docs: separate session workspace root from retained legacy work
This commit is contained in:
@@ -5217,3 +5217,5 @@ Before: managed project/thread verbs had no Console conversation area. After: fi
|
||||
2026-10-21T22:24:12Z | Huey | T1 item 7 sessions design r1, mos-1232, Vikunja 463 | Before: origin/refactor cca206cdc keys assistant claims/stores/messages by thread and renders Pi compaction markers; row 194 r4 excludes thread context clear. After: docs/plans/2026-10-21_t1-sessions.md proposes independent per-agent sessions within threads on Pi/Claude, scoped claims/stores/messages/workspaces, completed compaction counts, owner-write/RBAC matrix, idempotent proven-stop/fresh-successor clear, common admission/kill checks, migration and seven acceptance groups, replacement REQ-ROLE-2/REQ-THREAD-2 text and three owner questions. PRD 1.12 USER-3/4 candidate 1509c7cc5 cited separately from base. Verification: 22 pinned references resolve, eight-line summary and three exact owner quotes; manual source/consistency review, whitespace and installed queue guard checked. No code, queue/PRD edits, builds, suites, credential reads, live changes or paid calls. MVP priority ahead of Q198 S1. Review via Scrooge, then Sage/Ludwig as Mos authorized.
|
||||
|
||||
2026-10-21T22:28:56Z | Huey | T1 sessions design r2, scrooge-0006, mos-1235/1236, Vikunja 463 | Before: r1 347278044 lacked the exact per-session checkout/single-writer invariant and safe runner drain ordering, and admitted other role instances. After: F1 exact workspace path, fenced checkout setup, legacy shared-workspace quiescence, clear retains old dirty/untracked/unpushed checkout and creates fresh approved checkout, T2 mutant; F2 dequeue fence and generation-bound turn-boundary idle proof before runner signal, busy drain stays clearing, T4 cases; F3 THREAD_DEFINITION only per Mos scope ruling, no role eligibility change; N1 private titles/history vs owner-visible count/activity projection; N2 Claude offline adapter/managed-store-reader dependency flagged as MVP risk. Section 8 records Mos’s Q1–Q3 readings, no questions to Jason. Verification: 27 pinned references resolve, summary within 15 lines, source/delta consistency review, whitespace and installed queue guard checked. No code, queue/PRD edits, builds/suites/live changes/provider calls/credential reads.
|
||||
|
||||
2026-10-21T22:30:20Z | Huey | T1 sessions design r3, scrooge-0007 R1, Vikunja 463 | Before: r2 e19e30df2 nested new session checkouts under the retained legacy instance workspace, allowing project-name collision or historical parent inspection to reach live siblings. After: exact path is dataRoot/session-workspaces/business/instance/session, outside the legacy root; canonicalized ancestor/descendant overlap refuses; T2 nesting mutant covers historical mount/inspection and a legacy project named sessions. All other r2 content retained as approved, revision label updated. Verification: old nested path absent, manual R1-only delta, whitespace and installed queue guard checked; no code/builds/suites/live changes/provider calls/credential reads.
|
||||
|
||||
@@ -1446,3 +1446,4 @@ are never rewritten or removed; corrections are new entries.
|
||||
2026-10-21T21:45:20Z | Della (GPT-6.1-Sol, mos-1223 / ludwig-0004) | merged email plan focused review fixes | External content-key/expiry location and restore tests specified; fake registry work READY, production registry gated on PRD approval/Q4. Merged plan 399 lines, original plans/reviews unchanged. Commit/push and focused Ludwig review before Sage handoff.
|
||||
2026-10-21T22:24:12Z | Huey (gpt-6.1-sol) | mos-1232, MVP T1 item 7 sessions design, Vikunja 463, huey/t1-sessions-design from cca206cdc | design with pinned code/row194/PRD candidate evidence and acceptance proposals; doc checks only, no builds/suites/live changes/provider calls; review then Sage/Ludwig handoff
|
||||
2026-10-21T22:28:56Z | Huey (gpt-6.1-sol) | T1 item 7 r2, Vikunja 463, scrooge-0006 F1–F3/N1/N2, mos-1235/1236 | workspace/drain fixes and THREAD_DEFINITION scope recorded; Mos rulings in section 8; doc-only verification, re-review via Scrooge/Mos
|
||||
2026-10-21T22:30:20Z | Huey (gpt-6.1-sol) | T1 item 7 r3, scrooge-0007 R1, Vikunja 463 | isolated session-workspaces root and nesting mutant recorded; R1-only confirmation requested, other r2 findings closed; doc-only checks
|
||||
|
||||
@@ -10,7 +10,7 @@ This is MVP work under Q176 and Mos’s Q211 reading, ahead of Q198 S1.
|
||||
No runtime changes, provider calls or activation are authorized by this document.
