Merge M1: configuration-driven Hello World
Closes #1, closes #2, closes #3, closes #4
This commit is contained in:
@@ -106,4 +106,35 @@ No credentials are recorded in this file.
|
|||||||
|
|
||||||
All 11 acceptance criteria demonstrated. The real model request passed.
|
All 11 acceptance criteria demonstrated. The real model request passed.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Phase 5: Configuration-driven Hello World (M1)
|
||||||
|
|
||||||
|
### Entry 5.1 — before
|
||||||
|
|
||||||
|
- Timestamp: 2026-09-03
|
||||||
|
- Intended action: Make the container POC configuration-driven. Baseline committed and tagged `poc-container-hello-v0`. Milestone M1 tracked in Gitea (issues #1-#4): (T1) config module with idempotent bootstrap and strict v1 validation; (T2) wire scripts and compose to config.json with fail-closed behavior; (T3) sandboxed config selftests; (T4) E2E verification and documentation.
|
||||||
|
- Reason: Per docs/plans/2026-09-02_atomic-mosaic-foundation.md — config.json must be the sole discovery entry point; updates and runs must never corrupt or invent configuration.
|
||||||
|
- Expected result: All M1 acceptance criteria pass; Hello World reproducible from configuration alone.
|
||||||
|
|
||||||
|
### Entry 5.2 — after
|
||||||
|
|
||||||
|
- Timestamp: 2026-09-03
|
||||||
|
- Commands run: `scripts/test-config.sh` (20 cases); fail-closed checks (compose without launcher env, verify/reset with missing config); `scripts/bootstrap.sh`; config-driven `scripts/hello.sh`, `scripts/verify.sh`, negative marker test, sandboxed reset symlink refusal (canary survived), real reset + bootstrap + build + verify; config checksum comparison across the entire flow.
|
||||||
|
- Observed result:
|
||||||
|
- Config selftests: 20 passed, 0 failed.
|
||||||
|
- Fail-closed confirmed: compose exits 1 without launcher env; verify/reset exit 1 on missing config before any mutation.
|
||||||
|
- Bootstrap created `~/.config/mosaic-dev/config.json` exclusively; second run validated without rewriting (content + mtime unchanged).
|
||||||
|
- Config-driven hello/verify returned exactly `MOSAIC_HELLO_OK`; verify exit 0; negative marker test exit 1.
|
||||||
|
- Reset refused symlinked dataRoot; canary file survived; real reset removed only the configured data root.
|
||||||
|
- config.json checksum unchanged across hello/verify/reset/bootstrap/build/verify.
|
||||||
|
- Failure or correction:
|
||||||
|
1. Selftest harness bug: `cfg` helper invoked without a body for the symlink case (`$2: unbound variable`). Fixed in the harness; product code unaffected.
|
||||||
|
2. E2E rerun-after-reset failure: `verify.sh` did not ensure the configured data root existed before the container mount. With the data root absent, Docker auto-created the host path as root:root, and the container's uid-1000 user could not write the generated system prompt. Fixed by calling `bootstrap_runtime_dir` in `verify.sh`; also hardened it to fail with a clear message when the data root exists but is not writable (root-owned leftover). Clean-slate E2E rerun: all steps green.
|
||||||
|
- Credential check: no credential material in config, scripts, logs, or test output.
|
||||||
|
|
||||||
|
## Result (M1)
|
||||||
|
|
||||||
|
Configuration-driven Hello World verified. `main` merged with M1 and tagged `config-hello-v1`.
|
||||||
|
|
||||||
|
|
||||||
|
|||||||
@@ -9,24 +9,65 @@ to return exactly `MOSAIC_HELLO_OK`.
|
|||||||
## Layout
|
## Layout
|
||||||
|
|
||||||
```text
|
```text
|
||||||
BRIEF.md requirements for this experiment
|
BRIEF.md requirements for the original container proof
|
||||||
BUILD-LOG.md append-only build/verification log
|
BUILD-LOG.md append-only build/verification log
|
||||||
LAYERS.md implemented layer (L0) and deferred layers (L1-L6)
|
LAYERS.md implemented layer (L0) and deferred layers (L1-L6)
|
||||||
Containerfile image definition (node:24-bookworm-slim, non-root, pinned Pi)
|
Containerfile image definition (node:24-bookworm-slim, non-root, pinned Pi)
|
||||||
compose.yaml one service: mosaic-agent (one-shot)
|
compose.yaml one service: mosaic-agent (one-shot; configured via env)
|
||||||
package.json pins @earendil-works/pi-coding-agent at exactly 0.84.4
|
package.json pins @earendil-works/pi-coding-agent at exactly 0.84.4
|
||||||
package-lock.json resolved lockfile used by npm ci in the image
|
package-lock.json resolved lockfile used by npm ci in the image
|
||||||
.env.example non-secret settings only (provider, model)
|
.env.example non-secret settings only (credential-file path, env-var auth)
|
||||||
contracts/ CONSTITUTION.md, STANDARDS.md, SOUL.md, USER.md (immutable fixtures)
|
contracts/ CONSTITUTION.md, STANDARDS.md, SOUL.md, USER.md (immutable fixtures)
|
||||||
scripts/ build.sh, hello.sh, verify.sh, reset.sh (+ shared common.sh)
|
scripts/ bootstrap/build/hello/verify/reset + config tooling
|
||||||
src/ load-contracts.sh, run-agent.sh (run inside the container)
|
src/ load-contracts.sh, run-agent.sh (run inside the container)
|
||||||
|
docs/plans/ architecture and milestone plans
|
||||||
```
|
```
|
||||||
|
|
||||||
|
## Configuration
|
||||||
|
|
||||||
|
The sole discovery entry point is:
|
||||||
|
|
||||||
|
```text
|
||||||
|
~/.config/mosaic-dev/config.json
|
||||||
|
```
|
||||||
|
|
||||||
|
Created only by the explicit, idempotent bootstrap:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
scripts/bootstrap.sh # create-if-absent; validates existing config, never rewrites
|
||||||
|
```
|
||||||
|
|
||||||
|
Minimal shape (`configVersion` 1):
|
||||||
|
|
||||||
|
```json
|
||||||
|
{
|
||||||
|
"configVersion": 1,
|
||||||
|
"environment": "development",
|
||||||
|
"dataRoot": "/home/jwoltje/.mosaic-dev",
|
||||||
|
"execution": {
|
||||||
|
"backend": "docker",
|
||||||
|
"provider": "zai",
|
||||||
|
"model": "glm-5.3-flash"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
Rules enforced by `scripts/mosaic-config.mjs`:
|
||||||
|
|
||||||
|
- Unknown keys, unsupported versions/backends, and malformed JSON exit nonzero; nothing is modified.
