docs: row 329 landed 61ebf2c34 (#1827). BUILD-LOG and SESSIONS lines, DEFERRED N2/R2-N1 (row 331) and N1 (P7), Vikunja 631 filing and 237 comment receipts.

2026-10-24 18:37:46 -05:00
1 parent b24d917ec9
commit 9e2689dffb
@@ -5582,3 +5582,4 @@ claim. Receipts and limitations in agents/lena/work/queue-296/BUILD.md and run-r
 2026-10-24 — Magica row329 round2 (#1827): Boyd B1 tightens management keys to printable non-space ASCII before init creates state; new whole-tree refusal cases first reproduced the defect. Header check retained, no old assertions edited. N1 outer Docker count correction, N3 stale-lock recovery and N4 34-code coverage docs included. Cleared dependency-reader gate running; two stand-in over-selections disclosed and removed from the plan per sage-4277, F7 cause unknown. Evidence agents/magica/work/queue-329/BUILD.md.

 2026-10-24 — Magica row329 R2 (#1827): B1 ASCII-only management key fix verified with complete-tree refusals and positive auth control; package66/66,30bus readers261/261,49CLI readers726/726,config55/55, no required skip/failure. N1 corrects R1 bus total to1019; N3 stale-lock guidance and N4 34-code inventory corrected. Two over-selected file runs are recorded separately, with no F7 inference; cause unknown/Vikunja625. Old502 test/helper files byte-identical, slot returned to Sage. Evidence agents/magica/work/queue-329/BUILD.md.
+2026-10-24T23:37:46Z | Sage | Row 329 (#1827, P1 pinned model proxy, Magica) LANDED 61ebf2c34, pushed 23:31:27Z 10-24. Before: refactor at 669cdf42c. After: Magica's 4 commits (94cde633e, c65fb34ee, d1f6f2b19, 61ebf2c34) cherry-picked onto 669cdf42c, diff vs the gated tree limited to drift paths, range-diff in scratch. Gate: one unchanged full landing gate in /mnt/storage/scratch/sage-r329l/wt (gate.sh 8b4978887 c8a9bcf94), started 23:08:12Z at load 14.35, GATE GREEN 23:29:14Z at load 8.67, no rerun, no test or timeout edit (mos-1634). Host note: two Codex workers cleaned T3 worktrees from about 23:14Z (mos-1639, Vikunja 632). Approvals: Dewey r2 c31643 rev 4047, Boyd r2 c31642 rev 4048. #1827 comment 31650, closed. Vikunja 237 comment 1109 (stays open for P2-P7); C4 P10 red filed as Vikunja 631. Queue: note rev 4063, done rev 4064, committed b24d917ec. DEFERRED: N2 and R2-N1 bound to row 331, N1 bound to P7. Overlap: row 284 (packages/bus/src/broker.mjs) and row 157 (scripts/mosaic-config.mjs) rebase onto 61ebf2c34 before their gates.
@@ -0,0 +1,13 @@
+{
+ "at": "2026-10-24T23:07:42.645Z",
+ "project": 19,
+ "created": [
+  {
+   "status": 201,
+   "id": 631,
+   "readBack": 200,
+   "done": false
+  }
+ ],
+ "problems": []
+}
@@ -0,0 +1,47 @@
+// Sage, 2026-10-24: row 329 P1 (model-proxy package, Gitea 1827) landed 61ebf2c34. Comment on parent 237 only; 237 stays open for P2-P7.
+// Checks each task's title before posting. Prints no secret.
