TRIAGE.md classifies a hard criterion by when it can be checked, never by who can reach its evidence — so box#180 minted a host measurement and named the builder, who is a sandbox

[dan-claude-bot]

Flagged by @cndgrr on heavy-duty/box#180, 2026-08-20: "Every builder on this board is a box, so any criterion whose evidence is a host command is operator-owned by construction, not by exception. Worth carrying into TRIAGE.md if it is not there already." They declined to edit the vendored mirror and flagged it instead, which is correct — so it arrives here, where the file is changed. I am the triage that wrote the defective issue.

What happened

heavy-duty/box#180 was minted with a measurement task (lsblk -f, findmnt, df -h, incus storage show) and two acceptance criteria whose evidence is df on a real host with a spare block device. Its body said "the builder takes these on the host."

Every builder on that board runs inside a box — a trust-less, network-isolated guest with no view of the host it sits on — and standing up the host stack inside one is the prohibited act of heavy-duty/box#80. So the issue named an owner who could not be the owner. The builder caught it at claim time, roughly four minutes after claiming, and asked before starting. Triage amended the body: measurement task marked operator-owned and non-gating, an open spec decision resolved that had been made to depend on a measurement it did not need, and the criteria split by evidence and owner — six PR-checkable, two post-merge and operator-evidenced under the mechanism TRIAGE.md already specifies.

The issue is fixed. The question is why the mint produced it, because nothing about that issue was unusual.

The gap, precisely

The concept is in doctrine — but only downstream of the mint. At ef09fdb:

• BUILDER.md L51–L55, park shape 3, opens "every remaining acceptance criterion is operator-owned, stated so by triage on the issue." It presumes the classification has already happened.
• BUILDER.md L157–L160 gives the repair path: a criterion that "turns out wrong or unreachable goes back to triage to be amended, never silently shipped short." That is a correction, and it costs a round-trip at claim time.
• TRIAGE.md L80–L90 carries the only mint-time rule about hard criteria, and its trigger is time: "a criterion that can only be checked after the merge." Not reach.

So no line tells triage to make the ownership call when writing the criterion, and no line names what makes that call predictable instead of case-by-case. @cndgrr's phrase is the missing premise: on a board whose builders are all sandboxes, reach is a property of the evidence — knowable the moment the criterion is written, by asking what command produces it and where that command must run. Post-merge and out-of-reach are different axes, and today the file only has the first.

The cost is small per instance and structural in aggregate: the builder pays a claim-time round-trip, and — worse — a triage that does not classify at mint can write a criterion whose owner nobody notices until a panel or a merge asks who ticks it.

Proposed shape

Two additions, both to TRIAGE.md's Acceptance criteria bullet, in its existing voice:

1. Classify each criterion at mint by who can produce its evidence. Where the evidence is a command on a host, on hardware, or on any surface a builder's sandbox cannot reach, the criterion is operator-owned, says so in the criterion itself, names its evidence and its wake condition, and carries the post-merge mechanism already specified. Reach is judged from the evidence, not from the builder's report.
2. An unreachable criterion discovered at claim time is a spec defect triage fixes in the body — not a cost the builder absorbs, and not something answered in a comment while the body keeps saying otherwise. This is the same duty the file already states for a lifted hold ("a lifted hold makes its body prose stale in the same instant, and the body is yours", FLEET.md — the reviewer wake still specs a gh search trigger the bench replaced with an org-wide requested_reviewers sweep #149).

A sentence naming the sandbox premise once — that a builder cannot be assumed to reach the host it runs on — would carry both, and would generalize past box to any consumer whose builders are isolated.

The open question I do not own

Does the classification also fix the route? Two box issues were routed differently on purpose within an hour of each other, and I think both are right:

• box#174 — operator ruled: park the claim, operator supplies the VM run, nothing merges first. It ships on by default; its live criteria are the deliverable, so merging with them unproven ships the central claim unevidenced.
• box#180 — triage's call: merge, Refs, close post-merge. It ships off by default; with the variable unset the output is byte-for-byte today's, which is itself a PR-checkable criterion and is fully proved. The new path activates only when an operator sets the variable — and that operator is exactly the person who can run df.

The distinguishing question I used was "what does a user who does nothing get?" If that is the rule, it is worth writing down beside park shape 3, because shape 3 currently reads as though an operator-owned remainder always parks. If it is not the rule, or the choice should stay a per-issue judgment, then say so and the classification stays owner-only — which is still worth the two additions above.

I hold triage and not push here, so this is a discussion and not a PR.

[danmt]

i think your proposal is fine. although i dont want ceremony to know whether a builder is a box or not, thats up to each builder to know, in any case, that would be something in crew. now the proposal is fine and does help tho. @dan-claude-bot

[dan-claude-bot]

Converged — accepted, and split in two. This thread closes.

@cndgrr's flag was right and it lands where the file is actually changed. The outcome is accept, and the two parts of this discussion go to two different places because only one of them was decided.

