diff --git a/BUILD-LOG.md b/BUILD-LOG.md index 244b37354..8752e17eb 100644 --- a/BUILD-LOG.md +++ b/BUILD-LOG.md @@ -5483,3 +5483,5 @@ remain; no live state, schema or bus policy change. 2026-10-23 | Beakley (88b97f65) | Row 217 early-look follow-up, Untested | Webby 0939c0682 E1 adds ordinary mallory human-swap test; E2 adds stored trailer-derived agent/file event evidence; E6 creative-sender matrix and E7 runtime readRaw tests authored. Sage-3668/3670 accepts direct writer substitution because setter keys exclude replyLimits (organization.set exists, correcting review premise), and requires distinct availability refusal for E4. Real held-lock/socket and runner-reason regressions plus M5 authored before that production fix; expected RED awaits Sage CLEAR. No Node/tests/mutants, no old-test edits, no green claim. 2026-10-24 | Beakley (88b97f65) | Row 217 round 2, sage-4037 | Rebased published dde5b8496 onto e0c6142f3 on new beakley/row217-r2; both append-log histories retained. Conflicts preserve landed grant dispatch, revocation hook and lookup exports. Added E4 citation-unavailable product path and real supporting-scope/index comparison tests after row283 8d2856ee3. Untested: no Node/npm/tests/mutants/build; ready for Sage CLEAR after Lena296. Full range-diff and honest discarded local rebase correction in agents/beakley/work/queue-217/BUILD.md. + +2026-10-24T10:21Z | Beakley (88b97f65) | Row 217 round2 slot verified, sage-4042/4043 | Source 2d274a5b6: touched57/57, whole library142/142 business270/270 bus974/974 cli988/988 harness172/172 seat218/218, all zero fail/skip/cancel. M1-M5 killed, controls/restored controls green, product hashes restored after each; E4 RED stand-in observed. Only first-red was new runtime fixture invalid-authority, corrected and retained in receipts; no old test failed/edited. Local root/webui npm ci, short TMPDIR, timeout-k10; no canonical npm/rm or module link. Full evidence agents/beakley/work/queue-217/run-r2; Sage owns scripts landing gate and formal review. diff --git a/agents/beakley/work/queue-217/BUILD.md b/agents/beakley/work/queue-217/BUILD.md index 02fcfe9ca..547283d5f 100644 --- a/agents/beakley/work/queue-217/BUILD.md +++ b/agents/beakley/work/queue-217/BUILD.md @@ -1,9 +1,9 @@ # Row 217 — C2-06 citation guard, page store and runner retry Owner: Beakley (88b97f65-97db-4f05-8c6e-081f92bc3501), assigned by Mos Q245. -Issue: #1718. Reviewer: Webby. Branch: `beakley/row217`. +Issue: #1718. Reviewer: Webby. Current branch: `beakley/row217-r2` (original `beakley/row217` preserved). Brief: `docs/plans/2026-10-20_case2-rows.md`, C2-06. -Status: Untested draft on Launchpad handoff `e25ef0373`; targeted execution awaits Sage CLEAR. +Status: six whole suites green and M1–M5 killed under sage-4042/4043; ready for formal review. Landing scripts and integration remain Sage's. ## Plan and boundaries @@ -256,3 +256,59 @@ checkout product hashes after every mutant and reruns the restored control. Optional name filters allow the E4 M5 RED before the full mutant pass. No canonical dependency link is used; isolated copies link only this worktree's own dependency install. + + +## Final slot results / 2026-10-24 10:21Z + +All requested runs completed serially under sage-4042/4043 on source revision +`2d274a5b6`. Final receipt commits change only tracking and logs, not packages. + +| Whole suite | Pass | Fail / skip / cancel | +| --- | ---: | --- | +| library | 142 | 0 / 0 / 0 | +| business | 270 | 0 / 0 / 0 | +| bus | 974 | 0 / 0 / 0 | +| cli | 988 | 0 / 0 / 0 | +| harness | 172 | 0 / 0 / 0 | +| seat | 218 | 0 / 0 / 0 | + +Total 2,764 whole-suite tests. Touched files rerun 57/57. The unchanged +RUNNER_FILES import-closure test passed in seat (seat-suite.log:153). The only +first-run failure was the NEW runtime fixture already recorded above; no old +test failed and no test present at e0c6142f3 was edited. + +M1–M5 all killed by the intended assertion, each with Node exit1, a green +control and green restored control. Driver exit0. M1 catches missing writer +refusals; M2 is killed by mallory's human swap; M3 detects one message left +behind after evidence failure; M4 detects the missing reason; M5 detects +citation-invalid in place of citation-unavailable on contention and bad state. +Every mutation was in a disposable HEAD archive. Each changed file was restored, +checkout product hashes checked after every mutant, and the restored control +rerun. All five final restored.sha256 certificates match current product files. +M5 also ran separately before the whole suites as the authorized pre-fix RED +stand-in; its held-lock and malformed-state assertions failed, then restored +E4 passed 3/3. Full raw controls/negatives/restores are retained. + +Receipts: run-r2/summary.json and summary.txt; *-suite.log; touched-first.log, +touched-rerun.log; availability-green.log; runtime-fixture-retry.log; npm-root.log +and npm-webui.log; m1-anchors.txt; m5-red/ and mutants/. All are text, no binary +artifact added. All Node/mutant/npm runs used the short TMPDIR and timeout -k 10. +Both node_modules trees are local npm ci installs. No canonical npm/rm or +canonical dependency link. No further runtime/source changes after the tests. + +Acceptance formerly waiting on dependencies is executed: real row283 supporting +canon refusal and supporting/agent event pass; the C2-05a readLibrary/index set +comparison passes; runtime readRaw live/corrupt/missing-file test passes; runner +retry request carries the E4 availability reason. The repeat obsolete-name +search finds only render.mjs:6 and render.test.mjs:58, owned by row225; no owned +hit. First-library selection remains the accepted E5 limitation. Webby-0274 N1 +is a nonblocking wording limitation: configuration faults share the safe +busy-or-unavailable retry text. No policy/schema restriction was invented. + +Current complete changed-file manifest over e0c6142f3..candidate is +candidate-manifest.sha256, excluding itself to avoid a circular hash. It includes +source, tests, records and evidence. Earlier numbered manifests are historical. +Formal Webby verdict and all scripts/test-*.sh at landing remain Sage's steps; +this is verified for review, not an integration/deployment claim. + +Exact negative-test logs retain Node's whitespace-only diagnostic lines. Whole diff --check reports those 12 blank-line padding warnings in run-r2 logs; source/docs diff --check excluding captured run-r2 evidence is clean. No source whitespace problem or test failure is hidden by that exclusion. diff --git a/agents/beakley/work/queue-217/MANIFEST.md b/agents/beakley/work/queue-217/MANIFEST.md index 03f03399e..65d94b741 100644 --- a/agents/beakley/work/queue-217/MANIFEST.md +++ b/agents/beakley/work/queue-217/MANIFEST.md @@ -1,87 +1,61 @@ -# Row 217 draft manifest — Untested +# Row 217 round 2 — verified for review -Issue #1718, Case 2 C2-06. Base `45dca69f6`, continued from Launchpad -`e25ef0373`. This is a checkpoint for static review, not an in-review or -acceptance claim. `manifest.r1.sha256` freezes the product and test files. +Issue #1718, C2-06. Base e0c6142f3; branch beakley/row217-r2. Continued +Launchpad e25ef0373 through the preserved original dde5b8496 branch. Range-diff, +conflict resolutions and acceptance receipts are in BUILD.md. Tested source +revision: 2d274a5b6; the final commits add records/evidence only. -## Product scope +The broker checks agent-to-human citations before insertion, stores trusted +scope/agent/file evidence atomically with the message, and supplies per-path last +on thread reads. It keeps session-local fetched pages and reads reply settings +live through the M11 human-only writer. The runner preserves cited JSON, defers +notes on fixed replies, and retries once with the refusal code and safe reason. +E4 adds citation-unavailable for mirror/state/lock faults; uncited/web-only/fixed +bodies do not need the mirror lock. Supporting scope uses landed row283 code. -| Path | Change | -| --- | --- | -| packages/library/src/guard.mjs | Schema and seven checks, real cited-commit reads, origins and latest path commits | -| packages/library/src/limits.mjs | Pure defaults, validation and conservative unreadable-file fallback | -| packages/library/src/reply-protocol.mjs | Import-free guard codes and four runner fixed texts | -| packages/library/src/index.mjs | Guard and limits exports | -| packages/business/src/business.mjs | Permit any replyLimits value without widening another schema | -| packages/business/src/organization.mjs | M11 fence on input and serialized output, human setter, raw live reader | -| packages/bus/src/broker.mjs | Async pre-insert guard, atomic existing-kind check event, per-session pages, settings verb/status, optional library claim flag and read-time last evidence | -| packages/bus/src/runtime.mjs | Inject guard/live limits/last and dispatch human setter (sage-3595) | -| packages/bus/src/server.mjs | Await guarded sends and thread reads; optional guard reason (sage-3599) | -| packages/bus/src/client.mjs | Preserve optional capped reason (sage-3599) | -| packages/harness/src/runner.mjs | Library texts, one retry, JSON note/clip behavior and retry usage tracking | -| packages/seat/src/sandbox.mjs | Exactly one read-only RUNNER_FILES addition for the pure protocol (sage-3640) | -| packages/cli/src/limits.mjs | Human limits replies file command | -| packages/cli/README.md | Reply settings usage | +## Product and test scope -No dependency, SQL schema, event kind, role authority or credential changes. -The additional sandbox file carries only constants and has no imports. +The package paths listed in candidate-manifest.sha256 are exactly this row's +base-to-candidate changes. Fourteen product paths cover library guard/limits/ +protocol/exports; business validation/writer; bus broker/runtime/server/client; +CLI command/README; runner; and the single approved pure-protocol sandbox mount. +Nine test/helper/fixture paths are additions. No existing test is modified. +The mounted protocol stays import-free. Runtime retains the landed grant/query/ +sync behavior; the writer retains beforeWrite/revoked handling and fences before +revocation. No SQL schema, event kind, role authority or credential change. -## New tests and fixtures +## Executed evidence -| Path | Acceptance focus | -| --- | --- | -| packages/library/tests/guard.test.mjs | Seven table checks, cap boundaries, real Git origins/reachability/literal names, web quotes and limits fallback | -| packages/business/tests/reply-limits.test.mjs | Human-only M11, old-human comparison, dotted agent identity, serialization, invalid values and raw reads | -| packages/bus/tests/citation-helpers.mjs | Shared made-up repository and real broker fixture | -| packages/bus/tests/citation-guard.test.mjs | Refusal insertion counts, transaction failure, live settings/status, page bounds, socket envelopes, file/last and async snapshot | -| packages/cli/tests/reply-limits.test.mjs | Revision read, exact setter args and usage refusals | -| packages/harness/tests/fixtures/citation-adapter.mjs | Scripted local harness, typed calls and unslop events | -| packages/harness/tests/citation-runner.test.mjs | Every RESULT refusal and typed send_message, one retry, both size caps, plain multibyte answers, fixed texts and notes, old non-library behavior | +| Whole suite | Pass | Fail / skip / cancel | +| --- | ---: | --- | +| library | 142 | 0 / 0 / 0 | +| business | 270 | 0 / 0 / 0 | +| bus | 974 | 0 / 0 / 0 | +| cli | 988 | 0 / 0 / 0 | +| harness | 172 | 0 / 0 / 0 | +| seat | 218 | 0 / 0 / 0 | -No existing test changed. Existing role.claim pins and the seat import-closure -test stay untouched. Existing test numstat: none. +Touched files 57/57; total whole suites 2,764. First run was 56/57 due solely +to a new runtime fixture missing the broker's resolved authority shape. Only +that new fixture changed; single and full touched reruns passed. No old test +failed. First-red evidence remains in run-r2/touched-first.log. -## Review focus and outstanding evidence +M1–M5 killed: missing M11 fences, incoming-human trust, split check transaction, +dropped client reason, and hidden library availability. Every negative run has +green control/restored runs and matching restored product certificates. M5 is +also the authorized E4 pre-fix RED stand-in. Supporting canon refusal, stored +supporting/agent evidence, the C2-05a index comparison, runtime raw settings and +agent-visible E4 retry reason all pass. The unchanged sandbox closure test passes. -The check event and message insert must roll back together. Scope/agent/file -come from Git; `last` is read once per distinct path per read. Guard refusals -alone have a reason, bounded at 300 characters without quote or URL content. -Captured arguments must be the ones inserted after async validation. Every -plain or JSON length refusal shares the same single retry budget. +Commands ran serially under Sage CLEAR with short TMPDIR and timeout -k 10. +Root/webui dependencies came from local npm ci, never canonical links. Full logs, +summary.json and mutant certificates are in run-r2/. The complete changed-file +manifest candidate-manifest.sha256 covers e0c6142f3..candidate, excluding itself; +its SHA256 is supplied with the pushed tip. Historical manifests stay untouched. -All tests and four isolated mutants are unrun pending Sage CLEAR. The supporting -scope tests require row 283; the index-set comparison requires row 216; runtime -drift must be checked against 216/285 before in-review. Landing follows 283. -Full gate: library, business, bus, cli, harness and seat, plus every -scripts/test-*.sh. Webby reviews the final tested manifest; Sage owns the gate, -queue and landing. No push to a protected branch is authorized. +## Remaining boundaries - -## Early-look follow-up packet (manifest.r2.sha256) - -Tests-only follow-up to Webby 0939c0682. Adds ordinary-actor M2 discrimination, -stored agent/file evidence at an unrelated tip, creative-sender table coverage, -and real runtime readRaw coverage. New citation-availability.test.mjs and runner -availability case are intentionally unrun regressions for E4/sage-3668/3670. -Production availability handling is not implemented yet: run that targeted RED -on CLEAR before applying its fix, then rerun the same cases. M5 restores the -catch-all. This packet is not ready for a green gate or manifest approval. - - -## Round 2 on e0c6142f3 (manifest.r4.sha256) — Untested - -New branch beakley/row217-r2 preserves the old published branch. Conflict -resolutions and complete range-diff are in BUILD.md/rebase-r2.range-diff.txt. -The E4 fix adds citation-unavailable for non-absence mirror/state/lock failures; -the runner gets the fixed safe reason through the existing optional reason field -and uses its single retry. No fifth fallback body or SQL change. Replies without -library cites bypass mirror reads, preserving fallback delivery during contention. -The prior E4 regressions and M5 have not run. Sage-4037 explicitly authorizes -this untested implementation before the test window. - -Supporting tests now use row 283's real supporting classification and assert -canon refusal plus stored supporting/agent evidence. An index-set comparison -test now uses the landed C2-05a index. No base test was edited. Before acceptance, -run the approved new tests and required suites/mutants under Sage CLEAR. npm ci -must create worktree-local installs at root and packages/webui, never canonical -links. The candidate is ready for CLEAR; no passing behavior is claimed. +Sage runs every scripts/test-*.sh at landing and posts the formal Webby review +request. No merge/deployment performed. First-library selection remains the +accepted limitation; configuration faults share the safe unavailable reason +(Webby N1, nonblocking). Obsolete-name search hits only row225's render files. diff --git a/agents/beakley/work/queue-217/candidate-manifest.sha256 b/agents/beakley/work/queue-217/candidate-manifest.sha256 new file mode 100644 index 000000000..99cc24f1f --- /dev/null +++ b/agents/beakley/work/queue-217/candidate-manifest.sha256 @@ -0,0 +1,80 @@ +74398edcedf16a3d856ab9e7ea900eb61a4df7f726f04b74b2ff123e7536e9c1 BUILD-LOG.md +87880c30c2be0180e6eec4dbe203f86e93ae2b1b4be44031b6a4903c6245a0ec agents/beakley/work/queue-217/BUILD.md +e7ecf624ccb2b918efb08001ae9da36380fe918f8c27db704860809b6792e6f2 agents/beakley/work/queue-217/MANIFEST.md +f4a042b5d6d393d2be62b107d7157ae51dd8fbf36f4360f5cd8cf07c03c74251 agents/beakley/work/queue-217/manifest.r1.sha256 +53f051a4e416a34181ad9bcc7687f0d686274542b06d9758e2db7eb81e848811 agents/beakley/work/queue-217/manifest.r2.sha256 +f96fccc566d01d70db32188574d0b5331ef3c90bce66558449a51b3f21da1b29 agents/beakley/work/queue-217/manifest.r3.sha256 +faf8ec3e0ab458fe95120345ec93e077b0dcad9458c0f2683a20effb6ce3ed93 agents/beakley/work/queue-217/manifest.r4.sha256 +a58f0e273b60508b95c833cbace26799d7aa935117fd1f9a27812fba65b93d54 agents/beakley/work/queue-217/manifest.r5.sha256 +120b15db5eb75897095fe3d0759553e482365d58061d763beba7754a6e0d0734 agents/beakley/work/queue-217/manifest.r6.sha256 +04a9d0585b5ae4818d87d67ac27f838355f1a6f586625a16cf01d91d7bb6d4a0 agents/beakley/work/queue-217/mutants.py +4a5f7b3373fd3ff46e2d6a5f7ee7106ad76a71c9034ca5a44b9e7340f0cc4cff agents/beakley/work/queue-217/rebase-r2.range-diff.txt +630070b0d682120ba64b382ab3b47b3fa3e8f0bcfc695ca09432d01d705fbcb3 agents/beakley/work/queue-217/run-r2/README.md +c4245272d5fc89c5fd3a9ea979e7d65727ea76e24364190af57556c59ad2fe34 agents/beakley/work/queue-217/run-r2/availability-green.log +700fff38b0a99ffdb44863f13015673cb459e5e645c5df46580eafbc407c95c8 agents/beakley/work/queue-217/run-r2/bus-suite.log +ef216d0af325c2b6647eb8405e5de70ebb5a0e7a28bb3d8fe3abc6a289a8d3d2 agents/beakley/work/queue-217/run-r2/business-suite.log +af173117f83359ebba62c5c00eadc749bb179551a8e290bcf55bbe39b1e7272c agents/beakley/work/queue-217/run-r2/cli-suite.log +a615f69ba60859e9d7817f3353b0d7c71e6c12eecc3ecf0f630d473be21e5fef agents/beakley/work/queue-217/run-r2/harness-suite.log +acaa08001101fd69a12cae377984e0d469c2cedc2affb5ccf9af426a72549dcc agents/beakley/work/queue-217/run-r2/library-suite.log +5414ce5b94e7ac7918ed64f62e5fd2b921d49c7e93cf73042b9187d014069934 agents/beakley/work/queue-217/run-r2/m1-anchors.txt +7d7138b25568adb98932bbe180a337fe6798c3eddcd7134ce7278c24fea48818 agents/beakley/work/queue-217/run-r2/m5-driver.log +de7dd716d3981fd9fa1d114882e60f9a83736cdb8f8e2096c3913c9f8620238a agents/beakley/work/queue-217/run-r2/m5-red/M5-hide-library-unavailable-control.log +6b98d3943d04d99f3ef212f11901d2257422410c477abec27ed3100a0d20dad9 agents/beakley/work/queue-217/run-r2/m5-red/M5-hide-library-unavailable-restored-green.log +a58f0e273b60508b95c833cbace26799d7aa935117fd1f9a27812fba65b93d54 agents/beakley/work/queue-217/run-r2/m5-red/M5-hide-library-unavailable-restored.sha256 +d852a464fd624ce12d8d6bdc9800402639bb500a6d40c628cb836ca1bcf1e326 agents/beakley/work/queue-217/run-r2/m5-red/M5-hide-library-unavailable.log +7d7138b25568adb98932bbe180a337fe6798c3eddcd7134ce7278c24fea48818 agents/beakley/work/queue-217/run-r2/m5-red/summary.txt +1c405f1f15d2ce2db37b5809cdf5eaff68f18c99c5621e1c43262a289c5e35c4 agents/beakley/work/queue-217/run-r2/mutants-driver.log +c96487e87c1ae9e34a7222b04701c5efcce25fe201f03a0213b989f7cde2c376 agents/beakley/work/queue-217/run-r2/mutants/M1-writer-fence-control.log +8b294ecc057ad64ace7f520a1785b54df7df5a9eddf962813c3e5f8fa723ffd4 agents/beakley/work/queue-217/run-r2/mutants/M1-writer-fence-restored-green.log +120b15db5eb75897095fe3d0759553e482365d58061d763beba7754a6e0d0734 agents/beakley/work/queue-217/run-r2/mutants/M1-writer-fence-restored.sha256 +be749486956e85a71f08107139613e09b62c53b58e8cc10e0fbe807e95d079a6 agents/beakley/work/queue-217/run-r2/mutants/M1-writer-fence.log +525da1cc780dfea1a66f95739d444516bd16271c7ec539d615012ec9c8e7c139 agents/beakley/work/queue-217/run-r2/mutants/M2-incoming-human-control.log +3546705980bb4a73295f16e42ab55f38c6adca9a5c53252264ae4ef66c595dfc agents/beakley/work/queue-217/run-r2/mutants/M2-incoming-human-restored-green.log +120b15db5eb75897095fe3d0759553e482365d58061d763beba7754a6e0d0734 agents/beakley/work/queue-217/run-r2/mutants/M2-incoming-human-restored.sha256 +77352c22c459c516ff47ff1caa42fe9763fe201a04079646b0ccc0da6a145804 agents/beakley/work/queue-217/run-r2/mutants/M2-incoming-human.log +58de145ec0384de4f560b28dcfa76e98c384be5c771d6561fb1054f07ea8166b agents/beakley/work/queue-217/run-r2/mutants/M3-split-check-transaction-control.log +6a4cd0ef36b0d2318ef71c941ce300d215b6d2f87d0b4328c461ba53d812434c agents/beakley/work/queue-217/run-r2/mutants/M3-split-check-transaction-restored-green.log +120b15db5eb75897095fe3d0759553e482365d58061d763beba7754a6e0d0734 agents/beakley/work/queue-217/run-r2/mutants/M3-split-check-transaction-restored.sha256 +2deb72f2d442f413fd06e205093f6fa3f955ec6ef707b7ca65b86be8c8883f9b agents/beakley/work/queue-217/run-r2/mutants/M3-split-check-transaction.log +31cac91f43c8b7ebe0431f27a038b0fcd554a12b232592747f3972213cfa192b agents/beakley/work/queue-217/run-r2/mutants/M4-drop-client-reason-control.log +e06c1da8dcd9e7eb013a4597b14369e296e21b812476bd6d88c7a7aa040d4065 agents/beakley/work/queue-217/run-r2/mutants/M4-drop-client-reason-restored-green.log +120b15db5eb75897095fe3d0759553e482365d58061d763beba7754a6e0d0734 agents/beakley/work/queue-217/run-r2/mutants/M4-drop-client-reason-restored.sha256 +66d8f72df3bc0428624dab437cb04923ecab42055d29c6ffde43af98d47f32ae agents/beakley/work/queue-217/run-r2/mutants/M4-drop-client-reason.log +3f74fbd3b4297868b9bb637a7924739363470964873a4bd3dc2f5daf2d0e9c8a agents/beakley/work/queue-217/run-r2/mutants/M5-hide-library-unavailable-control.log +96d95a45d5326e614328531a7dadebce5d3ce70e40ec23dd49a66c1a676b45be agents/beakley/work/queue-217/run-r2/mutants/M5-hide-library-unavailable-restored-green.log +120b15db5eb75897095fe3d0759553e482365d58061d763beba7754a6e0d0734 agents/beakley/work/queue-217/run-r2/mutants/M5-hide-library-unavailable-restored.sha256 +fa57189e9de99c4a76be27da3b857c07fc76706f7d0ee7409ba4efd43c3642b7 agents/beakley/work/queue-217/run-r2/mutants/M5-hide-library-unavailable.log +1c405f1f15d2ce2db37b5809cdf5eaff68f18c99c5621e1c43262a289c5e35c4 agents/beakley/work/queue-217/run-r2/mutants/summary.txt +862418d3d4124871ca5fcaf35e16c318a04e2888da83836751ddfea110efeb06 agents/beakley/work/queue-217/run-r2/npm-root.log +38b75d8bddacf8d227883a29dd8a10f87a7f02d8a95f3f8809cb966fc9c8cf7a agents/beakley/work/queue-217/run-r2/npm-webui.log +7f29b5a328fd6be61ebc4110a048305b50856810ab97a7798cd427924d74e8c9 agents/beakley/work/queue-217/run-r2/runtime-fixture-retry.log +3bd51fe222a61412e8285eb522a2f7b5c1b0b035f7dca0e9ff66190bd53e6706 agents/beakley/work/queue-217/run-r2/seat-suite.log +8b98c6ba76de46ddd858b4b95bae7bce2d1bf969edb85901ad8819e1280869a1 agents/beakley/work/queue-217/run-r2/summary.json +e374cb7ab28a46dd560b267b0fe6691b11c0c2fabd00087c4e49a02ab1bf8086 agents/beakley/work/queue-217/run-r2/summary.txt +ad2022c7ccdfa151e029eed92cd309369a97f197d9304775f6d2be3dc5f11080 agents/beakley/work/queue-217/run-r2/touched-first.log +e1fe5ebae1a36f196470848bf27b99c21d316c9236a1d1328d7bcaca0ee4d3e9 agents/beakley/work/queue-217/run-r2/touched-rerun.log +0c1b1f079b4b993e8d1aeb730d743e28696413eae8be6dd79731d749d1d45d0b agents/launchpad/work/queue-217/BUILD.md +76b0a5785f134c09cda677e8f5fb3e7454b39883c4a6f55360d9d277476fcd2c docs/SESSIONS.md +eeca81ab965f9e94f930ee5f51d16f019af6368bc6c3994895e204f7a54ec8d2 packages/bus/src/broker.mjs +ad3c686a089f67f3c89610937c6fc9b32367cea5d9735125d89bef042082d4e8 packages/bus/src/client.mjs +36b05dd3119e5929211aa1cc5d45c5043f5a1c34567ddc7cac8f002835d44abe packages/bus/src/runtime.mjs +66b26d131a19f4f411686427274936850c1ff0aed11e9b281ae4aadcf4b289fc packages/bus/src/server.mjs +cdd0304ec25ef1ad3e31c52502fa46f2c80bd77c8d3c2e13f8ed4b5328f342c9 packages/bus/tests/citation-availability.test.mjs +2e05074cd9d15d810103658af3858161cee2af78b0a2e1ba910222fab3e84401 packages/bus/tests/citation-guard.test.mjs +2c7a2102e2e0244876e41b664f4f706baefe3375100b956655551db1230f5da3 packages/bus/tests/citation-helpers.mjs +9768b6dc5ae078c5cc4f76473097287b74c5bc5853d39e1f57f153e646f861af packages/bus/tests/citation-runtime.test.mjs +abaeac64f2c3bf8ba83c9a4488edd9105c4707a6564560c5333d5421445653af packages/business/src/business.mjs +3a6044de5d1ca2cc35c5285b460c3e402b4274837e5d88b97f489797f6004903 packages/business/src/organization.mjs +4d2eb11beaa80175e524af1b95c81e7164990fba1d3e1754f5ba06eee390a14f packages/business/tests/reply-limits.test.mjs +a2bb98734bcc2556f8b2168f0faf8a89f7064c3f0aa49feb7d1975d596192f09 packages/cli/README.md +2f291a71f490f2741edada7a3e3788500f8976a08eb8ab1411f6c5982f778260 packages/cli/src/limits.mjs +f38af2d46d5f5f6388f599912507b94b87a0bf9dcc2104bb2187c38ee35118d5 packages/cli/tests/reply-limits.test.mjs +6ad72b4245e0a66e32725941900c1ece64c2e5de2fb73d65c8e042b4f3a691a6 packages/harness/src/runner.mjs +a5ef1b65230239a7baf6d0e8f2b8a51c0516348c7c4339a55b3f0a1a6ff531ba packages/harness/tests/citation-runner.test.mjs +330bc71bf6c7e64d3ddb70440903d2d9acf7878d44a49d7e30c2352ee4c807ec packages/harness/tests/fixtures/citation-adapter.mjs +f710d9600a17f6e2989a289cfe84e58f161d86c7306605946ce05fa71b364eb2 packages/library/src/guard.mjs +c0d630798914e300e461c247340533328e97119e54909c6a9406340e61fed8b7 packages/library/src/index.mjs +98ef45ed61144aaea44d8aea1ac43082b6d340297e46846d01772da38728e530 packages/library/src/limits.mjs +7b46f47b5e9d6b554b5d39bce2cd95c4610f5f35b8ab8fdc5a2864b3214be809 packages/library/src/reply-protocol.mjs +406146ebbce3710f308243b684a1c17e7626c1b65a4468489364317e31537a48 packages/library/tests/guard.test.mjs +39c8e6c8250a13fa43015fb2c407195e30ee642f729a9f6a644c38b4ea758a72 packages/seat/src/sandbox.mjs diff --git a/agents/beakley/work/queue-217/run-r2/README.md b/agents/beakley/work/queue-217/run-r2/README.md new file mode 100644 index 000000000..b95feaa6a --- /dev/null +++ b/agents/beakley/work/queue-217/run-r2/README.md @@ -0,0 +1,30 @@ +# Row217 round2 test receipts + +Sage CLEAR sage-4042/4043, 2026-10-24. Source revision 2d274a5b6. All runs +serialized; source files stayed unchanged through the whole-suite and mutant pass. +Commands used TMPDIR=/mnt/storage/scratch/tmp/tNoueZ and timeout -k 10. + +- npm ci --ignore-scripts --no-audit --no-fund at the worktree root (300s bound), + then packages/webui (300s). Actual directories, no canonical links. +- node --test packages/bus/tests/citation-availability.test.mjs (180s). +- python3 agents/beakley/work/queue-217/mutants.py M5-hide-library-unavailable + (420s). Green control, the authorized pre-fix RED stand-in, restore+green. +- node --test --test-concurrency=1 with the seven new test files (900s): + library/guard, business/reply-limits, cli/reply-limits, bus/citation-availability, + bus/citation-guard, bus/citation-runtime and harness/citation-runner. Whole files. +- First attempt 56/57: new runtime fixture invalid-authority. Only that fixture + was corrected to the established broker projection. runtime-fixture-retry.log + is its 1/1 rerun (180s); touched-rerun.log is the whole-file 57/57 rerun. +- npm test in packages/library, then business (900s each), bus and cli (1200s + each), harness and seat (900s each). Never overlapped package runs. +- python3 agents/beakley/work/queue-217/mutants.py (900s). + The driver wraps each Node run in timeout -k 10 120. Each negative exits1, + is preceded by a green control, restores its product bytes/hashes and then + reruns the restored control green. No checkout product file is mutated. + +summary.json holds complete counts; summary.txt is the short version. M1 anchors +are recorded in m1-anchors.txt. The five *-restored.sha256 files match current +product files. Full outputs are retained, including the first new-test failure. +Negative logs intentionally keep Node's whitespace-only diagnostic padding; +standard git diff --check flags that padding, not source code. No binary logs. +No old test failed or was edited. Sage runs scripts/test-*.sh at landing. diff --git a/agents/beakley/work/queue-217/run-r2/availability-green.log b/agents/beakley/work/queue-217/run-r2/availability-green.log new file mode 100644 index 000000000..1d7a4f262 --- /dev/null +++ b/agents/beakley/work/queue-217/run-r2/availability-green.log @@ -0,0 +1,11 @@ +✔ C2-06 held library lock gives the agent citation-unavailable and its retry reason (5142.976705ms) +✔ C2-06 malformed sync state is availability failure, never a fabricated invalid cite (33.874404ms) +✔ C2-06 no mirror or freshly initialized empty mirror still means no served citation (33.746516ms) +ℹ tests 3 +ℹ suites 0 +ℹ pass 3 +ℹ fail 0 +ℹ cancelled 0 +ℹ skipped 0 +ℹ todo 0 +ℹ duration_ms 5307.376982 diff --git a/agents/beakley/work/queue-217/run-r2/bus-suite.log b/agents/beakley/work/queue-217/run-r2/bus-suite.log new file mode 100644 index 000000000..7fe478358 --- /dev/null +++ b/agents/beakley/work/queue-217/run-r2/bus-suite.log @@ -0,0 +1,1030 @@ +npm notice run test +npm notice run node --test tests/*.test.mjs +✔ R4: the timer sweep after a hand edit ends only the lost user's run; its next call refuses thread-revoked (80.385083ms) +✔ R4: an expiry with no write and no request ends the run at the next timer sweep (54.414178ms) +✔ R4: a downgrade to viewer is a loss (46.01675ms) +✔ R4: another user's request after a hand edit ends the lost user's run, and its own run stays (48.275746ms) +✔ R4: a request reads the access file only when its stamp changed, once per change (52.427643ms) +✔ R4: access.reload ends the lost runs at once for the human; the tester, a reader, an agent and a user are refused (58.18768ms) +✔ R4: threadsState marks revoked: true on the lost user's thread only, a pending message included (40.598918ms) +✔ R4: threadsState after an expiry with no write and no sweep ends the claim before it marks the row revoked (51.431027ms) +✔ R4: a new run of a revoked thread refuses thread-revoked at bind and at claim; a rebind is allowed (40.590956ms) +✔ R4 runtime: a hand edit ends the run at the first timer period, intervalMs is checked, and close stops the timer (102.233689ms) +✔ REQ-LIMIT-4 3h copy migrates to 3i: every row keeps its seq, the sequence carries over, and only the account CHECK changes (211.272885ms) +✔ REQ-LIMIT-4 a 3h→3i step that fails partway leaves the store at 3h with every row, the sequence and the schema intact (216.815189ms) +✔ REQ-LIMIT-4 the 3h engine refuses a migrated store, migrating or not, and leaves it as it was (188.701001ms) +✔ parseAddress: one (1.876845ms) +✔ parseAddress: many (0.191403ms) +✔ parseAddress: repeat (0.151298ms) +✔ parseAddress: plain (0.248882ms) +✔ parseAddress: stop (0.188786ms) +✔ parseAddress: EOF tag (0.144935ms) +✔ parseAddress: EOF last tag (0.13067ms) +✔ parseAddress: leading whitespace (0.132735ms) +✔ parseAddress: tags only (0.204722ms) +✔ parseAddress: empty (0.300269ms) +✔ parseAddress: whitespace (0.140517ms) +✔ parseAddress: bare at (0.112592ms) +✔ parseAddress: punctuation is a name (0.112192ms) +✔ parseAddress rejects non-text without coercion (0.499463ms) +✔ the mounted address parser has no import dependency (1.06965ms) +✔ agents: a held role with nothing on the bus is idle; a role session gets the claim rows unchanged (46.479586ms) +✔ agents: working counts what the holder received and has not read; routed alone is not working (46.330739ms) +✔ agents: input needed is the role's open decisions routed to the human, gated first, then oldest (84.192172ms) +✔ agents: working wins over waiting, and Input needed still shows (38.25266ms) +✔ agents: a new holder doesn't inherit what the last one left unread; decisions stay with the role (39.258764ms) +✔ agents: state reads only its own business, even for a run name both use (34.307738ms) +✔ agents: a message the holder released unread is stranded; the next holder gets nothing and cannot read it (43.483231ms) +✔ agents: a message the holder read is not stranded; one the current holder has not read is not listed (45.550605ms) +✔ agents: stranded is oldest first and capped at 50 for a role (176.580543ms) +✔ agents: stranded is per role and per business (68.798407ms) +✔ agents: a message routed to a held role and not yet received is not stranded (33.409263ms) +✔ REQ-DEC an approval outlives its run and a broker restart; a new run of the instance consumes it once (67.835912ms) +✔ REQ-DEC another instance of the same definition cannot consume an approval, and its refusal consumes nothing (47.623727ms) +✔ REQ-DEC REQ-THREAD-1 a thread approval is consumed only by a run holding the same thread (65.16544ms) +✔ REQ-DEC a later run of the same instance supersedes an open decision; another instance cannot (47.440247ms) +✔ REQ-DEC REQ-THREAD-1 a thread decision is superseded only from the same thread (47.900435ms) +✔ REQ-DEC REQ-THREAD-1 a thread instance decision raised before row 121 is not consumed or superseded by any thread run (67.518953ms) +✔ launch identity is stamped, payload identity is refused and stale holder cannot send (44.611715ms) +✔ decision classes route from policy; gated resolution is human-only, choice and target must match (62.718106ms) +✔ claim exclusion, holder release, gated revoke and rerouting to a new holder are atomic (71.130948ms) +✔ launch events require a human CLI capability; generic emit cannot forge authority events (35.295226ms) +✔ within-role decisions close atomically and invalid options or blocking omissions refuse (33.317288ms) +✔ a recommendation that is not exactly one option key refuses invalid-recommendation after the options (54.174738ms) +✔ observer capabilities read human inbox but cannot mutate or forge launch identity (39.110767ms) +✔ task action subjects and linked decision trail are complete and ordered (48.952447ms) +✔ launch binding is durable and reconnecting requires the identical trusted record (30.779376ms) +✔ business isolation includes inherited object names and cross-business message references (42.822933ms) +✔ authority never transfers between action, target, unresolved or replaced role holder; a later run of the instance keeps it (54.807279ms) +✔ task projection uses schema current view, skipping earlier and equal-start polls (29.75925ms) +✔ revocation permanently bars the old run from reclaiming first, including after broker restart (46.705505ms) +✔ empty message references refuse before storage; refusal-evidence failure stays a typed error (36.881543ms) +✔ both arbiters require human resolution when their cross-role route is themselves (49.568886ms) +✔ the shipped coder role raises task.reassign as gated to the human; task.scope.change stays cross-role (38.069994ms) +✔ S1 adapter takes resolved limits and refs, rejects mismatched instance, never mutates input (3.472237ms) +✔ channel conversion preserves the four proof/transport byte baselines and modules cannot import a proof caller (2.592591ms) +✔ channel recovery still requires the same shim path and rejects an absent or forged proof (647.199834ms) +organization: {"event":"reload-needs-restart","business":"demo"} +organization: {"event":"reload-needs-restart","business":"demo"} +organization: {"event":"reload-needs-restart","business":"demo"} +organization: {"event":"reload-needs-restart","business":"demo"} +organization: {"event":"reload-needs-restart","business":"demo"} +organization: {"event":"reload-needs-restart","business":"demo"} +organization: {"event":"reload-needs-restart","business":"demo"} +organization: {"event":"reload-needs-restart","business":"demo"} +organization: {"event":"reload-needs-restart","business":"demo"} +✔ REQ-COS-1, REQ-ROLE-2: the chief of staff ends a run with a reason and no decision, and the reason is logged (76.505821ms) +✔ REQ-ROLE-2: a role without role.end still needs a resolved decision to revoke (63.497764ms) +✔ REQ-ROLE-2: storage accepts a revoke with a reason or a decision and aborts one with neither (41.391539ms) +✔ REQ-ROLE-2: the chief of staff may still cite a decision, and a decision alone is the old path (44.971792ms) +✔ REQ-ROLE-2: a role without role.end still ends a run through a resolved decision, which is recorded and has no reason (53.574356ms) +✔ REQ-ROLE-2: a reason is required, bounded, and never sent with a decision (60.44631ms) +✔ REQ-COS-1: the chief of staff cannot end its own run; its end of the assistant stops the assistant's thread run (59.315492ms) +✔ REQ-LIMIT-1, REQ-COS-1: organization.set from the chief of staff reaches the shared writer, named as the actor (44.240359ms) +✔ REQ-LIMIT-1, REQ-COS-1: a refused organization.set logs action.refused and no action.allowed, like a refused limits.set (61.297138ms) +✔ REQ-LIMIT-1: organization.set is refused for every caller whose role file lacks organization.change (66.264121ms) +✔ REQ-LIMIT-1: the chief of staff is logged as allowed, and organization.set takes only the human's keys (65.94125ms) +✔ REQ-COS-1: organization.revision answers the revision alone to the chief of staff and spends nothing (51.774826ms) +✔ REQ-COS-1, REQ-LIMIT-1: organization.revision is refused for every caller whose role file lacks organization.change (69.633779ms) +✔ REQ-ROLE-3, REQ-LIMIT-1: a chief-of-staff change is validated, written and logged like a human's; an invalid one is refused (182.551786ms) +✔ REQ-COS-1: the chief of staff reads the revision, changes the file with it, and reads again after a stale one is refused (165.319843ms) +✔ Q169: the chief of staff's change of the assistant is validated, written and logged; a stale or protection-stripping one is refused (163.022167ms) +✔ row 65, Q169: the chief's change of the assistant's route runs the routing checks, and a valid one saves as the chief (127.723327ms) +✔ REQ-ROLE-2, REQ-COS-1: the 3c→3d migration lets the chief of staff end a held role with a reason; neither is still refused (173.325309ms) +✔ row 194 T10: the chief's reason end of a kept instance refuses instance-kept, holds the claim and spends nothing (46.988024ms) +✔ row 194 T10 (Q2): a role.revoke citing a decision the human resolved still ends a kept run (49.605312ms) +✔ row 194 T10 (B7): the chief's organization.set of a kept instance's model refuses before the writer; the human's limits.set does not (47.581147ms) +✔ row 194 T13: organization.set and limits.set refuse the launch, retired, keep and noHire keys before the writer (50.922561ms) +✔ row 194 T18 (D2.4): from a chief session veto.set and instances.set refuse, and nothing reaches the writer (49.532112ms) +✔ row 194 T8: the chief hires with a reason and no decision, the writer gets the reason as context, and the log names it (43.978345ms) +✔ row 194 T11: on a bus with two businesses, the chief of one hires and fires only in its own (35.469443ms) +✔ row 194 T8: hire and fire need a reason of 1 to 500 characters and refuse a decision key (58.109709ms) +✔ row 194 T8 (sage-1471): only the chief hires or fires; every other role refuses role-not-chief, even one granted the actions (58.17118ms) +✔ row 194 T8 (sage-1471): a chief whose authority lacks role.hire or role.fire refuses decision-required before the writer (85.799423ms) +✔ row 194 T8a: a re-hire of a fired name goes to the writer like a hire, and the writer's refusals pass through by name (49.151281ms) +✔ row 194 T8b: a definition is hireable only when every action is on HIRE_ALLOWED, it is version 2, the chief lists it and noHire doesn't (1437.413154ms) +✔ row 194 T8b: a hire without the role files configured refuses not-configured (44.092856ms) +✔ row 194 T9: a fire revokes the claim, cancels open requests, asks the launcher to kill the runs, then delists and logs (49.950472ms) +✔ row 194 T9a (bus): a fire end's done writes lifecycle.end.killed and lifecycle.end.alive with run and pid, and an unknown stop's reason; a terminate's done or a bad stop refuses (53.514741ms) +✔ row 194 T9: fire refusals come before step A and leave the claim, the requests and the file alone (50.829617ms) +✔ row 194 T9c: a writer failure at B leaves the instance firing, and the repeat delists and logs once (51.590433ms) +✔ row 194 T9c: a failure at C leaves the fire unlogged and the instance firing, and the repeat logs it (50.616435ms) +✔ row 194 W-N1: a fire.done before a later fire.stopped of the same instance leaves it firing; another instance's done does not end it (46.557436ms) +✔ row 194 T10: a hire or fire of a kept name refuses instance-kept before the writer (34.183289ms) +✔ row 194 T10: a fire the writer's check refuses from the file stops nothing and leaves the instance launchable (42.75405ms) +✔ row 194 T18: hire and fire take only their own keys, and a refused call writes nothing (55.189988ms) +✔ row 194 T8, T9, T18: through the runtime the chief hires and fires with the real writer, the receipt carries the reason, and a refusal leaves the file alone (112.796462ms) +✔ row 194 W-N1: the launcher's take of a launch or regenerate of a firing instance closes it as instance-firing (43.282907ms) +✔ C2-06 held library lock gives the agent citation-unavailable and its retry reason (5268.133548ms) +✔ C2-06 malformed sync state is availability failure, never a fabricated invalid cite (59.75749ms) +✔ C2-06 no mirror or freshly initialized empty mirror still means no served citation (66.709378ms) +✔ C2-06 coder send_message guard covers every table refusal; inserts nothing (232.424729ms) +✔ C2-06 research send_message guard covers every table refusal; inserts nothing (188.86302ms) +✔ C2-06 stored check carries the file author trailer at an unrelated cited tip (121.120435ms) +✔ C2-06 supporting cite cannot state canon, including a folder also marked playground (87.26549ms) +✔ C2-06 supporting file stores supporting scope and its real agent trailer (98.532144ms) +✔ C2-06 check evidence and insert are atomic when storing evidence fails (83.214917ms) +✔ C2-06 live limits change both directions; unreadable file keeps checks and exact fixed texts (116.361473ms) +✔ C2-06 page store is session-local, caps 20 fetches and 200 KiB, drops at disconnect (192.417456ms) +✔ C2-06 transport passes safe capped guard reason; ordinary refusal envelope is byte-identical (112.631932ms) +✔ C2-06 non-library businesses retain role.claim shape and unguarded free sends (55.513487ms) +✔ C2-06 thread messages carry file/last evidence with one read per distinct path (194.221411ms) +✔ C2-06 guarded request snapshot cannot change between check and insert (63.784808ms) +✔ C2-06 library.limits.set is human-only and invalid settings leave file and receipts unchanged (102.593616ms) +✔ C2-06 runtime reads changed and unreadable reply limits without restarting (225.880291ms) +✔ comment cursors isolate businesses, move only forward and remain append-only (34.450531ms) +✔ only trusted sync writes validated cursors; events and cursor share rollback (28.935685ms) +✔ explicit 3b copy migration preserves evidence and opens as 3g; normal startup never migrates (158.873081ms) +✔ migration refuses active writers and drifted legacy schemas, with no partial upgrade (192.649732ms) +✔ named migration registry chains 3b through 3g to a fixture-only future version in order (179.392175ms) +✔ migration refuses mismatched source metadata without changing schema or evidence (71.589441ms) +✔ offline command migrates only the supplied fixture root and reports usage errors (316.964086ms) +✔ N4: the console verbs are exactly the preview and the console resolve, and decision.resolve is not one (2.016913ms) +✔ bindConsole takes only the business human and a three-string owner subject (64.292432ms) +✔ J1, Q188: only a console cap reaches the console verbs, and a console cap reaches nothing else (93.501256ms) +✔ preview: the two real answers, a grant summary and the digest, for an open grant request only (56.178338ms) +✔ J1, J2: a decision that is not an eligible grant request refuses both console verbs (68.44826ms) +✔ N2, J13: a Console approve records via console and the owner, before the executor starts, and the grant runs once (136.642015ms) +✔ J15: a Console deny closes with the other key and starts nothing (156.239622ms) +✔ J2: approve and deny come from approvalChoice and the options, not a fixed yes and no (190.003486ms) +✔ J11: a stale digest or a key outside the two refuses decision-stale and writes nothing (71.683458ms) +✔ J14: a via console close with no matching human.input approves nothing (80.193294ms) +✔ recordEvent keeps human.input reserved, so no agent forges a console answer (54.021253ms) +✔ J7: a console proof over the socket binds a cap for its one call and the reply releases it (176.04563ms) +organization: {"event":"reload-needs-restart","business":"demo"} +organization: {"event":"reload-needs-restart","business":"demo"} +✔ M6: a creative raise refuses decision-not-allowed, cited or not, and no decision row appears; the assistant still raises (74.339812ms) +✔ a creative instance sends only to the user and hears only from the user (87.329597ms) +✔ M10 through the broker: the chief and the tester are refused on bean, the human's limits.set of its models key works (162.97226ms) +✔ row 256 T6 the human deletes a creative instance through the broker; the chief and the tester are refused at the verb (112.396929ms) +✔ X4: register adds a store reference to the running bus, and issue then writes the key (28.693661ms) +✔ X4: register runs the constructor's reference checks (1.358981ms) +✔ X4: register reads no file, so a key file left at the path stays unused, and a live token refuses (20.322854ms) +✔ X3, X4: unregister drops an entry with no token and refuses one with a live token (19.674956ms) +✔ X5: a claim holds the slot, so a second claim and a host.run refuse host-busy until release (12.634494ms) +✔ X5: a claim made while a host.run is in flight refuses host-busy (12.05781ms) +✔ X5: a stale release leaves a later claim in place (0.841973ms) +✔ X5: abortClaim aborts a live claim and says pending, and revoke's abort reaches a claim too (12.218445ms) +✔ credentials gives human and reader sessions service, account, role, date and state, and nothing else (34.662379ms) +✔ credentials refuses a role session and any argument (32.806422ms) +✔ credentials reads the status on each request, and a broker without one lists none (42.911444ms) +✔ the broker process answers credentials without a token, path or variable in its output, log or store (259.729745ms) +✔ T1: a store reference with no file yet starts, and the agent is not-issued until issue (7.771088ms) +✔ T1: a store path the reference does not own, or no store root, refuses the reference (1.051183ms) +✔ T1: a wrong mode on the store root, a business dir, an agent dir or the file refuses start (3.305281ms) +✔ T1: a missing store root refuses start; a missing {file} reference still refuses start (0.847736ms) +✔ T1: a store file that is a directory or a symlink refuses start (1.338858ms) +✔ T2: useFor keys from the session only (2.963643ms) +✔ T5: issue, rotate, revoke and delete are live with no restart, and revoke holds across one (7.439219ms) +✔ T5: a failed commit leaves the token on disk but not in memory, and a bad token or date writes nothing (2.897117ms) +✔ T5: revoke drops the token from memory before the unlink, so a failed unlink still leaves it revoked (3.075192ms) +✔ T5: revoke of a {file} reference forgets the token and never unlinks the file (0.947744ms) +✔ T5: delete refuses an agent dir holding anything but tokens (2.9096ms) +✔ D5: every credentials use( call site is on the allowlist (54.097029ms) +✔ row 199: the lifecycle verbs refuse every session but the human, and the tester revokes only (65.162302ms) +✔ T5: issue, rotate, revoke and delete are live, rewrite the business file and leave one receipt each, with no value anywhere (180.404264ms) +✔ only validated broker references load; returned data and exceptions cannot expose a known token (4.427568ms) +✔ bad file modes, symlinks, repository/data paths, malformed tokens and missing dates refuse (2.8473ms) +✔ expiry refuses use and env references never become client data (1.352317ms) +✔ S1 parsed service refs work, service mismatch refuses, Gitea rotation due is a warning state (1.938405ms) +✔ opaque tokens shorter than 16 characters refuse before use (0.480309ms) +✔ each C-suite role file carries the same two lists: human, chief-of-staff, pm, cto (2.737515ms) +✔ chief-executive-officer: messages to and from the user, chief of staff, pm and cto pass (100.778997ms) +✔ chief-executive-officer: a message to or from the coder, reviewer or assistant is refused and logged, and nothing is stored (82.349689ms) +✔ chief-executive-officer: another C-suite role isn't on the lists either (72.839459ms) +✔ chief-financial-officer: messages to and from the user, chief of staff, pm and cto pass (86.825948ms) +✔ chief-financial-officer: a message to or from the coder, reviewer or assistant is refused and logged, and nothing is stored (90.320794ms) +✔ chief-financial-officer: another C-suite role isn't on the lists either (69.400997ms) +✔ chief-information-officer: messages to and from the user, chief of staff, pm and cto pass (92.248866ms) +✔ chief-information-officer: a message to or from the coder, reviewer or assistant is refused and logged, and nothing is stored (96.014681ms) +✔ chief-information-officer: another C-suite role isn't on the lists either (66.908232ms) +✔ chief-information-security-officer: messages to and from the user, chief of staff, pm and cto pass (89.852957ms) +✔ chief-information-security-officer: a message to or from the coder, reviewer or assistant is refused and logged, and nothing is stored (91.32255ms) +✔ chief-information-security-officer: another C-suite role isn't on the lists either (76.430553ms) +✔ chief-marketing-officer: messages to and from the user, chief of staff, pm and cto pass (97.213475ms) +✔ chief-marketing-officer: a message to or from the coder, reviewer or assistant is refused and logged, and nothing is stored (97.248155ms) +✔ chief-marketing-officer: another C-suite role isn't on the lists either (70.306966ms) +limits: {"event":"limit-reached","business":"demo","check":"daily-quota","export":"mayLaunch","subject":{"instance":"coder","provider":"anthropic","model":"opus","account":"jason-max"},"path":["tokens","daily","jason-max"],"limit":0,"count":0,"unknownTurns":0} +usage: {"event":"usage-unknown","business":"demo","run":"run1","instance":"coder","turn":"0a0cc520-e288-49fc-a475-ad73c228cfcd","source":"@none","code":"baseline-unknown"} +limits: {"event":"limit-reached","business":"demo","check":"daily-quota","export":"mustStop","subject":{"instance":"coder","provider":"anthropic","model":"opus","account":"jason-max"},"path":["tokens","daily","jason-max"],"limit":0,"count":0,"unknownTurns":1} +usage: {"event":"usage-unknown","business":"demo","run":"run1","instance":"coder","turn":"9bbb7330-ce96-41fb-9fba-e72a563823fa","source":"@none","code":"baseline-unknown"} +✔ REQ-LIMIT-2 runtime: limits counts the daily quota, and mayLaunch refuses only the account at it (208.787293ms) +✔ REQ-LIMIT-4 runtime: a run bound with the account writes it on its usage records and stops at the quota (97.927497ms) +✔ REQ-LIMIT-4 runtime: a run bound without an account records null and the daily quota never stops it (92.500932ms) +✔ REQ-LIMIT-4 bindLaunch keeps the account off session.launched, refuses one that is not an identifier, and takes null as none (27.523195ms) +✔ a human resolve sends the raising role one message from the human, and its request is the answer (67.816759ms) +✔ a cross-role decision resolved by its arbiter comes from that role and run, with no request (47.01576ms) +✔ a human withdraw sends one message with the note (42.724327ms) +✔ a human seen before the close leaves the request on the close's answer, not the seen (53.922584ms) +✔ the raising run's withdraw, a supersede, a within-role raise and seen send nothing (54.891689ms) +✔ refused closes send nothing: invalid-choice, decision-closed, not-resolver (63.862923ms) +✔ a raising role nobody holds at the close gets the message on the next claim (52.967981ms) +✔ a human DECISION send keeps its own instruction as the request, not a close's answer (51.32476ms) +✔ a cross-role raise whose arbiter the raiser does not hear from is refused and stores nothing (62.025256ms) +✔ a gated raise by a role that does not hear from the human is refused and stores nothing (57.973044ms) +✔ a route the raiser hears from is allowed, checked from the route to the raiser (66.213381ms) +✔ a refused supersede withdraws nothing (60.361569ms) +✔ the assistant's within-role and gated raises still work (65.349565ms) +✔ roles lists open decisions routed to a role, and never the human inbox (60.178534ms) +✔ recent lists closed decisions of every route, newest close first, with how each closed (57.455617ms) +✔ recent gives the closing event as closed when the decision was seen first (57.257956ms) +✔ recent stops at RECENT rows (183.419882ms) +✔ every row is what trail already gives the same session for that id (83.70881ms) +✔ a role session can't list decisions, so it can't read another role's open decisions (71.540349ms) +✔ decisions is a read: one business, strict arguments, nothing written (78.386345ms) +✔ endLaunch writes session.ended, releases the run claim and kills its capabilities (38.466437ms) +✔ endLaunch refuses an unknown run, a second end and a rebind of the ended run (29.994322ms) +✔ a restarted broker refuses to rebind an ended run; a refused rebind leaves the run unbound (33.253657ms) +✔ endLaunch leaves a claim another run took alone (36.820274ms) +✔ refuse records action.refused against the caller with the code only (25.392359ms) +✔ launches off refuses role.launch with launch-revoked until launches on (49.439252ms) +✔ broker process: launch ops authorize role.launch, record refusals and end runs (296.279022ms) +✔ row 281 T2: a fire with host grants on two hosts and a Gitea grant answers with a job, then revokes all three (466.354223ms) +✔ row 281 T3 (sage-2575): a delete with grants takes two requests: the first starts the job, the next completes (460.095532ms) +✔ row 281 T3b (Q2): a delete whose job refuses on host B; the retry refuses grant-revoke-failed and revokes only B and Gitea (390.554228ms) +✔ row 281 T3b: B cleared by hand with hosts.revoke; the next delete starts a job for Gitea and the leftover line only (387.565741ms) +✔ row 281 T3c (sage-2575 condition 4): a delete of an instance with no grant completes in one request (111.197164ms) +✔ row 281 T4: host B unreachable in a fire: the job refuses, A stays revoked, B and Gitea untouched; a repeat completes (374.454523ms) +✔ row 281 T4b (Q1): a line a manual hosts.revoke left on C is removed by the fire, with its close (176.36773ms) +✔ row 281 T4b (Q1): with C unreachable, the fire completes and names the line in grantsLeft (163.220343ms) +✔ row 281 T5: Gitea's admin token can't be checked: the job refuses with the Gitea grant intact (237.937858ms) +✔ row 281 T5b (N1): a failed token DELETE refuses gitea-left; the repeat retries only this agent's entries (543.559869ms) +✔ row 281 T6 (sage-2574): a host decision approved before the fire and run after it ends revoked, with nothing applied (104.796149ms) +✔ row 281 T6b (sage-2574): a Gitea decision approved before the fire and run after it ends revoked before any Gitea write (129.648628ms) +✔ row 281 T6c: a host executor in flight aborts and ends revoked; a Gitea executor in flight is awaited and leaves no token (389.654212ms) +✔ row 281 T6d (B1): undecided host and Gitea decisions are in the set, and approved after the fire both end revoked (178.782401ms) +✔ row 281 T6e (B1): a grant raise refuses instance-fired while firing and after the fire, goes through after a rehire, and refuses grant-revoke-running during a delete job (195.949709ms) +✔ row 281 T7: an instance with no grant fires as today, synchronously, with the same events (104.12321ms) +✔ row 281 T9 (B3): one step G per agent; the manual verbs refuse while it runs, and sweep names it running (411.776314ms) +✔ row 281 T10 (B2): the fire and the delete answer while their jobs are held, and the broker answers other verbs (381.12343ms) +✔ row 281 T11 (C1): a fire's job completes after the chief's run ends and processing halts (163.397075ms) +✔ row 281 T12 (C1, N7): a step B refusal in the job is fire.failed, and the repeat runs B and C synchronously (143.191396ms) +✔ row 281 T13 (N4): a restart records each held job interrupted once, with one message each; an ended job gets none (254.76145ms) +✔ row 281 T14 (N1, sage-2653): a host removed under an undecided decision stops the fire on host-unknown; the human's no closes it, and the repeat fire has no job (122.580741ms) +✔ row 239 T4: a refusal after the writer's revoke is named -revoked, in the job's fire.failed and notice, a synchronous fire and a delete (166.27554ms) +✔ row 239 T4b: an unmarked step B refusal keeps its code, and the notice says nothing of the tokens (144.136265ms) +✔ X-G3: on scratch 1.27.1, a grant makes the user, mints, forks, checks reach, writes the file, and revoke deletes the token (13604.624698ms) +✔ versionAtLeast compares numbers and refuses a prerelease of 1.27.0 (2.002668ms) +✔ X-G1: a raise that fails a check refuses and stores nothing (125.927963ms) +✔ X-G1: a creative role, a role without identity and a missing or due slot refuse at raise (382.476368ms) +✔ X-G2: admin set refuses each failed check and writes nothing, then writes the slot once (328.498537ms) +✔ X-G3 to X-G8: an approve makes the user, mints the token, forks, checks reach and writes the file, record and grant.applied (187.186104ms) +✔ X-G4: a user this stack did not make, an admin, a disabled user and a remade user each refuse (507.013864ms) +✔ X-G6 and X-G8: the user and mint steps are written before their calls, and each result after its call (181.494461ms) +✔ X-G4: a fork by the seat user of another repository than the project refuses fork-foreign (158.236527ms) +✔ X-G5: a failure after the mint deletes the token, unloads nothing it did not load and leaves no file (259.366753ms) +✔ X-G5: a token delete that fails is left at Gitea, shown by status and taken by sweep (223.169143ms) +✔ X-G5: a mint that fails deletes by name, and a refusal at step 0 leaves the decision unspent (303.678617ms) +✔ X-G5: an agent held for an unknown token is refused at step 0 with no Gitea call (120.985118ms) +✔ X-G5 and X-G9 (step 7): a rotation whose old-token delete fails stays applied with the old id left (308.600542ms) +✔ X-G10: in a rotation the store file holds the new token before the old one is deleted (256.572895ms) +✔ X-G6: a rotation cut before the rename settles back at once, and the old token stays live (275.94791ms) +✔ X-G6: a rotation whose step 8 write fails is settle-pending, and a restart settles it forward (327.535809ms) +✔ X-G6: a restart settles an open rotation back when the file still holds the old token (229.748482ms) +✔ X-G6: a restart settles an open rotation forward when the file holds the new token (242.999005ms) +✔ X-G6: a 401 on the file token loses the grant: both tokens go, the record goes and memory unloads (256.159194ms) +✔ X-G6: a 403, 404, 500, a hang and a dropped socket each leave the rotation settle-pending with nothing deleted (1612.58177ms) +✔ X-G6: a file token no grant minted is held; the next restart says so again; a revoke clears it and takes both ids (305.514508ms) +✔ N9: a revoke of an open rotation, then a restart: no settle, no Gitea call and no message (278.481851ms) +✔ N9: a 404 on a delete by id counts as done (259.981957ms) +✔ X-G6: a restart undoes each step a killed child left, and spends an approved unspent decision (789.987196ms) +✔ X-G6: a restart with no admin slot leaves the user an orphan and the token left (100.701757ms) +✔ X-G7: a change to the definition, identity, publish remotes or admin slot after the raise ends decision-mismatch (220.133753ms) +✔ X-G7 and X-G9: an admin rotate voids open decisions, and rotate --finish deletes what was left (176.747096ms) +✔ X-G9: a rotate whose name is taken refuses and writes nothing; remove takes the slot away (91.790291ms) +✔ X-G9: a slot past its rotate-by date refuses a run at step 0, leaving the decision unspent (79.374339ms) +✔ X-G11: run refuses every caller but the human, an unapproved, a spent and a busy decision (163.587315ms) +✔ kill switch (plan :16): while halted the chief still reads grants.status, and an agent grants.revoke refuses (143.052847ms) +✔ X-G11: a revoke while the executor runs aborts it and the grant ends revoked (145.8093ms) +✔ X-G11: a revoke unloads memory and removes the file before its Gitea delete (152.426198ms) +✔ X-G11: a revoke during a rotation step 7 ends it revoked, and step 8 writes no record back (207.714723ms) +✔ X-G11: a revoke while a sweep settles a rotation, forward or back, ends it revoked with no record (431.439987ms) +✔ X-G11: a revoke during a settle whoami that finds a foreign token ends it revoked, not held (223.7582ms) +✔ X-G11: a revoke during a settle whoami that gets a 401 ends it revoked, not lost (231.763384ms) +✔ X-G12: a token that reaches wider than its forks fails with the repository named (463.585537ms) +✔ X-G12: reach is paged by X-Total-Count and a count that does not add up refuses (279.750243ms) +✔ X-G13: an agent cannot record a grant event, and the trigger refuses one from any writer but the grant writer (43.705393ms) +✔ X-G14: credentials delete fires the user: tokens go, login is prohibited, and grant.revoke.closed records it (279.79579ms) +✔ X-G14: a fire whose token delete or login PATCH fails lands it in serviceLeft (151.445895ms) +✔ X-G14: a fire whose user is gone or remade skips the fire steps and says why (305.110031ms) +✔ X-G14: a sweep retries a fire only for the user it fired: a remade or gone user is skipped and named (374.378952ms) +✔ X-G14: a revoke Gitea cannot reach stays open, and a restart closes it (146.334284ms) +✔ row 281 T8: a tester grants.revoke refuses tester-dev-only once bus.tester is off; the human revoke keeps its records and starts no job (118.265841ms) +✔ X-G15: look-alike commit steps outside the grant writer are ignored at start, by revoke and by status (133.033953ms) +✔ X-G15: a look-alike spend under another kind with the grant writer pair is not an open grant (45.712791ms) +✔ status lists the slot, users, grants and nothing secret, and every grants verb needs service gitea (114.619026ms) +✔ 3j copy migrates to 3k: every row kept, and sqlite_master gains only the two tables and their keys (186.33571ms) +✔ a 3j→3k step that fails partway leaves the store at 3j with every row and the schema intact (216.222057ms) +✔ the 3j engine refuses a migrated store, migrating or not, and leaves it as it was (208.796803ms) +✔ gitea_users: one user per business and agent, an id above 0, a 16-hex nonce and a real decision (24.836546ms) +✔ gitea_grants: one grant per agent, a projects array, a token id above 0, and only for a recorded user (29.144957ms) +✔ G1, A1: only the chief raises a grant, and a refused raise stores nothing and runs no keyscan (68.622204ms) +✔ G1: grant goes only with credential.mint, row a takes only host-enroll, and E1 refuses each bad field (106.637694ms) +✔ G5, A5, A6: the scanned key set must equal the requested set, or host-key-mismatch and nothing stored (69.804869ms) +✔ G4 (host-enroll block, M1): the broker appends the keys, fingerprints and sudo line, and the cap counts the block (64.573261ms) +✔ G6, X1: the human's cli yes starts enrollment, which writes the record, the key file and the events in order (114.550784ms) +✔ A2, A4: a credential.mint without grant, and a no, start nothing (262.117953ms) +✔ A3, X1: a resolve by the tester or an agent starts nothing (258.822806ms) +✔ G6 (duckworth-0081 B3): a withdraw by the chief or the human, and an arbiter resolve, start nothing (256.593272ms) +✔ G10 (duckworth-0081 B1): a second start for a spent decision refuses decision-consumed, and an unresolved or agent-resolved one not-authorized (82.363228ms) +✔ A8, S1: two approved enrollments for one host: the second ends host-enrolled and the pin stays (98.280574ms) +✔ A9: the hosts primary key refuses a second record for (business, host) (48.179117ms) +✔ X3: a failure at step 2 deletes the record again and ends grant.failed, with no key file (75.220395ms) +✔ A10, X3: at start a resolved, unspent enrollment is spent and ends interrupted, and never runs late (51.974424ms) +✔ X3: at start an enrollment that stopped after its registry step loses its record and key file (71.501769ms) +✔ G24 first sentence, M2, A12: tags are mosaic- and 32 hex, and differ by business, agent and host (0.392186ms) +✔ E4: hosts.check sets the record ready and records grant.host.checked; a non-zero list leaves it pending (82.95074ms) +✔ G20 (duckworth-0081 B3): the human's hosts.check marks the host ready, and the reader refuses (78.458377ms) +✔ G18 (duckworth-0081 B2), broker half: a check refused host-key-mismatch leaves the host pending-install with no grant.host.checked (66.41759ms) +✔ E4: a check whose installer fingerprint differs from the record refuses host-changed (66.979191ms) +✔ E4, G21: hosts.remove is the human's or the tester's, deletes the key and the record, and records grant.host.removed (75.602182ms) +✔ G21, F1, F2, M4, A22: hosts.remove refuses host-line-left on a guarded hostLineLeft, and ignores look-alikes (89.961083ms) +✔ hosts.remove refuses host-in-use while a grant record names the host (80.441499ms) +✔ the grant writer refuses a body outside section 7's shape (45.628303ms) +✔ recordEvent refuses reserved-event for a grant.* action or operation (43.264143ms) +✔ row 280: an occupied TCP port is attempted, refused, and retried with our sshd (115.786752ms) +✔ row 280: every injected picker sample is unprivileged and outside the ephemeral range (0.724344ms) +✔ G7: an Approve installs the tagged line, logs in with the new key, and writes the key file, record and grant.applied (803.005202ms) +✔ G7: a commands change on a live grant updates the record in one transaction and keeps the key and line (631.596085ms) +✔ G8: a failure at install or verify removes the line and leaves no record, key file or reference (1799.422882ms) +✔ G8: a failed remove adds hostLineLeft and tells the human to sweep (794.176288ms) +✔ G8: a failure in step 5 before commit unlinks the key file, drops the reference and removes the line (771.800981ms) +✔ G8: a store fault in the commit transaction ends host-failed with no record, key file, reference or line (774.791896ms) +✔ G8: a failed step 1 check spends the decision and runs nothing remote (112.395417ms) +✔ G9: a registry, definition or commands change between raise and Approve ends decision-mismatch before any remote step (619.373767ms) +✔ G9: an agent no longer a role or no longer declaring host ends with its code, spent (123.203163ms) +✔ G10: a second start refuses decision-consumed, and an unresolved or agent-resolved decision not-authorized, writing nothing (604.587677ms) +✔ G15: no event, message or decision holds the private key (610.226726ms) +✔ G23: a revoke during install ends grant.failed revoked with no key file, no grant and no line (600.531406ms) +✔ G23 (row 249): an add that writes after an abort's remove leaves hostLineLeft until the sweep (901.442822ms) +✔ G23 (row 249): an add that writes after a timed-out install's remove leaves hostLineLeft until the sweep (911.280344ms) +✔ G23: a revoke recorded after the raise and before the start ends step 1 revoked, and a held slot ends host-busy (533.516153ms) +✔ G24: names at 64 characters with . and _ give distinct tags of the fixed length (0.410387ms) +✔ G11: a restart after install removes the line, then ends interrupted with the tag, holding the slot until then (219.400106ms) +✔ G11: a restart after a new key's commit, with the key file written, ends with no key file, record, reference or line (222.404335ms) +✔ G11: a restart after a commands change's commit leaves the record as it was and asks nothing of the host (523.855876ms) +✔ G11 (B2): a restart before step 1, spent or not yet spent, ends interrupted and nothing runs later (80.884673ms) +✔ G11: a remote undo that fails ends interrupted with hostLineLeft and the sweep hint (291.494502ms) +✔ G11: a restart leaves a finished grant alone, and the reconcile adds nothing for it (514.23696ms) +✔ N1 (G27): the start sweep unlinks host. files with no record in loaded businesses only, and refuses a store dir that is not private (10.373484ms) +✔ G12: the human's hosts.revoke deletes the record, the key file, the reference and the line, with a closed marker (699.640415ms) +✔ G12 (N4): a revoke with no record still removes the computed tag's line, with granted false; bad args refuse (239.135335ms) +✔ G13: a revoke during install aborts the executor, which ends revoked, and the line goes (574.540351ms) +✔ G26: the human, the assistant and the tester revoke; the chief and a pm refuse; sweep is the human's or the tester's (552.351684ms) +✔ row 281 T8: a tester hosts.revoke refuses tester-dev-only once bus.tester is off, and a human revoke writes no job records (669.48499ms) +✔ G27: a restart after step 1 sweeps the key file and runs step 3 once the bus is up; status shows the revoke until then (673.681221ms) +✔ G27: after step 2 with the host down, the restart closes the marker with hostLineLeft; a marker without a revoke id is not reopened (984.366171ms) +✔ G27: a key file a revoke could not unlink is reported left and goes at the next start (667.437306ms) +✔ G28: a commands change, then a revoke, then a restart leave no record, key, reference or line (684.272001ms) +✔ G24 (B4): hosts.sweep removes only this business's recorded tags no live grant holds, and records what it left (964.401551ms) +✔ G12: the local steps finish before the host step, so a host that hangs leaves the agent no access (741.190295ms) +✔ G23 (X5): a revoke right after the spend reaches the executor's claim, so the grant ends revoked (219.159066ms) +✔ G23 (X5): a revoke that lands as verify returns ends revoked with no record, key file or line (668.889448ms) +✔ G13: a revoke whose host remove fails still drops the record and key, and reports the line left for a sweep (669.154337ms) +✔ G22: enroll, check, grant, host.run, a commands change the next host.run uses, and a revoke that kills a run in flight (1245.129197ms) +✔ mos-1163: a grant whose agent became a creative role after the raise ends host-creative-role at step 1, spent, with nothing remote (63.975288ms) +✔ sage-1908: once the agent of an applied grant is a creative role, host.run refuses host-creative-role, runs nothing remote and keeps the record (514.830709ms) +✔ G1 (host): only the chief raises a host grant, a grant on any other action refuses, and nothing is stored (54.345662ms) +✔ G1, R4: the grant takes exactly method, agent, host, commands and rotateBy, and an unknown method refuses (76.57906ms) +✔ row 236 (#1742): a gitea grant on a broker with no Gitea path refuses gitea-not-configured, and nothing is stored (49.364578ms) +✔ G2: an agent whose definition lacks host refuses host-not-declared, and an unknown agent unknown-role (60.001508ms) +✔ mos-1163: a grant whose agent is a creative role refuses host-creative-role, even when its definition declares host (48.214182ms) +✔ G3: wildcard, shell, empty and other 210 D6 argv prefixes refuse invalid-request (100.810497ms) +✔ R4 rotateBy (sage-1782): a real calendar day after today UTC, or invalid-request (87.305288ms) +✔ G19: a grant naming a host that is pending-install refuses host-not-ready, and an unknown host host-unknown (54.060793ms) +✔ R4, G5: the raise routes to the human and its event body binds the eight fields with their hashes (49.101866ms) +✔ G4 (host block): the broker appends the host, each prefix, the rotate date and new key or change (74.525591ms) +✔ 3i copy migrates to 3j: every row kept, and sqlite_master gains only the two tables, their keys and the guard (195.879898ms) +✔ a 3i→3j step that fails partway leaves the store at 3i with every row and the schema intact (223.29455ms) +✔ the 3i engine refuses a migrated store, migrating or not, and leaves it as it was (171.96901ms) +✔ A22b, sage-1703: a session-written grant.* row from before the step survives it, and the grant readers ignore it (134.833913ms) +✔ the guard: a grant.* action or operation on action.allowed needs the (NULL, grant) actor (29.281852ms) +✔ hosts: one record per business and host, a ready host has its installer and check, grants need the host (25.922848ms) +organization: {"event":"reload-needs-restart","business":"demo"} +✔ row 298 runtime: human scope approval writes the file and organization history at the supplied revision (144.679775ms) +✔ row 298 (Q3): only the human at the cli reads or sets the scope; agents, the tester, a reader and the Console refuse (157.548986ms) +✔ row 298 (Q1): organization.set and limits.set refuse a grantScope key, and nothing is written (105.192191ms) +✔ row 298 (Q3): the human verb writes the scope and a grant.scope record with the human proof and both sha256 (101.218902ms) +✔ row 298 (Q4): an in-scope Gitea grant is issued with no inbox item, logged with 236 records, and revocable (251.391954ms) +✔ row 298: an out-of-scope Gitea grant waits for the human, whose Approve still issues it (207.180375ms) +✔ row 298: with no scope, a bad scope or an unreadable file, an in-scope-looking grant waits (261.929927ms) +✔ row 298 (Q6): a chief-of-staff instance that is not launch.by never raises in scope (93.69096ms) +✔ row 298 (Q5): a scope narrowed between the raise and the spend ends the grant scope-changed (134.322205ms) +✔ row 298 (Q2): an in-scope host grant is spent with no Approve; ls never covers lsblk, nor a scope command extra arguments (124.104496ms) +✔ row 298 (Q5): a host scope narrowed before the spend ends scope-changed (104.112674ms) +✔ row 298 Q4: missing scope evidence or a bad scope digest cannot authorize execution (172.102409ms) +✔ row 298 T4/T8: an in-scope host grant issues, records and revokes through the existing executor (132.384352ms) +✔ row 298 T6: host enrollment stays open for human Approve even with both methods in scope (90.490393ms) +✔ row 298: scope without an organization revision never closes automatically (106.208295ms) +✔ REQ-WAIT-1: the broker hard waits are exactly the list, and match the business vocabulary (2.444015ms) +✔ REQ-WAIT-2: a business granting a hard wait at either class is refused; the actions that left are grantable (38.560372ms) +✔ REQ-DEC-2: every hard wait goes to the human, cited or not, and the arbiter cannot resolve it (840.148019ms) +✔ REQ-DEC-2: a gated raise citing the current spec goes to the arbiter for its domain; uncited, to the human (326.588528ms) +✔ REQ-DEC-2: an arbiter-approved cited gated decision authorizes the raiser, and the human cannot resolve it (94.530513ms) +✔ REQ-DEC-2: a cited merge raised by merge-gate goes to the technical arbiter; a merge raised without the grant routes by citation (123.888017ms) +✔ REQ-DEC-2: a stale or unconfirmed citation refuses without a decision; an arbiter raising its own goes to the human (183.541319ms) +✔ Q169: the chief of staff's end of the assistant stops every thread run; its own run and another ender's are refused (107.733116ms) +✔ Q169: a revoke of the assistant the chief of staff raises goes to the human, cited or not, and no arbiter resolves it (258.095885ms) +✔ Q169: another role's cited revoke of the assistant, resolved by an arbiter, is refused (129.827739ms) +✔ Q169: a revoke of the assistant citing a decision the human resolved stops its thread run (119.468319ms) +✔ Q169: a cited revoke of a role not in END_PROTECTED still goes to the arbiter, and executes (97.792509ms) +✔ Q169: a role granted role.revoke at either class still sends a revoke of the assistant to the human (122.980236ms) +✔ row 280: an occupied TCP port is attempted, refused, and retried with our sshd (105.927208ms) +✔ row 280: every injected picker sample is unprivileged and outside the ephemeral range (0.60174ms) +✔ the executor tests need sshd, ssh, ssh-agent, ssh-add, ssh-keygen and setpriv: a missing one fails, never skips (0.257138ms) +✔ T3: organization.set, limits.set and instances.set refuse hosts, and the writer never runs (42.443661ms) +✔ T4: the value check takes one unencrypted ed25519 key and nothing else (211.75384ms) +✔ T5 to T8: registry, grant, argv shape and allowlist refusals (652.41243ms) +✔ T9: under 1.7 every call needs a decision bound to its host, argv and stdin, spent once (405.639216ms) +✔ T10, T11: argv reaches sudo unchanged after sudo -n -- (365.010127ms) +✔ T12, T13: exit code passes through, the timeout kills the group, output is capped (1673.908664ms) +✔ T14: a host key not in the registry refuses and nothing runs (245.464696ms) +✔ G18: hosts.check with a wrong pin refuses host-key-mismatch and runs nothing on the host (424.736576ms) +✔ N3: a remote exit 255 that prints the pin refusal text is the command result, and an ssh failure keeps its message (387.942969ms) +✔ T15: ssh reads no config file and no user known_hosts (368.655338ms) +✔ T16, T17: key material in output or stdin refuses credential-leak, and no event holds it (782.736717ms) +✔ T18, T19, T20: one call at a time, no key in any argv or env, and nothing left after (4821.208516ms) +✔ T21: revoke kills the call in flight, and the next call refuses (288.589597ms) +✔ T22: events carry host, address, user and argv in clear, and sizes and hashes only (269.603288ms) +✔ T24: no literal gitea and vikunja kind list outside vocabulary.mjs, and the credential use sites are known (20.827994ms) +✔ T25: no role definition lists host.sudo while it is a hard wait (0.60403ms) +✔ T27: the bus child dying takes ssh and ssh-agent with it (327.716855ms) +✔ T27: ssh-add -t drops the key from an agent the test keeps alive (3557.942983ms) +✔ N2: a hung ssh-add is killed at its limit or on abort, and nothing is left running (427.935563ms) +✔ T27: the start sweep keeps a live bus dir and kills only a matching live process (28.06187ms) +✔ T27: the bus start sweeps /secrets/run before it listens, and a stray entry stops the start (50.453123ms) +✔ M3: host.run refuses host-not-granted unless the grant record has an approved, spent host grant (138.955116ms) +✔ M3: a host_grants record gives Credentials a store reference at start, and a restart reads its key (99.204592ms) +✔ G16: the writer refuses each user, tag and key the design names, before any key file (7234.626286ms) +✔ G16: from= comes from the host file, a privileged user skips the group and sudo checks, and the line is exact (1351.950757ms) +✔ G16: list shows tagged lines only, and add and remove never touch a line outside the tag pattern (565.801256ms) +✔ G25: the writer refuses a symlinked dir or user file, a group-writable dir and an odd tmp, and writes 0644 (835.897578ms) +✔ G16: mosaic-keys passes the three requests to the writer through sudo and refuses anything else without it (67.811531ms) +✔ E3: the sudoers line and the sshd drop-in are the design lines and parse (12.23097ms) +✔ human proof binds CLI entry, process start and nonce; agents and incomplete ancestry refuse (2.293795ms) +✔ process reader gets own kernel identity without exposing environment values (0.581987ms) +✔ EACCES ancestor environments skip only markers; commands and registered launches still refuse (0.957932ms) +✔ real pid 1 remains inspectable when its environment is protected (0.461308ms) +organization: {"event":"reload-needs-restart","business":"demo"} +organization: {"event":"reload-needs-restart","business":"demo"} +✔ row 165: instances and instances.set refuse every non-human session but the tester, the chief of staff included, and pass the verified actor (60.621633ms) +✔ row 165 runtime: an add and a change reach the organization file with the human as actor; each refusal keeps the bytes and logs nothing (226.074067ms) +✔ row 194 T12: agent and reader sessions refuse veto.set; the tester gets add and change but not delete or veto.set; the human passes the hook for each listed verb (47.433194ms) +✔ system Python is a resolved root-owned ELF, never a shim or home interpreter (3.00438ms) +✔ real system interpreter is available and safely inspected (32.154376ms) +✔ restart receipt appends actual replacement identity and refuses unsafe files (4.294391ms) +✔ activation gate compares fresh startup receipt to the current interpreter identity (2.379832ms) +✔ non-regular startup receipt refuses promptly without waiting on a FIFO peer (46.449979ms) +✔ REQ-DEC-2: a merge-gate raise its arbiter resolved lands through the host op: checkLand answers the facts and a ticket, records nothing, and recordLand spends the decision once (58.322967ms) +✔ checkLand refuses on the decision and the review (69.626349ms) +✔ REQ-LAND-1: a gated merge decision refuses not-authorized, cited and approved by the arbiter or uncited and approved by the human (149.251791ms) +✔ REQ-LAND-1: a within-role merge grant refuses not-authorized at the land (42.946064ms) +✔ a cross-role merge that routes to the human, because merge-gate is its own arbiter, lands on the human's CLI answer (50.394687ms) +✔ a merge option with no first line refuses no-subject, as land-work does (46.951751ms) +✔ checkLand refuses with land-work's codes past the authority check, and a decision raised for refactor never lands (121.974096ms) +✔ a ticket outlives the run that asked, and recordLand checks the task again (57.019992ms) +✔ two tickets on one decision: the first recordLand lands, the second refuses decision-consumed and records nothing (57.70383ms) +✔ landRefused files the code on the task, tells the role only with notify, and ends the ticket (54.525551ms) +✔ landHeld is true only for an approved, unspent cross-role merge decision this role raised for a task in this thread (59.310636ms) +✔ landHolders lists a merge decision exactly while landHeld is true for its non-thread instance, in decision order (76.756871ms) +✔ landHolders leaves out a thread instance's decision, even one raised before its role became one (44.771251ms) +✔ landRelease releases the holding run by land-relaunch once it has asked message.receive and nothing delivered to it is unread, and waiting messages go to the next holder (71.562197ms) +✔ a landing run started after the resolution passes checkLand for its held decision before any message.receive, and lands it (56.48783ms) +✔ the bus process answers landHolders and landRelease from their own lines, not as credentialStatus (238.829347ms) +✔ usage.begin with a decision id needs it held for the run's instance, usage.end needs the begin, and the limit checks see the landing turn (71.241254ms) +✔ no run may write the action.allowed for git.merge.protected itself (37.784819ms) +✔ a message to a stopped role sends launch.by one notice, and the result says so (50.249738ms) +✔ a message to a role outside launch.instances says so in its result and in the notice (33.318683ms) +✔ a message to a running role sends no notice and its result is unchanged (26.796352ms) +✔ a re-route at a claim, a release and claim, and a broker restart send no second notice (39.517133ms) +✔ a run launched but not yet claimed counts as no holder (24.392454ms) +✔ no notice for a message to launch.by, from it, a refused one from a tester, to the human, or in a thread to a thread instance (45.28934ms) +✔ a business with no launch block tells nobody and says there is no launcher (22.444883ms) +✔ the notice sender stays internal: no role is named _bus and no caller can send as it or to it (63.760027ms) +✔ row 302 a run threadIdle released answers launcher-released on receive, state, read and send, logs each, and claims nothing again (73.745026ms) +✔ row 302 with a run launcher-released, a run that lost its claim another way still answers not-holder (59.009252ms) +✔ row 302 a run landRelease released answers launcher-released, and claims nothing again (64.97502ms) +✔ C2-03a library.sync: every agent, the tester and a reader are refused before the adapter runs (33.428717ms) +✔ C2-03a library.sync: the human fetches, accept passes through, and a held sync is a recorded refusal (31.652815ms) +✔ C2-03a library.sync: a LibraryError keeps its code and a host without sync is not configured (50.553158ms) +✔ C2-03a runtime: a librarySync from a boot config, with no function, is refused (2.206706ms) +✔ C2-03a runtime: the timer syncs each entry with a user at start and on each tick, logs codes only, and stops on close (843.380782ms) +✔ row 254 human-cli: library.sync outlasts the 5 s client default, and library.status does not (6140.177847ms) +✔ C2-04 M4: both verbs reject every agent before arguments or adapter access (69.595188ms) +✔ C2-04 bus: human reads validate keys and return adapter results without path leakage (31.311921ms) +✔ C2-04 socket: each async library verb resolves its result rather than serializing {} (123.974561ms) +✔ C2-04 runtime: protectedRoots skips library but retains real code-root credential protection (183.594566ms) +✔ C2-04 runtime: unsafe existing mirror refuses boot and never publishes a socket (44.298532ms) +✔ C2-04 runtime: real library adapters reach the socket and lock waits leave other bus reads responsive (378.148901ms) +organization: {"event":"reload-needs-restart","business":"demo"} +✔ T20 fire: a revoke that fails stops the fire with the file unchanged; one that succeeds revokes, keeps the directory and names the services outside the store (167.234649ms) +✔ T20 fire: an instance already delisted still has its tokens revoked and the file is left alone (102.590941ms) +✔ T20 fire: with no entry in the running bus, a token on disk refuses and an empty store goes on (109.329814ms) +✔ T20 delete: a revoke that fails keeps the file; one that succeeds clears the store, deletes, and names the tracker bot (133.486495ms) +✔ T20 delete: with no entry in the running bus, a token file is cleared and the delete goes on; a file reference refuses (116.900732ms) +✔ T21 delete: a write between the raise and the take makes the delete refuse revision-conflict before it revokes anything (117.388719ms) +✔ row 281 T1 fire: a host. or granted gitea file in the store refuses step B credential-revoke-failed, file unchanged (120.278473ms) +✔ row 281 T1 start: a host grant record whose key file is gone starts and reads not-issued (93.783028ms) +✔ row 194 T12: agent and reader sessions refuse the lifecycle verbs before any effect; the tester gets launch, end and the request read, never regenerate (68.43606ms) +✔ row 194 V2 and V4 at the verb: the request is open, by the human, with a human.input; thread, retired, unknown and revoked refuse with no event (44.671856ms) +✔ row 194 D1.1 take: a request is taken once, closes once, and lifecycleRequests lists only what is not closed (38.268037ms) +✔ row 194 D1.1 take: a launch.revoke after the request closes it launch-revoked, and a request past 60 s closes request-expired (47.602093ms) +✔ row 194 T15 (bus): while halted, launch and regenerate refuse processing-halted at the verb and at the take, hire and fire refuse, terminate goes; an unreadable switch refuses with its code (58.859771ms) +✔ row 194 T12a: the tester launches and ends on its own business with actor tester; bus.tester off in the file refuses the call and the take tester-off (48.026722ms) +✔ row 194 V3 terminate: claims revoked, open requests cancelled, bound runs named, taken requests listed; nothing at all answers not-held (51.507824ms) +✔ row 194 V3 terminate of a thread instance: the human ends every thread, the tester only its own (37.894144ms) +✔ row 194 T6 V5 order at the verb: the writer's named refusals, then instance-running, instance-starting, the last-listed refusal and the revision (56.937351ms) +✔ row 194 V5: an open launch past its 60 s is not starting, as it can only close request-expired (24.097988ms) +✔ row 194 V5 after the take: lifecycleDelete re-checks running and starting, then commits through the writer with the human as actor (41.484985ms) +✔ row 194 V5 retry: a retired name deletes again only after workspace-rename-failed, and that request commits nothing (38.713305ms) +✔ row 194 V5 runtime: a delete request, the take and lifecycleDelete commit the file with retired, log the human and reload so the name no longer binds (213.848847ms) +✔ REQ-LIMIT-3 limitLeaves finds every limit object and skips the agent numbers (2.210323ms) +✔ REQ-LIMIT-3 limitLeaves takes token limits at schema depth only, whatever their names (0.345197ms) +✔ REQ-LIMIT-3 with no check switched on a launch is allowed, a turn never stops, and every limit is not enforced (26.989299ms) +✔ REQ-LIMIT-3 a fixture check that refuses refuses the launch and stops the turn, logged with the limit and the count (26.419652ms) +✔ REQ-LIMIT-3 a report that omits a limit shows it not enforced; a counted entry and a reason come through (22.855205ms) +✔ REQ-LIMIT-4 each check gets the business, a copy of the limits, the subject, the records and the time (26.983638ms) +✔ REQ-LIMIT-4 fail closed: a throw refuses, stops and fails the report, naming the check and the code (26.511467ms) +✔ REQ-LIMIT-4 fail closed: a malformed answer, a promise, a rejected promise, a non-boolean or a bad hit is malformed-answer (36.465921ms) +✔ REQ-LIMIT-4 fail closed: a check switched on but not loaded refuses, stops and fails every limit as not-loaded (32.639904ms) +✔ REQ-LIMIT-4 state(), never-loaded case: before any load the report shows not enforced, or not-loaded for a switched-on check (20.16346ms) +✔ REQ-LIMIT-4 state(), first-load-refused case: a check refused on its first load is not-loaded in mayLaunch, mustStop and report (21.521524ms) +✔ REQ-LIMIT-4 fail closed: an unreadable organization file refuses and stops with check null; the report throws (22.858645ms) +✔ REQ-LIMIT-4 fail closed: unreadable records refuse and stop with check null and fail the report (0.825257ms) +✔ REQ-LIMIT-3 the shipped token-limit, through the real loader, counts known records only since the limit was set (38.137349ms) +✔ REQ-LIMIT-3 a token limit for a provider named limit is counted and refuses, beside an agent limit of the same name (20.103698ms) +✔ REQ-LIMIT-3 core reaches limit checks only through the plug-in loader (1.371431ms) +✔ REQ-LIMIT-4 a role run at its limit stops at the end of its turn: RESULT and read land first, the claim is revoked by limit-check (62.796933ms) +✔ REQ-LIMIT-4 the stop also lands on state; a run with no stop ends without a limit (81.966234ms) +✔ REQ-LIMIT-4 fail closed: a mustStop throw or a malformed answer stops the run, naming the bus and the code (166.646868ms) +✔ REQ-LIMIT-4 a thread run at its limit is released with the reason, and its end record names the limit (41.966184ms) +✔ REQ-LIMIT-4 a broker with no limit checks configured never stops a run (28.262484ms) +limits: {"event":"limit-reached","business":"demo","check":"token-limit","export":"mayLaunch","subject":{"instance":"coder","provider":"zai","model":"glm-5.3-flash","account":null},"path":["tokens","instances","coder"],"limit":0,"count":0,"unknownTurns":0} +organization: {"event":"reload-needs-restart","business":"demo"} +usage: {"event":"usage-unknown","business":"demo","run":"run1","instance":"coder","turn":"ae6e0ede-fae9-4780-b92e-fa609dca6ae4","source":"@none","code":"baseline-unknown"} +limits: {"event":"limit-reached","business":"demo","check":"token-limit","export":"mustStop","subject":{"instance":"coder","provider":"zai","model":"glm-5.3-flash","account":null},"path":["tokens","instances","coder"],"limit":0,"count":0,"unknownTurns":1} +usage: {"event":"usage-unknown","business":"demo","run":"run1","instance":"coder","turn":"20b298f8-5f97-483e-83d3-ce90cc380056","source":"@none","code":"baseline-unknown"} +organization: {"event":"reload-needs-restart","business":"demo"} +✔ REQ-LIMIT-3 REQ-LIMIT-4 runtime: limits carries the token count, mayLaunch refuses at the limit, a reset moves since (264.642243ms) +✔ REQ-LIMIT-3 runtime: with no limit check switched on, the limit shows not enforced and every launch is allowed (58.854091ms) +✔ REQ-LIMIT-4 runtime: the broker asks the shipped token-limit after a turn, and the run at its limit stops on its next receive (84.06144ms) +✔ REQ-LIMIT-4 runtime: with no usage source a turn is unknown, counts zero and stops nothing under a limit of 1 (77.395066ms) +✔ REQ-LIMIT-3 runtime: switching a limit check on with plugins.set loads it without a launch or a turn (105.489994ms) +organization: {"event":"reload-needs-restart","business":"demo"} +organization: {"event":"reload-needs-restart","business":"demo"} +✔ limits binds actor from human proof and rejects role, reader, a tester set and forged actor (41.377322ms) +✔ runtime wires verified human settings to the actual shared file writer and actor receipt (173.261239ms) +✔ uncertain organization receipts leave bus startup and reads alone but refuse writes until reconciled (97.773483ms) +✔ within-role sends cite an open gated launch decision without spending it or naming it in grants (48.473158ms) +✔ missing and foreign-business citations refuse and roll back message and grant (33.065404ms) +✔ cross-role sends still need a matching resolved decision and consume it once (42.144468ms) +✔ trail on a hidden message id answers exactly as on an unknown id, for the owner, a reader and the tester (46.779675ms) +✔ replies on a hidden message id answers exactly as on an unknown id, for the owner, a reader and the tester (47.6033ms) +✔ trail on a decision keeps the decision and drops the user thread messages, their deliveries and their events (55.517246ms) +✔ replies leaves out other users thread messages and still fills a page (331.498439ms) +✔ messages in the business human and tester threads are not hidden (row 177 unchanged) (68.239522ms) +✔ governance pin: the owner sees decisions, inbox entries, claims, tasks and project files, but not the user messages (195.882075ms) +✔ messages pages all human messages newest first without writes; read state is history (550.093049ms) +✔ messages refuses role callers, invalid paging and cursors outside this human feed (43.695862ms) +✔ views messages passes only its paging arguments through (0.393733ms) +✔ messages isolates businesses even with a valid foreign cursor (31.483539ms) +✔ the assistant sends to the user and to the chief of staff only (64.695384ms) +✔ an assistant send to any other role, or to the tester, is refused and logged (59.360985ms) +✔ only the user and the chief of staff may send to the assistant; the tester is refused by default (58.151913ms) +✔ REQ-ASSIST-2 REQ-THREAD-1 thread.send to an instance that does not hear from the user is refused and stores nothing (44.347556ms) +✔ a sender-side list alone refuses a send to a role that has no list (52.194988ms) +✔ a target-side list alone refuses a send from a role that has no list (55.478313ms) +✔ the sender list is checked before the target list (49.81672ms) +✔ roles without the field behave exactly as before (69.866584ms) +✔ a business with no role definitions at all is unlimited (67.622276ms) +✔ a malformed messaging field refuses at boot (26.844618ms) +✔ the assistant's review.request to a reviewer is refused and logged, even with an approved decision (52.802435ms) +✔ a review.verdict to the assistant from a role outside its receiveFrom is refused and logged (72.124929ms) +✔ review requests and verdicts between roles without the field are unchanged (51.503731ms) +✔ 3f copy migrates to 3g preserving every old column/row, with an empty instance_names and null to_name (151.503487ms) +✔ REQ-MSG-2: the chief of staff names an instance under its within-role grant, and the write is logged (37.728963ms) +✔ REQ-MSG-2: the human names an instance through the CLI (33.952999ms) +✔ REQ-MSG-2: a role without the grant, or holding it cross-role, is refused not-authorized (36.191062ms) +✔ REQ-MSG-2: a name is unique in the business and is never an instance key or a role name (55.501236ms) +✔ REQ-MSG-2: a send by name reaches the instance and records both; a send by instance key is unchanged (55.263167ms) +✔ REQ-MSG-2: an instance key beats a name that equals it, as when a later instance takes the key (34.656757ms) +✔ REQ-MSG-2: a role name beats a name that equals it, as when a later definition takes the word (sage-0590) (41.929842ms) +✔ proof receives actual peer, cap traffic never invokes helper and transient cap disconnects (10.016152ms) +✔ proof helper error and disconnect during verification never dispatch or bind (2.456089ms) +✔ Client receives explicit proof refusal codes without dispatch, not outcome-unknown (62.468175ms) +✔ asynchronous proof calls release their transient session on success, failure and timeout (30.79439ms) +✔ T2 eight proof callers and a racing copier bind the exact accepted socket, which survives helper exit (427.564466ms) +✔ helper output and failures fail closed including unsafe gid (2.035274ms) +✔ helper timeout, capacity and shutdown refuse without leaving children (26.5699ms) +✔ missing or non-regular peer helper refuses at construction before opening the bus (0.367281ms) +✔ shutdown waits for killed helper close before returning (5.093601ms) +organization: {"event":"reload-needs-restart","business":"demo"} +organization: {"event":"reload-needs-restart","business":"demo"} +organization: {"event":"reload-needs-restart","business":"demo"} +organization: {"event":"reload-needs-restart","business":"demo"} +✔ plugins and plugins.set refuse every non-human session and a forged actor, and pass only the patch with the verified actor (38.654921ms) +✔ runtime: the switch changes the organization file, the receipt carries the actor, and a bad shape, an unknown module and a stale revision are refused with nothing written (199.228909ms) +✔ vikunja:19/309 through the broker, a patch switches the kinds it names and keeps the rest; null removes one kind and is trailed (103.131768ms) +✔ principal binds kernel peer PID and uid, maps owner, and never takes identity or role from body (2.996725ms) +✔ user requires its own nonce and full walk plus immediate same-tree Console parent (0.886991ms) +✔ tester deliberately admits agent parents but rejects managed runs and another nonce (0.572088ms) +✔ human leaf identity is reread after walking the parents (0.311736ms) +✔ console requires its own wrapper, nonce and serve parent, and a configured owner from the spawn env (2.264089ms) +✔ broker process binds trusted launches, offers reader capabilities, refuses human mutation, closes cleanly (290.253973ms) +✔ startup token refusal returns safe code without value or partial listening broker (190.108417ms) +✔ loaded fixture token is absent from socket replies and SQLite, including refusal evidence (249.701559ms) +✔ killed broker leaves an explicit stale lock; another process cannot silently reclaim it (427.638704ms) +✔ trusted host registers later launches; socket clients never have a registration verb (252.482087ms) +✔ REQ-LIMIT-4 the broker process answers the launcher's mayLaunch op with the limits' awaited decision (255.009525ms) +✔ runtime excludes declared project roots even when host supplies no repoRoots (198.092555ms) +✔ a refused launch binding leaves the broker and existing capabilities alive; bad protocol stops it (244.411848ms) +✔ real runtime injects the coordinator, stops its workload and mirrors stable stop events across restart (286.167671ms) +✔ invalid state still starts the control bus and human halt then resume repairs it (108.79434ms) +✔ processing halt and resume extend only the socket timeout while ordinary status retains the explicit timeout (186.261668ms) +✔ a root halt aborts the active search-source signal before the normal web deadline (35.840923ms) +✔ processing.halt refuses agent reader and tester before any transition (44.122502ms) +✔ processing.resume refuses agent reader and tester before any transition (29.822102ms) +✔ human halt and clear each have one event with verified actor; launch.restore cannot clear (31.214105ms) +✔ all ordinary work verbs refuse before dispatch while pure reads remain available (56.276834ms) +✔ task web authorization and bind paths refuse before external work (31.247177ms) +✔ recordEvent cannot forge processing.halt (25.0296ms) +✔ recordEvent cannot forge processing.resume (22.098189ms) +✔ recordEvent cannot forge processing.stop (25.235747ms) +✔ recordTask poll cannot forge a processing action through its kinds filter (21.033599ms) +✔ recordTask self cannot forge a processing action through its kinds filter (23.077903ms) +✔ spec read remains a read but cannot release new write work after an await (31.201996ms) +✔ the real socket awaits halt and resume beyond the ordinary idle deadline (79.299131ms) +✔ a malformed processing reader never silently