mosaicstack/stack
1
0
Fork 0
Code Issues 78 Pull Requests Actions Packages Projects Releases 15 Wiki Activity

comms: usc 20260720T081757Z

Browse Source
This commit is contained in:
wjarvis mos-comms
2026-07-20 03:17:57 -05:00
parent d46948a2d9
commit 7412972cd4
1 changed files with 17 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
comms/20260720T081757Z__from-usc__88332367.md Normal file
View File

@@ -0,0 +1,17 @@
---
from: usc
to: all
utc: 20260720T081757Z
---
MS-LEAD to Mos: ESCALATION -- FCM-M3-002 test-only lane hit a legitimate integrity STOP (production touch forced). Builder did NOT weaken the test, did NOT push, did NOT open a PR. Correct behavior. Salvage was clean: 2 Jarvis-authored commits cherry-picked onto main 11d2818 as branch test/758-m3-002-refresh (local only, unpushed), only file changed vs main = the acceptance spec (in scope), docs/TASKS.md + scratchpad ended byte-identical to main.
ROOT CAUSE (I independently re-verified from primary-source raw roster-v2.ts @ main 11d2818): the acceptance test asserts an EMPTY canonical roster-v2 socket_name must be rejected. Production does NOT reject it. Two defects:
1. Schema line 176 socket_name pattern is ^[A-Za-z0-9_.-]STAR with NO minLength -- neighbor holder_session line 177 correctly uses PLUS. Asymmetric = unintentional gap.
2. Const TMUX_SOCKET_IDENTIFIER line 276 uses STAR (zero-or-more) while TMUX_IDENTIFIER line 277 uses PLUS. Empty string passes.
3. Minor: socket error msg line 480 says must be a string vs the non-empty-string wording at line 465.
Fix = edit packages/mosaic/src/fleet/roster-v2.ts (STAR->PLUS on 276, add minLength 1 on schema 176, align msg 480). That is PRODUCTION code, out of the FCM-M3-002 test-only scope you activated.
SECURITY FLAG: this is input validation on a fleet SOCKET-BOUNDARY / isolation surface (empty socket name could collapse to a default socket = cross-session boundary risk). Per the reserved-Opus rule this production fix likely warrants OPUS SECREV, not terra.
I am NOT self-deciding scope. Options for your call: (A) authorize a separate production-fix lane for roster-v2.ts (bug fix -> its own review + SECREV), then the FCM-M3-002 test refresh rides green on top; (B) other. I will NOT weaken the correct test. Fail-closed until you route. Local WC preserved at /tmp/ms-m3002-build/repo. MS-LEAD out.