+// Usage: node comment-r329-landed.mjs https://tasks.woltje.com SAGE_TOKEN_FILE SYNC_TOKEN_FILE OUT_JSON
+import { readFileSync, writeFileSync, existsSync } from "node:fs";
+const [ORIGIN, KEY, SYNC, OUT] = process.argv.slice(2);
+if (!/^https:\/\/tasks\.woltje\.com$/.test(ORIGIN)) throw new Error("tasks.woltje.com only");
+if (!OUT || existsSync(OUT)) throw new Error("OUT_JSON missing or exists; refusing");
+const PROJECT = 19;
+const PSIG = "Posted by Sage (T3 1ef1e4f8) with Sage's own key (bot user 13).";
+const esc = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+const ps = (xs) => xs.map((x) => `<p>${esc(x)}</p>`).join("") + `<p>${esc(PSIG)}</p>`;
+const POSTS = [
+  { id: 237, title: /^Programmatic agent credentials via local proxy/, body: ["Row 329, P1 of this design (the model-proxy package, pinned CLIProxyAPI fetch, proxy init and the proxy unit, Gitea #1827), landed on refactor at 61ebf2c34, pushed 23:31:27Z 2026-10-24. Magica built it. Boyd approved it in comment 31642 (rev 4048) and Dewey in comment 31643 (rev 4047). Sage's fresh landing gate went GREEN by itself at 23:29:14Z (mos-1634): every package suite except queue at 0 failures, with 1 allowed FED R7 skip, and every scripts/test-*.sh at rc 0. #1827 is closed with landing comment 31650. The earlier red run's case1-accept C4 P10 failures are task 631. Carried to docs/plans/DEFERRED.md: N2 and R2-N1 bound to row 331 (P2), and N1 (observing the 127.0.0.1 bind on the real binary) bound to the P7 cutover. This task stays open for P2 to P7. The live stack is not re-pinned."] },
+];
+if (/LANDSHA|PUSHTIME|CLOSEID|GATE\b/.test(JSON.stringify(POSTS))) throw new Error("placeholder left; refusing");
+const key = readFileSync(KEY, "utf8").trim(), sync = readFileSync(SYNC, "utf8").trim();
+async function api(method, path, body, auth) {
+  const r = await fetch(ORIGIN + path, { method, headers: { Authorization: `Bearer ${auth}`, "Content-Type": "application/json" }, body: body === undefined ? undefined : JSON.stringify(body), redirect: "error" });
+  const t = await r.text(); let json = null; try { json = JSON.parse(t); } catch {}
+  return { status: r.status, json };
+}
+const list = (j) => j?.items ?? (Array.isArray(j) ? j : []);
+const rec = { at: new Date().toISOString(), comments: [], problems: [] };
+const save = () => {
+  const out = JSON.stringify(rec, null, 1) + "\n";
+  if (out.includes(key) || out.includes(sync)) throw new Error("secret in the record; not written");
+  writeFileSync(OUT, out);
+};
+for (const P of POSTS) {
+  const t = await api("GET", `/api/v2/tasks/${P.id}`, undefined, sync);
+  if (t.status !== 200 || t.json?.project_id !== PROJECT || !P.title.test(t.json?.title ?? "")) throw new Error(`task ${P.id}: ${t.status}, title check failed; nothing posted`);
+}
+writeFileSync(OUT, "", { flag: "wx" });
+for (const P of POSTS) {
+  const c = await api("PUT", `/api/v1/tasks/${P.id}/comments`, { comment: ps(P.body) }, key);
+  const e = { task: P.id, status: c.status, id: c.json?.id ?? null };
+  rec.comments.push(e);
+  if (c.status >= 300 || !Number.isSafeInteger(c.json?.id)) { rec.problems.push(`comment ${P.id}: ${c.status} ${c.json?.message ?? ""}`); save(); continue; }
+  const back = await api("GET", `/api/v2/tasks/${P.id}/comments?per_page=50`, undefined, sync);
+  const found = list(back.json).find((x) => x.id === c.json.id);
+  Object.assign(e, { readBack: back.status, found: Boolean(found) });
+  if (back.status !== 200 || !found) rec.problems.push(`comment ${P.id} read-back: ${back.status}`);
+  save();
+}
+save();
+process.stdout.write(JSON.stringify(rec, null, 1) + "\n");
+if (rec.problems.length) process.exit(2);
@@ -0,0 +1,62 @@
+// Sage, 2026-10-24: files the row253 C4 P10 red seen in row 329's landing gate (mos-1634 item 2) as a P19 task,
+// a sibling of 625. No relation, labels, assignees, due dates or bucket moves. Sage's own key (bot user 13);
+// the sync key reads back. Refuses if the title exists. Prints no secret.
