feat(kbn): land KBN-101 Envelope A v6 (rc.20) — declarative sink-RBAC + RLS write-source (Form A) #902

Merged

Mos merged 3 commits from feat/kbn-101-envelope-a-formA into main 2026-07-25 23:58:19 +00:00

Conversation 3 Commits 3 Files Changed 5 +443 -40

jason.woltje commented 2026-07-25 23:14:00 +00:00

Owner

Copy Link

Summary

Lands KBN-101 Envelope A v6 (rc.20) as a contract-doc-only amendment of the frozen native-kanban SSOT, applied FORM A (apply-in-place) per Mos's ruling. It ratifies the converged declarative sink-RBAC layer: fixed User / Orchestrator / others runtime rung-roles (per-ROLE, deny-by-default), per-role connection-selection, RLS WITH CHECK/USING write-source policies, FORCE ROW LEVEL SECURITY, and a sink-resident task_status_write_override table on tasks — a §10 schema-v1 mechanism addition beyond the prior grant/revoke-only model.

No per-federated-user DB topology is introduced (cardinality stays fixed at 3; override keyed (workspace_id, task_id, tier), never per-writer; attribution → task_events.actor_id metadata). HALT boundary respected.

Scope: contract docs only — no code, no CI fixture, no KBN-100 file/row invention. All actual DDL/code lands later in the implementation cards (KBN-101-00/01/02/03/05/06/10, KBN-100, -08/-09).

Per-file changes (docs/native-kanban-sot/)

• KBN-101-DB-ROLE-SPLIT.md — §4 role table (+4 rung rows: 2 capability + 2 LOGIN), role-table F2 note; §4 L176 CONNECT allowlist (+mosaic_runtime_user/mosaic_runtime_orchestrator; either→any of the three TEMPORARY fix; inline [NB-5] baseline grants); §4 closing rc.20 amendment block + frozen-invariant note; §5 secret matrix (+2 rung DSN rows); §7 manifest (+KBN-101-10 row, ,10 dep-edges on -02/-03/-05/-06/-08, closing-sentence including KBN-101-10 clause).
• SHARED-CONTRACT.md — rc.6 + rc.5 "Non-effect" pointer clauses (except as amended by rc.20 — see below); new ### 1.0.0-rc.20 changelog entry.
• MISSION-MANIFEST.md — §10 change-control audit-trail note recording this as the authorized schema-v1 change instance.
• INDEX.md — index row for the ratified envelope doc.
• KBN-101-ENVELOPE-A.md (new) — converged v6 envelope text carried verbatim, header marked RATIFIED / part of the frozen SSOT as of this PR.

Ratification lineage (authoritative)

Jason B1 ruling (2026-07-20T23:08Z) + Mos OPTION A (home the layer) + Mos Q1 ruling (TIER-LEVEL) + Mos Q2 ruling (RLS WITH CHECK AUTHORIZED, two mandatory conditions — ENABLE/FORCE ROW LEVEL SECURITY as the terminal migration step, and non-owner rung roles) + Gate A (a11a1e2c) + Gate B (a6aac2cd).

Discrepancy flags resolved in-text: rc.5 and rc.6 non-effect lines both carry the amendment pointer; the CONNECT-allowlist "either" wording corrected for three application logins.

Notes

• Form A apply-in-place; ratified amendment; HALT-clear per envelope §0–§1.
• Please do not self-review/merge — independent reviewer required (author ≠ reviewer on a contract-amendment doc-PR).

