mosaicstack/stack
21
0
Fork 1
Code Issues 338 Pull Requests 13 Actions Packages Projects Releases 15 Wiki Activity

WI-7 #834: T-C server-side branch-protection posture + R1 honesty amendment #847

Merged
jason.woltje merged 1 commits from feat/834-tc-server-side-doc into main 2026-07-20 04:20:03 +00:00
Conversation 1 Commits 1 Files Changed 3
+67 -1
jason.woltje commented 2026-07-20 04:10:55 +00:00
Owner
Copy Link
Copy Source

WI-7 #834 — T-C server-side branch-protection posture + R1 honesty amendment

closes #834

Milestone-188 (Compaction directive-freshness) WI-7. Functional/doc surface — NOT a peercred/gate/receipt security surface (per issue #834): no Opus-SECREV, no P6/Gate0 fire.

Deliverable

  • T-C server-side branch-protection posture (docs/architecture/compaction-revocation.md): documents that main push-blocked / PR-only-merge is MANDATORY regardless of client-gate state (client gate is window-narrowing only; server-side protected-branch is the irreducible guarantee); status-check + approval enforcement RECOMMENDED. Current-vs-required gap recorded, not enacted: enable_push=False (core push-block holds) with require_approvals=0 / enable_status_check=False / block_on_official_review=False documented as the gap — changing them is a separate owner-gated ops decision, NOT enacted by this doc.
  • R1 honesty amendment (docs/architecture/lease-broker-protocol.md): receipt detects ABSENT / PREFIX-TRUNCATED terminal token; a MIDDLE-DROP preserving the tail is a T-C contract violation that is NOT receipt-detectable — server-side-covered, with no category-wide receipt-detection claim.
  • T30 test (packages/mosaic/src/lease-broker/framework_skill_portability_unittest.py, +44/-0): dual-hook-miss contract rows + posture/R1 anchors; red-first (transplant to clean base fails on missing posture anchor).

Review of Record

  • CODE: ms-wi7-code (terra) — APPROVED, RoR sha256 8866052350583ebec440e586c1543de36b55e32e57744481e71c767f34f823ef (4189B), Mos-re-hashed byte-exact local + MS-LEAD independent bus-report agree. Zero findings.
  • Author≠reviewer by dispatch-record lane provenance: builder ms-wi7-build (terra:high) ≠ reviewer ms-wi7-code (terra) — NOT git-signer (shared ms-lead-reviewer identity).
  • Independent verify (3-way): Mos 8-check from source + MS-LEAD + homelab all PASS at pinned head 3831d5e377377400cd0fada9a6c6589dbcd98b94.

