diff --git a/agents/gosalyn/work/case2/DESIGN.md b/agents/gosalyn/work/case2/DESIGN.md index 44b0c7cc5..77347e838 100644 --- a/agents/gosalyn/work/case2/DESIGN.md +++ b/agents/gosalyn/work/case2/DESIGN.md @@ -18,6 +18,18 @@ survey counts it as an attachment. An embed with no extension or with `.md` embe like any link, R4 included. Section 1.3 says so. Row 212 lands as approved, and the change is C2-05a's, the first row that reads the R4 count. +## Ruling after r11: the Console starts at boot (Q189) + +Jason answered Q11 with "yes - automatic" (DECISIONS Q189, mos-1123). The Console on .54 starts at boot, +and the install starts it. This reverses mos-1097 item 1, so B1 under "Changes from r10" no longer +holds. The Console unit renders with `WantedBy=multi-user.target`, the same as the bus unit. Step 2c +enables both and starts the bus and then the Console. Step 9 no longer has Jason start the Console, and +a reboot brings it back with no human step. Row list C2-13a, section 9.3 and step 9 say so. Mos's +forgery question (mos-1097 item 2, #430) is unchanged, and so is the Console port below 1024 +(mos-1110). With a boot start the port squat window is shorter, a crash's `RestartSec=15` and each +re-pin, but it is still there. The C2-13a brief carries this when Sage re-briefs it into the installer +row (I2, Vikunja #432). + ## Changes from r10 Webby returned r10 with B1-B3 and N1-N5 (webby-0036, `agents/webby/work/case2-r10/REVIEW.md` at @@ -1033,7 +1045,7 @@ Chains follow Q177 merge-chaining. S marks a slice row. | C2-10b | S | Console chat: cited-item renderer through `renderItems`, the status line | C2-06, C2-09a, C2-03a | Haiku high | webui tests for items, scope badges, notices, "changed since" and the status line | | C2-12 | S | The setup sheet for Melanie (7.1, including N2 and N4, and what changes for Bean and Chet in 4) and the survey run sheet for `` | C2-01 | Luna | doc only, reviewed against the survey's real flags | | C2-20 | S | Persona import (9.1): a script that reads only the persona definitions of the two Hermes profiles, confirms profile to name, and writes each persona file (4) with its `persona.name` and `persona.sha256` for the business file. Prints names, byte counts and sha256 only. A `--dry-run` mode, run before Jason's go, prints only counts of files, lines and lines starting `# ` or `## ` | C2-08 | Opus (Gosalyn), run under Jason's go | fixture Hermes profile trees: the right fields are taken, memory and session files are never opened (a read trace on the fixture), a profile with no persona field refuses, a persona that would fail C2-08's fence check refuses, output holds no persona text, each written file is 0600 and its digest matches, `--dry-run` writes nothing and prints the right counts for a fixture with two heading lines and no marker string from it | -| C2-13a | S | `scripts/case2-unit.sh`, which renders the bus and Console system units from their existing templates and which root runs from a root-owned checkout in 10 step 2c, and `scripts/case2-precheck.sh` with the host checks. No library dependency, so row 195 chains on it (sage-1480) | none | Opus (Gosalyn) | the C2-13a brief's render and precheck cases: token rules, `@PATH@` from `--node`, the four hardening lines, the Console's capability lines and privileged port, no `[Install]` on the Console, one `WantedBy=` on the bus, copy-id pairing, the serve flag set, the key file and the unprivileged port start. Scratch unit directory and scratch data root | +| C2-13a | S | `scripts/case2-unit.sh`, which renders the bus and Console system units from their existing templates and which root runs from a root-owned checkout in 10 step 2c, and `scripts/case2-precheck.sh` with the host checks. No library dependency, so row 195 chains on it (sage-1480) | none | Opus (Gosalyn) | the C2-13a brief's render and precheck cases: token rules, `@PATH@` from `--node`, the four hardening lines, the Console's capability lines and privileged port, one `WantedBy=multi-user.target` on each unit (Q189), copy-id pairing, the serve flag set, the key file and the unprivileged port start. Scratch unit directory and scratch data root | | C2-13b | S | Install script for `` as ``: bootstrap, release activate, business file with the mapping, `bean` and `chet` with their persona vars and files, any specialists she picks, her human id, token slot path. The install writes no unit. Adds the library checks to the precheck. Jason or his delegate runs it (10) | C2-13a, C2-04, C2-03a, C2-20 | Opus (Gosalyn), Jason's go | precheck library checks: the business file, `.history`, `changes.jsonl` and persona files have the modes in 4 and each persona digest matches, `library.sync` fetches her repo read-only, `library.status` lists R-problems, no Discord binding exists. Tested against a scratch data root and a local bare repo | | C2-14 | S | End-to-end acceptance on a scratch data root and a bare repo in her layout: sync, ask a creative