|
||||
|
||||
Brief: **mos-1232**, Vikunja **463**. Owner Huey, reviewer Scrooge, gate/landing Sage.
|
||||
Design r2, scrooge-0006 and mos-1235/mos-1236. Section 8 records Mos’s rulings.
|
||||
Design r3, scrooge-0007 R1; all other r2 content approved. Section 8 records Mos’s rulings.
|
||||
Other proposed choices below are **Huey’s readings**, pending review.
|
||||
|
||||
## 1. Authority and pinned evidence
|
||||
@@ -99,7 +99,7 @@ attached to the old session and never appear as a successor’s answer.
|
||||
|
||||
Generated safe native storage: `<dataRoot>/threads/<business>/<thread>/sessions/<session>/`,
|
||||
with separate `session/` and `claude-projects/` directories. The exact workspace is
|
||||
`<dataRoot>/workspaces/<business>/<instance>/sessions/<session>/`, with the broker-bound
|
||||
`<dataRoot>/session-workspaces/<business>/<instance>/<session>/`, with the broker-bound
|
||||
session ID globally unique in that business and checked against its thread/instance.
|
||||
Scratch/HOME remains per run inside its selected session’s execution environment.
|
||||
|
||||
@@ -112,7 +112,9 @@ bind two session IDs to one mutable repository. A private per-session lock plus
|
||||
broker’s unique holder/generation fence covers concurrent host-launcher processes.
|
||||
Do not treat the old per-thread `instance-running` check as proof of single writer.
|
||||
Keep non-thread work on its existing exclusive instance path. T2 covers cross-thread
|
||||
and same-thread sessions and malicious workspace substitution.
|
||||
and same-thread sessions and malicious workspace substitution. The session-workspaces root
|
||||
is outside retained legacy workspaces. Refuse ancestor/descendant overlap with legacy
|
||||
workspaces, historical workspaces or another live session workspace after canonicalization.
|
||||
Derive paths server-side from validated IDs, verify ownership/private mode and refuse
|
||||
symlinks/escapes. Mount only that session’s stores. Project files remain accessible only
|
||||
through existing project grants and isolated checkouts, not by mounting sibling stores.
|
||||
@@ -305,7 +307,7 @@ an old binary resume a session from the wrong store. This design makes no live c
|
||||
| Ref | Required acceptance evidence (future fixtures on Sage’s grant) |
|
||||
| --- | --- |
|
||||
| T1 | Pi and Claude each run two sessions for the same agent in one thread with distinct sentinel histories/native IDs. Stop/restart one resumes only itself. Non-THREAD_DEFINITION roles refuse thread-session creation/launch. Cross-thread and cross-organization sentinels never appear. |
|
||||
| T2 | Two concurrent dispatchers claim the same session: one holder. Different sessions can run subject to aggregate limits. Approval/delivery/cursor replay from a sibling or retired generation refuses. Workspace/native-store symlink or path escape refuses. Mutant: map two session IDs to the same writable checkout (within one thread and across threads), and prove the single-writer fence prevents setup while another run can write. |
|
||||
| T2 | Two concurrent dispatchers claim the same session: one holder. Different sessions can run subject to aggregate limits. Approval/delivery/cursor replay from a sibling or retired generation refuses. Workspace/native-store symlink or path escape refuses. Mutant: map two session IDs to the same writable checkout (within one thread and across threads), and prove the single-writer fence prevents setup while another run can write. Nesting mutant: place a live session below a retained legacy workspace or a legacy project named sessions, then attempt its historical inspection/mount; reject the overlapping layout. |
|
||||
| T3 | Both harness compaction fixtures: zero, one, three, duplicate history/live hints, failed start, partial write, branches, resume and clear. Full lifetime count is stable across pagination/restart, old count remains, successor zero, unsupported legacy count unknown. Pin Claude’s source contract before claiming this test proves native compatibility. |
|
||||
| T4 | Clear busy and idle sessions, two concurrent clears, delayed stop, ambiguous remote write, late output and every journal crash boundary. No replacement starts before proof; one successor; sibling session untouched; old input never replayed. A busy child ignores drain: no runner signal or forced kill, operation remains clearing. Idle acknowledgement racing new dequeue is fenced. Clear preserves dirty/untracked/unpushed old workspace bytes and starts from an independent approved checkout. Held startup remains visible and first new turn contains no old sentinel. |
|
||||
| T5 | Owner/collaborator/viewer/shared-owner/private-owner matrix, expired/revoked grants before read and after clear acceptance, forged identity and cross-instance IDs. Private messages/history/titles never leak without a share. A4’s separately authorized activity projection exposes count/opaque IDs only, without summaries or transcript access. Clear/open/send require current owner write grant at effect. |
|
||||
|
||||
Reference in New Issue
Block a user