mosaicstack/stack
25
0
Fork 1
Code Issues 369 Pull Requests 13 Actions Packages Projects Releases 15 Wiki Activity

queue: queue add by jason or sage requires --gate-owner (#1595)

Browse Source 
Row 101. Built by a Haiku subagent under Researcher (decision 129),
packet agents/researcher/work/queue-101/r1/, candidate manifest
ee1335a6e44610f676ade116733d180ac6f0b3603a58306110cbd1dd1e9c1f69.
Filbert approved on #1595, comment 28245.

The check runs at write time in store.mjs mutateAs, with no SEMANTICS
bump, so the live Console keeps reading the log.

Sage's gate rerun on 79e126be0 with rows 101 and 105 applied, Docker
up: node suites bus 128, business 67, cli 146, control-board 124,
conversation 182, discord 178, harness 70, ledger 78, mosaic 69,
queue 155, runs 43, seat 109, tasks 92, webui 108; scripts auth 15,
conductor 17, config 24, discord 66, extension-package 18,
foundation 44, queue 28, release 14, task 98. All pass, 0 fail.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
jason.woltje
2026-10-13 16:26:12 -05:00
co-authored by Claude Opus 5.5
parent a2714a680e
commit 056a20397d
5 changed files with 136 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/queue/tests/gate-owner.test.mjs
+115
View File
@@ -0,0 +1,115 @@
// Row 101 (#1595): a privileged add names its gate owner. The refusal is a
// write-time check in store.mjs, so it is exercised through the CLI in a
// scratch repository. Replay is exercised through loadDoc, which runs the real
// replay path over a log that holds an old privileged add with no gate owner.
import assert from "node:assert/strict";
import { readFileSync } from "node:fs";
import { test } from "node:test";
import {
applyEntry, buildDoc, canonArgs, genesisReceipt, genesisRows, loadDoc, parseMigrationMap, render, rowsArray, serialize, sha256,
} from "../src/queue.mjs";
import { QueueError } from "../src/errors.mjs";
import { MAP_ROWS, cli, genesisCommitted, mapText, scratchRepo } from "./helpers.mjs";
const ROOT = "/srv/repo";
const BLOB = "a".repeat(40);
const BLOB2 = "b".repeat(40);
let clock = 0;
const at = () => new Date(Date.UTC(2026, 9, 13, 12, 0, clock++)).toISOString();
function brief() {
return { path: "docs/plans/brief-b.md", anchor: "Queue", blob: BLOB };
}
function addArgs(extra = {}) {
return { piece: "Gate row", gate: "g", brief: "docs/plans/brief-b.md#Queue", ...extra };
}
// A genesis document built the way store.mjs builds one.
function genesisDoc() {
const map = parseMigrationMap(mapText(MAP_ROWS));
const blobs = new Map(map.rows.filter((r) => r.brief).map((r) => [r.id, BLOB]));
const t = at();
const grows = genesisRows(map, blobs, "genesis-gate-0001", t, "sage");
const entry = {
rev: 0, op: "genesis-gate-0001", verb: "genesis", args: { root: ROOT, branch: "refactor", map: "agents/sage/work/queue-migration-map.md" },
by: "sage", at: t, semantics: 1,
result: { mapBlob: BLOB2, highWater: map.highWater, retired: map.retired, rows: grows, legacyView: "legacy\n", receipt: genesisReceipt("genesis-gate-0001", grows.length) },
viewSha: sha256(render(grows, 0)),
};
return { version: 1, canonicalRoot: ROOT, revision: 0, rows: grows, log: [entry] };
}
// Appends one add at the given semantics, the way store.mjs would have written
// it before this row: applyEntry only, no write-time check.