|
||||||
|
- `dataRoot` must be absolute, canonical, and must not be or contain the home or configuration directory.
|
||||||
|
- Validation failures never touch config, state, or images.
|
||||||
|
- `scripts/test-config.sh` runs the sandboxed config selftests (no Docker required).
|
||||||
|
|
||||||
|
Run paths (`build/hello/verify/reset`) fail closed when configuration is missing or invalid; they never invent it.
|
||||||
|
|
||||||
|
See `docs/plans/2026-09-02_atomic-mosaic-foundation.md` for the full plan.
|
||||||
|
|
||||||
Inside the container:
|
Inside the container:
|
||||||
|
|
||||||
```text
|
```text
|
||||||
/opt/mosaic/contracts immutable contract files
|
/opt/mosaic/contracts immutable contract files
|
||||||
/var/lib/mosaic generated runtime state (mounted from /home/jwoltje/.mosaic-dev)
|
/var/lib/mosaic generated runtime state (mounted from configured dataRoot)
|
||||||
/workspace agent workspace
|
/workspace agent workspace
|
||||||
```
|
```
|
||||||
|
|
||||||
@@ -48,10 +89,12 @@ Inside the container:
|
|||||||
## Usage
|
## Usage
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
scripts/build.sh # build the image
|
scripts/bootstrap.sh # create config.json if absent (idempotent)
|
||||||
scripts/hello.sh # one-shot request; prints the model response
|
scripts/build.sh # build the image
|
||||||
scripts/verify.sh # full gated test; exit 0 only on exact MOSAIC_HELLO_OK
|
scripts/hello.sh # one-shot request; prints the model response
|
||||||
scripts/reset.sh # delete /home/jwoltje/.mosaic-dev (safety-checked)
|
scripts/verify.sh # full gated test; exit 0 only on exact MOSAIC_HELLO_OK
|
||||||
|
scripts/test-config.sh # fast config-layer selftests (no Docker)
|
||||||
|
scripts/reset.sh # delete the configured data root (safety-checked)
|
||||||
```
|
```
|
||||||
|
|
||||||
Prove the failure path (acceptance criterion 9):
|
Prove the failure path (acceptance criterion 9):
|
||||||
|
|||||||
+6
-5
@@ -6,17 +6,18 @@ services:
|
|||||||
image: mosaic-poc-agent:0.84.4
|
image: mosaic-poc-agent:0.84.4
|
||||||
user: "1000:1000"
|
user: "1000:1000"
|
||||||
environment:
|
environment:
|
||||||
# Non-secret settings (see .env.example)
|
# Resolved from config.json by scripts/common.sh (load_config).
|
||||||
PI_PROVIDER: ${PI_PROVIDER:-zai}
|
# Required: compose fails fast when the launcher did not supply them.
|
||||||
PI_MODEL: ${PI_MODEL:-glm-5.3-flash}
|
PI_PROVIDER: ${MOSAIC_PROVIDER:?MOSAIC_PROVIDER must be set by scripts/load_config (run via scripts/*.sh)}
|
||||||
|
PI_MODEL: ${MOSAIC_MODEL:?MOSAIC_MODEL must be set by scripts/load_config (run via scripts/*.sh)}
|
||||||
# Documented container auth alternative: provider API key via
|
# Documented container auth alternative: provider API key via
|
||||||
# runtime environment variable. Empty by default; when empty Pi
|
# runtime environment variable. Empty by default; when empty Pi
|
||||||
# falls back to the read-only mounted auth.json credential file.
|
# falls back to the read-only mounted auth.json credential file.
|
||||||
ZAI_API_KEY: ${ZAI_API_KEY:-}
|
ZAI_API_KEY: ${ZAI_API_KEY:-}
|
||||||
ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}
|
ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}
|
||||||
volumes:
|
volumes:
|
||||||
# Generated runtime state (host dir per brief)
|
# Configured runtime state root (from config.json dataRoot).
|
||||||
- /home/jwoltje/.mosaic-dev:/var/lib/mosaic
|
- ${MOSAIC_DATA_ROOT:?MOSAIC_DATA_ROOT must be set by scripts/load_config (run via scripts/*.sh)}:/var/lib/mosaic
|
||||||
# Runtime credential only: pi auth file mounted READ-ONLY.
|
# Runtime credential only: pi auth file mounted READ-ONLY.
|
||||||
# Never copied into the image.
|
# Never copied into the image.
|
||||||
- ${PI_AUTH_FILE:-/home/jwoltje/.pi/agent/auth.json}:/home/node/.pi/agent/auth.json:ro
|
- ${PI_AUTH_FILE:-/home/jwoltje/.pi/agent/auth.json}:/home/node/.pi/agent/auth.json:ro
|
||||||
|
|||||||
Executable
+11
@@ -0,0 +1,11 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
# Explicit, idempotent configuration bootstrap.
|
||||||
|
#
|
||||||
|
# Creates ~/.config/mosaic-dev/config.json (or $MOSAIC_CONFIG) only when
|
||||||
|
# absent. An existing configuration is validated, never modified.
|
||||||
|
# Normal run paths (build/hello/verify) deliberately do NOT auto-bootstrap:
|
||||||
|
# missing configuration is an error there, not something to invent.
|
||||||
|
set -euo pipefail
|
||||||
|
cd "$(dirname "$0")/.."
