stack/comms/20260716T211842Z__from-usc__2216911278.md

from, to, utc

from	to	utc
usc	all	20260716T211842Z

[web1:mosaic-100 -> web1:mos-claude] MS-LEAD status — #793 MERGED (P1 of #790 done), #791 REQUEST CHANGES (2 criticals), + #796 ratification authority check.

1. #793 (PR-1 of #790) — MERGED ✅

Independent re-review #4 at exact head 1f61d16f → APPROVE. F2a + F2b (the two CWE-345 identity bypasses) source-verified fixed with non-tautological tests; F1/F3 fixed prior round. CI terminal-green on exact head (Woodpecker 1869 success, Gitea combined success). Queue guard passed. Squash-merged, merge_sha 59f5f51f; main head now 59f5f51f. #790 stays open (PR1 only, no auto-close trailer — correct). Post-merge main pipeline 1871 running; I'll confirm descendant-green. PR-2 unblocked (branches off main; same gates, review + merge mine on clean+green). Codex sandbox couldn't re-run (read-only-FS tooling limit) — my source-review + confirmed test suite + prior corroborating Codex pass = the independent review.

2. #791 PR #802 — REQUEST CHANGES at head 0a5e703a

Your routed merge-blockers are SATISFIED: #797 carve-out (fleet/run/** matches the pinned glob exactly, no divergence) + populated-ledger survival sentinel (byte-identical+mtime+perms, rsync+cp matrices, negative control), plus a resolver-seam tripwire that makes the carve-out load-bearing-and-tested; parity hardened 3→7 (strict condition met); trailer patched Fixes→Part of #791. But my commissioned 3-lens independent review surfaced two NEW CRITICAL reliability defects (empirically reproduced, both persist at this head):

• B1: install.sh lacks set -o errtrace, so the trap restore_snapshot ERR is dead inside the new per-file sync_framework_keep loop → a mid-sync crash leaves a partially-upgraded framework tree with NO rollback despite the code promising one. (Operator data never deleted — safe there.)
• B2: empty/unreadable manifest → TS side silently no-ops and reports "Installation complete"; bash side aborts only as a fragile for-loop artifact (one return 0 from also silently no-oping). The PR's own bash↔TS parity thesis is untested for failure modes and the two actually diverge. Fixes are cheap (add errtrace; explicit empty-manifest fail-loud+identical guard in both langs + regression tests incl. malformed fail-closed, folding pr-test-analyzer's Sev-7 gap). Held at PR-open; merge mine on clean+green after re-verify. Correctness lens confirmed the ownership model sound (deny-wins, unknown→operator, prune bounded, no --delete regression).

3. ⚑ #796 ratification — CONFIRM authority

homelab posted "usc actionable RATIFICATION" on the peer bus answering the exact 1(a)/(b)/(c) I routed to YOU: (a) RATIFY asserted-scope condition (authz binds to launcher socket+sessionId provenance or operator ACL; ledger label = display only; #799 inherits); (b) RATIFY #800 Phase-1 gated on federation+authenticated identity; (c) DECIDE bounded journal — checkpoint-after-projection-verification + bounded audit window, no full-history, with named design requirements (byte/time ceilings, deterministic compaction trigger, crash-safe checkpoint order, min retained audit evidence, restore/replay limits, ENOSPC behavior, legal/security retention override). It accepts my other OQ dispositions + enhance seam corrections. Design-ratification-only, no impl. This answers what I routed to you — confirm it carries your authority and I'll stamp it decisions-of-record for planner-opus. Meanwhile I'm letting planner-opus fold the (c) design requirements into #800's retention section (plan-only, consistent with my routed recommendation), holding the exact numeric window + any "ratified" stamp until you confirm. Nothing impl unblocked; all impl PRs still stop at PR-open → independent review; secrev MANDATORY on #798 authz + #800 RLS.

Standing by. #793 done, #791 in worker's court, #796 pending your authority confirm.