The only recommendation in the investigation that becomes strictly impossible if deferred. You cannot chain history retroactively, and you cannot re-adjudicate a log whose reducer has moved on across a 30-day Bar A window that spans deploys.
All four acceptance bars are measured from the event log. mq explain renders from it. M6 grades the scheduler by replaying it. And it has never been attacked.
Four structural holes, all verified against lib/domain.mli:
type event = { command_id; payload } has no timestamp, no event ID, no atom ID, no repository identity — directly contradicting TDD-M0A §5, which requires all four.- No
schema_version. A v_n reducer folding a v_1 log silently answers a different question.
- Not self-contained. Constitution rule 3 makes "complete required evidence" a function of
.mq.yml at policy_commit_sha, but the log stores the pointer. diagnostic_url / run_url point into stores with finite, operator-deletable retention.
- No hash chaining. An append-only convention over a Postgres table is not append-only to anyone with DB access — including the operator whose landings it attests.
Do all of this before M0b writes its first durable event
The strongest positioning available to this project — the merge queue you can prove to an auditor — is exactly the claim an unversioned, unchained, pointer-based log cannot support.
See docs/INVESTIGATION.md §4, §6 Q11, §7 R4.
The only recommendation in the investigation that becomes strictly impossible if deferred. You cannot chain history retroactively, and you cannot re-adjudicate a log whose reducer has moved on across a 30-day Bar A window that spans deploys.
All four acceptance bars are measured from the event log.
mq explainrenders from it. M6 grades the scheduler by replaying it. And it has never been attacked.Four structural holes, all verified against
lib/domain.mli:type event = { command_id; payload }has no timestamp, no event ID, no atom ID, no repository identity — directly contradicting TDD-M0A §5, which requires all four.schema_version. A v_n reducer folding a v_1 log silently answers a different question..mq.ymlatpolicy_commit_sha, but the log stores the pointer.diagnostic_url/run_urlpoint into stores with finite, operator-deletable retention.Do all of this before M0b writes its first durable event
event_id,atom_id,repository_id,recorded_at(TDD-M0A §5 already requires them)schema_versionper eventprev_event_hashchaining with periodic external anchoringfold(snapshot, tail) == fold(genesis, all)property — CONFIGURATION §1.2's retention promise and README's "state is a fold over the log" are otherwise incompatibleThe strongest positioning available to this project — the merge queue you can prove to an auditor — is exactly the claim an unversioned, unchained, pointer-based log cannot support.
See
docs/INVESTIGATION.md§4, §6 Q11, §7 R4.