Gate evidence

  • Pure-forward descendant of main 2509eb7646efc708b74b8f7db465f78829ca7303 (merge-base == main tip, no rebase).
  • Scope: exactly 3 MODIFIED files, zero new (manifest-completeness trap structurally avoided).
  • 3 lease-broker gate files byte-unchanged (S-B1 not reopened). Firewall clean (0 operator-home/identity in added lines).
  • Authority hashes verified byte-exact: BUILD-BRIEF 89fdbc27 / SPEC-v5 a6d07ade / RATIFICATION bac58319 / red-team 3da326a4.
## WI-7 #834 — T-C server-side branch-protection posture + R1 honesty amendment closes #834 Milestone-188 (Compaction directive-freshness) WI-7. **Functional/doc surface — NOT a peercred/gate/receipt security surface** (per issue #834): no Opus-SECREV, no P6/Gate0 fire. ### Deliverable - **T-C server-side branch-protection posture** (`docs/architecture/compaction-revocation.md`): documents that `main` push-blocked / PR-only-merge is **MANDATORY regardless of client-gate state** (client gate is window-narrowing only; server-side protected-branch is the irreducible guarantee); status-check + approval enforcement **RECOMMENDED**. Current-vs-required gap **recorded, not enacted**: `enable_push=False` (core push-block holds) with `require_approvals=0` / `enable_status_check=False` / `block_on_official_review=False` documented as the gap — changing them is a separate owner-gated ops decision, NOT enacted by this doc. - **R1 honesty amendment** (`docs/architecture/lease-broker-protocol.md`): receipt detects **ABSENT / PREFIX-TRUNCATED** terminal token; a **MIDDLE-DROP preserving the tail** is a T-C contract violation that is **NOT receipt-detectable** — server-side-covered, with no category-wide receipt-detection claim. - **T30 test** (`packages/mosaic/src/lease-broker/framework_skill_portability_unittest.py`, +44/-0): dual-hook-miss contract rows + posture/R1 anchors; red-first (transplant to clean base fails on missing posture anchor). ### Review of Record - **CODE:** ms-wi7-code (terra) — **APPROVED**, RoR sha256 `8866052350583ebec440e586c1543de36b55e32e57744481e71c767f34f823ef` (4189B), Mos-re-hashed byte-exact local + MS-LEAD independent bus-report agree. Zero findings. - **Author≠reviewer** by dispatch-record **lane** provenance: builder `ms-wi7-build` (terra:high) ≠ reviewer `ms-wi7-code` (terra) — NOT git-signer (shared ms-lead-reviewer identity). - **Independent verify (3-way):** Mos 8-check from source + MS-LEAD + homelab all PASS at pinned head `3831d5e377377400cd0fada9a6c6589dbcd98b94`. ### Gate evidence - Pure-forward descendant of `main` `2509eb7646efc708b74b8f7db465f78829ca7303` (merge-base == main tip, no rebase). - Scope: exactly 3 MODIFIED files, zero new (manifest-completeness trap structurally avoided). - 3 lease-broker gate files byte-unchanged (S-B1 not reopened). Firewall clean (0 operator-home/identity in added lines). - Authority hashes verified byte-exact: BUILD-BRIEF `89fdbc27` / SPEC-v5 `a6d07ade` / RATIFICATION `bac58319` / red-team `3da326a4`.
jason.woltje added 1 commit 2026-07-20 04:10:56 +00:00
docs(#834): document T-C branch protection posture
ci/woodpecker/pr/ci Pipeline was successful
Details
3831d5e377
jason.woltje commented 2026-07-20 04:16:32 +00:00
Author
Owner
Copy Link
Copy Source

WI-7 #834 — EXACT-HEAD CODE REVIEW RECORD (durable provider binding)

Verdict: APPROVED (CODE, non-security functional/doc surface — NO Opus-SECREV, NO P6/Gate0 per issue #834 classification).

Reviewed head: 3831d5e377377400cd0fada9a6c6589dbcd98b94 · branch feat/834-tc-server-side-doc · base main 2509eb7646efc708b74b8f7db465f78829ca7303 · merge-base = 2509eb76 (pure-forward descendant, no rebase; head PINNED/UNMOVED at review + relay time).

Deliverable: T-C server-side branch-protection posture line + R1 receipt-honesty doc amendment + red-first T30 test. Diff = exactly 3 files MODIFIED, ZERO new files, +67/-1:

  • docs/architecture/compaction-revocation.md (+16/-0) — T-C posture + current-vs-required gap
  • docs/architecture/lease-broker-protocol.md (+7/-1) — R1 receipt boundary / T-C residual
  • packages/mosaic/src/lease-broker/framework_skill_portability_unittest.py (+44/-0) — red-first T30

Review gates (author ≠ reviewer)

