docs(threads-ot6): draft promotion-write ↔ weave seam contract - #25
docs(threads-ot6): draft promotion-write ↔ weave seam contract#25BunsDev wants to merge 9 commits into
Conversation
Draft the single integration contract between 'coven memory promote' (coven-memory M2, substrate side) and weave enforcement (authority side). Status is DRAFT pending Cody's agreement; threads-ot6 acceptance requires both Echo and Cody, so this is half the artifact, not the whole one. What the contract fixes in writing: - Boundary per PHASE-0-DESIGN 3.3.1 anti-non-negotiable, quoted verbatim: coven-memory decides what to promote, coven-threads decides whether the write commits. Neither side infers the other's answer. Per 3.3.2, promotion targets source-authoritative surfaces only; derived-structure writes fall outside the contract rather than receiving a weaker gate. - Channel::Deliberate, already the named referent in 2.4, with the Phase-5 decision-1 constraint stated explicitly: ApprovalPath is never derived from Channel. - Tier 1-3 runs the normal proposal pipeline; Tier 0 is rejected from it entirely, with principal-authorized protected writes on the separate audited path and unreachable from 'coven memory promote'. - Nine fail-closed edges, each mapped to an existing RejectReason. No new reject reason is introduced -- a seam needing its own rejection vocabulary would be evidence it had grown policy it should not own. Marked open for Cody: the recommended FamiliarCoherence default ceremony (3.1, [PROPOSED]), and the unverified assertion that the daemon revalidates rather than trusts a client-declared channel (2). Inherited blockers recorded with a must-not-be-marked-satisfied clause so this bead cannot close on a draft that reads green: - 3.2 is currently false in coven -- threads-dgg - 5.2 typed terminal closes -- threads-980 Discovered while drafting: threads-55s. Drafted from the coven-threads side only. coven-memory was outside the session filesystem boundary, so every claim about the substrate side is an expectation for Cody and the coven-memory owner to confirm, not verified fact. Refs: threads-ot6, mirrors cmem-r59 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…cabularies The original fail-closed table implied one rejection vocabulary where the code has two distinct types at two distinct stages: - RejectReason (validate.rs) — admission rejections; the write never enters the proposal pipeline. - WindowCloseReason (audit layer, trigger-enforced) — lifecycle terminations; an opened veto window must close with a typed reason. Gate-4 divergence and evidence-deadline failure now sit under evidence_diverged where they actually land; revalidation_failed and superseded rows added so §4 and §5.2 agree. Values verified against the SQLite trigger constraints in audit.rs. No semantic change to the contract; review-provenance note added to the colophon. Refs: threads-ot6 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Adds a draft seam-contract document defining the integration boundary between coven memory promote (substrate-side write production) and coven-threads/daemon weave enforcement (authority-side commit permission), aligning terminology with Phase-0/Phase-5 vocabulary.
Changes:
- Introduces a single contract doc covering boundary ownership, promotion channel expectations, target classification fork, fail-closed behavior, and audit expectations.