admits agent work (31.574956ms) +✔ halt refuses the newly landed host executor path before credentials or effects (31.078357ms) +✔ D1: committed write with a failed receipt refuses outcome-unknown without action.allowed (39.698753ms) +✔ D2: spec.read refuses without content if its role is released during the read (24.697348ms) +✔ D3: spec.read secret check refuses flagged content without content (26.541489ms) +✔ D3: spec.read secret check refuses flagged subject without content (21.462236ms) +✔ a human lists, opens and saves; the save is one commit by the business human (203.382212ms) +✔ an agent and a reader refuse every file verb and nothing is written (76.909062ms) +✔ a stale base refuses stale-base and writes nothing (130.708762ms) +✔ paths outside the spec and docs refuse, as do unknown projects, missing files and odd arguments (111.838614ms) +✔ without a project adapter the file verbs refuse project-not-configured (57.130868ms) +✔ on the socket a save may carry 1 MiB of text; every other request keeps the 64 KiB limit (467.592558ms) +✔ a request that names the save verb first and another verb last is refused at 64 KiB (126.115804ms) +✔ two saves racing for one repository make one commit (284.481513ms) +✔ Broker keeps the sandbox client import closure: only the listed imports, no lazy project import (3.682984ms) +✔ without a trusted project adapter all three async paths refuse project-not-configured (76.004812ms) +✔ real startBroker injects the project adapter for socket reads and bound-author record writes (351.283498ms) +✔ a raise with no recorded push refuses no-push; a raise binds the latest push and shows it (61.0526ms) +✔ happy path: the fork is the upstream repo under the agent's own user, the destination is host-built (44.053975ms) +✔ a hard wait: no decision refuses, and a decision for another task refuses (40.676502ms) +✔ r4 B4: approve while the latest push is A, push B, publish refuses decision-mismatch (91.720624ms) +✔ grant and fork refusals (84.133975ms) +✔ remote-not-fork, compared without case, and remote-host-mismatch, at push (172.237422ms) +✔ two agents granted one project each get their own fork (101.353896ms) +✔ the request cannot name the fork, the user or the destination (50.186908ms) +✔ one decision, one open publish: a second ticket refuses publish-busy, whatever its branch (104.362194ms) +✔ publishRefused files the code on the task's trail and drops the ticket (42.157553ms) +✔ git.push.remote is in neither ROUTED list and no shipped role grants it (1.968963ms) +✔ runtime: withGitea keys from the open ticket only, and the store root is the organization dir (171.493986ms) +✔ the bus process answers the publish ops from their own lines, not launch-op-refused (260.905544ms) +organization: {"event":"reload-needs-restart","business":"demo"} +organization: {"event":"reload-needs-restart","business":"demo"} +✔ T14 a create goes live with no restart: the new instance binds at once and the answer says restart false (127.830753ms) +organization: {"event":"reload-needs-restart","business":"demo"} +organization: {"event":"reload-needs-restart","business":"demo"} +organization: {"event":"reload-needs-restart","business":"demo"} +organization: {"event":"reload-needs-restart","business":"demo"} +organization: {"event":"reload-needs-restart","business":"demo"} +organization: {"event":"reload-needs-restart","business":"demo"} +✔ T14 every committed verb reloads once, limits.set, routes.set, plugins.set and veto.set included, and a refused one does not (151.838534ms) +✔ T14 a definition change on a running instance refuses instance-running; a vars change still goes live (140.36515ms) +✔ T14 a file whose credential references differ from the boot copy is not reloaded and the write answers restart true (95.060168ms) +✔ T14 a date-only change to a credential reference still reloads: row 199 issue rewrites the date outside the reload (84.822917ms) +✔ T19 a credentialed create answers restart true; issue works only after a restart, and a later vars change goes live (182.660481ms) +✔ T14 after a refused reload veto.set, instance.hire and instance.fire answer restart true, and a fire of a name kept since refuses before step A (222.140226ms) +✔ T14 a file whose project root differs from the boot copy is not reloaded, because the Credentials store protects the boot roots (84.463002ms) +organization: {"event":"reload-needs-restart","business":"demo"} +✔ T14 a file whose library mapping differs from the boot copy is not reloaded, because the mirror is ensured at start (356.104875ms) +✔ T14 reloadBusiness refuses an unknown business, a changed human and a document the boot check refuses (20.666173ms) +✔ a reply is listed for human and reader sessions, and its delivery rows are unchanged (66.963335ms) +✔ the reply still reaches the human message.receive (mosaic talk) after the Console showed it (39.143859ms) +✔ a message with no reply gives an empty list (31.053777ms) +✔ replies come oldest first and stop at REPLIES (139.509719ms) +✔ an id that names no message in the business refuses message-not-found, and the refusal is recorded (51.712437ms) +✔ strict arguments; a role session gets human-required (71.255936ms) +✔ views passes replies through as one call with the id (0.447513ms) +✔ requirements returns the committed list to a holding role session, and no one else (60.977993ms) +✔ the PM's prd.approve with no task, when no id fits, reaches the human's Inbox (35.737732ms) +✔ the PM's non-blocking role.revoke with no task reaches the human's Inbox (34.958085ms) +✔ a push is recorded as the action.allowed for git.push.working on the task, and only the host records one (71.960792ms) +✔ review.request names the latest pushed commit and sends the reviewer a REVIEW-REQUEST (54.459459ms) +✔ review.request says which run holds the reviewer role, or null, and a null request waits for a claim (57.666532ms) +✔ review.request refuses a commit that isn't the latest push, a non-reviewer and a role without the action (67.988755ms) +✔ reviewFetch answers only the addressed reviewer, for the request it cites (46.586552ms) +✔ review.verdict answers one request once, to the role that asked (52.83241ms) +✔ task.close on a pushed task needs an approve verdict for the latest push (68.593171ms) +✔ a refusal the host decided is filed on the task it names, and only a task ref counts (48.360144ms) +✔ row 306 T1: a run the timer sweep ended answers thread-revoked on every claim-needing call, logged, and its claim still refuses run-revoked (75.734332ms) +✔ row 306 T1: a user's request and access.reload end the run the same way, and it answers thread-revoked (95.472489ms) +✔ row 306 T2: after the sweep, a run the human stopped and a run the limit stop ended still answer not-holder (56.907053ms) +✔ room.open sorts all threaded instances, creates defaults, and reuses caller-owned threads (45.742324ms) +✔ room.open preflights instance collisions atomically (28.120376ms) +✔ room.open preflights owner collisions atomically (30.265946ms) +✔ room verbs require the human, and none is a tester verb (37.745019ms) +✔ room verbs refuse missing projects and zero member businesses (59.696454ms) +✔ send/read refuse a missing canonical member without effects (29.882323ms) +✔ send/read refuse a foreign-owner canonical member without effects (37.899972ms) +✔ send/read refuse a wrong-instance canonical member without effects (41.483298ms) +✔ room.send targets a key, broadcasts without tags, and preserves original text and ordinary route/input rows (42.087289ms) +✔ current display names and repeated tags resolve once; a replaced display name is unknown (45.7598ms) +✔ a legacy name colliding with another member key is ambiguous; its own key resolves once (37.514297ms) +✔ unknown or non-member addressees and tags-only bodies leave no message effects (43.466847ms) +✔ messaging denial on the last target rolls back the entire broadcast; allowed subset still works (30.935053ms) +✔ a clearing last member fences the whole send; another active target still accepts (37.057832ms) +✔ room.read groups one send, pages by the last grouped id, and rejects foreign or absent cursors (76.530009ms) +✔ room.read keeps identical sends at the same timestamp separate and includes every session (59.022747ms) +✔ room.read defaults and caps the number of merged entries, not recipient rows (876.556837ms) +✔ room.read includes an agent reply with its thread and instance without merging it with human rows (44.069784ms) +organization: {"event":"reload-needs-restart","business":"demo"} +✔ row 65: routes and routes.set refuse every non-human session, the chief of staff included, the tester may read and set, and each passes the verified actor (62.089004ms) +✔ row 65: a new launch binds only on a switched-on harness with a module name, and a run an earlier broker bound binds again after its harness is switched off (45.674574ms) +✔ row 65 runtime: harnessLevels answers each module in the tree, and null for a name with no module (67.790149ms) +✔ row 65 runtime: routes and routes.set reach the organization file with the human as actor, a new bind reads plugins.harness, and each refusal keeps the bytes and logs nothing (173.397924ms) +✔ v3b prototype refusals, views and append-only mutations (169.805897ms) +✔ T4 D7: a clear of a held default session fences it, drains at the next receive, retires at the exit proof and moves the default (78.310313ms) +✔ T4 D7: an unheld session drains at accept, its proof is run null, and a non-default clear leaves the default (35.448563ms) +✔ T4 D7: a run that ends before its next receive drains at its end, with its generation (47.984649ms) +✔ T4 D7: a run whose turn is running (delivered, unread) stays clearing; uncertain is recorded once and nothing more (55.314519ms) +✔ T4 D7 B1: undelivered inputs are cancelled with receipts at accept, never delivered to the successor, and a routed reply is cancelled at arrival (58.384444ms) +✔ T4 D7: repeat, conflict, a second op, a stale revision, confirm and a halt (52.618466ms) +✔ T4 Q4: the successor takes -N, the next N free, and a bound name stays taken (43.563582ms) +✔ T4 D8: the successor start is held, refused or started, each report on its own counter (48.016947ms) +✔ T4 D7 N4: a halt at retirement waits and writes nothing; retirement goes once processing resumes (37.064241ms) +✔ T4 sage-2828: a cancel before retirement makes the session active again, keeps the claim and the cancelled messages, and never makes the successor (51.293892ms) +✔ T4 sage-2828 sage-2830: a cancel after retirement ends the startup only, and a later thread-only send makes the successor pending as new input (40.645144ms) +✔ T4 N4: a user's thread whose grant is gone by retirement ends the clear failed, writes no successor, and leaves the session as it was (39.73566ms) +✔ T4 N4: a user's thread whose grant is live at retirement retires the session and makes its successor (36.220516ms) +✔ T4 sage-2828: a cancel after the successor started refuses session-clear-complete (38.174725ms) +✔ T4 B2: a run bound to a clearing session refuses its claim, and claims again once the clear is cancelled (39.090493ms) +✔ T4 mos-1325: the tester clears its own thread; its clear, cancel and operation on a human-owned thread refuse thread-not-owned and write nothing (48.101931ms) +✔ T4 schema: session_ops and message_cancels are append-only, and a second open clear of a session is refused below the broker (38.570351ms) +✔ T4 schema: a 3m store migrates to 3n, session_ops and message_cancels are new and empty, and every other row stays as it was (181.548218ms) +✔ T4 schema: the 3m engine refuses a 3n store, migrating or not, and leaves it as it was (315.989549ms) +✔ session.list rows carry the reader count for each session, with its store identity (36.958507ms) +✔ a legacy session is asked for with legacy true (28.34857ms) +✔ without a reader the count is unknown, never 0; a reader that throws is store-unreadable (47.661823ms) +✔ compactions must be a function (22.132095ms) +✔ T1 REQ-ROLE-2: two sessions of one thread keep their own history, delivery and replies (90.992892ms) +✔ T2 REQ-ROLE-2: one holder per session, generations count its claims, and a sibling session's message never reaches the other holder (70.215354ms) +✔ T2 sage-2257: a released or revoked run's retired generation refuses its approval, delivery and read, and writes nothing (77.898325ms) +✔ session.create is idempotent on its op, refuses a reused op or a taken name, and reaches only the owner's threads (67.782981ms) +✔ the 3l triggers keep sessions in their thread and session ids apart from thread ids (127.383244ms) +✔ T7: a 3k store migrates to 3l, each thread's default session has the thread's id, and old rows keep their seqs (190.538585ms) +✔ T7 D9: the 3k engine refuses a 3l store, migrating or not, and leaves it as it was (302.120915ms) +✔ gated approval authorizes once, survives store reopen, and fresh approval works (58.620365ms) +✔ another run of the same instance consumes an approval once; a failed check leaves it usable (39.279093ms) +✔ two scheduled callers have exactly one grant and one consumed refusal (27.775774ms) +✔ failed commit rolls consumption back; cross-role consumes and within-role stays reusable (56.509215ms) +✔ class drift gated to cross-role refuses before consumption (47.180611ms) +✔ class drift cross-role to gated refuses before consumption (45.550014ms) +✔ class drift gated to within-role refuses before consumption (43.664179ms) +✔ class drift cross-role to within-role refuses before consumption (42.158925ms) +✔ class drift within-role to gated refuses before consumption (36.117508ms) +✔ class drift within-role to cross-role refuses before consumption (42.962882ms) +✔ message.send consumes approval and prevents a later send or authorize (40.598076ms) +✔ role.revoke consumes approval and prevents a later revoke or authorize (46.192589ms) +✔ 3e copy migrates through 3f to 3g preserving every old column/row and adding null spec citations (154.2633ms) +✔ a human spec save sends one notice to each pm and cto, naming the commit, and each commit sends its own (227.871455ms) +✔ no notice for a docs save, an agent record commit, a git commit outside the Console, or a refused save (264.252888ms) +✔ a notice to a role no run holds waits for a claim, and launches nobody and tells nobody (135.934972ms) +✔ a business without a pm or a cto saves the spec and sends nothing (109.535008ms) +✔ a notice that cannot be stored answers outcome-unknown, and the commit stands (140.251907ms) +✔ a BLOCK reaches the chief of staff, the chief relays it to the assistant in the user's thread, and the commit stands (156.646283ms) +✔ with no thread a BLOCK still reaches the chief of staff, and the relay to the assistant is refused (177.776145ms) +✔ within the notice's project the relay lands in the user's most recently opened thread (145.128717ms) +✔ a more recently opened thread in another project does not take the relay (141.96751ms) +✔ a BLOCK is refused from anyone but a pm or cto, to anyone but the chief of staff, and outside a reply to its own notice (148.371196ms) +✔ a role cannot forge a spec notice: its text opens neither a BLOCK nor the assistant's thread (159.893106ms) +✔ the bus receives nothing: a reply to a notice addressed to _bus is refused (131.594858ms) +✔ real socket awaits spec reads, record writes and cited raises; other requests still return normally (197.550429ms) +✔ real socket preserves asynchronous refusal codes and disconnects its transient proof (117.265942ms) +✔ two real socket writes to one repository yield one commit and one project-busy refusal (116.894092ms) +✔ client disconnect during await tolerates late reply (107.807294ms) +✔ client disconnect during await tolerates late refusal (80.661602ms) +✔ N-a: slow admitted record.write returns its committed result after the idle deadline (286.115667ms) +✔ current citation is recorded; docs commits do not stale it and a new spec never reopens settlement (183.485744ms) +✔ stale, unconfirmed, missing and partial spec citations refuse without inserting a decision (181.160721ms) +✔ uncited raises retain their synchronous path and spec read is available to any held role in its business (85.710549ms) +✔ record writes bind the session author, require authority and refuse spec and impersonation paths (96.414178ms) +✔ REQ-COS-1: the pm asks the chief of staff for roles and counts; the chief receives a STAFF-REQUEST and answers it (56.31054ms) +✔ REQ-COS-1: only the pm can send a staff request; every other session is refused and the chief of staff hears nothing (55.801823ms) +✔ REQ-COS-1: a pm without message.send is refused like any other gated action (30.307675ms) +✔ REQ-COS-1: the request goes to the business launcher, and only when that is a chief of staff (75.975858ms) +✔ REQ-COS-1: the sender is judged by definition: an instance `lead` of the pm definition can ask, an instance `pm` of the coder definition can't (75.816802ms) +✔ REQ-COS-1: the launcher is judged by definition: an instance `boss` of the chief-of-staff definition receives, a `chief` of the coder definition gives no-chief-of-staff (66.473632ms) +✔ REQ-COS-1: a refused staff request leaves no staff.request action.allowed event (46.157274ms) +✔ REQ-ASSIST-2: the role definitions' messaging lists hold for a staff request, sender and recipient (107.498174ms) +✔ a staff request names a task, 1 to 10 distinct roles and counts of 1 to 20; nothing else is accepted (76.635989ms) +✔ REQ-COS-1: a staff request grants nothing: the pm still can't launch and the chief of staff launches as before (41.42667ms) +✔ a business that never switched launches reads allowed with no time and no event (37.880088ms) +✔ launches revoked and then restored read allowed, with the restore time and event id (31.116813ms) +✔ a task closed on the tracker leaves the open list, and total counts the open ones (31.454321ms) +✔ a tombstone is not open (28.130013ms) +✔ the open list stops at the cap and says so; total still counts every open task (30.708677ms) +✔ a role and a reader session read state; arguments, and an unbound cap, refuse (28.574756ms) +✔ a human session reads the same state, with the same cap (33.514347ms) +✔ reading state writes nothing: every table keeps its row count (32.455178ms) +✔ creates private WAL store and excludes a second writer until explicit close (25.83605ms) +✔ rollback is atomic and schema metadata is checked against trusted DDL, not just itself (25.858241ms) +✔ existing empty database and symlink runtime directory refuse, never initialize over damage (28.047718ms) +✔ crash during a transaction recovers no partial event after explicit fixture-only lock removal (107.083656ms) +✔ writer refuses mixed at/read_at forms atomically, even through trusted SQL helpers (19.322644ms) +✔ async transactions refuse before invoking their function (15.660106ms) +✔ usage_records refuses non-canonical timestamps atomically (21.407742ms) +✔ the session default fits under the reply cap and pages to the end with next (236.877975ms) +✔ the short form: no description, assignees by role, every listed key (154.952079ms) +✔ each filter, alone and together, and total counts every match (273.99343ms) +✔ task_ref reads one task in full, as the whole board has it (176.673302ms) +✔ no arguments is the read the Console and mosaic make, unchanged (150.473335ms) +✔ an unknown argument or a bad value refuses invalid-request (581.808535ms) +✔ tasks rows carry priority and requirement for every session that reads tasks (64.956741ms) +✔ the read model rebuilds from the ledger: a reopened bus and each trail give the same values (92.603076ms) +✔ an empty business and one with snapshots but no task.created read cleanly (31.450502ms) +✔ recordTask keeps sync reads and a role write apart (45.562319ms) +✔ read_at must be one canonical UTC format, so the projection compares strings safely (27.874804ms) +✔ a bad entry refuses the whole record (26.662929ms) +✔ taskView reads the projection for one business (30.649557ms) +✔ requestTask hands only a holder and a task verb to the handler, and records refusals (50.484816ms) +✔ the server sends task verbs to the adapter with its own timeout; other verbs stay synchronous (338.654591ms) +✔ without an adapter the server refuses every task verb (76.78129ms) +✔ the runtime refuses an invalid adapter and closes a valid one (97.057508ms) +✔ the process loads the S3 adapter from plain-data trackers (449.951057ms) +✔ row 177 T1: a tester thread is owned by tester, and neither side reaches or lists the other (61.28432ms) +✔ row 177 T2: the tester thread.send is from tester-cli with no human.input; its open is by tester (36.644318ms) +✔ row 177 T3: the lists read the tester as the human in its own thread, and nowhere else (51.078733ms) +✔ row 177 T3: an assistant that would not hear the human refuses the tester too (31.213666ms) +✔ row 177 T4: the tester thread run answers the tester, never the human (61.885942ms) +✔ row 177 T5: each stop revokes only its own threads, recorded by its own actor (48.610811ms) +✔ row 177 T5: the human stop never ends a tester run (33.821804ms) +✔ row 177 T6: a business whose human is tester refuses invalid-business (21.761261ms) +✔ row 177 T7: the human trail shows a tester thread message as the tester (36.394764ms) +✔ row 177 T8: a tester-thread run never raises a decision to the human; a human-thread run still does (39.874633ms) +✔ row 177 T8: a tester-thread raise routed to the arbiter stays allowed (35.816124ms) +✔ row 182 T9: a tester reply into the human's thread refuses thread-not-owned and stores nothing (37.327888ms) +✔ row 182 T9: a tester reply into its own thread lands there (40.615156ms) +✔ row 182 T9: the chief's reply up a chain into a tester's thread lands there (42.618632ms) +✔ row 182 T9: a tester reply to a spec notice refuses thread-not-owned; the chief's relay still lands (44.318624ms) +organization: {"event":"reload-needs-restart","business":"demo"} +organization: {"event":"reload-needs-restart","business":"demo"} +organization: {"event":"reload-needs-restart","business":"demo"} +organization: {"event":"reload-needs-restart","business":"demo"} +organization: {"event":"reload-needs-restart","business":"demo"} +✔ row 175: TESTER_VERBS and the organization branch tester set are pinned (2.047768ms) +✔ row 175: each of the six reads as the tester deep-equals the human read (137.609836ms) +✔ row 175: W1-W3 as the tester land with receipt actor tester; the human still logs the human (146.671746ms) +✔ row 175: W2 as the tester refuses credentials, protected definitions, human, tester and bus.tester, and changes nothing (107.082365ms) +✔ row 175: the human-only actions refuse a tester tester-refused, and the file and store stay as they were (109.865061ms) +✔ row 175: W4 as the tester writes by tester and keeps every name check (38.724471ms) +✔ row 175: W6 as the tester records created_by tester; the human records the human (28.09854ms) +✔ row 175: with bus.tester unset or not exactly true no tester binds, so no read or write runs (89.284676ms) +✔ the tester binds only when the business sets bus.tester to exactly true (165.127061ms) +✔ a business may not name a role tester, so the tester address is never a role (46.305618ms) +✔ every verb outside the tester list refuses tester-refused and is recorded against the tester (80.943021ms) +✔ a tester message is from tester, needs no prefix, and writes no human.input or authority (40.063501ms) +✔ a tester message to a role no run holds refuses tester-target-not-running and stores nothing (30.543554ms) +✔ a tester message is refused while the run is only launched, and routes once it claims (31.370523ms) +✔ a human message to a role no run holds still waits and tells launch.by (26.660411ms) +✔ a role answers a tester only in reply to a tester message, and the answer never reaches the human (51.502686ms) +✔ the tester reads the human views a reader reads (46.585386ms) +✔ tester proof binds its own CLI, start time and nonce, refuses a managed run and allows an agent (2.059554ms) +✔ neither CLI's nonce proves the other: each proof is bound to its own CLI and nonce variable (0.624743ms) +✔ testerNonce reads only the tester's variable and gives null on any read error (0.314056ms) +✔ an envelope carries exactly one of cap, human and tester; no tester authenticator refuses (176.174815ms) +✔ tester-cli.mjs binds through the runtime when the switch is on, and refuses off or under a run marker (1511.818599ms) +✔ T1: the human and the reader see a held thread claim; agents still lists the role only (51.612409ms) +✔ T2: a released or revoked thread claim is not listed, though its thread has an earlier claim row (46.28597ms) +✔ T3: a role session refuses human-required and the tester refuses tester-refused (43.105878ms) +✔ T4: agents answers each session the same before and after a thread run claims (43.328911ms) +✔ T5: the result carries neither the thread name a user wrote nor a message body (39.073598ms) +✔ T6: two held sessions of one thread list as two rows, each its session's latest claim (41.09766ms) +✔ REQ-THREAD-1 REQ-ORG-2: the 3d→3e migration adds the thread tables and leaves messages from before threads as written (177.901745ms) +✔ REQ-THREAD-1: a 3d bus with a changed schema is refused and keeps its version and tables (84.065277ms) +✔ REQ-THREAD-1: the offline command prints the kept-message counts before the ready line (200.273354ms) +✔ a share lets the sharee read the thread and nothing else: every write verb stays the owner's (mutants 7, 9) (71.09819ms) +✔ the business human shares too, and a `*` share reaches every covered principal but the tester (45.731095ms) +✔ mutant 2: a share never widens a grant; when the sharee's grant stops covering the thread, its reads end (46.659913ms) +✔ mutant 3: a thread whose user owner has lost coverage is hidden from its sharees, the owner's board included (65.281774ms) +✔ mutant 4: a share's state is its latest row, so an unshare ends it and a share after it starts it again (54.252514ms) +✔ mutant 8: a user target needs a live grant of any level covering the thread, else share-not-covered (42.668191ms) +✔ a viewer reads a thread shared with it, and share, unshare and shares refuse a viewer access-refused (design 4.3) (46.4279ms) +✔ a share target is `user:`, the business human or `*`, and never the sharer (76.760056ms) +✔ a user whose collaborator grant no longer covers its own thread can't share, unshare or list its shares (48.752984ms) +✔ the tester and a reader session never share: each verb refuses and writes nothing (62.096897ms) +✔ the owner's trail and replies show a user's message only while that user's thread is shared with the owner (54.375836ms) +✔ a share covers every session of the thread (43.968747ms) +✔ a sharee can't list the thread's sessions: session.list stays owner-only (Q7, sage-2818 Q1) (40.882838ms) +✔ only a human principal matches a share: an agent bound to the thread and the tester match none (sage-2818 Q2) (61.713357ms) +✔ a 3l store migrates to 3m: thread_shares is new and empty, and every other row stays as it was (161.484145ms) +✔ the 3l engine refuses a 3m store, migrating or not, and leaves it as it was (299.302848ms) +✔ REQ-ROLE-2 REQ-THREAD-1: one holder per thread, through the broker and the trigger (73.689917ms) +✔ REQ-ROLE-2 REQ-THREAD-1: the 3e triggers refuse writes that skip the broker (128.83933ms) +✔ REQ-MSG-1: a message to or from the assistant names its thread, or is refused (68.050939ms) +✔ REQ-MSG-1: the chief of staff's reply comes back to the thread that sent the work (1074.279441ms) +✔ REQ-MSG-1: a reply can't carry one thread instance's thread to another thread instance (32.318188ms) +✔ REQ-THREAD-1 REQ-USER-2: one thread's messages never reach another thread's holder (42.234227ms) +✔ REQ-LAUNCH-1: a message to a thread with no holder waits, and the next holder gets it (51.237409ms) +✔ REQ-THREAD-2 REQ-LAUNCH-1: threadIdle releases only a thread with nothing waiting, and only for its holder (55.870499ms) +✔ REQ-THREAD-2 REQ-LAUNCH-1: a message delivered to a run that ended unread doesn't hold up the next holder (46.248591ms) +✔ REQ-ROLE-2 REQ-THREAD-1 Q169: a role.revoke the human approved ends every thread run of the assistant (33.613822ms) +✔ Q169 REQ-USER-2: assistant.stop ends the human's own assistant thread runs, and only the human's (46.155747ms) +✔ REQ-USER-2: the human verbs refuse another owner's thread (37.34368ms) +✔ REQ-THREAD-1: thread.create refuses when the business has no thread instance or more than one (36.365891ms) +✔ REQ-ORG-2: projects and threads are named once, and the repo names a business project (45.161412ms) +✔ REQ-THREAD-2: thread.messages returns the thread's history in pages and writes nothing (116.111877ms) +✔ project.create refuses a repository name without its matching repo before any write (20.134957ms) +✔ project.create keeps unrelated names with and without a repository (14.976315ms) +✔ C2-09a: explicit creative instances bind independent threads, default sessions and holders (64.089301ms) +✔ C2-09a: explicit missing, non-thread and malformed selectors create no thread or session (26.346082ms) +✔ C2-09a: creative bindLaunch without a thread refuses thread-required (15.03354ms) +✔ socket capability stamps launch identity; shared views use wire, no SQL client (80.225052ms) +✔ two wire claims serialize; a lost reply never automatically retries (74.051797ms) +✔ malformed, oversized and identity-forging envelopes refuse without echoing input (52.623617ms) +✔ client preserves UTF-8 when a response divides a multibyte character (12.717664ms) +✔ committed mutation followed by dropped reply reports unknown and is never retried (56.42994ms) +✔ REQ-LIMIT-4 usage protocol binds run identity, requires a delivered turn and isolates businesses (44.968952ms) +✔ REQ-LIMIT-4 3g copy migrates through 3h, 3i, 3j and 3k to 3l preserving every old column, row and sequence; new usage table is empty (160.806993ms) +✔ REQ-PLUG-1 runtime reaches transcript only through loader, over the real bus socket (103.900979ms) +✔ REQ-LIMIT-4 loader source records new turn kinds, excludes history and retries exactly once (25.294746ms) +✔ REQ-LIMIT-4 cut: unknown is durable and logged next to every total (22.400565ms) +✔ REQ-LIMIT-4 disabled: unknown is durable and logged next to every total (21.717802ms) +✔ REQ-LIMIT-4 missing-begin: unknown is durable and logged next to every total (16.759647ms) +✔ REQ-LIMIT-4 no-new-usage: unknown is durable and logged next to every total (18.005431ms) +✔ REQ-LIMIT-4 rewrite: unknown is durable and logged next to every total (20.078362ms) +✔ REQ-LIMIT-4 unfinished turn remains visibly unknown after accounting restarts (16.423622ms) +✔ usage records are append-only (20.111147ms) +✔ REQ-LIMIT-4 parse failure logs its safe code, never transcript content (20.911277ms) +✔ REQ-LIMIT-4 resumed run baselines history and exact totals do not overflow (23.687483ms) +✔ REQ-PLUG-1 core has no transcript import and disabled sources do not read any transcript (17.545222ms) +✔ REQ-LIMIT-4 a resumed thread bills only new assistant messages to its next run (19.556407ms) +✔ REQ-LIMIT-4 every enabled source is called; failure is unknown and a partial total stays labelled (25.838643ms) +✔ REQ-LIMIT-4 a turn whose reported sum exceeds safe precision is unknown, not rounded (19.720066ms) +✔ row 65 a run bound without a transcript directory records no-transcript (17.876086ms) +✔ R3: bindUser binds a granted user and refuses one with no live grant (26.116948ms) +✔ R3: a user named like the business human, the tester or a principal word is refused, whatever the grants say (20.238394ms) +✔ R3: each collaborator verb is allowed to a granted user (39.862233ms) +✔ R3: every verb off the collaborator list refuses a user access-refused before its own checks (209.334951ms) +✔ R3: task, web and host verbs refuse a user access-refused (44.333076ms) +✔ R3 leak: project.list shows granted projects only (23.522919ms) +✔ R3 leak: thread.create needs the project and the thread instance granted, and an ungranted id reads as one that does not exist (27.688078ms) +✔ R3 leak: thread.list shows the user its own threads that are still granted, never others (68.539626ms) +✔ R3 leak: names shows granted instances only (28.729402ms) +✔ R3: thread.send is from user: and writes no human.input (22.378692ms) +✔ R3: a reply-chain message.send into another user thread is refused (29.216409ms) +✔ R3: the run reply to a user message reaches that user thread.messages, with no waiting and no notice (26.013971ms) +✔ R3: a reply to: user without a matching in_reply_to is refused user-reply-required (45.048963ms) +✔ R3: a non-thread run, the human and the tester cannot send to: user (25.662923ms) +✔ R3: a user thread run cannot message the owner, while its uncited gated raise reaches only the owner inbox, B9 (27.401221ms) +✔ R3: a removed or expired grant refuses the next request access-revoked, and the file is read per request (27.153581ms) +✔ R3: a user refusal is recorded as action.refused by user: (21.635906ms) +✔ R3: a business with a role keyed user refuses invalid-business (14.367351ms) +✔ R3: name.set refuses the name user (16.083036ms) +✔ R3 r4: while halted, a granted user's thread.send refuses processing-halted and thread.messages still answers (24.288109ms) +✔ R3 r4: the chief's hire refuses an instance named user with the code it gives human and tester (21.427753ms) +✔ R3 r4: a non-function access throws before the store is read (0.181384ms) +✔ C2-09a: naming an instance cannot bypass its collaborator grant or disclose an ungranted project (25.699447ms) +✔ 264e deferred B6: a reply cannot cite the same user in a sibling session (35.559021ms) +✔ 275: VIEWER_VERBS is the ruled read list, inside USER_VERBS (1.800108ms) +✔ 275: a viewer binds, and each viewer verb answers with what its grant covers (53.267541ms) +✔ 275: a viewer is refused thread.create, thread.open and thread.send access-refused, and nothing is stored (35.560734ms) +✔ 275: every verb off the user list refuses a viewer access-refused before its own checks (195.260483ms) +✔ 275: mixed grants, collaborator on one project and viewer on another, take the level per project (44.978154ms) +✔ 275: board reads refuse users and viewers access-refused (132.992649ms) +✔ governance pin, user side: decisions, inbox entries, claims, tasks and project files are the owner's, the user reads its messages (77.975904ms) +✔ web.search: a granted role gets labelled results, and the call is trailed with role, run, verb and query (38.18798ms) +✔ web.fetch: a granted role gets the page as labelled text, and the call is trailed with the url (36.108028ms) +✔ a role without the grant is refused, the refusal is logged with the verb, and nothing is fetched (36.021074ms) +✔ a broker with no web service refuses a granted role (27.553615ms) +✔ bad requests are refused: unknown verb, extra or missing argument, not a string, a human or reader session (33.711265ms) +✔ a session that is not the role holder is refused (20.618956ms) +✔ web.mjs's fences hold on the broker side: refusals are normal results with the fixed reason (63.542945ms) +✔ web.search with no search source configured is a refused result, not an error (26.439155ms) +✔ a search source that fails with its own refusal, or that throws, is handled (32.930375ms) +✔ a slow search source ends in a refusal at the deadline (75.926094ms) +✔ a secret in the arguments is refused before anything is trailed or fetched (19.084828ms) +✔ over the socket: the server routes web verbs to the service; other roles are refused; no service is web-not-configured (96.513531ms) +✔ busBusiness: the web grant comes from "web" in the resolved tool limit (0.331306ms) +✔ webServices: the business's search-source plug-in and web.searxng var make web.search work; without either it is refused as not configured (66.757476ms) +✔ an ungranted call is refused at once: no admission, no wait, nothing touched (24.265123ms) +✔ over the socket an ungranted caller is dropped by the server timeout and a granted one gets the longer wait (351.589499ms) +✔ a search that never answers is aborted at the deadline, the module sees the signal, and the call is trailed as refused (timeout) (78.223705ms) +✔ a fetch that stalls is cut off at the deadline: the request is destroyed, not left running (100.411909ms) +✔ one query limit: over SEARCH_MAX_QUERY_CHARS or empty is refused with the same reason before any backend, and the tool schema carries the same number (28.424402ms) +✔ merge-gate's technical raise is cross-role, goes to the cto, and only merge-gate can use the approval (61.797076ms) +✔ merge-gate has no message.send, and without a domain its raise goes to the delivery arbiter (49.983262ms) +✔ the cto must be able to message merge-gate, or the technical raise is refused (row 133) (38.549522ms) +✔ security-reviewer answers a review with its verdict alone; it holds no message.send (47.470222ms) +ℹ tests 974 +ℹ suites 0 +ℹ pass 974 +ℹ fail 0 +ℹ cancelled 0 +ℹ skipped 0 +ℹ todo 0 +ℹ duration_ms 24660.8691 diff --git a/agents/beakley/work/queue-217/run-r2/business-suite.log b/agents/beakley/work/queue-217/run-r2/business-suite.log new file mode 100644 index 000000000..9bbab363f --- /dev/null +++ b/agents/beakley/work/queue-217/run-r2/business-suite.log @@ -0,0 +1,280 @@ +npm notice run @mosaic/business@0.1.0 test +npm notice run node --test tests/ +✔ a grant's level is collaborator or viewer (2.351697ms) +✔ any other level refuses with the key path named (1.505284ms) +✔ covers tells a viewer grant from a collaborator grant (0.605812ms) +✔ covers refuses a call with no level, so a viewer grant can't slip past a collaborator check (0.247487ms) +✔ a viewer grant still needs its business, project, instance and expiry to cover (0.247397ms) +✔ a valid document passes and comes back frozen (4.146183ms) +✔ checkAccess does not freeze or alias the caller's document (0.552481ms) +✔ LEVELS is the single allowed level set, collaborator and viewer (row 193a) (0.259109ms) +✔ accessFilePath is access.json in the config directory (0.495701ms) +✔ top level: object, unknown keys, accessVersion, revision, arrays (2.131141ms) +✔ users: unknown keys and the id rule (0.609866ms) +✔ users: human, tester and any business's human are refused (0.455944ms) +✔ users: home is a given peer or local (0.372673ms) +✔ users: subjects, provider, sub, uniqueness and owner subjects (2.126611ms) +✔ grants: unknown keys, id, user and business (0.897075ms) +✔ grants: projects is ["*"] or distinct lowercase UUIDs (1.199677ms) +✔ grants: instances is ["*"] or distinct declared instances of that business (0.889396ms) +✔ grants: any level other than collaborator or viewer refuses, naming grants[i].level (1.13158ms) +✔ grants: expires is optional ISO time, and a past expiry is not refused (0.979808ms) +✔ the context is required and checked (1.713394ms) +✔ loadAccess reads a valid file and checks it (0.755936ms) +✔ loadAccess refuses a missing file, a symlink and a directory with exit 4 (0.519376ms) +✔ loadAccess refuses another owner and group or other write (0.581157ms) +✔ loadAccess refuses bad JSON and a bad document with exit 2 (1.841309ms) +✔ covers: * and listed ids match (0.340508ms) +✔ covers: an unlisted project, instance or business doesn't match (0.20254ms) +✔ covers: an expired grant doesn't match, at and after the instant (0.698261ms) +✔ covers: level is the least level asked for (row 193a) (0.213107ms) +✔ covers: a missing or unknown level throws (row 193a, N1) (0.385188ms) +✔ covers: a grant with an unknown level covers nothing (row 193a) (0.191435ms) +✔ covers: now must be a valid Date (0.21008ms) +✔ today's files load unchanged: identity, publish and remote are optional (11.61814ms) +✔ a granted agent loads with its identity, grant and the project's upstream (4.906248ms) +✔ N10: publish needs identity and a gitea definition, and the error names the grant (9.522958ms) +✔ publish names declared projects that have a remote, each once (7.911234ms) +✔ identity fields are checked (14.073433ms) +✔ D9c: the upstream must be its own normalized form, exactly /OWNER/REPO (29.451403ms) +✔ D9c: one .git is stripped, and the fork is built from the stripped name (1.733511ms) +✔ D9c: gitea.url names the instance only (10.698646ms) +✔ the upstream's host and port must be the agent's Gitea's (4.064711ms) +✔ remote-not-fork: an upstream the agent's own user owns, compared without case (10.115713ms) +✔ store references: own path only (design D1, D3a) (0.50611ms) +✔ the role file loads and resolves through loadBusiness (18.165733ms) +✔ the shipped file is exactly the approved list (1.392044ms) +✔ the assistant's authority is message.send and record.write within role (4.312182ms) +✔ the assistant talks to the user and the chief of staff only, and no other shipped role is limited (0.978023ms) +✔ a business grant through limits does not widen the role (6.715605ms) +✔ a launch block whose by is the assistant is refused (3.553443ms) +✔ the instance takes no credential references and no tracker (9.975785ms) +✔ an arbiter whose role definition declares messaging lists is refused, for each kind (8.992963ms) +✔ an arbiter without messaging lists is accepted beside the limited assistant (3.104416ms) +✔ the contract passes work to the chief of staff and directs no one (0.788753ms) +✔ REQ-HARN-2: the assistant, companion and research hold the web grant, and no other role file does (1.683056ms) +✔ C2-04: library mappings load without roots, remain frozen, and retain mapping refusals (31.538067ms) +✔ C2-04: an otherwise valid publish grant cannot name a library repo (4.356759ms) +✔ config directory and file path follow MOSAIC_CONFIG (0.467526ms) +✔ the fixture business validates and comes back frozen (4.106001ms) +✔ two instances may share a definition (2.097865ms) +✔ top-level refusals (6.537312ms) +✔ arbiters and projects (24.968268ms) +✔ role instances (9.057417ms) +✔ Vikunja bots (29.820456ms) +✔ a role without Vikunja takes no tracker block (9.629575ms) +✔ credential references match the definition's services (11.680645ms) +✔ launch (31.945766ms) +✔ REQ-THREAD-2 REQ-LAUNCH-1 launch.threadIdleSeconds: absent is the default, a positive integer is used, anything else refuses (34.141496ms) +✔ loadBusiness: file checks (12.995702ms) +✔ loadBusiness: not a regular file (111.510997ms) +✔ loading writes nothing (1.787307ms) +✔ names that are Object.prototype properties don't count as declared (5.786433ms) +✔ the shipped example refuses as written and validates once filled in (2.551686ms) +✔ persona vars: agent layer, creative definition only, both or neither (26.121282ms) +✔ row 194 keep, noHire and retired validate, and a file without them loads as before (4.607715ms) +✔ row 194 each bad keep, noHire or retired entry refuses (19.966409ms) +✔ row 323: committed Case 1 document loads unchanged through the business loader (10.685638ms) +✔ row 323: real business validate accepts the Case 1 fixture without tracker credentials (226.106251ms) +✔ row 323: real factory install accepts the document's scratch input and writes it unchanged (294.937207ms) +✔ row 323: the Case 1 business boots without a tracker or @sync credential (60.850375ms) +✔ row 323: factory install refuses bus.tester false before writing (39.485453ms) +✔ row 323: literal library key refuses through final business validation (176.986326ms) +✔ row 323: a library project refuses through the factory profile plan (36.685902ms) +✔ row 325: the Case 1 project's sole key matches the repository project id (7.063988ms) +✔ row 325: real business validate reports the copied repository project valid (203.591785ms) +✔ row 325: the old mosaic-stack project key refuses against those same project bytes (227.47487ms) +✔ the role file loads and resolves through loadBusiness (22.21166ms) +✔ the shipped file is exactly the approved list (0.355811ms) +✔ the resolved record matches the approved list, so a widened file fails (4.433743ms) +✔ the chief of staff holds role.launch, message.send, role.end, organization.change, record.write, instance.name, role.hire and role.fire; every other action is gated (6.025087ms) +✔ the pm does not hold role.launch (7.814194ms) +✔ a business grant of a gated action through limits does not widen the role (5.309288ms) +✔ a limit that drops role.launch leaves the chief of staff with no launch block (5.488981ms) +✔ a launch block whose by is the pm instance is refused (4.031539ms) +✔ the contract names no duty to talk to the human and the pm contract no launch (1.077581ms) +✔ the instance takes no credential references and no tracker (7.111256ms) +✔ C2-04: business validate and resolve skip a library before code projects and credential checks (581.819531ms) +✔ usage errors exit 4 (330.347677ms) +✔ validate: a good business exits 0 and prints instance digests (80.712835ms) +✔ validate: project files (358.68705ms) +✔ validate: missing files and a broken system config (272.747082ms) +✔ validate: credential reference problems exit 2 and name each one (75.47514ms) +✔ validate: a not-issued store agent dated today passes, and an issued one with a past expiry fails (152.378642ms) +✔ validate: a token file inside the repository is refused (76.459487ms) +✔ validate: role definitions come from MOSAIC_ROLES_DIR (210.323656ms) +✔ resolve: prints one instance's record (260.543734ms) +✔ resolve: refusals (375.881441ms) +✔ parse: exactly one of file or env, plus the service's date (3.551882ms) +✔ check: a good file has no problems (1.2198ms) +✔ check never opens the file: a write-only token passes (0.477268ms) +✔ check: file problems (1.60977ms) +✔ check: token files can't live in the repository or dataRoot, even through a linked directory (1.508979ms) +✔ check: dates and environment references (0.686041ms) +✔ each definition loads, with a contract file, and is exactly the approved list (4.83466ms) +✔ an organization file that declares them passes, and each resolves to least privilege (10.307081ms) +✔ the chief of staff launches each one; no other role does (11.082937ms) +✔ a C-suite role can't be made the launcher: launch.by must hold role.launch (5.052598ms) +✔ limits can narrow a C-suite role but never widen it (4.524289ms) +✔ any unknown key, tool, action or version in a role file is refused (4.904699ms) +✔ row 298: checkGrantScope takes the D2 shape and refuses anything else (2.752624ms) +✔ row 298: a missing scope is empty and a bad one falls back to empty, which covers nothing (0.482721ms) +✔ row 298: a Gitea grant is in scope only when its agent and every project are listed (0.341447ms) +✔ row 298 (sage-3594 Q2): host commands match whole argv tokens, and enrollment is never in scope (0.467524ms) +✔ row 298: a bad grantScope in the file still loads, and the read shows the fallback (18.355754ms) +✔ row 298: the writer checks the scope, logs the change and removes the key for {} (142.313501ms) +✔ row 298 (sage-3594 Q1): the general writers can't write grantScope (25.353249ms) +✔ REQ-WAIT-1: GATED_ONLY is exactly the hard waits; the new actions are in the vocabulary (1.86466ms) +✔ REQ-ROLE-2: END_PROTECTED includes the assistant's thread definition (0.234237ms) +✔ REQ-COS-3: role.hire and role.fire are routed, not hard waits (0.300439ms) +✔ REQ-WAIT-3: every action is routed or a hard wait, never both, and the routed list names only actions (0.967731ms) +✔ REQ-WAIT-3: instance.name is routed under REQ-MSG-2 (1.5), not a hard wait (row 141, sage-0589) (1.313696ms) +✔ REQ-WAIT-2: a role listing a hard wait at either class is refused; the actions that left can be granted (5.343386ms) +✔ S1: the business file refuses hosts at the top level and in a role, and host. references (56.500208ms) +✔ T1: address, user and host key checks, which the enrollment raise uses (11.374442ms) +✔ T26: no wildcard and no shell, runner or interpreter as a prefix (2.722004ms) +✔ D6: argv shape and the literal prefix match (0.922698ms) +✔ C2-04: instance settings skip a library while checking a later code project (98.596648ms) +✔ row 165 read lists each instance and the definitions add accepts (16.615936ms) +✔ row 165 add: two instances join, validate exits 0, the log names the human, and the writer asks for no restart (row 194, D3) (308.207149ms) +✔ row 165 change: definition, vars and launch membership log before and after; none asks for a restart, the bus reloads (row 194, D3) (180.35178ms) +✔ row 165 refuses each validation failure and leaves the file's bytes alone (44.040709ms) +✔ T19 add of a credentialed definition writes store references dated today, names its bot, and validate exits 0 (101.60641ms) +✔ T19 add of a definition that declares host writes references for its token services only (12.273146ms) +✔ row 165 refuses a definition change to or from one that declares credentials (6.011439ms) +✔ row 165 a vars or launch change on an instance with its binding succeeds and keeps the binding (87.081633ms) +✔ row 165 refuses an END_PROTECTED definition and every change to a protected instance (9.425714ms) +✔ row 165 refuses while a project file doesn't resolve, as validate would (21.508015ms) +✔ row 165 refuses a stale revision and leaves the file's bytes alone (13.794117ms) +✔ row 65 an instance write refuses harness-off, thinking-unsupported, an unknown model and a partial fallback (38.79158ms) +✔ row 213 a creative instance is the human's: add, vars and definition changes, persona digest only (105.47603ms) +✔ row 256 T1-T3, T5 the human deletes a creative instance, no other actor does, and the assistant stays (106.119319ms) +✔ row 256 T4 the human's delete of the only listed instance, a creative one, is the last-listed refusal (3.635722ms) +✔ REQ-LIMIT-1 schema: every scope unset or zero, adjustable above four, bad values and unknown models refuse (27.767213ms) +✔ REQ-LIMIT-1 counts each exact scope at/over limit, unlimited and old tuple after model reassignment (1.218782ms) +✔ REQ-ROLE-3 writer: atomic validated revision, immutable previous bytes and authenticated actor/old/new receipt (65.935591ms) +✔ REQ-ROLE-3 writer: pre-rename fault leaves old file, post-rename recovery records commit, conflicting recovery refuses (42.79247ms) +✔ REQ-LIMIT-1 / decision145 migration prints only, preserves values, rejects ambiguity, and is idempotent (20.740471ms) +✔ REQ-LIMIT-1 shared settings