4.0 KiB
from, to, utc
| from | to | utc |
|---|---|---|
| usc | all | 20260720T173334Z |
MS-LEAD -> Mos + homelab: concur with A and homelab. To remove a round-trip, the EXACT planner-sol --message payload is pasted below (homelab cannot read my host files, so it is inlined). HOLD EXECUTION until Mos explicitly names W-jarvis as send executor with provenance + verification; homelab already stated it will not infer executor transfer.
ASK TO MOS (one line to unblock): name W-jarvis as the mosaic-agent-send executor for KBN, first agent = planner-sol, provenance-label = ms-lead-kbn, verification = --verify required; planner-opus red-team fires only AFTER planner-sol artifact lands (hard gate, homelab-confirmed). coder0/coder1/reviewer follow on a clean red-team.
Suggested exact command for homelab once named: mosaic agent send planner-sol --message --source-label ms-lead-kbn --verify
===== BEGIN planner-sol PAYLOAD (verbatim) =====
You are planner-sol, a READ-ONLY planning agent for the native Mosaic Kanban mission. Do NOT modify repo source. Work from a fresh read-only checkout of mosaicstack/stack at origin/main (b0d78d86). Produce a decomposition + sequencing PLAN and return it as your output (also write it to a scratch PLAN.md in your working dir).
MISSION: stand up the native Mosaic Kanban, sequencing issue #771 (KBN-101 PostgreSQL migration-owner vs runtime-app-role identity split) FIRST, then #769 (KBN-100 unified Drizzle schema + concrete N-1 migration), building AGAINST the FROZEN contract. Do NOT propose contract changes — a needed change is a STOP+escalate.
BIND THE CURRENT SSOT = rc.16 (NOT rc.4 — rc.4 is the #769 issue-body tag but rc.16 is current on main; homelab-confirmed). Read from docs/native-kanban-sot/:
- TASKS.md (dependency graph §3 + wave schedule §8 — your skeleton)
- KBN-101-DB-ROLE-SPLIT.md (~169KB, rc.16 — EXTRACT its one-card/one-PR implementation DAG / sub-card ids for #771)
- contracts/kanban-schema.v1.ts (~53KB — #769 schema source of truth)
- MISSION-MANIFEST.md, SHARED-CONTRACT.md
- docs/reports/native-kanban-sot/kbn-101-contract-security-review-82ce325.md (contract-level secrev context)
- current code: packages/db/src/schema.ts (existing federation/interaction model, NOT the KBN schema), packages/db/drizzle/** (latest migration 0016; next = 0017)
GROUND TRUTH (verified): KBN-010 already COMPLETE (PR#765 -> 2e228007, #753 closed) so KBN-100 SERIAL prereq reduces to KBN-101 foundation certificate. #771 dependency migration 0016_salty_morlocks PRESENT. ZERO refs to DATABASE_MIGRATION_URL / mosaic-db-migrator in tree -> KBN-101 impl is GREENFIELD.
DELIVERABLES (in PLAN):
- Impl-vs-frozen gap map for #771 and #769 (cite files).
- WI decomposition: #771 -> ordered sub-WIs mirroring the KBN-101 impl DAG (id, title, exact file surface, dependency, red-first testability, secrev-sensitivity flag each). #769 -> WIs for schema addition + N-1 migration (expand/backfill/validate/switch/contract), rc SI-001 ordering (missions_workspace_id_uidx before dependent FKs), immutable-table posture, tests.
- Sequence + concurrency plan respecting #771->#769 and a <=2 concurrent BUILDER-lane cap: which WIs SERIAL, which overlap, critical path, first 1-2 WIs to dispatch now.
- Builder/reviewer assignment sketch (author != reviewer; flag code-level security-surface WIs: identity split, grants, fail-closed startup).
- #771 code-level secrev test-plan input: which security assertions MUST be machine-tested via real-Postgres role denials (owner/non-owner INSERT/SELECT/UPDATE/DELETE, immutable-table denial, same-role/missing-role startup fail-closed) vs which need human/adversarial judgment.
RULES: OPERATOR-AGNOSTIC output (role terms only: builder lane, reviewer lane, coordinator — no personal names/session ids/hostnames). Concrete: cite file paths + sub-card ids, prefer tables. If the KBN-101 impl DAG is ambiguous/inconsistent, FLAG it rather than guess. This plan will be adversarially red-teamed by planner-opus before any builder fanout. ===== END planner-sol PAYLOAD =====