mosaicstack/stack
25
0 Fork 1
Code Issues 404 Pull Requests 13 Packages Projects Releases 15 Wiki Activity

plans: C2-13a rulings for gosalyn-0065. G1: default instance only, no --instance, a named instance is a follow-up. G2: library refuses --sso for 10-27, preview set and proof pair stay, --sso waits for Q175 phase 2. Line cites moved to their places after rows 190 and 192 (webui-service.sh, stack-copy.sh, bus-service.sh, serve.mjs), and the Console's WantedBy replaces :41

Browse Source
This commit is contained in:
jason.woltje committed 2026-10-20 18:09:04 -05:00
1 parent ad6f0be7aa
commit 01b40d3576
1 file changed
+16 -12
Download Patch File Download Diff File Expand all files Collapse all files
docs/plans/2026-10-20_case2-rows.md
+16 -12
View File
@@ -800,23 +800,26 @@ Row 195 calls it with those names. `library` refuses `--pm` and `--claude`.
Row 195 installs claude under a root-owned prefix to match. Row 195 installs claude under a root-owned prefix to match.
- The copy id must be exactly 40 lowercase hex characters naming a directory that holds - The copy id must be exactly 40 lowercase hex characters naming a directory that holds
`scripts/mosaic`, directly under `<home>/.local/share/mosaic-stack/copies`. That is the rule `scripts/mosaic`, directly under `<home>/.local/share/mosaic-stack/copies`. That is the rule
`copy_root` uses (`scripts/stack-copy.sh:6`, `:20`). Anything else refuses before the render. `copy_root` uses (`scripts/stack-copy.sh:8`, `:22`). Anything else refuses before the render.
- The serve flags. The script copies the checks from `serve_flags` (`scripts/webui-service.sh:146-207`) - The serve flags. The script copies the checks from `serve_flags` (`scripts/webui-service.sh:201-264`)
into its own function, with its own tests. It doesn't source or change that script, because its into its own function, with its own tests. It doesn't source or change that script, because its
proof-file check compares the owner to `id -u` (`:201`), which is root here, and its render finds proof-file check compares the owner to `id -u` (`:257`), which is root here, and its render finds
node with `command -v` (`:237`), not `--node` (webby-0036 N3). The library profile takes exactly node with `command -v` (`:294`), not `--node` (webby-0036 N3). The library profile takes exactly
these flags, each once, and refuses any other: these flags, each once, and refuses any other:
- `--port N`, with N in 1..1023 (design 9.3). - `--port N`, with N in 1..1023 (design 9.3).
- `--business ID`, equal to `--business`. - `--business ID`, equal to `--business`.
- `--public-host NAME`, `--auth-header HEADER` and `--allow-user ID`, checked as - `--public-host NAME`, `--auth-header HEADER` and `--allow-user ID`, checked as
`webui-service.sh` checks them. Their values come from design 10 step 5. `webui-service.sh` checks them. Their values come from design 10 step 5.
- `--send`, because C2-10b's chat needs it. - `--send`, because C2-10b's chat needs it.
- It refuses `--sso`. For 10-27 the library Console signs people in through the proxy, with the
preview set and the proof pair above. `webui-service.sh` refuses `--sso` with either (`:221-225`).
Taking `--sso` here waits for Q175 phase 2 (row 200 and its window), as a follow-up (gosalyn-0065 G2).
- `--proof-header NAME` and `--proof-file PATH`. The proof is required, not optional (design 9.3). - `--proof-header NAME` and `--proof-file PATH`. The proof is required, not optional (design 9.3).
The file must be a regular file, not a symlink, owned by `<user>`'s uid from `getent passwd`, mode The file must be a regular file, not a symlink, owned by `<user>`'s uid from `getent passwd`, mode
0600 or 0400, under `<home>/.config/mosaic-dev/secrets/`. That keeps it out of the data root, where 0600 or 0400, under `<home>/.config/mosaic-dev/secrets/`. That keeps it out of the data root, where
a session's run directory is. The script stats it and never opens it. a session's run directory is. The script stats it and never opens it.
