docs(P00): grill — D-086..D-090 binding decisions (CONDITIONAL PASS)
GRILL stage for v0.7. ci-griller red-teamed the plan across 9 axes + 7 specific probes. Overall verdict: CONDITIONAL PASS (confidence 0.72). 5 binding decisions applied to PLANS.md + ARCHITECTURE.md + oy-state + PROJECT.md: - D-086: P1 Factory functional for Phase-2 categories ONLY (FactoryAllowedPhases = [Phase2] in P1; P2 extends to [Phase2,Phase3,Phase4]); P1 simtest adds out-of-phase rejection negative case - D-087: PierCarriesVoice=false added as 12th locked const (was 11; now 12) in x/guild/types (FR-VOICE-6 mission-locked invariant) - D-088: lexicon_meta_cover uses new lexicon.CoverBannedTerms() helper (insurance/premium/claim/policy scoped to Cover surface, NOT project-wide); x/cover/firewall pinned to allow-list of routing destinations (string- equality check); optional x/pact insurance-like -> Cover-like doc-fix - D-089: StillKeeper satisfied by simtest-local stub (x/still NOT extended this milestone; x/still/keeper/ verified empty); x/bond -> x/cover CoverKeeper reverse edge added to dependency map (MsgDebitMABProceeds queries CoverKeeper.GetPoolReserveAccount; no import cycle, interface only) - D-090: Bill of Rights temporal-gap fix (RightID + 13 Waivable* consts + RightIsWaivable() + ValidateBasic gate land in P2, NOT P5 — closes the P2->P5 window where rights were waivable); Voucher cold-start fix (bond = max(10x avg, MinimumVoucherBond) — no zero-bond bypass); Standing- gate dual check (floor enforced at BOTH launch handler AND Params-amendment ValidateBasic); D-085 escalation window tightened to before P2 3 escalations to PO: D-085 (13th right identity, confidence 0.55), lexicon banned-term scope (griller recommends Cover-scoped helper), pen-test third party (this grill IS the self-administered review per oy-state §7 item 4). This grill IS the self-administered adversarial review (pen-test) per oy-state §7 remaining-open item 4. High/critical findings (D-090(1) temporal gap, D-088 lexicon paper tiger, D-090(2) Voucher cold-start) are remediated in P0 via binding decisions D-086..D-090. ---ci--- project: oy phase: 0 milestone: v0.7 status: grill ---/ci---
This commit is contained in:
@@ -6,9 +6,9 @@
|
||||
"project": "oy",
|
||||
"phase": 0,
|
||||
"phase_role": "pre_execution",
|
||||
"stage": "plan",
|
||||
"stage": "grill",
|
||||
"attempts": 0,
|
||||
"updated_at": "2026-08-19T00:03:00Z",
|
||||
"updated_at": "2026-08-19T00:04:00Z",
|
||||
"next_milestone": null,
|
||||
"previous_milestone": {
|
||||
"milestone": "v0.6",
|
||||
|
||||
@@ -552,10 +552,11 @@ v0.7 phase ordering:
|
||||
x/cover ──(StandingKeeper shim)──► x/standing (P1: gate query; G-003 expected_keepers.go)
|
||||
x/cover ──(WatcherKeeper shim)──► x/watcher (P1: attestation pipeline; P4: MAB release witness)
|
||||
x/cover ──(BondKeeper shim)──► x/bond (P4: MAB issuance ceiling query)
|
||||
x/bond ──(CoverKeeper shim)──► x/cover (P4: MAB MsgDebitMABProceeds queries CoverKeeper.GetPoolReserveAccount; D-089(2) reverse edge — no import cycle, interface only)
|
||||
x/bond ──(Stand by id)──► x/stand (v0.2 baseline; MAB issuer-stand-id, unchanged)
|
||||
x/guild ──(Stand by id)──► x/stand (v0.2 baseline; Guild StandAffiliationID, unchanged)
|
||||
x/guild ──(Cover Pool by id)──► x/cover (P3: Chapter Federation liens reference Cover Pool covenants)
|
||||
x/cover ──(Still by id)──► x/still (P1: auto-pause on below-floor; P4: auto-Still on MAB misuse)
|
||||
x/cover ──(StillKeeper stub)──► x/still (P1: auto-pause on below-floor; P4: auto-Still on MAB misuse; D-089(1) simtest-local stub, NOT a real x/still keeper — x/still is NOT extended this milestone)
|
||||
x/cover ──(PactCover by id)──► x/pact (cross-reference only; no struct import)
|
||||
```
|
||||
|
||||
@@ -591,10 +592,9 @@ The six cross-component interfaces are EXTENDED in v0.7:
|
||||
(REQ-058) aggregates one-per-Stand.
|
||||
- **Forge/Fold** — unchanged in v0.7.
|
||||
|
||||
### v0.7 Locked-Const Firewall Additions (pending GRILL ratification)
|
||||
### v0.7 Locked-Const Firewall Additions (GRILL-ratified D-086..D-090)
|
||||
|
||||
Per oy-state §3, v0.7 adds 10 new locked consts (all net-new, no amendments
|
||||
to existing consts):
|
||||
Per oy-state §3 + GRILL D-087, v0.7 adds 12 new locked consts (all net-new, no amendments to existing consts):
|
||||
|
||||
| Const | Value | Module | REQ |
|
||||
|-------|-------|--------|-----|
|
||||
@@ -608,4 +608,5 @@ to existing consts):
|
||||
| StandPierEscalationAnnualPassVolumeCents | 10000000 | x/stand | REQ-059 (not locked) |
|
||||
| CoverClaimsVoucherBondMultipleAvgCall | 10 | x/cover | REQ-055 (not locked) |
|
||||
| AntiCaptureBillOfRightsCount | 13 | x/cover | REQ-056 (locked) |
|
||||
| ShadowVouchWeightMultiplier | 0.5 | x/standing | REQ-060 (locked) |
|
||||
| ShadowVouchWeightMultiplier | 0.5 | x/standing | REQ-060 (locked) |
|
||||
| PierCarriesVoice | false | x/guild | REQ-053 / FR-VOICE-6 (locked, D-087) |
|
||||
+25
-21
@@ -2186,9 +2186,9 @@ P1 (x/cover Factory + firewall + floors + gates + tagging)
|
||||
└─► P5 (Anti-Capture Bill constrains MAB no-Voice + Voucher independence + secession)
|
||||
```
|
||||
|
||||
### v0.7 Locked-Const Firewall Additions (pending GRILL ratification at P0)
|
||||
### v0.7 Locked-Const Firewall Additions (GRILL-ratified D-086..D-090)
|
||||
|
||||
11 new locked consts (all net-new, no amendments to existing consts — per oy-state §3 + ARCHITECTURE.md v0.7 section):
|
||||
12 new locked consts (all net-new, no amendments to existing consts — per oy-state §3 + ARCHITECTURE.md v0.7 section + GRILL D-087 adding PierCarriesVoice as 12th):
|
||||
|
||||
| Const | Value | Module | REQ | Locked? |
|
||||
|-------|-------|--------|-----|---------|
|
||||
@@ -2203,6 +2203,7 @@ P1 (x/cover Factory + firewall + floors + gates + tagging)
|
||||
| CoverClaimsVoucherBondMultipleAvgCall | 10 | x/cover | REQ-055 | no |
|
||||
| AntiCaptureBillOfRightsCount | 13 | x/cover | REQ-056 | yes |
|
||||
| ShadowVouchWeightMultiplier | 0.5 | x/standing | REQ-060 | yes |
|
||||
| PierCarriesVoice | false | x/guild | REQ-053 (FR-VOICE-6) | yes (D-087) |
|
||||
|
||||
---
|
||||
|
||||
@@ -2230,10 +2231,11 @@ P1 (x/cover Factory + firewall + floors + gates + tagging)
|
||||
3. **Reserve floor 1.5× (REQ-047 locked)** — `CoverReserveFloorAnnualContribX = 1.5` const in `x/cover/types`. `MsgRouteCoverFee` handler invokes `checkReserveFloor(ctx, poolID)`; if `pool.ReserveAnnualContribRatio < 1.5`, REJECT routing AND emit `PoolBelowFloor` event that triggers auto-pause for subsequent routings until reserve replenished. Below-floor auto-pause = the handler sets a `PoolPaused bool` on the CoverPool; subsequent `MsgRouteCoverFee` handlers reject while paused.