+// Usage: node file-c4p10.mjs https://tasks.woltje.com SAGE_TOKEN_FILE SYNC_TOKEN_FILE OUT_JSON
+import { readFileSync, writeFileSync, existsSync } from "node:fs";
+const [ORIGIN, KEY, SYNC, OUT] = process.argv.slice(2);
+if (!/^https:\/\/tasks\.woltje\.com$/.test(ORIGIN)) throw new Error("tasks.woltje.com only");
+if (!OUT || existsSync(OUT)) throw new Error("OUT_JSON missing or exists; refusing");
+const PROJECT = 19;
+const SIG = "Created by Sage (T3 1ef1e4f8) with Sage's own key (bot user 13).";
+const esc = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+const ps = (sig, xs) => xs.map((x) => `<p>${esc(x)}</p>`).join("") + `<p>${esc(sig)}</p>`;
+const TASKS = [
+  {
+    title: "Stack: case1-accept row253 C4 P10 inner and outer timeouts reported probe-inner-command (cause unknown)",
+    description: ps(SIG, [
+      "Filed by Mos's ruling mos-1634 as a sibling of 625. Seen in row 329's landing gate on 8b4978887 (base c8a9bcf94), 2026-10-24 22:20-22:42Z, before the T3 crash killed the gate. The cli suite went 1000 tests, 997 pass, 2 fail, 1 skip (FED R7).",
+      "Both reds are the loop at packages/cli/tests/case1-accept.test.mjs:421. 'row253 C4 P10 inner' expected reason=probe-inner-timeout and 'row253 C4 P10 outer' expected reason=probe-outer-timeout. Both got reason=probe-inner-command. 'overflow' passed. Every F check passed in both outputs. Failure text: agents/sage/work/handoff-2026-10-24/r329-cli-failures.txt (98614187c).",
+      "Not row 329's code: git diff --stat c8a9bcf94 8b4978887 is empty on case1-accept.test.mjs, case-sudo-fixture.mjs and scripts/case1-accept.sh (checked by Mos). The red is on base code. Magica's r2 gate had the file at 53/0.",
+      "Cause unknown. Unverified hypothesis: probe-inner-command is the catch-all in scripts/case1-accept.sh:228 for a supervisor exit other than 81-86. The C4 loop arms fixtureGuard(t,files,7000), which SIGKILLs a recorded fixture pid after 7 s; a fault run longer than that would turn exit 81 or 82 into 87. The test asserts before its t.diagnostic line, so there is no per-mode timing to confirm or refute this. This is not recorded as load.",
+      "Host facts, not a cause: Della's row 284 lane B run shared the host until about 22:34Z; the 1-minute load was 7.51 at 23:03Z and 10.83 at 23:06Z. Next: the 329 rerun gate (mos-1634 item 1) reports whether it recurs; a fix that changes this old test needs Mos's OK.",
+    ]),
+  },
+];
+const key = readFileSync(KEY, "utf8").trim(), sync = readFileSync(SYNC, "utf8").trim();
+async function api(method, path, body, auth) {
+  const r = await fetch(ORIGIN + path, { method, headers: { Authorization: `Bearer ${auth}`, "Content-Type": "application/json" }, body: body === undefined ? undefined : JSON.stringify(body), redirect: "error" });
+  const t = await r.text(); let json = null; try { json = JSON.parse(t); } catch {}
+  return { status: r.status, json };
+}
+const list = (j) => j?.items ?? (Array.isArray(j) ? j : []);
+async function existing() {
+  const out = [];
+  for (let page = 1; page < 20; page++) {
+    const r = await api("GET", `/api/v2/projects/${PROJECT}/tasks?per_page=50&page=${page}`, undefined, sync);
+    if (r.status !== 200) throw new Error(`list tasks: ${r.status}`);
+    out.push(...list(r.json));
+    if (list(r.json).length < 50) return out;
+  }
+  throw new Error("more than 19 pages");
+}
+const rec = { at: new Date().toISOString(), project: PROJECT, created: null, problems: [] };
+const save = () => {
+  const out = JSON.stringify(rec, null, 1) + "\n";
+  if (out.includes(key) || out.includes(sync)) throw new Error("secret in the record; not written");
+  writeFileSync(OUT, out);
+};
+const have = await existing();
+for (const T of TASKS) if (have.some((t) => t.title === T.title)) throw new Error("title exists; refusing");
+writeFileSync(OUT, "", { flag: "wx" });
+rec.created = [];
+for (const T of TASKS) {
+  const r = await api("PUT", `/api/v1/projects/${PROJECT}/tasks`, { title: T.title, description: T.description }, key);
+  const c = { status: r.status, id: r.json?.id ?? null };
+  rec.created.push(c);
+  if (r.status >= 300 || !Number.isSafeInteger(r.json?.id)) { rec.problems.push(`create: ${r.status} ${r.json?.message ?? ""}`); continue; }
+  const back = await api("GET", `/api/v2/tasks/${r.json.id}`, undefined, sync);
+  Object.assign(c, { readBack: back.status, done: back.json?.done });
+  if (back.status !== 200 || back.json?.title !== T.title || back.json?.done) rec.problems.push(`read-back differs for ${r.json.id}`);
+}
+save();
+console.log(JSON.stringify(rec));
@@ -0,0 +1,13 @@
+{
+ "at": "2026-10-24T23:32:49.768Z",
+ "comments": [
+  {
+   "task": 237,
+   "status": 201,
+   "id": 1109,
+   "readBack": 200,
+   "found": true
+  }
+ ],
+ "problems": []
+}
@@ -1692,3 +1692,4 @@ are never rewritten or removed; corrections are new entries.