|
||||||
|
|
||||||
|
exec node scripts/mosaic-config.mjs bootstrap
|
||||||
@@ -5,6 +5,8 @@ cd "$(dirname "$0")/.."
|
|||||||
# shellcheck source=common.sh
|
# shellcheck source=common.sh
|
||||||
source scripts/common.sh
|
source scripts/common.sh
|
||||||
|
|
||||||
|
load_config
|
||||||
|
|
||||||
bootstrap_runtime_dir
|
bootstrap_runtime_dir
|
||||||
|
|
||||||
docker compose build
|
docker compose build
|
||||||
|
|||||||
+29
-6
@@ -1,13 +1,36 @@
|
|||||||
# Shared helpers for the POC host scripts. Not a documented entry point.
|
# Shared helpers for the Mosaic host scripts. Not a documented entry point.
|
||||||
|
|
||||||
MOSAIC_DEV_DIR="/home/jwoltje/.mosaic-dev"
|
|
||||||
POC_ROOT_MARKER=".mosaic-poc-root"
|
POC_ROOT_MARKER=".mosaic-poc-root"
|
||||||
|
|
||||||
# Ensure the runtime state directory exists and carries this project's
|
# Load and validate the Mosaic configuration (config.json), exporting
|
||||||
# ownership marker. The marker is what scripts/reset.sh requires before
|
# MOSAIC_DATA_ROOT, MOSAIC_PROVIDER, and MOSAIC_MODEL.
|
||||||
# it will delete anything.
|
#
|
||||||
|
# Fails closed: a missing or invalid configuration aborts the calling
|
||||||
|
# script before any container or filesystem mutation. Run paths never
|
||||||
|
# auto-bootstrap; use scripts/bootstrap.sh explicitly.
|
||||||
|
load_config() {
|
||||||
|
local config_env
|
||||||
|
if ! config_env="$(node scripts/mosaic-config.mjs env)"; then
|
||||||
|
echo "common: configuration load failed" >&2
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
eval "$config_env"
|
||||||
|
export MOSAIC_DATA_ROOT MOSAIC_PROVIDER MOSAIC_MODEL
|
||||||
|
MOSAIC_DEV_DIR="$MOSAIC_DATA_ROOT"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Ensure the configured runtime data directory exists and carries this
|
||||||
|
# project's ownership marker. The marker is what scripts/reset.sh requires
|
||||||
|
# before it will delete anything.
|
||||||
bootstrap_runtime_dir() {
|
bootstrap_runtime_dir() {
|
||||||
if [ ! -d "$MOSAIC_DEV_DIR" ]; then
|
if [ -d "$MOSAIC_DEV_DIR" ]; then
|
||||||
|
if [ ! -w "$MOSAIC_DEV_DIR" ] || [ ! -x "$MOSAIC_DEV_DIR" ]; then
|
||||||
|
echo "bootstrap: $MOSAIC_DEV_DIR exists but is not writable by $(id -un)" >&2
|
||||||
|
echo "bootstrap: a root-owned directory here is usually leftover from a" >&2
|
||||||
|
echo "bootstrap: Docker-created mount source; remove it and rerun." >&2
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
else
|
||||||
mkdir -p "$MOSAIC_DEV_DIR"
|
mkdir -p "$MOSAIC_DEV_DIR"
|
||||||
echo "bootstrap: created $MOSAIC_DEV_DIR"
|
echo "bootstrap: created $MOSAIC_DEV_DIR"
|
||||||
fi
|
fi
|
||||||
|
|||||||
Executable
+83
@@ -0,0 +1,83 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
# Minimal Gitea API client for this repository.
|
||||||
|
#
|
||||||
|
# Usage: scripts/gitea-api.sh METHOD api/path [json-body]
|
||||||
|
# e.g. scripts/gitea-api.sh GET repos/mosaicstack/stack-v2/issues
|
||||||
|
#
|
||||||
|
# Security:
|
||||||
|
# - Reads credentials from ~/secrets/mosaic.gitea.json (or
|
||||||
|
# MOSAIC_GITEA_CREDENTIAL_FILE); file must be 0600, non-symlink.
|
||||||
|
# - Token is passed to curl via a config stream (never argv, never disk,
|
||||||
|
# never stdout/stderr).
|
||||||
|
# - Prints the response body on stdout and "HTTP <code>" on stderr.
|
||||||
|
# Exits nonzero when the API reports an error.
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
METHOD="${1:?usage: gitea-api.sh METHOD api/path [json-body]}"
|
||||||
|
API_PATH="${2:?missing api/path}"
|
||||||
|
API_PATH="${API_PATH#/}"
|
||||||
|
BODY="${3:-}"
|
||||||
|
|
||||||
|
command -v curl >/dev/null || { echo "gitea-api: curl not found" >&2; exit 1; }
|
||||||
|
command -v node >/dev/null || { echo "gitea-api: node not found" >&2; exit 1; }
|
||||||
|
|
||||||
|
export MOSAIC_GITEA_CREDENTIAL_FILE="${MOSAIC_GITEA_CREDENTIAL_FILE:-$HOME/secrets/mosaic.gitea.json}"