|
||||
4. **Standing gate minimums (REQ-049 locked, D-077)** — `CoverStandingGateTrusted = 4.0` + `CoverStandingGatePreferred = 4.5` consts in `x/cover/types` (cross-documented to `x/standing.BucketTrusted`/`BucketPreferred`). `MsgLaunchCoverPool` handler invokes `StandingKeeper.GetStandingBucket(hostReachID, category)` for each category the Pool covers; if any category's gate is below the locked minimum (Trusted 4.0 for Travel, Preferred 4.5 for Health-MCS), REJECT the launch. Gate binds at Factory runtime (D-077). Pool MAY tighten (a `PoolStandingGate` Params field ≥ protocol minimum); NEVER loosen (the const floor).
|
||||
5. **Cover-Fee category tagging (REQ-050 locked)** — `CoverFeeTag` struct in `x/cover/types` (`{GrainAmount int64, CategoryTag string, PoolID string}`). `MsgRouteCoverFee` handler validates the tag against the Pool's allowed categories; category-mismatch → REJECT (FR-COVER-11). Pool-level fungibility preserved for net-reserve accounting.
|
||||
6. **Factory runtime (REQ-046)** — `MsgLaunchCoverPool` handler: validates reserve floor (REQ-047), validates Standing gate per category (REQ-049), validates category is in an allowed phase (REQ-065 staging — placeholder in P1, full staging lands in P2), witnesses Cover-Charter (REQ-052 — Charter hash placeholder in P1, full Charter lands in P2). Watcher attestation pipeline: `WatcherKeeper.Attest(poolID, launchPayload)` called at launch; stubbed in simtest.
|
||||
7. **Simtest** — `x/cover/keeper/msg_server_simtest_test.go` exercising: (a) successful Pool launch with valid Standing + reserve; (b) rejected launch below Standing gate; (c) rejected launch below reserve floor; (d) rejected Cover-Fee routing with category mismatch; (e) auto-pause on below-floor + recovery on reserve replenishment; (f) firewall rejection of an out-of-pool routing path.
|
||||
8. **Lexicon + locked-const regression** — `x/cover/types/types_test.go` asserts the 4 new consts + lexicon assertion (no banned terms in `x/cover/**` — "Cover", "Cover-Fee", "Cover Call", "Cover-Charter" are the lexicon-clean names; NOT "insurance", "premium", "claim", "policy"). The `lexicon_meta_cover/` meta-test is the 4th lexicon firewall.
|
||||
6. **Factory runtime (REQ-046)** — `MsgLaunchCoverPool` handler: validates reserve floor (REQ-047), validates Standing gate per category (REQ-049), validates category is in an allowed phase (REQ-065 staging — **D-086: P1 Factory is functional for Phase-2 categories ONLY** [Travel/HealthMCS/IncomePause]; `FactoryAllowedPhases` Params field is set to `[Phase2]` only in P1; Phase3/Phase4 categories are REJECTED in P1. P2 extends `FactoryAllowedPhases` to `[Phase2, Phase3, Phase4]` with full staging), witnesses Cover-Charter (REQ-052 — **D-090(1): Charter types + `RightID` + 13 `Waivable*` consts + `RightIsWaivable()` + `ValidateBasic` gate land in P2, NOT P1**; P1 Factory accepts a Charter hash placeholder only, with no `WaivedRights` field validation until P2). Watcher attestation pipeline: `WatcherKeeper.Attest(poolID, launchPayload)` called at launch; stubbed in simtest.
|
||||
7. **Simtest** — `x/cover/keeper/msg_server_simtest_test.go` exercising: (a) successful Pool launch with valid Standing + reserve; (b) rejected launch below Standing gate; (c) rejected launch below reserve floor; (d) rejected Cover-Fee routing with category mismatch; (e) auto-pause on below-floor + recovery on reserve replenishment; (f) firewall rejection of an out-of-pool routing path; **(g) D-086: rejected out-of-phase category launch (Phase 3 category rejected in P1 because only Phase 2 is allowed)**.
|
||||
8. **Lexicon + locked-const regression** — `x/cover/types/types_test.go` asserts the 4 new consts + lexicon assertion (no banned terms in `x/cover/**` — "Cover", "Cover-Fee", "Cover Call", "Cover-Charter" are the lexicon-clean names; NOT "insurance", "premium", "claim", "policy" per **D-088: `lexicon_meta_cover` uses a new `lexicon.CoverBannedTerms()` helper** [scoping the 4 Cover-specific terms to the Cover surface, avoiding false positives in non-Cover modules where "claim" is a common English word]). The `lexicon_meta_cover/` meta-test is the 4th lexicon firewall. **D-088(3) optional cleanup: replace `x/pact` "insurance-like" docstrings (`x/pact/types/types.go:36,158`) with "Cover-like" as a P1 doc-fix** (low-risk, no behavior change, removes latent lexicon debt).
|
||||
9. **Coverage ≥80%** on `x/cover/types` + `x/cover/keeper` + `x/cover/firewall`.
|
||||
10. **D-089(1): `StillKeeper` is satisfied by a simtest-local stub** (test-only, G-003 exempt), NOT a real `x/still` keeper. `x/still` is NOT extended this milestone. The P1 below-floor auto-pause invokes `StillKeeper.Still(poolID, "below floor")` on the stub.
|
||||
|
||||
### P1 Firewall-First Rationale
|
||||
|
||||
@@ -2251,12 +2253,12 @@ P1 lands the Anti-Crowding-Out firewall + locked floors + Standing gates BEFORE
|
||||
|
||||
### P2 Must-Haves
|
||||
|
||||
1. **Cover-Charter (REQ-052 locked)** — `CoverCharter` struct in `x/cover/types` (`{CharterID, PoolID, StatementOfBeliefsHash []byte, DisputePath string, Gate string, HoldingPeriodDays uint32, HostReachID string, WatcherWitnessHash []byte, Amendments []CharterAmendment}`). `MsgSignCoverCharter` handler: signed by Pool Host + witnessed by Watcher. Amendments require Pool supermajority + 7-day cooling + Watcher + Counsel (a `CharterAmendment` struct with `Status` enum: Proposed/Cooled/Ratified). **Protocol does NOT enforce SoB content** (FR-CHTR-5) — the `StatementOfBeliefsHash` is opaque bytes; validation checks structural fields only.