- It refuses `--tester-port`. The tester listener takes instance, route, name and chat writes from - It refuses `--tester-port`. The tester listener takes instance, route, name and chat writes from
loopback with no sign-in (`packages/webui/src/serve.mjs:472`, `:532-542`). loopback with no sign-in (`packages/webui/src/serve.mjs:482`, `:552-553`).
- It refuses `--checkout`. Her host has no canonical checkout, and the queue store refuses a read - It refuses `--checkout`. Her host has no canonical checkout, and the queue store refuses a read
from the copy, so the queue panel isn't part of Case 2 (webby-0036 N4). from the copy, so the queue panel isn't part of Case 2 (webby-0036 N4).
- It refuses `--board`. Case 2 runs no control board, and design 9.3 says why the default stays. - It refuses `--board`. Case 2 runs no control board, and design 9.3 says why the default stays.
@@ -835,11 +838,11 @@ The render. It renders two system units from the checkout's existing templates a
- `@PATH@` is the directory of `--node` first, then whichever of `/usr/local/bin`, `/usr/bin` and `/bin` - `@PATH@` is the directory of `--node` first, then whichever of `/usr/local/bin`, `/usr/bin` and `/bin`
it isn't, in that order. The bus's `ExecStart=` is `scripts/mosaic`, which runs `exec node` from it isn't, in that order. The bus's `ExecStart=` is `scripts/mosaic`, which runs `exec node` from
PATH (`scripts/mosaic:22-40`), so this line picks the bus's node. It differs from PATH (`scripts/mosaic:22-40`), so this line picks the bus's node. It differs from
`scripts/webui-service.sh:246-248` in one case on purpose. That script leaves the list alone when the `scripts/webui-service.sh:303-305` in one case on purpose. That script leaves the list alone when the
node's directory is already in it, so with `--node /usr/bin/node` a node in `/usr/local/bin` would node's directory is already in it, so with `--node /usr/bin/node` a node in `/usr/local/bin` would
come first and the bus would run it. come first and the bus would run it.
- `@FLAGS@` is the checked serve flags, in the order given. - `@FLAGS@` is the checked serve flags, in the order given.
- `@PM_FLAGS@` is ` --pm` when `factory` is given `--pm`, as `scripts/bus-service.sh:69-70` renders it, - `@PM_FLAGS@` is ` --pm` when `factory` is given `--pm`, as `scripts/bus-service.sh:82` renders it,
and empty otherwise. and empty otherwise.
- `@CLAUDE_ENV@` is the line `Environment=MOSAIC_CLAUDE_BIN=<--claude>` when `factory` is given - `@CLAUDE_ENV@` is the line `Environment=MOSAIC_CLAUDE_BIN=<--claude>` when `factory` is given
`--claude`, and empty otherwise. `--claude`, and empty otherwise.
@@ -847,8 +850,9 @@ The render. It renders two system units from the checkout's existing templates a
render refuses an unknown token, and row 190 landed first, so this row renders both, with tests render refuses an unknown token, and row 190 landed first, so this row renders both, with tests
(gosalyn-0057 item 4). Fill them as `scripts/instance.sh:85-107` does: for the default instance (gosalyn-0057 item 4). Fill them as `scripts/instance.sh:85-107` does: for the default instance
`dev` the `@CONFIG_ENV@` line is deleted and `@SESSION_ENV@` is the session env path under `%h`, which `dev` the `@CONFIG_ENV@` line is deleted and `@SESSION_ENV@` is the session env path under `%h`, which
the `%h` rule below then makes literal. A named instance takes instance.sh's the `%h` rule below then makes literal. This row renders the default instance only, with the
`Environment=MOSAIC_CONFIG=` line. The bus template's `EnvironmentFile=` line is now unsuffixed unit names below, and takes no `--instance`. A named instance on a Case 2 host is a
follow-up (gosalyn-0065 G1). The bus template's `EnvironmentFile=` line is now
`mosaic-bus.service.in:25`, `EnvironmentFile=-@SESSION_ENV@`, and the checks below match it there. `mosaic-bus.service.in:25`, `EnvironmentFile=-@SESSION_ENV@`, and the checks below match it there.