function addUnder(doc, by, args, semantics) {
const { state } = loadDoc(Buffer.from(serialize(doc)));
const rev = doc.revision + 1;
const entry = { rev, op: `add-gate-${rev}`, verb: "add", args: canonArgs("add", args), by, at: at(), semantics, result: null, viewSha: null };
const out = applyEntry(state, entry, { brief: brief() });
entry.result = out.result;
entry.viewSha = sha256(render(rowsArray(out.state), rev));
return buildDoc(doc.canonicalRoot, out.state, [...doc.log, entry]);
}
test("an old privileged add with no gate owner still replays through loadDoc, and gets jason", () => {
for (const semantics of [1, 2]) {
const d = addUnder(genesisDoc(), "sage", addArgs(), semantics);
const { doc, state } = loadDoc(Buffer.from(serialize(d)));
assert.equal(doc.rows.at(-1).gateOwner, "jason");
assert.equal(state.rows.get(doc.rows.at(-1).id).gateOwner, "jason");
}
});
test("a non-privileged add gets jason through the replay path and can't name a gate owner", () => {
const d = addUnder(genesisDoc(), "dewey", addArgs(), 2);
assert.equal(loadDoc(Buffer.from(serialize(d))).doc.rows.at(-1).gateOwner, "jason");
assert.throws(
() => addUnder(genesisDoc(), "dewey", addArgs({ gateOwner: "filbert" }), 2),
(err) => err instanceof QueueError && err.code === 2 && /only a privileged actor may set gateOwner on add/.test(err.message),
);
});
test("the CLI refuses a privileged add without --gate-owner, for jason and sage, and writes nothing", (t) => {
const repo = scratchRepo(t);
genesisCommitted(repo);
const queueBefore = readFileSync(repo.queuePath);
const viewBefore = readFileSync(repo.viewPath);
const revBefore = JSON.parse(queueBefore.toString("utf8")).revision;
const args = ["add", "--op", "add-gate-nogate-1", "--piece", "x", "--gate", "g", "--brief", "docs/plans/brief-b.md#Template"];
for (const by of ["sage", "jason"]) {
const r = cli(repo, args, { by });
assert.equal(r.code, 2, r.err);
assert.match(r.err, /--gate-owner/);
assert.match(r.err, /no default gate owner/);
assert.deepEqual(readFileSync(repo.queuePath), queueBefore);
assert.deepEqual(readFileSync(repo.viewPath), viewBefore);
assert.equal(JSON.parse(readFileSync(repo.queuePath, "utf8")).revision, revBefore);
}
});
test("the CLI add with --gate-owner carries the named owner and records a log entry", (t) => {
const repo = scratchRepo(t);
genesisCommitted(repo);
const r = cli(repo, ["add", "--op", "add-gate-named-1", "--piece", "x", "--gate", "g", "--brief", "docs/plans/brief-b.md#Template", "--gate-owner", "filbert"], { by: "sage" });
assert.equal(r.code, 0, r.err);
const d = JSON.parse(readFileSync(repo.queuePath, "utf8"));
assert.equal(d.rows.at(-1).gateOwner, "filbert");
assert.equal(d.log.at(-1).op, "add-gate-named-1");
assert.equal(d.log.at(-1).by, "sage");
});
test("the CLI add by a non-privileged seat gets jason and can't name a gate owner", (t) => {
const repo = scratchRepo(t);
genesisCommitted(repo);
const base = ["--piece", "x", "--gate", "g", "--brief", "docs/plans/brief-b.md#Template"];
const ok = cli(repo, ["add", "--op", "add-gate-dewey-1", ...base], { by: "dewey" });
assert.equal(ok.code, 0, ok.err);
assert.equal(JSON.parse(readFileSync(repo.queuePath, "utf8")).rows.at(-1).gateOwner, "jason");
const before = readFileSync(repo.queuePath);
const refusedRun = cli(repo, ["add", "--op", "add-gate-dewey-2", ...base, "--gate-owner", "filbert"], { by: "dewey" });
assert.equal(refusedRun.code, 2, refusedRun.err);
assert.match(refusedRun.err, /only a privileged actor may set gateOwner on add/);
assert.deepEqual(readFileSync(repo.queuePath), before);
});
packages/queue/tests/store.test.mjs
+4 -4
View File
@@ -176,7 +176,7 @@ test("op ids: missing, too long, reserved; a retry answers; another payload refu