- Captures explicit cross-bead dependencies (
threads-dgg,threads-980) as acceptance blockers. - Notes an audit-legibility gap (
memory_entry_admitteddropschannel) as a follow-up.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Keep the deliberate-channel path explicitly unimplemented and the default ceremony proposed; remove the unsupported mirror ID, preserve human/no-window semantics and distinguish daemon persistence from validator contracts. Incorporate the upstream maintainer review corrections without changing their intent. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: BunsDev <68980965+BunsDev@users.noreply.github.com>
Preserve all four maintainer corrections and retain the separately reviewed human/no-window clarification. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: BunsDev <68980965+BunsDev@users.noreply.github.com>
Require daemon-established targets and validated provenance, preserve applicable human authorization, and correct fray and opened-window close semantics. Keep ceremony selection proposed and human gates unresolved. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
|
Cody approved-continuation checkpoint: published draft corrections at b8c7532. The independent language review identified and this patch corrects caller-declared derived-target exemption, recorded-but-unvalidated provenance, omission of applicable explicit human authorization, inaccurate fray ordering/proposal eligibility, and unavailable evidence mapped to the wrong terminal reason. Opened-window vocabulary is now distinguished from human/no-window rejection, and implementation is explicitly subordinate to the governing contract. Sources rechecked: RFC-0001 at OpenCoven/familiar-contract commit 13d150a32a817da19bb4e5053f2205b15db0bb0a (sections 3.4, 5.6, 5.6.1), existing Threads Phase-5 section 4 and validate.rs ordering. Only docs/seam-promotion-write-contract.md changed; git diff --check passed. No Rust/SQL, migration, frozen spec, runtime implementation or authority mechanism was changed. The default remains PROPOSED; source-attestation validation and applicable admission evidence are requirements, not claims that runtime support exists. Keep this PR draft pending attributable language agreement. Runtime acceptance stays in threads-lm4, the mirror stays unresolved under threads-5mn, and no Nova/Val gate is granted. |
Draft - language-only contract review, not runtime acceptance.
Refs:
threads-ot6; coven-memory mirror ID UNRESOLVED (threads-5mn).Repository-owned coven-memory planning documents track this seam as
SEAM;they do not establish a specific counterpart Bead ID.
Objective and scope
Define the promotion-write / weave contract in
docs/seam-promotion-write-contract.md: coven-memory chooses what to promote,Threads supplies protected-write validation contracts, and the Coven daemon
owns authentication, staging, commit-time replay, writes, and audit persistence.
This PR does not implement a promotion command or a second audit store.
coven memory promoteremains planned work.Channel::Deliberateis anormative requirement for that future boundary, not observed daemon behavior.
The absent production submission path is tracked in
threads-xpo.ApprovalPathremains independent ofChannel; the suggestedFamiliarCoherence { veto }default remains PROPOSED, not ratified policy.Acceptance split
threads-ot6was retargeted to language correctness on 2026-08-20. It requiresaccurate future-versus-current wording, an explicit unresolved mirror reference,
a proposed default, and matching language-only acceptance in the document.
Runtime proof remains in
threads-lm4and its prerequisites; it is not aprerequisite for reviewing specification language.
The runtime findings remain unresolved:
threads-dgg/ P0 threads-dgg: Remove protected SOUL.md from the proposal/approval pipeline coven#887: protected targets must not gain proposalwrite authority; draft fix: remove Tier-0 proposal authority coven#933 is a checkpoint, not closure.
threads-980/ P0 threads-980: Require one typed terminal close for every opened veto window coven#886: every opened window needs exactly one typedterminal close; draft fix: require typed veto-window terminal closes coven#932 is a checkpoint, not closure.
threads-xpoandthreads-55s: supported deliberate-channel intake andauditable admission channels are still required.
No agent review substitutes for independent Nova review or Val's freeze.
Published review follow-up (2026-09-09)
The reviewed corrections are published at
a79dcc1763fa63dd02c0056c452f0ea7a0ef29e5indocs/seam-promotion-write-contract.md:language-only scope.
audit citations.
without allowing an existing window to lose its terminal close.
These edits are committed and pushed. All four intervening maintainer correction
commits are preserved in the history; the merge retains the additional
human/no-window clarification. Agent language review is not a GitHub approval or contract freeze.
The exact mirror lookup remains open in
threads-5mn; no ID was guessed.Impact and evidence
This is documentation-only work: no public Rust, SQL, migration, identity,
credential, or runtime authority change. Sources consulted include
specs/PHASE-0-DESIGN.md,specs/PHASE-5-APPROVAL-SEMANTICS.md,crates/coven-threads-core/src/{validate,audit,approval}.rs, the retargeted Bead,and coven-memory's repository-owned
docs/CATCHUP-PLAN-2026-07-24.md.Local whitespace validation passed. There is no downstream conformance claim.
Rollback is limited to the documentation; unresolved runtime and human gates
remain unchanged.
Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com