plans: decision 102 (Q99, Mos starts the Console unit); row 83 brief carries the start wording (#1576)

Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-11 22:47:57 -05:00
parent 53b51ebbae
commit 1d117112f0
2 changed files with 36 additions and 2 deletions
@@ -2227,3 +2227,29 @@ which stay with him. Each item names who decided it and what happened.
      the username. The policy binding admits only pk 5, and only admins
      can rename, so the exposure is to an admin, who controls the
      outpost anyway.
+
+102. **Q99 yes: Mos starts and restarts the Console unit (2026-10-12).**
+    Mos asked Jason (sage-0069, recorded in jason-master-restart
+    DECISIONS.md, commit f684a08): "Does your 02:18Z authorization let
+    me start and restart the mosaic-webui unit? It would also cover the
+    other cutover services: tunnel, outpost and Argo sync. One effect:
+    once the Console is up, web sends go into the trail as you
+    (human-cli). The 2026.8.0 upgrade, data deletion and the cutover go
+    stay with you either way." Jason, 03:46Z: "Yes".
+    - This amends decision 94's start line. Mos may start and restart
+      mosaic-webui, and seats route those requests to Mos. Jason still
+      may. No other seat starts, stops or restarts it, and Sage doesn't.
+    - Jason accepts that a Console started by Mos sends into the trail
+      as him (`human-cli`). Decision 62's local-forgery limit is
+      unchanged, and so is decision 95's PoC scope.
+    - The live cutover go stays Jason's. Mos starts the unit for the
+      cutover only after that go.
+    - Row 83 (#1576) carries the wording. `scripts/webui-service.sh`'s
+      header comment and install message, `docs/TOOLS.md` "Console
+      service" and the README service paragraph now say an agent start
+      works around the human proof and that Jason starts it. They
+      should name Jason or Mos under this decision. The script still
+      gets no start verb.
+    - The tradeoff: the human proof now rests on Jason's grant to one
+      named seat, not on his own shell. In exchange, a cutover restart
+      no longer waits for Jason to be at a terminal.
@@ -49,6 +49,14 @@ and the next `install` overwrites.
 - The README paragraph and TOOLS.md say the script takes `--send` only
  with the preview set, and that the Console then needs the system
  config at start (`--send needs the bus configured`).
+- The start wording (added 2026-10-12, lead decision 102). The script's
+  header comment and its install message, the TOOLS.md "Console service"
+  section and the README service paragraph say that an agent starting the
+  Console works around the human proof, and that Jason starts it. Each
+  should now say Jason or Mos starts and restarts it under decision 102,
+  which accepts that sends then enter the trail as Jason. Any other agent
+  starting it still works around the human proof. The script still has no
+  start, stop or restart verb.
 - Tests: `render --send` with the preview set; `--send` alone; `--send`
  with one or two preview flags; `install --send` into a test `--dir`
  with `--no-reload`; a no-`--send` render compared byte for byte with
@@ -57,8 +65,8 @@ and the next `install` overwrites.

 ### Out of scope

- Starting, restarting or enabling the unit. Jason does that (decision
-  94). No test starts a real user unit.
+- Starting, restarting or enabling the unit. Jason or Mos does that
+  (decisions 94 and 102). No test starts a real user unit.
 - The script checking the system config or the bus. The Console's own
  start check covers it.
 - The allowed-user switch from username to uid (decision 101). That is