gosalyn: Case 2 design ruling after r11, step 2b drops release package and activate, new step 4a runs the precheck's --library-status after the bus is up and the token is placed, C2-13b row text reads the bus's recorded sync state (row 226 D8, webby-0085 B1, sage-2189, sage-2195)

2026-10-21 17:00:57 -05:00
parent 75fb3e10e3
commit 6242128422
1 changed files with 9 additions and 3 deletions
@@ -1065,7 +1065,7 @@ Chains follow Q177 merge-chaining. S marks a slice row.
 | C2-12 | S | The setup sheet for Melanie (7.1, including N2 and N4, and what changes for Bean and Chet in 4) and the survey run sheet for `<host>` | C2-01 | Luna | doc only, reviewed against the survey's real flags |
 | C2-20 | S | Persona import (9.1): a script that reads only the persona definitions of the two Hermes profiles, confirms profile to name, and writes each persona file (4) with its `persona.name` and `persona.sha256` for the business file. Prints names, byte counts and sha256 only. A `--dry-run` mode, run before Jason's go, prints only counts of files, lines and lines starting `# ` or `## ` | C2-08 | Opus (Gosalyn), run under Jason's go | fixture Hermes profile trees: the right fields are taken, memory and session files are never opened (a read trace on the fixture), a profile with no persona field refuses, a persona that would fail C2-08's fence check refuses, output holds no persona text, each written file is 0600 and its digest matches, `--dry-run` writes nothing and prints the right counts for a fixture with two heading lines and no marker string from it |
 | C2-13a | S | `scripts/case2-unit.sh`, which renders the bus and Console system units from their existing templates and which root runs from a root-owned checkout in 10 step 2c, and `scripts/case2-precheck.sh` with the host checks. No library dependency, so row 195 chains on it (sage-1480) | none | Opus (Gosalyn) | the C2-13a brief's render and precheck cases: token rules, `@PATH@` from `--node`, the four hardening lines, the Console's capability lines and privileged port, one `WantedBy=multi-user.target` on each unit (Q189), copy-id pairing, the serve flag set, the key file and the unprivileged port start. Scratch unit directory and scratch data root |
-| C2-13b | S | Install script for `<host>` as `<user>`: bootstrap, release activate, business file with the mapping, `bean` and `chet` with their persona vars and files, any specialists she picks, her human id, token slot path. The install writes no unit. Adds the library checks to the precheck. Jason or his delegate runs it (10) | C2-13a, C2-04, C2-03a, C2-20 | Opus (Gosalyn), Jason's go | precheck library checks: the business file, `.history`, `changes.jsonl` and persona files have the modes in 4 and each persona digest matches, `library.sync` fetches her repo read-only, `library.status` lists R-problems, no Discord binding exists. Tested against a scratch data root and a local bare repo |
+| C2-13b | S | Install script for `<host>` as `<user>`: bootstrap, the stack copy, business file with the mapping, `bean` and `chet` with their persona vars and files, any specialists she picks, her human id, token slot path. The install writes no unit. Adds the library checks to the precheck. Jason or his delegate runs it (10) | C2-13a, C2-04, C2-03a, C2-20 | Opus (Gosalyn), Jason's go | precheck library checks: the business file, `.history`, `changes.jsonl` and persona files have the modes in 4 and each persona digest matches, no Discord binding exists, and after step 4 `--library-status` reads the bus's recorded sync state and lists R-problems (10 step 4a). Tested against a scratch data root and a local bare repo |
 | C2-14 | S | End-to-end acceptance on a scratch data root and a bare repo in her layout: sync, ask a creative agent in its thread, a reply whose cites verify, a playground cite as canon refused, a force-push held as diverged, the Console shows the reply as items | slice rows | Opus | one script, which the reviewer also runs |
 | C2-02 | | Bus writes: `writeLibraryFile`, `commitFile` refactor, r1's S0 rule on the working tree | C2-04 | Sol (Rocko) | writer tests, `packages/project/tests` unchanged and green |
 | C2-03b | | Push path, race retry, `unpushed`, `library-remote-invalid` on writes | C2-02, C2-03a | Opus | push tests against a bare repo |
@@ -1279,8 +1279,9 @@ What it adds is one bot account with read access to that one repo.
   - 2a, ops-01 via `localadmin`: `useradd` `mosaic` as a system user with no sudo, no supplementary
     groups and no keys. Create `/srv/mosaic` at 0700, owned by `mosaic`.
   - 2b: the install as `<user>`, by him or his delegate, run as `sudo -u mosaic -H` from `localadmin`.
-     `mosaic` has no keys and no login shell, and nobody adds a key to make 2b work. `scripts/bootstrap.sh`, release package and
-     activate, and the pinned harness. The model path is set (9, Q186). Chet's ChatGPT/Codex login is
+     `mosaic` has no keys and no login shell, and nobody adds a key to make 2b work. `scripts/case2-install.sh` runs `scripts/bootstrap.sh` and makes the stack copy, whose
+     `npm ci` installs the pinned harness. It runs no `release.sh package` or `activate`: both need
+     Docker, and the hub runs no containers (webby-0085 B1, sage-2189). The model path is set (9, Q186). Chet's ChatGPT/Codex login is
     not part of 10-27. It is row B (#428).
   - 2c, ops-01 via `localadmin`: root makes a checkout of the reviewed commit outside `/srv/mosaic`,
     owned by root, and checks that its HEAD is the commit Jason's go names. From that checkout it runs
@@ -1314,6 +1315,11 @@ What it adds is one bot account with read access to that one repo.
 4. The bot's token in slot `library-gitea` under `<configDir>/secrets/<business>/`, which is
   `/srv/mosaic/.config/mosaic-dev/secrets/<business>/` for `mosaic`, mode 0600. He puts it there, or
   says who may, per the Q173 secrets rule. Agents never print it.
+4a. `scripts/case2-precheck.sh --business <business> --library-status` as `<user>`, once the bus is up
+   and step 4's token is in place. It reads the bus's recorded sync state only and syncs nothing. It
+   refuses when the mirror is missing, when `lastError` is set, or when `lastFetch` is null. It prints
+   each R-problem as a `problem` line and then a count, never text (sage-2189). The bus syncs every 60
+   seconds, so the first check after step 4 may have to wait for one sync.
 5. Her Console sign-in from her machine: her Authentik user and `sub` once SSO lands (#412 step 3 is the
   model), or his ruling on an interim. The proxy forwards to the Console's port below 1024 and sets the
   proof header. The proof file goes under `<configDir>/secrets/`, mode 0600, owned by `mosaic`, and