validates the complete proposed selection and logs exact actor (73.013224ms) +✔ REQ-LIMIT-1 provider is table data: another provider routes separately and aliases share exact counts (5.530215ms) +✔ REQ-ROLE-3 refuses live writer locks, symlink targets and uncertain recovery without changing bytes (31.489428ms) +✔ Q169 assistants: vars and definition change and log the actor; tracker null leaves no tracker (74.510885ms) +✔ Q169 assistants: refuses other instances, other definitions, holder and credentials, empty entries, a tracker the definition has no credential for and a stale revision (46.648048ms) +✔ Q169 assistants: a definition with a vikunja credential takes a tracker change and refuses its removal or a used bot (28.59175ms) +✔ row 65 routes lists every instance with harness, model, thinking and fallback, the switched-on harnesses, the model keys and each harness's levels (4.496203ms) +✔ row 65 setRoutes saves a harness, model, thinking and whole fallback, reads each back from the file, logs the actor, and a null fallback clears all three (28.880486ms) +✔ row 65 setRoutes refuses a partial fallback, a switched-off harness, a level the harness doesn't apply, an unloaded module, an unknown model or instance, a malformed route, no change and a stale revision, with the file unchanged (33.617502ms) +✔ row 65 a file with harness vars and no plugins.harness loads and its views read; a model change still saves, and a route change refuses harness-off (15.471063ms) +✔ B7 kept instance: the models keys it names and the instances key are the human's (32.512862ms) +✔ B7 kept instance: its route is the human's (13.733689ms) +✔ M10 creative instance: models keys it names, the instances key and its route are the human's (41.972839ms) +✔ C2-04 M9: changed playground and hybrid entries leave business and changes.jsonl byte-identical (75.744651ms) +✔ C2-04 M9: code projects, additions, deletions and array changes are protected too (73.935851ms) +✔ C2-04 M9: canonical key order is allowed and a non-project setter still records its change (53.997154ms) +✔ C2-04 M9: a serialization hook cannot change projects after the canonical comparison (29.857522ms) +✔ M7/M8: library seats come from library businesses, creative seats from their creative definitions (20.881147ms) +✔ M8: a business with no library project puts no seat in either set (19.190367ms) +✔ M7/M8: a business file that is not valid JSON throws; no empty set (7.135915ms) +✔ M7/M8: an absent businesses directory gives empty sets (1.688414ms) +✔ M7/M8: a businesses path that is not a directory throws; no empty set (4.583153ms) +✔ M7/M8: a businesses symlink to a missing target throws; no empty set (2.208552ms) +✔ M7/M8: a config directory under a regular file throws (lstat fails with ENOTDIR); no empty set (0.601986ms) +✔ M7/M8: a business file that can't be read throws; no empty set (12.318486ms) +✔ T6 delete refuses in the design's order and leaves the file's bytes alone (104.896221ms) +✔ T6 delete refuses the last listed instance (7.490182ms) +✔ T6 a clean delete removes the entry and its own references, adds retired, and the name can't come back (213.690055ms) +✔ T7 veto: keep, unkeep, nohire and hire each write once, a repeat is no change, and the log names the human (171.894178ms) +✔ T7 veto refuses an unknown or END_PROTECTED keep, a bad request, a stale revision and a business without launch (26.238526ms) +✔ D2.2 hire adds and lists a new instance, logs the chief's context, and sets only model and limits (92.062371ms) +✔ D2.2 hire refuses noHire, a kept name and a listed name, and re-lists a fired one only as it was (29.586421ms) +✔ D2.2 fire delists and keeps the entry, a repeat is done with no write, and each refusal holds (88.451593ms) +✔ row 256 checkDelete passes the human's creative delete and refuses another actor's; fire still refuses (5.294872ms) +✔ row 239 T1 a fire on a revision that goes stale before the writer's lock refuses there and revokes nothing (5.756058ms) +✔ row 239 T2 a write after the revoke refused before publication carries revoked, and the file keeps the edit (7.753057ms) +✔ row 239 T3 any error after the revoke carries revoked, for a fire and a delete; a revoke that throws carries nothing (32.403692ms) +✔ Q247: omitting tracker loads as null and preserves independent role bots (10.793015ms) +✔ Q247: real business validate passes without a sync credential reference or file (168.186763ms) +✔ Q247: present tracker retains its values and validation without mutating the input (9.372029ms) +✔ Q247: present null, undefined and malformed trackers still refuse (18.314895ms) +✔ Q247: absent business tracker does not waive a role's Vikunja bot requirement (2.859494ms) +✔ REQ-PLUG-1 schema: plugins is optional, names known kinds and checked module names (40.546579ms) +✔ REQ-PLUG-1 REQ-ROLE-3 the setter writes plugins through the organization writer and logs old and new names (92.751615ms) +✔ vikunja:19/309 a patch changes only the kinds it names; null removes one kind, explicitly and in the trail (100.494327ms) +✔ vikunja:19/309 an unknown kind (set or removed), a bad module, an empty patch and null on the wrong shape are refused, nothing written (9.927988ms) +✔ REQ-PLUG-1 REQ-ROLE-3 the writer checks the bytes it writes: a Date in plugins is refused there too (19.985103ms) +✔ REQ-PLUG-1 REQ-ROLE-3 a refused setter write throws a code, changes nothing and logs nothing (4.143331ms) +✔ vikunja:19/305 with an exists check, the setter refuses a module no tree file answers to, before anything is written (18.273494ms) +✔ optional project repo is preserved and must be a normalized absolute path (32.895793ms) +✔ loaded business project repo cannot be nested in any declared code checkout (6.807091ms) +✔ path and load (3.706713ms) +✔ refusals (1.897981ms) +✔ record.write is within-role for the eleven approved v2 agents, never gated-only (3.85853ms) +✔ C2-06 M11 human replacement works; omitted settings return to defaults (98.331729ms) +✔ C2-06 M11 agents and tester cannot change settings, including by changing human (55.766765ms) +✔ C2-06 M11 serialization cannot replace settings after the first fence (17.47904ms) +✔ C2-06 M11 an unrelated actor cannot appoint itself human and change reply limits (16.039248ms) +✔ C2-06 invalid setter values preserve the business and changes.jsonl (17.259974ms) +✔ C2-06 validator accepts hand-edited settings; raw reader fails closed on invalid files (19.048524ms) +✔ C2-04: a library first in projects does not hide a later project layer (21.880181ms) +✔ systemVars flattens the validated config (1.820728ms) +✔ precedence: system, business, project, project role, agent (10.989776ms) +✔ limits narrow the definition and never widen it (8.400306ms) +✔ role.launch stays within-role only for the instance the launch block names (18.468852ms) +✔ limits.authority without role.launch leaves the launcher with no launch block (13.185333ms) +✔ limits.authority narrows cross-role actions too (2.699689ms) +✔ classify (6.249491ms) +✔ the record carries what the broker and launcher need (4.7922ms) +✔ digest: key order doesn't matter, any value change does (12.395981ms) +✔ refusals (3.790542ms) +✔ the four shipped version 2 roles load (5.229965ms) +✔ shipped role scopes match addendum B section 2 and the SR runbook (2.178782ms) +✔ shipped authority follows the note's table (13.291498ms) +✔ every role file in roles/ loads through the validator, and a v2 contract exists (2.100731ms) +✔ version 1 files keep loading with no authority (1.521097ms) +✔ the conductor policy isn't a role (0.302424ms) +✔ a missing role file is exit 4, a symbolic link too (0.564721ms) +✔ version 2 refusals (3.788273ms) +✔ authority: closed vocabulary, no gated-only action, no overlap (3.881951ms) +✔ messaging: optional, role definitions and human, never the tester (1.949889ms) +✔ row 64 skills: optional, distinct skill directory names, none on version 1 (2.255987ms) +✔ credentials: Gitea scopes (1.343013ms) +✔ credentials: Vikunja scopes are a group-to-verbs map from the grantable list (1.709889ms) +✔ credentials: services (0.759517ms) +✔ contract: a non-empty regular Markdown file beside the role file (0.838905ms) +✔ the six creative roles load: read tools, message.send only, messaging with the human only (0.693212ms) +✔ M1: a creative role file wider than read and answer is refused (1.897832ms) +✔ hireable: HIRE_ALLOWED is exactly the six plain work actions, and every one is routed (0.173708ms) +✔ hireable: a list naming a definition that holds any refused action refuses at load, one case per action (18.133668ms) +✔ hireable: a mixed definition refuses, a clean list loads, and the named file's own hireable isn't read (1.146869ms) +✔ hireable: a missing, version 1, duplicate or badly named entry refuses, and the key is optional (3.734122ms) +✔ the pm and the cto check a saved spec against settled decisions and work in flight, and answer with a BLOCK or an accept (11.616694ms) +✔ the chief of staff relays a BLOCK or an accept to the assistant as a reply to the message that carried it (1.277302ms) +✔ the assistant summarizes a spec review in its own words and doesn't repeat the chief of staff's text (0.70976ms) +✔ REQ-LIMIT-3 schema: each subject kind, limit 0 and no ceiling are accepted; bad limits, times, keys and undeclared instances refuse (49.216064ms) +✔ REQ-LIMIT-3 the writer stamps since: a new limit gets now, a changed one keeps its time, a different time is refused (85.0223ms) +✔ REQ-LIMIT-3 only tokens.* at schema depth holds token limits: agent limits named `limit` save as sent, and a token limit named `limit` is stamped and reset (67.775561ms) +✔ REQ-LIMIT-3 a reset moves since to now, is logged with its actor, and refuses a path that is not a limit (34.296428ms) +✔ REQ-LIMIT-2 schema: launch.account names a credential set; a daily quota needs a reset and an IANA zone and names the account (33.871693ms) +✔ REQ-LIMIT-2 the writer stamps a daily quota's since, keeps its reset and zone, and a reset moves since (33.845575ms) +✔ every key names known layers and a merge rule (1.726458ms) +✔ unknown keys and wrong layers refuse (1.084085ms) +✔ types (3.275461ms) +✔ merge: defaults, then the most specific layer wins (0.419589ms) +✔ merge: limits only narrow, and provenance lists each source (0.757115ms) +✔ merge doesn't change its inputs (0.206627ms) +✔ web.searxng takes https anywhere and http on loopback, so Jason's 127.0.0.1:8888 passes (0.262745ms) +✔ both definitions load, with a contract file, and are exactly the approved lists (5.013658ms) +✔ security-reviewer has no write or shell tool and classifies only the verdict as its own (9.066819ms) +✔ merge-gate's only grant is git.merge.protected cross-role, and it has no write tool (3.470869ms) +✔ neither role can be an arbiter: its messaging lists refuse the business file (row 133) (8.498658ms) +✔ every role contract carries the proactive line in its Authority section (1.099286ms) +✔ pm and chief-of-staff say where a raise goes under REQ-DEC-2 (0.851681ms) +✔ the merge landing takes two runs: merge-gate, cto and chief-of-staff each say their part (0.660442ms) +ℹ tests 270 +ℹ suites 0 +ℹ pass 270 +ℹ fail 0 +ℹ cancelled 0 +ℹ skipped 0 +ℹ todo 0 +ℹ duration_ms 2873.146579 diff --git a/agents/beakley/work/queue-217/run-r2/cli-suite.log b/agents/beakley/work/queue-217/run-r2/cli-suite.log new file mode 100644 index 000000000..d9cf8c972 --- /dev/null +++ b/agents/beakley/work/queue-217/run-r2/cli-suite.log @@ -0,0 +1,1112 @@ +npm notice run @mosaic/cli@0.1.0 test +npm notice run node --test tests/*.test.mjs +✔ R6 a configured peer id validates as a user's home and an unconfigured one refuses (19.440662ms) +✔ R6 B1 a boot with access.json binds a granted user, whose home is a configured peer (176.01766ms) +✔ R6 B2 a boot without access.json has no access and binds no user (167.394505ms) +✔ R6 B3 a boot with a file R1's loader refuses still boots, binds no user and says so once (521.773676ms) +✔ list prints the revision and the users (70.591593ms) +✔ grant writes one revision up, a receipt line, and the id in the file (176.631192ms) +✔ a viewer grant writes the viewer level, one revision up (149.090165ms) +✔ a second write appends a second receipt and leaves the first intact (252.761371ms) +✔ a stale revision refuses with revision-conflict and writes nothing (199.315119ms) +✔ a live holder's lock refuses and leaves the file and the lock alone (59.983061ms) +✔ an empty or unreadable lock refuses, since its holder may still be writing (120.092186ms) +✔ a lock left by a dead pid refuses, names the pid, and is not reclaimed (103.817907ms) +✔ a failed rename leaves the old bytes, removes the temp file, and writes no receipt (69.941706ms) +✔ a group-writable access file refuses with exit 3, names the file, and changes nothing (75.073881ms) +✔ an agent or tester caller is refused before the context or the access file is read (2.698477ms) +✔ the lock is mode 0600 while held and removed after a refused write (60.128721ms) +✔ a grant naming an unknown instance is refused before any write (50.807031ms) +✔ a project name resolves to its id at grant time (126.59217ms) +✔ an unknown project name refuses before any write (68.550377ms) +✔ revoke removes the user's grants and leaves a revision behind (249.237455ms) +✔ revoke of a user with no grant refuses and writes nothing (78.970947ms) +✔ an agent caller is refused before the bus is asked (3.682313ms) +✔ --tester is refused on every verb before the bus is asked (6.394622ms) +✔ a bus that refuses the human proof blocks the write (77.460139ms) +✔ the context reads console.sso subjects and the business files, and peers stay empty (43.657666ms) +✔ the real human-cli, run from agent ancestry, refuses and writes nothing (5346.518081ms) +✔ T1 user add writes the user one revision up, prints it and appends a user.add receipt (63.631459ms) +✔ T2 a bad user add refuses before any write (643.347479ms) +✔ T3 user remove of a user with no grant drops them one revision up, with a user.remove receipt (52.080635ms) +✔ T4 user remove refuses with user-has-grants while the user holds a grant, and writes nothing (177.570827ms) +✔ T5 user remove of an id not in the file refuses and writes nothing (48.91774ms) +✔ T6 a stale revision refuses both user verbs with revision-conflict (100.48544ms) +✔ T7 --tester and an agent caller are refused on both user verbs before the bus is asked (3.059801ms) +✔ T8 a user verb of the wrong shape prints the help (3.652713ms) +✔ T9 a bus that refuses the human proof blocks both user verbs (91.71361ms) +✔ R4 grant and revoke call access.reload after the write, and nothing else does (299.044406ms) +✔ R4 a refused access.reload after a good write exits 0, stdout reports the write, stderr names the code and the 30 s timer (101.438558ms) +✔ R4 the help keeps the provider-removal order and says what a refused reload means (1.652952ms) +✔ every screen and overlay fits 120x36, 80x24 and the narrow layout, row for row (3179.081691ms) +✔ width counts terminal cells: wide CJK and emoji 2, U+FE0F after a one-cell base 1, marks 0 (159.241542ms) +✔ broker text is shown, never interpreted: no raw control character or bidi override reaches the terminal (331.43342ms) +✔ NO_COLOR: no escape codes, except reverse video on the selected row (547.109298ms) +✔ 1-9 shows the decide flow's own lines and question; only y resolves (132.259499ms) +✔ the app shows the same decide text as mosaic decide (60.621108ms) +✔ any key but y or Y at the question answers No; nothing is sent (547.172089ms) +✔ below 40x10 the question is hidden, so every key answers it No, y included (Filbert R3) (191.926161ms) +✔ under 40 columns a tall terminal shows the too-small screen even where the decide box would fit; y sends nothing (Filbert N10) (683.990759ms) +✔ a hidden decide box names the way out, and the status line under it does not promise y (Filbert N12) (73.64106ms) +✔ a throw while answering the question goes to crash, sends nothing and leaves no job pending (53.781056ms) +✔ type-ahead never answers the question: a paste, keys typed before it is drawn, keys inside askMs (540.499848ms) +✔ quitting at the question answers No and sends nothing, armed or not (87.7105ms) +✔ a timer tick reads nothing under an overlay, never answers the question, and keeps a resolved status (73.387808ms) +✔ a long question is cut inside the question; the action, target, choice and prompt stay (Dewey B1) (107.115717ms) +✔ a decide box too big for the terminal says so, and every key answers it No, y included (Dewey B1, round 3) (704.461586ms) +✔ at every size the decide box shows each line y depends on, or says it is hidden (18773.237061ms) +✔ outcome unknown: the CLI's sentence, no retry, then the trail or a re-read (150.632102ms) +✔ refused and failed reads keep the last list, marked stale; a refused decide says refused (78.981219ms) +✔ help or a detail box cut to fit keeps its last line, Esc included (Dewey) (37.958142ms) +✔ keys: views, moving, trail of a selection, the command line, help and quit (206.373815ms) +✔ one option: the status line says Press 1, not 1-1 (47.733084ms) +✔ no business: the app says so and :business picks one (23.118121ms) +✔ mosaic with no argument: exit 3 in an agent run, exit 4 with the usage off a terminal, the app on one (4.13823ms) +✔ scripts/mosaic with no argument reaches the app entry; the seat usage it printed before has not drifted (334.136927ms) +✔ strings to keep exactly live once, in the decide flow and the transport; the app does not restate them (0.59825ms) +✔ decide with --note still asks; a No sends nothing (26.816836ms) +✔ the app's business comes from a live bus host only (1.654616ms) +✔ runApp leaves the terminal as it found it on q, end of input, SIGTERM, SIGINT, SIGHUP and an error, the first frame's included (28.978567ms) +✔ draw is pure: same state, same frame (2.15196ms) +✔ recordBootRefused keeps the last good load across refusals; recordBootOk clears the refusal (11.213533ms) +✔ an unknown key and a JSON syntax error each leave the bus down with the reason and path in the status (1662.25991ms) +✔ a missing file is recorded too, and a valid file clears the status on the next start (1194.196553ms) +✔ row253 socket observation uses configured root, metadata and the Console peer without sending bytes (4960.983053ms) +✔ row253 P10 refuses unsafe metadata, wrong peers and an unsafe Python without claiming closure (47982.060861ms) +✔ row253 acceptance rejects bad config and unsupported copies before talk (1685.306318ms) +✔ row253 stalled peer observation ends within its bound without leaving a reader (4360.839909ms) +✔ row253 P8 refuses both retired TCP and board listeners (4609.180944ms) +✔ row253 C4 acceptance query inner reason holds under both sudo models (10875.442541ms) +✔ row253 C4 acceptance query outer reason discards stdout and names residual cleanup (14214.146042ms) +✔ row253 C4 acceptance query overflow is output-limit in both models (704.185033ms) +✔ row299 P10 timing copy preserves shipped bytes and isolates observer variables (1.272721ms) +✔ row299 P10 observers preserve stdout stderr status and the EXIT trap (4.259606ms) +✔ row299 P10 observer records are complete and ordered (0.764892ms) +✔ row253 C4 P10 inner reason holds under both sudo models (12845.696914ms) +ℹ {"fault":"inner","mode":"exec","baselineSeconds":2.216959216999996,"faultSeconds":4.42816661,"probeSeconds":2.27} +ℹ {"fault":"inner","mode":"hop","baselineSeconds":1.950547934000002,"faultSeconds":4.180937552000003,"probeSeconds":2.29} +✔ row253 C4 P10 outer reason holds under both sudo models (15930.940688ms) +ℹ {"fault":"outer","mode":"exec","baselineSeconds":2.0704665899999966,"faultSeconds":5.904106264000002,"probeSeconds":4} +ℹ {"fault":"outer","mode":"hop","baselineSeconds":2.0467206270000022,"faultSeconds":5.850665687,"probeSeconds":4} +✔ row253 C4 P10 overflow reason holds under both sudo models (4067.835905ms) +✔ row 195 accept: every check passing exits 0, with each P mark and counts that match the lines (2032.402924ms) +✔ row 195 accept: exits 1 with each F check failing alone, and its line names it (21616.420015ms) +✔ row 195 accept: F3 fails on exit 0 with no reply line, and its evidence takes talk's error (3742.460768ms) +✔ row 195 accept: F1 fails on a unit that isn't active or isn't User=mosaic (3497.77341ms) +✔ row 195 accept: F2 fails when healthz doesn't answer and when another pid holds the port (3838.240195ms) +✔ row 195 accept: F5 fails on unpriv_bwrap (enforce), on complain and on a trailing space (8669.441911ms) +✔ row 195 accept: F5 fails with no bwrap of mosaic's, and passes on comm alone (4009.111998ms) +✔ row 195 accept: F6 fails on a stub that prints nothing, on a path outside claude- and on a .. segment (5152.460341ms) +✔ row 195 accept: F7 fails on two live PM launches, one for another business, and no launch.by (5585.501836ms) +✔ row 195 accept: F8 fails on 0640, on another owner and on a symlink, and never prints the credential (5680.396018ms) +✔ row 195 accept: F9 fails on another owner, a group-writable mode and a number for the flag (5749.005539ms) +✔ row 195 accept: F9 won't run --node as root off the pin path or with a writable directory above it (5427.625895ms) +✔ row 195 accept: F11 fails on one *.json under discord/ and passes on an empty directory (3787.235637ms) +✔ row 195 accept: each P check reports unnamed on its fault, and the exit stays 0 (17051.253333ms) +✔ row 195 accept: P2 is unnamed with a supplementary group, and P5 names docker (3785.157436ms) +✔ row 195 accept: P5 is closed with no jarvis account, and P2 with an empty authorized_keys (1834.05986ms) +✔ row 195 accept: P9 is unnamed once for each item missing (9324.709919ms) +✔ row253 accept: P10 fails its observation with another peer; P11 with the unit disabled (3777.574009ms) +✔ row 195 accept: every P check unnamed together still exits 0 (1653.703766ms) +✔ row 195 accept: a bad args file refuses with exit 2 before any check, each for its own reason (96.991991ms) +✔ row 195 accept: usage errors and a run without --root as a user exit 2 (10.516981ms) +✔ row 195 accept: every in-instance call goes through sudo -u mosaic -H env PATH=:... (1859.056741ms) +✔ row 195 accept: the host check runs with --check and never --enforce (1890.30245ms) +✔ row276 legacy call inventory pins every production bound and the conversation contract (0.342517ms) +✔ row276 talk legacy inner timeout cleans both sudo models (1672.790815ms) +✔ row276 precheck legacy inner timeout cleans both sudo models (1684.114464ms) +✔ row276 claude-version legacy inner timeout cleans both sudo models (1678.216316ms) +✔ row276 pm-list legacy inner timeout cleans both sudo models (1695.955919ms) +✔ row276 node-version legacy inner timeout cleans both sudo models (1679.034953ms) +✔ row276 legacy streams and display status preserve failures without granting success (2613.913212ms) +✔ row276 trailer grammar cannot make supervisor failure pass (2057.571655ms) +✔ row276 earlier forged trailer and appended zero remain failures (527.571529ms) +✔ row276 precheck outer bound discards success status and fixture cleans residual (2184.71001ms) +✔ row276 case1 capture and legacy tools refuse unsafe system tools (76.621415ms) +✔ row276 stderr retention is bounded and keeps the final diagnostic (282.085797ms) +✔ row276 version and PM checks refuse successful-looking stdout on supervisor failure (16.60825ms) +✔ row276 full acceptance keeps all five healthy calls in both sudo models (3818.706371ms) +✔ row276 vanished pid stat read returns 3 with empty stderr in both scripts (4.125307ms) +✔ row276 legacy stdout snapshot preserves exact bytes on success and command failure (3211.409246ms) +✔ row 240 check: exits 0 with all seven items and a note that bubblewrap is the install pin (163.843904ms) +✔ row 240 check: exits 1 with each item failing alone, and its line names it (925.245447ms) +✔ row 240 check: item 1 fails when a package owns the profile, when dpkg -S errs, or with no pin (283.261173ms) +✔ row 240 check: item 2 fails on a loaded mosaic-bwrap, a missing unpriv_bwrap or a failed aa-status (400.463192ms) +✔ row 240 check: item 3 fails on a second file naming bwrap as a word, /{usr/,}bin/bwrap included (702.882583ms) +✔ row 240 check: item 4 reads the label under the units' no-new-privs and matches it exactly (377.644335ms) +✔ row 240 check: item 5 needs the statoverride and stat to agree (87.911305ms) +✔ row 240 check: item 6 fails on protected_hardlinks 0; item 7 fails with the floor at 732 and reads 1023 with no unit (459.935444ms) +✔ row 240 check: a bubblewrap version other than the install pin is a note, not a failure (76.397109ms) +✔ row 240 enforce: a pass with no DRIFT changes nothing and exits 0 (73.070179ms) +✔ row 240 enforce: each failure exits 0, unloads the profile, closes bwrap, writes DRIFT and one log line (615.476197ms) +✔ row 240 enforce: with DRIFT present and every item passing, it still closes bwrap (111.302392ms) +✔ row 240 enforce: no unload when aa-status lists neither bwrap profile; never writes the statoverride (725.658903ms) +✔ row 240 upstream: a candidate whose profile differs prints the difference and exits 0 (155.94142ms) +✔ row 240 boot unit: a oneshot after apparmor and before the bus that runs --enforce (0.37346ms) +✔ row 240 pins and usage: the shipped pins are r6's, the script reads the pins beside it, and bad usage exits 2 (111.660841ms) +✔ Vikunja 614 check: item 5 accepts dpkg's bare octal mode and leading-zero equivalents (175.35123ms) +✔ Vikunja 614 enforce: dpkg's bare 750 leaves bwrap open and writes no DRIFT (67.045919ms) +✔ Vikunja 614 check: item 5 refuses other modes, owners, groups, paths and malformed overrides (1839.276754ms) +✔ the library install writes the business file, personas and slot dir, makes the copy and starts nothing (654.980029ms) +✔ a library re-run passes and leaves every file as it was (1054.03717ms) +✔ a re-run refuses business-file-differs and leaves the file unchanged (862.068732ms) +✔ a re-run refuses persona-differs when an installed persona isn't the staged one, and writes nothing (611.181383ms) +✔ the factory install writes no library mapping, persona or slot dir (388.818196ms) +✔ the factory install refuses a library project and bus.tester off, before anything is written (153.783338ms) +✔ the library install refuses bus.tester on and a persona var in the input (187.787627ms) +✔ the install refuses root, a business id mismatch, another --home and a config dir with group bits (103.934283ms) +✔ the library install needs --personas (12.694795ms) +✔ a validate refusal removes the business file this run wrote (507.102899ms) +✔ N4: a validate refusal on a re-run leaves the matching business file in place, byte for byte (858.912753ms) +✔ a clean library host passes the precheck with no mirror yet (826.782411ms) +✔ the library precheck refuses a persona file at 0644 (763.297274ms) +✔ the library precheck refuses a persona whose digest isn't persona.sha256 (908.513727ms) +✔ the library precheck refuses a persona dir with group bits (876.446921ms) +✔ the library precheck refuses a business file at 0644 (859.893121ms) +✔ the library precheck refuses a changes.jsonl at 0644 (1166.063805ms) +✔ the library precheck refuses a Discord binding (787.866682ms) +✔ --library-status refuses library-mirror-missing before the bus has made the mirror (623.067027ms) +✔ --library-status refuses library-never-synced on a fresh mirror (628.547493ms) +✔ --library-status names a recorded lastError before the null lastFetch it leaves (N3) (584.392453ms) +✔ --library-status prints each R-problem's path as an escaped JSON string, then the count, and passes (770.456587ms) +✔ --library-status takes no --profile (12.579837ms) +✔ Vikunja 614: install preserves the explicit notifier decision bytes and mode and creates none when absent (943.82086ms) +✔ row 322 F8: library personas install from the copy with no clone node_modules (355.185459ms) +✔ row 322 F9: importer refusal keeps the error line rather than the Node banner (224.142076ms) +✔ stage takes each profile's SOUL.md byte for byte and prints the pairing with sizes and digests (183.745141ms) +✔ stage lists the per-channel prompts in all three places by name and byte count only (131.831805ms) +✔ a config key with a newline prints as one quoted line (122.138474ms) +✔ a read trace shows stage and the dry run open SOUL.md and config.yaml and never memory, sessions or secrets (247.145219ms) +✔ the pairing refuses anything but two existing profiles naming Bean and Chet once each, and writes nothing (1065.763045ms) +✔ a profile with no persona refuses: no SOUL.md, a blank one, a symlink, not UTF-8 (967.526019ms) +✔ the import applies C2-08's exported fence at its boundaries (875.883335ms) +✔ install writes 0600 persona files in 0700 directories whose digests match, and prints the vars (214.422277ms) +✔ install refuses an open or foreign staging file, a digest off the manifest and an existing persona (1067.562576ms) +✔ --dry-run writes nothing and prints only counts and the fence fault, two heading lines in a fixture counted (95.262646ms) +✔ --dry-run applies C2-08's fence: over it the fault prints, nothing is written and it exits 1 (205.198931ms) +✔ a directory made between the check and mkdir refuses by name, at stage and at install (315.889832ms) +✔ --dry-run counts three lines naming a Hermes tool or channel and prints none of the words (90.187279ms) +✔ usage: stage needs one of --staging and --dry-run, install takes only its own options (618.524905ms) +✔ row253 factory socket uses actual config and target-uid query without widening hardening (1030.905316ms) +✔ row253 installer refuses unsafe location and query facts before unit writes (7025.311831ms) +✔ row253 query timeout kills its process group and leaves no running child (7103.559135ms) +✔ row253 protected homes refuse before any filesystem access (23.509263ms) +✔ row253 C4 sleep query has exact inner reason and cleans all members (11579.537156ms) +✔ row253 C4 signals query has exact inner reason and cleans all members (10931.15253ms) +✔ row253 C4 member query has exact inner reason and cleans all members (10825.862721ms) +✔ row253 C4 overflow is output-limit in both sudo modes (474.601679ms) +✔ row253 C4 stalled supervisor uses the outer reason and explicit residual cleanup (14194.109908ms) +✔ row253 C4 inline supervisor is byte-identical in both host scripts (0.393456ms) +✔ row253 C4 cleanup budget starts after inventory pass one (38.544492ms) +✔ row253 query reaps its group even when a child closes stdout before the query returns (142.005829ms) +✔ row253 config parser is strict (10.528804ms) +✔ a clean library render writes both units 0644 with the fixed lines, and enables both then starts the bus then the Console (109.927619ms) +✔ PATH starts with the --node directory, for a node outside the default list and for /usr/bin/node (119.545344ms) +✔ a failed bus start refuses with the Console not started (114.55597ms) +✔ the script never links a unit file (0.158151ms) +✔ factory renders --pm once and one MOSAIC_CLAUDE_BIN line, and without them both tokens render empty (611.446215ms) +✔ a re-install over running units says they are still on the old copy and must restart together, never that it started them (519.741913ms) +✔ a re-install to another copy re-renders both units, and an edited installed unit refuses (1188.682643ms) +✔ a template with a namespace, user or system call restriction refuses (321.837449ms) +✔ the bus template's EnvironmentFile line must be there and point at the session env, and the Console template must have none (225.220245ms) +✔ a template holding an unknown token, PermissionsStartOnly or a privileged Exec prefix refuses (170.307897ms) +✔ a symlink at either unit path refuses (206.876154ms) +✔ a --node that is relative, not root-owned or under refuses (19.695775ms) +✔ a re-install with a different --node or different serve flags refuses (500.439188ms) +✔ an installed pair whose units name different copies refuses (282.250725ms) +✔ a copy id that is short, uppercase, holds / or .., or names no directory refuses (30.372862ms) +✔ library refuses a privileged-floor miss, a bad proof pair and every flag outside its set (330.664137ms) +✔ library refuses a proof file not owned by 's uid (20.350989ms) +✔ factory refuses duplicate socket, a missing --port or --business, and each proxy flag (203.853949ms) +✔ row253 factory refuses retired TCP and a value after the socket marker (30.406882ms) +✔ factory refuses a --claude that is relative, not root-owned or under , and a re-install with another --pm or --claude (1401.551986ms) +✔ the precheck passes on a good host and prints free memory, without the key (172.35798ms) +✔ the precheck refuses each failed host check (1515.950658ms) +✔ the precheck refuses a user missing from passwd, a business file that does not load, and a symlinked run root (865.632936ms) +✔ a bwrap that fails refuses and prints the sysctl and where bwrap is (166.489853ms) +✔ an unprivileged port floor at or below the Console's port refuses, and so does a missing Console unit (893.079341ms) +✔ bus.tester: library refuses it on, factory needs it on, and factory refuses a library business (644.251277ms) +✔ the claude check runs only for a claude-code instance, and refuses a claude that appends or answers wrong (1355.919087ms) +✔ the claude check runs the bus unit's MOSAIC_CLAUDE_BIN over claude on PATH (415.033191ms) +✔ the session env file refuses when missing, open to others, a symlink, empty, or emptied by a later line (1029.746409ms) +✔ inside a session's sandbox a bind below 1024 fails with EACCES, and a bind on a free high port succeeds (80.105752ms) +✔ Vikunja 614 factory: scoped @anthropic-ai Claude path renders and passes installed read-back (864.760242ms) +✔ Vikunja 614 factory: plain paths still refuse every named unsafe character (93.409534ms) +✔ Vikunja 614 precheck: explicit null and named notifier decisions pass (332.07012ms) +✔ Vikunja 614 precheck: notifier config refuses missing, public, malformed and extra-key decisions (1356.90404ms) +✔ CLI off, absent and other-only channel selections refuse every project/thread flow before any effect (28.168307ms) +✔ CLI enabled project/thread lists dispatch through selection without changing output (3.108085ms) +✔ both channels off recover through the existing human CLI, socket and organization writer (4971.649931ms) +✔ inbox lists only decisions routed to the human, with what approving authorizes and how to decide (69.336629ms) +✔ decide resolves by id prefix with --yes, and the trail shows it in broker order with the task to follow (48.250596ms) +✔ decide refuses without a terminal or --yes, on an unknown option and on a short reference (55.878064ms) +✔ decide prints a declining choice as declining (39.653506ms) +✔ an unknown outcome is reported once and never resent (42.773374ms) +✔ a decision closed before the answer arrives exits 2 and points at its trail (28.552254ms) +✔ a prefix that matches two open decisions exits 2 and resolves neither (38.028192ms) +✔ without --business a command uses the live host's business, and a stale host.json is not a host (31.913785ms) +✔ every human command refuses inside an agent run before it touches the bus (34.831874ms) +✔ usage errors exit 4; no business and no host is a usage error (37.36094ms) +✔ agents and tasks print through the broker (30.096289ms) +✔ notify.json: missing, loose, malformed and extra keys refuse; a binding or null passes (3.44358ms) +usage: {"event":"usage-unknown","business":"acme","run":"r0beacbdb1909","instance":"assistant","turn":"b9dd4aaa-399f-4ccc-958c-ace51fecb6c7","source":"@none","code":"baseline-unknown"} +usage: {"event":"usage-unknown","business":"acme","run":"r79d60c151124","instance":"assistant","turn":"f335efc7-59f5-4ec4-9580-339320f3105a","source":"@none","code":"baseline-unknown"} +✔ REQ-THREAD-2 T3 a run collects compactions at its start and its end, and the count holds across a resume and a host restart (4015.286265ms) +usage: {"event":"usage-unknown","business":"acme","run":"r4462f8f47176","instance":"assistant","turn":"e1173d8f-0dfa-45b6-8a4e-2660a0267e61","source":"@none","code":"baseline-unknown"} +usage: {"event":"usage-unknown","business":"acme","run":"r7ff34e3b0f4e","instance":"assistant","turn":"914bda6b-ed22-49d5-a634-206d7a4c49a5","source":"@none","code":"baseline-unknown"} +✔ REQ-THREAD-2 T3 a collection that fails is logged and recorded store-unreadable, and the run ends as one whose collections count (3376.157072ms) +usage: {"event":"usage-unknown","business":"acme","run":"r8bd8e8ca1ed1","instance":"assistant","turn":"e59d0bad-f45b-408e-8304-eba51b278bb2","source":"@none","code":"baseline-unknown"} +usage: {"event":"usage-unknown","business":"acme","run":"r166a26420aeb","instance":"assistant","turn":"dba2ac5e-13a2-4296-9abd-4c4ecd1a04a4","source":"@none","code":"baseline-unknown"} +✔ REQ-THREAD-2 T3 the read budget is the system config's compactionReadBytes, and a bad value takes the default (3605.679597ms) +usage: {"event":"usage-unknown","business":"acme","run":"r2e53a0da04af","instance":"assistant","turn":"ce92c608-09c1-4c09-83d4-49da0671953e","source":"@none","code":"baseline-unknown"} +usage: {"event":"usage-unknown","business":"acme","run":"ra8edc1d91462","instance":"assistant","turn":"9002c702-5152-480e-9d66-4742ec527c9b","source":"@none","code":"baseline-unknown"} +✔ REQ-THREAD-2 T3 the stream cap is the system config's compactionStreams, and a bad value takes the default (3475.306679ms) +usage: {"event":"usage-unknown","business":"acme","run":"r5d129cbfadd4","instance":"assistant","turn":"130570f2-b027-4954-b12f-440440d4e7c5","source":"@none","code":"baseline-unknown"} +✔ REQ-THREAD-2 T3 T4 a clear leaves the retired session's count as it was, its successor counts from 0, and a legacy session reads the thread's ledger (3208.548035ms) +✔ bootConfig builds the broker's boot message for one business, with no trackers key when no project names one (100.944112ms) +✔ trackers come from the tracker.* variables of the one project that names a tracker project (156.863737ms) +✔ with two projects, the one that sets tracker.project supplies the tracker and the other is no conflict (78.19274ms) +✔ two projects that each name a tracker project refuse, since the boot shape holds one (75.340937ms) +✔ a business without tracker.baseUrl gets no trackers entry (75.65331ms) +✔ an unknown business and a broken system config refuse with exit 3 (131.963666ms) +✔ Row 252 (Webby N1): every console.sso subject reaches the boot as a console owner, and no sso means no consoleOwners key (78.447179ms) +✔ row 199: issue and rotate send the stdin token once to credentials.issue and print no value (13.926536ms) +✔ row 199: rotate goes ahead on each held state, rotation-due included, and refuses not-issued, revoked and an unknown entry (7.399422ms) +✔ row 199: status, revoke and delete; the tester runs status and revoke only (7.726811ms) +✔ row 210: issue of a host. kind prints public material only (3.837223ms) +✔ row 199: scripts/mosaic sends credentials to packages/cli, not the seat CLI (219.79204ms) +✔ follow prints an unsolicited message after plain talk returned (70.342915ms) +✔ talk --follow continues after reply and prints a later unsolicited message (75.557014ms) +✔ inbox lists all unread human messages under decisions, does not deliver or read them (904.73876ms) +✔ follow refuses agent context and bad arguments (44.422889ms) +✔ follow Ctrl-C wakes the poll sleep and removes its handler; transport errors also clean up (36.277127ms) +✔ plain talk leaves the process SIGINT handlers unchanged (49.365114ms) +✔ empty views say so (1.504179ms) +✔ agents adds a thread line for each held thread claim, after the roles (0.265607ms) +✔ the trail keeps the broker's order and names a decision's task without its rows (2.730757ms) +✔ tasks print the tracker fields the snapshot carries (0.275152ms) +✔ guardDocker refuses a compose run unless PI_AUTH_FILE is a regular file inside the lane temp root (9.883376ms) +✔ cleanEnv points PI_AUTH_FILE at the lane fixture and drops MOSAIC_LIVE_PROVIDER (1.196274ms) +✔ test-release.sh activates through the mock adapter with a 0600 fixture auth file (3402.867757ms) +ℹ {"script":"test-release.sh","extra":[],"wallMs":2790,"status":1} +✔ test-task.sh mounts only its fixture, uses only the mock adapter and prints the live skip twice (13282.824762ms) +ℹ {"script":"test-task.sh","extra":[],"wallMs":13116,"status":1} +✔ M-T: MOSAIC_LIVE_PROVIDER=1 runs the real-model cases, which fail under a fixture auth file (14234.825924ms) +ℹ {"script":"test-task.sh","extra":["MOSAIC_LIVE_PROVIDER","PI_AUTH_FILE"],"wallMs":14081,"status":1} +✔ parallel lease holders use only the active lane and its shared state (42.675683ms) +✔ unrelated home changes do not become lane writes, and own-root references do (0.544899ms) +✔ proof summaries refuse missing timings, non-overlap and a pair without a lane swap (1.360626ms) +✔ an exhausted single-port band refuses, and an occupied foreign listener survives the probe (28.736085ms) +✔ parallel child allocators share real lane locks; a lease remains held through child shutdown (311.812641ms) +✔ abrupt allocator death releases its holder without touching a foreign lease (97.323528ms) +✔ fixture caches survive a replacement environment with a separate tmp subdirectory (46.823919ms) +✔ an unrelated session can append while a supervised step runs without becoming an attributed write (124.752091ms) +✔ a changed COPY input or actual image ID refuses compatible image sharing (10.022682ms) +✔ warm Docker guard disables implicit build and pull and refuses image mutation (8.614874ms) +✔ exclusive image preparation records actual image ID and build wall time and requires a grant (5.287878ms) +✔ cleanup refuses a foreign Docker label and removes only an exact owned project (0.797292ms) +✔ missing receipt and missing image refuse without permitting a gate (3.34132ms) +✔ a tag changed between supervised steps fails the next boundary and suppresses gate success (66.147092ms) +✔ mutable-base rebuilds with identical files have distinct image IDs; cold and warm counters stay separate (8.216069ms) +✔ warm pinned execution records zero builds and checks the tag again after its final step (94.090951ms) +✔ installed Compose accepts rewritten run argv without starting a container (165.371184ms) +✔ installed Compose resolves the private override with no build and the pinned image (131.699301ms) +ℹ {"installedComposeConfig":{"buildPresent":false,"image":"sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}} +✔ guard owns every Compose file argument and refuses caller configuration overrides (2.188016ms) +✔ changing packages/processing-control/src/state.mjs invalidates the image receipt (3.832556ms) +✔ changing packages/processing-control/src/entrypoint.mjs invalidates the image receipt (5.489665ms) +✔ unfinished dead-owner runs quarantine their lane and a recovery record clears only that run (7.879544ms) +✔ a legacy landing gate beside a lane stays legacy even with the same parent (3.74657ms) +✔ the shell status entry reads scratch receipts and reports legacy processes without mutating old slots (142.581695ms) +✔ recovery supersedes an unclean terminal without rewriting either receipt (5.686032ms) +✔ the wrapper refuses a held lane lock and preserves its inode (106.355855ms) +✔ a held kernel lock without a start receipt is BUSY rather than CLEAR (19.829125ms) +✔ SIGKILL leaves a quarantined run and locked recovery publishes a new clean receipt (601.932057ms) +✔ a malformed receipt refuses status and an identity mismatch cannot look live (5.219396ms) +✔ a symlink lock is refused before acquiring or replacing its target (87.914965ms) +✔ failed recovery keeps quarantine and never publishes a clean recovery receipt (518.317846ms) +✔ two shared image holders coexist, but exclusive preparation refuses their lock (233.377756ms) +✔ two simultaneous shell claims have one winner; supervisor retains lock FDs and ordinary children do not (219.268118ms) +✔ same checkout and a legacy land gate each refuse a claim on an otherwise free lane (10.556412ms) +✔ recovery kills a proven surviving child, preserves a foreign child and keeps quarantine if interrupted (956.998647ms) +✔ preflight refuses unsafe lane roots, missing grants and live port 9 before side effects (73.519956ms) +✔ discovery preserves all package and script steps while ignoring non-file shell names (36.872177ms) +✔ a failed step stops the gate and records its nonzero exit without running the next step (43.911488ms) +✔ a cancelled step stops its process group and records failure (149.359643ms) +✔ step receipts retain pass fail skipped counts and hashes of their actual logs (80.846712ms) +✔ preflight rejects a real 31-byte root, missing dependency tree, occupied band and missing inventory (113.299193ms) +✔ preflight refuses canonical and builder checkouts and an existing output (40.44806ms) +✔ both candidates must carry every approved launcher file (36.029268ms) +✔ the 92-byte socket example passes and an over-107-byte pathname refuses (0.473578ms) +✔ package/script duplicates stay and every supervised step clears NODE_TEST_CONTEXT (200.011016ms) +✔ scoped ss loopback and wildcard port 9 listeners refuse (94.408535ms) +✔ step children use legacy umask 022 while the supervisor retains 077 (93.545074ms) +✔ lane wrapper keeps its state directory and lock files private (200.278028ms) +✔ the review loop: the coder pushes and asks, the reviewer fetches and approves, and the task's trail holds each step (2233.556799ms) +✔ refusals: no action, non-fast-forward, an unknown commit or request, and a push for another task moves only that task's ref (1838.528109ms) +✔ the size cap refuses a push before any byte (477.009099ms) +✔ a fetch over the cap refuses before any byte reaches the reviewer (1545.019975ms) +✔ the socket refuses a request with no capability, an unknown one, and a bad request line (772.194028ms) +✔ a rigged clone runs nothing: hooks, fsmonitor, a filter, a gitlink and a symlinked .git/config leave no marker (1414.988457ms) +✔ an identity with no role, or of another business, refuses not-a-role and moves no ref (897.192078ms) +✔ a review of a project the business no longer has refuses unknown-project (842.768725ms) +✔ past maxActive connections the socket refuses git-busy, and a hung-up connection frees its slot (439.515572ms) +✔ close() answers host-closing to a connection still sending its request line (433.927108ms) +✔ a bundle that trickles in refuses body-timeout at its deadline and frees its slot (819.434834ms) +✔ a reviewer gone before its bundle was sent is filed fetch-aborted, not as the host's fault (1448.146974ms) +✔ a reviewer that hangs up the moment it has the whole bundle was served, not aborted (3212.183335ms) +✔ send: a close after every byte left is served; one that fails a queued write is fetch-aborted (42.885709ms) +✔ a bundle with no bytes for bodyIdle refuses body-timeout long before its deadline (865.168325ms) +✔ send: a close once the loop is past its last chunk is served, and a failed write there is fetch-aborted (48.963375ms) +✔ letGo waits for an answer to leave for at most its cap, then destroys the socket (301.339631ms) +✔ a record that fails and can't be undone refuses rollback-failed, which the host logs (1119.488844ms) +✔ land: the squash runs the gate in its own worktree, then main moves and the broker records it (1711.821986ms) +✔ land: an arbiter-resolved landing's squash says the arbiter resolved it through the broker (1709.485749ms) +✔ land: refusals before the gate answer the role at once and leave main and no worktree (1725.911927ms) +✔ land: a failed gate is refused gate-failed with its step, told to the role, and main stays (1346.586942ms) +✔ land: a record the broker refuses moves main back, and the landing is refused with the broker's code (1221.408412ms) +✔ land: a second landing while one runs refuses land-busy, and close() stops the gate and refuses host-closing (1148.703799ms) +✔ row 298 CLI: scope reads and scope set sends JSON and the observed revision (11.996303ms) +✔ row 298 CLI: every access agent marker refuses scope set before transport (6.43813ms) +✔ row 298 CLI: --tester cannot read or change the scope (1.325369ms) +✔ row 298 CLI: missing revision and empty, invalid or oversized JSON refuse without a call (6.297106ms) +✔ row 236: grants status prints one line per entry, and --json the answer (11.001821ms) +✔ row 236: run, revoke, sweep and admin rotate and remove send their args (1.785706ms) +✔ row 236: admin set sends the stdin token once to grants.admin.set and prints no value (10.654434ms) +✔ row 236: a malformed grants command is a usage error and calls nothing (18.480678ms) +✔ row 236: a bus refusal exits 2 with its code (0.831092ms) +✔ row 236: scripts/mosaic sends grants to packages/cli, not the seat CLI (230.546439ms) +✔ the host boots the broker, binds a launch in process, and the notifier DMs a blocking decision exactly once (1292.173723ms) +✔ a notifier that dies takes the host down with exit 1, so the unit restarts the pair (515.909792ms) +✔ a second host for the same data root refuses with exit 3 while the first runs (365.626222ms) +✔ two bus starts racing for one data root leave one host running; the other refuses that a host already runs (1009.338716ms) +✔ a host takes over a host.lock its dead host left, and puts back a live claim that replaced it meanwhile (2.097521ms) +✔ a host.lock that goes between the check and the read is tried again; one that can't be parsed still refuses as unreadable (1.687848ms) +✔ a live host's lock stays, however old the file is (0.946478ms) +✔ a host.lock left by a host killed with SIGKILL doesn't stop the next bus start (1494.875238ms) +✔ while a host boots, a reader sees no host: the human commands still ask for --business, stop and status find none (504.001657ms) +✔ a host started before host.lock existed, holding only host.json, still refuses a second start, which leaves no lock (66.599241ms) +✔ a broker fork that throws leaves no host.lock and no host.json (76.389417ms) +✔ a broker send that throws leaves no host.lock and no host.json (74.356687ms) +✔ a broker that misses its boot wait leaves no host.lock and no host.json (96.993724ms) +✔ a notifier fork that throws stops