jason.woltje
ad21ad7ac5
ci/woodpecker/pr/ci Pipeline failed
Ratifies the Mosaic Stack PRD rev1 (Jason Woltje, 2026-09-01) as project source of truth and installs the GOV.1 lifecycle model: - docs/PRD.md becomes a permanent shim (kind: shim, current_rev -> docs/PRDs/2026-08-31_PRD_rev1/). Its path never changes again. - docs/PRDs/2026-08-26_PRD_rev0/PRD.md archives the 2026-08-26 North Star verbatim (sha256 60cc2f98...36afdf unchanged). Archive, never delete. - docs/PRDs/2026-08-31_PRD_rev1/ is the frozen rev1 bundle: 18 sectioned documents (VIS, DATA, AUTHN, AUTHZ, SEAT, ROLE, HARN, PROV, SESS, UI, CLI, GOV.1-5) consolidating rev0 D1-D15, the fleet north star, the agent-runtime L1/L2 contracts and the control-plane-surfaces lane findings, with a single decision map (GOV.3) and a closed open-questions frontier (GOV.5, grill rounds 1-8). Drafting inputs (_source-* snapshots) are not shipped. Consequences of the ratified rulings carried in the same change: - Q-T1 (ruling B, "shipped but frozen"): D3 amended in GOV.3/VIS.1; federation M1-M3 acknowledged as shipped behind tier === 'federated', excluded from the v1 bar and frozen, with a security re-audit gate before any resumption. docs/MISSION-MANIFEST.md, docs/federation/MISSION-MANIFEST.md and docs/scratchpads/mvp-20260312.md get status: superseded + banners (content preserved verbatim); docs/guides/deployment.md gains a "Relationship to the PRD (D15)" section. NORTH_STAR.yaml adds dormant workstream M (projects no goals by design); NORTH_STAR.md regenerated. - Q-G2 (distinct registry prefixes): every citation of the operator DECISION-REGISTER in the bundle reads OD-nn; the stack registry stays D1-D15; L1-Dnn/L2-Dnn untouched. Prefix rule recorded in GOV.1. Follow-ups (not in this PR): CI parity drift-gate witness (Q-C1); brain-side DECISION-REGISTER rename to OD- with redirect table on its next touch.
172 lines
9.9 KiB
Markdown
172 lines
9.9 KiB
Markdown
---
|
||
id: GOV.5
|
||
status: ratified
|
||
ratified: 2026-09-01 (Jason Woltje; PRD rev1 ratification PR)
|
||
---
|
||
|
||
# GOV.5 — Open questions (the grill list)
|
||
|
||
Every question the corpus could not settle. This is the E5 ms-grill-me input;
|
||
ratification is blocked until this list is empty or every remaining row is
|
||
explicitly deferred with an owner. IDs are stable; answered questions get their
|
||
ruling recorded here and flow into the owning section.
|
||
|
||
**Frontier status (2026-09-01, grill rounds 3–8 complete): EMPTY.** Every row
|
||
is ruled, dissolved, or deferred-with-owner. The operator-side Q-T3 canon
|
||
coalescence closed in round 8 and was executed the same day (brain commit
|
||
`59d43270`). E6 ratification executed 2026-09-01; this list is frozen with the
|
||
bundle.
|
||
|
||
## Data model
|
||
|
||
- **Q-D1** — **RULED, Jason 2026-09-01: consolidate.** `launch.env` folds
|
||
into `profile.json` (one seat record). Precondition verified same day:
|
||
`mosaic-core/lib/loader.ts seatRole()` parses profile.json as a generic
|
||
record and reads only `role` — widened files tolerated by construction.
|
||
Migration staged as lane work (ledger B1).
|
||
- **Q-D2** — **RULED, Jason 2026-09-01: per-provider map + broker refs.**
|
||
`profile.json` carries a per-provider map whose values are credential-broker
|
||
references (`environment/service/component/secret-name`), never secrets —
|
||
one seat, N providers, zero secrets in the brain tree. Flows to
|
||
[[DATA.1-record-authority]] and [[AUTHN.1-auth-accounts]].
|
||
- **Q-D3** — **RULED, Jason 2026-09-01: the projection engine owns.** One
|
||
writer: the role-projection engine (`role apply` path). The launcher seeds
|
||
nothing itself — it invokes the projector; Pi and every harness get
|
||
regenerated files on each role/seat change; hand edits are drift, flagged by
|
||
`validate`. Consistent with L2-D19 + Q-T5. Unblocks the reconciliation
|
||
features (lane ledger B3 → D8).
|
||
- **Q-D4** — **RULED, Jason 2026-09-01: role ceiling + seat choice.** The
|
||
Role Revision defines the allowed model set (policy ceiling); the seat
|
||
records preferences within it; effective models = intersection, consistent
|
||
with the L2-D39 intersection chain. Flows to [[HARN.1-harness-config]] and
|
||
role-harness-config DESIGN Q2 (same ruling, both doors).
