stack/docs/scratchpads/751-native-kanban-canon.md

Issue #751 — Native Kanban/SOT canonical publication

Objective

Publish the owner-ratified P0–P3 requirements, mission manifest, task decomposition, and frozen shared contracts before feature implementation.

Authority and decisions

• Owner: Jason
• Plan owner/orchestrator: web1 control plane; takeover by mosaic-100 during Claude quota outage
• Tracking: Mosaic Stack issue #751
• Foundation: current Stack main + Drizzle/PostgreSQL
• Fixed invariants: PostgreSQL sole writable SOT; writes fail closed; exports never import; outage notes become attributable proposals; mechanical Coordinator has no scope/gate/certify/merge authority; Certifier has no merge authority.
• Recovery posture only is configurable through Lite, Standard, and High-assurance profiles.

Execution log

• 2026-07-14: Existing planner-sol canon remediation reviewed from staging. KCR-001–016 claimed resolved; static checks passed.
• 2026-07-14: Independent GPT/Terra re-review dispatched to rev1.
• 2026-07-14: Re-review returned NO-GO: proposal audit-event IDs were not workspace-bound, leaving attribution forgeable; formatter evidence was not reproducible. Focused remediation round 2 routed to planner-sol.
• 2026-07-14: Remediation bound proposal audit links to task_events(workspace_id,id), froze same-transaction semantic validation and negative tests, and made formatter/type/static checks reproducible.
• 2026-07-14: Independent rev1 re-review returned GO with KCR-001–016 closed and no new blocker. Canon copied into the issue #751 publication worktree; feature implementation remains held until merge.
• 2026-07-14: Independent publication validation returned FAIL on formatting/trailing whitespace, stale staging wording, ignored review evidence, and missing worktree dependencies. Bounded publication remediation routed to planner-sol; no runtime source change authorized.
• 2026-07-14: Publication remediation installed locked dependencies outside the repository cache, fixed formatting and wording, and preserved docs-only scope. Independent gaterun revalidation returned PASS across staged scope, formatting, lint, typecheck, strict contract compile, links, rollups, review artifacts, and fixed invariants.
• 2026-07-14: Ultron final gate returned GO with zero BLOCKER/HIGH findings; residual LOW items remain explicit implementation obligations.
• 2026-07-14: First commit attempt was correctly blocked by the lint-staged hook because docs contract .ts files were outside TypeScript project-service scope. Added a strict no-emit workstream tsconfig.json with exact Drizzle declaration paths; targeted contract TSC, contract ESLint, format, full lint/typecheck, strictness, and docs-only scope independently passed.

Verification evidence

• Initial review: docs/reports/native-kanban-sot/canon-initial-review-no-go.md
• Final GO: docs/reports/native-kanban-sot/canon-final-rereview-go.md
• Ultron GO: docs/reports/native-kanban-sot/ultron-final-go.md
• Pending: PR gates, squash merge, terminal-green CI, and issue closure.

Publication remediation session — planner-sol

Assignment: Remediate only issue #751 publication blockers from /home/hermes/agent-work/reviews/751-kanban-canon-publication-validation.md; no source, package, lock, provider, CI, build, deploy, commit, or push action.

Plan:

1. Install the locked pnpm dependencies without modifying package metadata.
2. Replace only stale publication/staging wording while retaining the canon-merge and KBN prerequisite implementation hold.
3. Format all changed candidate Markdown and contract TypeScript; remove trailing whitespace.
4. Run worktree format:check, lint, typecheck, strict no-emit contract compilation, tracked/untracked whitespace checks, and static invariants.
5. Verify package/lock/source paths are unchanged and append exact evidence here.

Budget: No explicit token cap; bounded docs-only remediation, no exploratory/runtime work. TDD: Not applicable—documentation/contract-publication formatting and wording only; strict/static validation is the primary gate.