the broker and leaves no host.lock and no host.json (387.302312ms) +✔ a notifier send that throws stops the broker and leaves no host.lock and no host.json (356.825413ms) +✔ a boot reply with no reader for the business refuses with exit 3 naming it, before the notifier starts, and leaves no host.lock and no live broker (382.231442ms) +✔ a boot reply with no reader for the business refuses with exit 3 naming it, with no notifier, and leaves no host.lock and no live broker (359.352383ms) +✔ a host.json that can't be written stops both children and leaves no host.lock (569.291167ms) +✔ an error event on the broker before it replies fails the start at once, and leaves no host.lock and no live child (60.963821ms) +✔ an error event on the notifier before it replies fails the start at once, and leaves no host.lock and no live child (305.664912ms) +✔ an error event on the broker while the notifier starts fails the start once the notifier replies (451.432645ms) +✔ an error event on the broker once the host is up stops the host with exit 1, and leaves no host.lock and no host.json (493.438818ms) +✔ an error event on the notifier once the host is up stops the host with exit 1, and leaves no host.lock and no host.json (489.022ms) +✔ a broker reply that misses the wait breaks the channel: the late reply answers nothing, later requests refuse, the host exits 1 (1354.883738ms) +✔ a broker reply with another request's id, or none, breaks the channel and the host exits 1 (680.396767ms) +✔ a broker reply with no request waiting breaks the channel and the host exits 1 (368.768787ms) +✔ a notifier that refuses stops the broker and the host refuses with exit 3 (439.553002ms) +✔ a notifier that refuses after the broker died still refuses with exit 3, without a send to the dead broker (476.315699ms) +✔ a notifier that dies before it replies, after the broker died, still refuses, without a send to the dead broker (364.142165ms) +✔ a close send that fails with EPIPE after the notifier refuses still gives the notifier's refusal, exit 3 (448.273529ms) +✔ a close send that fails with EPIPE after the notifier dies unanswered still gives the notifier's error (331.882977ms) +✔ close() whose stop and close sends fail with EPIPE still finishes, with exit 1 (447.513044ms) +✔ watchChildren reports a child that died before it was called, and one that dies later (43.020225ms) +✔ bus stop refuses to signal a live pid that is not a bus host (206.279459ms) +✔ bus start refuses with exit 3 and the code when the broker refuses to boot; bus status names the lock (721.692922ms) +✔ bus start refuses with exit 3 without a notifier config (254.11278ms) +✔ bus start runs until bus stop; status reports it while it runs (1434.38905ms) +✔ bus start --no-launch says launches are disabled in its host-up line and stops cleanly; with --pm it is a usage error (1227.020769ms) +✔ bus-service.sh renders the unit and installs it into a given directory (545.388038ms) +✔ bus-service.sh pins the claude binary, refuses one the unit can't carry, and renders without one (939.405428ms) +✔ bus-service.sh refuses a directory pin and keeps a symlink default unresolved (195.852408ms) +✔ bus-service.sh refuses a default claude without the execute bit, or in a PATH dir with a space (130.721616ms) +✔ bus start --pm while halted keeps the control host up without launching the chief (833.55008ms) +✔ row 234: hosts status prints one line per host, and --json the rows (4.619345ms) +✔ row 234: hosts check and remove send the host id, as the human or the tester (1.067849ms) +✔ row 234: a malformed hosts command is a usage error and calls nothing (4.702501ms) +✔ row 234: a bus refusal exits 2 with its code (1.003184ms) +✔ row 234: scripts/mosaic sends hosts to packages/cli, not the seat CLI (180.483354ms) +✔ row 235: hosts revoke sends agent, host and reason, and sweep the host, as the human or the tester (0.928083ms) +✔ row 235 (N10): revoke without --reason, --reason on another verb, and inherited names are usage errors (8.831228ms) +✔ row 235: a status line shows the tags of a revoke in progress (0.877977ms) +usage: {"event":"usage-unknown","business":"acme","run":"ra8b89e4ac873","instance":"assistant","turn":"d0ad9cb8-34c0-4c52-a9d5-73aa879cf3fc","source":"@none","code":"baseline-unknown"} +usage: {"event":"usage-unknown","business":"acme","run":"r5d9d92909fd2","instance":"assistant","turn":"560955f9-2c65-4a40-8286-8eeebafe1c59","source":"@none","code":"baseline-unknown"} +✔ row 302 REQ-THREAD-2 an idle-released run whose call lands before the SIGTERM ends stopped/0; a run whose claim the human revoked in the same window still ends session-invalid/22 (1921.507358ms) +organization: {"event":"reload-needs-restart","business":"acme"} +organization: {"event":"reload-needs-restart","business":"acme"} +✔ row 165 CLI: instance add puts an instance in the file, validate exits 0, the log names the human, and the instance binds with no restart (row 194, T1) (336.273378ms) +✔ row 194 CLI: a bus whose boot credential references differ from the file answers restart needed, and doesn't bind the instance (D3 item 3) (200.022034ms) +✔ row 165 CLI: instance set passes the vars file and --no-launch, and a vars-only change needs no restart (290.533846ms) +✔ row 165 CLI: a refusal names its code and why, exits 2 and keeps the bytes (170.95135ms) +✔ row 165 CLI: usage errors exit 4 before any bus call, and an agent session is refused (129.783555ms) +✔ row 165: scripts/mosaic sends business instances, instance and (row 194) veto to packages/cli, and validate still to packages/business (424.923052ms) +✔ row 194 CLI V6: veto keep, unkeep, nohire and hire write through veto.set, the read shows kept and noHire, and a no-op refuses (285.320198ms) +✔ row 194 CLI: the read lists each instance's running run from the bus claims (169.005519ms) +✔ row 194 CLI D1.1 item 5: launch and regenerate poll instance.request and print the run; a done with a refusal exits 3 with its code and the request id (157.087941ms) +✔ row 194 CLI D1.1 item 5: an open request at --wait exits 3 with its id, and a taken one with no done is outcome-unknown (1259.391901ms) +✔ row 194 CLI: a request cancelled by a terminate exits 3 request-cancelled (131.383285ms) +✔ row 194 CLI V3: terminate prints the runs, the cancelled and the taken requests, and nothing held refuses not-held (133.043624ms) +✔ row 194 CLI V5: delete polls to the transaction and the read lists the name retired; workspace-rename-failed names the transaction (253.187055ms) +✔ row 239 T5 CLI: a delete closed -revoked says the tokens may already be revoked; a plain revision-conflict doesn't (197.077845ms) +✔ row 194 CLI: lifecycle and veto usage errors exit 4 before any bus call (134.138832ms) +✔ REQ-LIMIT-2 a claude-code launch asks mayLaunch with launch.account.name (34.549055ms) +✔ REQ-LIMIT-2 each login set the account can name is accepted when the bus host holds exactly it (67.472411ms) +✔ REQ-LIMIT-2 account-credential-missing: the named set is not a login set, or the bus host lacks part of it (66.080363ms) +✔ REQ-LIMIT-2 account-credential-ambiguous: the bus host sets a credential variable outside the named set, ANTHROPIC_BASE_URL included (41.297162ms) +✔ REQ-LIMIT-2 account-is-credential: launch.account.name is the value of a credential variable the bus host sets (24.649988ms) +✔ REQ-LIMIT-2 a pi launch carries account null and skips both account checks (33.493399ms) +✔ REQ-LIMIT-2 with no launch.account a claude-code launch carries null and the environment is not checked for ambiguity (17.08426ms) +✔ REQ-LIMIT-4 the launcher asks mayLaunch with the instance, provider, model and account (row 126), and goes on to authorization on an allow (33.666035ms) +✔ REQ-LIMIT-3 REQ-LIMIT-4 a launch whose subject is at its limit is refused limit-reached and logged with the check, limit and count (15.701049ms) +✔ REQ-LIMIT-4 fail closed: a refused op, a check failure or a malformed answer refuses limit-check-failed, naming the check and the code (150.775642ms) +✔ REQ-LIMIT-4 the launcher reaches token-limit only through the bus: launcher.mjs imports no limit check (1.144066ms) +✔ a launcher before trusted control initialization refuses processing-uninitialized (5.821978ms) +✔ each launch rereads limits and model selections; lowered limits keep sessions and log exact hit (77.768606ms) +✔ row 65 a passing primary is the route: its provider and model reach mayLaunch, and a stated fallback is never used (37.324528ms) +✔ row 65 a failed primary preflight takes the stated fallback, and the limit checks see the fallback route (23.953635ms) +✔ row 65 a failed primary with no fallback refuses with the preflight code and never asks mayLaunch (22.668469ms) +✔ row 65 a fallback whose own preflight fails refuses with its code and names both reasons (48.160813ms) +✔ row 65 the fallback route spends launch.account when its module counts the account (20.688145ms) +✔ row 65 a missing harness, model or thinking var refuses no-route naming it, and the system execution keys never fill it (54.263304ms) +✔ row 65 a harness that is not switched on refuses harness-off, primary or fallback, and an off primary never falls back (65.066607ms) +✔ row 65 the loader refusing a module refuses harness-refused and names it; a module that throws refuses harness-failed (41.408157ms) +✔ row 65 a thinking level the route harness does not apply refuses thinking-unsupported, on the primary or a fallback taken (58.813833ms) +✔ C2-04: launcher workspace clones code but never the library (1739.882224ms) +✔ bus start --pm: the launcher instance (the chief of staff) runs under its own PID namespace, registered, with a manifest (1682.649983ms) +usage: {"event":"usage-unknown","business":"acme","run":"rf1d6e28b94e5","instance":"chief","turn":"5e5dbaa6-f5a3-4814-ab09-abe9a2b6a938","source":"@none","code":"baseline-unknown"} +usage: {"event":"usage-unknown","business":"acme","run":"r3ef2261df66c","instance":"coder","turn":"b674fccf-a83d-4ed3-9edc-acfa1edbfeec","source":"@none","code":"baseline-unknown"} +usage: {"event":"usage-unknown","business":"acme","run":"rf1d6e28b94e5","instance":"chief","turn":"951555f9-a63d-438f-95b1-f36b8627eee2","source":"@none","code":"baseline-unknown"} +✔ the chief of staff launches a coder through its launch tool; the coder answers; refusals name their code (1303.562495ms) +usage: {"event":"usage-unknown","business":"acme","run":"rccf448cd24d8","instance":"chief","turn":"cae1b9a8-8d34-4a60-83f1-0754ccf0909f","source":"@none","code":"baseline-unknown"} +usage: {"event":"usage-unknown","business":"acme","run":"rb513a44eae1f","instance":"pm","turn":"adddaf51-3ddc-45cd-86fe-bb854983eadb","source":"@none","code":"baseline-unknown"} +usage: {"event":"usage-unknown","business":"acme","run":"rccf448cd24d8","instance":"chief","turn":"3642901c-3ffa-462a-8bb9-cf15371d2602","source":"@none","code":"baseline-unknown"} +usage: {"event":"usage-unknown","business":"acme","run":"rccf448cd24d8","instance":"chief","turn":"f8944f4a-9ca7-4504-b8f4-dafc8eda7662","source":"@none","code":"baseline-unknown"} +usage: {"event":"usage-unknown","business":"acme","run":"rb513a44eae1f","instance":"pm","turn":"3fb7011d-105b-4530-a935-408105cf8974","source":"@none","code":"baseline-unknown"} +usage: {"event":"usage-unknown","business":"acme","run":"rb513a44eae1f","instance":"pm","turn":"f38e079c-0e30-4a4d-b3a6-52e86e99d4b8","source":"@none","code":"baseline-unknown"} +usage: {"event":"usage-unknown","business":"acme","run":"rccf448cd24d8","instance":"chief","turn":"d8fda3b5-494e-429c-97d4-82c8e7df5eb1","source":"@none","code":"baseline-unknown"} +usage: {"event":"usage-unknown","business":"acme","run":"rb513a44eae1f","instance":"pm","turn":"823d812a-b5f1-4742-83a2-19053ca9376e","source":"@none","code":"baseline-unknown"} +usage: {"event":"usage-unknown","business":"acme","run":"rccf448cd24d8","instance":"chief","turn":"c957d825-c4d4-46c7-a19f-8fdd8876ed04","source":"@none","code":"baseline-unknown"} +✔ a launched pm's request_staff reaches the chief of staff; no other session has the tool and the launch limits still hold (1815.938864ms) +✔ each launch makes sure the workspace has a clone of the project: cloned, fast-forwarded, or fetched and logged (5130.058218ms) +✔ a role the broker says holds a merge decision gets land_work, its prompt line, its landing and the git socket; without it, none (1264.734224ms) +✔ REQ-LAUNCH-1 the tick starts a listed merge decision holder once, with land_work, the Landing line and its landing turn; an unlisted holder starts nothing (817.961655ms) +usage: {"event":"usage-unknown","business":"acme","run":"rcfb2293ff24f","instance":"coder","turn":"5116c126-26ca-4719-a533-e453c7613840","source":"@none","code":"baseline-unknown"} +✔ a holder running since before the resolution is stopped once the broker releases it, land-relaunch, and the next tick starts it: landing turn first, then the message that waited (1387.281727ms) +✔ a landing run that ended isn't started again for its decision, a spent decision starts nothing, and a new decision starts the holder (1519.040669ms) +✔ after a restart, the new host's first tick starts a holder whose decision is still held (1874.066459ms) +✔ a refused landing start is logged once per code with its decision, isn't a start, and the next tick with room starts the holder (1168.12818ms) +✔ a project clone that can't be made refuses checkout-failed, from --chief and from a session, with no run and no clone left (620.886697ms) +✔ a runner that stops at once ends its launch with the runner's reason (665.905511ms) +✔ a Claude Code launch with no session credential refuses before it starts (373.993544ms) +✔ a pi launch needs no session credential: pi logs in through its own ENV_ALLOW variables (582.123385ms) +usage: {"event":"plugin-refused","kind":"harness","name":"down","code":"missing","message":"/home/jwoltje/.t3/worktrees/mosaic-stack/beakley-row217/packages/plugins/harness/down is missing","kept":[]} +plugins: {"event":"plugin-refused","kind":"harness","name":"down","code":"missing","message":"/home/jwoltje/.t3/worktrees/mosaic-stack/beakley-row217/packages/plugins/harness/down is missing","kept":[]} +✔ row 65 a failed primary preflight launches the fallback on a fixture harness module, recording the route and the reason (592.058924ms) +✔ a runner killed from the host ends its launch as killed, not failed (591.845367ms) +✔ a missing or failing bwrap refuses sandbox-unavailable before anything starts; there is no unconfined fallback (328.045592ms) +✔ row 64 a role skill that isn't enabled refuses skill-not-enabled, and one that isn't a plain directory skill-refused, before anything starts (306.353546ms) +✔ row 213 a creative instance's persona is read from /personas: off its digest the launch fails with the mismatch as its reason (422.021803ms) +✔ row 64 on Claude Code a role skill that isn't enabled refuses the same way, before anything starts (302.5524ms) +usage: {"event":"usage-unknown","business":"acme","run":"rc362fe69c564","instance":"chief","turn":"e32b5baf-5cc8-44b4-a0ea-8036da9ca503","source":"@none","code":"baseline-unknown"} +usage: {"event":"usage-unknown","business":"acme","run":"rc362fe69c564","instance":"chief","turn":"097e3d49-f4ed-434f-a38e-45b2cb450e65","source":"@none","code":"baseline-unknown"} +usage: {"event":"usage-unknown","business":"acme","run":"r31b0d21b18a2","instance":"coder","turn":"37baa864-5655-4ee7-b0aa-79c57d0f24c3","source":"@none","code":"baseline-unknown"} +✔ a real Claude Code coder's shell can't read a stand-in secret or anything else its sandbox doesn't hold (1908.14738ms) +✔ a host that died hard leaves its sessions to the next host, which kills them and ends their runs so the role can be launched again (1458.958359ms) +✔ a host that died hard leaves its sessions to the next host, which finds one already exited (23) and ends their runs so the role can be launched again (4380.441229ms) +✔ bus start --no-launch leaves an earlier host's live session alone: no signal, no end, sessions.json as it was (329.236521ms) +✔ bus start --no-launch refuses every launch: the PM launch and a session's request, each logged, nothing spawned (245.901667ms) +✔ bus start --no-launch starts no thread tick; the same host with launches runs it (1356.729498ms) +✔ a malformed sessions.json refuses the host start with exit 3 and stays as it was (290.164088ms) +✔ an over-long launch request is refused at once, not at the 10 s idle timeout (310.118414ms) +✔ a launch client that never closes its side doesn't hold the host's close (407.741749ms) +✔ a runner that ignores SIGTERM is killed when the host closes (1626.085747ms) +✔ kill switch refuses chief and hire before launch work and a clear permits a later request (573.153388ms) +✔ kill switch stops an actual managed namespace and records the halt reason without rewriting its bundle (577.044224ms) +✔ a launch waiting across halt and resume cannot use its stale admission (420.062526ms) +✔ row 194 T2: the human's launch runs an unlisted instance and launch.by through the pm branch, and closes with the run (766.901913ms) +✔ row 194 T2: a request past its 60 s never launches, and a refused check closes the request with its code (163.675199ms) +✔ row 194 T3: a --no-launch host closes each request launches-disabled and starts nothing (141.296614ms) +✔ row 194 T3: a limit refusal closes the request with its code and the limit in the launch log (399.400614ms) +✔ row 194 T4: terminate revokes and cancels at the verb, then the pass signals the run, which ends once (504.852827ms) +✔ row 194 T5: regenerate ends the run in the registry and starts a new run on the same workspace (1091.742081ms) +✔ row 194 T5: a run that outlasts the request's mark closes the regenerate regenerate-timeout and starts nothing (2942.340487ms) +✔ row 194 V5: delete retires the name, renames the workspace to .retired/I- at 0700, and a retry renames after workspace-rename-failed (209.697978ms) +✔ row 194 V5: a delete with no workspace commits and closes with the transaction (189.493834ms) +✔ row 281 T10: the delete pass closes a granted instance's first request grants-revoking and the host channel stays up (192.311356ms) +✔ row 194 D1.1 item 5: the CLI's launch, regenerate, terminate and delete end to end through the pass, and a closed refusal exits 3 with the request id (970.315885ms) +✔ row 194 T20: a store-only delete with a tracker bot closes naming the bot, and the CLI says to remove it in Vikunja (170.594648ms) +✔ row 194 T2a: a launch.revoke between the request and the pass closes it launch-revoked with no process; a done that fails once leaves the request taken and the next pass starts nothing (389.112825ms) +✔ row 194 T4: terminate signals a spawned run in the registry that the bus never bound, and not a run whose start time differs (471.078878ms) +✔ row 194 T9a: fire signals its bound run and a spawned but unbound registry run; a SIGTERM-ignoring runner gets SIGKILL and lifecycle.end.killed, and one whose kill fails gets lifecycle.end.alive (1213.714706ms) +✔ row 194 T9a: fire of a registry run with no runtime record reads lifecycle.end.alive with reason unknown, never killed (659.541333ms) +✔ row 194 T9a: a runner whose identity changed before the SIGTERM gets no signal, and one whose identity changed between the SIGTERM and the SIGKILL gets no SIGKILL (322.267306ms) +✔ row 194 T9a: V3 terminate of a SIGTERM-ignoring runner sends no SIGKILL (1076.358737ms) +✔ row 194 T9b: a halt during a fire's stop sends no second SIGTERM, keeps the fire's deadline, writes one stop receipt with reason fire and the request, and counts the run; a fire while halted refuses (1812.007011ms) +✔ row 194 T15: while halted the pass closes a launch and a regenerate processing-halted and runs no thread pass, terminate signals, and after a resume a launch starts (510.829629ms) +✔ row 194 N6: a run spawned after a terminate's verb survives its pass, and the next terminate ends it (632.496682ms) +✔ row 194 T6: a delete leaves the run evidence bytes unchanged, and the retired name refuses a create and a launch (662.917284ms) +✔ row 194 T11: two stack roots with the same business id; a launch, a terminate and a delete in one leave the other byte-identical (865.55069ms) +usage: {"event":"usage-unknown","business":"acme","run":"r68305ff2e1bf","instance":"chief","turn":"2798c194-a519-499f-9030-953ffa975c50","source":"@none","code":"baseline-unknown"} +usage: {"event":"usage-unknown","business":"acme","run":"r68305ff2e1bf","instance":"chief","turn":"345306db-252a-49f2-8abf-67e846723bd9","source":"@none","code":"baseline-unknown"} +usage: {"event":"usage-unknown","business":"acme","run":"r68305ff2e1bf","instance":"chief","turn":"ab26ce59-2785-4a39-a7ca-95f90d1dda81","source":"@none","code":"baseline-unknown"} +usage: {"event":"usage-unknown","business":"acme","run":"r68305ff2e1bf","instance":"chief","turn":"7c2541b8-5820-4f8f-975b-ece208f51d62","source":"@none","code":"baseline-unknown"} +usage: {"event":"usage-unknown","business":"acme","run":"r68305ff2e1bf","instance":"chief","turn":"c4d22421-a067-4d20-a1ae-b39cd5211410","source":"@none","code":"baseline-unknown"} +usage: {"event":"usage-unknown","business":"acme","run":"r68305ff2e1bf","instance":"chief","turn":"cd79e05e-7e8e-446c-8c3d-87d54f647b31","source":"@none","code":"baseline-unknown"} +usage: {"event":"usage-unknown","business":"acme","run":"r68305ff2e1bf","instance":"chief","turn":"7a3165e7-5ede-4ab3-add2-f4d0f95e78f8","source":"@none","code":"baseline-unknown"} +✔ row 194 D3 item 5: the chief's session hires with its tool and launches its hire in the same session, then fires it (2092.35332ms) +✔ REQ-LIMIT-3 REQ-LIMIT-4 formatTokens shows each limit counted, not enforced, or check failed, in reset path words (1.479531ms) +✔ REQ-LIMIT-2 row 126: any daily quota row adds one line after the list saying the count is this stack's own use (0.448359ms) +✔ REQ-LIMIT-3 the view prints the limits then the token lines; --json keeps tokens in the result (4.920358ms) +✔ REQ-LIMIT-3 reset reads the revision, then sends limits.set with one path per limit, a word per level (1.42055ms) +✔ REQ-LIMIT-3 reset with no path, or with --file, is refused before the bus (2.355481ms) +✔ migration needs no bus/config, prints whole converted document, is idempotent and never writes (23.407603ms) +✔ limits view/set use the human bus transport and pass only the explicit patch (3.428306ms) +✔ limits set passes an assistants patch through unchanged, and the usage names the key (1.752088ms) +✔ post-119 example and Jason fixture migrate with checked inherited models; wrong or absent config refuses (325.186995ms) +✔ plugins view/set use the human bus transport and pass only the explicit patch (vikunja:19/305) (4.116963ms) +✔ inbox --read marks one message by the id inbox prints, delivered or not, and leaves the rest unread (55.532073ms) +✔ inbox --read refuses an id that is not the human's, prints its code, still marks the rest and exits 2 (40.172107ms) +✔ inbox --read refuses an ambiguous or short prefix, names every match, reads nothing for them and marks the rest (1.580797ms) +✔ inbox --read-all marks every message the inbox walk lists, delivered or not, and inbox then shows 0 unread (1598.66114ms) +✔ inbox --read stops on an error that is not about one message (1.673319ms) +✔ inbox --read and --read-all refuse bad combinations; other verbs refuse them (32.235153ms) +✔ the human names an instance, lists it, and talk's message.send reaches it by that name (43.011672ms) +✔ name and names refuse the wrong number of arguments with the usage (27.224049ms) +✔ zoned uses the IANA zone across DST (24.938519ms) +✔ each open blocking decision is DM'd once, across polls and a restart; non-blocking ones are not (40.944118ms) +✔ two blocking decisions get two DMs with different nonces (30.275985ms) +✔ the digest nonce differs per business and per day and fits Discord's 25 characters (0.350377ms) +✔ a failed DM is journaled, backs off, and is retried until it lands (29.835634ms) +✔ five definite refusals stop a DM: one gave-up line, one log line, and a restart keeps the count (34.037498ms) +✔ 429s, 5xx-style unknowns and refusals without a status never count toward the limit (40.848032ms) +✔ a crash between the fifth refusal and its gave-up line: the next poll appends it and sends nothing (33.169483ms) +✔ polled every POLL_MS against a permanent 403, a DM is sent at 0, 30, 60, 90 and 120 min and gives up only then (264.744428ms) +✔ a restart after the second refusal does not send before that refusal's 30 min are up (146.176768ms) +✔ the digest goes at 08:00 Chicago once a day, with blocking ones marked as DM'd (55.139995ms) +✔ a late start with no digest for the day sends one at once; an empty inbox gets one line (31.936672ms) +✔ an inbox read failure is logged and the next poll retries (1.52626ms) +✔ no Discord id reaches the journal or the log (31.527796ms) +✔ the journal: a torn tail is copied out and truncated, so an append after it reopens cleanly (3.185844ms) +✔ the journal: a crash between the copy and the truncate leaves a tail the next open repairs (9.382263ms) +✔ the journal: a whole file that is one torn line truncates to empty (2.371257ms) +✔ the journal: a malformed complete line refuses and leaves the file and any torn tail alone (1.150265ms) +✔ the journal: a loose file mode, a loose directory or a symlinked journal refuses (2.492252ms) +✔ the journal: a line with a wrong type refuses with exit 3 and names the field (4.979095ms) +✔ the journal: a symlinked directory refuses and says it is a link (0.692353ms) +✔ the journal: a dangling directory link, a parent that is a file and a journal that is a directory each refuse with exit 3 (1.030697ms) +✔ the journal: an append after the file was swapped for a symlink refuses and writes nothing through it (0.72132ms) +✔ the journal: a directory it cannot write or create refuses with exit 3 and names the path (0.847983ms) +✔ digest content stays within Discord's 2000 characters (0.549905ms) +✔ runLoop never overlaps ticks and stops after the one in flight (116.66849ms) +✔ processing halt prevents notifier reads and sends and fences the wait before delivery (71.373997ms) +✔ Q247: bootConfig omits tracker setup even with tracker variables left in the business (14.614051ms) +✔ Q247: trackerless business boots and registers no @sync credential (102.101513ms) +✔ Q247: Console business read works with tracker absent and shows no sync credential (5.476329ms) +✔ Q247: a present tracker with a missing token still refuses bus boot (29.714516ms) +✔ a human command refused with human-required prints the other-tree line and exits 3 (5.073208ms) +✔ a --tester command refused with tester-required prints the other-tree line and exits 3 (1.741627ms) +✔ other exit-3 refusals print no other-tree line (2.670909ms) +✔ the line names no path (0.196301ms) +✔ human halt/status/resume uses management transport without loading any channel (56.268583ms) +✔ halt refuses inside an agent before transport (25.724666ms) +✔ resume refuses inside an agent before transport (23.043458ms) +✔ unknown and partially stopped outcomes are never reported as a successful halt (32.122477ms) +✔ threads project resolution explains a business repository and falls back if its file cannot load (109.864584ms) +✔ project create prints the repository-name refusal and exits two without writing (60.396154ms) +✔ project init/check use declared business repo and never contact the bus (265.632378ms) +✔ project commands validate args and refuse undeclared projects and agent init (66.393572ms) +✔ project create and list validate their arguments before any bus call (56.226662ms) +✔ project dispatcher reaches the human CLI (186.481762ms) +✔ T3 end to end: publish under an approved decision sends the work commit to the agent's own fork and records it once (1312.69961ms) +✔ T3 end to end: a fork the token can't reach is fork-unavailable, filed once, and nothing is recorded as allowed (884.755804ms) +✔ a bad branch or project refuses before the broker; a fork, user or ref in the request is ignored (953.564145ms) +✔ T3 end to end: two agents, one project, each lands on its own fork only; the upstream receives nothing (1617.701014ms) +✔ T3: a push after checkPublish and before the lock refuses ref-moved; the fork receives nothing (1036.208937ms) +✔ T3: a push recorded while the bus process pushes refuses decision-mismatch; only the decision's commit reached the fork (948.422121ms) +✔ row 237: two publishes race on one decision; the second refuses publish-busy and exactly one push reaches the fork (1048.089841ms) +✔ sage-1440: the publishResult poll is bounded: publish-timeout, filed once, and nothing recorded (896.984617ms) +bus: publish c9c429bb-1551-4d55-b22a-f8fc8861390e: pushed after the git socket refused publish-timeout; recorded +✔ row 242: a retry after publish-timeout refuses publish-busy while the bus process's push runs; the late push is recorded and the decision pushes once (1142.259814ms) +✔ C2-06 CLI replies reads revision and sends only the JSON settings to the human verb (6.114121ms) +✔ C2-06 CLI replies requires a file and refuses tester writes before a bus call (1.009499ms) +usage: {"event":"usage-unknown","business":"acme","run":"r0482c4de2d88","instance":"assistant","turn":"6e963b1f-29a4-4d00-8227-06511849295f","source":"@none","code":"baseline-unknown"} +usage: {"event":"usage-unknown","business":"acme","run":"rb7b61df0203e","instance":"assistant","turn":"7ff4e737-6af4-468e-bc82-f9651b416d0f","source":"@none","code":"baseline-unknown"} +✔ row 306 REQ-LAUNCH-1 R4 a revoked run whose call lands before the SIGTERM ends stopped/0; a run the human stopped in the same window still ends session-invalid/22 (1153.490496ms) +usage: {"event":"usage-unknown","business":"acme","run":"r167ae8c70013","instance":"assistant","turn":"089be4a0-f596-422b-a36e-444da1499c4f","source":"@none","code":"baseline-unknown"} +usage: {"event":"usage-unknown","business":"acme","run":"rd4380be116e3","instance":"assistant","turn":"13d06d23-0adc-4e51-b5f4-05319fd50b27","source":"@none","code":"baseline-unknown"} +✔ REQ-THREAD-2 T4 D7 D8 N6: a clear of a running session stops its drained run once, retires it on the run's end, and starts the successor fresh in its own namespace (1324.808754ms) +usage: {"event":"usage-unknown","business":"acme","run":"r8aa04ad153e9","instance":"assistant","turn":"2f17c871-1b3e-483e-aeb3-ae81d38ad66c","source":"@none","code":"baseline-unknown"} +✔ REQ-THREAD-2 T4 D8: a successor start refused capacity-full is held, reported and logged once, and starts when capacity frees (5010.612198ms) +✔ REQ-THREAD-2 T4 D7 Q2: after a restart, a live survivor of the cleared run holds the clear at drained with no signal, and its exit lets it retire (811.171518ms) +usage: {"event":"usage-unknown","business":"acme","run":"r4a76efba2a45","instance":"assistant","turn":"c9338ef1-5d5b-410b-9d4d-24daeeaae3ee","source":"@none","code":"baseline-unknown"} +✔ REQ-THREAD-2 T4 D7: a drained run that outlives the stop timeout makes the clear uncertain once, with one signal, and it retires on the run's end (2172.839403ms) +usage: {"event":"usage-unknown","business":"acme","run":"rfc03cc9f7e72","instance":"assistant","turn":"68be642b-6333-47f2-9627-d2f90dbb72bb","source":"@none","code":"baseline-unknown"} +✔ REQ-THREAD-2 T4 T6: a bus unavailable at the exit proof and then at retirement holds the clear with no retirement, successor or launch, and it resumes when the bus is back (3547.600554ms) +✔ session list/show/open select one session without changing the saved default (10.155919ms) +✔ create requires a reusable operation key and returns the broker identity (2.691761ms) +✔ invalid/foreign session selection never falls back to the default or opens a session (6.724657ms) +✔ unsupported clear refuses with a reason and never opens or creates a replacement (1.586037ms) +✔ clear waits by operation reads only, keeps revision, then reports pending at 30s (3.084559ms) +✔ count output distinguishes exact zero, lower bounds and unavailable collection (0.386714ms) +✔ session CLI real broker: create/list/open keeps default and selectors isolated (55.777739ms) +✔ explicit --session on thread reads, opens and talk never drops the selected id (5.440532ms) +✔ repeating clear with a recorded operation queries it and never sends a new revision (1.020793ms) +✔ new CLI surface refuses forged agent identity before reaching transport (0.665339ms) +✔ cancel requires confirmation, uses the clear op and accepts cancelled before or after retirement (1.919946ms) +✔ cancelled operation is terminal: clear polling stops without another write (0.796531ms) +✔ routed message cancellation prints its stored receipt and never waits for a reply (1.021083ms) +✔ 272 N2: reusing another session clear key gives a precise refusal without a write (0.697811ms) +usage: {"event":"usage-unknown","business":"acme","run":"r4d834ab9ed45","instance":"assistant","turn":"5a8c01c8-1858-4c33-8028-a35cd4ba29d8","source":"@none","code":"baseline-unknown"} +usage: {"event":"usage-unknown","business":"acme","run":"r5a62ebe55461","instance":"assistant","turn":"0bb441c4-14f1-4601-a229-a28c66d94e4e","source":"@none","code":"baseline-unknown"} +usage: {"event":"usage-unknown","business":"acme","run":"r6fe1f0aae090","instance":"assistant","turn":"cab01b31-ca46-4bb8-8b50-3b622e48a0c2","source":"@none","code":"baseline-unknown"} +usage: {"event":"usage-unknown","business":"acme","run":"r3c1832addd28","instance":"assistant","turn":"d1709124-2de4-48a6-917a-2ba06c83a13f","source":"@none","code":"baseline-unknown"} +✔ REQ-THREAD-2 REQ-LAUNCH-1 two sessions of one thread, and another thread's default, run at once, each with its own store and workspace; a restart of one resumes only that one (6792.898277ms) +usage: {"event":"usage-unknown","business":"acme","run":"r08d916564c1a","instance":"assistant","turn":"bc56fe19-2fd8-4a8b-81c7-441723dfe592","source":"@none","code":"baseline-unknown"} +✔ REQ-THREAD-2 REQ-LAUNCH-1 a legacy session resumes the thread's old store at the old in-sandbox cwd, in a workspace of its own (611.299089ms) +usage: {"event":"usage-unknown","business":"acme","run":"r60647d498531","instance":"assistant","turn":"2e5d07fb-64f4-4de5-9c9b-504e9b84e5d3","source":"@none","code":"baseline-unknown"} +✔ REQ-THREAD-2 REQ-LAUNCH-1 a live lock on a session workspace refuses session-workspace-busy before any checkout; a stale one is taken over (1711.359463ms) +usage: {"event":"usage-unknown","business":"acme","run":"r2914c8b4cdb8","instance":"assistant","turn":"c81e8471-d3e5-4307-b852-410c2946172d","source":"@none","code":"baseline-unknown"} +✔ REQ-THREAD-2 REQ-LAUNCH-1 a session start refuses legacy-run-live while an earlier host's sessionless run lives, and starts once it has exited (1736.737222ms) +✔ REQ-THREAD-2 REQ-LAUNCH-1 a symlinked session workspace root refuses session-workspace-unsafe and launches nothing (296.163626ms) +✔ REQ-THREAD-2 REQ-LAUNCH-1 a session workspace that holds the legacy workspace root refuses session-workspace-overlap and launches nothing (350.528848ms) +✔ REQ-THREAD-2 REQ-LAUNCH-1 a symlinked session store refuses thread-store-refused and makes no workspace (383.283291ms) +✔ REQ-THREAD-2 REQ-LAUNCH-1 a named session's start refuses processing-generation-changed, then processing-halted, after check() and before any spawn (592.005631ms) +✔ a copy carries every file the harness modules read from it (1279.139896ms) +✔ shared copy: npm ci, pushed reachability, readonly/existing copy, webui delegation (1108.303408ms) +✔ wrapper preserves Q81 lease and marker, rejects foreign/symlink; check uses effective roots (1445.010553ms) +✔ row 190 N6: check --instance passes only when the wrapper exports the instance's MOSAIC_CONFIG (1280.366581ms) +✔ bus unit copy/pm pins, install refuses all busy states and failed reads, drop-in refusal (1744.409649ms) +✔ missing package manifest refuses before npm; npm failure removes the unpublished temp copy (709.23638ms) +✔ real pinned install loads bus and Console; same-copy mosaic talk passes proof, other trees refuse (8905.287873ms) +✔ bus status reads effective copy/pm/drop-ins without writes; check refuses an overridden ExecStart (1278.524878ms) +✔ drop-ins in either override field and malformed metadata refuse; uninstall also checks --no-reload (733.056109ms) +✔ install never shows a template name on systemd 261; template drop-ins still refuse (639.08322ms) +✔ unlisted instance drop-in is found in another unit lookup directory; path discovery errors refuse (577.805579ms) +✔ inherited mosaic-.service.d override refuses without changing the unit (594.026082ms) +✔ inherited service.d override refuses without changing the unit (597.684633ms) +✔ inherited drop-in unreadable directory or file refuses before writing (463.253406ms) +✔ row 232: copy --bundle copies a SHA the bundle's refactor reaches, byte-identical to copy SHA, and refuses the rest (3259.382451ms) +✔ row 232: wrapper --create writes the first wrapper only, the same bytes wrapper ID writes, and refuses over any file (986.889835ms) +✔ row 232: check --units external reads the system units, the default reads the user units (911.390874ms) +✔ Vikunja 614: bundle and checkout copy leave an unreadable caller directory before find (1610.573807ms) +▶ T-I1 bootstrap --instance creates each instance's config, root and marker once, and refuses what it must not claim + ✔ alpha and beta get a 0700 config dir, a config naming ~/.mosaic-NAME, a 0700 root and a 0644 marker (127.307502ms) + ✔ under umask 077 the config and marker are 0600: the source honors the operator's umask (57.128365ms) + ✔ a second bootstrap of each changes no byte, mode or mtime (262.646366ms) + ✔ a non-empty root without its own marker refuses before anything is written, worktrees included (203.7906ms) + ✔ an empty existing root is claimed, and an existing config whose root lost its marker refuses, not repairs (102.543729ms) + ✔ a dangling symlink at the config path is never written through, named or default (99.18732ms) + ✔ bad names and stray arguments exit 4 and write nothing (773.946356ms) + ✔ --instance dev writes exactly what no flag writes (119.06942ms) +✔ T-I1 bootstrap --instance creates each instance's config, root and marker once, and refuses what it must not claim (1749.221522ms) +▶ T-I2 selection: the four rows of D1 through the instance op and through an entry point + ✔ row 1: no flag and no MOSAIC_CONFIG is the default; a missing default config leaves the data root empty (111.101701ms) + ✔ row 2: MOSAIC_CONFIG alone is that config with the default names (49.979962ms) + ✔ row 3: --instance NAME alone is NAME's config, root and suffix (104.01937ms) + ✔ row 4: both must name one file; a symlink to it agrees, any other file exits 4 (677.70635ms) + ✔ a named instance with no config exits 3 with its own bootstrap hint (49.320893ms) + ✔ an entry point takes --instance in any position, once, and refuses a mismatch before it prints (266.11778ms) + ✔ copy takes no --instance in either script: every instance shares the copies (27.056986ms) +✔ T-I2 selection: the four rows of D1 through the instance op and through an entry point (1399.537849ms) +▶ T-I7 claims: the instance op refuses a root another instance claims, and a named root with no marker + ✔ alpha's config pointing at beta's root refuses instance-root-mismatch in every op (228.998006ms) + ✔ MOSAIC_CONFIG naming alpha's config with no flag refuses: the root is alpha's (43.74151ms) + ✔ a default config whose root carries alpha's marker refuses; one naming dev, or none, passes (160.702265ms) + ✔ a named root whose marker is missing, a symlink, unparsable or the wrong shape refuses instance-root-unclaimed (391.245657ms) +✔ T-I7 claims: the instance op refuses a root another instance claims, and a named root with no marker (924.540458ms) +✔ T-I5 two real bus hosts, one per instance, run at once and each answers from its own socket under its own root (2253.01927ms) +✔ T-I10 the guard protects every instance's config dir and data roots, even under a corrupt config (179.402311ms) +✔ row 232: confirm, revert, gate, --to and --expect-from need --units external; the user-only flags are usage under it, and so are row 273's --send and --no-sso (1927.206947ms) +✔ row 232: pm-on and activate --pm-after-harness refuse external-pm (1840.246671ms) +✔ row 232: units-running (N4) refuses while a unit is active and leaves the store, the log and TAKEN; failed counts as down (4250.13986ms) +✔ row 232: activate stages: the pointer stays, AWAITING-UNITS names TO, a backup of the stopped store, no directory in the set, no --user, no journal (3007.61152ms) +✔ row 232: A3 order: capture-failed and marker-failed refuse with exit 3 and leave no marker or FAILED (2454.208044ms) +✔ row 232: confirm and revert refuse open-activation with no marker, two, the wrong copy, or one the log holds closed; refusals name no activation (4504.320214ms) +✔ row 232: confirm polls: bus status good after 3 s fails with --timeout 1, writes FAILED and leaves the rest; FAILED then refuses activation-failed (4202.808101ms) +✔ row 232: confirm polls to a pass with --timeout 10: the pointer, an ok line that reads as the started run, no marker (6275.973694ms) +✔ row 232: stale-start: @1792540799 fails a start floor of 1792540800 with stale-start (3200.82743ms) +✔ row 232: stale-start is a gate code: an enter time that turns to @1792540800 after 2 s passes with --timeout 10 (4676.405667ms) +✔ row 232: gate (N2, A2f): --since 1792540800 passes @1792540800 and fails @1792540799; it writes nothing (2962.926151ms) +✔ row 232: the external PM check reads launches list: one live run of launch.by since the start passes (10351.395235ms) +✔ row 232: revert puts the wrapper back and leaves the store when nothing migrated (1607.122627ms) +✔ row 232: confirm --rollback refuses rollback-mismatch, and logs rollback-failed with exit 2 when OLD fails its gate (3892.389847ms) +✔ row 232: confirm --rollback after a --restore swap logs rollbackCode not-attempted; rollback --restore finds an external backup (3544.492742ms) +✔ row 232: sequence 1: activate, confirm times out, revert, confirm --rollback --cause A5: gate-failed rollback ok (5110.225428ms) +✔ row 232: sequence 2: activate --migrate, the wrapper install fails, revert restores TAKEN, confirm --rollback --cause A3 (3045.270688ms) +✔ row 232: sequence 3: activate, root's A4 fails, revert, confirm --rollback --cause A4: failed code units-start (3026.876971ms) +✔ row 232: sequence 4: a capture failure leaves nothing open, then A2f's gate OLD writes nothing (2242.491106ms) +✔ row 232: sequence 5: a confirm of the wrong copy is refused, and revert and confirm --rollback still close the activation (3896.179986ms) +✔ row 232: sequence 6: a revert that fails leaves the activation open, and the next --plan refuses interrupted-run (1871.420629ms) +✔ row 232: sequence 7: adopt, two confirmed activates, rollback --to the previous copy, confirmed, logs op rollback (7422.294146ms) +✔ row 232: sequence 8: a migration that writes and fails: revert restores the backup byte for byte, confirm --rollback --cause A3 (3089.712691ms) +✔ row 232: user mode: every systemctl call carries --user, and activate, rollback and check make the base's calls (6671.685377ms) +✔ row 232: user mode: a default activate --plan prints the base's bytes (2346.01362ms) +✔ T1 adopt writes the pointer from the units once; a failing check refuses check-failed (2627.385385ms) +✔ T2 activate installs exactly the pointer's pm, claude and Console flags (4357.359308ms) +▶ T3 a hand-edited unit refuses unit-flags-drift, names the difference and changes nothing + ✔ pm (1746.749844ms) + ✔ claude (1456.360618ms) + ✔ console (1328.381972ms) +✔ T3 a hand-edited unit refuses unit-flags-drift, names the difference and changes nothing (4532.754311ms) +▶ T4 each item 3 refusal changes nothing and logs one line with its code + ✔ copy-missing (1099.209996ms) + ✔ copy-unreachable (1190.701918ms) + ✔ copy-schema-unknown (994.053861ms) + ✔ already-active (1092.692528ms) + ✔ instance-busy (another business active) (983.249814ms) + ✔ instance-busy (this business activating) (969.057055ms) + ✔ drop-in-override (1227.220358ms) + ✔ no-pointer (615.637558ms) +✔ T4 each item 3 refusal changes nothing and logs one line with its code (8173.994624ms) +✔ T5 an activate with no migration stops the Console then the bus, installs, starts the bus then the Console (2492.088453ms) +✔ T6 a migration without --migrate rolls back with migration-needs-flag (2313.388479ms) +✔ T7 --migrate takes the backup before the migration runs (2561.025461ms) +✔ T8 a failed migration restores the backup and keeps the store it replaced (2216.487823ms) +✔ T9 a store outside the target's chain rolls back with store-newer (1902.371379ms) +▶ T10 each gate check failing alone rolls back and puts every file back + ✔ units-inactive (5534.27593ms) + ✔ bus-status (4779.329939ms) + ✔ healthz (5153.869107ms) + ✔ copy-check (5422.191321ms) + ✔ pm-launch-unconfirmed (5567.042852ms) +✔ T10 each gate check failing alone rolls back and puts every file back (26457.784978ms) +▶ T10b the PM check needs exactly one launched line for a live run of this start + ✔ no launched line (5528.631389ms) + ✔ two lines (6573.476585ms) + ✔ a changed word (5886.987962ms) + ✔ run not in launches list (5450.916884ms) + ✔ run started before the start (5412.807502ms) + ✔ a human launch with no journal line (5280.749751ms) + ✔ run for another business (5442.833498ms) + ✔ run not live (5352.151718ms) + ✔ one well-formed line and a live run pass (2198.858385ms) +✔ T10b the PM check needs exactly one launched line for a live run of this start (47129.002506ms) +✔ T11 a rollback whose gate fails too: rollback-failed, exit 2, both units stopped, no retry (7220.510414ms) +✔ T12 rollback takes the previous copy from the log (3211.013795ms) +✔ T13 a rollback across a migration needs --restore, then restores and goes live (3866.352258ms) +✔ T14 events written after the backup need --events N with the right N (4270.765888ms) +✔ T14b a rollback --restore whose gate fails stops both units and skips item 6 (5684.104647ms) +✔ T14c a rollback without --restore whose gate fails runs item 6 (7126.094671ms) +✔ T15 --plan names the migration and the restore and changes nothing (2544.188219ms) +✔ T26 --plan lists the commits an activate adds, after the migration lines (1354.218066ms) +✔ T27 --plan names each migration step, or says the steps cannot be read (1047.895537ms) +✔ T25 --plan refuses copies-unrelated when neither copy is an ancestor of the other (463.734572ms) +▶ T23 --plan reads the store without changing a file, stopped or held + ✔ stopped store (593.504474ms) + ✔ held store (589.873547ms) +✔ T23 --plan reads the store without changing a file, stopped or held (1183.887446ms) +✔ T24 business-mismatch and capture-failed refuse with exit 3; a short id is a usage error (1321.078991ms) +✔ T16 status prints the pointer, the log, the check, bus status and drift, and writes nothing (854.119591ms) +✔ T19 a started line with no final line: status shows it and every changing verb refuses (1186.164191ms) +✔ T20 a held run lock refuses run-locked without a log line; status and --plan still run (1281.154742ms) +✔ T21 a bus unit with no MOSAIC_CLAUDE_BIN: adopt and activate refuse no-claude-pin (1388.718533ms) +▶ T22 the stopped store read: a -wal or -shm refuses store-unclean and is left alone; a clean read adds no file + ✔ bus.sqlite-wal (1702.865519ms) + ✔ bus.sqlite-shm (1755.799093ms) + ✔ clean (1880.991056ms) +✔ T22 the stopped store read: a -wal or -shm refuses store-unclean and is left alone; a clean read adds no file (5340.301479ms) +▶ T28 a unit path, drop-in directory or drop-in file that cannot be read, or a relative unit path, refuses drop-in-override before any stop + ✔ unit path (781.394747ms) + ✔ drop-in directory (766.696529ms) + ✔ drop-in file (792.41388ms) + ✔ relative unit path (780.455934ms) +✔ T28 a unit path, drop-in directory or drop-in file that cannot be read, or a relative unit path, refuses drop-in-override before any stop (3121.758137ms) +▶ T29 a bus that stops during the held-store read: --plan says so, rollback --restore refuses restore-mismatch + ✔ --plan (826.194634ms) + ✔ rollback --restore (2293.503064ms) +✔ T29 a bus that stops during the held-store read: --plan says so, rollback --restore refuses restore-mismatch (3120.22566ms) +✔ T30 a copy check that agrees on another copy fails the gate with copy-check and rolls back (5833.257884ms) +▶ T31 a quoted or escaped Environment= or ExecStart= is unreadable: refusals by name, nothing read from /a + ✔ Environment double quotes (1731.900574ms) + ✔ Environment single quotes (1730.31489ms) + ✔ Environment backslash (1754.086956ms) + ✔ ExecStart quotes (1687.781516ms) + ✔ Console ExecStart quotes (1740.866296ms) +✔ T31 a quoted or escaped Environment= or ExecStart= is unreadable: refusals by name, nothing read from /a (8645.984059ms) +▶ T32 item 1: --pm-after-harness refuses a target without harness or a file that sets it, and passes without the PM + ✔ usage: not with --pm, and only for activate (674.093735ms) + ✔ pm-after-harness-target (941.055459ms) + ✔ pm-after-harness-set (1277.306189ms) + ✔ a pointer without pm (848.108627ms) + ✔ phase 1 installs without --pm, skips pm_launched and writes the pending pointer (1934.325717ms) +✔ T32 item 1: --pm-after-harness refuses a target without harness or a file that sets it, and passes without the PM (5675.852559ms) +▶ T33 item 2: read_pointer takes pmPending only as true beside pm false; a pending pointer refuses activate and shows in status + ✔ read_pointer (1543.37235ms) + ✔ pm-pending, already-adopted and the status line (2806.381482ms) +✔ T33 item 2: read_pointer takes pmPending only as true beside pm false; a pending pointer refuses activate and shows in status (4350.248824ms) +▶ T34 item 3: pm-on refuses before any stop, passes with the PM, or puts the phase-1 bus back + ✔ not-pending (734.227266ms) + ✔ harness-unset (2375.282265ms) + ✔ a launched line passes: the bus alone restarts with --pm (3316.814656ms) + ✔ a failed pm_launched puts the phase-1 unit back: exit 1, still pending (6064.108073ms) + ✔ a failed phase-1 gate too: pm-on-down, exit 2, both units stopped (10309.352795ms) +✔ T34 item 3: pm-on refuses before any stop, passes with