CODE (ms-wi7-code, terra GPT): APPROVED. C1 scope-fence=Y · C2 3-security-files byte-unchanged=Y (mutator-gate.py/daemon.py/recover-context.py git diff --quiet exit 0 each; S-B1 untouched) · C3 manifest-trap-avoided=Y (zero added files under packages/mosaic/framework/) · C4 firewall-clean=Y (0 /home/, 0 operator-identity in added lines) · C5 red-first-additive=Y (base-transplant of head test FAILED@base at missing enable_status_check posture/gap anchor = genuine RED; head GREEN; +44/-0, no assertion weakened) · C6 content-correct+honest=Y (T-C: main push-blocked/PR-only MANDATORY regardless of client-gate, client-gate window-narrowing only, status/approval RECOMMENDED, enable_push=False core + 3 recommended-control gaps recorded-not-enacted owner-gated; R1: ABSENT/PREFIX-TRUNC detected, tail-preserving MIDDLE-DROP NOT receipt-detectable + server-side-covered + no category-wide claim) · C7 integrity=Y.
RoR WI7-834-CODE-3831d5e3.md sha256 8866052350583ebec440e586c1543de36b55e32e57744481e71c767f34f823ef (MS-LEAD verified byte-exact, 4189 bytes).

Provenance: author (ms-wi7-build terra:high) ≠ reviewer (ms-wi7-code terra), established by dispatch-record LANE provenance, NOT git-signer (commit signer is the shared ms-lead-reviewer identity).

Authority (verified byte-exact before review): BUILD-BRIEF 89fdbc27 · SPEC-v5 a6d07ade · SPEC-RATIFICATION bac58319 · SPEC-v5-redteam-sol 3da326a4.

Gates run vs deferred

Ran: python -m unittest framework_skill_portability_unittest.py 3/3 OK · py_compile OK · base-red-first transplant · git diff --check 2509eb76...HEAD clean.
Deferred → CI (terminal Gate-2, no green claimed locally): pnpm format:check (prettier not-found), pnpm typecheck/lint/test (turbo not-found).

Independent verification (three parties)

  • MS-LEAD: RoR sha256 byte-exact + head-unmoved + merge-base-clean + scope/security-byte/firewall/red-first re-checks.
  • Mos: 8-check from-source (ancestry/scope/security-byte/firewall/red-first/additive/content-honesty/§4) = PASS + review-dispatch GO + placement adjudicated ACCEPT.
  • homelab: exact landed-head verify PASS + exact-archived-head unittest 3/3 + 4 contract anchors absent@base; flagged provider-mirror binding (this record).

No live branch-protection mutation — current-vs-required gap is DOCUMENTED not enacted (separate owner-gated ops decision). Merge = Mos-owned (Gate 13/16) after local+mirror re-hash + exact-head Gate-2 CI green + 6-check + queue guard → squash closes #834. Posted by MS-LEAD as durable exact-head review binding per team discipline (pr-review gitea-comment broken, #812 → curl).