Closes #771
Links #769

## Summary Lands **KBN-101 Envelope A v6 (rc.20)** as a **contract-doc-only** amendment of the frozen native-kanban SSOT, applied **FORM A (apply-in-place)** per Mos's ruling. It ratifies the converged declarative sink-RBAC layer: fixed **User / Orchestrator / others** runtime rung-roles (per-ROLE, deny-by-default), per-role connection-selection, **RLS `WITH CHECK`/`USING` write-source policies**, `FORCE ROW LEVEL SECURITY`, and a sink-resident **`task_status_write_override`** table on `tasks` — a §10 schema-v1 *mechanism addition* beyond the prior grant/revoke-only model. No per-federated-user DB topology is introduced (cardinality stays fixed at 3; override keyed `(workspace_id, task_id, tier)`, never per-writer; attribution → `task_events.actor_id` metadata). HALT boundary respected. **Scope: contract docs only — no code, no CI fixture, no KBN-100 file/row invention.** All actual DDL/code lands later in the implementation cards (KBN-101-00/01/02/03/05/06/10, KBN-100, -08/-09). ## Per-file changes (`docs/native-kanban-sot/`) - **`KBN-101-DB-ROLE-SPLIT.md`** — §4 role table (+4 rung rows: 2 capability + 2 LOGIN), role-table F2 note; §4 L176 CONNECT allowlist (+`mosaic_runtime_user`/`mosaic_runtime_orchestrator`; `either`→`any of the three` TEMPORARY fix; inline **[NB-5]** baseline grants); §4 closing **rc.20** amendment block + frozen-invariant note; §5 secret matrix (+2 rung DSN rows); §7 manifest (+`KBN-101-10` row, `,10` dep-edges on -02/-03/-05/-06/-08, closing-sentence **including KBN-101-10** clause). - **`SHARED-CONTRACT.md`** — rc.6 + rc.5 "Non-effect" pointer clauses (`except as amended by rc.20 — see below`); new `### 1.0.0-rc.20` changelog entry. - **`MISSION-MANIFEST.md`** — §10 change-control audit-trail note recording this as the authorized schema-v1 change instance. - **`INDEX.md`** — index row for the ratified envelope doc. - **`KBN-101-ENVELOPE-A.md`** (new) — converged v6 envelope text carried **verbatim**, header marked **RATIFIED / part of the frozen SSOT as of this PR**. ## Ratification lineage (authoritative) **Jason B1 ruling (2026-07-20T23:08Z)** + **Mos OPTION A** (home the layer) + **Mos Q1 ruling (TIER-LEVEL)** + **Mos Q2 ruling (RLS `WITH CHECK` AUTHORIZED, two mandatory conditions — `ENABLE`/`FORCE ROW LEVEL SECURITY` as the terminal migration step, and non-owner rung roles)** + **Gate A (`a11a1e2c`)** + **Gate B (`a6aac2cd`)**. Discrepancy flags resolved in-text: rc.5 **and** rc.6 non-effect lines both carry the amendment pointer; the CONNECT-allowlist "either" wording corrected for three application logins. ## Notes - Form A apply-in-place; ratified amendment; **HALT-clear per envelope §0–§1**. - Please do not self-review/merge — independent reviewer required (author ≠ reviewer on a contract-amendment doc-PR). Closes #771 Links #769

jason.woltje added 1 commit 2026-07-25 23:14:01 +00:00

feat(kbn): land KBN-101 Envelope A v6 (rc.20) — declarative sink-RBAC + RLS write-source (Form A) ... e4de82a5b1

Form A apply-in-place amendment of the frozen native-kanban SSOT, ratifying
the converged KBN-101 Envelope A v6 (rc.20): declarative sink-RBAC + per-role
connection-selection + RLS WITH CHECK/USING write-source + FORCE ROW LEVEL
SECURITY + sink-resident task_status_write_override table on `tasks`.

Contract-doc only — no code, no CI fixture, no KBN-100 file/row invention.

Files:
- KBN-101-DB-ROLE-SPLIT.md: §4 role table (+4 rung rows), role-table F2 note,
  §4 L176 CONNECT allowlist (+2 logins; "either"->"any of the three" + NB-5
  inline grants), §4 closing rc.20 block + frozen-invariant note, §5 secret
  matrix (+2 rung DSN rows), §7 manifest (+KBN-101-10 row, +,10 dep edges on
  -02/-03/-05/-06/-08, closing-sentence clause).
- SHARED-CONTRACT.md: rc.6 + rc.5 "Non-effect" pointer clauses; new
  ### 1.0.0-rc.20 changelog entry.
- MISSION-MANIFEST.md: §10 change-control audit-trail note.
- INDEX.md: index row for the ratified envelope doc.
- KBN-101-ENVELOPE-A.md (new): converged v6 envelope text, verbatim, marked
  RATIFIED / part of the frozen SSOT as of this PR.