|
||||
2. **Reserve ceiling 2.5× (REQ-048 not locked)** — `CoverReserveCeilingAnnualContribX = 2.5` const (the bounded upper limit). Pool Council MAY vote within [1.5×, 2.5×] via a `PoolReserveTarget` Params field. Watcher escalation to 2.5× after 12 months operating history (a `MsgEscalateReserveCeiling` handler requiring Watcher attestation + 12-month age check). The 1.5× floor (P1) is NOT tunable; only the target within the bounded range.
|
||||
3. **Pool governance hybrid (REQ-062 locked)** — `PoolCouncil` struct in `x/cover/types` (`{PoolID, HostReachID, ElectedMasonReachIDs [3]string, WatcherObserverReachID string}`). `MsgElectPoolMason` handler (Pool-eligible Masons elect 3). `MsgVoteCoverCall` handler: majority required with Watcher observer present (a `WatcherObserverPresent bool` field on the vote; if false, vote rejects). **No Anchor seat** (§5). No MAB-holder seat (REQ-063 — lands in P4 but the governance struct excludes them now).
|
||||
4. **Category staging (REQ-065 locked)** — `CoverCategoryPhase` enum in `x/cover/types` (`Phase2`/`Phase3`/`Phase4`). `CoverCategory` enum (`Travel`/`HealthMCS`/`IncomePause`/`EquipmentLoss`/`LifeBurial`/`RoadSide`/`CyberSkimming`/`GuildInternalMutualAid`). Phase 2 = Travel + HealthMCS + IncomePause; Phase 3 = EquipmentLoss + LifeBurial + RoadSide; Phase 4 = CyberSkimming + GuildInternalMutualAid. `FactoryAllowedPhases` Params field. `MsgLaunchCoverPool` handler (extended from P1) rejects out-of-phase launches.
|
||||
5. **Simtest** — (a) successful Charter signing + Watcher witness; (b) Charter amendment with 7-day cooling + supermajority; (c) Pool Council election (3 Masons); (d) Cover Call vote with Watcher observer present (succeeds) + absent (rejects); (e) Factory rejects out-of-phase category launch; (f) reserve ceiling escalation after 12-month age check.
|
||||
6. **Lexicon + locked-const regression** — `x/cover/types/types_test.go` extended with the ceiling + phase + category consts. Lexicon assertion on new Msg* names.
|
||||
1. **Cover-Charter (REQ-052 locked) + D-090(1) Bill of Rights types land HERE** — `CoverCharter` struct in `x/cover/types` (`{CharterID, PoolID, StatementOfBeliefsHash []byte, DisputePath string, Gate string, HoldingPeriodDays uint32, HostReachID string, WatcherWitnessHash []byte, Amendments []CharterAmendment, WaivedRights []RightID}`). `MsgSignCoverCharter` handler: signed by Pool Host + witnessed by Watcher. Amendments require Pool supermajority + 7-day cooling + Watcher + Counsel. **Protocol does NOT enforce SoB content** (FR-CHTR-5). **D-090(1) Bill of Rights temporal-gap fix:** `x/cover/types/rights.go` lands in P2 (NOT P5): 13 `RightID` consts + 13 `Waivable*` bool consts (all `false`) + `RightIsWaivable(id RightID) bool` (always returns `false`) + `AntiCaptureBillOfRightsCount = 13` const. The `MsgSignCoverCharter.ValidateBasic` gate rejects any `WaivedRights` element (dual firewall: const + ValidateBasic, mirroring MissionLockAmendable + MissionLockAmendmentRejected). **The 12 enumerated rights + D-085 13th-right candidate (`RightNonParticipationNoDenial`, confidence 0.55) all land in P2.** P5 then adds the *ceremony* surface (Counsel review handler, full Bill-of-Rights simtest cases). **D-090(4): D-085 escalation window tightened to before P2** — lead-developer surfaces D-085 to PO before P2; fallback at P2: log `RightNonParticipationNoDenial` as the 13th right and proceed.
|
||||
2. **Reserve ceiling 2.5× (REQ-048 not locked)** — `CoverReserveCeilingAnnualContribX = 2.5` const (the bounded upper limit). Pool Council MAY vote within [1.5×, 2.5×] via a `PoolReserveTarget` Params field. Watcher escalation to 2.5× after 12 months operating history. The 1.5× floor (P1) is NOT tunable. **D-090(3): the `CoverStandingGateTrusted`/`CoverStandingGatePreferred` floor is enforced at BOTH (a) the `MsgLaunchCoverPool` handler AND (b) the `MsgAmendPoolStandingGate` (Params-amendment) `ValidateBasic`** — a Pool must not be able to *store* a below-floor gate even if the launch would reject it. Same dual-check applies to the reserve target (amendment ValidateBasic rejects below 1.5× or above 2.5×).
|
||||
3. **Pool governance hybrid (REQ-062 locked)** — `PoolCouncil` struct in `x/cover/types` (`{PoolID, HostReachID, ElectedMasonReachIDs [3]string, WatcherObserverReachID string}`). `MsgElectPoolMason` handler (Pool-eligible Masons elect 3). `MsgVoteCoverCall` handler: majority required with Watcher observer present. **No Anchor seat** (§5). No MAB-holder seat (REQ-063 — lands in P4 but the governance struct excludes them now).
|
||||
4. **Category staging (REQ-065 locked)** — `CoverCategoryPhase` enum in `x/cover/types` (`Phase2`/`Phase3`/`Phase4`). `CoverCategory` enum (`Travel`/`HealthMCS`/`IncomePause`/`EquipmentLoss`/`LifeBurial`/`RoadSide`/`CyberSkimming`/`GuildInternalMutualAid`). Phase 2 = Travel + HealthMCS + IncomePause; Phase 3 = EquipmentLoss + LifeBurial + RoadSide; Phase 4 = CyberSkimming + GuildInternalMutualAid. **D-086: `FactoryAllowedPhases` Params field extended from P1's `[Phase2]` to `[Phase2, Phase3, Phase4]`** with full staging rejection of out-of-phase launches.
|
||||
5. **Simtest** — (a) successful Charter signing + Watcher witness; **(b) D-090(1) Charter with `WaivedRights` non-empty → REJECTED at ValidateBasic**; (c) Charter amendment with 7-day cooling + supermajority; (d) Pool Council election (3 Masons); (e) Cover Call vote with Watcher observer present (succeeds) + absent (rejects); **(f) D-086 Factory rejects out-of-phase category launch (Phase 4 category when only Phase 2/3 allowed)**; (g) reserve ceiling escalation after 12-month age check; **(h) D-090(3) Pool Standing gate amendment below floor → REJECTED at ValidateBasic**.
|
||||
6. **Lexicon + locked-const regression** — `x/cover/types/types_test.go` extended with the ceiling + phase + category consts + `AntiCaptureBillOfRightsCount=13` + 13 `Waivable*` consts all false + `RightIsWaivable` always false. Lexicon assertion on new Msg* names.
|
||||
7. **Coverage ≥80%** on the extended `x/cover` surface.
|
||||
|
||||
---
|
||||
@@ -2272,7 +2274,7 @@ P1 lands the Anti-Crowding-Out firewall + locked floors + Standing gates BEFORE
|
||||
### P3 Must-Haves
|
||||
|
||||
1. **Guild Charter + Common Bond (REQ-051 locked)** — extend `x/guild/types.Guild` with `CommonBondHash []byte` + `PublicProfile GuildPublicProfile` fields. `GuildPublicProfile` struct (`{BondSummary string, Disclaimers []string, MasonCount uint32_or_Private bool, PierWrapperID string}`). `MsgCreateGuild` handler (extended): Common Bond declared + hash-pinned at creation; Public Profile published. `MasonCount` is either a count or a `"private"` sentinel.
