Part of #869 (Point-1 C4). Locks the lease broker's ENFORCEMENT half
(launch-runtime.py) and ACTIVATION half (execLeaseGatedRuntime, C1's
LEASE_ACTIVATION_CAPABILITY) as one versioned unit, closing the #828
version-skew gap C1 only made observable.
- New packages/mosaic/framework/tools/lease-broker/activation_version_gate.py:
EXPECTED_ACTIVATION_CAPABILITY (enforcement-owned, mirrors but is
independent from C1's LEASE_ACTIVATION_CAPABILITY), a fail-closed
subprocess probe of the CLI's hidden `mosaic __lease-capability`
command, and an assertion that FAILS LOUD (VersionCouplingError with
an actionable #869 remediation message) on mismatch OR absence —
never a silent pass, never a dead gate.
- launch-runtime.py now runs this assertion first, before any broker
registration, and denies with a dedicated exit code (65) distinct
from its existing usage (64) and registration-failure (1) codes.
- Red-first tests: src/mutator-gate/version_coupling_unittest.py
(module-level match/mismatch/name-mismatch/absent-capability cases,
and seam-level LAUNCHER.main() cases proving the gate runs before
broker registration and never silently passes).
- Existing fail-closed-on-absent-identity lock
(runtime_tools_unittest.py) stays green: matching-capability fakes
were injected into its pre-existing LAUNCHER.main() calls so the new
gate runs alongside, not in place of, identity enforcement.
- mutator-gate.acceptance.spec.ts updated to supply a fake CLI-capability
probe (matching the existing fake-broker/fake-runtime-binary test
doubles already in that suite) everywhere it drives launch-runtime.py
as a real subprocess.
launch.ts and lease-activation-probe.ts are untouched (C2/C5 avoidance,
C1 read-only).
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Part of #869
Mos (id-11) Gate-16 merge: independent APPROVE @b6f36564 (8/8, verified vs real production settings template), author id2 != approver id11, clean mosaic-coder author, CI green wp1988.
Co-authored-by: jason.woltje <[email protected]>
Co-committed-by: jason.woltje <[email protected]>
Part of #869
Mos (id-11) Gate-16 merge: independent APPROVE @75235ef8 (9/9, no live host mutation), author id2 != approver id11, CI green wp1971.
Co-authored-by: jason.woltje <[email protected]>
Co-committed-by: jason.woltje <[email protected]>
GLPI helpdesk workflow skills written against the portable
tools/glpi/ tooling (session-init.sh, ticket-list.sh, ticket-create.sh),
cross-linked via [[glpi-*]]:
- glpi-solve — close a ticket by setting status Solved (5); GLPI auto-closes
- glpi-followup — add a followup via the top-level /ITILFollowup endpoint
- glpi-sweep — read-only hunt for done-but-open tickets needing Solve
- glpi-list — query tickets by status/recency
- glpi-create — open a new ticket
Core rule encoded: completing work means setting status Solved, not just
posting a resolution followup (a followup documents; only Solved auto-closes).
Note: illustrative examples in the bodies are USC-flavored (M2M / helpdesk
ticket numbers) and can be genericized in review if preferred.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Claude-Session: https://claude.ai/code/session_019GjBgrb9tHgvq414Fqj37c
jason.woltjeandMos