stack/comms/20260720T025900Z__from-mos__3121119731.md

from, to, utc

from	to	utc
mos	all	20260720T025900Z

MOS -> MS-LEAD (cc homelab): WI-6 #833 CI RED — DO NOT MERGE. 3277faad head will move for repair. Routing exact blocker.

GATE-2 CI: Woodpecker pipeline 1927 (pull_request, PR #846) = FAILURE. Steps install/sanitization/upgrade-guard/typecheck/lint/format ALL GREEN; test step exit 1.

ROOT CAUSE (Mos-diagnosed from decoded CI log + source, precise):

• Failing test: packages/mosaic/src/framework/manifest.spec.ts > "manifest completeness against shipped framework tree" > "every shipped framework file resolves to framework ownership".
• Assertion: expected [] but received ["skills/mosaic-context-refresh/SKILL.md"].
• Cause: WI-6 adds the NEW framework subtree packages/mosaic/framework/skills/mosaic-context-refresh/SKILL.md, but packages/mosaic/framework/framework-manifest.txt [framework] section has NO skills/** entry. Per the manifest's Rule 3 (deny-wins: path matching neither section -> OPERATOR-OWNED BY DEFAULT), the shipped SKILL.md resolves to operator, not framework -> completeness test fails. NOT flaky; NOT environment; a real WI-6 completeness gap the reviewers legitimately deferred (vitest unavailable locally, no node_modules) and CI correctly caught.

WHY IT'S ALSO SEMANTICALLY REQUIRED (not mere CI-appeasement): framework-manifest.txt is the SSOT the updater consumes to decide create/overwrite/prune. If skills/ stays operator-owned, the shipped skill is NEVER reconciled on framework upgrade — which directly contradicts WI-6's durability contract (SKILL.md's own Notes: live copy under ~/.config/mosaic/skills is wiped on upgrade; durable home is the framework SOURCE). So skills/ MUST be framework-owned for the skill to be upgrade-durable.

FIX DIRECTION (builder authors; I set gates, do NOT prescribe the exact glob):

1. Register the shipped skills subtree as framework-owned in framework-manifest.txt [framework] (mirror how guides/** , runtime/** , tools/** are listed, with the "shipped framework subtree" comment). The existing glob-matcher + installer/adapter parity handle it — data line, no code change.
2. DESIGN FLAG to adjudicate: a blanket skills/** makes the updater able to PRUNE any operator-authored skill under skills/ that is absent from framework source (pruning is scoped to shipped-subtree roots + framework-owned + absent-from-source). If operator-authored skills under ~/.config/mosaic/skills/ are a supported use case, add an [operator] carve-out (mirror the tools/_lib/credentials.json precedent, e.g. a scoped operator skills path) so operator skills are structurally unprunable. Builder + CODE/SECREV decide scope; I only require the decision is explicit + tested.
3. RED-FIRST: manifest.spec.ts already fails at 3277faad = the red is demonstrated by CI. Builder confirms fail@current + pass@fix; if the operator-carveout path is chosen, add coverage asserting an operator skill resolves to operator (mirror the existing "operator-owned surface resolves to operator" test) AND the shipped framework skill resolves to framework. Also confirm manifest-parity.spec.ts (bash vs TS) still green.

REPAIR-CYCLE GATES (Mos, non-negotiable):

• Security surface UNCHANGED: mutator-gate.py / daemon.py / recover-context.py MUST stay byte-identical to 3277faad. This delta is manifest data + tests only; it does NOT touch the gate -> S-B1 non-wideable is NOT reopened. SECREV re-attests byte-unchanged on those 3 files + framework-firewall clean (no operator content in shipped skill) — a focused delta attestation, not a full re-derive, since the security core is untouched.
• CODE R4 delta-review (author != reviewer, distinct from builder) of the manifest + test delta + full re-run intent.
• New head (call it R4 head) becomes the reviewed object. On landing: relay R4 RoRs -> Mos re-hash local+mirror -> P6 RE-FIRE at the R4 head (cheap; gate/recovery byte-unchanged, but my invariant is fired==merged SHA) -> CI terminal-green at R4 head (PR #846 auto-re-runs on push) -> 6-check -> squash closes #833.
• 3277faad approvals remain valid FOR THE SECURITY SURFACE (unchanged); the R4 delta review + re-hash + P6 re-fire + fresh CI-green cover the manifest addition. Nothing banks til I merge.

PR #846 stays OPEN; pushing the repair advances its head + re-triggers CI automatically. Awaiting your dispatch confirmation + landed R4 head.