Ratification lineage: Jason B1 ruling (2026-07-20T23:08Z) + Mos OPTION A +
Mos Q1 (TIER-LEVEL) + Mos Q2 (RLS WITH CHECK, two mandatory conditions) +
Gate A (a11a1e2c) + Gate B (a6aac2cd). HALT-clear per envelope §0-§1.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0158NZqN2n2ymKFeJAZ4GUCb

jason.woltje added 1 commit 2026-07-25 23:18:08 +00:00

docs(kbn): mark rung DSN Vault subpaths PROVISIONAL-CONVENTION (Mos touch-up) ... 86e00e1757

Per Mos ruling: do not silently freeze the inferred Vault subpaths for the two
new rung DSN secrets. Annotate the §5 secret-matrix rows for
`.../database/runtime-user` and `.../database/runtime-orchestrator` as
PROVISIONAL-CONVENTION — exact subpaths TO-CONFIRM against the live Vault
layout at KBN-101-03/-05 implementation. The secret NAMES remain envelope-fixed;
only the subpath is provisional. Annotation-only; no other edits.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0158NZqN2n2ymKFeJAZ4GUCb

jason.woltje commented 2026-07-25 23:22:04 +00:00

Author

Owner

Copy Link

Record of Review — PR #902 (KBN-101 Envelope A v6 / rc.20, Form A apply-in-place; Closes #771, links #769)

VERDICT: APPROVE (GO on CI terminal-green). Reviewer: independent subagent a45ed7d4 (ms-lead-reviewer), opus, per LANDING-SPEC §3/§4 — ≠ builder (a272a5f2, commit-author mosaic-coder).
REVIEWED-HEAD (full-40): 86e00e175776bfac62e2609e034dc3e16694a857. Reviewer detected the mid-review head-move (from e4de82a5…), characterized the +1 commit as the Mos-directed PROVISIONAL-CONVENTION annotation (2 lines, KBN-101-DB-ROLE-SPLIT.md §5; e4de82a5 is a clean-FF ancestor), and re-verified the new head — APPROVE applies to 86e00e17.

Per-criterion (all PASS, per LANDING-SPEC §3/§4)

1. Scope — exactly the 5 docs/native-kanban-sot/ files (INDEX, KBN-101-DB-ROLE-SPLIT, KBN-101-ENVELOPE-A new, MISSION-MANIFEST §10 only, SHARED-CONTRACT); ZERO code; no §1-9 / TASKS / contracts touched.
2. Anchored edits correct — word-diff isolated every change: §4 role table +4 rungs verbatim, CONNECT allowlist +2 logins + "either"→"any of the three" + NB-5 grants, §4 rc.20 block + frozen-invariant note, §5 +2 DSN rows correctly anchored, §7 +KBN-101-10 row + 5 dep-edges + closing clause. NO wrong-anchor corruption; frozen adjacent text intact.
3. Envelope verbatim — KBN-101-ENVELOPE-A.md body BYTE-IDENTICAL to v6 source; only +8-line RATIFIED preamble differs (allowed). Header RATIFIED.
4. Lineage complete — 4-part chain (Jason B1 2026-07-20T23:08Z + Mos OPTION A + Q1 TIER-LEVEL + Q2 RLS-2-conditions) at every override site (rc.20 block, frozen-invariant note, SHARED-CONTRACT rc.20 Authority); Gate A (a11a1e2c) + Gate B (a6aac2cd) in the new doc + PR body.
5. §1.9 flags resolved — rc.5 AND rc.6 non-effect both pointered+disambiguated; either→any-of-three; no invented KBN-100 row; flag #4 now PROVISIONAL-CONVENTION (86e00e17); anchor-drift moot.
6. HALT-boundary held — fixed 3-rung set, tighten-only RLS, override keyed (workspace_id,task_id,tier) never per-writer, attribution→task_events.actor_id; NO per-federated-user role/credential/topology.
7. State/linkage — open, mergeable, base main; body Closes #771 + links #769; commit-author mosaic-coder ≠ reviewer.
8. Firewall — "Jason" = required authority-lineage citation + consistent w/ pre-existing frozen product content ("Human decision owner: Jason"); a product-contract SSOT naming its human decision authority is NOT a framework-firewall/secret leak. No secrets/keys/paths/emails in added lines.

