stack/docs/fleet/proposals/mosaic-platform-prd/DEBATE-FINDINGS.md

Debate Findings & Dispositions — Mosaic Platform PRD

Convener: mos-claude-1 · Date: 2026-07-09 · Panel: 9 personas × 2 rounds (8 Claude lenses + independent Codex runtime), 20 agents, ~1.05M tokens Artifacts: jarvis-brain:docs/scratchpads/mosaic-platform-prd-debate/ (THREAD.md — full transcript · SYNTHESIS.md — Principal-Engineer close-out) Mandate (Jason, 2026-07-09): "debate and make judgment calls." D1–D12 were held fixed; the panel attacked only the implementing structure. Dispositions below are the convener's judgment calls, folded into the sibling docs in this directory. Items marked OPEN — Jason need his call at ratification.

How to read this

Every synthesis finding (SYNTHESIS.md §1, items 1–24) is dispositioned here. Accepted findings are folded into the PRDs/YAML as inline fixes or "Debate-accepted deltas" rows; this file is the traceability record. Severity labels are the panel's (P0 blocker → P3 note).

P0 findings — all accepted, folded inline

#	Finding	Disposition
1	Storage-authority contradiction (X2 "relational + flat-file backends" vs Q "Postgres sole record")	Accepted. X2 rewritten: Postgres authoritative for all product entities; flat-file backend is a derived, regenerated, read-only projection.
2	Phase-1 Jarvis executes external PA ops before the relay exists (J2 vs NS-11)	Accepted. J2 split: J2a workspace-internal entities (phase 1) / J2b external integrations (phase 2, depends_on: [P2]). Phase-1 has no external credential path at all.
3	phase vs depends_on disagree; dispatcher obedience undefined	Accepted. Phases encoded as real DAG edges (X2 depends_on [J2a, P2], J2b gate above); sandbox dispatch-test added to ratification checklist (README Gate Zero §).
4	Four load-bearing upstream artifacts unverified (memory subsystem, Hermes-MCP tool equivalents, push pipeline, wake/event router)	Accepted. README gains Gate Zero (pre-ratification artifact audit); presumed-MISSING rows get goal cards now: M1 (memory subsystem), J6 (event/wake router), K3 (push pipeline). Parity map's MCP row re-pointed at concrete deliverables.
5	X-R4 migration manifest wrong about its own source tree (phantom tickets.json, unlisted dirs, six divergent memory stores, live Vikunja sync unmapped)	Accepted. X-R4 rewritten: migrator stage 1 = machine-generated source census (incl. untracked paths + all memory stores), per-path disposition, any unknown blocks; re-point list generated from tools/sync_*.py; Vikunja disposition line added to X-R6.

P1 findings — all accepted

#	Finding	Disposition (folded as deltas)
6	Events have no provider join key; re-point duplicates the calendar	Accepted. Provider-sourced events migrate from the provider; flat files supply only brain-native events. DST/recurrence fixture is the AC (X-R6 delta).
7	Approval pipeline has no state machine (double-execute / approve≠execute)	Accepted. P deltas: CAS on one durable row, terminal states, consumed-event dedupe table (shared substrate with bridge + wake dedupe), payload persisted at request time, poll/ack outcomes, per-capability retry class, staleness bound, approved_unexecuted alarm, re-surface = re-prepare with machine diff.
8	"Cannot bypass by construction" false: agent-readable vault creds + host-resident creds outside the relay	Accepted. Credentials gateway-only + scoped capability tokens; P1 gains host credential inventory with continuous scheduled scan in the health floor; clean-host AC passes with empty exemption list.
9	Silent auto-deny steady state (fail-closed TTL + single surface + unprovisioned push)	Accepted. K gains homeserver ops + monitored push (K3); CLI approval surface ships with P2; delivered/seen tracking + TTL/2 escalation; denied / expired_seen / expired_unseen distinct terminal states.
10	Prompt injection → durable memory; wake turns add system-role injection	Accepted. J2 write-side trust rule (transitive source_trust=external; standing-instruction-shaped content needs user ratification before retrievable); wake turns templated with provenance-tagged data fields.
11	Exactly-one-Jarvis has no fencing incl. the Matrix send path	Accepted. New J-R16 workspace lease (workspace_id, epoch) CAS row in product Postgres; epoch on every write; pre-send lease re-check; takeover notice; degraded = mute-with-notice. NS-10 amended: one main agent per workspace.
12	Matrix principal resolution undefined (Codex #2, unanswered in R2)	Accepted. K/P delta: immutable Matrix user ID + bridge provenance + workspace membership → product principal; unlinked/bridged-unlinked identities read-only, cannot approve/butt-in/trigger external writes. All four Codex fixtures = deny + audit.
13	Policy evaluation time undefined (Codex #7, unanswered in R2)	Accepted. Immutable policy snapshot on every prepared action/card; execution revalidates or fails policy_changed; delegated effects gated by grant intersection.

