mosaicstack/stack
25
0
Fork 1
Code Issues 416 Pull Requests 13 Actions Packages Projects Releases 15 Wiki Activity

morgana: FED R3 r6 (sage-2576): the collaborator-list test pins USER_VERBS as the ruled seven so M3x and M6x fail it, and its off-list set adds the grants, lifecycle, web and host verb lists; test only, unrun

Browse Source
This commit is contained in:
jason.woltje
2026-10-22 05:06:52 -05:00
parent f58cfc3617
commit 4c485c63b9
2 changed files with 19 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
agents/morgana/work/fed-r3/BUILD.md
+13
View File
@@ -198,6 +198,19 @@ util, isn't one of them. R3 had never been run, so nobody had seen this.
The kit runs project-runtime, access, access-levels and seat sandbox whole, plus the seat suite, and adds the cli suite and every `scripts/test-*.sh`
(mos-1200).
## r6 (sage-2576): the list test pins the collaborator list
The r5 gate on f58cfc361 stopped red at 10:05:09Z: M3x and M6x survived (morgana-0108). The test "every
verb off the collaborator list ..." deleted the broker's own USER_VERBS from its off-list set, so a verb a
mutant added to the list left the checked set as well. The broker's allowlist at the user gate is right.
- The test now deepEquals USER_VERBS against the ruled seven verbs, written out, before the delete loop.
M3x and M6x fail on that line.
- The off-list set adds GRANTS_VERBS, LIFECYCLE_HUMAN_VERBS, WEB_VERBS and HOST_VERBS (sage-2576 item 2).
The user gate refuses each of them `access-refused` before any other check. If one doesn't, that is a
finding for Sage, not a test fix.
- Test only. Only user-principal.test.mjs's blob changes in the manifest. The gate reruns whole on the r6 tip.
## Gate
The kit is /mnt/storage/scratch/morgana-r3 (`slot-r3.sh`, `mutate.py`, `busy.sh`), run as
packages/bus/tests/user-principal.test.mjs
+6 -1
View File
@@ -11,7 +11,7 @@ import { fileURLToPath } from 'node:url';
import { Store } from '../src/store.mjs';
import {
Broker, ACTIONS, USER_VERBS, TESTER_VERBS, TASK_VERBS, WEB_VERBS, HOST_VERBS, HOSTS_VERBS, CREDENTIAL_VERBS,
PROJECT_FILE_VERBS, LIBRARY_VERBS, TESTER_ORGANIZATION_VERBS,
PROJECT_FILE_VERBS, LIBRARY_VERBS, TESTER_ORGANIZATION_VERBS, GRANTS_VERBS, LIFECYCLE_HUMAN_VERBS,
} from '../src/broker.mjs';
const shipped = (name) =>
@@ -131,10 +131,15 @@ test('R3: every verb off the collaborator list refuses a user access-refused bef
const { b, caps } = granted(t);
const others = new Set([
...ACTIONS, ...TESTER_VERBS, ...TESTER_ORGANIZATION_VERBS, ...PROJECT_FILE_VERBS, ...LIBRARY_VERBS, ...CREDENTIAL_VERBS, ...HOSTS_VERBS,
// R3 r6 (sage-2576): the grants, lifecycle, web and host lists, each refused at the user gate too.
...GRANTS_VERBS, ...LIFECYCLE_HUMAN_VERBS, ...WEB_VERBS, ...HOST_VERBS,
'decision.raise', 'decision.resolve', 'decision.seen', 'role.claim', 'role.release', 'role.end', 'record.write', 'spec.read',
'usage.begin', 'usage.end', 'limits.set', 'organization.set', 'organization.revision', 'review.request', 'review.verdict',
'staff.request', 'state', 'input', 'launch', 'no.such.verb',
]);
// R3 r6 (sage-2576): the collaborator list as ruled, written out, so a widened USER_VERBS fails here
// rather than leaving the set below with the verb it added (M3x, M6x).
assert.deepEqual(USER_VERBS, ['project.list', 'thread.create', 'thread.list', 'thread.open', 'thread.send', 'thread.messages', 'names']);
for (const v of USER_VERBS) others.delete(v);
assert.ok(others.size > 40);
for (const verb of others) {