gizmoduck: T3 federation design r4.4 for #414 (mos-1020): R4 chained after row 193's viewer level and keeps the level-loss test, which must kill its mutant (N17)

agents/gizmoduck/work/federation/DESIGN.md

@@ -1,6 +1,6 @@
 # T3 federation design: factory and hub (Vikunja #414, G3, G4, C1.1)
 
-Author Gizmoduck (Opus 5.5), 2026-10-20, r4.3. Design only, no product code. Reviewer Duckworth (Opus 5.5,
+Author Gizmoduck (Opus 5.5), 2026-10-20, r4.4. Design only, no product code. Reviewer Duckworth (Opus 5.5,
 mos-0978), r1 verdict changes B1-B5 (duckworth-0001, REVIEW.md at b402197ff), r2 verdict changes B6 (duckworth-0002,
 REVIEW-r2.md at 03a663cd7), r3 verdict changes B7 (duckworth-0003, REVIEW-r3.md at 45cbe5896), r4 verdict changes B8 (duckworth-0005, REVIEW-r4.md at
 4966136d4), r4.1 verdict changes, B8's issuer host (duckworth-0007, REVIEW-r4.1.md at b14f11136). R1, R2 and R5 go to Sage's
@@ -40,6 +40,8 @@ PLAN.md T3 (all in jason-master-restart).
   #419, section 8). N11, `#waiting` returns null for `to` `user` (3.6 item 7, R3).
   N12, R3 assumes nothing about how shares end (section 9 Q2). Row 196 (#1694, Gander) owns the shared
   principal verifier before R3 (section 5).
+- r4.4 (mos-1020, mos-1019): N17, R4 is chained after row 193's viewer level and keeps the level-loss
+  test, which has to kill its mutant before R4 is done.
 - r4.3 (duckworth-0007): B8, an issuer that isn't on the hub host must pass the host-access, hypervisor
   and backups rows against its own host, and a hosted issuer's admin accounts each pass the failed-call
   check (section 8, sign-in row). N16, the dependency note covers every secret on a PVE guest. N17, R4's
@@ -500,7 +502,7 @@ gate. Chains follow Q177: a dependent row builds on its parent's candidate.
 | R2 | `federation` key in scripts/mosaic-config.mjs | Haiku 5.5 high | Sage #412 phase 1 candidate | test-config.sh: valid key loads, unknown sub-key and bad origin refuse, config without it loads |
 | R5 | `mosaic access list, grant, revoke`: human proof, atomic write, revision bump, receipt line. Help text states the `instances` limit and the provider-removal order | Haiku 5.5 high | R1 | cli tests: tester and agent callers refused, concurrent write refuses on revision conflict, receipt appended, bad grant refused before write |
 | R3 | Broker user principal: consumes row 196's `verifyPrincipal` (`user` kind, `user-cli.mjs`), `bindUser`, the 3.6 changes, the collaborator verb list and its filters, per-request grant read, audit lines for every `s.human`/`s.tester` branch | Opus 5.5 | R1, row 196 | bus tests: each listed verb allowed, every other verb refused, a leak test per listed read (other projects, other instances, other users' threads), a reply-chain `message.send` into another user's thread refused, `thread.send` writes no `human.input`, the run's reply to a user's message reaches that user's `thread.messages`, a reply `to: 'user'` without a matching `in_reply_to` refused, a user-thread run sending `to: 'human'` refused, a reply to a user returns `waiting` null and posts no notice message, revoked and expired grant refused on next request, refusals recorded. Mutants (the agent-parent, non-Console-parent and kind-confusion mutants are row 196's): the grant read skipped, a read filter dropped, `#threadFor`'s user refusal removed, the reply-to check dropped (a run answers another user's message or one outside its thread), a user named like the human accepted |
-| R4 | Revocation: 30 s timer, `access.reload` verb, claim end on loss, `threadsState` `revoked`, launcher skip and SIGTERM, launch check refusal, R5 calls `access.reload` | Codex Sol | R3, R5 | bus and launcher tests, each with a mutant: a hand edit removing the grant ends the run within one timer period, an expiry with no request ends it, a pending message followed by a launcher restart starts no run, a running revoked thread gets SIGTERM, another user's runs stay. The test that a downgrade to viewer counts as a loss lands with row 193's viewer level: until then R1 refuses any other level, so the whole file fails and no 10-27 test can kill that mutant (N17) |
+| R4 | Revocation: 30 s timer, `access.reload` verb, claim end on loss, `threadsState` `revoked`, launcher skip and SIGTERM, launch check refusal, R5 calls `access.reload` | Codex Sol | R3, R5, row 193's viewer level (mos-1019) | bus and launcher tests, each with a mutant: a hand edit removing the grant ends the run within one timer period, an expiry with no request ends it, a pending message followed by a launcher restart starts no run, a running revoked thread gets SIGTERM, a grant downgraded to viewer counts as a loss, another user's runs stay. R4 starts after row 193's viewer level lands, because before it R1 refuses any other level, the whole file fails, and the downgrade test can't kill its mutant (N17, mos-1020) |
 | R6 | Console: granted-user sign-in, `user-cli` transport per session, per-request grant re-read, owner-only controls hidden, peer links | Opus 5.5 | Sage #412 phase 1, R1, R2, R3 | webui tests on Sage's fake OP: granted user signs in, ungranted `sub` refused, revoked mid-session gets 401 on next call, a granted user's owner-verb call refused by the bus even with the UI check removed (mutant) |
 | R7 | Scratch two-instance acceptance: two configs, two data roots, two Consoles, one fake OP. The Consoles start outside agent ancestry (a transient user unit), as the user proof requires. They never use the live stack's units or ports | Haiku 5.5 high | R1-R6, row 190 (several instances on one uid) | script test: Jason granted collaborator on one hub project signs in to the hub, makes a thread, sends to the granted instance, gets the instance's reply in the thread, is refused on another project and on board reads, is revoked and gets refused with the run ended. The factory shows nothing of the hub |
 | R8 | Live window, not a code row: hub provider client, hub proxy route, access.json written by Jason, re-pins | Jason, Mos | the hub host live (Vikunja #418), Jason's #419 answer, #412 phase 2, R7 | Entry gate, host form only for 10-27 (mos-0996): the hub runs on its own host (#418), not on dragon-lin or Melanie's server. R8 refuses to start unless every check passes. The privilege checks run on every factory host in section 8's list (the dragon-lin dev uid, `<case1-host>` and its agents, W-jarvis), as each factory uid there under `env -i`, and each passes only when the call fails: `sudo -n true`, `doas -n true`, and `ssh -o BatchMode=yes <hub-host> true` as the hub user, as Jason's user and as root, each with and without the session's `SSH_AUTH_SOCK`. If `sudo -n` succeeds, as it does for jwoltje on dragon-lin (mos-0996 point 1), the factory counts as root on its own host. Then, as root through `sudo -n`: fingerprint every private key under every home and `/root`, and every key loaded in any agent socket found on the host (`ssh-add -l` per socket). Compare them with `ssh-keygen -lf` over every `authorized_keys` on the hub host, root's included, and no fingerprint matches. Run the ssh checks as root, once with no agent socket and once with each socket found, and each fails (N13). Every other privilege path is a named item in section 8's table (mos-1009): hypervisor, backups, sign-in provider, TLS front end, certificate authority, DNS and network. R8 refuses to start until each one is either closed, with its check passing, or accepted by Jason in writing with the table's wording, which also goes to Melanie (#419). The hub host's bus socket, data root and config dir don't exist on any factory host, no factory host mounts anything of the hub's, and the hub host runs no other instance or agent. Also: the two provider client ids differ, each origin answers over HTTPS from the other host, each Console reaches its issuer's discovery URL, and both clocks are synced. Jason's attestation confirms no factory agent holds a login or key for the hub host, but the failed calls are the gate. The uid form (row 190b) is a later option, outside this gate. Then Jason signs in to the hub from his account and sends one message, Melanie revokes, and his next request is refused |