Publication remediation results

Changes

• docs/native-kanban-sot/INDEX.md: replaced staging/pending-GO wording with current publication and independent-GO wording; retained the merge hold and dependency-ordered KBN prerequisite hold.
• docs/native-kanban-sot/TASKS.md: replaced “Mos using this staging set” with “Mos / publication control plane”; made the post-merge KBN prerequisite hold explicit.
• Formatted all changed candidate Markdown and four contract TypeScript files with current-worktree Prettier 3.8.1.
• Removed trailing whitespace from candidate Markdown, including both linked review reports.
• Preserved both review reports and their links; they remain ignored by .gitignore:11 for coordinator force-tracking.

Dependency installation

The first target-worktree install attempt used the environment's default root-owned pnpm store and failed without changing package metadata:

cd /home/hermes/agent-work/stack-kanban-canon && pnpm install --frozen-lockfile
EACCES: permission denied, open '/root/.local/share/pnpm/store/v10/server/server.json'

Successful locked install using an authorized cache outside the repository:

cd /home/hermes/agent-work/stack-kanban-canon
pnpm install --frozen-lockfile --store-dir /home/hermes/agent-work/pnpm-store

Result: PASS, 1,240 packages installed; lockfile resolution skipped as up to date. node_modules remains ignored. Tool versions: pnpm 10.6.2, Prettier 3.8.1, TypeScript 5.9.3, Drizzle ORM 0.45.1, Turbo 2.8.16.

Exact quality-gate results

pnpm format:check
PASS — All matched files use Prettier code style.

pnpm lint
PASS — 23 successful lint tasks.

pnpm typecheck
PASS — 42 successful tasks. Turbo invoked configured dependency build prerequisites as part of the repository's exact typecheck graph; no standalone build command was run.

Candidate formatting commands:

pnpm exec prettier --write <3 tracked rollups + 9 native-kanban artifacts + requirements + scratchpad>
pnpm exec prettier --check <same files>
pnpm exec prettier --ignore-path /dev/null --write \
  docs/reports/native-kanban-sot/canon-initial-review-no-go.md \
  docs/reports/native-kanban-sot/canon-final-rereview-go.md
pnpm exec prettier --ignore-path /dev/null --check \
  docs/reports/native-kanban-sot/canon-initial-review-no-go.md \
  docs/reports/native-kanban-sot/canon-final-rereview-go.md

Result: PASS. The explicit /dev/null ignore path is required because docs/reports/ is intentionally ignored pending coordinator force-tracking.

Tracked and untracked whitespace checks:

git diff --check
PASS

git diff --no-index --check /dev/null <each untracked/ignored candidate>
PASS for all candidates

Strict contract compilation initially could not resolve pnpm-isolated drizzle-orm from the external docs directory. A temporary, removed dependency-context symlink made current-worktree resolution explicit:

LINK=docs/native-kanban-sot/node_modules
ln -s ../../packages/db/node_modules "$LINK"
trap 'unlink "$LINK"' EXIT
pnpm exec tsc \
  --noEmit \
  --strict \
  --skipLibCheck \
  --target ES2022 \
  --module NodeNext \
  --moduleResolution NodeNext \
  docs/native-kanban-sot/contracts/*.ts

Result: strict-contract-noemit=PASS; temporary link removed.

Static result:

proposal-audit-links=PASS
kcr-invariant-regression=PASS
publication-wording=PASS
vocabulary-alignment=PASS

Scope-integrity evidence

Baseline and final hashes are identical:

package.json   93a50eaefc7a0446a56234e427df03f6a2256f8da17c0bede17c22206928c8c0
pnpm-lock.yaml 8b6448d51ac7797c8f782af52a080c0e38ab8bf364f32624f94e636bf5743229

tracked-package-lock-source-unchanged=PASS: every tracked/untracked nonignored change remains under docs/; no package, lock, application source, plugin source, configuration, CI trigger, standalone build/deploy, container, provider, commit, or push action occurred.