feat(mosaic): add per-estate repository-backed brain #1061

2026-08-05T20:10:42Z

be-coder-07 commented

2026-08-05 20:10:42 +00:00

Summary

Implements the repository-backed, per-estate Mosaic brain for #1051: target-derived estate selection, MC-CRED-mediated validation, provider-verified durable ownership, private local storage, fail-closed diagnostics, exact-snapshot migration controls, and append-only push-on-write publication.

Current source head: e91c8c06a5d49ac3443c02bafd53ec6259be5114 (16 commits / 25 files against main at 85d2108e4ed15c744ad3b87a5b629e7b2d39405a; all commits authored and committed by be-coder-07).

Hard dependency and verification scope

#1061 remains merge-ordered behind #1059 (MC-CRED), but a fresh checkout now tracks the provider-fetched canonical estate-registry seam and its DTO dependencies instead of relying on an untracked scaffold. History confirms the imports were intentional: commit 2451c2f introduced both consumers, while the contemporaneous seam report explicitly marked the local 32-line parser as disposable and required MC-CRED's canonical implementation.

Three DTO files are byte-identical to #1059 head fbff4ffa. Author review found that the canonical parser accepted a trailing-slash origin which MB-BRAIN consumers concatenate into double-slash URLs; this branch adds a RED-first rejection control and requires the configured value to equal URL.origin. That hardening must be propagated to #1059 before dependency convergence.

Full merged-system re-verification remains required after #1059 merges and MB-BRAIN rebases onto it. Reviewers remain held until then.

Evidence

Rebase patch IDs: /home/hermes/agent-work/be-coder-07/MB-BRAIN-REBASE-PATCH-ID-BEFORE.txt and /home/hermes/agent-work/be-coder-07/MB-BRAIN-REBASE-PATCH-ID-AFTER.txt
Rebase trailers: /home/hermes/agent-work/be-coder-07/MB-BRAIN-REBASE-TRAILERS.log
Final pre-rebase report: /home/hermes/agent-work/be-coder-07/REPORT-MB-BRAIN-FROZEN-HEAD.md
Security convergence: /home/hermes/agent-work/be-coder-07/REPORT-MB-BRAIN-SECURITY-CONVERGENCE.md
Nullable measurement sweep: /home/hermes/agent-work/be-coder-07/MB-BRAIN-NULLABLE-MEASUREMENT-SWEEP.log

Advisory disposition

FIXED

Alternate-index checkout desynchronization, including clean-checkout and real concurrent non-fast-forward controls.
Nullable Git measurements being treated as false/ready; remote, branch, and status failures now produce an indeterminate finding.
Publication through an existing noncanonical .gitignore.
Owner-accessible brain roots/layout directories; principal ownership and mode 0700 are enforced and diagnosed.

DEFERRED

Root installer P7 integration remains gated on the required order C1 → MC-CRED → MB-BRAIN.
P7's four pre-registered integration tests are INTENTIONALLY RED until C1 and MC-CRED are integrated. They must not be weakened or removed.
Live R3 grant and R4 principal-owned round-trip validation remain gated on merged, operational MC-CRED.
All canonical verification and independent rev-974 / rev-security-02 review remain held until the real MC-CRED dependency is tracked on the rebased branch.
Three unrelated full-package CLI smoke failures caused by the ambient update-available stderr banner remain disclosed for later adjudication.

Delivery status

Refs #1051. Status remains believed-fixed, pending jarvis validation. The issue remains open through merge, and the source branch is preserved while deferred integration and validation remain outstanding.

Exact-head CI dependency remediation

Pipeline #2222 at a50b5a6b ran the only pull-request-eligible workflow (ci, 1/3 defined workflows) and failed typecheck with two TS2307 errors before lint, format, or tests ran. Base pipeline #2221 ran the byte-identical ci/typecheck workflow at 85d2108e and passed 45/45 tasks, proving the failure was introduced by #1061 rather than pre-existing.

RED-first root typecheck reproduced the two missing-module errors. Tracking the canonical module returned typecheck to 45/45 tasks. R7 deleting the module returned RED with three missing-module errors; restoration returned GREEN. Author review's trailing-slash finding was separately RED-first and remediated. Final author advisories: code approve, zero findings; security risk none, zero findings.

With typecheck no longer suppressing downstream execution:

lint: 25/25 tasks
format: passed
build: 25/25 tasks
focused registry + MB-BRAIN behavior: 102/102
full tests: 1,607/1,614; four failures are the pre-registered P7 integration controls held for C1/MC-CRED integration, and three are the previously disclosed ambient update-banner CLI smoke failures. No test was weakened.

This is a second independent instance of the #1068 suppression class: an early integrity failure prevented all downstream stages carrying behavioral evidence while the aggregate workflow still looked like a completed check. Workflow ordering is not changed here; that remains #1068 scope.