docs/SESSIONS.md

@@ -1367,3 +1367,4 @@ are never rewritten or removed; corrections are new entries.
 2026-10-20T19:12:55Z | Gizmoduck (Opus 5.5) | T3 federation design r4.1 for Vikunja #414: B8 (duckworth-0005, issuer and TLS front end), N13 key procedure, N14 R3 on row 196, N15 DNS; mos-1006 (identity provider path, sudo deviation accepted); mos-1009 (privilege path table, each closed or accepted per #419); gander-0007 (verifier interface); morgana-0005 (grants name bus project ids, one covers in R1, R4 counts collaborator grants only) | committed and pushed on gizmoduck/federation-design; sent to Duckworth, copies to Mos, Morgana and Gander
 | 2026-10-20T19:16:08Z | Gizmoduck | T3 federation design r4.2 for #414 (mos-1013, morgana-0007) | factory means every principal outside the hub instance, hosts as variables, Q180 settles Q1 |
 | 2026-10-20T19:16:56Z | Gizmoduck | T3 federation design r4.3 for #414 (duckworth-0007) | B8 issuer host passes host-access, hypervisor and backups rows, N16-N19 |
+| 2026-10-20T19:17:11Z | Gizmoduck | T3 federation design r4.4 for #414 (mos-1020) | R4 chained after row 193's viewer level, keeps the level-loss test (N17) |