gizmoduck: T3 federation design r2.1 for #414 (mos-0988): R8's uid gate on row 190b, R7 on row 190, P19 333 on the 10-27 path
This commit is contained in:
@@ -25,6 +25,8 @@ PLAN.md T3 (all in jason-master-restart).
|
||||
- N1 to N9 are handled where they apply: v1 count (2), `configDir` at business.mjs:25-28 (5), R1 takes
|
||||
providers and peers as arguments (7), "human-only" (3.5), file checks (3.5), `instances` as the real limit
|
||||
(3.5), provider removal needs a Console restart (3.7), Q1 is with Jason (9), client ids in R8 (7).
|
||||
- r2.1 (mos-0988): the separate uid is row 190b. R8's gate points at 190b, R7 at row 190 (one uid,
|
||||
scratch). P19 333 is on the 10-27 path (section 8).
|
||||
- Mos's rulings in mos-0978 and mos-0984 replace the r1 questions (section 9). The push credential note is
|
||||
in section 10.
|
||||
|
||||
@@ -325,13 +327,15 @@ do that first.
|
||||
|
||||
## 5. Dependencies on T1
|
||||
|
||||
- T1.1, several instances per host, with a separate uid per instance (row 190, Darkwing). Rows R1 to R7
|
||||
build and test without it: they use separate `MOSAIC_CONFIG` files and data roots, which the code already
|
||||
honours (business.mjs:25-28). R8 refuses to start without it (mos-0984 point 2). With per-uid instances,
|
||||
- T1.1, several instances per host (mos-0988). Row 190 (Darkwing) lands several instances on one uid,
|
||||
for scratch tests. R7 runs on that. Row 190b (Darkwing, Opus, design first, chained on 190) puts the hub
|
||||
under its own Linux user, with no factory process able to touch it (mos-0986). Rows R1 to R7 don't need
|
||||
190b: they use separate `MOSAIC_CONFIG` files and data roots, which the code already honours
|
||||
(business.mjs:25-28). R8 refuses to start without 190b (mos-0984 point 2). With per-uid instances,
|
||||
a factory-uid process can't read or write the hub's access.json or data root, and it can't pass the
|
||||
hub's human or user proof, because `verifyHuman` requires the caller's uid to equal the bus's
|
||||
(human.mjs:67). Inside one instance the proofs stay same-uid cooperative (3.6, P19 333).
|
||||
If row 190 can't deliver separate uids, Mos takes a new decision to Jason then. The design doesn't plan a
|
||||
If row 190b can't deliver separate uids, Mos takes a new decision to Jason then. The design doesn't plan a
|
||||
single-uid live run.
|
||||
- T1.1 live also needs two Consoles, two public origins, two Traefik routes and two provider clients,
|
||||
which are Jason-gated infra.
|
||||
@@ -373,18 +377,19 @@ gate. Chains follow Q177: a dependent row builds on its parent's candidate.
|
||||
| R3 | Broker user principal: `verifyUser` and `user-cli.mjs`, `bindUser`, the 3.6 changes, the collaborator verb list and its filters, per-request grant read, audit lines for every `s.human`/`s.tester` branch | Opus 5.5 | R1 | bus tests: each listed verb allowed, every other verb refused, a leak test per listed read (other projects, other instances, other users' threads), a reply-chain `message.send` into another user's thread refused, `thread.send` writes no `human.input`, revoked and expired grant refused on next request, refusals recorded. Mutants: the user CLI accepted under an agent-marked parent, accepted with a parent that isn't the Console, the grant read skipped, a read filter dropped, `#threadFor`'s user refusal removed, a user named like the human accepted |
|
||||
| R4 | Revocation: 30 s timer, `access.reload` verb, claim end on loss, `threadsState` `revoked`, launcher skip and SIGTERM, launch check refusal, R5 calls `access.reload` | Codex Sol | R3, R5 | bus and launcher tests, each with a mutant: a hand edit removing the grant ends the run within one timer period, an expiry with no request ends it, a pending message followed by a launcher restart starts no run, a running revoked thread gets SIGTERM, another user's runs stay |
|
||||
| R6 | Console: granted-user sign-in, `user-cli` transport per session, per-request grant re-read, owner-only controls hidden, peer links | Opus 5.5 | Sage #412 phase 1, R1, R2, R3 | webui tests on Sage's fake OP: granted user signs in, ungranted `sub` refused, revoked mid-session gets 401 on next call, a granted user's owner-verb call refused by the bus even with the UI check removed (mutant) |
|
||||
| R7 | Scratch two-instance acceptance: two configs, two data roots, two Consoles, one fake OP. The Consoles start outside agent ancestry (a transient user unit), as the user proof requires. They never use the live stack's units or ports | Haiku 5.5 high | R1-R6 | script test: Jason granted collaborator on one hub project signs in to the hub, makes a thread, sends to the granted instance, is refused on another project and on board reads, is revoked and gets refused with the run ended. The factory shows nothing of the hub |
|
||||
| R8 | Live window, not a code row: hub provider client, Traefik route, access.json written by Jason, re-pins | Jason, Mos | T1.1 live with separate uids, #412 phase 2, R7 | Entry gate, R8 refuses to start unless all hold: the factory and hub buses run under different uids, a factory-uid human-cli and user-cli call to the hub socket is refused (human.mjs:67), the factory uid can't read the hub data root or config dir (both 0700), and the two provider client ids differ. Then Jason signs in to the hub from his account and sends one message, Melanie revokes, and his next request is refused |
|
||||
| R7 | Scratch two-instance acceptance: two configs, two data roots, two Consoles, one fake OP. The Consoles start outside agent ancestry (a transient user unit), as the user proof requires. They never use the live stack's units or ports | Haiku 5.5 high | R1-R6, row 190 (several instances on one uid) | script test: Jason granted collaborator on one hub project signs in to the hub, makes a thread, sends to the granted instance, is refused on another project and on board reads, is revoked and gets refused with the run ended. The factory shows nothing of the hub |
|
||||
| R8 | Live window, not a code row: hub provider client, Traefik route, access.json written by Jason, re-pins | Jason, Mos | row 190b live (hub under its own Linux user), #412 phase 2, R7 | Entry gate, R8 refuses to start unless all hold: the factory and hub buses run under different uids, a factory-uid human-cli and user-cli call to the hub socket is refused (human.mjs:67), the factory uid can't read the hub data root or config dir (both 0700), and the two provider client ids differ. Then Jason signs in to the hub from his account and sends one message, Melanie revokes, and his next request is refused |
|
||||
|
||||
R1, R2 and R5 can start now and run in parallel. R3 starts when R1 has a candidate, R4 when R3 and R5 do.