P2/P3 findings — accepted (see per-PRD delta sections)

14 Hermes evidence snapshot before stop (machine gate) · 15 Q1 crash barriers + external_refs unique-index table (one mechanism, three consumers) · 16 rollback honestly scoped (transport-only, point-of-no-return = first native card) + bounded day-30 review with three recorded outcomes · 17 human-attention budget (rate limits, quotas, deferrable flag, away state) · 18 self-referential-loop containment (provenance labels, source-grounded retrieval preference, retrieval eval gate ≥50 queries / ≥90% baseline recall@5 + negative queries, tombstones, priority budget, day-1 trend telemetry) · 19 butt-in exclusive lease + structured control-plane API + break-glass doctrine · 20 default-closed capability gating with unclassified third state · 21 per-agent atomic approval-routing cutover table · 22 needs-decision card lifecycle (immutable spec + typed amendments; ratified_by authorizes dispatch, never merge) · 23 retention class per durable table; dedupe pruning checkpoint-coupled · 24 AC-NS-8 made measurable (distinct quota pools pinned in profile; TTFT p95 ≤ 1.2× baseline, ≥30 interleaved turns).

All accepted. None conflicts with D1–D12.

Open disagreements — convener judgment calls

§	Question	Call
3.1	Gate architecture: tiered blocking pack (Moonshot+Ops+ML-Cal) vs 4 artifact-existence machine gates + pass/fail-free pre-registered dossier (Contrarian)	Adopted the agreed floor now (4 machine gates on irreversible transitions, pre-registration, priced amendments, day-1 emission — folded into X). Superstructure choice is OPEN — Jason. Convener recommendation: Contrarian's dossier + dumb gates — the tier demonstrably gamed itself within one debate round (13+ claims vs cap 10, slot-riding, zero demotions); simple machine gates don't degrade under pressure.
3.2	Audit schema: additive-only typed schema (Coder-Data) vs six-field mandatory envelope + typed payloads + pinned checked-in queries (Contrarian)	Adopted: minimal envelope + schema-on-read (folded into P1 delta). Rationale: preserves "can't add data later" essentials without a god-schema by committee; an additive typed layer can be grown later where query pain proves it.
3.3	Unclassified capability: reject at call time vs version-scoped activation hold vs capability-scoped hold	Adopted: capability-scoped hold (Contrarian R2#6a, synthesis editor concurs) — gate the capability, ship the version; security patches are never pinned behind classification.
3.4	Away mode: fail-closed expiry labeled expired_during_away vs suppress preparation while away	Adopted: suppress preparation of non-deferrable requests while away + audited suppressed-preparations list swept on return. Cleaner than labeling corpses; nothing expires that was never surfaced.
3.5	Memory-exclusion scope for measurement artifacts	Adopted: normative/parametric split (Contrarian R2#4) — rules the agent is scored against stay retrievable; thresholds/seeds/drill timings/canary templates are excluded.
3.6	Statistical instruments	Adopted: deterministic named crash barriers as the gate; residual randomized soak is trace-directed, not wall-clock-uniform.
3.7	K2 scope narrowing by Hermes traffic audit	Adopted as a Gate Zero action: run the audit pre-ratification; platforms with live traffic become the must-have subset gating X3.

Process rules adopted (README)

• Gate Zero — pre-ratification upstream-artifact audit (present @ SHA or MISSING → goal card).
• Conflict register — spec contradictions block the requirement, not the mission ("alert, don't auto-resolve" promoted to specs).
• DoD line on every goal card (runbook, health-floor alerts, AGENTS.md).
• Silent-roster rule — a panel member's silent round records their open findings as open items, never consensus (Codex's R2 silence on #2/#7 is the instance; both were folded as P1 items 12–13 above, explicitly not consensus-resolved).

Addendum — logging & telemetry (Jason, 2026-07-09, post-debate)

Requirement raised outside the panel, folded in the same pass: Mosaic Stack must support inbound error reporting/logging from agents and installs, plus optional anonymous agentic-efficiency telemetry — no IP or PII capture, opt-in. The P0 of this capability already exists: MALS (Mosaic Agent Log System, FastAPI+Postgres, ~/src/mals), currently dark because its k3s migration landed without an Ingress (tracked: infrastructure #135). Folded as new workstream L (L1 restore MALS · L2 Mosaic-native ingestion · L3 anonymous telemetry) + standing objective NS-14. Day-1 trial-metric emission (finding 18) targets MALS until W3 panels exist.