docs(tess): TESS-M2-V PASS (done); M3-001/002 in-progress (Mos-dispatched); +M2-FUP-001/002/003

Refs #708 #709

docs/tess/TASKS.md

@@ -22,9 +22,12 @@
 | TESS-M1-FUP-001 | not-started | RuntimeProviderService.execute() records provider-thrown authorization errors as failed/provider_error instead of denied/policy_denied | #707 | — | apps/gateway, packages/agent | — | — | 6K | NON-GATING follow-up from M1-V review (2026-07-12). Provider-thrown authz errors (e.g. FleetRuntimeProviderError 'forbidden' from M1-003 write-authority) mis-classify as outcome:'failed'/'provider_error' rather than 'denied'/'policy_denied'. Low-priority. Land BEFORE/WITH TESS-M3-001 fleet-provider registry wiring (#709), NOT now |
 | TESS-M2-001 | done | Add Tess roster/profile/service pinned to GPT-5.6 Sol high with fail-fast config and observable effective policy | #708 | coder0 | packages/mosaic | feat/tess-pi-service | TESS-M1-V | 22K | TESS-PI-001; AC-TESS-03. Mos-dispatched directly to coder0. MERGED to main by Mos (2026-07-12): PR #728 head c58e86e2, ROR comment 16905, CI 1728 green. NAME-AS-CONFIG invariant VERIFIED — identity via MOSAIC_AGENT_NAME/%i/roster data, no hardcoded tess identity in impl/service/schema/tool, Tess example-only; Nova distinct-name zero-code-change provisioning test; GPT-5.6 Sol high fail-fast; credential-safe effective-policy output; no live credential material |
 | TESS-M2-002 | done | Implement durable session identity, inbox/outbox, approval, checkpoint, handoff, compaction and restart recovery | #708 | coder0 | apps/gateway, packages/agent, packages/db | feat/tess-durable-state | TESS-M2-001 | 38K | TESS-STA-001, TESS-SEC-007..008; recovery TDD. Mos-dispatched directly to coder0 (2026-07-12) — orchestrator tracks, no competing lane. Branch feat/tess-durable-state from fresh origin/main e3b5113b; first recovery TDD packages/agent/src/tess-durable-session.test.ts; reuses existing provider registry + durable approval store. base=main, PR-open-STOP, independent non-author ROR then Mos merges. Next gate after merge = TESS-M2-V (M2→M3 review). PR #729 OPEN (feat(tess): persist durable session state; base=main, mergeable=true, head 102a7b606bd492201e3d731a86397a9cfe4eb998); coder0 pnpm turbo typecheck/lint/test --force 88/88 cold-cache + format green + Codex code/security remediated; scope = durable identity/inbox-outbox idempotency/immutable checkpoints/portable handoffs/PGlite close-reopen recovery/exact one-time approvals/sealed-redacted payloads/scoped dispatch. ROR routed to reviewer lane (non-author) at exact head 102a7b60. CHANGES REQUESTED (reviewer comment 16917 @102a7b60, CI pipeline 1730 RED) — 3 blockers routed to coder0: (1) CI red: gateway PGlite close/reopen durable recovery test TIMEOUT; (2) idempotency compares REDACTED payloads so distinct secrets collapse/collide — key must be over pre-redaction canonical identity; (3) durable schema/approval NAMESPACE hardcoded to tess, violates name-as-config — must derive from configured agent name (Nova zero-code-change). coder0 remediating; head will move → re-ROR required at new exact head. REMEDIATED + re-pushed: new head 444988d23bada28d3cc9ce7e588e18e052f058ff — (1) recovery suite uses one shared PGlite fixture, close/reopen AC completes ~0.5s (was 30s timeout); (2) pre-redaction SHA-256 payload digest added to idempotency conflict checks (distinct secrets no longer collapse); (3) hardcoded tess durable DB objects/approval prefix replaced with generic interaction naming + agent-bound approval namespace. push-hook typecheck/lint/format green; CI pipeline 1731 GREEN on new head 444988d2. Head confirmed unchanged at green SHA; re-ROR routed to reviewer (non-author) at exact head 444988d2 — prior REQUEST CHANGES 16917 void at old head. RE-ROR = REQUEST CHANGES (reviewer comment 16925 @444988d2; CI 1731 green + recovery test passes 1515ms not skipped). 