|
||||||
|
|
||||||
|
# Validate credential file; emit only the non-secret base URL on stdout.
|
||||||
|
BASE="$(node -e '
|
||||||
|
const fs = require("fs");
|
||||||
|
const p = process.env.MOSAIC_GITEA_CREDENTIAL_FILE;
|
||||||
|
let s;
|
||||||
|
try { s = fs.lstatSync(p); } catch { process.exit(3); }
|
||||||
|
if (!s.isFile() || s.isSymbolicLink() || (s.mode & 0o077) !== 0) process.exit(3);
|
||||||
|
let e;
|
||||||
|
try { e = JSON.parse(fs.readFileSync(p, "utf8")).mosaicstack || {}; } catch { process.exit(3); }
|
||||||
|
const base = String(e.url || "").replace(/\/+$/, "");
|
||||||
|
if (!/^https:\/\/git\.mosaicstack\.dev$/.test(base)) process.exit(3);
|
||||||
|
if (typeof e.api_token !== "string" || e.api_token.length === 0) process.exit(3);
|
||||||
|
process.stdout.write(base);
|
||||||
|
')"
|
||||||
|
|
||||||
|
# Repo path from the configured origin remote (never from credentials).
|
||||||
|
REMOTE_URL="$(git remote get-url origin)"
|
||||||
|
REPO_PATH="${REMOTE_URL#https://git.mosaicstack.dev/}"
|
||||||
|
REPO_PATH="${REPO_PATH%.git}"
|
||||||
|
|
||||||
|
# curl config stream: auth header via fd, never argv.
|
||||||
|
gen_curl_cfg() {
|
||||||
|
node -e '
|
||||||
|
const fs = require("fs");
|
||||||
|
const e = JSON.parse(fs.readFileSync(process.env.MOSAIC_GITEA_CREDENTIAL_FILE, "utf8")).mosaicstack || {};
|
||||||
|
process.stdout.write("header = \"Authorization: token " + e.api_token + "\"\n");
|
||||||
|
process.stdout.write("header = \"Content-Type: application/json\"\n");
|
||||||
|
'
|
||||||
|
}
|
||||||
|
|
||||||
|
BODY_FILE=""
|
||||||
|
cleanup() { [ -n "$BODY_FILE" ] && rm -f "$BODY_FILE"; }
|
||||||
|
trap cleanup EXIT
|
||||||
|
if [ -n "$BODY" ]; then
|
||||||
|
BODY_FILE="$(mktemp)"
|
||||||
|
chmod 600 "$BODY_FILE"
|
||||||
|
printf '%s' "$BODY" > "$BODY_FILE"
|
||||||
|
fi
|
||||||
|
|
||||||
|
URL="$BASE/api/v1/$API_PATH"
|
||||||
|
if [ -n "$BODY_FILE" ]; then
|
||||||
|
HTTP_CODE="$(curl -sS -K <(gen_curl_cfg) -o /tmp/gitea-api-response.$$ \
|
||||||
|
-w '%{http_code}' -X "$METHOD" "$URL" --data-binary @"$BODY_FILE")" || {
|
||||||
|
echo "gitea-api: request failed" >&2; exit 1; }
|
||||||
|
else
|
||||||
|
HTTP_CODE="$(curl -sS -K <(gen_curl_cfg) -o /tmp/gitea-api-response.$$ \
|
||||||
|
-w '%{http_code}' -X "$METHOD" "$URL")" || {
|
||||||
|
echo "gitea-api: request failed" >&2; exit 1; }
|
||||||
|
fi
|
||||||
|
|
||||||
|
cat /tmp/gitea-api-response.$$ 2>/dev/null || true
|
||||||
|
rm -f /tmp/gitea-api-response.$$
|
||||||
|
echo "HTTP $HTTP_CODE" >&2
|
||||||
|
|
||||||
|
case "$HTTP_CODE" in
|
||||||
|
2*) exit 0 ;;
|
||||||
|
*) echo "gitea-api: $METHOD $API_PATH failed (HTTP $HTTP_CODE)" >&2; exit 1 ;;
|
||||||
|
esac
|
||||||
@@ -10,6 +10,8 @@ cd "$(dirname "$0")/.."
|
|||||||
# shellcheck source=common.sh
|
# shellcheck source=common.sh
|
||||||
source scripts/common.sh
|
source scripts/common.sh
|
||||||
|
|
||||||
|
load_config
|
||||||
|
|
||||||
bootstrap_runtime_dir
|
bootstrap_runtime_dir
|
||||||
|
|
||||||
# -T: no pseudo-TTY, so stdout is clean model output.
|
# -T: no pseudo-TTY, so stdout is clean model output.
|
||||||
|
|||||||
Executable
+233
@@ -0,0 +1,233 @@
|
|||||||
|
#!/usr/bin/env node
|
||||||
|
/**
|
||||||
|
* Mosaic development configuration: bootstrap, validate, resolve.
|
||||||
|
*
|
||||||
|
* Operations:
|
||||||
|
* bootstrap Create the default config ONLY if absent; otherwise validate
|
||||||
|
* the existing file without writing (idempotent).
|
||||||
|
* validate Load and strictly validate; print resolved config on stdout.
|
||||||
|
* env Print shell-safe exports for launcher scripts:
|
||||||
|
* MOSAIC_DATA_ROOT, MOSAIC_PROVIDER, MOSAIC_MODEL.
|
||||||
|
*
|
||||||
|
* Config location: $MOSAIC_CONFIG or ~/.config/mosaic-dev/config.json
|
||||||
|
*
|
||||||
|
* Exit codes:
|
||||||
|
* 0 success
|
||||||
|
* 2 configuration exists but is invalid (never modified by this tool)
|
||||||
|
* 3 configuration is missing for a read operation (validate/env)
|
||||||
|
*
|
||||||
|
* Invariants (docs/plans/2026-09-02_atomic-mosaic-foundation.md):
|
||||||
|
* - Existing configuration is never overwritten.
|
||||||
|
* - Validation failure modifies nothing.
|
||||||
|
* - Secrets are never stored in configuration.