- `%h` becomes the literal `--home`, because in a system unit `%h` is root's home. - `%h` becomes the literal `--home`, because in a system unit `%h` is root's home.
- After the render it refuses any `@[A-Z_]+@` or `%h` left in either unit. - After the render it refuses any `@[A-Z_]+@` or `%h` left in either unit.
@@ -870,7 +874,7 @@ line restricts namespaces or system calls. A session's bwrap needs a user, PID a
holds any of them. holds any of them.
- `[Install]`. Each unit renders `WantedBy=multi-user.target` as its one `WantedBy=` line. In the bus - `[Install]`. Each unit renders `WantedBy=multi-user.target` as its one `WantedBy=` line. In the bus
unit it replaces `WantedBy=default.target`, not followed by a second line (webby-0036 N1). The unit it replaces `WantedBy=default.target`, not followed by a second line (webby-0036 N1). The
Console unit gets the same line (Q189, mos-1122, mos-1123, gosalyn-0064 item 1). That reverses Console unit gets the same line, replacing `WantedBy=default.target` at `mosaic-webui.service.in:41` (Q189, mos-1122, mos-1123, gosalyn-0064 item 1). That reverses
mos-1097 item 1 and webby-0036 B1's "no `[Install]` on the Console". mos-1097 item 1 and webby-0036 B1's "no `[Install]` on the Console".
- Root's 2c step enables both units, then starts the bus and then the Console (gosalyn-0064 item 2, - Root's 2c step enables both units, then starts the bus and then the Console (gosalyn-0064 item 2,
design ruling after r11 at 8614ba87c). Both come back after a boot on their own. Design 10 step 9 has design ruling after r11 at 8614ba87c). Both come back after a boot on their own. Design 10 step 9 has
@@ -889,7 +893,7 @@ none, and it refuses one. It also refuses:
webby-0027, defence in depth). webby-0027, defence in depth).
- on a re-install, an installed pair whose two units name different copy ids (webby-0036 N5). The bus - on a re-install, an installed pair whose two units name different copy ids (webby-0036 N5). The bus
accepts only its own `human-cli.mjs` path, so a split pair breaks the human proof accepts only its own `human-cli.mjs` path, so a split pair breaks the human proof
(`scripts/webui-service.sh:266-273`). (`scripts/webui-service.sh:324-348`).
- on a re-install, an installed unit that differs from the render in anything but the copy id. So the - on a re-install, an installed unit that differs from the render in anything but the copy id. So the
node path and serve flags must equal the installed ones. The copy id is the one value that may node path and serve flags must equal the installed ones. The copy id is the one value that may
change, so a re-pin or a rollback to another copy re-renders both units together (row 195). With change, so a re-pin or a rollback to another copy re-renders both units together (row 195). With
@@ -911,7 +915,7 @@ checks below. C2-13b adds the library checks to the same file. It refuses unless
`profile-library-business`, so Case 2 can't reach a tester-on check through a wrong flag. `profile-library-business`, so Case 2 can't reach a tester-on check through a wrong flag.
- The run root is 0700. - The run root is 0700.
- `XDG_DATA_HOME` is unset or is `<home>/.local/share`. `copy_root` reads the copies dir from it - `XDG_DATA_HOME` is unset or is `<home>/.local/share`. `copy_root` reads the copies dir from it
(`scripts/stack-copy.sh:6`), and the unit fixes `<home>/.local/share`, so any other value would put (`scripts/stack-copy.sh:8`), and the unit fixes `<home>/.local/share`, so any other value would put
the copy where the unit refuses it (webby-0032 N2). the copy where the unit refuses it (webby-0032 N2).
- `node --version` is 24 or later, because every package's `engines` field says `>=24` (row 195: .53 - `node --version` is 24 or later, because every package's `engines` field says `>=24` (row 195: .53
has v22.22.2). has v22.22.2).