mos-dt-0andClaude Opus 5
aa4b584764
A USC governance spec reached this pane as a role-addressed cc. Not my estate, no action taken, nothing in it constrains mosaicstack. But it converges on three principles this mission paid for in blockers, reached by different people solving a different problem. Their clause B — the allowlist is data the validator reads, never data it or the validated party writes, git-tracked and reviewed-PR only, because "a validator whose permitted set can be influenced by the thing it validates is not a validator" — is our D-45 five-arrival principle in one line, and it is RM-02 blocker 2 exactly: REQUIRED_GATE_INVENTORY was a mutable constant inside the PR-controlled verifier. Their clause D, rejecting all on an unreachable or empty allowlist so the bounded shape cannot be defeated by making its source unavailable, is our D-46. Their clause E, exact membership with no "close enough" branch, is our D-40. Independent convergence is the strongest signal available — the same weight this mission gave two planners agreeing without collusion. And they carry a refinement we lack, now adopted into RM-02's (d)-strict exclusion work: fail-closed is not the same as fail-silent. "Read OK, owner absent" rejects quietly and is normal; "could not read or empty while enforcing" must reject AND alarm, because a missing allowlist in production is an incident. Our D-46 makes non-emptiness a precondition but never said the precondition's own failure must be loud. A registry rejecting everything because its population vanished looks identical from outside to a registry with nothing to do — D-23's inert guard wearing the opposite mask, a false quiet rather than a false green. Also worth keeping: seed the allowlist in an audited commit BEFORE switching to enforcing mode, or fail-closed rejects every legitimate owner at cutover. The same ordering trap applies to any gate we move from advisory to blocking. Routing: this is the second role-addressed message hours after D-53 made seat-addressing doctrine, so the doctrine has not reached installer-7. Recurrence of a just-banked defect is evidence about propagation, not about the rule — the same gap as D-51, where a fix that exists is not a fix that has arrived. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
84 lines
7.4 KiB
Markdown
84 lines
7.4 KiB
Markdown
# mos-remediation — LIVE BOARD (keep < 8 KB)
|
||
|
||
**Phase:** EXECUTING — RM-03 at owner-merge; RM-61 **MERGED**; **RM-02 keystone is the front**.
|
||
**Updated:** 2026-08-01 — seam crossed; successor seat resumed, attested from the files, and is driving.
|
||
⚠ That was a **MANUAL pane respawn** (prior seat ~803k tokens): it validates the checkpoint+rehydration
|
||
**design**, NOT a lifecycle **mechanism** — P-LIFECYCLE rotation does not exist yet (**D-41 / RM-62**).
|
||
|
||
## Head
|
||
|
||
- Charter + 15 decisions + 4-build plan: `MISSION.md`. Backlog + all findings: `TASKS.md`.
|
||
- Planning DONE (58 tasks, P0–P5). **DECISION-1/2/3 all RULED by Mos 2026-07-31** (`TASKS.md` §5) —
|
||
nothing is waiting on a decision. D-2's availability _target_ is Jason-pending and non-blocking.
|
||
- **Executing, not planning.** RM-01 is MERGED; three lanes are live (see In-flight).
|
||
- Orchestrator seat `mos-remediation` LIVE, owns the mission, resumed across the rotation seam
|
||
2026-08-01 and re-attested to Mos from the files. Residency attestation: PASS.
|
||
|
||
## In-flight
|
||
|
||
| Task | Owner | State |
|
||
| ------------------- | --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
|
||
| RM-01 checkout | — | **MERGED** `f58b3699` (#1027) |
|
||
| RM-03 queue guard | Jason (re-sync) | ✅ **MERGED** `58b971ab` (#1032), #1019 closed. ⚠ **NOT DELIVERED**: installed guard still the broken one (291 lines / 0 `ASSERTED_NOT_READY` vs main 482 / 5). Re-sync via `mosaic upgrade`, then **prove it blocks a KNOWN-RED pipeline** — **D-51** |
|
||
| RM-02 registry ★key | rev-974 | **RE-REVIEW @ `e910a45a`** — (d)-strict history REMOVED + blocker 2 NARROWED (D-52) + blocker 3 + renderer. Overclaim control **fires at exit 84**, verified by orchestrator. CI 2201 **10/10**. ACs @ `dde38717` |
|
||
| RM-61 CI exemption | — | ✅ **MERGED** `f4fd5967` (#1033). #1034 closed; **#1000 stays OPEN** (retirement trigger). Exemption is on `main` |
|
||
| RM-59 / RM-60 | Jason (infra) | tracked deps; RM-60 option **B** |
|
||
| #1023 queue attempt | Jason | SUPERSEDED-PENDING-JASON — live REQUEST_CHANGES, do **not** merge |
|
||
|
||
### For the incoming orchestrator — read this before acting
|
||
|
||
1. **Lane state lives in the In-flight table above — this item does NOT restate it.** It went stale
|
||
three times in one session by duplicating that table (D-26's class). Read the table. ⚠ **And
|
||
re-derive any board claim from the provider before load-bearing use (D-43)** — the board is
|
||
sole-written and has no independent verifier.