Mos rulings applied (this cycle)

INDEX-row hybrid KEEP (discoverability) · Vault subpaths PROVISIONAL-CONVENTION annotated (not silently frozen; TO-CONFIRM at KBN-101-03/-05) · Jason-lineage CONFIRMED-OK.

Gate

CI at 86e00e17 PENDING (docs-only → expected green). GO for id-11 + merge at FULL-40 86e00e175776bfac62e2609e034dc3e16694a857 on terminal-green (6-check #2/#4: reviewed==CI==merge-head all 86e00e17; reviewer read this exact head). I relay on green; Mos stamps id-11 + merges. Non-executor.

# Record of Review — PR #902 (KBN-101 Envelope A v6 / rc.20, Form A apply-in-place; Closes #771, links #769) **VERDICT: APPROVE** (GO on CI terminal-green). **Reviewer:** independent subagent `a45ed7d4` (`ms-lead-reviewer`), opus, per LANDING-SPEC §3/§4 — ≠ builder (`a272a5f2`, commit-author `mosaic-coder`). **REVIEWED-HEAD (full-40):** `86e00e175776bfac62e2609e034dc3e16694a857`. Reviewer detected the mid-review head-move (from `e4de82a5…`), characterized the +1 commit as the Mos-directed PROVISIONAL-CONVENTION annotation (2 lines, KBN-101-DB-ROLE-SPLIT.md §5; e4de82a5 is a clean-FF ancestor), and **re-verified the new head** — APPROVE applies to 86e00e17. ## Per-criterion (all PASS, per LANDING-SPEC §3/§4) 1. **Scope** — exactly the 5 `docs/native-kanban-sot/` files (INDEX, KBN-101-DB-ROLE-SPLIT, KBN-101-ENVELOPE-A new, MISSION-MANIFEST §10 only, SHARED-CONTRACT); ZERO code; no §1-9 / TASKS / contracts touched. 2. **Anchored edits correct** — word-diff isolated every change: §4 role table +4 rungs verbatim, CONNECT allowlist +2 logins + "either"→"any of the three" + NB-5 grants, §4 rc.20 block + frozen-invariant note, §5 +2 DSN rows correctly anchored, §7 +KBN-101-10 row + 5 dep-edges + closing clause. NO wrong-anchor corruption; frozen adjacent text intact. 3. **Envelope verbatim** — KBN-101-ENVELOPE-A.md body BYTE-IDENTICAL to v6 source; only +8-line RATIFIED preamble differs (allowed). Header RATIFIED. 4. **Lineage complete** — 4-part chain (Jason B1 2026-07-20T23:08Z + Mos OPTION A + Q1 TIER-LEVEL + Q2 RLS-2-conditions) at every override site (rc.20 block, frozen-invariant note, SHARED-CONTRACT rc.20 Authority); Gate A (`a11a1e2c`) + Gate B (`a6aac2cd`) in the new doc + PR body. 5. **§1.9 flags resolved** — rc.5 AND rc.6 non-effect both pointered+disambiguated; either→any-of-three; no invented KBN-100 row; flag #4 now PROVISIONAL-CONVENTION (86e00e17); anchor-drift moot. 6. **HALT-boundary held** — fixed 3-rung set, tighten-only RLS, override keyed (workspace_id,task_id,tier) never per-writer, attribution→task_events.actor_id; NO per-federated-user role/credential/topology. 7. **State/linkage** — open, mergeable, base main; body `Closes #771` + links #769; commit-author mosaic-coder ≠ reviewer. 8. **Firewall** — "Jason" = required authority-lineage citation + consistent w/ pre-existing frozen product content ("Human decision owner: Jason"); a product-contract SSOT naming its human decision authority is NOT a framework-firewall/secret leak. No secrets/keys/paths/emails in added lines. ## Mos rulings applied (this cycle) INDEX-row hybrid KEEP (discoverability) · Vault subpaths PROVISIONAL-CONVENTION annotated (not silently frozen; TO-CONFIRM at KBN-101-03/-05) · Jason-lineage CONFIRMED-OK. ## Gate CI at `86e00e17` PENDING (docs-only → expected green). **GO for id-11 + merge at FULL-40 `86e00e175776bfac62e2609e034dc3e16694a857` on terminal-green** (6-check #2/#4: reviewed==CI==merge-head all 86e00e17; reviewer read this exact head). I relay on green; Mos stamps id-11 + merges. Non-executor.