|
||
- **Q-D5** — **DEFERRED with owner (Jason 2026-09-01)**: the mutating
|
||
config-engine half gets its own ruling after v1 read-only `validate`/`plan`
|
||
ships; owner = the mosaic-config workstream. ([[CLI.1-parity]] §v1 subset)
|
||
|
||
## Sessions
|
||
|
||
- **Q-S1** — **DEFERRED with owner (Jason 2026-09-01)**: the
|
||
session-id ↔ incarnation-id contract is settled inside the session-lifecycle
|
||
draft before it lands (which now carries the Q-S4 two-path requirement);
|
||
owner = that draft's ratification. ([[SESS.1-session-continuity]])
|
||
- **Q-S2** — **RULED, Jason 2026-09-01: step-up re-auth required.** Role
|
||
rebinding is an authority-changing act: fresh principal re-authentication
|
||
≤10 minutes before the confirmation lands, matching the S2
|
||
identity-lifecycle linking precedent. Flows to [[SEAT.1-seat-profile]]
|
||
§role-binding and the UI.1 seat-page spec.
|
||
- **Q-S3** — **DEFERRED with owner (Jason 2026-09-01)**: the measurable
|
||
continuity-degradation bar is settled inside the session-lifecycle draft
|
||
before it lands; owner = that draft's ratification.
|
||
- **Q-S4** — **RULED, Jason 2026-09-01: two-path requirement ratified.** The
|
||
session-lifecycle draft may not land with one relaunch path. Role change →
|
||
clean-session path (new incarnation + fencing token, ephemeral context
|
||
discarded, OD-02/OD-03); harness/model/provider change → continuity path (same
|
||
Stack session id, checkpointed context restored, OD-57–OD-61, no noticeable
|
||
degradation). Binding requirement on the draft, recorded in
|
||
[[SESS.1-session-continuity]] §state machine.
|
||
|
||
## Audit
|
||
|
||
- **Q-A1** — **RULED, Jason 2026-09-01: mechanical tooling.** The audit is
|
||
deterministic tooling over the grant/assignment record (witness-style, per
|
||
the S2 writer-coverage pattern); its output feeds the audit page read-only.
|
||
Agents may consume audit output but never produce the verdict ("prompt
|
||
adherence is not an enforcement mechanism"). Flows to
|
||
[[AUTHZ.1-capability-authority]] and [[UI.1-webui-surfaces]] §audit.
|
||
- **Q-A2** — **DISSOLVED by the Q-A1 ruling**: the auditor is code, audited by
|
||
ordinary review and CI witnesses, not a seat subject to misdirection.
|
||
- **Q-A3** — **DEFERRED with owner (Jason 2026-09-01)**: the computable
|
||
misdirection metric is designed inside the mechanical audit tooling ruled by
|
||
Q-A1; owner = the audit-tooling workstream (lane ledger C2).
|
||
|
||
## Surfaces
|
||
|
||
- **Q-N1** — **DEFERRED with owner (Jason 2026-09-01)**: technical
|
||
investigation of the in-browser OAuth flow (tmux-bridged terminal vs
|
||
server-side) runs before the auth page builds; owner = the auth-page
|
||
workstream (lane ledger D6). ([[AUTHN.1-auth-accounts]])
|
||
- **Q-C1** — **RULED, Jason 2026-09-01: CI witness in the stack repo.** The
|
||
parity matrix becomes a generated artifact with a drift-gate witness
|
||
(contract-9 pattern): CI regenerates the inventory from code and fails on
|
||
divergence from the committed matrix. Flows to [[CLI.1-parity]]; the
|
||
witness itself is E6-return follow-up work.
|
||
|
||
## Governance
|
||
|
||
- **Q-G1** — **RULED, Jason 2026-09-01: both ratified.** L2-D52
|
||
(least-privilege Assignment issuance, closes G1+G2) and the G6 WebUI
|
||
surface-scope fix applied per their return procedures after digest
|
||
re-verification; amendment files flipped to ratified; lane ledger A3/A4
|
||
closed.
|
||
- **Q-G2** — **RULED, Jason 2026-09-01: distinct prefixes at source.**
|
||
Stack keeps D1–D15; the operator DECISION-REGISTER renames to **OD-01…OD-65**
|
||
with a redirect table at the source doc; file-local D-numbering in drafts is
|
||
prohibited going forward (each decision doc declares a unique registry
|
||
prefix, rule lands in [[GOV.1-prd-lifecycle]]). Applied at E6 return for
|
||
stack references; brain-side rename on next DECISION-REGISTER touch.
|
||
- **Q-G3** — **RULED, Jason 2026-09-01: Jason marks; archive in bundle.**
|
||
Graduation is a ratification act — Jason marks it (grill or direct ruling);
|
||
the graduated contract text archives inside the then-current PRD revision
|
||
bundle ([[GOV.4-workstream-contracts]] gains a graduated-set section),
|
||
keeping the frozen-bundle model intact.
