stack/docs/plans/reviews/2026-09-10_m20-publication-regression-verdict.md

M20-I2-PUBLICATION-GATES-FILBERT-1 (#1500) — regression applicability verdict

Reviewer: Filbert. Candidate unchanged at manifest 11255dd4…; execution in a disposable baseline 27e4873a + reviewed-overlay tree with clean HOME and scrubbed MOSAIC_* environment. No real Pi, credentials, network model calls, Docker builds/releases, services, source edits, commits, or shared logs. This verdict owns regression applicability/reconciliation feedback; publication decisions remain the coordinator's and the owner's.

Independently executed, exact reviewed overlay

• Foundation: scripts/test-foundation.sh — 43 passed, 0 failed. Inspected first: sandboxed mkdtemp, synthetic fixtures, subprocess spawns of the inspector only, canary non-disclosure checks; no Docker/network/credential surface.
• Conductor: scripts/test-conductor.sh — 17 passed, 0 failed. Inspected first: all git operations target sandbox clones with a sandbox config and mock adapter. Two failures during my runs were artifacts of my own disposable method, documented for the record: an archive tree lacks .git (fixed with a scratch init) and a scrubbed HOME lacks the git identity the apply step needs (fixed with explicit identity env). Neither touched the candidate.
• Config: 24/24; Auth: 15/15 — both in the isolated environment. Package+launcher 74/74 was reproduced in this same overlay tree during the final increment review.

These four gates are satisfied by independent evidence on the exact reviewed bytes.

Not executed, with source evidence

• test-task.sh requires the real container path with a real model and live Pi recall ("Live recall: real pi, real phrasing", the unconditional block at lines ~480+). Executing it would exceed this review's authorization (real Docker, model calls, credentials). Applicability analysis instead:
  • Nothing outside the package references it: no packages/mosaic/@mosaic/registry import exists in scripts/, src/, compose.yaml, or the root manifest. The fixture-only package is unintegrated; the task pipeline cannot execute any changed code.
  • The suite's one failing check ("no agent identity on headless run") predates this work entirely — increment 1 recorded byte-identical failure parity at stashed baseline 54c12312.
  • The mechanism is now independently reproduced by me, not just asserted: compose.yaml:26 forwards host MOSAIC_AGENT_NAME into the container, and src/load-contracts.sh emits an AGENT IDENTITY section if and only if that variable is set (my synthetic control: set → section present; unset → absent). The variable is present in the host environment. The historical failure is host-environment contamination through compose, unrelated to this package; its fix (env hygiene in the task launch path) is separate scoped work.
• test-release.sh with Docker available (it is up on this host) takes the real-activation path: image builds and activation drills. The increment's diff is packages/mosaic plus review documents only — no RELEASE, compose, scripts, or packaging-surface change — and image rebuild is out of charter scope. The release-relevant surface (the pi pin) was last changed in increment 1, whose release run was independently green at that candidate and is published.

Recommendation — owner disposition required, no waiver

The charter's task and release gates cannot be satisfied by offline evidence for this slice, and I do not waive them. Two honest paths, either of which needs an explicit owner record before publication:

1. Task gate: record that the suite is not applicable to this unintegrated fixture-only package (zero shared code paths), that its single failure is pre-existing with a now-reproduced contamination mechanism and a separately scoped fix, and that a full rerun requires an authorized Docker/model window if the owner wants end-to-end evidence.
2. Release gate: record that the release surface is unchanged since increment 1's green run and image rebuild is out of scope — or, if the owner wants release evidence against the integrated tree, authorize a Docker window for the real-activation suite.

A silent "baseline waiver" would be the wrong record: it would paper over a real, reproduced environment leak that deserves its own fix task regardless of this increment.

Bottom line

Foundation, conductor, config, auth, package, and launcher gates: green by independent rerun on the exact reviewed overlay. Task and release: not executable within this review's safety envelope; applicability is documented above with source evidence and a reproduced mechanism; the owner should choose the disposition path before publication. Production refresh remains excluded.