|
||||
2. **Chapter Federation (REQ-053)** — extend `x/guild/types.Guild` with `ParentGuildID string` (empty for Parent Guilds) + `IsChapter bool` + `SecessionTermsHash []byte` + `GoodStandingLiens []Lien`. `Lien` struct (`{Amount int64, CreditorReachID string, SecuredAtFounding bool}`). `MsgCreateChapter` handler: Parent Guild + Chapter model; Chapter inherits Parent's policies + MAY tighten but NOT loosen. Secession terms coded at founding (a `SecessionTerms` struct: `{CoolingCoverActiveDays uint32, CoolingNonCoverDays uint32, LienAuditRequired bool, CovenantClearanceRequired bool}` — hash-pinned at creation, immutable). Good-standing liens at founding (NOT freely increasable — `SecuredAtFounding=true` liens reject `MsgAddLien`). Chapter retains mesh-level Voice (Pier does NOT carry Voice per FR-VOICE-6 — a `PierCarriesVoice bool` const `false` in `x/guild/types`).
|
||||
2. **Chapter Federation (REQ-053) + D-087 PierCarriesVoice const** — extend `x/guild/types.Guild` with `ParentGuildID string` (empty for Parent Guilds) + `IsChapter bool` + `SecessionTermsHash []byte` + `GoodStandingLiens []Lien`. `Lien` struct (`{Amount int64, CreditorReachID string, SecuredAtFounding bool}`). `MsgCreateChapter` handler: Parent Guild + Chapter model; Chapter inherits Parent's policies + MAY tighten but NOT loosen. Secession terms coded at founding (a `SecessionTerms` struct: `{CoolingCoverActiveDays uint32, CoolingNonCoverDays uint32, LienAuditRequired bool, CovenantClearanceRequired bool}` — hash-pinned at creation, immutable). Good-standing liens at founding (NOT freely increasable — `SecuredAtFounding=true` liens reject `MsgAddLien`). **D-087: `PierCarriesVoice = false` const in `x/guild/types`** (the 12th locked const per the GRILL-ratified table — FR-VOICE-6: Pier does NOT carry Voice; mission-locked invariant). Chapter retains mesh-level Voice (the const enforces that the Pier wrapper does NOT carry Voice regardless of fiduciary role).
|
||||
3. **Household simplified (REQ-057)** — `x/stand` keeper: `IsHousehold(standID)` check (switch on `StandType == StandHousehold`). Household Stands skip the formal-Council requirement. `MsgOneTapExitStand` handler — the dispute path for Household. One-tap exit = the Stand is dissolved + assets returned to the Holder's Stash; no Council vote required.
|
||||
4. **Confederation Voice (REQ-058 locked)** — `x/stand` keeper: `GetConfederationVoice(confederationStandID) []Voice` aggregates member-Stand Voice one-per-Stand. Internal bundle delegation via §19 delegation (existing `x/council` Voice mechanics — a `MsgDelegateConfederationVoice` handler). One-Stand-one-Vote: each member Stand gets exactly 1 Voice in the Confederation's aggregate, regardless of size.
|
||||
5. **Disclaimer cadence (REQ-061 locked)** — `MsgCreateGuild` + `MsgCreateChapter` + `MsgSignCoverCharter` handlers all surface a jurisdictional disclaimer at every charter signing (a `Disclaimer string` field on each Msg; the handler returns the disclaimer in the response). NOT session-bounded.
|
||||
@@ -2294,12 +2296,14 @@ P1 lands the Anti-Crowding-Out firewall + locked floors + Standing gates BEFORE
|
||||
|
||||
1. **Mutual Aid Bond (REQ-054 locked)** — `MAB` struct in `x/bond/types` (anonymous embed of `Bond` + `CouponKind CouponDenom` + `AnnualSurplusAtIssuance int64` + `UseOfProceedsTag string`). `CouponDenom` enum (`CouponDenomCoverCall`/`CouponDenomMutualAidCredit`/`CouponDenomBread` — the last exists ONLY to be rejected at `ValidateBasic` with "FR-MAB-3: MAB coupons NEVER Bread", mirroring `MissionLockAmendmentRejected`). `MABIssuanceCeilingAnnualSurplusMultiple = 3` const in `x/bond/types`. `MsgIssueMAB` handler: `checkMABIssuanceCeiling(ctx, poolID, newPrincipal)` asserts `sum(issuedMABPrincipal) + newPrincipal <= 3 × AnnualSurplus` (re-check at every issuance). Coupon rate bounded by `CouponCapBps=800` (existing locked const — no new const, cross-const test extends).
|
||||
2. **D-080 tagged streaming + Watcher-witnessed release** — `UseOfProceedsTag` field locked to `"reserve_build_out"` (a const `MABUseOfProceedsReserveBuildOut`). `MsgDebitMABProceeds` handler: checks destination account is the Pool's `ReserveAccount`; else invokes `StillKeeper.Still(poolID, "MAB misuse")` for auto-Still. `MsgWitnessMABProceedsRelease` handler: requires Watcher quorum (6-of-9, `x/watcher/types/types.go:23` `Quorum=6`) before proceeds move from tagged staging to reserve. Watcher attestation at deployment + quarterly audit (a `MsgWatcherAttestMAB` handler).
|
||||
3. **Cover Claims Voucher (REQ-055)** — `CoverClaimsVoucher` struct in `x/cover/types` (`{VoucherReachID string, PoolID string, BondAmount int64, BondMultipleAvgCall uint32}`). `CoverClaimsVoucherBondMultipleAvgCall = 10` const. Bond = 10× avg Call size per Pool. `MsgRegisterCoverClaimsVoucher` handler: bonds the Voucher. `MsgFileCoverCall` handler: assigns a Call to a Voucher; **no self-adjudication** (FR-CPCV-2) — rejects if `voucherReachID == claimantReachID`. Slashing via existing `x/standing.Slash` struct with new `SlashReasonFraudulentCoverCall` const — cross-Pool applicability (the slash drops the Voucher's Standing bucket, disqualifying them from other Pools). Bounded earnings (a `MaxVoucherEarningsPerCall` Params field).
|
||||
3. **Cover Claims Voucher (REQ-055) + D-090(2) cold-start fix** — `CoverClaimsVoucher` struct in `x/cover/types` (`{VoucherReachID string, PoolID string, BondAmount int64, BondMultipleAvgCall uint32}`). `CoverClaimsVoucherBondMultipleAvgCall = 10` const. **D-090(2): `bond = max(CoverClaimsVoucherBondMultipleAvgCall × avgCallSize, MinimumVoucherBond)` where `MinimumVoucherBond` is a Params field with a non-zero default** — the cold-start fallback when no Calls have been filed yet (avg = 0 → bond = MinimumVoucherBond, NOT zero). `MsgRegisterCoverClaimsVoucher` handler: bonds the Voucher. `MsgFileCoverCall` handler: assigns a Call to a Voucher; **no self-adjudication** (FR-CPCV-2) — rejects if `voucherReachID == claimantReachID`. Slashing via existing `x/standing.Slash` struct with new `SlashReasonFraudulentCoverCall` const — cross-Pool applicability (the slash drops the Voucher's Standing bucket, disqualifying them from other Pools). Bounded earnings (a `MaxVoucherEarningsPerCall` Params field).