|
||||||
|
*/
|
||||||
|
|
||||||
|
import fs from "node:fs";
|
||||||
|
import os from "node:os";
|
||||||
|
import path from "node:path";
|
||||||
|
import process from "node:process";
|
||||||
|
|
||||||
|
const SUPPORTED_CONFIG_VERSION = 1;
|
||||||
|
const SUPPORTED_ENVIRONMENTS = new Set(["development", "production"]);
|
||||||
|
const SUPPORTED_BACKENDS = new Set(["docker"]);
|
||||||
|
const NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,199}$/;
|
||||||
|
|
||||||
|
function fail(exitCode, message) {
|
||||||
|
process.stderr.write(`mosaic-config: ${message}\n`);
|
||||||
|
process.exit(exitCode);
|
||||||
|
}
|
||||||
|
|
||||||
|
function configPath() {
|
||||||
|
return process.env.MOSAIC_CONFIG
|
||||||
|
? path.resolve(process.env.MOSAIC_CONFIG)
|
||||||
|
: path.join(os.homedir(), ".config", "mosaic-dev", "config.json");
|
||||||
|
}
|
||||||
|
|
||||||
|
function readRaw(file) {
|
||||||
|
let stat;
|
||||||
|
try {
|
||||||
|
stat = fs.lstatSync(file);
|
||||||
|
} catch {
|
||||||
|
return null; // missing
|
||||||
|
}
|
||||||
|
if (!stat.isFile() || stat.isSymbolicLink()) {
|
||||||
|
fail(2, `configuration path must be a regular, non-symbolic-link file: ${file}`);
|
||||||
|
}
|
||||||
|
try {
|
||||||
|
return fs.readFileSync(file, "utf8");
|
||||||
|
} catch {
|
||||||
|
fail(2, `configuration file is not readable: ${file}`);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
function rejectUnknownKeys(object, allowed, where) {
|
||||||
|
for (const key of Object.keys(object)) {
|
||||||
|
if (!allowed.includes(key)) {
|
||||||
|
fail(2, `unsupported ${where} key: "${key}"`);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
function isPlainObject(value) {
|
||||||
|
return typeof value === "object" && value !== null && !Array.isArray(value);
|
||||||
|
}
|
||||||
|
|
||||||
|
function validateDataRoot(value, file) {
|
||||||
|
if (typeof value !== "string" || value.length === 0) {
|
||||||
|
fail(2, 'execution "dataRoot" must be a non-empty string');
|
||||||
|
}
|
||||||
|
if (value.includes("\0")) {
|
||||||
|
fail(2, 'execution "dataRoot" contains a NUL byte');
|
||||||
|
}
|
||||||
|
if (!path.isAbsolute(value)) {
|
||||||
|
fail(2, `execution "dataRoot" must be an absolute path (got "${value}")`);
|
||||||
|
}
|
||||||
|
const resolved = path.resolve(value);
|
||||||
|
if (resolved !== value) {
|
||||||
|
fail(2, `execution "dataRoot" must be canonical without ".", "..", trailing slashes, or redundant separators (got "${value}")`);
|
||||||
|
}
|
||||||
|
if (resolved === path.parse(resolved).root) {
|
||||||
|
fail(2, 'execution "dataRoot" must not be the filesystem root');
|
||||||
|
}
|
||||||
|
const home = path.resolve(os.homedir());
|
||||||
|
if (resolved === home || isAncestorOf(resolved, home)) {
|
||||||
|
fail(2, `execution "dataRoot" must not be or contain the home directory (${home})`);
|
||||||
|
}
|
||||||
|
const configDir = path.dirname(path.resolve(file));
|
||||||
|
if (resolved === configDir || isAncestorOf(resolved, configDir)) {
|
||||||
|
fail(2, `execution "dataRoot" must not be or contain the configuration directory (${configDir})`);
|
||||||
|
}
|
||||||
|
return resolved;
|
||||||
|
}
|
||||||
|
|
||||||
|
function isAncestorOf(ancestor, candidate) {
|
||||||
|
const rel = path.relative(ancestor, candidate);
|
||||||
|
return rel !== "" && !rel.startsWith("..") && !path.isAbsolute(rel);
|
||||||
|
}
|
||||||
|
|
||||||
|
function validate(document, file) {
|
||||||
|
if (!isPlainObject(document)) {
|
||||||
|
fail(2, "configuration must be a JSON object");
|
||||||
|
}
|
||||||
|
rejectUnknownKeys(
|
||||||
|
document,
|
||||||
|
["configVersion", "environment", "dataRoot", "execution"],
|
||||||
|
"configuration",
|
||||||
|
);
|
||||||
|
|
||||||
|
if (document.configVersion !== SUPPORTED_CONFIG_VERSION) {
|
||||||
|
fail(2, `unsupported configVersion: ${JSON.stringify(document.configVersion)} (supported: ${SUPPORTED_CONFIG_VERSION})`);
|
||||||
|
}
|
||||||
|
if (!SUPPORTED_ENVIRONMENTS.has(document.environment)) {
|
||||||
|
fail(2, `unsupported environment: ${JSON.stringify(document.environment)} (supported: ${[...SUPPORTED_ENVIRONMENTS].join(", ")})`);
|
||||||
|
}
|
||||||
|
|
||||||
|
const dataRoot = validateDataRoot(document.dataRoot, file);
|
||||||
|
|
||||||
|
if (!isPlainObject(document.execution)) {
|
||||||
|
fail(2, '"execution" must be a JSON object');
|
||||||
|
}
|
||||||
|
rejectUnknownKeys(document.execution, ["backend", "provider", "model"], '"execution"');
|
||||||
|
if (!SUPPORTED_BACKENDS.has(document.execution.backend)) {
|
||||||
|
fail(2, `unsupported execution.backend: ${JSON.stringify(document.execution.backend)} (supported: ${[...SUPPORTED_BACKENDS].join(", ")})`);
|
||||||
|
}
|
||||||
|
