jason.woltje
33f14bbfdc
Authority binding: owner class-auth (Jason 'amend the charter'/option B, #mos 2026-07-18 17:28Z, pre-SHA) + independent-adjudicator byte-verify (Mos, web1:mos-claude, author != verifier). Published by the adjudicator per homelab durable-Gate0 independence requirement. Probe-3 remains HELD pending homelab verification + owner window.
5.6 KiB
Compaction-Refresh Mechanism — SPEC RATIFICATION RECORD
Ratifier: Mos (main fleet orchestrator, mos-claude)
Date: 2026-07-17 ~22:2xZ
Decision: ✅ RATIFIED — GO WITH BINDING CONDITIONS R1–R6. Architecture converged v1→v5 via
oppositional adversarial planning (planner-opus authors / planner-sol red-teams). No v6 required.
Authenticated authority artifacts (sha256-pinned)
| Artifact | Path | SHA-256 |
|---|---|---|
| Ratified SPEC v5 | ~/agent-work/reviews/compaction-refresh-SPEC-v5.md |
a6d07ade835758e8488ca10d3b0631caf0beb93ea3a6733631f151b0c2f01433 |
| sol FINAL red-team (GO) | ~/agent-work/reviews/compaction-refresh-SPEC-v5-redteam-sol.md |
3da326a4ea91767b731e128a93b13194e8002358101e30de3fcb8ca2f8f54faa |
| (base) SPEC v4 | ~/agent-work/reviews/compaction-refresh-SPEC-v4.md |
a5e9c261a613974fc0d853d69ad76f616f5f1c3b6b63a436daecdd15b4a72b80 |
| (base) sol v4 red-team | ~/agent-work/reviews/compaction-refresh-SPEC-v4-redteam-sol.md |
1e76ee5942241d9520b9ff8f39a628488578ec2d9b91cc09b9f0e7cc6091ef2f |
| Ratification-Input (R1-R6 + rulings, provenance-clean) | ~/agent-work/reviews/compaction-refresh-SPEC-RATIFICATION-INPUT.md |
d01411a5c966f513e992a941deef0ff5cc6f29d37adab97ea2fbd3c5e6aef266 |
Convergence trail
v1 NO-GO (9 architectural) → v2 NO-GO (7 enforcement, arch accepted) → v3 NO-GO (5 surgical, arch locked) → v4 NO-GO (narrow; echo-lock narrowing APPROVED) → v5 GO-with-conditions.
Locked architecture (do not redesign)
Authenticated external lease broker bound to kernel SO_PEERCRED (pid, starttime,
runtime_generation) — the only unforgeable identity fact on a same-uid tmux fleet. Broker MINTS the
logical session_id at first peercred contact (never caller-asserted). Revoke-first / promote-last.
Whole mutator-class gate (not per-wrapper). Verbatim-hashed normative fragments. Single
constrained recovery command = the only ungated mutator; the mosaic-context-refresh skill is its
wrapper. Threat tiers: T-A honest-stale → client gate · T-B compromised-tool → mutator-class · T-C
fully-rotted → server-side branch-protection = the irreducible line (client gate is
window-narrowing, NOT a complete guarantee).
Delivery-receipt (echo-lock, sol §8-final): broker mints a single-use receipt_challenge per
cycle bound to (session, runtime_generation, epochs, H_source, H_payload); COMPUTE = broker
(observes + computes the full binding incl H(latest-assistant-message) as the cycle-audit fact),
COPY = model (copies challenge + H_payload verbatim — model never computes a hash; sol T29
copy-not-compute preserved). Receipt is a one-cycle T-A delivery/liveness proof ONLY — never an
obedience, residency, or safety proof. The mechanical mutator-class gate remains THE safety
mechanism; §8 intact for T-B/T-C.
Binding ratification conditions (R1–R6) — MANDATORY for build acceptance
- R1 (honesty / T27 amendment): state honestly that the receipt detects an ABSENT or PREFIX-TRUNCATED terminal token, but a MIDDLE-DROP that preserves the tail token is a T-C contract violation, NOT receipt-detectable (covered by server-side, not the receipt). No over-claim. Fold as a doc amendment — no v6.
- R2 (atomicity): evidence-commit → consume-challenge → promote-VERIFIED is ONE atomic broker transaction. A crash leaves NEITHER a VERIFIED-with-live-challenge NOR a consumed-with-ambiguous-promotion state; recovery mints a NEW challenge, never reuses one.
- R3 (parsing): exact single current-cycle receipt parse — no unbounded grep; reject quoted/tool-output receipts, wrong generation/epoch, unknown/stale challenge, and multiple receipts.
- R4 (Gate0 runtime evidence — BUILD-ADMISSION GATE): launcher-ancestry/D1, sibling-substitution rejection, Pi last-or-closed, same-PID runtime_generation bump, nonce→tool-call-id map, socket/authenticity posture, and source-invalidation fail-closed require runtime Gate0 evidence BEFORE build admission, not design assertion. A failed Gate0 item RETURNS the design to planner review — it is NOT waived by this GO.
- R5 (TTL — RATIFIER ACCEPTED): proposed 300s MAX lease TTL + soak-tighten is ACCEPTED by Mos (ratifier). Safe-direction default: soak data may only SHORTEN it, never lengthen. Operator (Jason) may tighten at will; flagged for operator awareness, non-blocking (not an escalation trigger — a proposed max that only tightens).
- R6 (receipt semantics — REAFFIRMED): receipt remains T-A delivery/liveness ONLY, never obedience/safety proof. Reaffirmed as a permanent invariant of the design.
Build sequencing (PLAN-ONLY until these clear)
- HARD DEP:
mosaic skillregister/unregister/list + generic install/upgrade symlink auto-sync (mosaicstack/stack #824, in flight on ms-824) MUST land first — else the durablemosaic-context-refreshskill ships unreachable (no~/.claude/skills/bridge symlink). - Then MS-LEAD builds the mechanism in packages/mosaic (M1 = Claude + Pi orchestrators) against THIS ratified spec + R1–R6, producing R4 Gate0 evidence. Author≠reviewer independent review; no self-merge; Mos merges.
- The durable
mosaic-context-refreshskill (+ jarvis-brain CLAUDE.md mandate PR) lands aligned to the ratified receipt/hash contract, AFTER the #824 bridge exists.
Interim protection (live now, until the mechanism ships): mosaic-context-refresh skill
(fail-closed 7-line residency attestation) + jarvis-brain CLAUDE.md "Directive Freshness After
Compaction" mandate — self-run manual re-read + attestation. Symlink hand-created this session; loads
and attests 7/7.