Epic: the destructive surface has outgrown ADR 0029's classification table #563

New issue

Open

opened 2026-09-21 21:01:44 +00:00 by hexajon · 0 comments

hexajon commented

2026-09-21 21:01:44 +00:00

Owner

What I found

I audited the codebase against ADR 0029 (docs/decisions/0029-strict-omission-destruction-model.md), which says no madtea surface carries an operation that destroys unrecoverable work, with one carve-out for destruction madtea can machine-prove is safe.

Two of its three clauses hold. The #208 worktree force-remove and #209 madt_delete convergence work landed for real: force is absent from the remove action spec (internal/mcp/tools_worktrees.go:83-87) and rejected pre-dispatch, tools_delete.go does not exist, the destructive domain is not registered, and gateForcedWorktreeRemove is gone. push --force rides a bare --force-with-lease at the one force construction in the tree (internal/service/git/push.go:131).

The rest of the audit found four concrete defects and one structural problem underneath them.

The structural problem

ADR 0029's per-operation table classifies nine operations. A second, older policy governs the surface that actually ships: internal/parity/destructive_remote_pin_test.go pins roughly fifty delete-shaped MCP operations under the #120 rule "irreversible means gated". ADR 0029 clause 1 rejects that rule by name, because a gate degrades per client and madt_enable is a plain agent-callable tool with no consent step.

Both policies are green in CI. Neither knows the other exists. That is the "three models coexisting, documented but unreconciled" state ADR 0029 was written to end, reappearing one layer down.

docs/reference/destructive.md reads as an exhaustive list of the omitted deletes and is not one. Seven code comments still cite the pre-migration path docs/adr/0029-....

The children

Two prune defects break a decided machine-proof carve-out. Both are reproduced, not theorised.

Two more are surface and refusal defects. The last child settles the classification question the other four keep running into.

Exit criterion

Every destructive-capable operation on either surface is classified, the carve-outs prove what the ADR says they prove, and destructive.md matches the shipped behaviour.

Relates to #554, which asks the neighbouring scope question: whether the omission rule reaches raw git forms that re-enable an omitted operation.

## What I found I audited the codebase against ADR 0029 (`docs/decisions/0029-strict-omission-destruction-model.md`), which says no madtea surface carries an operation that destroys unrecoverable work, with one carve-out for destruction madtea can machine-prove is safe. Two of its three clauses hold. The #208 worktree force-remove and #209 `madt_delete` convergence work landed for real: `force` is absent from the `remove` action spec (`internal/mcp/tools_worktrees.go:83-87`) and rejected pre-dispatch, `tools_delete.go` does not exist, the `destructive` domain is not registered, and `gateForcedWorktreeRemove` is gone. `push --force` rides a bare `--force-with-lease` at the one force construction in the tree (`internal/service/git/push.go:131`). The rest of the audit found four concrete defects and one structural problem underneath them. ## The structural problem ADR 0029's per-operation table classifies nine operations. A second, older policy governs the surface that actually ships: `internal/parity/destructive_remote_pin_test.go` pins roughly fifty delete-shaped MCP operations under the #120 rule "irreversible means gated". ADR 0029 clause 1 rejects that rule by name, because a gate degrades per client and `madt_enable` is a plain agent-callable tool with no consent step. Both policies are green in CI. Neither knows the other exists. That is the "three models coexisting, documented but unreconciled" state ADR 0029 was written to end, reappearing one layer down. `docs/reference/destructive.md` reads as an exhaustive list of the omitted deletes and is not one. Seven code comments still cite the pre-migration path `docs/adr/0029-...`. ## The children Two prune defects break a decided machine-proof carve-out. Both are reproduced, not theorised. Two more are surface and refusal defects. The last child settles the classification question the other four keep running into. ## Exit criterion Every destructive-capable operation on either surface is classified, the carve-outs prove what the ADR says they prove, and `destructive.md` matches the shipped behaviour. Relates to #554, which asks the neighbouring scope question: whether the omission rule reaches raw git forms that re-enable an omitted operation.

hexajon referenced this issue

2026-09-21 21:01:56 +00:00

prune force-deletes a branch whose content is not in the default branch #564

hexajon referenced this issue

2026-09-21 21:08:26 +00:00

prune deletes the remote twin on a proof computed only from local refs #566

hexajon referenced this issue

2026-09-21 21:09:02 +00:00

the orchestrate dangerous-verify refusal ends by naming the surface that still allows it #567

hexajon referenced this issue

2026-09-21 21:09:18 +00:00

branches-remote delete drops an unmerged remote ref with no containment proof #568