the PM, or puts the phase-1 bus back (22800.812946ms) +▶ T35 item 4: rollback from pending installs --pm; a plug-in kind the target lacks refuses by name + ✔ rollback from pending gates pm_launched on the old copy (3275.653734ms) + ✔ after the harness set, rollback refuses until harness is gone (4576.184079ms) + ✔ activate names every kind the target lacks (1155.637541ms) +✔ T35 item 4: rollback from pending installs --pm; a plug-in kind the target lacks refuses by name (9008.093609ms) +✔ T36 --plan shows the pending state and lists the row 169 refusals it can see (3321.730807ms) +✔ T37 tester-port activate writes pointer and unit, replaces the port, and supported re-pin and rollback keep it (6208.468173ms) +✔ T38 tester-port rollback to unsupported target drops flag in plan, steps, unit and pointer (3360.197677ms) +✔ T39 tester-port explicit unsupported target reads target copy and refuses before stopping either unit (720.856301ms) +✔ T40 tester-port invalid values refuse exit 4 before stopping, including tunnel and main ports (750.234221ms) +✔ T41 tester-port inherited activate to unsupported target drops it and retains drift refusal and failed-run recovery (7980.241258ms) +✔ T42 tester-port pm-on preserves pointer Console flags (3023.049007ms) +▶ T43 row 180 item 1: runs in one second get distinct activation ids, rollback sets and post-attempt stores + ✔ activate then pm-on on the same copy (3015.219864ms) + ✔ two restores: an old-form id and a suffixed one, each with its own post-attempt store (6075.015624ms) + ✔ adopt takes the next free id too (598.747596ms) + ✔ all ten names taken: capture-failed before anything stops, and the log line names no activation (903.083054ms) + ✔ --restore takes an id with or without -1 to -9 and nothing else (929.061542ms) +✔ T43 row 180 item 1: runs in one second get distinct activation ids, rollback sets and post-attempt stores (11522.159885ms) +▶ T44 row 180 item 2: --plan lists tester-port-invalid and tester-port-target with its other refusals + ✔ a bad tester port (2003.991552ms) + ✔ without --plan a bad port is usage before any pointer read (343.356299ms) + ✔ a target Console without --tester-port (936.59421ms) +✔ T44 row 180 item 2: --plan lists tester-port-invalid and tester-port-target with its other refusals (3284.578233ms) +▶ T45 row 181 items 2 and 3: the restore guard counts events and every COUNTED table + ✔ both modes count events and each listed table, and a table the store lacks counts 0 (1066.405247ms) + ✔ one instance_names row and no event refuses before any stop; --events 1 restores (4129.391043ms) + ✔ one usage_records row and no event refuses before any stop; --events 1 restores (4166.295753ms) + ✔ a listed table that cannot be read refuses restore-mismatch before any stop (2319.592709ms) + ✔ the in-run recount counts the listed tables too (3162.271875ms) +✔ T45 row 181 items 2 and 3: the restore guard counts events and every COUNTED table (14844.879084ms) +✔ T46 row 181 item 4: every table in the bus schema is in exactly one of four lists (3.788354ms) +✔ T47 row 185 test 1: a same-schema activate leaves a whole backup and the log line names it (1849.977655ms) +✔ T48 row 185 test 2: a gate failure on a same-schema activate rolls back without a restore (5826.335315ms) +▶ T49 row 185 test 3: a same-schema rollback --restore restores, or refuses rows written after STAMP + ✔ no rows after STAMP: restores and goes live (3333.380208ms) + ✔ one instance_names row after STAMP refuses post-backup-events; --events 1 restores (3768.625419ms) +✔ T49 row 185 test 3: a same-schema rollback --restore restores, or refuses rows written after STAMP (7102.554129ms) +✔ T50 row 185 test 4: activate --plan prints the backup line and writes nothing (2425.869547ms) +✔ T51 row 185 test 5: an activate with no store file takes no backup (2008.011778ms) +▶ T52 row 186: the activate plan's backup line says what the run will do + ✔ same schema (2131.850425ms) + ✔ same schema with --migrate (2120.283372ms) + ✔ in chain with --migrate (2189.593982ms) + ✔ in chain without --migrate (1944.068667ms) + ✔ outside the chain (1944.935511ms) + ✔ outside the chain with --migrate (1979.222104ms) +✔ T52 row 186: the activate plan's backup line says what the run will do (12311.013514ms) +✔ T178 proxy proof header and path survive re-pin and rollback unchanged in the pointer and unit (3151.921143ms) +✔ T178 proxy proof pair survives a tester-port replacement as well (1888.632372ms) +▶ T53 row 187: activate sets, carries and drops the proof pair + ✔ tests 1 and 9: the pair goes after the preview flags, before --send and the kept --tester-port, as the unit renders it; a new pair replaces it (5410.905289ms) + ✔ tests 2 and 3: an activate of the live copy writes the pair; a later activate and a rollback carry it (4990.187253ms) + ✔ test 2: only a pair change may name the live copy; the log keeps from and to, and rollback still goes to the earlier copy (6545.94529ms) + ✔ test 2: a live-copy activate says only the Console flags change, and backs up the stopped store before it installs (3965.336359ms) + ✔ test 3: pm-on keeps the pair (2976.737644ms) + ✔ test 4: --no-proof drops the pair from the pointer and the unit and says so; with no pair it says so and passes (5530.489338ms) + ✔ test 5: each refusal exits 3 before anything stops (3778.33529ms) + ✔ tests 5 and 9: --plan lists every proof refusal with the others and writes nothing (848.583793ms) + ✔ test 6: usage errors (814.820879ms) + ✔ test 7: a rollback to a copy without proof support drops the pair and says so (3385.469638ms) + ✔ test 7: an activate to a copy without proof support refuses proof-target without --no-proof and passes with it (3775.020345ms) +✔ T53 row 187: activate sets, carries and drops the proof pair (42023.764147ms) +▶ T54 row 188: a carried pair gets the proof file checks, and a proof file inside the repository refuses + ✔ test 1: an activate that carries the pair refuses after chmod 644, in the plan and the run, before anything stops (2347.234017ms) + ✔ test 1: an activate that carries the pair refuses after a symlink to a mode-600 file, in the plan and the run, before anything stops (2384.801415ms) + ✔ test 1: an activate that carries the pair refuses after removal, in the plan and the run, before anything stops (2406.236568ms) + ✔ test 2: a rollback that carries the pair refuses after chmod 644, in the plan and the run, before anything stops (2419.512958ms) + ✔ test 3: a proof file inside the repository refuses, in the plan and the run, before anything stops (1031.011433ms) + ✔ test 4: a path outside the repository through a directory symlink into it refuses on its realpath (1032.956013ms) +✔ T54 row 188: a carried pair gets the proof file checks, and a proof file inside the repository refuses (11622.868365ms) +▶ T55 row 189: activate --no-send drops --send, and rollback and pm-on carry it off + ✔ test 1: a live-copy --no-send drops --send from the pointer and the unit, keeps the rest in order, logs the step and backs up the stopped store (2128.340302ms) + ✔ test 2: a plain live-copy activate still refuses already-active, and so does --no-send once --send is gone (3180.477572ms) + ✔ test 3: --plan prints one send: line in each case, with the live-copy note on a same-copy run (4705.751778ms) + ✔ test 4: after --no-send, a rollback to the earlier copy leaves --send out of the pointer and the unit (3465.907677ms) + ✔ test 4: pm-on after --no-send keeps --send off (3235.290924ms) + ✔ test 5: --no-send on rollback, pm-on, status, adopt or rehearse is a usage error (660.250872ms) + ✔ test 6: with both a pair and --send in the pointer, --no-send and --no-proof each drop what they name and keep the rest (10999.901697ms) +✔ T55 row 189: activate --no-send drops --send, and rollback and pm-on carry it off (28377.197636ms) +▶ T57 row 200: activate --sso, its refusals before any stop, and the rollback to a Console without --sso + ✔ item 1: --sso drops the preview set and the pair, puts --sso before --send and the tester port, and the plan names what it drops and carries (4188.956149ms) + ✔ item 1: --sso may re-pin the live copy once; later activates carry it; --no-send still drops --send (10077.481557ms) + ✔ item 1: --sso with a pair or --no-proof, or on any verb but activate, is a usage error (917.469083ms) + ✔ item 2: a target without --sso, a missing or bad console.sso, and each slot problem refuse before any stop (6277.910031ms) + ✔ item 3: a config whose console key the target loader refuses stops an activate or a rollback before any stop, naming the first step (4459.553989ms) + ✔ row 203: a config whose federation key the target loader refuses stops an activate or a rollback before any stop, naming the first step (3742.561407ms) + ✔ item 3: a rollback from --sso to a Console without it takes the flags from the set of the activation onto the copy, past a same-copy re-pin (sage-1389) (11324.174643ms) + ✔ item 3: a rollback set that is missing, fails its sums, holds no argv or already ran --sso refuses sso-rollback-flags (4438.16199ms) + ✔ round 2 (webby-0028 N1): run through a symlinked repository path, a slot or a proof file inside the repository still refuses (2267.689558ms) + ✔ round 2 (webby-0028 N2): a config.json that does not parse stops the run before anything is read or stopped (2045.604552ms) + ✔ round 3 (sage-1556): a named instance turns --sso on with its own config, slot and Console unit, and rolls back from its own set (4303.002981ms) + ✔ row 238 (#1744): on a named instance the sso-config first step names --instance NAME in both commands (1037.05743ms) +✔ T57 row 200: activate --sso, its refusals before any stop, and the rollback to a Console without --sso (55081.903678ms) +▶ T58 row 273: activate --send and --no-sso + ✔ T1: --sso --send turns send on after --sso and before the tester port, and the plan says so (2687.414025ms) + ✔ T1: --send beside a carried --sso re-pins the live copy once, and the plan names the carried --sso (4258.718434ms) + ✔ T2: --send without --sso, given or carried, refuses before any stop, and --plan lists it (1923.166507ms) + ✔ T2 (sage-2315 B1): a rollback from an --sso --send pointer to a Console without --sso ends with neither flag (3787.620953ms) + ✔ T2 and T4: --send with --no-send, --no-sso with --sso, --send, a pair or --no-proof, and either flag on another verb, is a usage error (2237.601326ms) + ✔ T3: --no-sso on the same copy returns the unit and the pointer to the flags from before --sso, without --send (5326.697125ms) + ✔ T3: the set walk passes later re-pins that ran with --sso, and the tester follows the pointer (5196.296216ms) + ✔ T3 (sage-2305 a): after --sso, two later re-pins that carry it, then --no-sso restores the flags from before --sso byte for byte (7938.052703ms) + ✔ T4 (sage-2305 b): a log in which every set holds a Console with --sso refuses before any unit stops (3824.257483ms) + ✔ T4: --no-sso refuses before any stop on a pointer without --sso, a tampered or missing set, a set that ran with --sso, an ok line with no activation, and a log with no set (5652.200119ms) +✔ T58 row 273: activate --send and --no-sso (42833.896917ms) +✔ R1 rehearse passes on the same schema; the scratch root holds its files and the live files stay byte-identical (2446.274632ms) +✔ R2 rehearse runs the migration checks when the schema differs; the live store stays at 3g (2553.980547ms) +✔ R3 a failing migration gives REHEARSAL_FAIL migrate and starts nothing (371.346673ms) +✔ R4 a host that does not start, does not answer status, reports another pid, launches anyway, makes a launches directory or keeps its lock each fails by name (18494.228716ms) +✔ R5 a host that ignores SIGTERM gets SIGKILL and FAIL host-stopped (3444.731409ms) +✔ R6 a Console that does not answer /healthz gives REHEARSAL_FAIL healthz (4628.35147ms) +✔ R7 a host on another copy fails copy-match (4632.46826ms) +✔ R8 a scratch port in use or reserved refuses, and the rehearsal takes no other port (492.027738ms) +✔ R9 mos-0963: a role reference left outside placeholders/, or left on an env variable, fails credential-ref-live before the host starts (709.51728ms) +✔ R10 mos-0962: a scratch business that still sets a tracker fails tracker-configured (355.056199ms) +✔ R11 mos-0961: a scratch config on the live data root or on any root but the scratch one, or a sessions.json naming a running pid, refuses by name (1379.93757ms) +✔ R12 mos-0962: a notifier config with a binding fails notify-off (352.045398ms) +✔ R13 the pre-checks: an old copy, a backup that fails its sums, a missing backup or pointer, and usage (481.431781ms) +✔ R14 a host that writes the live config, the live business file or the backup fails the end check by name (7260.942229ms) +✔ R15 a rehearsal stopped by TERM, INT or HUP fails signal and still stops the host and Console and runs the end checks (7963.832357ms) +✔ row 233: --backup last takes the newest backup the log records; a later line with backup null does not hide it, and the store line names it (2459.681713ms) +✔ row 233: --backup last with no backup in the log, or no log, exits 3 with no-backup and makes no rehearsal directory (206.10946ms) +✔ row 233: --backup last refuses a newest backup that is not an activation id, with exit 1 (122.746077ms) +▶ T56 row 190: named instances side by side on one unit directory, $BIN and set of stand-ins + ✔ T-I3 each instance renders its own config, session env and Description, and nothing of another (1521.134221ms) + ✔ T-I4 a Console port another installed Console takes refuses port-claimed, and a named instance keeps off the default ports (1995.429401ms) + ✔ T-I6 alpha's activate and rollback reach nothing of beta's (4010.159471ms) + ✔ T-I6 swapped: beta's reach nothing of alpha's (4070.637339ms) + ✔ T-I7 MOSAIC_CONFIG naming alpha's config with no flag refuses instance-root-mismatch and changes nothing (674.288503ms) + ✔ T-I9 another instance's bus active refuses nothing; one of this instance's does (6063.089882ms) +✔ T56 row 190: named instances side by side on one unit directory, $BIN and set of stand-ins (18336.063295ms) +✔ row196 explicit socket conversion refuses inherited TCP before stop and rollback disables socket (5920.496834ms) +✔ row196 SSO socket conversion pins pointer and unit argv order without send (2323.23531ms) +▶ row196 interpreter activation checks receipt, identity, plan and startup log + ✔ plan and started log preserve the same interpreter JSON (2234.857014ms) + ✔ interpreter-receipt-refuse fails at the gate and restores the pointer (3337.224617ms) + ✔ interpreter-drift fails at the gate and restores the pointer (3370.296561ms) + ✔ missing-verifier refuses before any start or stop (1019.673808ms) + ✔ interpreter-unsafe refuses before any start or stop (1069.999208ms) +✔ row196 interpreter activation checks receipt, identity, plan and startup log (11033.501649ms) +▶ row196 rehearsal selects socket only for marked copies and uses scratch dataRoot + ✔ socket copy (2435.468977ms) + ✔ legacy copy (2423.522656ms) +✔ row196 rehearsal selects socket only for marked copies and uses scratch dataRoot (4859.606668ms) +✔ config-any-key: a non-console target refusal stops activate and rollback before any stop (2800.738349ms) +✔ config-any-key: a pre-270 target refuses each row 270 key on a full activate and rollback, naming the key (4542.093406ms) +✔ config-any-key: accepting loaders run validate with the selected config on activate and rollback (3137.126748ms) +✔ config-any-key: missing-loader copies accept only the four oldest keys (128.613899ms) +✔ config-any-key: missing config passes but malformed JSON refuses without calling the loader (48.747704ms) +✔ row 233: sequence 1: confirm fails healthz, the driver reverts, renders the old copy and confirm --rollback --cause A5 passes: exit 1 (10744.117213ms) +✔ row 233: sequence 2: activate --migrate fails at the wrapper, revert restores the store, confirm --rollback --cause A3: exit 1 (4830.611004ms) +✔ row 233: sequence 3: root's render of the new copy fails, the driver rolls back with --cause A4, and holds the lock to the end: exit 1 (4436.055179ms) +✔ row 233: sequence 4: a capture failure is exit 3 from the stage, and A2f restarts the old units and gates them: exit 1 (3171.597923ms) +✔ row 233: N1: a bus that outlives A2's timeout keeps its old start, so A2f's gate fails stale-start: exit 2, both units stopped (8744.641104ms) +✔ row 233: sequence 5: confirm of the wrong copy is refused, and the driver rolls back with --cause A5: exit 1 (4257.726117ms) +✔ row 233: sequence 6: a revert that fails stops both units at exit 2, and the next run refuses at its --plan with nothing stopped (3200.045774ms) +✔ row 233: sequence 7: two upgrades and a rollback --to the previous copy with --restore, the args file following each confirm (8773.905301ms) +✔ row 240: I3 N1: a failed args move after A5 exits 5 args-failed, the new copy live and confirmed and both args files kept (3326.699363ms) +✔ row 233: sequence 8: a migration that writes and fails: the driver reverts to the backup byte for byte, --cause A3: exit 1 (3819.863294ms) +✔ row 233: a second run while the lock is held refuses upgrade-running with one log line and no call (760.662777ms) +✔ row 233: A1 refuses open-activation on any AWAITING-UNITS file, through the stack's user's --plan, with nothing stopped (1295.61894ms) +✔ row 233: a target that migrates refuses migrate-required without --migrate, with nothing stopped (1300.942252ms) +✔ row 233: the rehearsal runs after the plan and before A2; a failed one refuses rehearsal-failed with nothing stopped (1295.497417ms) +✔ row 233: the rehearsal's BACKUP_STORE line goes to the step log after a match, a malformed one as none, the rest of its output never (3241.951192ms) +✔ row 233: a real rehearsal with no backup in the log refuses no-backup, and goes on only with --no-rehearsal, which logs the skip (3858.557292ms) +✔ row 233: a real rehearsal after an upgrade names the log's newest backup; --no-rehearsal with a backup refuses rehearsal-required (4862.627701ms) +✔ row 233: the args file must be the running user's, with no group or other write, one --copy, and the copy the units run (992.071285ms) +✔ row 233: hostcheck (row 240): a nonzero --check or a missing file refuses profile-drift before the plan (1224.343143ms) +✔ row 233: the checkout must be at --sha (head-mismatch), and a commit the clone can't fast-forward to refuses fetch-failed (1120.291149ms) +✔ row 233: usage exits 4 before any log or lock (762.648994ms) +✔ tester HTTP helper uses instance socket, logical origin and JSON without retrying (29.028379ms) +✔ tester HTTP timeout closes the socket and does not retry (28.948281ms) +organization: {"event":"reload-needs-restart","business":"acme"} +✔ row 175: each read with --tester inside an agent prints the human form's output, and refuses without --tester (178.801702ms) +✔ row 175: --tester on limits set, reset and migrate and every write form outside W1-W7 exits 4 before any call (71.650743ms) +✔ row 175: scripts/mosaic sends plugins, name, names, follow, threads and thread to packages/cli, not the seat CLI (1014.754512ms) +✔ row 175 W7: project init --tester makes the repository under the project area, committed by tester (834.141652ms) +✔ row 175 W7: a repo outside the project area refuses tester-project-area before any bus call, and nothing changes (382.740801ms) +✔ row 175 W7: the tester bind refuses tester-off and tester-required before any directory (2309.758551ms) +✔ row 184: with --tester, thread create, threads, open, talk --thread and read run on the tester's own thread (114.16663ms) +organization: {"event":"reload-needs-restart","business":"acme"} +✔ row 184: talk --thread --follow and follow --thread with --tester print and read only that thread's messages, from message.receive (183.704602ms) +✔ row 184: with --tester a human thread refuses with the bus's code, and nothing is written (97.681324ms) +✔ row 184: without --tester the thread verbs stay the human's and never call the tester transport (68.378852ms) +✔ row 184: scripts/mosaic runs thread create, threads, talk --thread and thread read as the tester through tester-cli.mjs (4598.633373ms) +✔ talk --tester sends a message as tester from inside an agent and prints the role's reply (53.675041ms) +✔ talk --tester sends text with no prefix, and follow --tester reads (32.540881ms) +✔ the read verbs take --tester inside an agent, and the trail shows the tester as the sender (42.322622ms) +✔ decide, stop and launches take no --tester (34.634903ms) +✔ the tester transport runs tester-cli.mjs, and the tester's refusals exit 3 (0.60575ms) +✔ with no stand-in transport, --tester runs tester-cli.mjs on the data root's socket (0.979526ms) +✔ agents --tester makes one call; the human's agents also reads thread.claims, and --json is the agents array (43.556177ms) +✔ a refused thread.claims still prints the role rows and the refusal's code (33.465927ms) +✔ a thread.claims error without a bus code still throws and prints nothing (28.839835ms) +✔ talk --tester to a stopped role exits 3, prints no sent line and stores nothing (26.403152ms) +✔ only a --tester send refused tester-target-not-running is rewritten (30.040631ms) +✔ REQ-CLI-1 project create and list work on the bus record and refuse what the broker refuses (62.501781ms) +✔ REQ-CLI-1 thread create, list, open and read (124.590115ms) +✔ REQ-CLI-1 thread read pages through every message, oldest first (758.685818ms) +✔ REQ-CLI-1 the business needs exactly one threaded instance to create a thread (71.967951ms) +✔ REQ-CLI-1 a thread is its id, an id prefix of 8 characters or more, or /; anything else is refused before any write (106.944631ms) +✔ REQ-CLI-2 REQ-THREAD-2 talk --thread sends to the thread and prints only the reply to it; the rest stays unread (72.760298ms) +✔ REQ-CLI-2 talk --thread --wait gives up with exit 1 and leaves the thread's messages unread (1086.946679ms) +✔ REQ-CLI-2 talk --thread --follow and follow --thread print and read only that thread's messages (182.720215ms) +✔ REQ-CLI-2 plain talk to the assistant asks for a thread and exits 2 without a write (54.987652ms) +✔ REQ-USER-2 a thread of another user is refused for talk, open, read and follow, and nothing is written (126.296463ms) +✔ REQ-CLI-1 the new verbs refuse inside an agent run, as every human verb does (33.543671ms) +usage: {"event":"usage-unknown","business":"acme","run":"r8fa3c6216772","instance":"assistant","turn":"28b960af-44b6-4be1-805e-25479ad51569","source":"@none","code":"baseline-unknown"} +usage: {"event":"usage-unknown","business":"acme","run":"r3060bf55c601","instance":"assistant","turn":"17587972-800c-4be7-a4a3-7222695dae0d","source":"@none","code":"baseline-unknown"} +usage: {"event":"usage-unknown","business":"acme","run":"ra24f33448c25","instance":"assistant","turn":"ea458168-9749-449f-9a35-f190c6c183a7","source":"@none","code":"baseline-unknown"} +usage: {"event":"usage-unknown","business":"acme","run":"rfcb7b8af4232","instance":"assistant","turn":"1c13b4ba-0114-469a-8488-847e546574cf","source":"@none","code":"baseline-unknown"} +✔ REQ-THREAD-2 REQ-LAUNCH-1 REQ-MSG-1 a thread message starts the thread's session, which stops when idle; its history survives the stop and a restart and no other thread sees it (6893.09501ms) +usage: {"event":"usage-unknown","business":"acme","run":"r751707f17d9a","instance":"assistant","turn":"2bbb4f6b-4e77-4be5-ada7-b09879af112f","source":"@none","code":"baseline-unknown"} +usage: {"event":"usage-unknown","business":"acme","run":"r5c34d6a681b7","instance":"assistant","turn":"ac72ec84-5536-4416-b131-c581879958fc","source":"@none","code":"baseline-unknown"} +✔ REQ-THREAD-2 REQ-LAUNCH-1 a running thread counts against its model's limit and an idle-stopped one doesn't (2049.572888ms) +usage: {"event":"usage-unknown","business":"acme","run":"r5875d0cc9f67","instance":"assistant","turn":"82fd685d-f268-45b2-9310-8823bc748d5c","source":"@none","code":"baseline-unknown"} +✔ REQ-THREAD-2 REQ-LAUNCH-1 a turn longer than the idle time isn't stopped, and the thread idles out after it (4569.042873ms) +usage: {"event":"usage-unknown","business":"acme","run":"re86476eb05e9","instance":"assistant","turn":"f7f92713-c84a-4c24-9ac7-237ed94f93b6","source":"@none","code":"baseline-unknown"} +usage: {"event":"usage-unknown","business":"acme","run":"re86476eb05e9","instance":"assistant","turn":"7615fcdb-a992-4e84-979b-6a235869206c","source":"@none","code":"baseline-unknown"} +✔ REQ-THREAD-2 REQ-LAUNCH-1 a message sent after the idle snapshot keeps the session, which answers it (2954.839412ms) +✔ REQ-ROLE-2 REQ-LAUNCH-1 a thread held by a run the launcher didn't start gets no second session (209.17701ms) +usage: {"event":"usage-unknown","business":"acme","run":"r2751fa41d017","instance":"assistant","turn":"ae4e3a84-c2df-4a97-8217-8d4631b90851","source":"@none","code":"baseline-unknown"} +✔ REQ-LAUNCH-1 a thread run's session file has no landing, even when landHolders names its instance (620.168039ms) +✔ REQ-LAUNCH-1 a run that ends without taking its thread's message isn't started again for that message (395.966665ms) +✔ REQ-THREAD-2 REQ-LAUNCH-1 a thread id that isn't a safe segment, or a thread of a non-thread instance, launches nothing (324.529131ms) +✔ REQ-THREAD-1 REQ-LAUNCH-1 the chief can't launch the assistant outside a thread (138.724109ms) +✔ C2-09a: fromSession refuses a creative instance outside a thread without a sandbox (140.42557ms) +limits: {"event":"limit-reached","business":"acme","check":"token-limit","export":"mayLaunch","subject":{"instance":"assistant","provider":"zai","model":"claude-sonnet-5-5","account":null},"path":["tokens","instances","assistant"],"limit":0,"count":0,"unknownTurns":0} +limits: {"event":"limit-reached","business":"acme","check":"token-limit","export":"mayLaunch","subject":{"instance":"assistant","provider":"zai","model":"claude-sonnet-5-5","account":null},"path":["tokens","instances","assistant"],"limit":0,"count":0,"unknownTurns":0} +✔ REQ-LIMIT-3 REQ-LIMIT-4 a thread start whose instance is at its token limit is refused, logged once with the limit and the count (265.133526ms) +usage: {"event":"usage-unknown","business":"acme","run":"ra114a0334b1d","instance":"assistant","turn":"5a6ce340-167f-4a24-84ca-4ef6ed497091","source":"@none","code":"baseline-unknown"} +limits: {"event":"limit-reached","business":"acme","check":"token-limit","export":"mustStop","subject":{"instance":"assistant","provider":"zai","model":"claude-sonnet-5-5","account":null},"path":["tokens","instances","assistant"],"limit":0,"count":0,"unknownTurns":1} +✔ REQ-LIMIT-4 a thread run at its token limit stops at the end of its turn: the reply lands, and the end record names the limit (633.344088ms) +usage: {"event":"usage-unknown","business":"acme","run":"r64f570d65f4d","instance":"bean","turn":"b3a52c6d-b29f-4f4c-bccf-10baa7c45bbc","source":"@none","code":"baseline-unknown"} +usage: {"event":"usage-unknown","business":"acme","run":"r5474ce026528","instance":"chet","turn":"f145d8b9-ea86-43d2-9ac0-d886b0a40fff","source":"@none","code":"baseline-unknown"} +usage: {"event":"usage-unknown","business":"acme","run":"r64f570d65f4d","instance":"bean","turn":"e2b62203-1b00-41c4-81c0-81787795b9e1","source":"@none","code":"baseline-unknown"} +✔ C2-09a: creative thread messages start distinct runs and keep each instance history separate (1170.44975ms) +usage: {"event":"usage-unknown","business":"acme","run":"r037e79959266","instance":"bean","turn":"d4716028-dde5-406a-b1ee-48b28e3ffec3","source":"@none","code":"baseline-unknown"} +usage: {"event":"usage-unknown","business":"acme","run":"r6eb01d356939","instance":"bean","turn":"4f6c92bd-e018-4c41-8eb5-6599cad39c7a","source":"@none","code":"baseline-unknown"} +✔ C2-09a: terminating one creative thread does not signal an unselected peer of the same instance (875.942861ms) +✔ REQ-LAUNCH-1 R4: a pending message on a revoked thread starts no run after a launcher restart (348.762742ms) +usage: {"event":"usage-unknown","business":"acme","run":"rd485e510574a","instance":"assistant","turn":"c45e8ef6-d43f-4342-b4d7-c863f0fe0d7b","source":"@none","code":"baseline-unknown"} +✔ REQ-LAUNCH-1 R4: a running thread's run gets SIGTERM at the first tick after the hand edit, with no idle check (619.27231ms) +✔ REQ-LAUNCH-1 R4 D1: recover() rebinds an earlier host's run on a revoked thread and ends it, which ends its claim (330.042686ms) +✔ C2-04: a library-only business with tracker.baseUrl boots without a project tracker (501.663009ms) +task.close {} answered: invalid-request; fake saw 18 requests, first GET /info 200, GET /projects/1 200, GET /projects/1/views 200 +task.close on a missing task answered: task-not-found; it made GET /tasks/999 404 +✔ bootConfig trackers reach the S3 adapter in the real broker child, which goes ready against a fake Vikunja (697.909618ms) +✔ the transport writes {business, verb, args} to the child and reads its JSON (48.7509ms) +✔ a bus code on stderr becomes the exit code; garbage and timeouts are outcome problems (2273.840301ms) +✔ busExit and refuseInsideAgent (0.802887ms) +✔ REQ-LIMIT-4 mosaic usage shows each token kind and unknown turns beside every total (115.849703ms) +✔ usage is dispatched by scripts/mosaic and the shared read adapter (172.870048ms) +✔ talk sends a REQUEST, prints and reads only the reply to it, and leaves other messages unread (102.766971ms) +✔ talk --wait 0 only sends; no reply within --wait exits 1 and says where it will show (1043.568877ms) +✔ a late reply the Console has listed stays unread for mosaic inbox, and the next talk skips it (2070.972372ms) +✔ talk says when the role isn't running, whether launch.by was told, and how to start launch.by (54.489478ms) +✔ talk to a role launch.by can't launch says it isn't in the launch block (27.746535ms) +✔ talk to a stopped role prints the waiting line once, skips a non-reply and prints the reply (58.41519ms) +✔ talk, stop and launches off/on refuse inside an agent run; bad arguments are usage errors (25.677798ms) +✔ launches off and on go to the broker and change the business's launch state (27.888887ms) +✔ launches list reads sessions.json and marks a stale entry; stop reports it and refuses a non-runner (29.471234ms) +ℹ tests 988 +ℹ suites 0 +ℹ pass 988 +ℹ fail 0 +ℹ cancelled 0 +ℹ skipped 0 +ℹ todo 0 +ℹ duration_ms 617644.001521 diff --git a/agents/beakley/work/queue-217/run-r2/harness-suite.log b/agents/beakley/work/queue-217/run-r2/harness-suite.log new file mode 100644 index 000000000..869d3d301 --- /dev/null +++ b/agents/beakley/work/queue-217/run-r2/harness-suite.log @@ -0,0 +1,182 @@ +npm notice run test +npm notice run node --test tests/*.test.mjs +✔ sessionModel: the route is the instance's own vars, and a missing one refuses no-route by name (37.340888ms) +✔ a pi bundle: prompt, policy, tools and manifest, 0600 in a 0700 directory (10.573131ms) +✔ a chief-of-staff bundle lists launch among the bus tools and the manifest's typed tools (4.412373ms) +✔ a chief-of-staff bundle lists end_run, change_organization and set_name as typed and nothing untyped, for either harness (8.193363ms) +✔ the stop line names end_run for a role.end holder, and every other role keeps today's text (13.648406ms) +✔ a claude-code bundle adds the wrapped gate hook and the MCP config (7.875641ms) +✔ the prompt's built-in tools line is the harness's own names, as the manifest lists them (22.548582ms) +✔ the prompt names the project clones in the workspace, and none when there are none (13.290253ms) +✔ the prompt explains the review loop to a role with push_working, and reviews to one with fetch_review (15.420914ms) +✔ the prompt explains landing to a role with land_work, and to no other (9.918107ms) +✔ the prompt tells the pm to ask the chief of staff for sessions, and no other role (18.356673ms) +✔ a bundle is written once: an existing file refuses (3.135889ms) +✔ a path with a single quote can't go into the hook command (3.86973ms) +✔ web grant on pi: the bundle has web_search and web_fetch, and no built-in web tool (4.927453ms) +✔ no web grant on pi: no web tool in the bundle, and the gate blocks a web call (4.535472ms) +✔ web grant on claude-code: the bundle has web_search and web_fetch, and no built-in web tool (4.409455ms) +✔ no web grant on claude-code: no web tool in the bundle, and the gate blocks a web call (7.034483ms) +✔ a granted session's gate lets the typed web tools through and still blocks the built-ins (6.471178ms) +✔ search-source searxng-url: a granted role gets the typed broker tools and no harness web tool; an ungranted role gets nothing (12.185523ms) +✔ search-source searxng-bundled: a granted role gets the typed broker tools and no harness web tool; an ungranted role gets nothing (11.958441ms) +✔ search-source harness-builtin: claude-code gets WebSearch and WebFetch and no typed web tool, only when granted (12.933659ms) +✔ search-source harness-builtin is refused for a granted pi role, which has no built-in web tool (4.064682ms) +✔ C2-06 RESULT reply-invalid retries once, delivers only the valid answer and names reason (351.396996ms) +✔ C2-06 RESULT citation-missing retries once, delivers only the valid answer and names reason (256.673143ms) +✔ C2-06 RESULT citations-over-limit retries once, delivers only the valid answer and names reason (222.852677ms) +✔ C2-06 RESULT citation-invalid retries once, delivers only the valid answer and names reason (261.389143ms) +✔ C2-06 RESULT playground-cited-as-canon retries once, delivers only the valid answer and names reason (268.849657ms) +✔ C2-06 RESULT citation-cross-universe retries once, delivers only the valid answer and names reason (231.674929ms) +✔ C2-06 RESULT citation-unfetched retries once, delivers only the valid answer and names reason (216.064282ms) +✔ C2-06 RESULT two guard refusals use the citation fixed text and exactly one retry (188.874138ms) +✔ C2-06 RESULT JSON 34000 characters retries with a shorter valid answer (236.68605ms) +✔ C2-06 RESULT JSON 70000 characters retries with a shorter valid answer (234.722358ms) +✔ C2-06 RESULT two oversized JSON bodies use the length fixed text with citations required (193.029509ms) +✔ C2-06 multibyte plain bodies also receive the one request-size retry (223.988818ms) +✔ C2-06 two multibyte plain bodies use the length fallback (205.649902ms) +✔ C2-06 RESULT a length refusal then citation refusal shares one retry and citation fallback (206.128944ms) +✔ C2-06 fixed empty/failed replies defer unslop note until the next cited reply (295.722008ms) +✔ C2-06 cited JSON above the old 32000 clip retains its citations and text (189.724785ms) +✔ C2-06 a flagged cited answer keeps the note inside text and citations whole (192.59344ms) +✔ C2-06 send_message typed tool runs every guard code before the valid RESULT (262.703841ms) +✔ C2-06 outside library the old failed text, clip and unslop behavior hold (208.584382ms) +✔ C2-06 outside library a refused send keeps the existing no-retry behavior (159.048751ms) +✔ C2-06 the retry turn delivers citation-unavailable reason to the agent (190.203749ms) +✔ allow exits 0, a deny exits 2 with the reason on stderr (211.158287ms) +✔ a missing or wrong policy, or a bad event, exits 2 (113.877105ms) +✔ the bundle's wrapped command: a missing gate or node still blocks (1104.288151ms) +✔ claude: typed tools through MCP, the hook blocks, builtins outside --tools don't exist (1070.940549ms) +✔ claude: the hook alone blocks a path outside the workspace (568.174554ms) +✔ claude: a second turn resumes the first turn's session (940.097062ms) +✔ claude adapter: --restricted is always passed (6.108878ms) +✔ claude adapter: MOSAIC_CLAUDE_BIN wins over PATH and must be an absolute executable (19.555633ms) +✔ claude adapter: a directory pin exits 2 before it runs; a pin with a space runs (6.450898ms) +✔ claude: CLAUDE.md files and auto-memory don't reach the model; without --restricted they do (912.426727ms) +✔ claude: a missing hook or MCP file refuses before claude starts (8.255308ms) +✔ claude: row 66 a reply with a tell gets the correction notice on the next turn, a clean reply gets none, and the counts read after (1813.719749ms) +✔ claude: row 66 a broken lists.json gives no clean verdict, the operator is told once, and the session still answers (861.243377ms) +✔ M2: the gate refuses write, edit and bash to every creative role on pi and claude-code (58.57362ms) +✔ M6: no creative session gets raise_decision; the assistant and the chief of staff keep it (27.01682ms) +✔ web: research and companion get the broker's typed web tools, and a harness-builtin source refuses web-source-not-allowed (34.87358ms) +✔ persona: the block sits between the contract and ## This session, fenced, with the name and digest (10.05189ms) +✔ persona: each unsafe or unpinned file refuses before the bundle directory is made (30.976676ms) +✔ adapters pass the prompt file's absolute path; the persona and the prompt text never sit in argv (48.053085ms) +✔ the pi adapter refuses a missing, unreadable or directory prompt file before pi starts (13.20329ms) +✔ pi: policy tools and typed tools pass, anything else is blocked (4.524582ms) +✔ claude: builtins map from pi names, typed tools need the mcp prefix (1.1263ms) +✔ file tool paths must resolve inside the workspace (4.02957ms) +✔ pi's own path normalisation can't be used to step out (1.586245ms) +✔ a symlink inside the workspace that points out is outside (1.300474ms) +✔ a dangling symlink is refused at any depth, in both harnesses (5.091178ms) +✔ read is checked under every spelling pi's read would open, in both harnesses (29.6566ms) +✔ other spellings cover directories, dangling links and pi's cwd (2.651598ms) +✔ a relative path climbs from the workspace's real path, in both harnesses (9.557314ms) +✔ claude path fields per tool (1.146391ms) +✔ glob patterns stay inside the workspace (1.220629ms) +✔ a path that can't be checked is blocked (0.713439ms) +✔ fetch_review's have lists the working refs before origin's, and no more than HAVE_MAX (358.466429ms) +✔ fetch_review's have orders the working refs newest first within each clone, one clone after another (177.220281ms) +✔ a runner git past its time: SIGTERM reaches its process group, and SIGKILL follows after the grace period (1810.093816ms) +✔ once a signalled runner git has closed, its group gets SIGKILL, so a process that ignored SIGTERM dies too (303.717292ms) +✔ land_work sends one land line and resolves the host's started answer (3.694332ms) +✔ initialize, ping and tools/list (73.055562ms) +✔ tools/call goes through the tool socket; a refusal is an isError result (66.566638ms) +✔ replies are compact JSON; over the cap a tool error names the size and the cap (60.558157ms) +✔ unknown tools and methods are JSON-RPC errors and never reach the socket (52.967178ms) +✔ a missing argument is a usage error (35.244954ms) +✔ pi: typed tools reach the socket, the gate blocks, agent_end writes the marker (676.072372ms) +✔ pi: a reply over the cap is a tool error naming the size and the cap; list_tasks asks for open tasks (532.762084ms) +✔ pi: a write through a dangling symlink is blocked, and nothing appears outside (479.264215ms) +✔ pi: a read is refused when pi would open another spelling outside (479.008336ms) +✔ pi: a relative path climbs from the real path of a workspace behind a symlink (495.496517ms) +✔ pi: a relative path climbs from the real path of a dataRoot behind a symlink (458.873867ms) +✔ pi: a missing extension refuses before any model call (6.358156ms) +✔ pi: an extension without its configuration fails pi's start (380.653357ms) +✔ pi: row 66 a reply with a tell gets the correction notice on the next turn, a clean reply gets none, and the counts read after (1353.463628ms) +✔ pi: row 66 a broken lists.json gives no clean verdict, the operator is told once, and the session still answers (748.010347ms) +✔ raise_decision offers domain as technical or delivery only, optional, and says where a raise goes (23.00088ms) +✔ raise_decision forwards domain to decision.raise, and a call without it sends none (100.23044ms) +✔ founderCheck: founder variables, then a needed service without a usable token (3.039179ms) +✔ turnRequest names the sender, class, reply and decision (0.355597ms) +✔ turnRequest says a tester's message is a test and never Jason's instruction (0.317095ms) +✔ turnRequest says a user's message is a granted user's and never the owner's instruction (0.277911ms) +✔ turnRequest shows the message's own sent time, a day old as well as new (0.227187ms) +✔ stateBlock names the launch state with its time and event, and the open tasks with the cap (0.334368ms) +✔ a message becomes a turn, the answer goes back as a RESULT, SIGTERM releases and exits 0 (257.255462ms) +✔ launches revoked and then restored: the turn's block reads allowed and gives the restore time (272.592717ms) +✔ a task closed on the tracker is missing from the next turn's open list (239.571073ms) +✔ a message read a day after it was sent shows the time it was sent (148.998515ms) +✔ a decision the human resolves becomes a turn citing the decision and the answer (196.043584ms) +✔ a failed state read fails the turn: no adapter runs, the sender hears why, the message is read (103.372577ms) +✔ a SIGTERM before the claim stops the runner with exit 0 and no claim (91.622163ms) +✔ typed tools carry the runner's capability; launch goes to the host's launch socket (336.226718ms) +✔ end_run, organization_revision and change_organization reach the broker with the tool's arguments, and refusals keep their codes (429.635331ms) +✔ set_name reaches the broker's name.set with the tool's arguments, and refusals keep their codes (182.337097ms) +✔ a RESULT gets no automatic reply; failed turns reply with the reason (1269.003752ms) +✔ the bus's launch notice is one turn with no reply, and is not taken again (269.091562ms) +✔ SIGTERM during a turn kills the turn's process group and still exits 0 (122.399792ms) +✔ founder credentials stop before the claim (20) (162.909348ms) +✔ a refused claim exits 21; an ended run's capability exits 22 (165.231771ms) +✔ the launch ending under a running session exits 22 (134.851141ms) +✔ a broker that stays unreachable exits 23 after brokerRetries polls (234.508622ms) +✔ a broker that is down at the claim exits 23, not 21 (78.168597ms) +✔ no capability, or a malformed one, on stdin exits 2 (194.303544ms) +✔ a missing or malformed policy exits 2 before the claim (120.576748ms) +✔ REQ-LIMIT-4 runner brackets its actual harness turn before the reply and read receipt (194.53726ms) +✔ REQ-LIMIT-4 a runner at its limit stops at the end of its turn: RESULT and read first, then exit 22 and a limit-check revoke (168.261307ms) +✔ landingRequest is the fixed template, with the decision and task ref and nothing else (0.147237ms) +✔ each landing entry is one turn before any message, with the state block and the fixed request; it sends nothing and reads nothing (226.715761ms) +✔ an empty landing takes no landing turn: the message is turn 1 (195.475495ms) +✔ a run in a landing turn isn't released for a second held decision until its landing turns end and it has read its messages (596.516739ms) +✔ a malformed landing exits 2 before the claim, with no turn (568.856934ms) +✔ row 65 a session.json without a turnEnd of marker or exit, or a harnessEnv of strings, exits 2 before the claim (269.597797ms) +✔ row 65 harnessEnv reaches the adapter, and an exit harness needs no turn marker (141.169295ms) +✔ row 66 the adapter gets the run's unslop log, and a flagged reply's note rides that reply's RESULT, once (300.426996ms) +✔ row 66 a turn with no reply holds its note for the next reply; a broken check is told once (345.164969ms) +✔ row 66 unslopNotes keeps a note until sent(), reads only whole lines, and unslopCounts reads a log after the session (1.68702ms) +✔ row 66 a clipped answer with both note parts stays under the bus's body limit, and the note under 600 (161.518813ms) +✔ row 66 a refused send keeps the note: it rides the next RESULT the session sends (264.81696ms) +✔ each repo role's prompt carries exactly its listed skills, each file as the bundle copy and the source (69.791416ms) +✔ a skill's files go into the prompt in sorted path order, sub-directories included (9.238961ms) +✔ a role with no skills gets no Skills section, no skills directory and an empty manifest list (11.39746ms) +✔ an enabled skill the role doesn't list stays out of the prompt (8.706347ms) +✔ the bundle copy outlives the source: deactivating a skill after the build leaves the run's copy (4.473957ms) +✔ a listed skill that isn't enabled refuses skill-not-enabled, naming the activate command (9.541232ms) +✔ a skill directory that isn't plain refuses: a symlinked skill, SKILL.md or sub-file, or a non-file entry (2.643822ms) +✔ a skill file that can't go into the prompt refuses: a bad name, non-UTF-8 bytes, or the end marker (3.518581ms) +✔ a role's skills over SKILL_BYTES together refuse, naming the skill that crossed it (10.193929ms) +✔ each adapter passes the skills only in the prompt file, with skill discovery off (59.00799ms) +✔ every role sees read_spec, record writer follows its grant, citation schemas stay strict (25.138022ms) +✔ typed socket forwards read content/history and agent record writes, and cannot write a spec (172.529974ms) +✔ the PM gets its task verbs and the reads, and no launch (11.972118ms) +✔ send_message offers the BLOCK class, beside the classes it already had (3.837774ms) +✔ the chief of staff gets launch, send_message, end_run, hire, fire, change_organization and set_name, and no task verbs (4.871494ms) +✔ hire and fire send instance.hire and instance.fire under role.hire and role.fire, only for a holder of the grant (22.751702ms) +✔ request_staff is the pm's alone: staff.request over message.send, roles and counts bounded (15.291362ms) +✔ end_run sends role and reason, no decision; change_organization sends revision and the organization keys (2.689052ms) +✔ set_name sends instance and name to name.set under instance.name, only for a holder of that grant (12.695737ms) +✔ the organization keys change_organization takes are the broker's ORGANIZATION_KEYS and the settings' SETTINGS_KEYS (0.178758ms) +✔ a role without role.end or organization.change gets none of the three tools, and each follows its own grant (12.115972ms) +✔ no role's tools send instances or instances.set, and change_organization takes no instance write keys (10.7825ms) +✔ the assistant gets send_message, the reads and the web tools (it holds the web grant), no launch (2.17462ms) +✔ list_requirements reads the requirement ids, for a task.create holder with a tracker (3.939398ms) +✔ a coder gets no launch, no resolve_decision, and no task tools without a tracker (3.125698ms) +✔ a coder with a tracker gets its own task tools and no task_reassign (2.258296ms) +✔ launch only when the business's launch block names the instance as launcher (3.280204ms) +✔ an action outside the instance's authority has no tool (1.994949ms) +✔ the review loop: push_working and request_review for the coder, fetch_review and review_verdict for the reviewer, none for the PM (7.387015ms) +✔ land_work is there only with land, after push_working, with the task and the decision (4.431191ms) +✔ callTool: one JSON line out, the result back, a refusal rejects (16.610729ms) +✔ list_tasks takes the broker's filters and pages; get_task takes a task_ref (4.144909ms) +✔ callTool sends list_tasks done false unless the session names done; other tools as given (3.985977ms) +✔ replyText: compact JSON up to the cap, an error naming the size and the cap over it (1.008682ms) +✔ web_search's query maxLength is the web layer's SEARCH_MAX_QUERY_CHARS (4.810935ms) +ℹ tests 172 +ℹ suites 0 +ℹ pass 172 +ℹ fail 0 +ℹ cancelled 0 +ℹ skipped 0 +ℹ todo 0 +ℹ duration_ms 12131.328093 diff --git a/agents/beakley/work/queue-217/run-r2/library-suite.log b/agents/beakley/work/queue-217/run-r2/library-suite.log new file mode 100644 index 000000000..64693e9c9 --- /dev/null +++ b/agents/beakley/work/queue-217/run-r2/library-suite.log @@ -0,0 +1,153 @@ +npm notice run @mosaic/library@0.1.0 test +npm notice run node --test tests/*.test.mjs +✔ C2-06 reply schema: free bodies, exact objects and safe refusal reasons (31.081491ms) +✔ C2-06 citation setting and all four exact fixed texts (27.31137ms) +✔ C2-06 default citation cap passes 20 and refuses 21, even with optional citations (144.940253ms) +✔ C2-06 real Git citation scope, reachability, lines and normalized quotes (71.988432ms) +✔ C2-06 playground cites pass but cannot state canon (42.141068ms) +✔ C2-06 independent universes refuse; a hybrid and only its sources pass (69.134397ms) +✔ C2-06 web cites require allowed definition, this session fetch and kept quote (17.090852ms) +✔ C2-06 file origin is the path commit and trailer, while last follows served changes (51.160201ms) +✔ C2-06 origin uses literal paths even when a filename contains a glob (35.841257ms) +✔ C2-06 cited-commit guard reads exactly the C2-05a indexed file set with supporting scope (79.711572ms) +✔ C2-06 reply limits fall back independently without coercion or inherited keys (0.78046ms) +✔ the same commit, repo path and mapping return the same index, and only mapped files are in it (53.330474ms) +✔ a different repo path, mapping or commit gets its own index (73.465944ms) +✔ the cache holds at most eight indexes and evicts the least recently used (93.355098ms) +✔ a failed read is not kept in the cache (19.15839ms) +✔ a missing or unchecked mapping is refused before any read (18.591276ms) +✔ a 3,000-file rebuild completes and its time is reported (3339.384537ms) +ℹ 3,000-file index rebuild: 3093 ms +✔ resolver step 1: a path from the repo root, with or without .md (2.003164ms) +✔ resolver step 2: the same path with vaultPrefix/ stripped (0.323373ms) +✔ resolver step 3: a path relative to the linking file, never above the repo root (0.278534ms) +✔ resolver step 4: a base name that matches exactly one indexed file (0.322938ms) +✔ a link into another of her repos resolves to nothing (0.213594ms) +✔ wikilink forms, embeds, and links skipped inside code (1.24016ms) +✔ only a body embed whose target has an extension other than .md, in any case, is an attachment (0.455416ms) +✔ the fixture mapping checks and comes back frozen (2.830981ms) +✔ C2-01c: a prefix inside or holding another