agent in its thread, a reply whose cites verify, a playground cite as canon refused, a force-push held as diverged, the Console shows the reply as items | slice rows | Opus | one script, which the reviewer also runs | | C2-02 | | Bus writes: `writeLibraryFile`, `commitFile` refactor, r1's S0 rule on the working tree | C2-04 | Sol (Rocko) | writer tests, `packages/project/tests` unchanged and green | @@ -1190,9 +1202,9 @@ A gap I found while checking this: a port squat. When the Console isn't running, its port, if the port is 1024 or above. The proxy then forwards Melanie's browser to the session's listener, with her sign-in header and the proof header on every request. The session gets the proof value, and from then on it can send as her to the real Console. It can also show her a fake Console. -The Console is down after every reboot until Jason starts it (step 9), after a crash for -`RestartSec=15`, and during each re-pin. So B1 makes this window longer than it would be with a boot -start. Bean and Chet run model-driven shells, so I treat it as reachable. The same reach exists wherever +The Console is down after a crash for `RestartSec=15`, during each re-pin, and for a moment at boot +before its unit starts. Q189 starts it at boot, so a reboot no longer leaves it down until a human +starts it, as r11's B1 did. Bean and Chet run model-driven shells, so I treat it as reachable. The same reach exists wherever sessions share a host and a network namespace with a Console on a port above 1023. I haven't looked at the live install and make no claim about it. The fix in C2-13a is a Console port below 1024. Only a process with `CAP_NET_BIND_SERVICE` in the host's network namespace can bind it. The Console unit gets @@ -1261,14 +1273,14 @@ What it adds is one bot account with read access to that one repo. `/.local/share/mosaic-stack/copies/`. `%h` becomes the literal home, because a system unit's `%h` is root's home. `@PATH@` starts with the directory of `--node`. The render adds `User=`, `Group=` and four hardening lines, and the Console unit also gets `CAP_NET_BIND_SERVICE` for its - port below 1024 (9.3). The bus unit's `WantedBy=` becomes `multi-user.target`, and the Console - unit has no `[Install]`. The C2-13a brief lists every line and rule. It checks `User=`, `Group=`, `ExecStart=`, the bus unit's + port below 1024 (9.3). Each unit's `WantedBy=` becomes `multi-user.target`, so + both start at boot (Q189). The C2-13a brief lists every line and rule. It checks `User=`, `Group=`, `ExecStart=`, the bus unit's `EnvironmentFile=` and the hardening lines against fixed values, and the copy id is the one part that may change between renders. It writes both under `/etc/systemd/system/` as `root:root` 0644. It never uses `systemctl link`, and it refuses a symlink at either unit path. On a re-install it refuses an installed unit that differs from the render. Root runs nothing from `/srv/mosaic` and - reads no unit that `mosaic` wrote. Then it enables the bus unit only. Both start only at step 9, - the bus first and then the Console, and they stop in the reverse order. + reads no unit that `mosaic` wrote. Then it enables both units and starts the bus and then the + Console. They stop in the reverse order. - 2d, Jason: the hub's own key on the existing Z.ai account, with a spend cap if the account offers one. Model use is spend, so the key and the cap are his. Whose Z.ai account it is hasn't been said, and that is his input. The key goes in `/srv/mosaic/.config/mosaic-dev/secrets/claude-session.env` @@ -1298,12 +1310,8 @@ What it adds is one bot account with read access to that one repo. 8. The residual in 5.1: up to 5 idea items of 200 characters per reply, 1,000 characters of free text within 1,200 total. He or Melanie accepts it or orders lower caps. Mos takes it to him. 9. The instance start. Stopping Hermes comes later, and only when she chooses it. - - Jason starts the bus unit, then the Console unit with `systemctl start mosaic-webui.service`. - The Console unit has no `[Install]`, so this is his start, and he makes it again after each boot - (decisions 94 and 102, mos-1097). Q185 already has him in the homelab for any VM 1012 reboot, so a - planned reboot costs him one command while he is there. The tradeoff: after an unplanned reboot the - Console stays down until he starts it. The bus comes back on its own and Bean and Chet keep - running, but Melanie has no Console until then. Her repo and Obsidian don't depend on it. With a + - The bus and the Console are already running from step 2c, and both come back after a boot on + their own (Q189, which reverses mos-1097 item 1). Nobody starts the Console by hand here. With a port below 1024, no session can take the port while it is down (9.3). - One session starts under the bus unit before she is told the hub is up. The first turn of `bean` reaches a running session, and its run record shows the runner started. The bwrap precheck runs in