|
||
2. **`docs/remediation/TASKS.md` is authoritative**, not the newest voice in a chat. It holds 55 findings
|
||
(D-1…D-6 in `BOARD-LEDGER.md`, D-7…D-54 + D-38c in TASKS.md), every ruling with its rationale, and the
|
||
requirements each finding placed on RM-02/RM-34/RM-50/RM-55.
|
||
3. **`MISSION.md` carries the first-class principles** — read them there, they are not listed here.
|
||
Two added 2026-08-01: **the anchor must live outside the audited party's authority** (D-19/D-25/D-45,
|
||
third arrival) and **no universally-quantified check may pass over an empty set** (D-44/D-46).
|
||
4. **Seat identity:** `export MOSAIC_GIT_IDENTITY=<seat>` is stripped by a context reset (**D-34**) —
|
||
every dispatch/rehydration brief must re-export it, or the seat cannot use its credentials.
|
||
5. **Scan CI from `-f json`, never default text** — text mode omits `clone` (**D-33**). State counts.
|
||
6. **The queue guard is zero-information until RM-03 merges** (**D-23**) — never cite its green.
|
||
7. **The bounded CI re-roll used on RM-02 was a one-time stopgap, NOT policy.** A per-PR free re-roll is
|
||
D-21 normalisation. Do not repeat it; RM-61 is the fix.
|
||
|
||
## Delivery gates — REFERENCE, do not restate
|
||
|
||
Canonical: `~/.config/mosaic/fleet/roles.local/merge-gate.md` (verdict authority) +
|
||
`~/.config/mosaic/fleet/roles/validator.md`. Order and the freeze/zero-information rules: `MISSION.md`
|
||
and `KICKSTART.md`. **Read them there** (why: **D-26**, in `BOARD-LEDGER.md`).
|
||
|
||
## Fleet seats
|
||
|
||
Roster rolled verbatim to [`BOARD-LEDGER.md`](./BOARD-LEDGER.md); live truth is `mosaic fleet ps`.
|
||
|
||
## Gate status
|
||
|
||
- Freeze: LIFTED for this workstream only.
|
||
- Git identity: orchestrator runs `MOSAIC_GIT_IDENTITY=mos-dt-0` INTERIM. Mos ruled gate-16 HOLDS (author≠reviewer is what
|
||
gate-16 protects; rev-974 reviews, mos-dt-0 never self-reviews). Dedicated identity TRACKED, Mos provisions.
|
||
- Capability + seat identity (**D-11b / D-11a**, incl. the false-NEGATIVE twin): authoritative in
|
||
`TASKS.md`. Short form — **assert the DIFFERENTIAL as that seat** (authenticated `push:true` vs
|
||
unauthenticated `push:false`); a single endpoint can be true for anyone or 403 for an unrelated
|
||
scope. Full text rolled to [`BOARD-LEDGER.md`](./BOARD-LEDGER.md).
|
||
- ⚠ **LIVE HAZARD (D-37) — one shared `.git/config` re-identifies EVERY worktree at once.** Every seat,
|
||
including `rev-974`'s review worktree, currently authors as **`coder-mos1`**; `MOSAIC_GIT_IDENTITY`
|
||
does **not** override it. **STANDING ORDER: commit with explicit
|
||
`git -c user.name=<seat> -c user.email=<seat>@…`, and NOBODY rewrites the shared config mid-flight.**
|
||
Real fix authorised, Mos owns it, sequenced at a quiet seam. **#1024 implicated.** Detail: D-37.
|
||
- Standing worker-brief doctrine (mandatory in EVERY brief): re-export `MOSAIC_GIT_IDENTITY` (**D-34**);
|
||
commit early/WIP (**D-31**); don't weaken a RED test to pass; if a check is unrunnable SAY SO, never
|
||
substitute; `agent-send -f` never `-m`; artifacts off shared `/tmp`; scan CI from `-f json` (**D-33**);
|
||
**relay observations into an open review, NEVER your own conclusion on an open check (D-39)**; the
|
||
**author never adjudicates their own PR's blocker status** — surface evidence, prepare the fix, hold.
|
||
- Remote control: native `/remote-control` NOT wired in this runtime. Path is **Mos-relay**
|
||
(Jason ↔ mos-claude via Discord ↔ mos-remediation via agent-send). Not a blocker.
|
||
|
||
## Decisions log — full record in [`TASKS.md`](./TASKS.md)
|
||
|
||
All 55 findings (D-1…D-6 in `BOARD-LEDGER.md`, D-7…D-54 + D-38c in `TASKS.md`) and every ruling with
|
||
its rationale live there. **Not duplicated here.** The history of _why_ this board must not restate —
|
||
six stale copies across two seams — is rolled verbatim into [`BOARD-LEDGER.md`](./BOARD-LEDGER.md).
|