From 7fd265033bbd079916afde75a787c381d58cb8d0 Mon Sep 17 00:00:00 2001 From: Jason Woltje Date: Tue, 20 Oct 2026 15:23:26 -0500 Subject: [PATCH] row 202 round 2 manifest: candidate 48a3fb96e (FED R5) --- agents/quackerjack/work/queue-202/MANIFEST.md | 61 ++++++++++++++----- 1 file changed, 45 insertions(+), 16 deletions(-) diff --git a/agents/quackerjack/work/queue-202/MANIFEST.md b/agents/quackerjack/work/queue-202/MANIFEST.md index 7d63a7d21..8a0132b74 100644 --- a/agents/quackerjack/work/queue-202/MANIFEST.md +++ b/agents/quackerjack/work/queue-202/MANIFEST.md @@ -1,35 +1,64 @@ -# Row 202 manifest: FED R5, mosaic access list, grant, revoke +# Row 202 manifest: FED R5, mosaic access list, grant, revoke (round 2) -Commit: 030809e15 on quackerjack/fed-r5 (base: R1 at 80fe31071, merged; 44e36fc4c on top, pyc only). +Candidate: 48a3fb96e on quackerjack/fed-r5 (round 2). Supersedes the round-1 manifest at 959bfb275, which +pointed at build 030809e15 and was reviewed by Duckworth as round 1 (changes, B1; REVIEW-r1.md, a76767e87). +Base: R1 at 80fe31071, merged; 44e36fc4c and 35aaceac9 on the branch before the build. Owner Quackerjack, reviewer Duckworth, gate owner Sage. Brief: docs/plans/2026-10-20_federation-r1-r2-r5.md, Brief: FED R5. -## Files (sha256 of the blob at 030809e15) +## Files (sha256 of the blob at 48a3fb96e) ``` -42958364617e7c0f0daac7a487cf68c74753f3a141b2daa80f8a1e5ede1ef03a packages/cli/src/access.mjs -19981c6d46a2c3e1490fdbe017d948ea8f980ececa4a7917716852eebdfdab92 packages/cli/src/cli.mjs -e5cd9158e1c65280c5c35d4c83aee7739b3308ddc853b1bc4575cfb121fc2f5e packages/cli/tests/access.test.mjs -57091e13a0e7e7789af6e34645cf9624075dd98c41afb7ee3e539ada00c5134d packages/cli/README.md +e2d3e613a8d6f04544904acb2af8aec44dedf9ba6820f1936e1f7d6547be2028 packages/cli/src/access.mjs +e956ac5b54844af30ac7717e85b5b60282b2ccf00dfc134d1d5c1d9f3cb44f32 packages/cli/src/cli.mjs +de7d15dc6989379a47b1efd4f449e9707004978198f01d704b2d61c8411ed6ca packages/cli/tests/access.test.mjs +f50760a67337147e50af032969ea65ca313ac7b76f6239e23e5c0d95431bd4b7 packages/cli/README.md aeddef32c28c883eedf166bcac96d1e6828b71c862e683977e097706339baf86 scripts/mosaic -2d7f1595d1070443a5afaf665259d7e7428f407f74e75378d500317b6aa2bdb3 agents/quackerjack/work/queue-202/BUILD.md +79f2c5344c0d73754804ab58c68edfb82bad7bfef50718550c698f61ae2a8ab5 agents/quackerjack/work/queue-202/BUILD.md ``` +scripts/mosaic is unchanged since round 1. + +## What changed in round 2 + +- Lock: no reclaim. A dead-pid, empty or unreadable lock refuses and names the path (and pid); a human + removes it. The reclaim race is gone (Sage sage-1429). +- Atomic write: fs calls go through `deps.fs` (default: the real `node:fs` functions). A failed write + removes its temp file and leaves the old bytes (Sage sage-1429, the direct-write gap). +- BusinessError from loadAccess or loadBusiness: exit 3, file and key path on stderr, no stack trace + (Duckworth B1, Sage sage-1437). Sage's ruling is exit 3, so the checkAccess refusals move from exit 2 to + exit 3 too. +- `contextFor` is a function, built after the agent and tester refusals and the human proof. A refused + caller never reads access.json or the business files (Sage sage-1437). +- The help text and README say the command runs as the instance's uid (Duckworth N6, Sage sage-1437). + ## Interface used from R1 (80fe31071) -checkAccess(doc, { providers, peers, businesses, ssoSubjects }), loadBusiness, accessFilePath is not used (the CLI takes configDir), covers is not used by R5. BusinessError is caught and re-thrown as exit 2. +checkAccess(doc, { providers, peers, businesses, ssoSubjects }), loadBusiness, loadAccess (via readCurrent), +accessFilePath is not used (the CLI takes configDir), covers is not used by R5. ## Named in review -- Human proof: one project.list call (proveHuman, access.mjs). Gate: packages/bus/src/broker.mjs:2319 (project.list case) and :377 (#human). -- Lock: /access.json.lock, 0600, pid stamp, stale reclaim on ESRCH, see BUILD.md. -- Pinned bus behavior: failed proof reads as outcome-unknown (client.mjs:32-33). Outside R5. -- Context: accessContextFor; peers [] until row 203; subjects flattened from console.sso.providers[].subjects. +- Human proof: one project.list call (proveHuman, access.mjs). Gate: packages/bus/src/broker.mjs:2319 + (project.list case) and :377 (#human). Agent and --tester refusals come before the proof. +- Lock: /access.json.lock, 0600, pid stamp. Live pid refuses (BUSY); dead, empty or unreadable + refuses and names the path. No reclaim. See BUILD.md. +- Write: checkAccess on the new document, then temp file, fsync, rename; revision compared inside the lock. +- Pinned bus behavior: a failed proof reads as outcome-unknown (client.mjs:32-33). Outside R5. +- Context: accessContextFor, built lazily; peers [] until row 203; subjects flattened from + console.sso.providers[].subjects. ## Tests and mutants -- packages/cli/tests/access.test.mjs: 18 tests, single file green on 030809e15. -- Mutant list M1-M10 in BUILD.md, run on Sage's go. Known gap: atomic-rename failure is not tested (BUILD.md). +- packages/cli/tests/access.test.mjs: 21 tests, single file green on 48a3fb96e (21/21, run on the candidate). +- Mutants M1-M13 in BUILD.md. M11 (direct write) and M12 (no BusinessError catch) and M13 (context built + early) are new. Run on Sage's go and slot only. +- Not run in this round: the mutant batch, the cli suite and scripts/test-*.sh. ## Not in this row -R2 peers, R4 access.reload, row 192 checkConsole, cli suite and scripts/test-*.sh (Sage's gate). +- R2 peers and the federation key (row 203). +- R4 access.reload (its brief takes N1: project.list exempts testers, so access.reload needs #human). +- row 192 checkConsole (the context reads console.sso directly until 192 lands). +- Viewer level (Sage's carry, item 5): whichever of 202 and 204 lands second adds it. Row 204 is not on + refactor yet as of 10-20 20:23Z. +- Cli suite and scripts/test-*.sh (Sage's gate).