|
||||
4. **Shadow vouch 50% weight (REQ-060 locked)** — extend `x/standing/types.Vouch` with `IsShadow bool` field. `ShadowVouchWeightMultiplier = 0.5` const in `x/standing/types`. Modify `GetVoucherWeight` to apply the multiplier as a post-step: `if isShadow { weight *= ShadowVouchWeightMultiplier }`. The const makes the 0.5× mission-locked (REQ-060 locked) and regression-testable. New test `TestShadowVouchWeight` in `x/standing/types/types_test.go`.
|
||||
5. **MAB holder seniority no-Voice (REQ-063 locked)** — `PoolDissolutionWaterfall` function in `x/cover/keeper`: returns `[{Tier: "CoverFeeContributors", ...}, {Tier: "MABHolders", ...}, {Tier: "BreadHolders", ...}]` (FR-MAB-4 seniority chain). MAB holders excluded from the Pool Council voice set (the `PoolCouncil` struct from P2 already excludes them; P4 adds the waterfall + a `MsgDissolveCoverPool` handler that invokes the waterfall). MAB holders have NO Voice in dissolution decisions.
|
||||
6. **Simtest** — (a) MAB issuance with valid Cover-Call coupons; (b) MAB issuance rejected with Bread coupons (FR-MAB-3); (c) MAB issuance rejected above 3× annual surplus ceiling; (d) tagged streaming misuse → auto-Still; (e) Watcher-witnessed release (quorum present: succeeds; absent: rejects); (f) Cover Claims Voucher registration + bond; (g) Cover Call adjudication (no self-adjudication); (h) Voucher slash for fraudulent Call → Standing bucket drop; (i) Shadow vouch 0.5× weight applied; (j) Pool dissolution waterfall (Cover-Fee contributors > MAB > Bread holders).
|
||||
7. **Lexicon + locked-const regression** — `x/bond/types/types_test.go` extended with `MABIssuanceCeilingAnnualSurplusMultiple=3` + `CouponDenom` enum count. `x/standing/types/types_test.go` extended with `ShadowVouchWeightMultiplier=0.5`. `x/cover/types/types_test.go` extended with `CoverClaimsVoucherBondMultipleAvgCall=10`. Cross-const test: MAB coupon cap == `CouponCapBps` (extends REQ-030 pattern).
|
||||
8. **Coverage ≥80%** on the extended `x/bond` + `x/cover` (Voucher + waterfall) + `x/standing` (Shadow vouch) surfaces.
|
||||
6. **D-089(2): `x/bond → x/cover` CoverKeeper reverse edge** — `x/bond/types/expected_keepers.go` gains a `CoverKeeper` interface (`GetPoolReserveAccount(poolID) string`) used by the `MsgDebitMABProceeds` handler to validate the destination. No import cycle (interface only). Documented in ARCHITECTURE.md v0.7 dependency map.
|
||||
7. **D-089(1): `StillKeeper` simtest stub** — the MAB auto-Still hook (`MsgDebitMABProceeds` misuse → `StillKeeper.Still`) is satisfied by a simtest-local stub (test-only, G-003 exempt). `x/still` is NOT extended this milestone.
|
||||
8. **Simtest** — (a) MAB issuance with valid Cover-Call coupons; (b) MAB issuance rejected with Bread coupons (FR-MAB-3); (c) MAB issuance rejected above 3× annual surplus ceiling; (d) tagged streaming misuse → auto-Still; (e) Watcher-witnessed release (quorum present: succeeds; absent: rejects); (f) Cover Claims Voucher registration + bond; **(g) D-090(2) Voucher cold-start: bond = MinimumVoucherBond when no Calls exist**; (h) Cover Call adjudication (no self-adjudication); (i) Voucher slash for fraudulent Call → Standing bucket drop; (j) Shadow vouch 0.5× weight applied; (k) Pool dissolution waterfall (Cover-Fee contributors > MAB > Bread holders).
|
||||
9. **Lexicon + locked-const regression** — `x/bond/types/types_test.go` extended with `MABIssuanceCeilingAnnualSurplusMultiple=3` + `CouponDenom` enum count. `x/standing/types/types_test.go` extended with `ShadowVouchWeightMultiplier=0.5`. `x/cover/types/types_test.go` extended with `CoverClaimsVoucherBondMultipleAvgCall=10`. Cross-const test: MAB coupon cap == `CouponCapBps` (extends REQ-030 pattern).
|
||||
10. **Coverage ≥80%** on the extended `x/bond` + `x/cover` (Voucher + waterfall) + `x/standing` (Shadow vouch) surfaces.
|
||||
|
||||
---
|
||||
|
||||
@@ -2313,14 +2317,14 @@ P1 lands the Anti-Crowding-Out firewall + locked floors + Standing gates BEFORE
|
||||
|
||||
### P5 Must-Haves
|
||||
|
||||
1. **Anti-Capture Bill of Rights v0.2 (REQ-056 locked)** — `x/cover/types/rights.go`: 13 `RightID` consts + 13 `Waivable*` bool consts (all `false`) + `RightIsWaivable(id RightID) bool` function that always returns `false`. `AntiCaptureBillOfRightsCount = 13` const. The 12 enumerated rights: `RightOneTapExit`, `RightNoTaxOnPersonalStash`, `RightAuditableVoice`, `RightCooling`, `RightWatcherInspection`, `RightFreeholderVoucher`, `RightCounselEscalation`, `RightAnchoredBreadConversion`, `RightWayfarersRecord`, `RightSecessionFoundingTerms`, `RightNonCoverAccess`, `RightCategoryMismatchRefusal`. **The 13th right** — D-085 escalation candidate: `RightNonParticipationNoDenial` (confidence 0.55; "non-participation MUST NOT deny other mesh products" per REQ-085/FR-NORM-4). **Lead-developer surfaces D-085 to PO before P5 lands.** If unresolved at full autonomy, log as assumption with `RightNonParticipationNoDenial` and proceed.
|
||||
2. **Dual firewall (const + ValidateBasic)** — `MsgSignCoverCharter.ValidateBasic` (extended from P2): checks the charter's `WaivedRights []RightID` field; if ANY right is in the list, REJECT with "REQ-056: rights non-amendable, non-waivable by any Charter". Mirrors `MissionLockAmendable=false` + `MissionLockAmendmentRejected` (D-064). The 13 `Waivable*` consts are the const firewall; the `ValidateBasic` gate is the runtime firewall.
|
||||
1. **Anti-Capture Bill of Rights v0.2 ceremony (REQ-056 locked) + D-090(1) types already in P2** — the `RightID` type + 13 `Waivable*` consts + `RightIsWaivable()` + `AntiCaptureBillOfRightsCount=13` const + the `MsgSignCoverCharter.ValidateBasic` gate ALL landed in P2 (D-090(1) temporal-gap fix). **P5 adds the *ceremony* surface:** the `MsgCounselReviewBillOfRights` handler (the "bonded Counsel review" §7 acceptance criterion — the Counsel's Standing bond is staked; the handler records the review result). P5 also adds the full Bill-of-Rights simtest cases (the P2 simtest covered the ValidateBasic gate; P5 covers the Counsel review + the 13-rights regression test asserting all 13 `Waivable*` consts are `false` + `RightIsWaivable` returns `false` for all 13). The 12 enumerated rights + D-085 13th-right candidate (`RightNonParticipationNoDenial`) are all in P2; P5 does NOT re-declare them.