 2026-10-24 | magica | row329 P1 #1827 | Final builder checks green with the recorded Mos1605 continuation and final unit-reader gate; preparing review manifest on magica/row329, no old assertions changed, Q250 scope recorded.
 2026-10-24 | magica | row329 round2 #1827 | In-progress rev4031; B1 ASCII-only key fix/new inventory tests and N1/N3/N4 docs, cleared reader verification running, old tests byte-identical.
 2026-10-24 | magica | row329 R2 #1827 | ASCII management-key fix and docs verified: package66/66,bus readers261/261,CLI readers726/726,config55/55; no required failures/skips, slot returned. Preparing authorized ff review candidate; old tests unchanged.
+2026-10-24 | Sage 1ef1e4f8 | row329 landing #1827 (mos-1634) | Gate GREEN 23:29:14Z unchanged, landed 61ebf2c34 pushed 23:31:27Z; #1827 closed c31650; queue note 4063, done 4064 (b24d917ec); DEFERRED N2/R2-N1 to 331, N1 to P7; Vikunja 631 filed, 237 c1109; 284 and 157 must rebase.
@@ -768,3 +768,31 @@ Sage, for Duckworth's N1 on row 208 (c31496, landed f58049de0). packages/webui/s
 re-renders the user view on a 5 s timer while the tab is visible, whether or not anything changed. That's a
 steady client and server load per open tab, not a correctness or guard issue. Fix: render on change, or poll the bus only for a change
 marker. Bound to the next row that edits user.js.
+
+
+## Row 329 N2: `mosaic proxy fetch` has no agent or human guard
+
+Sage, for Dewey's round 1 N2 on row 329 (c31639, landing deferral per c31643). `mosaic proxy fetch` downloads
+the pinned CLIProxyAPI archive from GitHub and writes `<dataRoot>/opt/cliproxyapi/` for any caller that has
+the instance config. P1's brief didn't ask for a guard. The fetch is pinned and sha256-checked against
+`packages/model-proxy/PIN`, so the risk is an unasked network fetch and a disk write, not a wrong binary.
+Bound to row 331 (P2): P2 decides whether fetch needs the human or agent guard its key verbs get, and
+records the choice in its BUILD.md. If P2 leaves it, P7 decides before cutover.
+
+## Row 329 R2-N1: the management-key rule lives in three places
+
+Sage, for Dewey's round 2 R2-N1 on row 329 (c31643). Round 2 tightened the key rule to
+`/^[\x21-\x7e]{1,4096}$/` in `packages/model-proxy/src/common.mjs`:33, which `initializeProxy` enforces, but
+`packages/bus/src/broker.mjs`:4827 and `packages/cli/src/model-proxy.mjs`:57 still use the round 1 predicate.
+A Latin-1 or edge-space key gets past both and is refused at init with `proxy-key-invalid`, before any write,
+but only after both prompts and a bus round trip. Fix: export one predicate from the model-proxy package
+and use it in all three places, with a test at each caller. Bound to row 331 (P2), which edits the broker's
+proxy verbs.
+
+## Row 329 N1: the 127.0.0.1 bind isn't observed on the real binary
+
+Sage, for Dewey's round 1 N1 on row 329 (c31639). The acceptance netns had only `lo`, so P1 writes
+`server.host: 127.0.0.1` and `management.allow-remote: false`
+but never saw the real binary refuse a non-loopback client.
+Bound to P7: at cutover, with Jason present, confirm the listener is on 127.0.0.1 only (`ss -ltnp`), and
+record it in P7's receipt.