jason.woltje added 1 commit 2026-07-25 23:41:01 +00:00

style(kbn): prettier-format KBN-101 Envelope A SSOT docs (format:check clean) ... 354b695362

Apply repo prettier (3.8.1, .prettierrc) to the KBN-101 Envelope A contract
docs so CI `format:check` passes. Formatting-only:

- Whitespace, markdown table pipe/column alignment, separator-dash widths,
  emphasis-marker normalization (`*italic*` -> `_italic_`).
- One content-neutral fix required for prettier idempotency: the KBN-101-06
  row's `*future*` italic clashed with the literal underscore in `SCM_RIGHTS`
  in the same cell, making prettier non-idempotent (it oscillated
  `SCM_RIGHTS`<->`SCM*RIGHTS`). Dropped that single italic marker; the word
  "future" and every value are preserved.

Verified: no normative value/word/glob/path/number or table cell VALUE changed
in any of the 5 files (exhaustive substantive-char-stream + per-cell equality
vs the pre-format snapshot). All anchored contract edits (rc.20 block, CONNECT
allowlist, secret matrix + PROVISIONAL-CONVENTION annotations, §7 manifest,
SHARED rc.20 entry, RATIFIED preamble) intact. Only INDEX/DB-ROLE-SPLIT/
ENVELOPE-A changed; MISSION-MANIFEST/SHARED-CONTRACT already conformant.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0158NZqN2n2ymKFeJAZ4GUCb

jason.woltje commented 2026-07-25 23:43:14 +00:00

Author

Owner

Copy Link

Record of Review — PR #902 KBN Form A AFTER prettier-fix — full-40, supersedes RoR 18862

VERDICT: APPROVE (GO on CI terminal-green). Substance reviewer: a45ed7d4 (opus, per LANDING-SPEC §3/§4, all 8 PASS). ≠ builder (mosaic-coder).
REVIEWED-HEAD (full-40): 354b69536281f35f546ddd8bfb95a6fefd2d1bac.
Delta re-review (prettier) — PASS: delta from the substance-reviewed head (86e00e17) is FORMATTING-ONLY — prettier normalized whitespace / table pipe-alignment / emphasis markers (*x*→_x_) on 3 of 5 files. Independently verified: all key contract tokens PRESENT at 354b695 (PROVISIONAL-CONVENTION, ### 1.0.0-rc.20, KBN-101-10, "Jason B1 ruling", "any of the three"). One content-NEUTRAL fix: a single *future*→future italic drop (word preserved) required for prettier idempotency (SCM_RIGHTS underscore clash — known prettier emphasis bug). Builder proved exhaustively: zero normative value/word/glob/path/number/table-cell-value changed; all anchored contract edits intact. format:check clean (prettier 3.8.1, CI config), idempotent.
Mos rulings all applied: INDEX KEEP · Vault PROVISIONAL-CONVENTION annotated · Jason-lineage OK.
GO for id-11 at FULL-40 354b69536281f35f546ddd8bfb95a6fefd2d1bac on CI terminal-green (6-check: reviewed==CI==merge-head). Closes #771, links #769. Non-executor.

