stack/docs/compaction-refresh/governance/charter-SPEC-RATIFICATION.md

# Compaction-Refresh Mechanism — SPEC RATIFICATION RECORD

**Ratifier:** Mos (main fleet orchestrator, `mos-claude`)
**Date:** 2026-07-17 ~22:2xZ
**Decision:** ✅ **RATIFIED — GO WITH BINDING CONDITIONS R1–R6.** Architecture converged v1→v5 via
oppositional adversarial planning (planner-opus authors / planner-sol red-teams). No v6 required.

## Authenticated authority artifacts (sha256-pinned)

| Artifact | Path | SHA-256 |
|---|---|---|
| Ratified SPEC v5 | `~/agent-work/reviews/compaction-refresh-SPEC-v5.md` | `a6d07ade835758e8488ca10d3b0631caf0beb93ea3a6733631f151b0c2f01433` |
| sol FINAL red-team (GO) | `~/agent-work/reviews/compaction-refresh-SPEC-v5-redteam-sol.md` | `3da326a4ea91767b731e128a93b13194e8002358101e30de3fcb8ca2f8f54faa` |
| (base) SPEC v4 | `~/agent-work/reviews/compaction-refresh-SPEC-v4.md` | `a5e9c261a613974fc0d853d69ad76f616f5f1c3b6b63a436daecdd15b4a72b80` |
| (base) sol v4 red-team | `~/agent-work/reviews/compaction-refresh-SPEC-v4-redteam-sol.md` | `1e76ee5942241d9520b9ff8f39a628488578ec2d9b91cc09b9f0e7cc6091ef2f` |
| Ratification-Input (R1-R6 + rulings, provenance-clean) | `~/agent-work/reviews/compaction-refresh-SPEC-RATIFICATION-INPUT.md` | `d01411a5c966f513e992a941deef0ff5cc6f29d37adab97ea2fbd3c5e6aef266` |

## Convergence trail
v1 NO-GO (9 architectural) → v2 NO-GO (7 enforcement, arch accepted) → v3 NO-GO (5 surgical, arch
locked) → v4 NO-GO (narrow; echo-lock narrowing APPROVED) → **v5 GO-with-conditions**.

## Locked architecture (do not redesign)
Authenticated external **lease broker** bound to kernel `SO_PEERCRED` (pid, starttime,
runtime_generation) — the only unforgeable identity fact on a same-uid tmux fleet. Broker MINTS the
logical session_id at first peercred contact (never caller-asserted). **Revoke-first / promote-last.**
Whole **mutator-class gate** (not per-wrapper). Verbatim-hashed normative fragments. Single
**constrained recovery command** = the only ungated mutator; the `mosaic-context-refresh` skill is its
wrapper. **Threat tiers:** T-A honest-stale → client gate · T-B compromised-tool → mutator-class · T-C
fully-rotted → **server-side branch-protection = the irreducible line** (client gate is
window-narrowing, NOT a complete guarantee).

**Delivery-receipt (echo-lock, sol §8-final):** broker mints a single-use `receipt_challenge` per
cycle bound to (session, runtime_generation, epochs, H_source, H_payload); **COMPUTE = broker**
(observes + computes the full binding incl H(latest-assistant-message) as the cycle-audit fact),
**COPY = model** (copies challenge + H_payload verbatim — model never computes a hash; sol T29
copy-not-compute preserved). Receipt is a **one-cycle T-A delivery/liveness proof ONLY — never an
obedience, residency, or safety proof.** The mechanical mutator-class gate remains THE safety
mechanism; §8 intact for T-B/T-C.

## Binding ratification conditions (R1–R6) — MANDATORY for build acceptance
- **R1 (honesty / T27 amendment):** state honestly that the receipt detects an ABSENT or
  PREFIX-TRUNCATED terminal token, but a MIDDLE-DROP that preserves the tail token is a **T-C
  contract violation, NOT receipt-detectable** (covered by server-side, not the receipt). No
  over-claim. Fold as a doc amendment — no v6.
- **R2 (atomicity):** evidence-commit → consume-challenge → promote-VERIFIED is ONE atomic broker
  transaction. A crash leaves NEITHER a VERIFIED-with-live-challenge NOR a
  consumed-with-ambiguous-promotion state; recovery mints a **NEW** challenge, never reuses one.
- **R3 (parsing):** exact single current-cycle receipt parse — no unbounded grep; reject
  quoted/tool-output receipts, wrong generation/epoch, unknown/stale challenge, and multiple receipts.
- **R4 (Gate0 runtime evidence — BUILD-ADMISSION GATE):** launcher-ancestry/D1,
  sibling-substitution rejection, Pi last-or-closed, same-PID runtime_generation bump,
  nonce→tool-call-id map, socket/authenticity posture, and source-invalidation fail-closed require
  **runtime Gate0 evidence BEFORE build admission**, not design assertion. **A failed Gate0 item
  RETURNS the design to planner review — it is NOT waived by this GO.**
- **R5 (TTL — RATIFIER ACCEPTED):** proposed **300s MAX lease TTL + soak-tighten** is **ACCEPTED by
  Mos (ratifier)**. Safe-direction default: soak data may only SHORTEN it, never lengthen. Operator
  (Jason) may tighten at will; flagged for operator awareness, non-blocking (not an escalation
  trigger — a proposed max that only tightens).
- **R6 (receipt semantics — REAFFIRMED):** receipt remains T-A delivery/liveness ONLY, never
  obedience/safety proof. Reaffirmed as a permanent invariant of the design.

## Build sequencing (PLAN-ONLY until these clear)
1. **HARD DEP:** `mosaic skill` register/unregister/list + generic install/upgrade symlink auto-sync
   (mosaicstack/stack **#824**, in flight on ms-824) MUST land first — else the durable
   `mosaic-context-refresh` skill ships unreachable (no `~/.claude/skills/` bridge symlink).
2. Then MS-LEAD builds the mechanism in **packages/mosaic** (M1 = Claude + Pi orchestrators) against
   THIS ratified spec + R1–R6, producing R4 Gate0 evidence. Author≠reviewer independent review; no
   self-merge; Mos merges.
3. The durable `mosaic-context-refresh` skill (+ jarvis-brain CLAUDE.md mandate PR) lands aligned to
   the ratified receipt/hash contract, AFTER the #824 bridge exists.

**Interim protection (live now, until the mechanism ships):** `mosaic-context-refresh` skill
(fail-closed 7-line residency attestation) + jarvis-brain CLAUDE.md "Directive Freshness After
Compaction" mandate — self-run manual re-read + attestation. Symlink hand-created this session; loads
and attests 7/7.