for (const key of ["provider", "model"]) {
|
||||||
|
const value = document.execution[key];
|
||||||
|
if (typeof value !== "string" || !NAME_PATTERN.test(value)) {
|
||||||
|
fail(2, `execution.${key} must match ${NAME_PATTERN} (got ${JSON.stringify(value)})`);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return {
|
||||||
|
configVersion: document.configVersion,
|
||||||
|
environment: document.environment,
|
||||||
|
dataRoot,
|
||||||
|
execution: {
|
||||||
|
backend: document.execution.backend,
|
||||||
|
provider: document.execution.provider,
|
||||||
|
model: document.execution.model,
|
||||||
|
},
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
||||||
|
function load(file) {
|
||||||
|
const raw = readRaw(file);
|
||||||
|
if (raw === null) {
|
||||||
|
fail(3, `configuration not found: ${file} (run scripts/bootstrap.sh to create it)`);
|
||||||
|
}
|
||||||
|
let document;
|
||||||
|
try {
|
||||||
|
document = JSON.parse(raw);
|
||||||
|
} catch (error) {
|
||||||
|
fail(2, `configuration is not valid JSON (${file}): ${error.message}`);
|
||||||
|
}
|
||||||
|
return validate(document, file);
|
||||||
|
}
|
||||||
|
|
||||||
|
function shellQuote(value) {
|
||||||
|
return `'${String(value).replaceAll("'", `'\\''`)}'`;
|
||||||
|
}
|
||||||
|
|
||||||
|
const DEFAULT_CONFIG = {
|
||||||
|
configVersion: 1,
|
||||||
|
environment: "development",
|
||||||
|
dataRoot: path.join(os.homedir(), ".mosaic-dev"),
|
||||||
|
execution: {
|
||||||
|
backend: "docker",
|
||||||
|
provider: "zai",
|
||||||
|
model: "glm-5.3-flash",
|
||||||
|
},
|
||||||
|
};
|
||||||
|
|
||||||
|
const operation = process.argv[2];
|
||||||
|
const file = configPath();
|
||||||
|
|
||||||
|
switch (operation) {
|
||||||
|
case "bootstrap": {
|
||||||
|
if (fs.existsSync(file)) {
|
||||||
|
load(file); // validate only; never rewrite
|
||||||
|
process.stderr.write(`mosaic-config: configuration already present, validated without changes: ${file}\n`);
|
||||||
|
process.exit(0);
|
||||||
|
}
|
||||||
|
fs.mkdirSync(path.dirname(file), { recursive: true });
|
||||||
|
let fd;
|
||||||
|
try {
|
||||||
|
// 'wx': creation is exclusive; an existing file is never overwritten.
|
||||||
|
fd = fs.openSync(file, "wx", 0o644);
|
||||||
|
fs.writeFileSync(fd, `${JSON.stringify(DEFAULT_CONFIG, null, 2)}\n`);
|
||||||
|
} catch (error) {
|
||||||
|
if (error.code === "EEXIST") {
|
||||||
|
load(file);
|
||||||
|
process.exit(0);
|
||||||
|
}
|
||||||
|
fail(1, `unable to create configuration: ${error.message}`);
|
||||||
|
} finally {
|
||||||
|
if (fd !== undefined) fs.closeSync(fd);
|
||||||
|
}
|
||||||
|
load(file);
|
||||||
|
process.stderr.write(`mosaic-config: created default configuration: ${file}\n`);
|
||||||
|
process.exit(0);
|
||||||
|
}
|
||||||
|
|
||||||
|
case "validate": {
|
||||||
|
const resolved = load(file);
|
||||||
|
process.stdout.write(`${JSON.stringify(resolved, null, 2)}\n`);
|
||||||
|
process.exit(0);
|
||||||
|
}
|
||||||
|
|
||||||
|
case "env": {
|
||||||
|
const resolved = load(file);
|
||||||
|
process.stdout.write(
|
||||||
|
[
|
||||||
|
`MOSAIC_DATA_ROOT=${shellQuote(resolved.dataRoot)}`,
|
||||||
|
`MOSAIC_PROVIDER=${shellQuote(resolved.execution.provider)}`,
|
||||||
|
`MOSAIC_MODEL=${shellQuote(resolved.execution.model)}`,
|
||||||
|
"",
|
||||||
|
].join("\n"),
|
||||||
|
);
|
||||||
|
process.exit(0);
|
||||||
|
}
|
||||||
|
|
||||||
|
default:
|
||||||
|
fail(1, `unknown operation: ${JSON.stringify(operation ?? "")} (expected bootstrap | validate | env)`);
|
||||||
|
}
|
||||||
+8
-2
@@ -7,9 +7,15 @@
|
|||||||
# created by this project.
|
# created by this project.
|
||||||
# Any failed check aborts with nothing deleted.
|
# Any failed check aborts with nothing deleted.
|
||||||
set -euo pipefail
|
set -euo pipefail
|
||||||
|
cd "$(dirname "$0")/.."
|
||||||
|
# shellcheck source=common.sh
|
||||||
|
source scripts/common.sh
|
||||||
|
|
||||||
TARGET="/home/jwoltje/.mosaic-dev"
|
# Reset operates on the CONFIGURED data root. Configuration itself is
|
||||||
MARKER=".mosaic-poc-root"
|
# never a reset target; a missing/invalid configuration aborts here.
|
||||||
|
load_config
|
||||||
|
TARGET="$MOSAIC_DATA_ROOT"
|
||||||
|
MARKER="$POC_ROOT_MARKER"
|
||||||
|
|
||||||
fail() {
|
fail() {
|
||||||
echo "reset: refusing to delete: $*" >&2
|
echo "reset: refusing to delete: $*" >&2
|
||||||
|
|||||||
Executable
+142
@@ -0,0 +1,142 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
# Fast, sandboxed selftests for the configuration layer.
|
||||||
|
#
|
||||||
|
# No Docker, no network, no credentials: every case runs against a
|
||||||
|
# temporary config via MOSAIC_CONFIG. Suitable for frequent local runs.
|
||||||
|
set -uo pipefail
|
||||||
|
cd "$(dirname "$0")/.."