|
||||
2. **Dual firewall (const + ValidateBasic) — ALREADY IN P2** — the `MsgSignCoverCharter.ValidateBasic` gate rejecting `WaivedRights` landed in P2 (D-090(1)). P5's contribution is the Counsel review ceremony + the full regression test suite.
|
||||
3. **Secession cooling enforcement (REQ-064 locked)** — `x/guild/keeper`: `MsgInitiateSecession` handler records `secessionStartedAt` + invokes `lienAudit(poolID)`. `MsgCompleteSecession` handler checks: (a) `now >= secessionStartedAt + coolingSeconds` where `coolingSeconds = CoolingSecessionCoverActiveDays*86400` (21d) if the Chapter is Cover-active, else `CoolingSecessionNonCoverDays*86400` (14d); (b) lien-audit-passed; (c) Cover Call / Bond covenant clearance passed. Cooling secured at founding (the `SecessionTerms` from P3 is immutable), NOT reducible. Parent Guild Treasury receives pro-rata Cover-Fee settlement for in-flight Cover Calls (a `ProRataSettlement` function in `x/cover/keeper`).
|
||||
4. **Stand→Pier boundary (REQ-059, D-074)** — `StandPierEscalationAnnualPassVolumeCents = 10000000` const in `x/stand/types` (placeholder for $100k in Grain-cents at simtest; the PO ruling D-074 is $100k USD which is converted at the current USD/Grain oracle rate — but no oracle exists in simtest). The handler `MsgEscalateStandToPier` (or a keeper-level `checkStandPierEscalation(standID)` invoked on Pass routing): when annual Pass volume > the const, the Stand is *invited* to Hub API (a `StandPierEligible bool` flag + a `MsgAcceptPierInvitation` handler). Soft upgrade, not a ban — the Stand may decline.
|
||||
5. **Pier selection (REQ-066)** — `PierSelectionIndex` struct in `x/cover/types` (`{PierID string, JurisdictionalReliabilityScore float64, FiduciaryRecordHash []byte, IntegrationQualityScore float64, OverallScore float64}`). `MsgSelectPier` handler: Guild Council chooses Pier at formation. `MsgRevokePierSelection` handler: reversible by Cover Pool supermajority + Counsel witness. Mesh maintains the Pier Selection Index (a keeper-level `GetPierSelectionIndex(pierID)` query). **Pier-Routed Legal Wrapper is OPTIONAL** (§5 default-no-wrapper — no code required; a `PierWrapperID string` field on Guild from P3 is optional, empty by default).
|
||||
6. **Simtest** — (a) Charter signing with waived rights → REJECT (dual firewall); (b) Charter signing with no waived rights → succeeds; (c) `RightIsWaivable` returns false for all 13 rights; (d) secession initiation + 21d cooling (Cover-active) + lien audit + covenant clearance + completion; (e) secession rejected before cooling expires; (f) secession rejected with outstanding liens; (g) Stand→Pier escalation at >10M Grain-cents annual Pass volume; (h) Stand declines Pier invitation (soft upgrade); (i) Pier selection by Guild Council; (j) Pier selection revoked by Cover Pool supermajority + Counsel.
|
||||
7. **Lexicon + locked-const regression** — `x/cover/types/types_test.go` extended with `AntiCaptureBillOfRightsCount=13` + 13 `Waivable*` consts all false. `x/stand/types/types_test.go` extended with `StandPierEscalationAnnualPassVolumeCents=10000000`. Lexicon assertion on new Msg* names.
|
||||
8. **Coverage ≥80%** on the extended `x/cover` (Bill of Rights + Pier Index) + `x/guild` (secession) + `x/stand` (Pier boundary) surfaces.
|
||||
6. **Simtest** — (a) Charter signing with waived rights → REJECT (dual firewall — **already in P2, P5 re-verified**); (b) Charter signing with no waived rights → succeeds; (c) `RightIsWaivable` returns false for all 13 rights; (d) `MsgCounselReviewBillOfRights` ceremony (bonded Counsel staked + review recorded); (e) secession initiation + 21d cooling (Cover-active) + lien audit + covenant clearance + completion; (f) secession rejected before cooling expires; (g) secession rejected with outstanding liens; (h) Stand→Pier escalation at >10M Grain-cents annual Pass volume; (i) Stand declines Pier invitation (soft upgrade); (j) Pier selection by Guild Council; (k) Pier selection revoked by Cover Pool supermajority + Counsel.
|
||||
7. **Lexicon + locked-const regression** — `x/cover/types/types_test.go` extended with `AntiCaptureBillOfRightsCount=13` + 13 `Waivable*` consts all false (P2 landed them; P5 adds the full regression suite). `x/stand/types/types_test.go` extended with `StandPierEscalationAnnualPassVolumeCents=10000000`. Lexicon assertion on new Msg* names.
|
||||
8. **Coverage ≥80%** on the extended `x/cover` (Bill of Rights ceremony + Pier Index) + `x/guild` (secession) + `x/stand` (Pier boundary) surfaces.
