docs(threads-ot6): draft promotion-write ↔ weave seam contract - #25
Conversation
Draft the single integration contract between 'coven memory promote' (coven-memory M2, substrate side) and weave enforcement (authority side). Status is DRAFT pending Cody's agreement; threads-ot6 acceptance requires both Echo and Cody, so this is half the artifact, not the whole one. What the contract fixes in writing: - Boundary per PHASE-0-DESIGN 3.3.1 anti-non-negotiable, quoted verbatim: coven-memory decides what to promote, coven-threads decides whether the write commits. Neither side infers the other's answer. Per 3.3.2, promotion targets source-authoritative surfaces only; derived-structure writes fall outside the contract rather than receiving a weaker gate. - Channel::Deliberate, already the named referent in 2.4, with the Phase-5 decision-1 constraint stated explicitly: ApprovalPath is never derived from Channel. - Tier 1-3 runs the normal proposal pipeline; Tier 0 is rejected from it entirely, with principal-authorized protected writes on the separate audited path and unreachable from 'coven memory promote'. - Nine fail-closed edges, each mapped to an existing RejectReason. No new reject reason is introduced -- a seam needing its own rejection vocabulary would be evidence it had grown policy it should not own. Marked open for Cody: the recommended FamiliarCoherence default ceremony (3.1, [PROPOSED]), and the unverified assertion that the daemon revalidates rather than trusts a client-declared channel (2). Inherited blockers recorded with a must-not-be-marked-satisfied clause so this bead cannot close on a draft that reads green: - 3.2 is currently false in coven -- threads-dgg - 5.2 typed terminal closes -- threads-980 Discovered while drafting: threads-55s. Drafted from the coven-threads side only. coven-memory was outside the session filesystem boundary, so every claim about the substrate side is an expectation for Cody and the coven-memory owner to confirm, not verified fact. Refs: threads-ot6, mirrors cmem-r59 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…cabularies The original fail-closed table implied one rejection vocabulary where the code has two distinct types at two distinct stages: - RejectReason (validate.rs) — admission rejections; the write never enters the proposal pipeline. - WindowCloseReason (audit layer, trigger-enforced) — lifecycle terminations; an opened veto window must close with a typed reason. Gate-4 divergence and evidence-deadline failure now sit under evidence_diverged where they actually land; revalidation_failed and superseded rows added so §4 and §5.2 agree. Values verified against the SQLite trigger constraints in audit.rs. No semantic change to the contract; review-provenance note added to the colophon. Refs: threads-ot6 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Adds a draft seam-contract document defining the integration boundary between coven memory promote (substrate-side write production) and coven-threads/daemon weave enforcement (authority-side commit permission), aligning terminology with Phase-0/Phase-5 vocabulary.
Changes:
- Introduces a single contract doc covering boundary ownership, promotion channel expectations, target classification fork, fail-closed behavior, and audit expectations.
- Captures explicit cross-bead dependencies (
threads-dgg,threads-980) as acceptance blockers. - Notes an audit-legibility gap (
memory_entry_admitteddropschannel) as a follow-up.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Keep the deliberate-channel path explicitly unimplemented and the default ceremony proposed; remove the unsupported mirror ID, preserve human/no-window semantics and distinguish daemon persistence from validator contracts. Incorporate the upstream maintainer review corrections without changing their intent. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: BunsDev <68980965+BunsDev@users.noreply.github.com>
Preserve all four maintainer corrections and retain the separately reviewed human/no-window clarification. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: BunsDev <68980965+BunsDev@users.noreply.github.com>
Require daemon-established targets and validated provenance, preserve applicable human authorization, and correct fray and opened-window close semantics. Keep ceremony selection proposed and human gates unresolved. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
|
Cody approved-continuation checkpoint: published draft corrections at b8c7532. The independent language review identified and this patch corrects caller-declared derived-target exemption, recorded-but-unvalidated provenance, omission of applicable explicit human authorization, inaccurate fray ordering/proposal eligibility, and unavailable evidence mapped to the wrong terminal reason. Opened-window vocabulary is now distinguished from human/no-window rejection, and implementation is explicitly subordinate to the governing contract. Sources rechecked: RFC-0001 at OpenCoven/familiar-contract commit 13d150a32a817da19bb4e5053f2205b15db0bb0a (sections 3.4, 5.6, 5.6.1), existing Threads Phase-5 section 4 and validate.rs ordering. Only docs/seam-promotion-write-contract.md changed; git diff --check passed. No Rust/SQL, migration, frozen spec, runtime implementation or authority mechanism was changed. The default remains PROPOSED; source-attestation validation and applicable admission evidence are requirements, not claims that runtime support exists. Keep this PR draft pending attributable language agreement. Runtime acceptance stays in threads-lm4, the mirror stays unresolved under threads-5mn, and no Nova/Val gate is granted. |
…-promotion-contract
