From 3e6de980794524edf57cf8cf296ef403f7fcf59c Mon Sep 17 00:00:00 2001 From: Jason Woltje Date: Fri, 23 Oct 2026 09:56:01 -0500 Subject: [PATCH] row 252 BUILD.md: rebase onto fe4ee8c7b, commit map and the six conflict resolutions (sage-3482) --- agents/scrooge/work/queue-252/BUILD.md | 29 ++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/agents/scrooge/work/queue-252/BUILD.md b/agents/scrooge/work/queue-252/BUILD.md index 2ec926fb7..5087743af 100644 --- a/agents/scrooge/work/queue-252/BUILD.md +++ b/agents/scrooge/work/queue-252/BUILD.md @@ -137,3 +137,32 @@ Not run. At the first CLEAR: 1. Run each touched test file whole, with TMPDIR under /mnt/storage/scratch/tmp. 2. Run the bus, webui and cli suites. 3. Run the mutants above, then the drift check against refactor. + +## Rebase onto fe4ee8c7b (sage-3482, 2026-10-23) + +The old base aca16404c had drifted. Since then refactor changed 8 of the row's 24 paths, across 15 commits. I made a new branch, scrooge/row252-fe4ee8c7b, so scrooge/row252 22cc74645 is untouched and nothing was force-pushed. I rebased with local git, `-c core.hooksPath=/dev/null`, and no stash. + +Commit map: +- 4bd273bce -> 1891d36e4 (product and tests; six files conflicted) +- ca4537cc9 -> 9e5980acd (BUILD.md; clean) +- 22cc74645 -> 6fd206e80 (shell.test comment and BUILD.md; clean) + +Conflicts, all in 4bd273bce, and how each was resolved: +1. packages/bus/src/broker.mjs, verb lists. On the base, row 206 added the share verbs to USER_VERBS, and row 275 added VIEWER_VERBS, userLevel and BOARD_VERBS and removed the USER_LEVEL const. I kept the base's lists and dropped USER_LEVEL, because nothing on the base reads it. CONSOLE_VERBS goes in after USER_VERBS with its comment unchanged. The request() gate (`!!s.console !== CONSOLE_VERBS.includes(verb)`) auto-merged after the FED R4 access sweep and the user check. Its order relative to the user gate is the same as on the old base. +2. packages/bus/src/runtime.mjs, startBroker. FED R4 (#1801) added `access.intervalMs` to the access check. I kept the consoleOwners validation and the frozen owners first, as in the row, and then the base's access check with intervalMs. +3. packages/cli/src/config.mjs. FED R6 (#1800) added accessFor and `config.access`. I kept both: accessFor and then consoleOwners, and in bootConfig `config.access` and then `config.consoleOwners`. process.mjs passes the boot config to startBroker whole, so both keys reach it. +4. packages/webui/src/cli.mjs. FED R6 moved the owner's bus options into consoleBus() (console-bus.mjs) and added userCaller and userOptions. I kept the base's form, added consoleCall to the bus.mjs import, and added decisionWrite to the declarations. I kept the row's `if (ssoOn && sendOn) decisionWrite = consoleCall(...)` after the consoleBus() call, and pass decisionWrite to startServer next to userOptions and federation. +5. packages/webui/src/serve.mjs. FED R6 added granted-user sessions: userRoute gates them, and userOptions rebinds the options per request. + - The signature now has both decisionWrite and userOptions/federation. + - The session hunk keeps the base's signer and granted-user block. ssoSession is set only for a session with no `user`, which is the owner's. A granted user is refused at userRoute before the decision route anyway, because /api/decisions/* is not on userRoute's list. Under the new base this keeps the design section 2 rule that only the owner answers a decision. + - /api/config keeps the base's `user` and `federation` keys. `decide` gains `!granted`, matching how the base gates `edit`, so a granted user's config never offers Approve and Deny. + - The decisionWrite startup check and createConfirmations() auto-merged unchanged. +6. packages/bus/tests/channel-proof.test.mjs, webui bus.mjs pin. Row 301 (#1808, mos-1449) moved the user transport into bus.mjs and re-pinned it to 39fcb27c. The row's consoleCall auto-merged on top. I kept row 301's comment and re-pinned to the merged blob's sha256, 604092cb706b152d458f299ff1071f6cd488774629012f96b672f7e9a16c0b2c. The human.mjs pin (bb13c146) auto-merged and matches the blob at the new tip. The row's existing header comment (Webby N5) still describes why bus.mjs is re-pinned. humanCall and transport() are unchanged. + +Auto-merged without conflict: webui bus.mjs (consoleCall next to row 301's userCaller), webui README.md, bus client.mjs, human.mjs, principal.mjs, server.mjs and public/bus.js. + +Two new-base reads I checked: +- granted-user.test.mjs reads `/api/config` key by key and has no deepEqual on the whole object, so the extra `decide` key doesn't break it. +- No other test pins one of the row's source files by sha256, apart from channel-proof. + +Not run: no test, node or syntax check during this step. Sage's next CLEAR covers the push, the whole webui, bus and cli suites, every scripts/test-*.sh, and J1-J17. Plugins must show 0 failures (mos-1456/1462). J7 still needs a killer test. The serve.mjs `!granted` and ssoSession lines are new since the build, so they get mutants too. I'll add them to the J list at the run.