WI-3 Scratchpad — Compaction revocation and runtime-generation rollover

Issue: Gitea #830
Branch: feat/830-compaction-revoke
Base HEAD: abd2791f59b3f06f46dd08e55298ced72f6aa7c2
Role: sol author/build lane only; terra CODE and Opus SECREV are coordinator-owned.

Mission prompt

Implement BUILD-BRIEF Deliverable 3.3 and D4 on merged WI-1/WI-2 under packages/mosaic/. Claude PreCompact and SessionStart(matcher=compact) plus Pi session_before_compact/context equivalents must revoke the active lease through the existing broker state machine. Any runtime_generation bump—including same-PID reload/resume/fork—must auto-revoke the prior incarnation so the new generation inherits no prior lease. M1 is Claude + Pi only.

Honor amended D2-v5 exactly: hard fail-closure when at least one observer fires or after lease expiry; both observers missing within TTL is an explicitly named bounded residual stale window (maximum 300 seconds, soak-tighten only), with no claim that the mutator gate bounds actions inside that window; total gate-hook miss is T-C. T12b/T30 must report both the within-TTL ALLOWED outcome and after-TTL DENIED outcome.

Session start verification

Worktree is clean on feat/830-compaction-revoke at exact required base abd2791f59b3f06f46dd08e55298ced72f6aa7c2; origin/main is the same SHA and includes merged WI-2 atop WI-1.
Authority SHA-256 verified:
- BUILD-BRIEF: 89fdbc27ed0e5050dc7b52f3ef2ddaea691edf17fd89d51b15e26fb5ed47171b
- SPEC-v5: a6d07ade835758e8488ca10d3b0631caf0beb93ea3a6733631f151b0c2f01433
- Ratification: bac58319c9c4028b5b40e1129e0033cdb5a6b7b02033c25f06f4cb77d7779c67
- sol red-team: 3da326a4ea91767b731e128a93b13194e8002358101e30de3fcb8ca2f8f54faa
WI-0 evidence pack SHA-256 5d418306fcc597fd514e500bee40d1509f0bf467e46ee13fc5c280ed8274759d read directly. Probe P3 is PASS: real Pi retained the same PID/starttime through reload/fork/new/resume while generations advanced and a prior VERIFIED generation was revoked.
P6 planner-return ruling SHA-256 b7bbb6ea6e8d9a5c3366993642ab4e4f65b961af04936dcac20bfbcdcbaf1a09 read directly: feature WI admission is GO with the exact-delivery empirical compatibility fact and disclosed T-C middle-drop residual; no receipt redesign.

Plan and budget

RED real-socket acceptance for T12b/T30, each Claude observer, same-PID generation rollover, Claude/Claudex hook wiring, and Pi lifecycle wiring.
Add one broker client executable for observer revocation plus a private monotonic generation-file helper shared by launcher, gate, and revoker.
Wire Claude PreCompact, SessionStart(compact), and resume/clear generation rollover; merge equivalent mandatory hooks into isolated Claudex settings.
Wire Pi pre/post compaction observers and reload/new/resume/fork generation rollover with local fail-closed tool blocking if lifecycle revocation fails.
Document the D2-v5 bounded stale window without claiming the mutator gate bounds within-TTL actions; update protocol/security/operations/sitemap/checklist.
Run focused real tests, independently measured executable coverage ≥85%, full repository gates, commit/push, open an unmerged closes #830 PR, and hand off for terra CODE + mandatory Opus SECREV.

Working estimate: 35K tokens. No explicit hard cap was supplied; reduce refactor breadth before touching locked broker authority/state-machine semantics.

RED evidence

New T12b/T30 test already reports the inherited primitive honestly: within-TTL ALLOWED, after-TTL DENIED. The complete AC remains RED because the mandatory threat-contract document is absent.
Focused real-socket suite is RED with 7 expected failures: missing revoker executable (both Claude observers + generation bump), missing Claude/Pi wiring, missing isolated Claudex observers, and missing D2-v5 disclosure.
Branch-focused Python suite is RED on the wished generation initializer/resolver interfaces and missing lease_generation.py / revoke-lease.py.
Pi lifecycle suite is RED because the wished standalone lease-lifecycle.ts observer/generation module does not exist.

Locked discipline

RED-first T12b/T30 and observer/generation tests; test commit precedes implementation.
Reuse broker revoke_lease; do not fork identity, lease, or transition authority.
Preserve revoke-first/promote-last and WI-1/WI-2 reviewed state machine.
≥85% attributable executable coverage with real tests.
No author self-review, no merge, no --no-verify.

4.4 KiB Raw Blame History