decisions, vikunja-setup, S7: 114 (#162 round 1, Q113-Q119), 115 (order around I1, S7 restart); P19 #219-#222; S7 run log

Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-12 13:31:07 -05:00
parent 4f8ac1e7eb
commit 681de77811
4 changed files with 249 additions and 0 deletions
@@ -2547,3 +2547,76 @@ which stay with him. Each item names who decided it and what happened.
      verb-level writer `packages/tasks` enforces (pm by definition, the
      assigned role, or any role), and whether a decision is needed,
      which the test reads from `roles/*.json` instead of copying.
+114. **#162 baseline round 1: Q113-Q118, confirmed by Q119
+    (2026-10-12).** Jason, relayed by Mos (sage-0092), verbatim: "Q113:
+    C" "Q114: A" "Q115: A" "Q116: A" "Q117: A" "Q118: A", then "Q119:
+    yes", confirming Mos's readings. The full text is in
+    jason-master-restart DECISIONS.md, entries 18:23Z and 18:27Z. This
+    lifts sage-0091's hold on the six #162 items.
+    - Q113, where instructions live: stack roles take instructions only
+      from role files in this repository, changed only by reviewed
+      commits. The M1 file (row 84) is the first. `~/.mosaic` prose stays
+      frozen, and a seat's prose retires when that seat moves into a
+      stack role. After I4 the Console changes a role file only by
+      opening a PR, never by writing the file.
+    - Q114, settings: build `mosaic settings set` now for repo
+      locations, task locations, repo settings and project settings.
+      Every write goes through the gate and into the trail. Browser
+      editing waits for I4. A design that lets an agent loosen a
+      setting Jason set goes back to Jason through Mos before it ships.
+    - Q115, the branch floor: a system floor that the gate enforces in
+      code. Agents never push to a protected branch. A protected branch
+      changes only by a PR with green CI and review, which is how R28
+      merges continue. A repo can tighten the floor, never loosen it.
+      A repo that names no protected branch has its default branch
+      protected. Today `git.push.protected` and `git.merge.protected`
+      are always gated, so they reach Jason as decisions
+      (`packages/business/src/vocabulary.mjs:42-43`), and
+      `git.workingBranch` and `git.protectedBranches` exist only at the
+      project layer, read by nothing outside `vars.mjs`. The brief
+      settles how the floor turns those into refusals and checks.
+    - Q116, CLIProxyAPI: it comes into the stack read-only. Its WebUI
+      serves from a path on mosaic.woltje.com behind Authentik, admitting
+      jason.woltje only, and Jason's A approves that exposure. A new DNS
+      name or subdomain goes back to him. The Console shows usage per
+      account. No session traffic goes through it until Jason rules on
+      I1's egress routing design. No agent reads the management key;
+      ops-01 wires it by slot name. Q105's file-secret token is
+      unchanged.
+    - Q117, T3 seats: no T3 bridge. Seats move into stack roles one at a
+      time, Mos first through M1-M3. About 10-17 is a latest-by marker
+      only (decision 111).
+    - Q118, Jason's channel: Jason sends Mosaic Stack requests through
+      the Console or `mosaic talk pm`. Agent seats can't run `mosaic
+      talk` (REQ-DEC-3; Mos measured the refusal at 18:28Z), so when
+      Jason sends one to T3 Mos, Mos gives him the command and logs the
+      slip on Vikunja #205, and doesn't relay it. The day-one gap is row
+      81, replies to a web send (Dewey, in progress).
+115. **Where the #162 work goes around I1, and S7 restarts (2026-10-12).**
+    Mos asked (sage-0092) for P19 tasks in next order around I1. Q97's
+    order stands (S7, M1-M2, D1-D2 alongside I1, I2-I6), and the new
+    work slots in by dependency.
+    - My writing order: the I1 brief (#153) first, since I1 gates I2-I6
+      and the Q116 routing ruling. Then the Q115 brief, then Q114's.
+    - Q115, the branch floor, is built before the I1 images. It is a
+      gate rule that contained agents rely on, and Q114 needs it to know
+      what "loosen" means for branch settings.
+    - Q114, `mosaic settings set`, follows Q115. It touches the CLI and
+      the business layers, not the Console or the images, so it can run
+      beside D1-D2 and I1 with a different owner.
+    - Q116 has two parts. The ops part (deploy CLIProxyAPI, the path on
+      mosaic.woltje.com behind Authentik, the key in a slot) is
+      ops-01's through Mos and can start now. The stack part, a
+      read-only usage view in the Console, follows the ops part and row
+      77, since it is a Console landing (decision 109). Session routing
+      through it waits for Jason's I1 ruling.
+    - S7 (row 42) restarts now on the Q118 channel. Its five pieces are
+      the first five Mosaic Stack requests Jason sends to the PM through
+      the Console or `mosaic talk pm` after the Q119 confirm at 18:27Z.
+      A request sent to T3 doesn't count; Mos logs it on #205. Agent
+      seats can't read the trail or the bus (REQ-DEC-3), so the run log
+      names each piece's trail subject and Vikunja task, and Jason reads
+      the trails and the event counts in the Console or `mosaic trail`
+      at his gate. Nobody builds an agent read path around that.
+    - Filed in P19 by Sage's key: #219 Q115, #220 Q114, #221 Q116 ops
+      (ops-01 through Mos), #222 Q116 stack.