2 residual payload-digest blockers routed to coder0: (1) CHECKPOINT idempotency still collapses — pre-redaction digest fix reached inbox/outbox but NOT checkpoint path; distinct sensitive checkpoint payloads under same sessionId+checkpointId collapse; needs pre-redaction digest column on checkpoint conflict check; (2) digest is UNKEYED plaintext SHA-256 over sensitive payloads → allows offline plaintext confirmation; switch to KEYED HMAC-SHA256 with config-sourced fail-fast secret (never hardcoded/logged), applied to inbox/outbox + checkpoint. coder0 remediating; head will move → re-ROR at new exact head. ROUND-2 REMEDIATED + pushed: new head cbdc38af954d49016b5fdc4a6dab0497317b6a1c — checkpoint now persists pre-redaction HMAC digest; inbox/outbox switched to VERSIONED HMAC; distinct-secret + delimiter-collision regressions added; migration safe for pre-existing checkpoint rows and legacy checkpoints FAIL CLOSED (cannot prove original payload); Codex security review no findings; format/diff green, PGlite recovery executes 1.765s. CI pipeline 1732 TERMINAL GREEN (success) on cbdc38af. RE-ROR = APPROVE — canonical VERIFIED APPROVE reviewer-of-record [W-jarvis:reviewer] head cbdc38af954d49016b5fdc4a6dab0497317b6a1c (visible Gitea comment 16933). Head confirmed unchanged at ROR target + PR mergeable=true. Reviewer verified checkpoint HMAC digest + collision regressions, recovery no-duplicate-side-effect, sealed/redacted at-rest payloads, scoped dispatch, agent-bound generic namespace; CI 1732 steps ci-postgres/install/sanitization/typecheck/lint/format/test all green; no merge by reviewer (pr-review wrapper self-approve blocked → recorded as verified PR comment). MERGED to main by Mos — merge_commit 99a2d0fc, final APPROVE at head cbdc38af (3-round reviewer loop 16917→16925→16933). M2 build phase CONVERGED (M2-001 #728 + M2-002 #729). TESS-M2-V (M2→M3 gate, AC-TESS-03/06) now running as Mos-owned independent Sonnet reviewer (same arrangement as M1-V) — orchestrator does NOT launch a competing review lane; Mos reports verdict. On M2-V PASS, M3 (#709) tasks TESS-M3-001/002 unblock. |
-| TESS-M2-V | not-started | Clean-host Pi launch plus model/policy status and restart/compaction/duplicate-side-effect verification | #708 | sonnet | apps/gateway/src/__tests__/integration, packages/mosaic/src | review/tess-m2 | TESS-M2-002 | 18K | Gate M3; AC-TESS-03/06 |
-| TESS-M3-001 | not-started | Bind dedicated Tess Discord channel with streaming, threads, attachments, pairing/RBAC and approvals | #709 | codex | plugins/discord, apps/gateway | feat/tess-discord | TESS-M2-V,TESS-M1-SEC-004 | 35K | TESS-DSC-001 |
-| TESS-M3-002 | not-started | Implement `mosaic tess` chat/status/sessions/tree/attach/send/stop/health/recover CLI | #709 | codex | packages/mosaic | feat/tess-cli | TESS-M2-V | 30K | TESS-CLI-001 |