|
||||||
|
|
||||||
|
SANDBOX="$(mktemp -d)"
|
||||||
|
trap 'rm -rf "$SANDBOX"' EXIT
|
||||||
|
|
||||||
|
PASS=0
|
||||||
|
FAIL=0
|
||||||
|
|
||||||
|
# expect_exit NAME EXPECTED_RC -- command...
|
||||||
|
expect_exit() {
|
||||||
|
local name="$1" expected="$2"
|
||||||
|
shift 3 # name, expected, "--"
|
||||||
|
local rc
|
||||||
|
"$@" >/dev/null 2>&1
|
||||||
|
rc=$?
|
||||||
|
if [ "$rc" -eq "$expected" ]; then
|
||||||
|
PASS=$((PASS + 1))
|
||||||
|
echo "ok $name (exit $rc)"
|
||||||
|
else
|
||||||
|
FAIL=$((FAIL + 1))
|
||||||
|
echo "FAIL $name (exit $rc, expected $expected)"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
CONFIG_OP="node scripts/mosaic-config.mjs"
|
||||||
|
|
||||||
|
valid_body() {
|
||||||
|
cat <<EOF
|
||||||
|
{"configVersion":1,"environment":"development","dataRoot":"$1","execution":{"backend":"docker","provider":"zai","model":"glm-5.3-flash"}}
|
||||||
|
EOF
|
||||||
|
}
|
||||||
|
|
||||||
|
cfg() { printf '%s' "$2" > "$SANDBOX/$1"; }
|
||||||
|
|
||||||
|
DATA_ROOT="$SANDBOX/data"
|
||||||
|
|
||||||
|
# --- bootstrap ---
|
||||||
|
rm -f "$SANDBOX/config.json"
|
||||||
|
expect_exit "bootstrap creates default when absent" 0 -- \
|
||||||
|
env MOSAIC_CONFIG="$SANDBOX/config.json" $CONFIG_OP bootstrap
|
||||||
|
[ -f "$SANDBOX/config.json" ] && { PASS=$((PASS+1)); echo "ok bootstrap wrote config file"; } \
|
||||||
|
|| { FAIL=$((FAIL+1)); echo "FAIL bootstrap wrote config file"; }
|
||||||
|
|
||||||
|
SUM_BEFORE=$(sha256sum "$SANDBOX/config.json" | cut -d' ' -f1)
|
||||||
|
MTIME_BEFORE=$(stat -c %Y "$SANDBOX/config.json")
|
||||||
|
sleep 1.1
|
||||||
|
expect_exit "bootstrap is idempotent on existing config" 0 -- \
|
||||||
|
env MOSAIC_CONFIG="$SANDBOX/config.json" $CONFIG_OP bootstrap
|
||||||
|
SUM_AFTER=$(sha256sum "$SANDBOX/config.json" | cut -d' ' -f1)
|
||||||
|
MTIME_AFTER=$(stat -c %Y "$SANDBOX/config.json")
|
||||||
|
if [ "$SUM_BEFORE" = "$SUM_AFTER" ] && [ "$MTIME_BEFORE" = "$MTIME_AFTER" ]; then
|
||||||
|
PASS=$((PASS+1)); echo "ok bootstrap did not rewrite existing config"
|
||||||
|
else
|
||||||
|
FAIL=$((FAIL+1)); echo "FAIL bootstrap rewrote existing config"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# --- validate ---
|
||||||
|
expect_exit "validate missing config exits 3" 3 -- \
|
||||||
|
env MOSAIC_CONFIG="$SANDBOX/absent.json" $CONFIG_OP validate
|
||||||
|
|
||||||
|
cfg invalid.json '{'
|
||||||
|
expect_exit "malformed JSON exits 2" 2 -- \
|
||||||
|
env MOSAIC_CONFIG="$SANDBOX/invalid.json" $CONFIG_OP validate
|
||||||
|
|
||||||
|
cfg badversion.json '{"configVersion":2,"environment":"development","dataRoot":"'$DATA_ROOT'","execution":{"backend":"docker","provider":"zai","model":"m"}}'
|
||||||
|
expect_exit "unsupported configVersion exits 2" 2 -- \
|
||||||
|
env MOSAIC_CONFIG="$SANDBOX/badversion.json" $CONFIG_OP validate
|
||||||
|
|
||||||
|
cfg unknownkey.json '{"configVersion":1,"environment":"development","dataRoot":"'$DATA_ROOT'","extra":true,"execution":{"backend":"docker","provider":"zai","model":"m"}}'
|
||||||
|
expect_exit "unknown top-level key exits 2" 2 -- \
|
||||||
|
env MOSAIC_CONFIG="$SANDBOX/unknownkey.json" $CONFIG_OP validate
|
||||||
|
|
||||||
|
cfg unknownexec.json '{"configVersion":1,"environment":"development","dataRoot":"'$DATA_ROOT'","execution":{"backend":"docker","provider":"zai","model":"m","extra":1}}'
|
||||||
|
expect_exit "unknown execution key exits 2" 2 -- \
|
||||||
|
env MOSAIC_CONFIG="$SANDBOX/unknownexec.json" $CONFIG_OP validate
|
||||||
|
|
||||||
|
cfg badbackend.json '{"configVersion":1,"environment":"development","dataRoot":"'$DATA_ROOT'","execution":{"backend":"podman","provider":"zai","model":"m"}}'
|
||||||
|
expect_exit "unsupported backend exits 2" 2 -- \
|
||||||
|
env MOSAIC_CONFIG="$SANDBOX/badbackend.json" $CONFIG_OP validate
|
||||||
|
|
||||||
|
cfg badenv.json '{"configVersion":1,"environment":"staging","dataRoot":"'$DATA_ROOT'","execution":{"backend":"docker","provider":"zai","model":"m"}}'
|
||||||
|
expect_exit "unsupported environment exits 2" 2 -- \
|
||||||
|
env MOSAIC_CONFIG="$SANDBOX/badenv.json" $CONFIG_OP validate
|
||||||
|
|
||||||
|