test("a retried add returns the id it first allocated, after reassignment and after done", (t) => {
const repo = ready(t);
const add = ["add", "--op", "add-new-row-01", "--piece", "New thing", "--gate", "Jason says", "--brief", "docs/plans/brief-b.md#Template", "--owner", "rocko", "--issue", "#1508"];
const add = ["add", "--op", "add-new-row-01", "--piece", "New thing", "--gate", "Jason says", "--brief", "docs/plans/brief-b.md#Template", "--owner", "rocko", "--gate-owner", "filbert", "--issue", "#1508"];
const first = ok(cli(repo, add, { by: "sage" }), /row 12 none→queued$/m).out.trim();
ok(cli(repo, ["assign", "12", "dewey", "--op", "assign-12-dewey"], { by: "sage" }), /owner: rocko→dewey/);
ok(cli(repo, add, { by: "sage" }), new RegExp(`^${first} \\(already recorded at rev 1\\)$`, "m"));
@@ -226,7 +226,7 @@ test("claims and add defaults through the CLI; candidates are manifests or reach
ok(cli(repo, ["add", "--op", "add-by-dewey-1", "--piece", "Mine", "--gate", "tests", "--brief", "docs/plans/brief-b.md#Template"], { by: "dewey" }));
const r = row(repo, 12);
assert.deepEqual([r.owner, r.gateOwner, r.state, r.claim, r.brief.blob], ["dewey", "jason", "queued", null, repo.g("rev-parse", "HEAD:docs/plans/brief-b.md").trim()]);
no(cli(repo, ["add", "--op", "add-by-dewey-2", "--piece", "x", "--gate", "g", "--brief", "docs/plans/brief-b.md#Template", "--reviewer", "ghost"], { by: "sage" }), 2, /reviewer ghost is not jason or a seat/);
no(cli(repo, ["add", "--op", "add-by-dewey-2", "--piece", "x", "--gate", "g", "--brief", "docs/plans/brief-b.md#Template", "--gate-owner", "filbert", "--reviewer", "ghost"], { by: "sage" }), 2, /reviewer ghost is not jason or a seat/);
no(cli(repo, ["add", "--op", "add-by-dewey-3", "--piece", "x", "--gate", "g", "--brief", "docs/plans/brief-b.md"], { by: "dewey" }), 2, /PATH#ANCHOR/);
no(cli(repo, ["add", "--op", "add-by-dewey-4", "--piece", "x", "--gate", "g", "--brief", "docs/plans/brief-b.md#Queue", "--issue", "x"], { by: "dewey" }), 4);
ok(cli(repo, ["move", "11", "in-progress", "--op", "start-11-0001"], { by: "dewey" }));
@@ -245,7 +245,7 @@ test("claims and add defaults through the CLI; candidates are manifests or reach
test("add, set reviewers and assign refuse the row's owner as a reviewer", (t) => {
const repo = ready(t);
const before = doc(repo);
no(cli(repo, ["add", "--op", "add-owner-reviewer", "--piece", "x", "--gate", "g", "--brief", "docs/plans/brief-b.md#Template", "--owner", "rocko", "--reviewer", "rocko"], { by: "sage" }), 2, /row 12 owner rocko can't be a listed reviewer/);
no(cli(repo, ["add", "--op", "add-owner-reviewer", "--piece", "x", "--gate", "g", "--brief", "docs/plans/brief-b.md#Template", "--owner", "rocko", "--gate-owner", "filbert", "--reviewer", "rocko"], { by: "sage" }), 2, /row 12 owner rocko can't be a listed reviewer/);
assert.deepEqual(doc(repo), before);
no(cli(repo, ["set", "9", "reviewers", "filbert,darkwing", "--op", "set-9-owner-reviewer"], { by: "sage" }), 2, /row 9 owner darkwing can't be a listed reviewer/);
assert.deepEqual(doc(repo), before);
@@ -394,7 +394,7 @@ test("usage errors exit 4", (t) => {
no(cli(repo, ["move", "9", "done", "--op", "x-00000001", "--op", "y-00000001"], { by: "sage" }), 4, /--op given twice/);
no(cli(repo, ["set", "9", "owner", "x", "--op", "set-9-000001"], { by: "sage" }), 4, /set fields/);
no(cli(repo, ["set", "9", "required", "yes", "--op", "set-9-000001"], { by: "sage" }), 4, /true or false/);
no(cli(repo, ["add", "--op", "add-0000001", "--piece", "x"], { by: "sage" }), 4, /add needs --gate/);
no(cli(repo, ["add", "--op", "add-0000001", "--piece", "x", "--gate-owner", "filbert"], { by: "sage" }), 4, /add needs --gate/);
no(cli(repo, ["list", "--check"]), 4, /does not apply here/);
ok(cli(repo, ["--help"]), /^usage: queue list/);
});