+| TESS-M2-V | done | Clean-host Pi launch plus model/policy status and restart/compaction/duplicate-side-effect verification | #708 | mos-reviewer | apps/gateway/src/__tests__/integration, packages/mosaic/src | review/tess-m2 | TESS-M2-002 | 18K | Gate M3 = PASS (Mos-owned independent Sonnet reviewer at merged main 99a2d0fc, 2026-07-13). All 5 criteria verified with live test runs: model/policy fail-fast + credential-safe; restart recovery exactly-once; keyed-HMAC pre-redaction idempotency; compaction/handoff survival; name-as-config (interaction_* everywhere, Nova tests). Orchestrator did NOT run a competing lane (same as M1-V). M3 (#709) UNBLOCKED. Non-gating follow-ups from this review captured as TESS-M2-FUP-001/002/003 below. |
+| TESS-M2-FUP-001 | not-started | Delete dead unkeyed-sha256 OR-branch in tess-durable-session.repository.ts matchesContentDigest (:417-422) to match strict matchesCheckpointDigest | #708 | — | apps/gateway | — | — | 4K | NON-GATING follow-up from M2-V review (2026-07-13). Dead OR-branch NOT exploitable (all writers hmac:v1:-prefixed, content_digest NOT NULL from migration 0012) but weakens exactness guarantee. Low-priority. SCHEDULE TO LAND WITH M3 work. |
+| TESS-M2-FUP-002 | not-started | Add literal approval+compaction combined integration test | #708 | — | apps/gateway/src/__tests__/integration | — | — | 4K | NON-GATING follow-up from M2-V review (2026-07-13). Subsystems currently tested separately; what matters IS covered. OPTIONAL, low-priority. |
+| TESS-M2-FUP-003 | not-started | Cosmetic rename pass: 'Tess' in class/file/log names (TessDurableSessionRepository etc.) so Nova deployment logs don't say Tess | #708 | — | apps/gateway, packages/agent | — | — | 5K | NON-GATING follow-up from M2-V review (2026-07-13). Cosmetic only — functional name-as-config already correct (interaction_* data path). Low-priority. SCHEDULE TO LAND WITH M3 work. Related pre-existing: sourceLabel??'tess' default @packages/agent/src/tmux-fleet-runtime-provider.ts:142 (from #722/#724, OUT OF SCOPE — not a Tess-mission row). |
+| TESS-M3-001 | in-progress | Bind dedicated Tess Discord channel with streaming, threads, attachments, pairing/RBAC and approvals | #709 | coder4 | plugins/discord, apps/gateway | feat/tess-discord | TESS-M2-V,TESS-M1-SEC-004 | 35K | TESS-DSC-001. Mos DIRECT-DISPATCHED to coder4 on feat/tess-discord (base=main, 2026-07-13) — orchestrator is DYOR-loaded so Mos dispatched to avoid double-dispatch; orchestrator TRACKS only, no competing lane. PR-open-STOP, independent non-author ROR then Mos merges. Land TESS-M1-FUP-001 (execute() authz-error mapping) + TESS-M2-FUP-001/003 with this M3 work. |
+| TESS-M3-002 | in-progress | Implement `mosaic tess` chat/status/sessions/tree/attach/send/stop/health/recover CLI | #709 | diskhygiene-terra | packages/mosaic | feat/tess-cli | TESS-M2-V | 30K | TESS-CLI-001. Mos DIRECT-DISPATCHED to diskhygiene-terra on feat/tess-cli (base=main, 2026-07-13) — orchestrator TRACKS only, no competing lane. PR-open-STOP, independent non-author ROR then Mos merges. |
 | TESS-M3-V | not-started | Discord+CLI same-session E2E, denial/approval tests, and operator-flow review | #709 | sonnet | apps/gateway/src/__tests__/integration, plugins/discord, packages/mosaic/src | review/tess-m3 | TESS-M3-001,TESS-M3-002 | 20K | Gate M4 |
 | TESS-M4-001 | not-started | Implement Mos coordination handoff/observe/result contract with authority-boundary tests | #710 | codex | packages/coord, apps/gateway | feat/tess-mos-coordination | TESS-M3-V | 25K | TESS-MOS-001 |
 | TESS-M4-002 | not-started | Implement transitional Hermes runtime/capability adapter | #710 | codex | packages/agent, apps/gateway | feat/tess-hermes-adapter | TESS-M3-V | 40K | TESS-HRM-001; no legacy schema in core contracts |