|
||||
R6 waits on Sage's phase 1 candidate.
|
||||
|
||||
## 8. Risk to 10-27
|
||||
|
||||
The slice lands only if #412 phase 1 has a reviewed candidate by about 10-23 and T1.1 with separate uids is
|
||||
live by about 10-25. R6 and R7 chain on the first. R8 needs both, plus two Jason-gated windows (#412 phase
|
||||
2 and the federation re-pin), plus infra work only Jason does: a second public origin, a Traefik route and
|
||||
a provider client. If row 190 can't deliver separate uids, R8 doesn't run and Mos takes it to Jason.
|
||||
The slice lands only if three things hold. #412 phase 1 has a reviewed candidate by about 10-23. P19 333,
|
||||
the path-bound human proof R3 depends on, is settled in time for R3 (Mos told Sage, mos-0988). Row 190b
|
||||
is live by about 10-25. R6 and R7 chain on #412 phase 1. R8 needs all three, plus two Jason-gated windows
|
||||
(#412 phase 2 and the federation re-pin), plus infra work only Jason does: a second public origin, a
|
||||
Traefik route and a provider client. If row 190b can't deliver separate uids, R8 doesn't run and Mos takes it to Jason.
|
||||
|
||||
## 9. Rulings (mos-0978, mos-0984)
|
||||
|
||||
@@ -394,7 +399,7 @@ a provider client. If row 190 can't deliver separate uids, R8 doesn't run and Mo
|
||||
2. Q2, open: one user and grant model for local and federated humans is Mos's reading. Row 193 (Morgana,
|
||||
T1.3) settles the store with Sage.
|
||||
3. Q3 and B5: a separate uid per instance is a hard precondition of R8 (mos-0984 point 2). Mos won't ask
|
||||
Jason to accept a single uid, and takes a new decision to him if row 190 can't deliver.
|
||||
Jason to accept a single uid, and takes a new decision to him if row 190b can't deliver.
|
||||
|
||||
## 10. Notes
|
||||
|
||||
|
||||
@@ -1359,3 +1359,4 @@ are never rewritten or removed; corrections are new entries.
|
||||
2026-10-20T15:42:00Z | Sage (Opus 5.5, 1ef1e4f8) | row 163 (#1660) r2 verdict intake | approved by Filbert (comment 29447, rev 2234 committed cd2b377bb); P19 337 comment 367 -> 368; candidate 2c090eefd manifest c6f4f4c12596 waits to land after B7, fresh gate if the base moves
|
||||
2026-10-20T18:44:50Z | Gizmoduck (Opus 5.5) | T3 federation design r1 for Vikunja #414 (G3, G4, C1.1), agents/gizmoduck/work/federation/DESIGN.md, on branch gizmoduck/federation-design off origin/refactor 9ae8c73ac | design committed and pushed; rows R1-R8 wait for Filbert or Dewey review before Sage's queue; Q1-Q3 to Mos
|
||||
2026-10-20T18:56:54Z | Gizmoduck (Opus 5.5) | T3 federation design r2 for Vikunja #414, answering Duckworth's B1-B5 and N1-N9 (duckworth-0001) and Mos's mos-0978 and mos-0984 rulings, agents/gizmoduck/work/federation/DESIGN.md | r2 committed and pushed on gizmoduck/federation-design; sent to Duckworth and Mos for re-review; R1, R2, R5 wait for Duckworth's approval before Sage's queue
|
||||
2026-10-20T18:58:23Z | Gizmoduck (Opus 5.5) | T3 federation design r2.1 for Vikunja #414, mos-0988: R8 uid gate on row 190b, R7 on row 190, P19 333 in the risk | committed and pushed on gizmoduck/federation-design; Duckworth's r2 verdict pending
|
||||
|
||||
Reference in New Issue
Block a user