The decided part is minted: #487 — ready, documentation, scope:docs, unassigned and unclaimed

Both additions this thread proposed, plus the premise sentence that carries them:

• D1 — every criterion is classified at mint by who can produce its evidence, with the evidence as the input: what command proves it, and where that command must run.
• D2 — an operator-owned criterion says so in its own text and carries its evidence and its wake condition there, plus the existing Refs #N / post-merge mechanism where it is also post-merge.
• D3 — the sandbox premise, stated once and generally, so it holds for any consumer whose builders are isolated rather than for one board.
• D4 — an unreachable criterion found at claim time is a spec defect triage fixes in the body, in the same tick, in the voice TRIAGE.md already uses for a lifted hold (FLEET.md — the reviewer wake still specs a gh search trigger the bench replaced with an org-wide requested_reviewers sweep #149).
• D5 — the two axes are independent in both directions, with a four-cell matrix in the Context and a test-plan case for the corner people forget (post-merge and builder-owned).
• D6 — the one thing this mint could easily get wrong: the incident is in another repository and #280 forbids the vendored files from citing one. The rule is stated in ceremony's own vocabulary, and an acceptance criterion measures zero occurrences of box, incus, heavy-duty/ or any owner/repo#N form in TRIAGE.md. The narrative lives in the issue precisely so the file does not have to carry it.

It declares no blocker and none is owed: the board held 0 open issues and 0 open pull requests at the mint, so no open carrier of TRIAGE.md exists and there is no collision edge. Its class is ordinary by #425 D2 — it reds nothing and breaks no build but the next mint's — and no release-window membership call is owed, #482 having closed on 2026-08-19.

The part I said I do not own is escalated on its own: discussion #488

Does the classification also fix the route? — park the claim until the operator's evidence lands, or hand off, merge with Refs #N, and close the remainder post-merge. It is asked there with the canonical ruling shape, three options and the hard-block reasoning, and @danmt is the decider.

Folding it in here would have made this thread converge on two outcomes, and folding it into #487 would have put an open question inside an issue contract, which the contract forbids. So it goes out on its own — the same split #451 took out of #435.

Two things about it sharpened while writing it down, and neither is in this thread's framing above:

• Doctrine already has a default route and it is merge. TRIAGE.md L81–L90 is unconditional for any criterion checkable only after the merge. So the question is not "which of two blank options" — it is whether an operator-owned remainder is an exception to a rule that already exists.
• This thread said park shape 3 "reads as though an operator-owned remainder always parks." Read exactly, it does not: L51–L55 governs the claim slot and orders shapes 3 and 4 — "parks the claim and never the handoff" — which is BUILDER.md — two ways a finished session stops: parking on an operator-owned remainder before the handoff, and blocking on a producer it cannot prove alive #336's actual subject. The misreading is real and is what the ruling would repair; the sentence itself is not wrong. When every remaining acceptance criterion is operator-owned, does the merge wait for the operator’s evidence or does the PR merge with `Refs #N`? Two live cases routed opposite ways this morning #488 says it that way rather than the way it is said above.

What #487 is deliberately silent about

Route-neutrality is one of its acceptance criteria. Whichever way #488 is ruled, #487 ships whole and unchanged, and a written route rule lands as its own issue against BUILDER.md park shape 3 — taking the collision edge behind #487 if that is still open. Nothing on this board is flagged needs-ruling on #488's account, because nothing on it is blocked.

Back to box#180

Nothing here changes anything there. Its body is already amended, its six PR-checkable criteria are proved at head, its two df criteria are operator-evidenced and post-merge, and its claim stands with @cndgrr. This thread was about why the mint produced the defect, not about the defect, and that answer is now a ready issue rather than a lesson only I hold.

[dan-claude-bot]

Taken, @danmt — and it landed in the build, not just in this thread

The comment that closed this discussion was posted four minutes after yours and did not read it. So this is the late half, and it is not an ack: your constraint changed the shipped text.

What it changed. The build was already signalled when you were quoted into it. TRIAGE.md at 70f68da reads "A builder's session is not assumed to reach the host it runs on, the hardware under it, or the network beyond itself, governed boards running their builders in isolation." Everything before that comma declines to assume; the clause after it asserts what builders are — the thing you said ceremony should not know. #487's D3 asked for exactly that clause, so the defect is triage's and the fix is in the spec: D3 rewritten to a non-assumption and nothing more, one task row, one acceptance criterion measuring that the added text asserts no environment at all. The clause comes out and nothing replaces it.

Why the rule survives it whole, as you said it should: the classification's input is the evidence — what command proves a criterion and where it must run — which needs no fact about the builder's session. The premise is only a default about what triage may assume.

One bound, mine, needing no answer unless I have it wrong. I read you as: the file may not assert an environment, but may still decline to assume reach. If you meant the premise sentence should go entirely, it is a one-line deletion and D1/D2 stand without it. The issue body still tells the incident story with a host and an isolated guest, because #280 puts the narrative in the issue so the vendored file carries none of it — say the word if the constraint reaches issue bodies too.

Where a builder's own environment gets written down is crew's, and I mint nothing there for it; this file cites it either way under #280.

Not read as a ruling on #488. Your comment predates that ask by four minutes and speaks to the classification, not the route. The route question — whether an operator-owned remainder holds the merge or takes Refs #N and closes post-merge — is still open there and still yours, hard-blocked, with the 24-hour ladder running from 2026-08-20T15:25:36Z.

This thread stays closed and answered; the work is on #487.