|
||||
|
||||
---
|
||||
|
||||
|
||||
+13
-1
@@ -446,4 +446,16 @@ Auto-decided defaults logged per clarify workflow Step 4 (full autonomy → acce
|
||||
| D-081 | **v0.7 scope = §7 authoritative — REQ-046..REQ-066 only (21 REQs).** Cluster A+B+C (REQ-067..REQ-081) are v0.8, NOT v0.7, despite §8 Q4 PO rec suggesting Cluster A+B+C ship in v0.7. The §7 v0.7 acceptance text lists only REQ-046..REQ-066; the §7 v0.8 acceptance text lists REQ-067..REQ-097 with the const firewall extensions. §7 is the milestone contract; §8 Q4 was a recommendation the PO can override — and did, by accepting the "§7 only" interactive ruling before CLARIFY. | §7 acceptance text is the authoritative milestone contract (it lists the REQs and the acceptance criteria). §8 Q4 was a sequencing recommendation, not a binding scope ruling. Shipping 36 REQs in v0.7 would create a mega-milestone with coupled territories (fraternal primitives + their risk mitigations are different vertical slices). v0.7 = foundation; v0.8 = hardening. | 0.90 | [§8 Q4 — Cluster A+B+C in v0.7 (36 REQs, coupled territories); §7 + partial Cluster A only (REQ-067..072, 27 REQs — still couples fraternal + trust-minimization)] |
|
||||
| D-082 | **v0.7 phase ordering** (provisional, planner finalizes): P1 Cover Pool firewall + foundation (REQ-046/047/049/050 — firewall-first, same `x/cover` territory) → P2 Cover-Charter + Council + staging (REQ-048/052/062/065 — extends `x/cover` + `x/council`) → P3 Guild Charter + Chapter Federation (REQ-051/053/057/058/061 — extends `x/guild`, `x/stand`) → P4 MAB + Cover Claims Voucher (REQ-054/055/060/063 — extends `x/bond`, `x/standing`, `x/cover`) → P5 Anti-Capture Bill + secession + Pier (REQ-056/059/064/066 — cross-cutting, lands last as it constrains all prior surfaces) → P6 final review + audit + milestone ship. Each phase independently shippable; P1 lands the firewall + locked floors first (firewall-first pattern per D-044/D-069/D-079). | The 21 REQs cluster into 5 vertical slices by module territory + dependency. P1 is the spine (Factory + firewall + locked floors + gates + tagging); everything else hangs off it. P5 lands last because the Anti-Capture Bill constrains all prior surfaces (non-amendable rights that P1-P4 code must not violate). | 0.82 | [governance-first (REQ-062 first — but it depends on Factory); MAB-first (REQ-054 — but it depends on Cover Pool reserve existing); single mega-phase (couples territories)] |
|
||||
| D-083 | **No IDEATE stage in v0.7** (no `--ideate` flag this run). The feature scope was pre-seeded from oy-spec v3 §7 (REQ-046..REQ-066) and ratified at CLARIFY with all 8 §8 questions resolved. The D-001 refinement-only filter does NOT apply (v0.7 is a feature milestone). | run.md §IDEATE is conditional on `--ideate`. This invocation has no `--ideate`. | 1.00 | [run IDEATE anyway] |
|
||||
| D-084 | **New module `x/cover`** (Cover Pool Factory + Anti-Crowding-Out firewall + Anti-Capture Bill of Rights). The existing `x/pact` `PactCover` enum value remains as a cross-reference (G-003 by-ID-string pattern). This mirrors the D-039 precedent (`x/hub` split out of `x/pact`'s `PactHubAPI` in v0.3) — when a PactType grows into a first-class protocol surface with its own keeper + firewall, it graduates to a dedicated module. The `x/pact` `PactCover` enum value stays as a typed cross-reference so `x/pact` tests still pass; `x/cover` owns the runtime. | REQ-046 (Factory runtime), REQ-047 (reserve floor in `x/pact/cover` per spec text — interpreted as `x/cover` since that's where the Factory lives), REQ-050 (Cover-Fee tagging at protocol layer), REQ-052 (Cover-Charter), REQ-055 (Cover Claims Voucher), REQ-056 (Anti-Capture Bill) all need a home. A dedicated `x/cover` module is the D-039 pattern; keeping them in `x/pact` would overload `x/pact` (which is a 6-Pact enum skeleton, not a Cover Pool runtime). The spec text "codified in `x/pact/cover`" is read as "the Cover surface, which graduated from `x/pact`" — `x/cover` is the graduated module. GRILL ratifies. | 0.82 | [keep everything in `x/pact` (overloads the 6-Pact enum module); create 3 micro-modules (`x/coverpool`, `x/covercharter`, `x/anticapture` — fragments the Cover surface)] |
|
||||
| D-084 | **New module `x/cover`** (Cover Pool Factory + Anti-Crowding-Out firewall + Anti-Capture Bill of Rights). The existing `x/pact` `PactCover` enum value remains as a cross-reference (G-003 by-ID-string pattern). This mirrors the D-039 precedent (`x/hub` split out of `x/pact`'s `PactHubAPI` in v0.3) — when a PactType grows into a first-class protocol surface with its own keeper + firewall, it graduates to a dedicated module. The `x/pact` `PactCover` enum value stays as a typed cross-reference so `x/pact` tests still pass; `x/cover` owns the runtime. | REQ-046 (Factory runtime), REQ-047 (reserve floor in `x/pact/cover` per spec text — interpreted as `x/cover` since that's where the Factory lives), REQ-050 (Cover-Fee tagging at protocol layer), REQ-052 (Cover-Charter), REQ-055 (Cover Claims Voucher), REQ-056 (Anti-Capture Bill) all need a home. A dedicated `x/cover` module is the D-039 pattern; keeping them in `x/pact` would overload `x/pact` (which is a 6-Pact enum skeleton, not a Cover Pool runtime). The spec text "codified in `x/pact/cover`" is read as "the Cover surface, which graduated from `x/pact`" — `x/cover` is the graduated module. GRILL ratifies. | 0.82 | [keep everything in `x/pact` (overloads the 6-Pact enum module); create 3 micro-modules (`x/coverpool`, `x/covercharter`, `x/anticapture` — fragments the Cover surface)] |
|
||||
|
||||
## GRILL Decisions (Phase 0 v0.7 — GRILL, autonomy=full)
|
||||
|
||||
The ci-griller red-teamed the v0.7 plan across 9 axes + 7 specific probes. Overall verdict: **CONDITIONAL PASS** (confidence 0.72) with 5 binding decisions (D-086..D-090) and 3 escalations to PO. The plan does NOT proceed to P1 until D-086..D-090 are applied (they are applied to PLANS.md + ARCHITECTURE.md + this file). This grill IS the self-administered adversarial review (pen-test) per oy-state §7 remaining-open item 4.
|
||||
|
||||
| ID | Decision | Rationale | Confidence | Affects |
|
||||
|----|----------|-----------|------------|--------|
|
||||
| D-086 | **P1 Factory scope clarification** — P1's `MsgLaunchCoverPool` is *functional for Phase-2 categories ONLY* (Travel/HealthMCS/IncomePause). `FactoryAllowedPhases` Params field set to `[Phase2]` only in P1; Phase3/Phase4 categories REJECTED in P1. P2 extends to `[Phase2, Phase3, Phase4]`. P1 simtest includes negative case: out-of-phase category launch rejected. | The plan's "placeholder" language was ambiguous. Pinning P1 to Phase-2-only makes the vertical slice honest: P1 ships a working Factory for the Phase-2 subset, not a half-Factory. | 0.82 | PLANS P1 |
|
||||
| D-087 | **`PierCarriesVoice` const reconciliation** — P3 introduces `PierCarriesVoice bool const false` in `x/guild/types` (FR-VOICE-6: Pier does NOT carry Voice). Added as the **12th locked const** to the v0.7 const additions table (was 11; now 12). Mission-locked invariant — const is the correct firewall shape (not a field). | The plan and the const table disagreed by 1. A const that exists in code but not in the firewall table is invisible to the regression firewall. | 0.80 | PLANS const table, oy-state §3, ARCHITECTURE const table |