## Summary Implements the repository-backed, per-estate Mosaic brain for #1051: target-derived estate selection, MC-CRED-mediated validation, provider-verified durable ownership, private local storage, fail-closed diagnostics, exact-snapshot migration controls, and append-only push-on-write publication. Current source head: `e91c8c06a5d49ac3443c02bafd53ec6259be5114` (16 commits / 25 files against `main` at `85d2108e4ed15c744ad3b87a5b629e7b2d39405a`; all commits authored and committed by `be-coder-07`). ## Hard dependency and verification scope #1061 remains merge-ordered behind #1059 (MC-CRED), but a fresh checkout now tracks the provider-fetched canonical estate-registry seam and its DTO dependencies instead of relying on an untracked scaffold. History confirms the imports were intentional: commit `2451c2f` introduced both consumers, while the contemporaneous seam report explicitly marked the local 32-line parser as disposable and required MC-CRED's canonical implementation. Three DTO files are byte-identical to #1059 head `fbff4ffa`. Author review found that the canonical parser accepted a trailing-slash origin which MB-BRAIN consumers concatenate into double-slash URLs; this branch adds a RED-first rejection control and requires the configured value to equal `URL.origin`. That hardening must be propagated to #1059 before dependency convergence. Full merged-system re-verification remains required after #1059 merges and MB-BRAIN rebases onto it. Reviewers remain held until then. ## Evidence - Rebase patch IDs: `/home/hermes/agent-work/be-coder-07/MB-BRAIN-REBASE-PATCH-ID-BEFORE.txt` and `/home/hermes/agent-work/be-coder-07/MB-BRAIN-REBASE-PATCH-ID-AFTER.txt` - Rebase trailers: `/home/hermes/agent-work/be-coder-07/MB-BRAIN-REBASE-TRAILERS.log` - Final pre-rebase report: `/home/hermes/agent-work/be-coder-07/REPORT-MB-BRAIN-FROZEN-HEAD.md` - Security convergence: `/home/hermes/agent-work/be-coder-07/REPORT-MB-BRAIN-SECURITY-CONVERGENCE.md` - Nullable measurement sweep: `/home/hermes/agent-work/be-coder-07/MB-BRAIN-NULLABLE-MEASUREMENT-SWEEP.log` ## Advisory disposition ### FIXED - Alternate-index checkout desynchronization, including clean-checkout and real concurrent non-fast-forward controls. - Nullable Git measurements being treated as false/ready; remote, branch, and status failures now produce an indeterminate finding. - Publication through an existing noncanonical `.gitignore`. - Owner-accessible brain roots/layout directories; principal ownership and mode `0700` are enforced and diagnosed. ### DEFERRED - Root installer P7 integration remains gated on the required order **C1 → MC-CRED → MB-BRAIN**. - P7's **four pre-registered integration tests are INTENTIONALLY RED** until C1 and MC-CRED are integrated. They must not be weakened or removed. - Live R3 grant and R4 principal-owned round-trip validation remain gated on merged, operational MC-CRED. - All canonical verification and independent `rev-974` / `rev-security-02` review remain held until the real MC-CRED dependency is tracked on the rebased branch. - Three unrelated full-package CLI smoke failures caused by the ambient update-available stderr banner remain disclosed for later adjudication. ## Delivery status Refs #1051. Status remains **believed-fixed, pending jarvis validation**. The issue remains open through merge, and the source branch is preserved while deferred integration and validation remain outstanding. ## Exact-head CI dependency remediation Pipeline `#2222` at `a50b5a6b` ran the only pull-request-eligible workflow (`ci`, 1/3 defined workflows) and failed `typecheck` with two `TS2307` errors before lint, format, or tests ran. Base pipeline `#2221` ran the byte-identical `ci/typecheck` workflow at `85d2108e` and passed 45/45 tasks, proving the failure was introduced by #1061 rather than pre-existing. RED-first root typecheck reproduced the two missing-module errors. Tracking the canonical module returned typecheck to 45/45 tasks. R7 deleting the module returned RED with three missing-module errors; restoration returned GREEN. Author review's trailing-slash finding was separately RED-first and remediated. Final author advisories: code `approve`, zero findings; security risk `none`, zero findings. With typecheck no longer suppressing downstream execution: - lint: 25/25 tasks - format: passed - build: 25/25 tasks - focused registry + MB-BRAIN behavior: 102/102 - full tests: 1,607/1,614; four failures are the pre-registered P7 integration controls held for C1/MC-CRED integration, and three are the previously disclosed ambient update-banner CLI smoke failures. No test was weakened. This is a second independent instance of the `#1068` suppression class: an early integrity failure prevented all downstream stages carrying behavioral evidence while the aggregate workflow still looked like a completed check. Workflow ordering is not changed here; that remains #1068 scope.

be-coder-07 added 15 commits 2026-08-05 22:21:21 +00:00

test(#1051 ): preregister mosaic-brain acceptance contract 01694f3f98

test(installer): preregister durable brain P7 integration c6329ec91e

feat(mosaic): provision per-estate durable brain 2451c2f21a

fix(mosaic): harden brain migration snapshots fcfc1b08f9

fix(mosaic): exclude nested secret migration paths 351cb67cec

fix(mosaic): hold brain migration destinations by descriptor 6afb3cb5b3

fix(mosaic): fail closed on unsafe brain cleanup and config 656fa9ceb7

fix(mosaic): bound brain migration and owner lookups 836aab1ab5

fix(mosaic): quarantine unscanned brain state fb7087b3eb

fix(mosaic): isolate brain publication index f0555016f4

fix(mosaic): bind brain commits to approved blobs 877473c244