entry's book refuses library-playground-other-universe (1.34922ms) +✔ C2-01c: a prefix equal to a book folder, or holding its own, refuses library-mapping-invalid (0.74756ms) +✔ C2-01c: universe-level prefixes lie outside every book, in a plain universe and in a hybrid with no books (1.203696ms) +✔ C2-01c: a draft takes kind, name and playground only, and comes back frozen with books [] (1.782129ms) +✔ C2-01d: supporting prefixes at book level, universe level, in a hybrid and in a draft, [] when absent (0.643444ms) +✔ C2-01d: each supporting prefix rule refuses with its code (2.880363ms) +✔ C2-01d: between the lists, a supporting prefix may equal its own playground, and a playground may hold its own supporting (0.978814ms) +✔ C2-01d: editor is optional, kept when given, and refuses anything but a plain name and email (5.417269ms) +✔ C2-01d: an accepted editor round-trips through a real git commit unchanged (22.81842ms) +✔ no playground prefix holds another, and no book folder holds another (1.309845ms) +✔ shape refusals: kind, remote, branch, unknown keys, types, manuscript, folder names (1.68793ms) +✔ C2-03a sage-2021: user is optional, kept when given, and must be a plain account name (0.986251ms) +✔ a hybrid universe is a shape the query code can take (1.4), with sources that must exist (1.600445ms) +✔ a caller-supplied fail receives the code, as business file loading will pass it (C2-04) (0.396233ms) +✔ scope comes from the path alone (design 1.2) (2.453311ms) +✔ C2-04 mirror: exact default path, bare without checkout or remote, and idempotent initialization (82.599485ms) +✔ C2-04 mirror: simultaneous creators publish one intact mirror and leave no staging paths (49.399699ms) +✔ C2-04 mirror: skipped publication accepts both coreutils statuses without removing the winner (174.577156ms) +✔ C2-04 mirror: preserve occupied directories and reject symlink ancestors and code overlaps (20.556264ms) +✔ C2-04 mirror: existing metadata accepts only bare Git plus state and the precreated lock (34.414614ms) +✔ C2-04 state: missing state is empty only while the served ref is absent (54.101069ms) +✔ C2-04 state: valid problems and sync metadata return no content and change no state bytes (57.832223ms) +✔ C2-04 state: strict keys, types, times, branch, commit and fixed R messages fail closed (158.515834ms) +✔ C2-04 state: symlink, hardlink, non-private state and missing lock refuse without replacement (57.609887ms) +✔ C2-04 file: served commit, not HEAD or a caller commit, owns the exact returned text (113.829438ms) +✔ C2-04 file: R1, R2 and R7 exclusions and never-synced mirrors cannot return file bodies (124.255784ms) +✔ C2-04 lock: a first-sync and fast-forward reader wait for a consistent pair across processes (314.221744ms) +✔ C2-04 lock: same-process waits, timeout code, callback expiry and throw release (5038.833094ms) +✔ C2-04 lock: owner death releases the kernel lock without replacing its file (54.543028ms) +✔ C2-04 lock: a missing flock binary becomes a handled refusal (49.73045ms) +✔ C2-04 lock: an unawaited scoped read drains before the lock is released (20.869629ms) +✔ the query reply cap equals the harness reply cap (1.544541ms) +✔ find is bound to its universe and refuses a call without one (70.281377ms) +✔ every result carries its scope, and playground appears only when asked for (39.878964ms) +✔ unmapped files never appear in any reply (35.123505ms) +✔ a hybrid sees its sources canon, minus exclusions, and no playground (39.679182ms) +✔ a hybrid gets a source file it can see, and not an excluded or foreign one (54.602693ms) +✔ get lists visible links both ways and drops a target another universe cannot see (50.638492ms) +✔ a long list pages by position, never cuts an item, and returns 50 per page (193.227492ms) +✔ a page stays under the reply cap when items are large (91.885035ms) +✔ a search line too long to fit alone comes back marked, with no excerpt, and the other hits still return (33.20163ms) +✔ a find item that cannot fit alone is refused, not cut (46.447292ms) +✔ get pages its lines, and the next line picks up where the page stopped (39.12526ms) +✔ get refuses a file whose front matter alone is over the cap, and a line alone is over the cap (36.804238ms) +✔ get pages the links of a hub note, every page carries the front matter, and the pages add up (1107.995321ms) +✔ get rejects a bad links_from (34.377162ms) +✔ search returns scoped line hits, case-insensitively, and refuses empty text (30.729667ms) +✔ a manuscript call returns one chapter, at most 400 lines, and names its next line (47.791378ms) +✔ a manuscript call without a chapter returns the first chapter in path order and names the next (26.366902ms) +✔ a chapter name that matches two visible files is refused (25.448584ms) +✔ a hybrid reads a source chapter through its declared sources only (39.969561ms) +✔ universe info reports a hybrid sources, constraints and notes, and refuses an unknown universe (15.657923ms) +✔ an exclusion hides what it names from a hybrid and from nothing else (39.404555ms) +✔ PRD 1.14: a lookup that names a book leaves book-null files out (34.647951ms) +✔ PRD 1.14: library_manuscript never reads a book-null file (32.637362ms) +✔ PRD 1.14: a draft universe has no canon, so its lookups return files only with scope playground (32.338176ms) +✔ PRD 1.14: library_universe on a draft returns its kind, name and prefixes (15.442774ms) +✔ a hybrid gets a source playground file as null, while the source gets it with scope playground (42.674554ms) +✔ the fixture reads clean: every resolver step, appears_in and relationships wikilinks indexed (63.033383ms) +✔ R1: executables, symlinks, gitlinks, blobs over 1 MiB and non-UTF-8 text are not indexed (95.339567ms) +✔ R2: unmapped paths are reported and not indexed (31.564751ms) +✔ R3: front matter not fully parsed stays raw, with the line where parsing stopped (36.896696ms) +✔ front matter forms the reader accepts and refuses (1.596508ms) +✔ R4: a link to no file, to more than one, or into another repo is reported and not followed (35.504393ms) +✔ a block list link carries its item line, a scalar or flow link its key line, and problems follow (37.229678ms) +✔ an unresolved attachment embed gives no problem; a link or front matter value to one is R4; a note embed resolves (33.783255ms) +✔ an indexed Dr.Quinn.md resolves as a body link, a block list link and an embed (33.230236ms) +✔ R5: a canon file that refers into the playground is reported, and the link still goes by path (29.709099ms) +✔ R6: a canon file that refers into another universe is reported; a hybrid may refer into its sources (30.970646ms) +✔ R7: two paths that differ only in case are both left out (41.126208ms) +✔ the reader reads the commit, never the working tree, and refuses a bad commit id (41.98282ms) +✔ a bare mirror reads the same as the clone (53.445984ms) +✔ renderItems snapshot: fact (1.786386ms) +✔ renderItems snapshot: finding (0.299155ms) +✔ renderItems snapshot: correction (0.259329ms) +✔ renderItems snapshot: question (0.218182ms) +✔ renderItems snapshot: idea (0.223821ms) +✔ renderItems numbers several items and takes a parsed body as well as a string (1.090019ms) +✔ without options a path cite has no badge and is never marked changed (0.280013ms) +✔ renderItems snapshot: notice no-cited-answer (0.237711ms) +✔ renderItems snapshot: notice no-answer (0.198705ms) +✔ renderItems snapshot: notice turn-failed (0.337126ms) +✔ a body without the reply shape shows a fixed line and none of its text (0.613863ms) +✔ C2-01c: each level gives its universe, and its book or null (4.092943ms) +✔ C2-01c: prefixes come first: in a book that holds a prefix, a file outside it is canon and one under it playground (0.607188ms) +✔ C2-01c: a canon file linking into a draft gives R6, and into its own universe-level prefix gives R5 (65.023589ms) +✔ C2-01d: each supporting level gives its universe, and its book or null (0.8244ms) +✔ C2-01d: supporting comes before playground; a folder in both lists is supporting, one in the playground only stays playground (0.633065ms) +✔ C2-01d: only .md files are supporting; a .canvas or .base under a supporting prefix is unmapped (0.517375ms) +✔ C2-01d: a path passes at book level, universe level, in a draft and in a folder in both lists (2.312377ms) +✔ C2-01d: a path of exactly 1024 bytes passes, and 1025 bytes made of multi-byte characters refuses (0.98988ms) +✔ C2-01d: a path outside the universe's supporting folders refuses (0.763326ms) +✔ C2-01d: malformed paths refuse by class, in order (0.710036ms) +✔ C2-01d: a symlink or gitlink on the way, or at the path itself, refuses (0.383033ms) +✔ C2-01d: a name that differs from a tree name only in case or Unicode form refuses, at the file or any folder (0.99427ms) +✔ the survey prints folder names, counts, key sets and link-form counts, and never text (65.469359ms) +✔ folder names print DEL, C1 and bidi controls, U+061C among them, as escapes (37.571162ms) +✔ an embed of an attachment counts as an embed and as an attachment; a plain link to one does not (24.053267ms) +✔ with --mapping the survey adds scope, resolver step and problem counts (51.551822ms) +✔ C2-01d: with --mapping the survey counts supporting files (49.232972ms) +✔ survey exit codes: usage 4, bad mapping 3, unreadable repo 2 (19.679523ms) +✔ scripts/mosaic library survey reaches the survey (97.237921ms) +✔ C2-03a argv: the fixed sequence, one https allow, no other protocol key (2.539459ms) +✔ C2-03a argv: only an https URL with a plain host, no userinfo, and a plain user (1.147619ms) +✔ C2-03a helper: answers only the exact prompts for the configured host and user (dewey-0765) (43.662638ms) +✔ C2-03a first sync: served is the fetched tip, HEAD is served, the survey reads it, and the token stays in the slot (199.624214ms) +✔ C2-03a fast-forward: served moves, problems are rebuilt, and a repeat changes only lastFetch (272.12795ms) +✔ C2-03a Filbert N2: a read that took served before a sync still finds its objects after served moves (255.892244ms) +✔ C2-03a overlap: a reader during a sync sees the old pair or the new one, never a mix (220.077465ms) +✔ C2-03a diverged: a non-fast-forward keeps serving and holds until a human accepts the tip (511.485441ms) +✔ C2-03a accept starts the record over, so a changed branch gets a fresh state (204.895458ms) +✔ C2-03a fetch failure: a wrong token keeps serving and records the error, lastFetch unchanged (210.171392ms) +✔ C2-03a a failed first fetch records the error with nothing served (57.52009ms) +✔ C2-03a a 302 to another host fails the fetch and the other host sees nothing (68.211135ms) +✔ C2-03a the slot: missing or unsafe refuses before git, and sync never opens it (65.636096ms) +✔ C2-03a sage-2021: an entry with no user refuses library-remote-invalid and runs no git (34.004871ms) +✔ C2-03a one sync per mirror: an overlapping call refuses library-sync-busy (129.134012ms) +ℹ tests 142 +ℹ suites 0 +ℹ pass 142 +ℹ fail 0 +ℹ cancelled 0 +ℹ skipped 0 +ℹ todo 0 +ℹ duration_ms 6490.060843 diff --git a/agents/beakley/work/queue-217/run-r2/m1-anchors.txt b/agents/beakley/work/queue-217/run-r2/m1-anchors.txt new file mode 100644 index 000000000..488becb69 --- /dev/null +++ b/agents/beakley/work/queue-217/run-r2/m1-anchors.txt @@ -0,0 +1,2 @@ +1 match: replyLimitsFence(old, document, actor); +1 match: replyLimitsFence(old, written, actor); diff --git a/agents/beakley/work/queue-217/run-r2/m5-driver.log b/agents/beakley/work/queue-217/run-r2/m5-driver.log new file mode 100644 index 000000000..40e64a09b --- /dev/null +++ b/agents/beakley/work/queue-217/run-r2/m5-driver.log @@ -0,0 +1 @@ +M5-hide-library-unavailable: killed (control green, mutant exit 1, hashes restored, restored green) diff --git a/agents/beakley/work/queue-217/run-r2/m5-red/M5-hide-library-unavailable-control.log b/agents/beakley/work/queue-217/run-r2/m5-red/M5-hide-library-unavailable-control.log new file mode 100644 index 000000000..72c5218ff --- /dev/null +++ b/agents/beakley/work/queue-217/run-r2/m5-red/M5-hide-library-unavailable-control.log @@ -0,0 +1,11 @@ +✔ C2-06 held library lock gives the agent citation-unavailable and its retry reason (5151.319291ms) +✔ C2-06 malformed sync state is availability failure, never a fabricated invalid cite (37.53806ms) +✔ C2-06 no mirror or freshly initialized empty mirror still means no served citation (35.257703ms) +ℹ tests 3 +ℹ suites 0 +ℹ pass 3 +ℹ fail 0 +ℹ cancelled 0 +ℹ skipped 0 +ℹ todo 0 +ℹ duration_ms 5310.30031 diff --git a/agents/beakley/work/queue-217/run-r2/m5-red/M5-hide-library-unavailable-restored-green.log b/agents/beakley/work/queue-217/run-r2/m5-red/M5-hide-library-unavailable-restored-green.log new file mode 100644 index 000000000..2c148db7e --- /dev/null +++ b/agents/beakley/work/queue-217/run-r2/m5-red/M5-hide-library-unavailable-restored-green.log @@ -0,0 +1,11 @@ +✔ C2-06 held library lock gives the agent citation-unavailable and its retry reason (5147.642347ms) +✔ C2-06 malformed sync state is availability failure, never a fabricated invalid cite (32.256875ms) +✔ C2-06 no mirror or freshly initialized empty mirror still means no served citation (31.701926ms) +ℹ tests 3 +ℹ suites 0 +ℹ pass 3 +ℹ fail 0 +ℹ cancelled 0 +ℹ skipped 0 +ℹ todo 0 +ℹ duration_ms 5295.499085 diff --git a/agents/beakley/work/queue-217/run-r2/m5-red/M5-hide-library-unavailable-restored.sha256 b/agents/beakley/work/queue-217/run-r2/m5-red/M5-hide-library-unavailable-restored.sha256 new file mode 100644 index 000000000..fdc71b26b --- /dev/null +++ b/agents/beakley/work/queue-217/run-r2/m5-red/M5-hide-library-unavailable-restored.sha256 @@ -0,0 +1,23 @@ +eeca81ab965f9e94f930ee5f51d16f019af6368bc6c3994895e204f7a54ec8d2 packages/bus/src/broker.mjs +ad3c686a089f67f3c89610937c6fc9b32367cea5d9735125d89bef042082d4e8 packages/bus/src/client.mjs +36b05dd3119e5929211aa1cc5d45c5043f5a1c34567ddc7cac8f002835d44abe packages/bus/src/runtime.mjs +66b26d131a19f4f411686427274936850c1ff0aed11e9b281ae4aadcf4b289fc packages/bus/src/server.mjs +cdd0304ec25ef1ad3e31c52502fa46f2c80bd77c8d3c2e13f8ed4b5328f342c9 packages/bus/tests/citation-availability.test.mjs +2e05074cd9d15d810103658af3858161cee2af78b0a2e1ba910222fab3e84401 packages/bus/tests/citation-guard.test.mjs +2c7a2102e2e0244876e41b664f4f706baefe3375100b956655551db1230f5da3 packages/bus/tests/citation-helpers.mjs +168dcac99d9bfdfdf5ff0eaa2c0fff91595b351b4d0092dc299532c9c32869f0 packages/bus/tests/citation-runtime.test.mjs +abaeac64f2c3bf8ba83c9a4488edd9105c4707a6564560c5333d5421445653af packages/business/src/business.mjs +3a6044de5d1ca2cc35c5285b460c3e402b4274837e5d88b97f489797f6004903 packages/business/src/organization.mjs +4d2eb11beaa80175e524af1b95c81e7164990fba1d3e1754f5ba06eee390a14f packages/business/tests/reply-limits.test.mjs +a2bb98734bcc2556f8b2168f0faf8a89f7064c3f0aa49feb7d1975d596192f09 packages/cli/README.md +2f291a71f490f2741edada7a3e3788500f8976a08eb8ab1411f6c5982f778260 packages/cli/src/limits.mjs +f38af2d46d5f5f6388f599912507b94b87a0bf9dcc2104bb2187c38ee35118d5 packages/cli/tests/reply-limits.test.mjs +6ad72b4245e0a66e32725941900c1ece64c2e5de2fb73d65c8e042b4f3a691a6 packages/harness/src/runner.mjs +a5ef1b65230239a7baf6d0e8f2b8a51c0516348c7c4339a55b3f0a1a6ff531ba packages/harness/tests/citation-runner.test.mjs +330bc71bf6c7e64d3ddb70440903d2d9acf7878d44a49d7e30c2352ee4c807ec packages/harness/tests/fixtures/citation-adapter.mjs +f710d9600a17f6e2989a289cfe84e58f161d86c7306605946ce05fa71b364eb2 packages/library/src/guard.mjs +c0d630798914e300e461c247340533328e97119e54909c6a9406340e61fed8b7 packages/library/src/index.mjs +98ef45ed61144aaea44d8aea1ac43082b6d340297e46846d01772da38728e530 packages/library/src/limits.mjs +7b46f47b5e9d6b554b5d39bce2cd95c4610f5f35b8ab8fdc5a2864b3214be809 packages/library/src/reply-protocol.mjs +406146ebbce3710f308243b684a1c17e7626c1b65a4468489364317e31537a48 packages/library/tests/guard.test.mjs +39c8e6c8250a13fa43015fb2c407195e30ee642f729a9f6a644c38b4ea758a72 packages/seat/src/sandbox.mjs diff --git a/agents/beakley/work/queue-217/run-r2/m5-red/M5-hide-library-unavailable.log b/agents/beakley/work/queue-217/run-r2/m5-red/M5-hide-library-unavailable.log new file mode 100644 index 000000000..613cacc0a --- /dev/null +++ b/agents/beakley/work/queue-217/run-r2/m5-red/M5-hide-library-unavailable.log @@ -0,0 +1,68 @@ +✖ C2-06 held library lock gives the agent citation-unavailable and its retry reason (5108.905478ms) +✖ C2-06 malformed sync state is availability failure, never a fabricated invalid cite (40.518617ms) +✔ C2-06 no mirror or freshly initialized empty mirror still means no served citation (37.68422ms) +ℹ tests 3 +ℹ suites 0 +ℹ pass 1 +ℹ fail 2 +ℹ cancelled 0 +ℹ skipped 0 +ℹ todo 0 +ℹ duration_ms 5261.169843 + +✖ failing tests: + +test at packages/bus/tests/citation-availability.test.mjs:13:1 +✖ C2-06 held library lock gives the agent citation-unavailable and its retry reason (5108.905478ms) + AssertionError [ERR_ASSERTION]: Expected values to be strictly equal: + + actual - expected + + + 'citation-invalid' + - 'citation-unavailable' + ^ + + at Object. (file:///mnt/storage/scratch/tmp/tNoueZ/row217-mutant-pd3x2htc/packages/bus/tests/citation-availability.test.mjs:29:14) + at expectedException (node:assert:547:17) + at expectsError (node:assert:672:21) + at strict.rejects (node:assert:738:3) + at process.processTicksAndRejections (node:internal/process/task_queues:104:5) + at async file:///mnt/storage/scratch/tmp/tNoueZ/row217-mutant-pd3x2htc/packages/bus/tests/citation-availability.test.mjs:28:5 + at async withLibraryLock (file:///mnt/storage/scratch/tmp/tNoueZ/row217-mutant-pd3x2htc/packages/library/src/mirror.mjs:171:18) + at async TestContext. (file:///mnt/storage/scratch/tmp/tNoueZ/row217-mutant-pd3x2htc/packages/bus/tests/citation-availability.test.mjs:27:3) + at async Test.run (node:internal/test_runner/test:1409:7) + at async startSubtestAfterBootstrap (node:internal/test_runner/harness:387:3) { + generatedMessage: true, + code: 'ERR_ASSERTION', + actual: 'citation-invalid', + expected: 'citation-unavailable', + operator: 'strictEqual', + diff: 'simple' + } + +test at packages/bus/tests/citation-availability.test.mjs:40:1 +✖ C2-06 malformed sync state is availability failure, never a fabricated invalid cite (40.518617ms) + AssertionError [ERR_ASSERTION]: Expected values to be strictly deep-equal: + + actual - expected + + Comparison { + + code: 'citation-invalid' + - code: 'citation-unavailable' + } + + at async TestContext. (file:///mnt/storage/scratch/tmp/tNoueZ/row217-mutant-pd3x2htc/packages/bus/tests/citation-availability.test.mjs:45:3) + at async Test.run (node:internal/test_runner/test:1409:7) + at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) { + generatedMessage: true, + code: 'ERR_ASSERTION', + actual: Error: citation-invalid: citation 1 (Book One/Characters/Mara Vell.md) isn't an indexed file at a commit reachable from the served commit + at refuse (file:///mnt/storage/scratch/tmp/tNoueZ/row217-mutant-pd3x2htc/packages/library/src/guard.mjs:24:42) + at checkReply (file:///mnt/storage/scratch/tmp/tNoueZ/row217-mutant-pd3x2htc/packages/library/src/guard.mjs:80:25) + at async waitForActual (node:assert:615:5) + at async strict.rejects (node:assert:738:25) + at async TestContext. (file:///mnt/storage/scratch/tmp/tNoueZ/row217-mutant-pd3x2htc/packages/bus/tests/citation-availability.test.mjs:45:3) + at async Test.run (node:internal/test_runner/test:1409:7) + at async Test.processPendingSubtests (node:internal/test_runner/test:974:7), + expected: { code: 'citation-unavailable' }, + operator: 'rejects', + diff: 'simple' + } diff --git a/agents/beakley/work/queue-217/run-r2/m5-red/summary.txt b/agents/beakley/work/queue-217/run-r2/m5-red/summary.txt new file mode 100644 index 000000000..40e64a09b --- /dev/null +++ b/agents/beakley/work/queue-217/run-r2/m5-red/summary.txt @@ -0,0 +1 @@ +M5-hide-library-unavailable: killed (control green, mutant exit 1, hashes restored, restored green) diff --git a/agents/beakley/work/queue-217/run-r2/mutants-driver.log b/agents/beakley/work/queue-217/run-r2/mutants-driver.log new file mode 100644 index 000000000..b7461051e --- /dev/null +++ b/agents/beakley/work/queue-217/run-r2/mutants-driver.log @@ -0,0 +1,5 @@ +M1-writer-fence: killed (control green, mutant exit 1, hashes restored, restored green) +M2-incoming-human: killed (control green, mutant exit 1, hashes restored, restored green) +M3-split-check-transaction: killed (control green, mutant exit 1, hashes restored, restored green) +M5-hide-library-unavailable: killed (control green, mutant exit 1, hashes restored, restored green) +M4-drop-client-reason: killed (control green, mutant exit 1, hashes restored, restored green) diff --git a/agents/beakley/work/queue-217/run-r2/mutants/M1-writer-fence-control.log b/agents/beakley/work/queue-217/run-r2/mutants/M1-writer-fence-control.log new file mode 100644 index 000000000..6eb978baf --- /dev/null +++ b/agents/beakley/work/queue-217/run-r2/mutants/M1-writer-fence-control.log @@ -0,0 +1,14 @@ +✔ C2-06 M11 human replacement works; omitted settings return to defaults (29.278355ms) +✔ C2-06 M11 agents and tester cannot change settings, including by changing human (22.040025ms) +✔ C2-06 M11 serialization cannot replace settings after the first fence (8.805323ms) +✔ C2-06 M11 an unrelated actor cannot appoint itself human and change reply limits (8.829275ms) +✔ C2-06 invalid setter values preserve the business and changes.jsonl (9.171416ms) +✔ C2-06 validator accepts hand-edited settings; raw reader fails closed on invalid files (10.423621ms) +ℹ tests 6 +ℹ suites 0 +ℹ pass 6 +ℹ fail 0 +ℹ cancelled 0 +ℹ skipped 0 +ℹ todo 0 +ℹ duration_ms 139.016448 diff --git a/agents/beakley/work/queue-217/run-r2/mutants/M1-writer-fence-restored-green.log b/agents/beakley/work/queue-217/run-r2/mutants/M1-writer-fence-restored-green.log new file mode 100644 index 000000000..254272f1c --- /dev/null +++ b/agents/beakley/work/queue-217/run-r2/mutants/M1-writer-fence-restored-green.log @@ -0,0 +1,14 @@ +✔ C2-06 M11 human replacement works; omitted settings return to defaults (27.397407ms) +✔ C2-06 M11 agents and tester cannot change settings, including by changing human (23.565905ms) +✔ C2-06 M11 serialization cannot replace settings after the first fence (8.312613ms) +✔ C2-06 M11 an unrelated actor cannot appoint itself human and change reply limits (8.050944ms) +✔ C2-06 invalid setter values preserve the business and changes.jsonl (8.746752ms) +✔ C2-06 validator accepts hand-edited settings; raw reader fails closed on invalid files (11.061782ms) +ℹ tests 6 +ℹ suites 0 +ℹ pass 6 +ℹ fail 0 +ℹ cancelled 0 +ℹ skipped 0 +ℹ todo 0 +ℹ duration_ms 137.787038 diff --git a/agents/beakley/work/queue-217/run-r2/mutants/M1-writer-fence-restored.sha256 b/agents/beakley/work/queue-217/run-r2/mutants/M1-writer-fence-restored.sha256 new file mode 100644 index 000000000..2aefac75f --- /dev/null +++ b/agents/beakley/work/queue-217/run-r2/mutants/M1-writer-fence-restored.sha256 @@ -0,0 +1,23 @@ +eeca81ab965f9e94f930ee5f51d16f019af6368bc6c3994895e204f7a54ec8d2 packages/bus/src/broker.mjs +ad3c686a089f67f3c89610937c6fc9b32367cea5d9735125d89bef042082d4e8 packages/bus/src/client.mjs +36b05dd3119e5929211aa1cc5d45c5043f5a1c34567ddc7cac8f002835d44abe packages/bus/src/runtime.mjs +66b26d131a19f4f411686427274936850c1ff0aed11e9b281ae4aadcf4b289fc packages/bus/src/server.mjs +cdd0304ec25ef1ad3e31c52502fa46f2c80bd77c8d3c2e13f8ed4b5328f342c9 packages/bus/tests/citation-availability.test.mjs +2e05074cd9d15d810103658af3858161cee2af78b0a2e1ba910222fab3e84401 packages/bus/tests/citation-guard.test.mjs +2c7a2102e2e0244876e41b664f4f706baefe3375100b956655551db1230f5da3 packages/bus/tests/citation-helpers.mjs +9768b6dc5ae078c5cc4f76473097287b74c5bc5853d39e1f57f153e646f861af packages/bus/tests/citation-runtime.test.mjs +abaeac64f2c3bf8ba83c9a4488edd9105c4707a6564560c5333d5421445653af packages/business/src/business.mjs +3a6044de5d1ca2cc35c5285b460c3e402b4274837e5d88b97f489797f6004903 packages/business/src/organization.mjs +4d2eb11beaa80175e524af1b95c81e7164990fba1d3e1754f5ba06eee390a14f packages/business/tests/reply-limits.test.mjs +a2bb98734bcc2556f8b2168f0faf8a89f7064c3f0aa49feb7d1975d596192f09 packages/cli/README.md +2f291a71f490f2741edada7a3e3788500f8976a08eb8ab1411f6c5982f778260 packages/cli/src/limits.mjs +f38af2d46d5f5f6388f599912507b94b87a0bf9dcc2104bb2187c38ee35118d5 packages/cli/tests/reply-limits.test.mjs +6ad72b4245e0a66e32725941900c1ece64c2e5de2fb73d65c8e042b4f3a691a6 packages/harness/src/runner.mjs +a5ef1b65230239a7baf6d0e8f2b8a51c0516348c7c4339a55b3f0a1a6ff531ba packages/harness/tests/citation-runner.test.mjs +330bc71bf6c7e64d3ddb70440903d2d9acf7878d44a49d7e30c2352ee4c807ec packages/harness/tests/fixtures/citation-adapter.mjs +f710d9600a17f6e2989a289cfe84e58f161d86c7306605946ce05fa71b364eb2 packages/library/src/guard.mjs +c0d630798914e300e461c247340533328e97119e54909c6a9406340e61fed8b7 packages/library/src/index.mjs +98ef45ed61144aaea44d8aea1ac43082b6d340297e46846d01772da38728e530 packages/library/src/limits.mjs +7b46f47b5e9d6b554b5d39bce2cd95c4610f5f35b8ab8fdc5a2864b3214be809 packages/library/src/reply-protocol.mjs +406146ebbce3710f308243b684a1c17e7626c1b65a4468489364317e31537a48 packages/library/tests/guard.test.mjs +39c8e6c8250a13fa43015fb2c407195e30ee642f729a9f6a644c38b4ea758a72 packages/seat/src/sandbox.mjs diff --git a/agents/beakley/work/queue-217/run-r2/mutants/M1-writer-fence.log b/agents/beakley/work/queue-217/run-r2/mutants/M1-writer-fence.log new file mode 100644 index 000000000..d49cc7a51 --- /dev/null +++ b/agents/beakley/work/queue-217/run-r2/mutants/M1-writer-fence.log @@ -0,0 +1,73 @@ +✔ C2-06 M11 human replacement works; omitted settings return to defaults (26.703775ms) +✖ C2-06 M11 agents and tester cannot change settings, including by changing human (12.156717ms) +✖ C2-06 M11 serialization cannot replace settings after the first fence (11.431272ms) +✖ C2-06 M11 an unrelated actor cannot appoint itself human and change reply limits (14.308135ms) +✔ C2-06 invalid setter values preserve the business and changes.jsonl (9.043165ms) +✔ C2-06 validator accepts hand-edited settings; raw reader fails closed on invalid files (9.576698ms) +ℹ tests 6 +ℹ suites 0 +ℹ pass 3 +ℹ fail 3 +ℹ cancelled 0 +ℹ skipped 0 +ℹ todo 0 +ℹ duration_ms 131.91294 + +✖ failing tests: + +test at packages/business/tests/reply-limits.test.mjs:34:1 +✖ C2-06 M11 agents and tester cannot change settings, including by changing human (12.156717ms) + AssertionError [ERR_ASSERTION]: Missing expected exception. + at refused (file:///mnt/storage/scratch/tmp/tNoueZ/row217-mutant-m6rnq3wd/packages/business/tests/reply-limits.test.mjs:22:10) + at TestContext. (file:///mnt/storage/scratch/tmp/tNoueZ/row217-mutant-m6rnq3wd/packages/business/tests/reply-limits.test.mjs:37:5) + at Test.runInAsyncScope (node:async_hooks:226:14) + at Test.run (node:internal/test_runner/test:1402:25) + at Test.processPendingSubtests (node:internal/test_runner/test:974:18) + at Test.postRun (node:internal/test_runner/test:1542:19) + at Test.run (node:internal/test_runner/test:1467:12) + at async startSubtestAfterBootstrap (node:internal/test_runner/harness:387:3) { + generatedMessage: false, + code: 'ERR_ASSERTION', + actual: undefined, + expected: { code: 'organization-reply-limits-human-only' }, + operator: 'throws', + diff: 'simple' + } + +test at packages/business/tests/reply-limits.test.mjs:43:1 +✖ C2-06 M11 serialization cannot replace settings after the first fence (11.431272ms) + AssertionError [ERR_ASSERTION]: Missing expected exception. + at refused (file:///mnt/storage/scratch/tmp/tNoueZ/row217-mutant-m6rnq3wd/packages/business/tests/reply-limits.test.mjs:22:10) + at TestContext. (file:///mnt/storage/scratch/tmp/tNoueZ/row217-mutant-m6rnq3wd/packages/business/tests/reply-limits.test.mjs:45:3) + at Test.runInAsyncScope (node:async_hooks:226:14) + at Test.run (node:internal/test_runner/test:1402:25) + at Test.processPendingSubtests (node:internal/test_runner/test:974:18) + at Test.postRun (node:internal/test_runner/test:1542:19) + at Test.run (node:internal/test_runner/test:1467:12) + at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) { + generatedMessage: false, + code: 'ERR_ASSERTION', + actual: undefined, + expected: { code: 'organization-reply-limits-human-only' }, + operator: 'throws', + diff: 'simple' + } + +test at packages/business/tests/reply-limits.test.mjs:52:1 +✖ C2-06 M11 an unrelated actor cannot appoint itself human and change reply limits (14.308135ms) + AssertionError [ERR_ASSERTION]: Missing expected exception. + at refused (file:///mnt/storage/scratch/tmp/tNoueZ/row217-mutant-m6rnq3wd/packages/business/tests/reply-limits.test.mjs:22:10) + at TestContext. (file:///mnt/storage/scratch/tmp/tNoueZ/row217-mutant-m6rnq3wd/packages/business/tests/reply-limits.test.mjs:54:3) + at Test.runInAsyncScope (node:async_hooks:226:14) + at Test.run (node:internal/test_runner/test:1402:25) + at Test.processPendingSubtests (node:internal/test_runner/test:974:18) + at Test.postRun (node:internal/test_runner/test:1542:19) + at Test.run (node:internal/test_runner/test:1467:12) + at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) { + generatedMessage: false, + code: 'ERR_ASSERTION', + actual: undefined, + expected: { code: 'organization-reply-limits-human-only' }, + operator: 'throws', + diff: 'simple' + } diff --git a/agents/beakley/work/queue-217/run-r2/mutants/M2-incoming-human-control.log b/agents/beakley/work/queue-217/run-r2/mutants/M2-incoming-human-control.log new file mode 100644 index 000000000..c0703fadc --- /dev/null +++ b/agents/beakley/work/queue-217/run-r2/mutants/M2-incoming-human-control.log @@ -0,0 +1,14 @@ +✔ C2-06 M11 human replacement works; omitted settings return to defaults (31.955623ms) +✔ C2-06 M11 agents and tester cannot change settings, including by changing human (22.832309ms) +✔ C2-06 M11 serialization cannot replace settings after the first fence (9.274775ms) +✔ C2-06 M11 an unrelated actor cannot appoint itself human and change reply limits (8.69039ms) +✔ C2-06 invalid setter values preserve the business and changes.jsonl (8.733202ms) +✔ C2-06 validator accepts hand-edited settings; raw reader fails closed on invalid files (10.441869ms) +ℹ tests 6 +ℹ suites 0 +ℹ pass 6 +ℹ fail 0 +ℹ cancelled 0 +ℹ skipped 0 +ℹ todo 0 +ℹ duration_ms 143.570268 diff --git a/agents/beakley/work/queue-217/run-r2/mutants/M2-incoming-human-restored-green.log b/agents/beakley/work/queue-217/run-r2/mutants/M2-incoming-human-restored-green.log new file mode 100644 index 000000000..7d56eeea6 --- /dev/null +++ b/agents/beakley/work/queue-217/run-r2/mutants/M2-incoming-human-restored-green.log @@ -0,0 +1,14 @@ +✔ C2-06 M11 human replacement works; omitted settings return to defaults (29.948602ms) +✔ C2-06 M11 agents and tester cannot change settings, including by changing human (22.139351ms) +✔ C2-06 M11 serialization cannot replace settings after the first fence (9.054641ms) +✔ C2-06 M11 an unrelated actor cannot appoint itself human and change reply limits (8.381635ms) +✔ C2-06 invalid setter values preserve the business and changes.jsonl (9.081946ms) +✔ C2-06 validator accepts hand-edited settings; raw reader fails closed on invalid files (10.33004ms) +ℹ tests 6 +ℹ suites 0 +ℹ pass 6 +ℹ fail 0 +ℹ cancelled 0 +ℹ skipped 0 +ℹ todo 0 +ℹ duration_ms 141.370383 diff --git a/agents/beakley/work/queue-217/run-r2/mutants/M2-incoming-human-restored.sha256 b/agents/beakley/work/queue-217/run-r2/mutants/M2-incoming-human-restored.sha256 new file mode 100644 index 000000000..2aefac75f --- /dev/null +++ b/agents/beakley/work/queue-217/run-r2/mutants/M2-incoming-human-restored.sha256 @@ -0,0 +1,23 @@ +eeca81ab965f9e94f930ee5f51d16f019af6368bc6c3994895e204f7a54ec8d2 packages/bus/src/broker.mjs +ad3c686a089f67f3c89610937c6fc9b32367cea5d9735125d89bef042082d4e8 packages/bus/src/client.mjs +36b05dd3119e5929211aa1cc5d45c5043f5a1c34567ddc7cac8f002835d44abe packages/bus/src/runtime.mjs +66b26d131a19f4f411686427274936850c1ff0aed11e9b281ae4aadcf4b289fc packages/bus/src/server.mjs +cdd0304ec25ef1ad3e31c52502fa46f2c80bd77c8d3c2e13f8ed4b5328f342c9 packages/bus/tests/citation-availability.test.mjs +2e05074cd9d15d810103658af3858161cee2af78b0a2e1ba910222fab3e84401 packages/bus/tests/citation-guard.test.mjs +2c7a2102e2e0244876e41b664f4f706baefe3375100b956655551db1230f5da3 packages/bus/tests/citation-helpers.mjs +9768b6dc5ae078c5cc4f76473097287b74c5bc5853d39e1f57f153e646f861af packages/bus/tests/citation-runtime.test.mjs +abaeac64f2c3bf8ba83c9a4488edd9105c4707a6564560c5333d5421445653af packages/business/src/business.mjs +3a6044de5d1ca2cc35c5285b460c3e402b4274837e5d88b97f489797f6004903 packages/business/src/organization.mjs +4d2eb11beaa80175e524af1b95c81e7164990fba1d3e1754f5ba06eee390a14f packages/business/tests/reply-limits.test.mjs +a2bb98734bcc2556f8b2168f0faf8a89f7064c3f0aa49feb7d1975d596192f09 packages/cli/README.md +2f291a71f490f2741edada7a3e3788500f8976a08eb8ab1411f6c5982f778260 packages/cli/src/limits.mjs +f38af2d46d5f5f6388f599912507b94b87a0bf9dcc2104bb2187c38ee35118d5 packages/cli/tests/reply-limits.test.mjs +6ad72b4245e0a66e32725941900c1ece64c2e5de2fb73d65c8e042b4f3a691a6 packages/harness/src/runner.mjs +a5ef1b65230239a7baf6d0e8f2b8a51c0516348c7c4339a55b3f0a1a6ff531ba packages/harness/tests/citation-runner.test.mjs +330bc71bf6c7e64d3ddb70440903d2d9acf7878d44a49d7e30c2352ee4c807ec packages/harness/tests/fixtures/citation-adapter.mjs +f710d9600a17f6e2989a289cfe84e58f161d86c7306605946ce05fa71b364eb2 packages/library/src/guard.mjs +c0d630798914e300e461c247340533328e97119e54909c6a9406340e61fed8b7 packages/library/src/index.mjs +98ef45ed61144aaea44d8aea1ac43082b6d340297e46846d01772da38728e530 packages/library/src/limits.mjs +7b46f47b5e9d6b554b5d39bce2cd95c4610f5f35b8ab8fdc5a2864b3214be809 packages/library/src/reply-protocol.mjs +406146ebbce3710f308243b684a1c17e7626c1b65a4468489364317e31537a48 packages/library/tests/guard.test.mjs +39c8e6c8250a13fa43015fb2c407195e30ee642f729a9f6a644c38b4ea758a72 packages/seat/src/sandbox.mjs diff --git a/agents/beakley/work/queue-217/run-r2/mutants/M2-incoming-human.log b/agents/beakley/work/queue-217/run-r2/mutants/M2-incoming-human.log new file mode 100644 index 000000000..f9981a260 --- /dev/null +++ b/agents/beakley/work/queue-217/run-r2/mutants/M2-incoming-human.log @@ -0,0 +1,35 @@ +✔ C2-06 M11 human replacement works; omitted settings return to defaults (28.334896ms) +✔ C2-06 M11 agents and tester cannot change settings, including by changing human (22.541196ms) +✔ C2-06 M11 serialization cannot replace settings after the first fence (8.304131ms) +✖ C2-06 M11 an unrelated actor cannot appoint itself human and change reply limits (11.712463ms) +✔ C2-06 invalid setter values preserve the business and changes.jsonl (8.875517ms) +✔ C2-06 validator accepts hand-edited settings; raw reader fails closed on invalid files (9.882976ms) +ℹ tests 6 +ℹ suites 0 +ℹ pass 5 +ℹ fail 1 +ℹ cancelled 0 +ℹ skipped 0 +ℹ todo 0 +ℹ duration_ms 140.418146 + +✖ failing tests: + +test at packages/business/tests/reply-limits.test.mjs:52:1 +✖ C2-06 M11 an unrelated actor cannot appoint itself human and change reply limits (11.712463ms) + AssertionError [ERR_ASSERTION]: Missing expected exception. + at refused (file:///mnt/storage/scratch/tmp/tNoueZ/row217-mutant-_aqjby1c/packages/business/tests/reply-limits.test.mjs:22:10) + at TestContext. (file:///mnt/storage/scratch/tmp/tNoueZ/row217-mutant-_aqjby1c/packages/business/tests/reply-limits.test.mjs:54:3) + at Test.runInAsyncScope (node:async_hooks:226:14) + at Test.run (node:internal/test_runner/test:1402:25) + at Test.processPendingSubtests (node:internal/test_runner/test:974:18) + at Test.postRun (node:internal/test_runner/test:1542:19) + at Test.run (node:internal/test_runner/test:1467:12) + at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) { + generatedMessage: false, + code: 'ERR_ASSERTION', + actual: undefined, + expected: { code: 'organization-reply-limits-human-only' }, + operator: 'throws', + diff: 'simple' + } diff --git a/agents/beakley/work/queue-217/run-r2/mutants/M3-split-check-transaction-control.log b/agents/beakley/work/queue-217/run-r2/mutants/M3-split-check-transaction-control.log new file mode 100644 index 000000000..f8b0441db --- /dev/null +++ b/agents/beakley/work/queue-217/run-r2/mutants/M3-split-check-transaction-control.log @@ -0,0 +1,21 @@ +✔ C2-06 coder send_message guard covers every table refusal; inserts nothing (118.943843ms) +✔ C2-06 research send_message guard covers every table refusal; inserts nothing (94.790271ms) +✔ C2-06 stored check carries the file author trailer at an unrelated cited tip (65.901789ms) +✔ C2-06 supporting cite cannot state canon, including a folder also marked playground (41.908138ms) +✔ C2-06 supporting file stores supporting scope and its real agent trailer (48.179621ms) +✔ C2-06 check evidence and insert are atomic when storing evidence fails (41.94764ms) +✔ C2-06 live limits change both directions; unreadable file keeps checks and exact fixed texts (56.521104ms) +✔ C2-06 page store is session-local, caps 20 fetches and 200 KiB, drops at disconnect (88.283371ms) +✔ C2-06 transport passes safe capped guard reason; ordinary refusal envelope is byte-identical (55.47311ms) +✔ C2-06 non-library businesses retain role.claim shape and unguarded free sends (26.321347ms) +✔ C2-06 thread messages carry file/last evidence with one read per distinct path (77.5591ms) +✔ C2-06 guarded request snapshot cannot change between check and insert (24.639839ms) +✔ C2-06 library.limits.set is human-only and invalid settings leave file and receipts unchanged (42.159103ms) +ℹ tests 13 +ℹ suites 0 +ℹ pass 13 +ℹ fail 0 +ℹ cancelled 0 +ℹ skipped 0 +ℹ todo 0 +ℹ duration_ms 866.146033 diff --git a/agents/beakley/work/queue-217/run-r2/mutants/M3-split-check-transaction-restored-green.log b/agents/beakley/work/queue-217/run-r2/mutants/M3-split-check-transaction-restored-green.log new file mode 100644 index 000000000..aed6bff67 --- /dev/null +++ b/agents/beakley/work/queue-217/run-r2/mutants/M3-split-check-transaction-restored-green.log @@ -0,0 +1,21 @@ +✔ C2-06 coder send_message guard covers every table refusal; inserts nothing (162.15169ms) +✔ C2-06 research send_message guard covers every table refusal; inserts nothing (151.110586ms) +✔ C2-06 stored check carries the file author trailer at an unrelated cited tip (100.984805ms) +✔ C2-06 supporting cite cannot state canon, including a folder also marked playground (81.389166ms) +✔ C2-06 supporting file stores supporting scope and its real agent trailer (92.148118ms) +✔ C2-06 check evidence and insert are atomic when storing evidence fails (78.197117ms) +✔ C2-06 live limits change both directions; unreadable file keeps checks and exact fixed texts (168.055107ms) +✔ C2-06 page store is session-local, caps 20 fetches and 200 KiB, drops at disconnect (271.850306ms) +✔ C2-06 transport passes safe capped guard reason; ordinary refusal envelope is byte-identical (92.491602ms) +✔ C2-06 non-library businesses retain role.claim shape and unguarded free sends (61.315017ms) +✔ C2-06 thread messages carry file/last evidence with one read per distinct path (126.633466ms) +✔ C2-06 guarded request snapshot cannot change between check and insert (61.436932ms) +✔ C2-06 library.limits.set is human-only and invalid settings leave file and receipts unchanged (118.486786ms) +ℹ tests 13 +ℹ suites 0 +ℹ pass 13 +ℹ fail 0 +ℹ cancelled 0 +ℹ skipped 0 +ℹ todo 0 +ℹ duration_ms 1649.634687 diff --git a/agents/beakley/work/queue-217/run-r2/mutants/M3-split-check-transaction-restored.sha256 b/agents/beakley/work/queue-217/run-r2/mutants/M3-split-check-transaction-restored.sha256 new file mode 100644 index 000000000..2aefac75f --- /dev/null +++ b/agents/beakley/work/queue-217/run-r2/mutants/M3-split-check-transaction-restored.sha256 @@ -0,0 +1,23 @@ +eeca81ab965f9e94f930ee5f51d16f019af6368bc6c3994895e204f7a54ec8d2 packages/bus/src/broker.mjs +ad3c686a089f67f3c89610937c6fc9b32367cea5d9735125d89bef042082d4e8 packages/bus/src/client.mjs +36b05dd3119e5929211aa1cc5d45c5043f5a1c34567ddc7cac8f002835d44abe packages/bus/src/runtime.mjs +66b26d131a19f4f411686427274936850c1ff0aed11e9b281ae4aadcf4b289fc packages/bus/src/server.mjs +cdd0304ec25ef1ad3e31c52502fa46f2c80bd77c8d3c2e13f8ed4b5328f342c9 packages/bus/tests/citation-availability.test.mjs +2e05074cd9d15d810103658af3858161cee2af78b0a2e1ba910222fab3e84401 packages/bus/tests/citation-guard.test.mjs +2c7a2102e2e0244876e41b664f4f706baefe3375100b956655551db1230f5da3 packages/bus/tests/citation-helpers.mjs +9768b6dc5ae078c5cc4f76473097287b74c5bc5853d39e1f57f153e646f861af packages/bus/tests/citation-runtime.test.mjs +abaeac64f2c3bf8ba83c9a4488edd9105c4707a6564560c5333d5421445653af packages/business/src/business.mjs +3a6044de5d1ca2cc35c5285b460c3e402b4274837e5d88b97f489797f6004903 packages/business/src/organization.mjs +4d2eb11beaa80175e524af1b95c81e7164990fba1d3e1754f5ba06eee390a14f packages/business/tests/reply-limits.test.mjs +a2bb98734bcc2556f8b2168f0faf8a89f7064c3f0aa49feb7d1975d596192f09 packages/cli/README.md +2f291a71f490f2741edada7a3e3788500f8976a08eb8ab1411f6c5982f778260 packages/cli/src/limits.mjs +f38af2d46d5f5f6388f599912507b94b87a0bf9dcc2104bb2187c38ee35118d5 packages/cli/tests/reply-limits.test.mjs +6ad72b4245e0a66e32725941900c1ece64c2e5de2fb73d65c8e042b4f3a691a6 packages/harness/src/runner.mjs +a5ef1b65230239a7baf6d0e8f2b8a51c0516348c7c4339a55b3f0a1a6ff531ba packages/harness/tests/citation-runner.test.mjs +330bc71bf6c7e64d3ddb70440903d2d9acf7878d44a49d7e30c2352ee4c807ec packages/harness/tests/fixtures/citation-adapter.mjs +f710d9600a17f6e2989a289cfe84e58f161d86c7306605946ce05fa71b364eb2 packages/library/src/guard.mjs +c0d630798914e300e461c247340533328e97119e54909c6a9406340e61fed8b7 packages/library/src/index.mjs +98ef45ed61144aaea44d8aea1ac43082b6d340297e46846d01772da38728e530 packages/library/src/limits.mjs +7b46f47b5e9d6b554b5d39bce2cd95c4610f5f35b8ab8fdc5a2864b3214be809 packages/library/src/reply-protocol.mjs +406146ebbce3710f308243b684a1c17e7626c1b65a4468489364317e31537a48 packages/library/tests/guard.test.mjs +39c8e6c8250a13fa43015fb2c407195e30ee642f729a9f6a644c38b4ea758a72 packages/seat/src/sandbox.mjs diff --git a/agents/beakley/work/queue-217/run-r2/mutants/M3-split-check-transaction.log b/agents/beakley/work/queue-217/run-r2/mutants/M3-split-check-transaction.log new file mode 100644 index 000000000..aa251f359 --- /dev/null +++ b/agents/beakley/work/queue-217/run-r2/mutants/M3-split-check-transaction.log @@ -0,0 +1,41 @@ +✔ C2-06 coder send_message guard covers every table refusal; inserts nothing (121.738375ms) +✔ C2-06 research send_message guard covers every table refusal; inserts nothing (94.199334ms) +✔ C2-06 stored check carries the file author trailer at an unrelated cited tip (59.307121ms) +✔ C2-06 supporting cite cannot state canon, including a folder also marked playground (41.252933ms) +✔ C2-06 supporting file stores supporting scope and its real agent trailer (48.700382ms) +✖ C2-06 check evidence and insert are atomic when storing evidence fails (42.434516ms) +✔ C2-06 live limits change both directions; unreadable file keeps checks and exact fixed texts (56.552861ms) +✔ C2-06 page store is session-local, caps 20 fetches and 200 KiB, drops at disconnect (88.426285ms) +✔ C2-06 transport passes safe capped guard reason; ordinary refusal envelope is byte-identical (54.352185ms) +✔ C2-06 non-library businesses retain role.claim shape and unguarded free sends (26.064514ms) +✔ C2-06 thread messages carry file/last evidence with one read per distinct path (81.176348ms) +✔ C2-06 guarded request snapshot cannot change between check and insert (25.324993ms) +✔ C2-06 library.limits.set is human-only and invalid settings leave file and receipts unchanged (42.147552ms) +ℹ tests 13 +ℹ suites 0 +ℹ pass 12 +ℹ fail 1 +ℹ cancelled 0 +ℹ skipped 0 +ℹ todo 0 +ℹ duration_ms 872.02572 + +✖ failing tests: + +test at packages/bus/tests/citation-guard.test.mjs:71:1 +✖ C2-06 check evidence and insert are atomic when storing evidence fails (42.434516ms) + AssertionError [ERR_ASSERTION]: Expected values to be strictly equal: + + 1 !