|
||||
| D-088 | **`lexicon_meta_cover` banned-term list + firewall shape** — (1) The `lexicon_meta_cover/` meta-test uses a NEW `lexicon.CoverBannedTerms()` helper banning `insurance`, `premium`, `claim`, `policy` scoped to the Cover surface (NOT project-wide — avoids false positives in non-Cover modules where "claim" is a common English word). (2) The `x/cover/firewall/` runtime subpackage shape is pinned to an **allow-list of permitted routing destinations** (the Pool's `ReserveAccount`), checked via string-equality at the start of every `MsgRouteCoverFee` handler. (3) **Optional cleanup:** replace `x/pact` "insurance-like" docstrings (`x/pact/types/types.go:36,158`) with "Cover-like" as a P1 doc-fix. | (1) Without a defined banned-term list, the `lexicon_meta_cover` meta-test was a paper tiger — it scanned but didn't ban the terms the plan said are banned. (2) The firewall's "rejects any code path" language was aspirational; an allow-list is the simtest-grade concrete form. (3) The `x/pact` "insurance-like" string is latent lexicon debt. | 0.78 | PLANS P1, `lexicon/lexicon.go`, `x/pact/types/types.go` |
|
||||
| D-089 | **`StillKeeper` stub + `x/bond → x/cover` CoverKeeper reverse edge** — (1) `StillKeeper.Still(poolID, reason)` is satisfied by a **simtest-local stub** (test-only, G-003 exempt), NOT a real `x/still` keeper. `x/still` is NOT extended this milestone (verified: `x/still/keeper/` is empty). (2) ARCHITECTURE.md v0.7 dependency map adds the reverse edge: `x/bond ──(CoverKeeper shim)──► x/cover` (the MAB `MsgDebitMABProceeds` handler queries `CoverKeeper.GetPoolReserveAccount(poolID)`). NEW expected-keeper interface in `x/bond/types/expected_keepers.go`. No import cycle (interface only). | (1) The auto-Still hook references a method that doesn't exist; without a documented stub, P4 cannot wire the simtest. (2) The reverse dependency edge is real (MAB handler must query the Pool's reserve account) but undocumented — a hidden architecture coupling. | 0.76 | PLANS P1/P4, ARCHITECTURE dependency map, `x/bond/types/expected_keepers.go` |
|
||||
| D-090 | **Bill of Rights temporal gap + Voucher cold-start + Standing-gate dual check + D-085 window** — (1) **Bill of Rights temporal-gap fix (most serious):** the `RightID` type + 13 `Waivable*` consts (all `false`) + `RightIsWaivable(id) bool` (always `false`) + `MsgSignCoverCharter.ValidateBasic` gate rejecting any `WaivedRights` element land in **P2** (before the first Charter can be signed), NOT P5. P5 adds the *ceremony* surface (Counsel review handler, full simtest). (2) **Voucher bond cold-start fix:** `bond = max(CoverClaimsVoucherBondMultipleAvgCall × avgCallSize, MinimumVoucherBond)` where `MinimumVoucherBond` is a Params field with a non-zero default. (3) **Standing-gate dual check:** the `CoverStandingGateTrusted`/`CoverStandingGatePreferred` floor is enforced at BOTH the `MsgLaunchCoverPool` handler AND the `MsgAmendPoolStandingGate` (Params-amendment) `ValidateBasic`. (4) **D-085 escalation window tightened to before P2** (because D-090(1) moves the RightID + 13 consts to P2). Fallback at P2: log `RightNonParticipationNoDenial` as the 13th right at confidence 0.55 and proceed. | (1) The P2→P5 temporal gap was a real security hole — rights waivable between P2 and P5. (2) Zero-bond cold-start was a Voucher bypass. (3) A Params-only check left the amendment path open. (4) The escalation window must match the new P2 deadline. | 0.72 | PLANS P2, P4, P5, RESEARCH D-085 |
|
||||
@@ -131,20 +131,22 @@ Ingested as: oy-state
|
||||
| ServiceKindCount | 4 | x/services | D-040 |
|
||||
| HubServiceCount | 3 | x/hub | D-039 |
|
||||
|
||||
### v0.7 planned const additions (pending GRILL ratification at P0)
|
||||
### v0.7 planned const additions (GRILL-ratified D-086..D-090)
|
||||
| Const | Value | Module | REQ | Why locked |
|
||||
|-------|-------|--------|-----|-----------|
|
||||
| CoverReserveFloorAnnualContribX | 1.5 | x/cover (NEW) | REQ-047 (locked) | vision §16 — 1.5× annual contributions floor, mission-locked |
|
||||
| CoverReserveCeilingAnnualContribX | 2.5 | x/cover (NEW) | REQ-048 (not locked — governance-tunable within 1.5×–2.5×) | vision §16 — upper bound of bounded range |
|
||||
| CoverStandingGateTrusted | 4.0 (Trusted bucket) | x/cover (NEW) | REQ-049 (locked) | vision §16, §9.3 — Travel gate minimum (Pool MAY tighten, NEVER loosen) |
|
||||
| CoverStandingGatePreferred | 4.5 (Preferred bucket) | x/cover (NEW) | REQ-049 (locked) | vision §16, §9.3 — Health-MCS gate minimum |
|
||||
| CoverStandingGateTrusted | 4.0 (Trusted bucket) | x/cover (NEW) | REQ-049 (locked) | vision §16, §9.3 — Travel gate minimum (Pool MAY tighten, NEVER loosen). D-090(3): enforced at BOTH launch handler AND Params-amendment ValidateBasic. |
|
||||
| CoverStandingGatePreferred | 4.5 (Preferred bucket) | x/cover (NEW) | REQ-049 (locked) | vision §16, §9.3 — Health-MCS gate minimum. D-090(3): dual check. |
|
||||
| MABIssuanceCeilingAnnualSurplusMultiple | 3 | x/bond (extended) | REQ-054 (locked) | vision §17 — 3× annual surplus mission-locked ceiling |
|
||||
| MABCouponCapBps | 800 (reuse CouponCapBps) | x/bond | REQ-054 (locked) | coupon bounded by existing CouponCapBps (D-028) — no new const, cross-const test extends |
|
||||
| CoolingSecessionCoverActiveDays | 21 | x/guild (extended) | REQ-064 (locked) | vision §4.6 — secession cooling, secured at founding, not reducible |
|
||||
| CoolingSecessionNonCoverDays | 14 | x/guild (extended) | REQ-064 (locked) | vision §4.6 — secession cooling, secured at founding, not reducible |
|
||||
| StandPierEscalationAnnualPassVolumeCents | 10000000 ($100k in Grain-cents) | x/stand (extended) | REQ-059 (not locked) | D-074 ruling — TBD-X = $100k annual Pass volume |
|
||||
| CoverClaimsVoucherBondMultipleAvgCall | 10 | x/cover (NEW) | REQ-055 (not locked) | §9.4, §15 — bond default 10× avg Call size per Pool |
|
||||
| AntiCaptureBillOfRightsCount | 13 | x/cover (NEW) | REQ-056 (locked) | §8.2 — 13 rights codified, non-amendable, non-waivable |
|
||||
| StandPierEscalationAnnualPassVolumeCents | 10000000 ($100k in Grain-cents) | x/stand (extended) | REQ-059 (not locked) | D-074 ruling — TBD-X = $100k annual Pass volume; simtest placeholder (no USD/Grain oracle) |
|
||||
| CoverClaimsVoucherBondMultipleAvgCall | 10 | x/cover (NEW) | REQ-055 (not locked) | §9.4, §15 — bond default 10× avg Call size per Pool. D-090(2): bond = max(10× avg, MinimumVoucherBond) — cold-start fallback. |
|
||||
| AntiCaptureBillOfRightsCount | 13 | x/cover (NEW) | REQ-056 (locked) | §8.2 — 13 rights codified, non-amendable, non-waivable. D-090(1): RightID type + 13 Waivable* consts + ValidateBasic gate land in P2 (NOT P5). |
|
||||
| ShadowVouchWeightMultiplier | 0.5 | x/standing (extended) | REQ-060 (locked) | vision §9.1 — Shadow vouch 50% weight in Community Endorsement signal |
|
||||
| PierCarriesVoice | false | x/guild (extended) | REQ-053 / FR-VOICE-6 (locked, D-087) | vision §12 — Pier does NOT carry Voice; mission-locked invariant (12th const per GRILL D-087) |
|
||||
|
||||
> Note: the v0.8 const firewall extensions named in oy-spec §7 v0.8 acceptance
|
||||
> (`EyeQuorumMin=7`, `AnchorConcentrationCapBps=2000`,
|
||||
|
||||
Reference in New Issue
Block a user