Section 2 left the channel question open between two readings: the daemon determines the effective channel, or coven-memory declares it and the daemon revalidates. Val decided it on 2026-09-16: the daemon determines the effective channel from the promotion route itself. A caller-supplied channel label is descriptive only and must not be an input to that determination. Where a label is supplied and disagrees, the daemon rejects rather than coercing or silently ignoring the disagreement. The declaring side does not hold channel authority. This widens nothing. Determining a channel is not permission to commit, and section 3 still decides whether the write may land. The ownership table in section 1 now names the daemon for channel determination so the decision is visible where owners are defined. Re-verified threads-xpo against coven origin/main on 2026-09-16 rather than trusting the 2026-08-09 snapshot. No submission path exists and no construction site produces Channel::Deliberate, so the NOT YET IMPLEMENTED marker stays. One claim in that record is now stale: ward_audit_census.rs parses a stored "deliberate" channel, which is a read path over existing audit history and not a submission path. Section 2 says so rather than repeating "referenced nowhere". Section 7 acceptance item 1 required Echo and Cody to agree the language. That predates the solo-maintainer review policy adopted 2026-09-13, under which Val is the sole human acceptance authority for this work. Item 1 now names Val, with agent passes recorded as supporting engineering evidence rather than a separate human acceptance, so the document is not merged against its own criteria. Refs: threads-ot6, threads-xpo Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Current disposition (2026-09-17)
Contract language merged as
74a7840cf45f3e706378ba140909e2fcd33812b4.threads-ot6is complete for its language-only scope. The coven-memory mirroris
cmem-r59, verified directly withbd show cmem-r59 --jsonin thatrepository's live Dolt database. Its title, seam description, and the linked
cmem-6gynotes identifycmem-r59/threads-ot6; the earlier passive-exportlookup could not establish absence.
threads-5mntracks this reference repair.Coven #887 is closed for its protected-route criteria. Admission channel
recording landed in Threads #72. Promotion runtime conformance remains
threads-lm4, blocked by the absent authenticated authority/committed-Wardstate and daemon submission path. No promotion implementation or Phase-5
human acceptance is claimed.
The original publication record below is historical; its draft status,
unresolved mirror, and draft-only downstream descriptions are superseded.
Draft - language-only contract review, not runtime acceptance.
Refs:
threads-ot6; coven-memory mirror ID UNRESOLVED (threads-5mn).Repository-owned coven-memory planning documents track this seam as
SEAM;they do not establish a specific counterpart Bead ID.
Objective and scope
Define the promotion-write / weave contract in
docs/seam-promotion-write-contract.md: coven-memory chooses what to promote,Threads supplies protected-write validation contracts, and the Coven daemon
owns authentication, staging, commit-time replay, writes, and audit persistence.
This PR does not implement a promotion command or a second audit store.
coven memory promoteremains planned work.Channel::Deliberateis anormative requirement for that future boundary, not observed daemon behavior.
The absent production submission path is tracked in
threads-xpo.ApprovalPathremains independent ofChannel; the suggestedFamiliarCoherence { veto }default remains PROPOSED, not ratified policy.Acceptance split
threads-ot6was retargeted to language correctness on 2026-08-20. It requiresaccurate future-versus-current wording, an explicit unresolved mirror reference,
a proposed default, and matching language-only acceptance in the document.
Runtime proof remains in
threads-lm4and its prerequisites; it is not aprerequisite for reviewing specification language.
The runtime findings remain unresolved:
threads-dgg/ P0 threads-dgg: Remove protected SOUL.md from the proposal/approval pipeline coven#887: protected targets must not gain proposalwrite authority; draft fix: remove Tier-0 proposal authority coven#933 is a checkpoint, not closure.
threads-980/ P0 threads-980: Require one typed terminal close for every opened veto window coven#886: every opened window needs exactly one typedterminal close; draft fix: require typed veto-window terminal closes coven#932 is a checkpoint, not closure.
threads-xpoandthreads-55s: supported deliberate-channel intake andauditable admission channels are still required.
No agent review substitutes for independent Nova review or Val's freeze.
Published review follow-up (2026-09-09)
The reviewed corrections are published at
a79dcc1763fa63dd02c0056c452f0ea7a0ef29e5indocs/seam-promotion-write-contract.md:language-only scope.
audit citations.
without allowing an existing window to lose its terminal close.
These edits are committed and pushed. All four intervening maintainer correction
commits are preserved in the history; the merge retains the additional
human/no-window clarification. Agent language review is not a GitHub approval or contract freeze.
The exact mirror lookup remains open in
threads-5mn; no ID was guessed.Impact and evidence
This is documentation-only work: no public Rust, SQL, migration, identity,
credential, or runtime authority change. Sources consulted include
specs/PHASE-0-DESIGN.md,specs/PHASE-5-APPROVAL-SEMANTICS.md,crates/coven-threads-core/src/{validate,audit,approval}.rs, the retargeted Bead,and coven-memory's repository-owned
docs/CATCHUP-PLAN-2026-07-24.md.Local whitespace validation passed. There is no downstream conformance claim.
Rollback is limited to the documentation; unresolved runtime and human gates
remain unchanged.
Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com