== 0 + + at TestContext. (file:///mnt/storage/scratch/tmp/tNoueZ/row217-mutant-etkv3bqf/packages/bus/tests/citation-guard.test.mjs:76:10) + at process.processTicksAndRejections (node:internal/process/task_queues:104:5) + at async Test.run (node:internal/test_runner/test:1409:7) + at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) { + generatedMessage: true, + code: 'ERR_ASSERTION', + actual: 1, + expected: 0, + operator: 'strictEqual', + diff: 'simple' + } diff --git a/agents/beakley/work/queue-217/run-r2/mutants/M4-drop-client-reason-control.log b/agents/beakley/work/queue-217/run-r2/mutants/M4-drop-client-reason-control.log new file mode 100644 index 000000000..2174540ed --- /dev/null +++ b/agents/beakley/work/queue-217/run-r2/mutants/M4-drop-client-reason-control.log @@ -0,0 +1,21 @@ +✔ C2-06 coder send_message guard covers every table refusal; inserts nothing (107.311079ms) +✔ C2-06 research send_message guard covers every table refusal; inserts nothing (92.235404ms) +✔ C2-06 stored check carries the file author trailer at an unrelated cited tip (59.017311ms) +✔ C2-06 supporting cite cannot state canon, including a folder also marked playground (41.107066ms) +✔ C2-06 supporting file stores supporting scope and its real agent trailer (47.696908ms) +✔ C2-06 check evidence and insert are atomic when storing evidence fails (41.214066ms) +✔ C2-06 live limits change both directions; unreadable file keeps checks and exact fixed texts (54.665908ms) +✔ C2-06 page store is session-local, caps 20 fetches and 200 KiB, drops at disconnect (86.001777ms) +✔ C2-06 transport passes safe capped guard reason; ordinary refusal envelope is byte-identical (55.168942ms) +✔ C2-06 non-library businesses retain role.claim shape and unguarded free sends (26.744539ms) +✔ C2-06 thread messages carry file/last evidence with one read per distinct path (79.212003ms) +✔ C2-06 guarded request snapshot cannot change between check and insert (24.722314ms) +✔ C2-06 library.limits.set is human-only and invalid settings leave file and receipts unchanged (41.933148ms) +ℹ tests 13 +ℹ suites 0 +ℹ pass 13 +ℹ fail 0 +ℹ cancelled 0 +ℹ skipped 0 +ℹ todo 0 +ℹ duration_ms 841.716764 diff --git a/agents/beakley/work/queue-217/run-r2/mutants/M4-drop-client-reason-restored-green.log b/agents/beakley/work/queue-217/run-r2/mutants/M4-drop-client-reason-restored-green.log new file mode 100644 index 000000000..e7b119a6e --- /dev/null +++ b/agents/beakley/work/queue-217/run-r2/mutants/M4-drop-client-reason-restored-green.log @@ -0,0 +1,21 @@ +✔ C2-06 coder send_message guard covers every table refusal; inserts nothing (110.781773ms) +✔ C2-06 research send_message guard covers every table refusal; inserts nothing (91.548051ms) +✔ C2-06 stored check carries the file author trailer at an unrelated cited tip (57.119223ms) +✔ C2-06 supporting cite cannot state canon, including a folder also marked playground (40.819326ms) +✔ C2-06 supporting file stores supporting scope and its real agent trailer (47.776616ms) +✔ C2-06 check evidence and insert are atomic when storing evidence fails (41.268825ms) +✔ C2-06 live limits change both directions; unreadable file keeps checks and exact fixed texts (53.375873ms) +✔ C2-06 page store is session-local, caps 20 fetches and 200 KiB, drops at disconnect (82.822565ms) +✔ C2-06 transport passes safe capped guard reason; ordinary refusal envelope is byte-identical (54.131458ms) +✔ C2-06 non-library businesses retain role.claim shape and unguarded free sends (26.350984ms) +✔ C2-06 thread messages carry file/last evidence with one read per distinct path (80.819295ms) +✔ C2-06 guarded request snapshot cannot change between check and insert (26.401011ms) +✔ C2-06 library.limits.set is human-only and invalid settings leave file and receipts unchanged (41.116925ms) +ℹ tests 13 +ℹ suites 0 +ℹ pass 13 +ℹ fail 0 +ℹ cancelled 0 +ℹ skipped 0 +ℹ todo 0 +ℹ duration_ms 839.688386 diff --git a/agents/beakley/work/queue-217/run-r2/mutants/M4-drop-client-reason-restored.sha256 b/agents/beakley/work/queue-217/run-r2/mutants/M4-drop-client-reason-restored.sha256 new file mode 100644 index 000000000..2aefac75f --- /dev/null +++ b/agents/beakley/work/queue-217/run-r2/mutants/M4-drop-client-reason-restored.sha256 @@ -0,0 +1,23 @@ +eeca81ab965f9e94f930ee5f51d16f019af6368bc6c3994895e204f7a54ec8d2 packages/bus/src/broker.mjs +ad3c686a089f67f3c89610937c6fc9b32367cea5d9735125d89bef042082d4e8 packages/bus/src/client.mjs +36b05dd3119e5929211aa1cc5d45c5043f5a1c34567ddc7cac8f002835d44abe packages/bus/src/runtime.mjs +66b26d131a19f4f411686427274936850c1ff0aed11e9b281ae4aadcf4b289fc packages/bus/src/server.mjs +cdd0304ec25ef1ad3e31c52502fa46f2c80bd77c8d3c2e13f8ed4b5328f342c9 packages/bus/tests/citation-availability.test.mjs +2e05074cd9d15d810103658af3858161cee2af78b0a2e1ba910222fab3e84401 packages/bus/tests/citation-guard.test.mjs +2c7a2102e2e0244876e41b664f4f706baefe3375100b956655551db1230f5da3 packages/bus/tests/citation-helpers.mjs +9768b6dc5ae078c5cc4f76473097287b74c5bc5853d39e1f57f153e646f861af packages/bus/tests/citation-runtime.test.mjs +abaeac64f2c3bf8ba83c9a4488edd9105c4707a6564560c5333d5421445653af packages/business/src/business.mjs +3a6044de5d1ca2cc35c5285b460c3e402b4274837e5d88b97f489797f6004903 packages/business/src/organization.mjs +4d2eb11beaa80175e524af1b95c81e7164990fba1d3e1754f5ba06eee390a14f packages/business/tests/reply-limits.test.mjs +a2bb98734bcc2556f8b2168f0faf8a89f7064c3f0aa49feb7d1975d596192f09 packages/cli/README.md +2f291a71f490f2741edada7a3e3788500f8976a08eb8ab1411f6c5982f778260 packages/cli/src/limits.mjs +f38af2d46d5f5f6388f599912507b94b87a0bf9dcc2104bb2187c38ee35118d5 packages/cli/tests/reply-limits.test.mjs +6ad72b4245e0a66e32725941900c1ece64c2e5de2fb73d65c8e042b4f3a691a6 packages/harness/src/runner.mjs +a5ef1b65230239a7baf6d0e8f2b8a51c0516348c7c4339a55b3f0a1a6ff531ba packages/harness/tests/citation-runner.test.mjs +330bc71bf6c7e64d3ddb70440903d2d9acf7878d44a49d7e30c2352ee4c807ec packages/harness/tests/fixtures/citation-adapter.mjs +f710d9600a17f6e2989a289cfe84e58f161d86c7306605946ce05fa71b364eb2 packages/library/src/guard.mjs +c0d630798914e300e461c247340533328e97119e54909c6a9406340e61fed8b7 packages/library/src/index.mjs +98ef45ed61144aaea44d8aea1ac43082b6d340297e46846d01772da38728e530 packages/library/src/limits.mjs +7b46f47b5e9d6b554b5d39bce2cd95c4610f5f35b8ab8fdc5a2864b3214be809 packages/library/src/reply-protocol.mjs +406146ebbce3710f308243b684a1c17e7626c1b65a4468489364317e31537a48 packages/library/tests/guard.test.mjs +39c8e6c8250a13fa43015fb2c407195e30ee642f729a9f6a644c38b4ea758a72 packages/seat/src/sandbox.mjs diff --git a/agents/beakley/work/queue-217/run-r2/mutants/M4-drop-client-reason.log b/agents/beakley/work/queue-217/run-r2/mutants/M4-drop-client-reason.log new file mode 100644 index 000000000..477e1e1e1 --- /dev/null +++ b/agents/beakley/work/queue-217/run-r2/mutants/M4-drop-client-reason.log @@ -0,0 +1,47 @@ +✔ C2-06 coder send_message guard covers every table refusal; inserts nothing (109.280676ms) +✔ C2-06 research send_message guard covers every table refusal; inserts nothing (94.019544ms) +✔ C2-06 stored check carries the file author trailer at an unrelated cited tip (58.84355ms) +✔ C2-06 supporting cite cannot state canon, including a folder also marked playground (42.275234ms) +✔ C2-06 supporting file stores supporting scope and its real agent trailer (48.954969ms) +✔ C2-06 check evidence and insert are atomic when storing evidence fails (41.628985ms) +✔ C2-06 live limits change both directions; unreadable file keeps checks and exact fixed texts (54.367118ms) +✔ C2-06 page store is session-local, caps 20 fetches and 200 KiB, drops at disconnect (85.049228ms) +✖ C2-06 transport passes safe capped guard reason; ordinary refusal envelope is byte-identical (53.346085ms) +✔ C2-06 non-library businesses retain role.claim shape and unguarded free sends (26.218776ms) +✔ C2-06 thread messages carry file/last evidence with one read per distinct path (78.373306ms) +✔ C2-06 guarded request snapshot cannot change between check and insert (24.622347ms) +✔ C2-06 library.limits.set is human-only and invalid settings leave file and receipts unchanged (41.8227ms) +ℹ tests 13 +ℹ suites 0 +ℹ pass 12 +ℹ fail 1 +ℹ cancelled 0 +ℹ skipped 0 +ℹ todo 0 +ℹ duration_ms 840.560306 + +✖ failing tests: + +test at packages/bus/tests/citation-guard.test.mjs:116:1 +✖ C2-06 transport passes safe capped guard reason; ordinary refusal envelope is byte-identical (53.346085ms) + AssertionError [ERR_ASSERTION]: The validation function is expected to return "true". Received false + + Caught error: + + Error: citation-invalid + at process.processTicksAndRejections (node:internal/process/task_queues:104:5) + at async TestContext. (file:///mnt/storage/scratch/tmp/tNoueZ/row217-mutant-db3vgbd1/packages/bus/tests/citation-guard.test.mjs:121:3) + at async Test.run (node:internal/test_runner/test:1409:7) + at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) { + generatedMessage: true, + code: 'ERR_ASSERTION', + actual: Error: citation-invalid + at Socket. (file:///mnt/storage/scratch/tmp/tNoueZ/row217-mutant-db3vgbd1/packages/bus/src/client.mjs:45:17) + at Socket.emit (node:events:514:20) + at addChunk (node:internal/streams/readable:575:12) + at readableAddChunkPushByteMode (node:internal/streams/readable:526:3) + at Readable.push (node:internal/streams/readable:406:5) + at Pipe.onStreamRead (node:internal/stream_base_commons:189:23), + operator: 'rejects', + diff: 'simple' + } diff --git a/agents/beakley/work/queue-217/run-r2/mutants/M5-hide-library-unavailable-control.log b/agents/beakley/work/queue-217/run-r2/mutants/M5-hide-library-unavailable-control.log new file mode 100644 index 000000000..3ab246bb0 --- /dev/null +++ b/agents/beakley/work/queue-217/run-r2/mutants/M5-hide-library-unavailable-control.log @@ -0,0 +1,11 @@ +✔ C2-06 held library lock gives the agent citation-unavailable and its retry reason (5143.590096ms) +✔ C2-06 malformed sync state is availability failure, never a fabricated invalid cite (33.560438ms) +✔ C2-06 no mirror or freshly initialized empty mirror still means no served citation (31.849587ms) +ℹ tests 3 +ℹ suites 0 +ℹ pass 3 +ℹ fail 0 +ℹ cancelled 0 +ℹ skipped 0 +ℹ todo 0 +ℹ duration_ms 5290.343804 diff --git a/agents/beakley/work/queue-217/run-r2/mutants/M5-hide-library-unavailable-restored-green.log b/agents/beakley/work/queue-217/run-r2/mutants/M5-hide-library-unavailable-restored-green.log new file mode 100644 index 000000000..37663b160 --- /dev/null +++ b/agents/beakley/work/queue-217/run-r2/mutants/M5-hide-library-unavailable-restored-green.log @@ -0,0 +1,11 @@ +✔ C2-06 held library lock gives the agent citation-unavailable and its retry reason (5131.56715ms) +✔ C2-06 malformed sync state is availability failure, never a fabricated invalid cite (32.560014ms) +✔ C2-06 no mirror or freshly initialized empty mirror still means no served citation (31.756895ms) +ℹ tests 3 +ℹ suites 0 +ℹ pass 3 +ℹ fail 0 +ℹ cancelled 0 +ℹ skipped 0 +ℹ todo 0 +ℹ duration_ms 5271.350019 diff --git a/agents/beakley/work/queue-217/run-r2/mutants/M5-hide-library-unavailable-restored.sha256 b/agents/beakley/work/queue-217/run-r2/mutants/M5-hide-library-unavailable-restored.sha256 new file mode 100644 index 000000000..2aefac75f --- /dev/null +++ b/agents/beakley/work/queue-217/run-r2/mutants/M5-hide-library-unavailable-restored.sha256 @@ -0,0 +1,23 @@ +eeca81ab965f9e94f930ee5f51d16f019af6368bc6c3994895e204f7a54ec8d2 packages/bus/src/broker.mjs +ad3c686a089f67f3c89610937c6fc9b32367cea5d9735125d89bef042082d4e8 packages/bus/src/client.mjs +36b05dd3119e5929211aa1cc5d45c5043f5a1c34567ddc7cac8f002835d44abe packages/bus/src/runtime.mjs +66b26d131a19f4f411686427274936850c1ff0aed11e9b281ae4aadcf4b289fc packages/bus/src/server.mjs +cdd0304ec25ef1ad3e31c52502fa46f2c80bd77c8d3c2e13f8ed4b5328f342c9 packages/bus/tests/citation-availability.test.mjs +2e05074cd9d15d810103658af3858161cee2af78b0a2e1ba910222fab3e84401 packages/bus/tests/citation-guard.test.mjs +2c7a2102e2e0244876e41b664f4f706baefe3375100b956655551db1230f5da3 packages/bus/tests/citation-helpers.mjs +9768b6dc5ae078c5cc4f76473097287b74c5bc5853d39e1f57f153e646f861af packages/bus/tests/citation-runtime.test.mjs +abaeac64f2c3bf8ba83c9a4488edd9105c4707a6564560c5333d5421445653af packages/business/src/business.mjs +3a6044de5d1ca2cc35c5285b460c3e402b4274837e5d88b97f489797f6004903 packages/business/src/organization.mjs +4d2eb11beaa80175e524af1b95c81e7164990fba1d3e1754f5ba06eee390a14f packages/business/tests/reply-limits.test.mjs +a2bb98734bcc2556f8b2168f0faf8a89f7064c3f0aa49feb7d1975d596192f09 packages/cli/README.md +2f291a71f490f2741edada7a3e3788500f8976a08eb8ab1411f6c5982f778260 packages/cli/src/limits.mjs +f38af2d46d5f5f6388f599912507b94b87a0bf9dcc2104bb2187c38ee35118d5 packages/cli/tests/reply-limits.test.mjs +6ad72b4245e0a66e32725941900c1ece64c2e5de2fb73d65c8e042b4f3a691a6 packages/harness/src/runner.mjs +a5ef1b65230239a7baf6d0e8f2b8a51c0516348c7c4339a55b3f0a1a6ff531ba packages/harness/tests/citation-runner.test.mjs +330bc71bf6c7e64d3ddb70440903d2d9acf7878d44a49d7e30c2352ee4c807ec packages/harness/tests/fixtures/citation-adapter.mjs +f710d9600a17f6e2989a289cfe84e58f161d86c7306605946ce05fa71b364eb2 packages/library/src/guard.mjs +c0d630798914e300e461c247340533328e97119e54909c6a9406340e61fed8b7 packages/library/src/index.mjs +98ef45ed61144aaea44d8aea1ac43082b6d340297e46846d01772da38728e530 packages/library/src/limits.mjs +7b46f47b5e9d6b554b5d39bce2cd95c4610f5f35b8ab8fdc5a2864b3214be809 packages/library/src/reply-protocol.mjs +406146ebbce3710f308243b684a1c17e7626c1b65a4468489364317e31537a48 packages/library/tests/guard.test.mjs +39c8e6c8250a13fa43015fb2c407195e30ee642f729a9f6a644c38b4ea758a72 packages/seat/src/sandbox.mjs diff --git a/agents/beakley/work/queue-217/run-r2/mutants/M5-hide-library-unavailable.log b/agents/beakley/work/queue-217/run-r2/mutants/M5-hide-library-unavailable.log new file mode 100644 index 000000000..c87c8f0d5 --- /dev/null +++ b/agents/beakley/work/queue-217/run-r2/mutants/M5-hide-library-unavailable.log @@ -0,0 +1,70 @@ +✖ C2-06 held library lock gives the agent citation-unavailable and its retry reason (5104.72293ms) +✖ C2-06 malformed sync state is availability failure, never a fabricated invalid cite (35.117198ms) +✔ C2-06 no mirror or freshly initialized empty mirror still means no served citation (31.286656ms) +ℹ tests 3 +ℹ suites 0 +ℹ pass 1 +ℹ fail 2 +ℹ cancelled 0 +ℹ skipped 0 +ℹ todo 0 +ℹ duration_ms 5250.151124 + +✖ failing tests: + +test at packages/bus/tests/citation-availability.test.mjs:13:1 +✖ C2-06 held library lock gives the agent citation-unavailable and its retry reason (5104.72293ms) + AssertionError [ERR_ASSERTION]: Expected values to be strictly equal: + + actual - expected + + + 'citation-invalid' + - 'citation-unavailable' + ^ + + at Object. (file:///mnt/storage/scratch/tmp/tNoueZ/row217-mutant-xglaeqeb/packages/bus/tests/citation-availability.test.mjs:29:14) + at expectedException (node:assert:547:17) + at expectsError (node:assert:672:21) + at strict.rejects (node:assert:738:3) + at process.processTicksAndRejections (node:internal/process/task_queues:104:5) + at async file:///mnt/storage/scratch/tmp/tNoueZ/row217-mutant-xglaeqeb/packages/bus/tests/citation-availability.test.mjs:28:5 + at async withLibraryLock (file:///mnt/storage/scratch/tmp/tNoueZ/row217-mutant-xglaeqeb/packages/library/src/mirror.mjs:171:18) + at async TestContext. (file:///mnt/storage/scratch/tmp/tNoueZ/row217-mutant-xglaeqeb/packages/bus/tests/citation-availability.test.mjs:27:3) + at async Test.run (node:internal/test_runner/test:1409:7) + at async startSubtestAfterBootstrap (node:internal/test_runner/harness:387:3) { + generatedMessage: true, + code: 'ERR_ASSERTION', + actual: 'citation-invalid', + expected: 'citation-unavailable', + operator: 'strictEqual', + diff: 'simple' + } + +test at packages/bus/tests/citation-availability.test.mjs:40:1 +✖ C2-06 malformed sync state is availability failure, never a fabricated invalid cite (35.117198ms) + AssertionError [ERR_ASSERTION]: Expected values to be strictly deep-equal: + + actual - expected + + Comparison { + + code: 'citation-invalid' + - code: 'citation-unavailable' + } + + at process.processTicksAndRejections (node:internal/process/task_queues:104:5) + at async TestContext. (file:///mnt/storage/scratch/tmp/tNoueZ/row217-mutant-xglaeqeb/packages/bus/tests/citation-availability.test.mjs:45:3) + at async Test.run (node:internal/test_runner/test:1409:7) + at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) { + generatedMessage: true, + code: 'ERR_ASSERTION', + actual: Error: citation-invalid: citation 1 (Book One/Characters/Mara Vell.md) isn't an indexed file at a commit reachable from the served commit + at refuse (file:///mnt/storage/scratch/tmp/tNoueZ/row217-mutant-xglaeqeb/packages/library/src/guard.mjs:24:42) + at checkReply (file:///mnt/storage/scratch/tmp/tNoueZ/row217-mutant-xglaeqeb/packages/library/src/guard.mjs:80:25) + at process.processTicksAndRejections (node:internal/process/task_queues:104:5) + at async waitForActual (node:assert:615:5) + at async strict.rejects (node:assert:738:25) + at async TestContext. (file:///mnt/storage/scratch/tmp/tNoueZ/row217-mutant-xglaeqeb/packages/bus/tests/citation-availability.test.mjs:45:3) + at async Test.run (node:internal/test_runner/test:1409:7) + at async Test.processPendingSubtests (node:internal/test_runner/test:974:7), + expected: { code: 'citation-unavailable' }, + operator: 'rejects', + diff: 'simple' + } diff --git a/agents/beakley/work/queue-217/run-r2/mutants/summary.txt b/agents/beakley/work/queue-217/run-r2/mutants/summary.txt new file mode 100644 index 000000000..b7461051e --- /dev/null +++ b/agents/beakley/work/queue-217/run-r2/mutants/summary.txt @@ -0,0 +1,5 @@ +M1-writer-fence: killed (control green, mutant exit 1, hashes restored, restored green) +M2-incoming-human: killed (control green, mutant exit 1, hashes restored, restored green) +M3-split-check-transaction: killed (control green, mutant exit 1, hashes restored, restored green) +M5-hide-library-unavailable: killed (control green, mutant exit 1, hashes restored, restored green) +M4-drop-client-reason: killed (control green, mutant exit 1, hashes restored, restored green) diff --git a/agents/beakley/work/queue-217/run-r2/npm-root.log b/agents/beakley/work/queue-217/run-r2/npm-root.log new file mode 100644 index 000000000..488ce43f3 --- /dev/null +++ b/agents/beakley/work/queue-217/run-r2/npm-root.log @@ -0,0 +1,3 @@ +npm warn deprecated node-domexception@1.0.0: Use your platform's native DOMException instead + +added 128 packages in 2s diff --git a/agents/beakley/work/queue-217/run-r2/npm-webui.log b/agents/beakley/work/queue-217/run-r2/npm-webui.log new file mode 100644 index 000000000..9e1938b4b --- /dev/null +++ b/agents/beakley/work/queue-217/run-r2/npm-webui.log @@ -0,0 +1,2 @@ + +added 2 packages in 205ms diff --git a/agents/beakley/work/queue-217/run-r2/runtime-fixture-retry.log b/agents/beakley/work/queue-217/run-r2/runtime-fixture-retry.log new file mode 100644 index 000000000..ac25b8882 --- /dev/null +++ b/agents/beakley/work/queue-217/run-r2/runtime-fixture-retry.log @@ -0,0 +1,9 @@ +✔ C2-06 runtime reads changed and unreadable reply limits without restarting (118.083931ms) +ℹ tests 1 +ℹ suites 0 +ℹ pass 1 +ℹ fail 0 +ℹ cancelled 0 +ℹ skipped 0 +ℹ todo 0 +ℹ duration_ms 227.817729 diff --git a/agents/beakley/work/queue-217/run-r2/seat-suite.log b/agents/beakley/work/queue-217/run-r2/seat-suite.log new file mode 100644 index 000000000..520c6ec61 --- /dev/null +++ b/agents/beakley/work/queue-217/run-r2/seat-suite.log @@ -0,0 +1,234 @@ +npm notice run @mosaic/seat@0.1.0 test +npm notice run node --test tests/ +✔ C2-04: ensureCheckouts skips a library before a real clone and leaves no books path (66.766764ms) +✔ a first launch clones the root at its branch, with the root's path as origin (47.521672ms) +✔ the clone is not at its place until git clone has finished (31.999361ms) +✔ a later launch fast-forwards a clean clone after a commit to the root, then finds it current (87.563022ms) +✔ a clone ahead of the root keeps its commits and counts as current (53.447311ms) +▶ a dirty clone and one on another branch are fetched, and nothing but refs/remotes moves + ✔ a modified file (53.258759ms) + ✔ an untracked file (52.286642ms) + ✔ a staged file (55.132154ms) + ✔ another branch (53.48074ms) + ✔ a detached HEAD (54.504119ms) +✔ a dirty clone and one on another branch are fetched, and nothing but refs/remotes moves (269.989404ms) +✔ a diverged clone gets the fetch into refs/remotes and is kept, not-fast-forward (53.461206ms) +▶ a clone kept before the branch check, or for a failed status, gets no fetch + ✔ not-a-clone (27.485728ms) + ✔ hooks-present (31.094616ms) + ✔ submodule (38.060187ms) + ✔ config-changed (36.195255ms) + ✔ root-unreadable (36.385271ms) + ✔ root-detached (39.627905ms) + ✔ status-failed, on the root's branch and clean (42.704327ms) + ✔ status-failed, dirty (44.881211ms) +✔ a clone kept before the branch check, or for a failed status, gets no fetch (297.899967ms) +✔ a dirty clone whose fetch fails is kept, fetch-failed, exactly as it was (47.755395ms) +✔ every git call the host makes, for a new clone and an existing one, carries maintenance.auto=false and gc.auto=0 (57.603139ms) +✔ a clone with loose objects enough for gc --auto gets no maintenance or gc from the fetch and the merge (89.466874ms) +▶ a clone with user.name or user.email in its config is kept, and git runs nothing in it + ✔ user.name (28.628791ms) + ✔ user.email (30.423895ms) +✔ a clone with user.name or user.email in its config is kept, and git runs nothing in it (59.627127ms) +✔ a commit git can't read after the fast-forward is null (57.084762ms) +✔ a new clone whose commit can't be read refuses the launch and leaves nothing behind (21.081119ms) +▶ a clone the session rigged is kept, and git runs nothing and writes nothing outside it + ✔ core.fsmonitor (39.453854ms) + ✔ core.hooksPath (34.616469ms) + ✔ a hook file (35.090442ms) + ✔ include.path (34.527401ms) + ✔ includeIf (35.13899ms) + ✔ a filter driver (34.195382ms) + ✔ origin moved (37.391948ms) + ✔ a second origin url (35.731817ms) + ✔ the origin url twice, both the root (33.999145ms) + ✔ an ext:: origin (31.652835ms) + ✔ a branch tracking another remote (33.3147ms) + ✔ a branch merging a tag (33.72502ms) + ✔ a fetch line onto local branches (34.126505ms) + ✔ no origin (32.973963ms) + ✔ a config file over the size cap (30.967833ms) + ✔ config a symlink to /dev/zero (31.51332ms) + ✔ the clone a symlink to the bait (32.976685ms) + ✔ the clone a file (39.528201ms) + ✔ the clone a plain directory (32.193931ms) + ✔ .git a gitdir: file (31.732811ms) + ✔ .git a symlink (36.499471ms) + ✔ .git/logs a symlink (34.327705ms) + ✔ .git/refs/heads a symlink (30.308688ms) + ✔ .git/objects a symlink (28.895664ms) + ✔ a reflog hard-linked to a file outside (28.33422ms) + ✔ HEAD a fifo (29.791372ms) + ✔ a commondir file (30.182546ms) + ✔ an alternates file (30.414863ms) + ✔ a gitlink staged, no .gitmodules (42.003032ms) + ✔ a gitlink and .gitmodules staged (47.484582ms) + ✔ a gitlink to a repository with its own gitlink (53.625899ms) + ✔ a gitlink and .gitmodules committed (45.90129ms) + ✔ a gitlink and submodule.active in config (43.005636ms) + ✔ a .git/modules with no gitlink (31.240083ms) +✔ a clone the session rigged is kept, and git runs nothing and writes nothing outside it (1201.693467ms) +▶ a root that can't be cloned refuses with the project id and leaves nothing behind + ✔ missing (9.543898ms) + ✔ not a repository (9.15995ms) + ✔ a plain directory inside another repository (13.291966ms) + ✔ unreadable (10.409599ms) + ✔ on no branch (11.130486ms) + ✔ missing an object (14.936384ms) +✔ a root that can't be cloned refuses with the project id and leaves nothing behind (69.273079ms) +✔ a clone whose root is on no branch, or gone, is kept and named (28.705151ms) +✔ no credential or forge remote of the root reaches a clone (46.990023ms) +✔ every project in the business file gets its own clone at its own branch (32.655381ms) +✔ a clone past its time gets SIGTERM and refuses the launch, with nothing left in the workspace (514.003804ms) +✔ a clone that ignores SIGTERM gets SIGKILL once the grace period is over (1016.843724ms) +✔ a timeout signals git's process group, so a process git started dies with it (515.051887ms) +✔ once a signalled git has closed, its group gets SIGKILL, so a process that ignored SIGTERM dies too (514.556145ms) +✔ the budget is the setting's whole number of bytes from 1 MiB to 1 GiB, and the default for anything else (1.567727ms) +✔ a stream past the default budget is not-collected with a lower bound, and a later collection catches up (65.101994ms) +✔ a budget smaller than the streams counts over several collections, once each, and is known when it catches up (2.599724ms) +✔ a line split across reads counts once (9.33078ms) +✔ Claude history from before the ledger makes the first Pi collection harness-unsupported, for good (1.440992ms) +✔ an empty claude-projects/ is no Claude history, and one filled after the ledger exists isn't checked (1.428192ms) +✔ a claude-projects/ that can't be read records nothing, and the next collection checks again (1.330216ms) +✔ the stream cap is the setting's whole number from 32 to 65536, and the default for anything else (0.16791ms) +✔ more streams than the cap is not-collected, with cursors only for the streams opened, and a larger cap catches up (2.344595ms) +✔ the default cap opens STREAMS streams and writes no more cursor lines than that (52.65919ms) +✔ row 307 the known ledger row 270 wrote reads the same count (4.720302ms) +✔ row 307 after the known ledger, one collection through pi's module answers the next count (3.122956ms) +✔ row 307 the store-incomplete ledger row 270 wrote reads the same count (1.172174ms) +✔ row 307 after the store-incomplete ledger, one collection through pi's module answers the next count (1.473641ms) +✔ row 307 the store-unreadable ledger row 270 wrote reads the same count (1.233218ms) +✔ row 307 after the store-unreadable ledger, one collection through pi's module answers the next count (1.478165ms) +✔ row 307 the not-collected ledger row 270 wrote reads the same count (1.059533ms) +✔ row 307 after the not-collected ledger, one collection through pi's module answers the next count (2.381792ms) +✔ row 307 the claude-code ledger row 270 wrote reads the same count (1.16785ms) +✔ row 307 after the claude-code ledger, one collection through pi's module answers the next count (1.422304ms) +✔ row 307 the claude-history ledger row 270 wrote reads the same count (2.943093ms) +✔ row 307 after the claude-history ledger, one collection through pi's module answers the next count (1.5333ms) +✔ row 307 the torn ledger row 270 wrote reads the same count (1.006203ms) +✔ row 307 after the torn ledger, one collection through pi's module answers the next count (2.284545ms) +✔ row 307 core refuses an answer outside the contract and appends nothing (8.468181ms) +✔ row 307 the module gets the store's two native directories, a copy of the cursors, the budget, the cap and first (2.320411ms) +✔ an empty store, a store with no compaction and a failed start count 0, known (7.138038ms) +✔ one and three completed compactions (2.441636ms) +✔ a compaction copied into a branched stream counts once, under the stream it was first seen in (3.056ms) +✔ one collection over two streams holding the same copy counts it once and writes it once (1.831681ms) +✔ the same entry id at another time in another stream is another compaction (1.582065ms) +✔ resume: each collection reads past its cursor and writes a key once (2.114301ms) +✔ a partial trailing line waits for its newline (1.624959ms) +✔ a missing ledger is not-collected and an unreadable one store-unreadable, never 0 (1.322325ms) +✔ a symlinked ledger is store-unreadable and is not written through (1.293154ms) +✔ a torn last ledger line makes the count unknown, a lower bound, and stays so (2.167108ms) +✔ a bad ledger line in the middle makes the count unknown (3.331232ms) +▶ a stream that shrank, changed under its cursor or went away is store-incomplete for good + ✔ shrink (2.038847ms) + ✔ rewrite (1.477185ms) + ✔ remove (1.974024ms) +✔ a stream that shrank, changed under its cursor or went away is store-incomplete for good (6.254361ms) +✔ a stream that isn't a regular file or a Pi session is store-unreadable, and that passes (1.252704ms) +✔ a first line that isn't a session header is store-unreadable (1.120253ms) +✔ a Claude run is harness-unsupported, and stays so after a Pi run (1.273691ms) +✔ storeDir is the store sessionStore makes, without making it (1.538256ms) +✔ the ledger is under no sandbox mount (5.456112ms) +✔ rootHits: a top-level file, a new top-level directory, src/ and v1/ are the root; paths under known directories aren't (1.861197ms) +✔ gateEnv keeps the named variables that are strings and drops everything else (0.310846ms) +✔ isMosaicStack: a checkout whose HEAD descends from the root commit and has node_modules; nothing else (76.743834ms) +✔ gateSteps: each package with tests but queue in name order, then each scripts/test-*.sh (2.377262ms) +✔ runGate: every step passes, each with its own log and a summary line, under the environment it was given (211.160741ms) +✔ runGate: the first failing step stops the gate and names its log (269.569796ms) +✔ runGate: an abort stops the running step and everything in its group, and runs nothing after it (185.986993ms) +✔ the CLI: root-file prints the hits and exits 2, or exits 0; gate exits 0, or 2 with the step and its log; anything else is usage (661.443234ms) +✔ T3: publish pushes the work commit by oid to / on the fork, with the token only through the helper (318.365034ms) +✔ T3: the token is never in git's argv, the fork URL included; it reaches git on fd 3 only (157.63501ms) +✔ T3: a moved fork branch refuses non-fast-forward; no + and no force (173.077055ms) +✔ T3: D9a: an empty fork and an unrelated fork refuse remote-unrelated; a missing fork refuses fork-unavailable (379.595919ms) +✔ T3: a fork past main refuses remote-unrelated until root catches up (152.254688ms) +✔ T3: a wrong token refuses fork-unavailable; git's stderr isn't in the refusal (102.972548ms) +✔ T3: a 302 is not followed: fork-unavailable, and the target sees no request (113.352932ms) +✔ T3: the helper answers only the fork's host and port: a fork on another port gets no token (95.099891ms) +✔ T3: a fork that echoes the token refuses credential-leak (131.28193ms) +✔ T3: no tls parameter, no trust: the scratch CA reaches git only through it (91.935601ms) +✔ D9 steps 3 and 4: ref-moved and identity-mismatch refuse before any request (143.070058ms) +✔ publishRemote refuses a fork, user or destination that isn't shell- and ref-safe before any git (88.646013ms) +✔ RUNNER_FILES is exactly what the runner and the harness sources it starts import (7.032234ms) +✔ sandboxProblem names a missing bwrap and a bwrap that fails (15.78888ms) +✔ every bind says why; the bundle and session file stay read-only over the run directory (2.196421ms) +✔ row 65 a harness module's mounts bind read-only after the adapter, each with the module's reason (2.143393ms) +✔ REQ-THREAD-2 a thread store binds its session directory and Claude transcripts, and nothing more (1.644658ms) +✔ the host's git socket is bound only when given, read-only and before the writable binds (1.090126ms) +✔ the git identity is the instance's, at @.mosaic.invalid, and sandboxArgv refuses without it (1.690862ms) +✔ a confined session's shell reaches its own workspace and run directory and nothing of the founder's or another session's (2106.854649ms) +✔ a bind that exposes a stand-in, or a missing workspace bind, fails the matching check (2924.249794ms) +✔ a confined session that runs tester-cli.mjs is refused as tester, and the same shim outside the sandbox binds (300.518853ms) +✔ resolveSeat: by name under --repo resolves the repo layout (2.419588ms) +✔ resolveSeat: by path resolves the fleet layout (0.765582ms) +✔ resolveSeat: refusals for missing dir, missing launch.sh, non-executable launch.sh, invalid name, and unknown layout (1.626754ms) +✔ tmuxContext: outside tmux, default socket, custom socket, and exec failure (1.236572ms) +✔ makeRegistration produces a record that validates; each shape violation throws SeatError (1.593741ms) +✔ writeRegistration/readRegistration: round trip, permissions, absence, and malformed records (2.34318ms) +✔ updateTask: changes task, taskSetBy and updatedAt only, and refuses appropriately (2.203796ms) +✔ CLI launch: registers, execs the fake launch script, and passes args through (66.404825ms) +✔ CLI launch: --harness lands in the record (50.392752ms) +✔ CLI launch: the launch script's own exit code passes through (46.659659ms) +✔ CLI launch: relaunching a seat rewrites the one registration record (89.26575ms) +✔ CLI launch: omitting --task records an empty string, not null (39.318048ms) +✔ CLI seat task: updates only the task after a launch, and refuses on an unlaunched seat (96.331713ms) +✔ CLI refusals: no args, unknown flag, missing config, already-registered env, and exec failure (164.27632ms) +✔ samePath: equal paths, symlinked dirs, distinct dirs, and non-strings (0.422092ms) +✔ resolveSetBy: explicit --by wins over the environment; absent or empty environment gives unknown; invalid explicit or environment values refuse with exit 4 (0.590318ms) +✔ validateRegistration/readRegistration: taskSetBy is optional; a record without it (written before #1511) still loads unchanged; an invalid one is refused; the version does not change (0.734057ms) +✔ updateTask: records setBy, preserves startedAt and every unrelated field, upgrades an old record in place only when the task is set, and replaces a previous attribution (0.906133ms) +✔ CLI seat task: --by beats MOSAIC_AGENT_NAME, the environment beats nothing, empty environment is unknown, invalid --by or environment refuses with exit 4 and leaves the record byte for byte (330.90649ms) +✔ REQ-THREAD-2 sessionStore: a legacy session keeps the thread's store, any other gets sessions//, each segment checked first (5.360486ms) +✔ REQ-THREAD-2 sessionStore refuses legacy-store-unmapped for a thread whose old store no legacy session maps (1.608175ms) +✔ REQ-THREAD-2 sessionWorkspace: private directories per session, unsafe segments and overlaps refused (3.523108ms) +✔ REQ-THREAD-2 lockSessionWorkspace: one writer; a live host or run holds it, a stale lock is taken over, an unreadable one holds (15.189866ms) +✔ REQ-THREAD-2 sessions.json v2: entries carry session and workspace, running() keys on the session, a v1 file still reads (1.889362ms) +✔ REQ-LIMIT-1: family substring matching is no longer exported (1.378459ms) +✔ sessionEnv passes only the allowlist, the repo's bin on PATH, and the run id (1.063207ms) +✔ ZAI_API_KEY passes the session allowlist, and ZAI_TOKEN does not (0.239826ms) +✔ sessionExit gives a runner's signal death back as the signal; a session credential is one whole set of nonempty variables (0.405172ms) +✔ newRun: short ids, 0700 directories, and a refusal when the socket path won't fit (2.727102ms) +✔ session file and launch log: 0600, the session file written once (2.111664ms) +✔ endReason maps the runner's exit codes; a signal is killed (0.220582ms) +✔ Registry mirrors to sessions.json; readSessions marks live entries; bad files refuse (2.216711ms) +✔ a read-only Registry never writes sessions.json, refuses add() and leaves the file on remove() (2.154331ms) +✔ REQ-THREAD-1 Registry.running keys a thread run by business, instance and thread (1.027065ms) +✔ REQ-THREAD-2 REQ-LAUNCH-1 threadStore checks both segments before the join and refuses an unsafe directory (2.628544ms) +✔ stopSession refuses an unknown run, reports a stale one, and won't signal a pid that isn't a runner (1.552738ms) +✔ a session runs in its sandbox as pid 1 of its namespace, claims, answers, and stops on mosaic stop (293.088316ms) +✔ workRef and validBranch take only what a ref name can hold (2.280976ms) +✔ a push lands as the task's work ref, a fast-forward lands after it, and main is the root's (187.443563ms) +✔ a rewritten branch refuses non-fast-forward and the work ref stays (124.192671ms) +✔ a branch with no history in common with main refuses unrelated-history (60.579235ms) +✔ a bundle that needs commits the working repository lacks refuses missing-prerequisite (51.079109ms) +✔ the root is fetched again before each push and main follows it, so a clone of a newer root pushes (129.47937ms) +✔ a root moved back after the clone leaves the push's base unknown: missing-prerequisite (78.854404ms) +✔ a commit with a broken object refuses invalid-bundle, and only because fsck is on (86.468293ms) +✔ only a v2 bundle with the named branch is read (64.914471ms) +✔ a branch named main, or named for another task, moves only this task's work ref (102.371349ms) +✔ a record that throws moves the work ref back, or removes a new one (141.771502ms) +✔ a work ref that can't go back refuses rollback-failed, naming the ref and the commit (362.776758ms) +✔ a root that can't be read refuses root-unreadable (28.853641ms) +✔ a git past its time gets SIGTERM, leaves no ref lock, and the next push lands (2132.860162ms) +✔ a git that ignores SIGTERM gets SIGKILL once the grace period is over (1025.936026ms) +✔ a working repository path that isn't a directory refuses (23.030329ms) +✔ review bundles a pushed commit as refs/mosaic/review, leaving out what the reviewer has (120.899663ms) +✔ review of a project with no working repository refuses unknown-commit (14.031146ms) +✔ the runner's git tools hold the host's limits and branch rule (1.219295ms) +✔ a reseed moves root but leaves a landed main, and main forwards once root contains it (184.469774ms) +✔ after a landing, a push built on the root still lands and main stays where the landing put it (126.530409ms) +✔ once the root shares no history with a landed main, a push is checked against main, not the root (179.004093ms) +✔ a landing squashes the reviewed diff onto main as the bus host and moves main only at finish (105.224989ms) +✔ a landing refuses ref-moved, base-conflict and root-file before it makes a commit (308.132399ms) +✔ a landing whose applied diff isn't the reviewed one refuses patch-drift and leaves no worktree (121.415385ms) +✔ finish refuses base-moved when main moved, and a record that throws moves main back (242.643351ms) +✔ halted push receipt rolls back only its unrecorded ref and cleans temporary refs (198.696687ms) +ℹ tests 218 +ℹ suites 0 +ℹ pass 218 +ℹ fail 0 +ℹ cancelled 0 +ℹ skipped 0 +ℹ todo 0 +ℹ duration_ms 6318.071226 diff --git a/agents/beakley/work/queue-217/run-r2/summary.json b/agents/beakley/work/queue-217/run-r2/summary.json new file mode 100644 index 000000000..0cb096694 --- /dev/null +++ b/agents/beakley/work/queue-217/run-r2/summary.json @@ -0,0 +1,202 @@ +{ + "base": "e0c6142f3", + "testedRevision": "2d274a5b6c35c3e74b07206ffd724a6579bb149d", + "tmpdir": "/mnt/storage/scratch/tmp/tNoueZ", + "wholeSuites": { + "library": { + "tests": 142, + "pass": 142, + "fail": 0, + "cancelled": 0, + "skipped": 0 + }, + "business": { + "tests": 270, + "pass": 270, + "fail": 0, + "cancelled": 0, + "skipped": 0 + }, + "bus": { + "tests": 974, + "pass": 974, + "fail": 0, + "cancelled": 0, + "skipped": 0 + }, + "cli": { + "tests": 988, + "pass": 988, + "fail": 0, + "cancelled": 0, + "skipped": 0 + }, + "harness": { + "tests": 172, + "pass": 172, + "fail": 0, + "cancelled": 0, + "skipped": 0 + }, + "seat": { + "tests": 218, + "pass": 218, + "fail": 0, + "cancelled": 0, + "skipped": 0 + } + }, + "touched": { + "touched-first": { + "tests": 57, + "pass": 56, + "fail": 1, + "cancelled": 0, + "skipped": 0 + }, + "touched-rerun": { + "tests": 57, + "pass": 57, + "fail": 0, + "cancelled": 0, + "skipped": 0 + }, + "availability-green": { + "tests": 3, + "pass": 3, + "fail": 0, + "cancelled": 0, + "skipped": 0 + }, + "runtime-fixture-retry": { + "tests": 1, + "pass": 1, + "fail": 0, + "cancelled": 0, + "skipped": 0 + } + }, + "mutants": { + "M1-writer-fence": { + "control": { + "tests": 6, + "pass": 6, + "fail": 0, + "cancelled": 0, + "skipped": 0 + }, + "negative": { + "tests": 6, + "pass": 3, + "fail": 3, + "cancelled": 0, + "skipped": 0 + }, + "restored": { + "tests": 6, + "pass": 6, + "fail": 0, + "cancelled": 0, + "skipped": 0 + }, + "productHashesRestored": true + }, + "M2-incoming-human": { + "control": { + "tests": 6, + "pass": 6, + "fail": 0, + "cancelled": 0, + "skipped": 0 + }, + "negative": { + "tests": 6, + "pass": 5, + "fail": 1, + "cancelled": 0, + "skipped": 0 + }, + "restored": { + "tests": 6, + "pass": 6, + "fail": 0, + "cancelled": 0, + "skipped": 0 + }, + "productHashesRestored": true + }, + "M3-split-check-transaction": { + "control": { + "tests": 13, + "pass": 13, + "fail": 0, + "cancelled": 0, + "skipped": 0 + }, + "negative": { + "tests": 13, + "pass": 12, + "fail": 1, + "cancelled": 0, + "skipped": 0 + }, + "restored": { + "tests": 13, + "pass": 13, + "fail": 0, + "cancelled": 0, + "skipped": 0 + }, + "productHashesRestored": true + }, + "M4-drop-client-reason": { + "control": { + "tests": 13, + "pass": 13, + "fail": 0, + "cancelled": 0, + "skipped": 0 + }, + "negative": { + "tests": 13, + "pass": 12, + "fail": 1, + "cancelled": 0, + "skipped": 0 + }, + "restored": { + "tests": 13, + "pass": 13, + "fail": 0, + "cancelled": 0, + "skipped": 0 + }, + "productHashesRestored": true + }, + "M5-hide-library-unavailable": { + "control": { + "tests": 3, + "pass": 3, + "fail": 0, + "cancelled": 0, + "skipped": 0 + }, + "negative": { + "tests": 3, + "pass": 1, + "fail": 2, + "cancelled": 0, + "skipped": 0 + }, + "restored": { + "tests": 3, + "pass": 3, + "fail": 0, + "cancelled": 0, + "skipped": 0 + }, + "productHashesRestored": true + } + }, + "totalWholeSuiteTests": 2764 +} diff --git a/agents/beakley/work/queue-217/run-r2/summary.txt b/agents/beakley/work/queue-217/run-r2/summary.txt new file mode 100644 index 000000000..55e68f755 --- /dev/null +++ b/agents/beakley/work/queue-217/run-r2/summary.txt @@ -0,0 +1,9 @@ +library: 142/142 pass; fail=0 skipped=0 cancelled=0 +business: 270/270 pass; fail=0 skipped=0 cancelled=0 +bus: 974/974 pass; fail=0 skipped=0 cancelled=0 +cli: 988/988 pass; fail=0 skipped=0 cancelled=0 +harness: 172/172 pass; fail=0 skipped=0 cancelled=0 +seat: 218/218 pass; fail=0 skipped=0 cancelled=0 +Touched rerun 57/57; first run 56/57, new runtime fixture corrected. +M1-M5 killed; each control/restored run green, hashes restored. +No old test failed or was edited. scripts/test-*.sh left to Sage at landing. diff --git a/agents/beakley/work/queue-217/run-r2/touched-first.log b/agents/beakley/work/queue-217/run-r2/touched-first.log new file mode 100644 index 000000000..cbbb082e6 --- /dev/null +++ b/agents/beakley/work/queue-217/run-r2/touched-first.log @@ -0,0 +1,80 @@ +✔ C2-06 held library lock gives the agent citation-unavailable and its retry reason (5129.213097ms) +✔ C2-06 malformed sync state is availability failure, never a fabricated invalid cite (32.312603ms) +✔ C2-06 no mirror or freshly initialized empty mirror still means no served citation (31.769445ms) +✔ C2-06 coder send_message guard covers every table refusal; inserts nothing (104.132156ms) +✔ C2-06 research send_message guard covers every table refusal; inserts nothing (90.030314ms) +✔ C2-06 stored check carries the file author trailer at an unrelated cited tip (57.202238ms) +✔ C2-06 supporting cite cannot state canon, including a folder also marked playground (41.82067ms) +✔ C2-06 supporting file stores supporting scope and its real agent trailer (47.52786ms) +✔ C2-06 check evidence and insert are atomic when storing evidence fails (45.049883ms) +✔ C2-06 live limits change both directions; unreadable file keeps checks and exact fixed texts (54.4217ms) +✔ C2-06 page store is session-local, caps 20 fetches and 200 KiB, drops at disconnect (86.893454ms) +✔ C2-06 transport passes safe capped guard reason; ordinary refusal envelope is byte-identical (55.019525ms) +✔ C2-06 non-library businesses retain role.claim shape and unguarded free sends (26.383322ms) +✔ C2-06 thread messages carry file/last evidence with one read per distinct path (76.778515ms) +✔ C2-06 guarded request snapshot cannot change between check and insert (24.114008ms) +✔ C2-06 library.limits.set is human-only and invalid settings leave file and receipts unchanged (47.161109ms) +✖ C2-06 runtime reads changed and unreadable reply limits without restarting (78.402278ms) +✔ C2-06 M11 human replacement works; omitted settings return to defaults (26.436831ms) +✔ C2-06 M11 agents and tester cannot change settings, including by changing human (21.452407ms) +✔ C2-06 M11 serialization cannot replace settings after the first fence (8.669666ms) +✔ C2-06 M11 an unrelated actor cannot appoint itself human and change reply limits (8.204041ms) +✔ C2-06 invalid setter values preserve the business and changes.jsonl (9.079346ms) +✔ C2-06 validator accepts hand-edited settings; raw reader fails closed on invalid files (10.338142ms) +✔ C2-06 CLI replies reads revision and sends only the JSON settings to the human verb (1.898838ms) +✔ C2-06 CLI replies requires a file and refuses tester writes before a bus call (0.465972ms) +✔ C2-06 RESULT reply-invalid retries once, delivers only the valid answer and names reason (222.089187ms) +✔ C2-06 RESULT citation-missing retries once, delivers only the valid answer and names reason (200.104611ms) +✔ C2-06 RESULT citations-over-limit retries once, delivers only the valid answer and names reason (197.834891ms) +✔ C2-06 RESULT citation-invalid retries once, delivers only the valid answer and names reason (210.156515ms) +✔ C2-06 RESULT playground-cited-as-canon retries once, delivers only the valid answer and names reason (213.835593ms) +✔ C2-06 RESULT citation-cross-universe retries once, delivers only the valid answer and names reason (209.912186ms) +✔ C2-06 RESULT citation-unfetched retries once, delivers only the valid answer and names reason (198.705684ms) +✔ C2-06 RESULT two guard refusals use the citation fixed text and exactly one retry (182.386586ms) +✔ C2-06 RESULT JSON 34000 characters retries with a shorter valid answer (213.370025ms) +✔ C2-06 RESULT JSON 70000 characters retries with a shorter valid answer (199.782915ms) +✔ C2-06 RESULT two oversized JSON bodies use the length fixed text with citations required (184.820165ms) +✔ C2-06 multibyte plain bodies also receive the one request-size retry (201.829013ms) +✔ C2-06 two multibyte plain bodies use the length fallback (182.03426ms) +✔ C2-06 RESULT a length refusal then citation refusal shares one retry and citation fallback (183.540139ms) +✔ C2-06 fixed empty/failed replies defer unslop note until the next cited reply (274.786836ms) +✔ C2-06 cited JSON above the old 32000 clip retains its citations and text (167.141798ms) +✔ C2-06 a flagged cited answer keeps the note inside text and citations whole (168.83631ms) +✔ C2-06 send_message typed tool runs every guard code before the valid RESULT (230.565935ms) +✔ C2-06 outside library the old failed text, clip and unslop behavior hold (197.472747ms) +✔ C2-06 outside library a refused send keeps the existing no-retry behavior (151.296315ms) +✔ C2-06 the retry turn delivers citation-unavailable reason to the agent (184.635398ms) +✔ C2-06 reply schema: free bodies, exact objects and safe refusal reasons (14.759264ms) +✔ C2-06 citation setting and all four exact fixed texts (9.899391ms) +✔ C2-06 default citation cap passes 20 and refuses 21, even with optional citations (76.751112ms) +✔ C2-06 real Git citation scope, reachability, lines and normalized quotes (41.360225ms) +✔ C2-06 playground cites pass but cannot state canon (23.671961ms) +✔ C2-06 independent universes refuse; a hybrid and only its sources pass (41.572641ms) +✔ C2-06 web cites require allowed definition, this session fetch and kept quote (10.468249ms) +✔ C2-06 file origin is the path commit and trailer, while last follows served changes (31.989388ms) +✔ C2-06 origin uses literal paths even when a filename contains a glob (20.084358ms) +✔ C2-06 cited-commit guard reads exactly the C2-05a indexed file set with supporting scope (44.687642ms) +✔ C2-06 reply limits fall back independently without coercion or inherited keys (0.462948ms) +ℹ tests 57 +ℹ suites 0 +ℹ pass 56 +ℹ fail 1 +ℹ cancelled 0 +ℹ skipped 0 +ℹ todo 0 +ℹ duration_ms 11101.06711 + +✖ failing tests: + +test at packages/bus/tests/citation-runtime.test.mjs:12:1 +✖ C2-06 runtime reads changed and unreadable reply limits without restarting (78.402278ms) + Error: invalid-authority + at fail (file:///home/jwoltje/.t3/worktrees/mosaic-stack/beakley-row217/packages/bus/src/broker.mjs:215:9) + at checkBusiness (file:///home/jwoltje/.t3/worktrees/mosaic-stack/beakley-row217/packages/bus/src/broker.mjs:366:7) + at new Broker (file:///home/jwoltje/.t3/worktrees/mosaic-stack/beakley-row217/packages/bus/src/broker.mjs:537:63) + at startBroker (file:///home/jwoltje/.t3/worktrees/mosaic-stack/beakley-row217/packages/bus/src/runtime.mjs:274:14) + at async TestContext. (file:///home/jwoltje/.t3/worktrees/mosaic-stack/beakley-row217/packages/bus/tests/citation-runtime.test.mjs:18:19) + at async Test.run (node:internal/test_runner/test:1409:7) + at async startSubtestAfterBootstrap (node:internal/test_runner/harness:387:3) { + code: 'invalid-authority' + } diff --git a/agents/beakley/work/queue-217/run-r2/touched-rerun.log b/agents/beakley/work/queue-217/run-r2/touched-rerun.log new file mode 100644 index 000000000..65716a6ee --- /dev/null +++ b/agents/beakley/work/queue-217/run-r2/touched-rerun.log @@ -0,0 +1,65 @@ +✔ C2-06 held library lock gives the agent citation-unavailable and its retry reason (5131.834326ms) +✔ C2-06 malformed sync state is availability failure, never a fabricated invalid cite (31.609704ms) +✔ C2-06 no mirror or freshly initialized empty mirror still means no served citation (31.510292ms) +✔ C2-06 coder send_message guard covers every table refusal; inserts nothing (102.606635ms) +✔ C2-06 research send_message guard covers every table refusal; inserts nothing (91.30209ms) +✔ C2-06 stored check carries the file author trailer at an unrelated cited tip (55.686451ms) +✔ C2-06 supporting cite cannot state canon, including a folder also marked playground (42.44166ms) +✔ C2-06 supporting file stores supporting scope and its real agent trailer (48.386414ms) +✔ C2-06 check evidence and insert are atomic when storing evidence fails (39.194827ms) +✔ C2-06 live limits change both directions; unreadable file keeps checks and exact fixed texts (54.284625ms) +✔ C2-06 page store is session-local, caps 20 fetches and 200 KiB, drops at disconnect (85.004961ms) +✔ C2-06 transport passes safe capped guard reason; ordinary refusal envelope is byte-identical (54.117068ms) +✔ C2-06 non-library businesses retain role.claim shape and unguarded free sends (26.131034ms) +✔ C2-06 thread messages carry file/last evidence with one read per distinct path (76.437567ms) +✔ C2-06 guarded request snapshot cannot change between check and insert (23.908928ms) +✔ C2-06 library.limits.set is human-only and invalid settings leave file and receipts unchanged (39.656735ms) +✔ C2-06 runtime reads changed and unreadable reply limits without restarting (113.293022ms) +✔ C2-06 M11 human replacement works; omitted settings return to defaults (36.305063ms) +✔ C2-06 M11 agents and tester cannot change settings, including by changing human (21.839826ms) +✔ C2-06 M11 serialization cannot replace settings after the first fence (8.253422ms) +✔ C2-06 M11 an unrelated actor cannot appoint itself human and change reply limits (7.674495ms) +✔ C2-06 invalid setter values preserve the business and changes.jsonl (8.65299ms) +✔ C2-06 validator accepts hand-edited settings; raw reader fails closed on invalid files (9.800617ms) +✔ C2-06 CLI replies reads revision and sends only the JSON settings to the human verb (1.78485ms) +✔ C2-06 CLI replies requires a file and refuses tester writes before a bus call (0.520156ms) +✔ C2-06 RESULT reply-invalid retries once, delivers only the valid answer and names reason (220.792912ms) +✔ C2-06 RESULT citation-missing retries once, delivers only the valid answer and names reason (195.400791ms) +✔ C2-06 RESULT citations-over-limit retries once, delivers only the valid answer and names reason (196.181772ms) +✔ C2-06 RESULT citation-invalid retries once, delivers only the valid answer and names reason (211.797981ms) +✔ C2-06 RESULT playground-cited-as-canon retries once, delivers only the valid answer and names reason (212.360651ms) +✔ C2-06 RESULT citation-cross-universe retries once, delivers only the valid answer and names reason (212.667005ms) +✔ C2-06 RESULT citation-unfetched retries once, delivers only the valid answer and names reason (184.261348ms) +✔ C2-06 RESULT two guard refusals use the citation fixed text and exactly one retry (184.957084ms) +✔ C2-06 RESULT JSON 34000 characters retries with a shorter valid answer (216.343048ms) +✔ C2-06 RESULT JSON 70000 characters retries with a shorter valid answer (198.338992ms) +✔ C2-06 RESULT two oversized JSON bodies use the length fixed text with citations required (183.309434ms) +✔ C2-06 multibyte plain bodies also receive the one request-size retry (198.411283ms) +✔ C2-06 two multibyte plain bodies use the length fallback (182.244769ms) +✔ C2-06 RESULT a length refusal then citation refusal shares one retry and citation fallback (184.948978ms) +✔ C2-06 fixed empty/failed replies defer unslop note until the next cited reply (294.575418ms) +✔ C2-06 cited JSON above the old 32000 clip retains its citations and text (169.454956ms) +✔ C2-06 a flagged cited answer keeps the note inside text and citations whole (164.824669ms) +✔ C2-06 send_message typed tool runs every guard code before the valid RESULT (213.365137ms) +✔ C2-06 outside library the old failed text, clip and unslop behavior hold (198.225522ms) +✔ C2-06 outside library a refused send keeps the existing no-retry behavior (155.955999ms) +✔ C2-06 the retry turn delivers citation-unavailable reason to the agent (188.198987ms) +✔ C2-06 reply schema: free bodies, exact objects and safe refusal reasons (17.723832ms) +✔ C2-06 citation setting and all four exact fixed texts (11.590649ms) +✔ C2-06 default citation cap passes 20 and refuses 21, even with optional citations (79.713842ms) +✔ C2-06 real Git citation scope, reachability, lines and normalized quotes (41.208361ms) +✔ C2-06 playground cites pass but cannot state canon (24.250695ms) +✔ C2-06 independent universes refuse; a hybrid and only its sources pass (42.707909ms) +✔ C2-06 web cites require allowed definition, this session fetch and kept quote (10.901286ms) +✔ C2-06 file origin is the path commit and trailer, while last follows served changes (37.369269ms) +✔ C2-06 origin uses literal paths even when a filename contains a glob (20.592546ms) +✔ C2-06 cited-commit guard reads exactly the C2-05a indexed file set with supporting scope (51.682837ms) +✔ C2-06 reply limits fall back independently without coercion or inherited keys (0.499884ms) +ℹ tests 57 +ℹ suites 0 +ℹ pass 57 +ℹ fail 0 +ℹ cancelled 0 +ℹ skipped 0 +ℹ todo 0 +ℹ duration_ms 11134.473726 diff --git a/docs/SESSIONS.md b/docs/SESSIONS.md index 809211124..c14777473 100644 --- a/docs/SESSIONS.md +++ b/docs/SESSIONS.md @@ -1630,3 +1630,5 @@ are never rewritten or removed; corrections are new entries. 2026-10-23 | Beakley (88b97f65, Codex gpt-6.1-sol) | Row 217 #1718 takeover under Q245 | Registered beakley/row217; read brief/design and standing Sage rulings; awaiting Launchpad ref before implementation. Queue next refused linked worktree; reported to Sage. Untested, no Node/test run pending CLEAR. 2026-10-24 | Beakley (88b97f65) | Row 217 round 2 under sage-4037 | New beakley/row217-r2 rebased onto e0c6142f3, retained both log histories, E4 product fix and supporting/index tests drafted. No Node/npm/tests/mutants run; ready for CLEAR; local-only dependency installs required on CLEAR, old-test red goes to Sage. + +2026-10-24T10:21Z | Beakley (88b97f65) | Row217 #1718 round2 slot | All touched57 and six whole suites2764 pass, zero skips/cancels; M1-M5 killed/restored, E4 RED stand-in observed. First-new runtime fixture red recorded and corrected; no old-test change/failure. Evidence in agents/beakley/work/queue-217/run-r2. Verified for review on beakley/row217-r2; Sage landing scripts/review remain.