## WI-7 #834 — EXACT-HEAD CODE REVIEW RECORD (durable provider binding) **Verdict:** APPROVED (CODE, non-security functional/doc surface — NO Opus-SECREV, NO P6/Gate0 per issue #834 classification). **Reviewed head:** `3831d5e377377400cd0fada9a6c6589dbcd98b94` · branch `feat/834-tc-server-side-doc` · base `main` `2509eb7646efc708b74b8f7db465f78829ca7303` · merge-base = `2509eb76` (pure-forward descendant, no rebase; head PINNED/UNMOVED at review + relay time). **Deliverable:** T-C server-side branch-protection posture line + R1 receipt-honesty doc amendment + red-first T30 test. Diff = exactly 3 files MODIFIED, ZERO new files, `+67/-1`: - `docs/architecture/compaction-revocation.md` (+16/-0) — T-C posture + current-vs-required gap - `docs/architecture/lease-broker-protocol.md` (+7/-1) — R1 receipt boundary / T-C residual - `packages/mosaic/src/lease-broker/framework_skill_portability_unittest.py` (+44/-0) — red-first T30 ### Review gates (author ≠ reviewer) **CODE** (ms-wi7-code, terra GPT): **APPROVED**. C1 scope-fence=Y · C2 3-security-files byte-unchanged=Y (mutator-gate.py/daemon.py/recover-context.py `git diff --quiet` exit 0 each; S-B1 untouched) · C3 manifest-trap-avoided=Y (zero added files under packages/mosaic/framework/) · C4 firewall-clean=Y (0 `/home/`, 0 operator-identity in added lines) · C5 red-first-additive=Y (base-transplant of head test FAILED@base at missing `enable_status_check` posture/gap anchor = genuine RED; head GREEN; +44/-0, no assertion weakened) · C6 content-correct+honest=Y (T-C: main push-blocked/PR-only MANDATORY regardless of client-gate, client-gate window-narrowing only, status/approval RECOMMENDED, `enable_push=False` core + 3 recommended-control gaps recorded-not-enacted owner-gated; R1: ABSENT/PREFIX-TRUNC detected, tail-preserving MIDDLE-DROP NOT receipt-detectable + server-side-covered + no category-wide claim) · C7 integrity=Y. RoR `WI7-834-CODE-3831d5e3.md` sha256 `8866052350583ebec440e586c1543de36b55e32e57744481e71c767f34f823ef` (MS-LEAD verified byte-exact, 4189 bytes). **Provenance:** author (ms-wi7-build terra:high) ≠ reviewer (ms-wi7-code terra), established by dispatch-record LANE provenance, NOT git-signer (commit signer is the shared ms-lead-reviewer identity). **Authority (verified byte-exact before review):** BUILD-BRIEF `89fdbc27` · SPEC-v5 `a6d07ade` · SPEC-RATIFICATION `bac58319` · SPEC-v5-redteam-sol `3da326a4`. ### Gates run vs deferred Ran: `python -m unittest framework_skill_portability_unittest.py` 3/3 OK · `py_compile` OK · base-red-first transplant · `git diff --check 2509eb76...HEAD` clean. Deferred → CI (terminal Gate-2, no green claimed locally): `pnpm format:check` (prettier not-found), `pnpm typecheck`/`lint`/`test` (turbo not-found). ### Independent verification (three parties) - **MS-LEAD**: RoR sha256 byte-exact + head-unmoved + merge-base-clean + scope/security-byte/firewall/red-first re-checks. - **Mos**: 8-check from-source (ancestry/scope/security-byte/firewall/red-first/additive/content-honesty/§4) = PASS + review-dispatch GO + placement adjudicated ACCEPT. - **homelab**: exact landed-head verify PASS + exact-archived-head unittest 3/3 + 4 contract anchors absent@base; flagged provider-mirror binding (this record). **No live branch-protection mutation** — current-vs-required gap is DOCUMENTED not enacted (separate owner-gated ops decision). Merge = Mos-owned (Gate 13/16) after local+mirror re-hash + exact-head Gate-2 CI green + 6-check + queue guard → squash `closes #834`. Posted by MS-LEAD as durable exact-head review binding per team discipline (pr-review gitea-comment broken, #812 → curl).
jason.woltje merged commit 0582a8912b into main 2026-07-20 04:20:03 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
bug
Defect in framework tooling or delivered code
 fleet-enhancement
Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
code-be-01 (Mosaic fleet seat code-be-01) code-be-02 (Mosaic fleet seat code-be-02) code-dogfood-01 (Mosaic fleet seat code-dogfood-01) code-infra-01 (Mosaic fleet seat code-infra-01) fargo fred gate-merge-01 (Mosaic fleet seat gate-merge-01) happy jason.woltje (Jason Woltje) marcie merge-gate ops-01 (Mosaic fleet seat ops-01) ops-02 (Mosaic fleet seat ops-02) ops-03 (Mosaic fleet seat ops-03) ops-ci-01 (Mosaic fleet seat ops-ci-01) ops-deploy-01 (Mosaic fleet seat ops-deploy-01) orch-01 (Mosaic fleet seat orch-01) pepper resume rev-code-01 rev-code-02 rev-security-01 rev-security-02 rev-security-03 (Mosaic fleet seat rev-security-03) sanity scooby (Scooby) scrappy shaggy tiny topher (Mosaic fleet seat topher) velma veronica (Mosaic fleet seat veronica) vision woodpecker
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#847