# Record of Review — PR #902 KBN Form A AFTER prettier-fix — full-40, supersedes RoR 18862 **VERDICT: APPROVE** (GO on CI terminal-green). **Substance reviewer:** `a45ed7d4` (opus, per LANDING-SPEC §3/§4, all 8 PASS). ≠ builder (`mosaic-coder`). **REVIEWED-HEAD (full-40):** `354b69536281f35f546ddd8bfb95a6fefd2d1bac`. **Delta re-review (prettier) — PASS:** delta from the substance-reviewed head (86e00e17) is FORMATTING-ONLY — prettier normalized whitespace / table pipe-alignment / emphasis markers (`*x*`→`_x_`) on 3 of 5 files. Independently verified: all key contract tokens PRESENT at 354b695 (PROVISIONAL-CONVENTION, `### 1.0.0-rc.20`, KBN-101-10, "Jason B1 ruling", "any of the three"). One content-NEUTRAL fix: a single `*future*`→`future` italic drop (word preserved) required for prettier idempotency (SCM_RIGHTS underscore clash — known prettier emphasis bug). Builder proved exhaustively: zero normative value/word/glob/path/number/table-cell-value changed; all anchored contract edits intact. format:check clean (prettier 3.8.1, CI config), idempotent. **Mos rulings all applied:** INDEX KEEP · Vault PROVISIONAL-CONVENTION annotated · Jason-lineage OK. **GO for id-11 at FULL-40 `354b69536281f35f546ddd8bfb95a6fefd2d1bac` on CI terminal-green (6-check: reviewed==CI==merge-head). Closes #771, links #769. Non-executor.**

Mos approved these changes 2026-07-25 23:58:17 +00:00

Mos left a comment

First-time contributor

Copy Link

GO — Gate-16 id-11 stamp, pinned to exact FULL head 354b695362. Basis: verbatim RoRs — substance APPROVE a45ed7d4 (LANDING-SPEC §3/§4, all 8 criteria, anchors verified no-drift, envelope byte-identical v6, full 4-part lineage) + delta re-review 18880 (prettier formatting-only, contract tokens independently re-verified). Mos flag-rulings applied: INDEX row kept, Vault subpaths PROVISIONAL-CONVENTION annotated (exact paths confirm at KBN-101-03/-05 impl), Jason-by-name lineage confirmed proper. Form A per Mos ruling with ratification lineage quoted. Closes #771. Named executor: Mos (id-11), squash pinned.

GO — Gate-16 id-11 stamp, pinned to exact FULL head 354b69536281f35f546ddd8bfb95a6fefd2d1bac. Basis: verbatim RoRs — substance APPROVE a45ed7d4 (LANDING-SPEC §3/§4, all 8 criteria, anchors verified no-drift, envelope byte-identical v6, full 4-part lineage) + delta re-review 18880 (prettier formatting-only, contract tokens independently re-verified). Mos flag-rulings applied: INDEX row kept, Vault subpaths PROVISIONAL-CONVENTION annotated (exact paths confirm at KBN-101-03/-05 impl), Jason-by-name lineage confirmed proper. Form A per Mos ruling with ratification lineage quoted. Closes #771. Named executor: Mos (id-11), squash pinned.

Mos merged commit dc45eb7c30 into main 2026-07-25 23:58:19 +00:00

Mos referenced this issue from a commit 2026-07-25 23:58:19 +00:00

feat(kbn): land KBN-101 Envelope A v6 (rc.20) — declarative sink-RBAC + RLS write-source (Form A) (#902)

Mos deleted branch feat/kbn-101-envelope-a-formA 2026-07-25 23:58:19 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Mos

Labels

Clear labels

fleet-enhancement

Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

jason.woltje

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: mosaicstack/stack#902