mos-dt-0andClaude Opus 5
50c0340add
D-38 — RM-61's terminal-green verifier certified the right RECORD for the wrong COMMIT. rev-974 mutated only #2188's commit field and the gate still exited 0. Confirmed by construction: ate7b29219the whole verifier had exactly one "commit" line (159), no expected-head parameter, no comparison, no failure path. D-24 at the gate layer — a true answer to a different question. The transferable half is the AC set, not the verifier: AC1-AC8 ALL PASSED and the PR was still NO GO, because every registered check tested whether the signature discriminates and none tested whether the evidence was bound to its subject (coverage-failure-mode-2, D-17 class). Mos ruled a STANDING clause into RM-02 coverage: "does this gate bind its evidence to the subject under review?" — every gate can fail this way and pass its own ACs. D-37 — one shared .git/config silently re-identified EVERY worktree. extensions.worktreeConfig is unset, so a worker's repo-local identity write rebinds all linked worktrees at once; the orchestrator checkout and rev-974's review worktree both authored as coder-mos1. Distinct from D-34, not an instance: MOSAIC_GIT_IDENTITY was exported and correct and still resolved wrong. Sharp edge is gate-16 defeated in the artifact — the reviewer would author its pre-registered ACs as the author of the code under review. No contamination occurred. Containment (explicit -c, no shared-config rewrites mid-flight) is the standing order; the real fix is authorised and owned by Mos, sequenced at a quiet seam. #1024 is implicated: repo-local pinning is the colliding mechanism. Also pre-registers the twelve RM-61 re-review checks at exact head033b2ffbBEFORE the reviewer reads the diff, and rebuilds the board for a cold read — RM-61 "building", "nothing implemented yet", and DECISION-1/2/3 "must be ruled" were all stale, the D-36 class again at the same seam. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
6.1 KiB
RM-61 / PR #1033 — PRE-REGISTERED RE-REVIEW ACCEPTANCE CHECKS
Subject head (exact): 033b2ffb46674b2c0bcc5197273c109b461f62d9
Supersedes: review 67 / comment 20403 @ e7b29219 (NO GO). That verdict is VOID — the head moved.
Registered by: mos-remediation (orchestrator). Reviewer: rev-974 (author ≠ reviewer).
Registered BEFORE the reviewer read the diff. Any head move after this file is committed voids the
re-review and requires re-registration.
Scope discipline
The prior review passed AC1–AC8 and still found a blocker, because the registered set tested whether the signature DISCRIMINATES and never tested whether the evidence was BOUND TO ITS SUBJECT (Finding 3 / coverage-failure-mode-2, D-17 class). This set therefore carries the binding property as a first-class check, and RR7 explicitly invites the reviewer to attack outside the set — a registered set is protection against retrofitting only, never a ceiling on scrutiny.
Checks
| id | check | verdict form |
|---|---|---|
| RR1 | The full 12-case contract harness passes at the exact head: bash test-terminal-green-contract.sh |
⇒0, and states 12 cases |
| RR2 | ★CRUX — the ORIGINAL ATTACK IS DEAD. Take the real #2188 record, mutate ONLY commit to an unrelated 40-hex value, verify against the true expected head |
⇒1, exempted_steps == 0, anomaly naming expected vs actual |
| RR3 | Missing --expect-commit cannot be defaulted, inferred, or skipped |
⇒2 (not 0, not 1) |
| RR4 | Malformed expected commit (short SHA, non-hex, empty) is rejected — no silent normalisation into a pass | ⇒2 |
| RR5 | A record with the commit key ABSENT (not merely different) is rejected — fail-closed on missing, not just on mismatch |
⇒1, exempted_steps == 0 |
| RR6 | The genuine artifact still passes when correctly bound: real #2188 + its true head |
⇒0, exempted_steps == 1, exactly one WP-K8S-1000-CI-POSTGRES-TEARDOWN |
| RR7 | ★RED-FIRST, PROVED RETROACTIVELY. The four new cases must FAIL against the OLD verifier at e7b29219 — otherwise they do not test what they claim (D-8 class). Run the new cases against the previous implementation |
new cases ⇒≠0 under e7b29219 |
| RR8 | AC2 OF THE PRIOR SET DID NOT REGRESS: both REAL controls stay terminal red — #2189 (ci-postgres exit 1) and #2191 (exit 137, test exit 61) |
both ⇒1, exempted_steps == 0 |
| RR9 | Still NO fetch / trigger / retry / re-roll / sleep / network of any kind in the verifier or harness. The coin flip must remain removed, not codified (D-21) | grep ⇒ no such call sites |
| RR10 | The doc/baseline changes REQUIRE the current provider PR head to be passed — they must not merely mention it. Check merge-gate.md, CI-CD-PIPELINES.md, woodpecker/README.md state it as a requirement a gate operator cannot satisfy by omission |
reviewer judgement, quote the lines |
| RR11 | Exemption remains bound to #1000 and retires with it; signature conjunction unchanged and not widened by this fix | diff-scoped, ⇒ no widening |
| RR12 | Case-sensitivity: an uppercase-hex record commit against a lowercase expected head must NOT silently pass by accident of comparison. State which way it resolves and whether it fails closed | state the observed behaviour |
Reviewer instruction
Report the verdict bound to 033b2ffb46674b2c0bcc5197273c109b461f62d9 and state each check's
observed result, including counts read from pipeline-status.sh -f json (never default text — it omits
clone, D-33). If any check is unrunnable, say so — never substitute a passing variant. Attack
outside this set and report anything it finds; RR7 and RR12 exist because the last blocker was found
exactly that way.