cfg relative.json '{"configVersion":1,"environment":"development","dataRoot":"relative/path","execution":{"backend":"docker","provider":"zai","model":"m"}}'
|
||||||
|
expect_exit "relative dataRoot exits 2" 2 -- \
|
||||||
|
env MOSAIC_CONFIG="$SANDBOX/relative.json" $CONFIG_OP validate
|
||||||
|
|
||||||
|
cfg traversal.json '{"configVersion":1,"environment":"development","dataRoot":"/tmp/../home/x","execution":{"backend":"docker","provider":"zai","model":"m"}}'
|
||||||
|
expect_exit "non-canonical dataRoot exits 2" 2 -- \
|
||||||
|
env MOSAIC_CONFIG="$SANDBOX/traversal.json" $CONFIG_OP validate
|
||||||
|
|
||||||
|
cfg root.json '{"configVersion":1,"environment":"development","dataRoot":"/","execution":{"backend":"docker","provider":"zai","model":"m"}}'
|
||||||
|
expect_exit "filesystem root dataRoot exits 2" 2 -- \
|
||||||
|
env MOSAIC_CONFIG="$SANDBOX/root.json" $CONFIG_OP validate
|
||||||
|
|
||||||
|
cfg home.json '{"configVersion":1,"environment":"development","dataRoot":"'$HOME'","execution":{"backend":"docker","provider":"zai","model":"m"}}'
|
||||||
|
expect_exit "home directory dataRoot exits 2" 2 -- \
|
||||||
|
env MOSAIC_CONFIG="$SANDBOX/home.json" $CONFIG_OP validate
|
||||||
|
|
||||||
|
cfg cfgdir.json '{"configVersion":1,"environment":"development","dataRoot":"'$SANDBOX'","execution":{"backend":"docker","provider":"zai","model":"m"}}'
|
||||||
|
expect_exit "dataRoot containing config dir exits 2" 2 -- \
|
||||||
|
env MOSAIC_CONFIG="$SANDBOX/cfgdir.json" $CONFIG_OP validate
|
||||||
|
|
||||||
|
cfg ctrlchar.json '{"configVersion":1,"environment":"development","dataRoot":"'$DATA_ROOT'","execution":{"backend":"docker","provider":"z\nai","model":"m"}}'
|
||||||
|
expect_exit "control character in provider exits 2" 2 -- \
|
||||||
|
env MOSAIC_CONFIG="$SANDBOX/ctrlchar.json" $CONFIG_OP validate
|
||||||
|
|
||||||
|
cfg symlink.json 'placeholder'
|
||||||
|
ln -sf "$SANDBOX/invalid.json" "$SANDBOX/symlink.json"
|
||||||
|
expect_exit "symlinked config file exits 2" 2 -- \
|
||||||
|
env MOSAIC_CONFIG="$SANDBOX/symlink.json" $CONFIG_OP validate
|
||||||
|
|
||||||
|
# --- env resolution ---
|
||||||
|
cfg valid.json "$(valid_body "$DATA_ROOT")"
|
||||||
|
EVAL_OUT="$(MOSAIC_CONFIG="$SANDBOX/valid.json" $CONFIG_OP env)" || true
|
||||||
|
if eval "$EVAL_OUT" 2>/dev/null && [ "$MOSAIC_DATA_ROOT" = "$DATA_ROOT" ] \
|
||||||
|
&& [ "$MOSAIC_PROVIDER" = "zai" ] && [ "$MOSAIC_MODEL" = "glm-5.3-flash" ]; then
|
||||||
|
PASS=$((PASS+1)); echo "ok env exports resolve correctly"
|
||||||
|
else
|
||||||
|
FAIL=$((FAIL+1)); echo "FAIL env exports resolve correctly"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# --- validation must not modify the file ---
|
||||||
|
SUM_INVALID_BEFORE=$(sha256sum "$SANDBOX/invalid.json" | cut -d' ' -f1)
|
||||||
|
MOSAIC_CONFIG="$SANDBOX/invalid.json" $CONFIG_OP validate >/dev/null 2>&1
|
||||||
|
SUM_INVALID_AFTER=$(sha256sum "$SANDBOX/invalid.json" | cut -d' ' -f1)
|
||||||
|
if [ "$SUM_INVALID_BEFORE" = "$SUM_INVALID_AFTER" ]; then
|
||||||
|
PASS=$((PASS+1)); echo "ok failed validation modified nothing"
|
||||||
|
else
|
||||||
|
FAIL=$((FAIL+1)); echo "FAIL failed validation modified the file"
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo
|
||||||
|
echo "selftest: $PASS passed, $FAIL failed"
|
||||||
|
[ "$FAIL" -eq 0 ]
|
||||||
@@ -17,6 +17,12 @@ source scripts/common.sh
|
|||||||
IMAGE="mosaic-poc-agent:0.84.4"
|
IMAGE="mosaic-poc-agent:0.84.4"
|
||||||
EXPECTED="${EXPECTED_MARKER:-MOSAIC_HELLO_OK}"
|
EXPECTED="${EXPECTED_MARKER:-MOSAIC_HELLO_OK}"
|
||||||
|
|
||||||
|
load_config
|
||||||
|
|
||||||
|
# Ensure the configured data root exists (host-owned) before the mount,
|
||||||
|
# otherwise Docker would auto-create a root-owned directory.
|
||||||
|
bootstrap_runtime_dir
|
||||||
|
|
||||||
# 1. Build the image only if it is not already present.
|
# 1. Build the image only if it is not already present.
|
||||||
if ! docker image inspect "$IMAGE" >/dev/null 2>&1; then
|
if ! docker image inspect "$IMAGE" >/dev/null 2>&1; then
|
||||||
echo "verify: image $IMAGE not found, building..." >&2
|
echo "verify: image $IMAGE not found, building..." >&2
|
||||||
|
|||||||
Reference in New Issue
Block a user