|
||
|
||
## Triage-raised (E2 sweep, 2026-08-31)
|
||
|
||
- **Q-T1** — **RULED B, Jason 2026-09-01: "shipped but frozen."** Amend D3 to
|
||
acknowledge federation M1–M3 exist (Step-CA, enrollment, grants, mTLS auth
|
||
guard, ScopeService, list/get/capabilities verbs; M3 landed 2026-06-24/25),
|
||
are excluded from the v1 bar, and are frozen; re-home tracking in
|
||
NORTH_STAR.yaml as a dormant workstream; frozen cert/auth code carries a
|
||
**security re-audit gate** before any resumption. Consequences at E6 return:
|
||
supersession/status banners on the three stale docs (root MISSION-MANIFEST,
|
||
federation/MISSION-MANIFEST, scratchpads/mvp-20260312), reconcile
|
||
guides/deployment.md with D15, NORTH_STAR.yaml dormant entry. The P5
|
||
scope ambiguity (governance-federation vs shipped mTLS-query federation)
|
||
stays open inside the future federation PRD, not rev1. Evidence: lane
|
||
`FEDERATION-DOSSIER-2026-08-31.md`.
|
||
- **Q-T2** — **RULED, Jason 2026-09-01: all three re-ratified** into the
|
||
rev1 decision map ([[GOV.3-decision-map]] §re-ratified orphans): "No Python"
|
||
in the monorepo; Matrix/MACP exactly-three-install-modes with Mode A
|
||
(split-domain) primary; OpenBrain excluded from consolidation scope. The
|
||
Matrix ruling's open DNS/domain prerequisite gets its own row (Q-T6).
|
||
- **Q-T3** — **RULED (partial), Jason 2026-09-01: coalesce under the
|
||
STRUCTURE-CANON name.** MOSAIC-CANON's more comprehensive content is
|
||
authoritative; `STRUCTURE-CANON.md` is the logical surviving document name;
|
||
the two coalesce into one. Conflict report delivered and all six
|
||
decision points ruled (grill round 8, 2026-09-01): per-seat credential
|
||
slots win; doc paths corrected to `fleet/auth/`/`fleet/memory/`;
|
||
ENTITY.md/README.md stay required with a 42-seat backfill task; merge
|
||
executed with the full reference sweep, MOSAIC-CANON reduced to a pointer
|
||
shim. Record: lane `CANON-COALESCENCE-2026-09-01.md`. Operator-side; not a
|
||
rev1 blocker.
|
||
- **Q-T4** — **RULED, Jason 2026-09-01, two parts.**
|
||
**(a) Two independent axes**: "Standalone/Enterprise" in the S2 corpus is a
|
||
multi-tenancy/isolation *mode* (`platform_mode`, D3/D11); D15's "compose
|
||
standalone tier" is deployment *packaging*. Orthogonal. rev1 text always
|
||
says "standalone mode" vs "compose tier"; mode-conversion.md needs a
|
||
terminology note only, not a rewrite.
|
||
**(b) Own track, rev1 cites**: rev1 ratifies citing the nine contracts as
|
||
DRAFT successor material with status noted; each contract ratifies on its
|
||
own PR when its family lands. Extraction record: lane
|
||
`S2-EXTRACTION-2026-08-31.md`.
|
||
- **Q-T5** — **RULED, Jason 2026-09-01: scope to files.** Adopted wording:
|
||
"Generated settings *files* are projections of the active Role Revision,
|
||
never authority (L2-D19). DB settings records written through audited
|
||
Gateway commands (`platform_mode`, `registration_mode`, `custody_config`,
|
||
`bootstrap.seed-company-name`, and their successors) are records of
|
||
authority like any other SOT row." No corpus conflict remains. Case law:
|
||
contract 1 §5.4, contract 8 §2.4, contract 9 §3.2.
|
||
- **Q-T6** — **DEFERRED with owner (Jason 2026-09-01)**: the Matrix/MACP
|
||
Mode A DNS/domain prerequisite (`archive/planning/matrix-macp/rfc-001:428`)
|
||
rules before any Matrix install work resumes; owner = whoever reopens
|
||
Matrix. Until then Mode A is primary-on-paper only.
|
||
|
||
## Deferred-by-scope (recorded, not blocking rev1)
|
||
|
||
- Federation design (D3 — roadmap placeholder; nothing in v1 may foreclose it).
|
||
*Q-T1 ruled B (2026-09-01): D3 to be amended — M1–M3 acknowledged, frozen,
|
||
security re-audit gate before resumption; design itself stays deferred.*
|
||
- OS/kernel-level seat sandboxing (explicit lane non-goal; role-lane
|
||
discipline, not process containment).
|