docs: isolate session workspaces and require idle drain before clear
This commit is contained in:
jason.woltje committed
1 parent
347278044d
commit
e19e30df27
3 files changed
+104
-41
No files matched your search
@@ -5215,3 +5215,5 @@ Before: managed project/thread verbs had no Console conversation area. After: fi
|
||||
2026-10-21T21:45:20Z | Della mos-1223 / ludwig-0004 focused corrections | Before: b096a16cc left content-key location implicit and E05 core registration marked ready. After: merged plan 399 lines fixes external configDir secret key/lifecycle namespace outside dataRoot backup/restore, E01 schema and E03 missing/expired-key restore tests, and E05/E06 test-local registry readiness with core kinds.mjs registration gated on approved E01/Q4. Sixteen rows and eleven questions retained; originals unchanged. Focused static checks and queue guard apply, no product/live changes. Reviewer will check changed lines only.
|
||||
|
||||
2026-10-21T22:24:12Z | Huey | T1 item 7 sessions design r1, mos-1232, Vikunja 463 | Before: origin/refactor cca206cdc keys assistant claims/stores/messages by thread and renders Pi compaction markers; row 194 r4 excludes thread context clear. After: docs/plans/2026-10-21_t1-sessions.md proposes independent per-agent sessions within threads on Pi/Claude, scoped claims/stores/messages/workspaces, completed compaction counts, owner-write/RBAC matrix, idempotent proven-stop/fresh-successor clear, common admission/kill checks, migration and seven acceptance groups, replacement REQ-ROLE-2/REQ-THREAD-2 text and three owner questions. PRD 1.12 USER-3/4 candidate 1509c7cc5 cited separately from base. Verification: 22 pinned references resolve, eight-line summary and three exact owner quotes; manual source/consistency review, whitespace and installed queue guard checked. No code, queue/PRD edits, builds, suites, credential reads, live changes or paid calls. MVP priority ahead of Q198 S1. Review via Scrooge, then Sage/Ludwig as Mos authorized.
|
||||
|
||||
2026-10-21T22:28:56Z | Huey | T1 sessions design r2, scrooge-0006, mos-1235/1236, Vikunja 463 | Before: r1 347278044 lacked the exact per-session checkout/single-writer invariant and safe runner drain ordering, and admitted other role instances. After: F1 exact workspace path, fenced checkout setup, legacy shared-workspace quiescence, clear retains old dirty/untracked/unpushed checkout and creates fresh approved checkout, T2 mutant; F2 dequeue fence and generation-bound turn-boundary idle proof before runner signal, busy drain stays clearing, T4 cases; F3 THREAD_DEFINITION only per Mos scope ruling, no role eligibility change; N1 private titles/history vs owner-visible count/activity projection; N2 Claude offline adapter/managed-store-reader dependency flagged as MVP risk. Section 8 records Mos’s Q1–Q3 readings, no questions to Jason. Verification: 27 pinned references resolve, summary within 15 lines, source/delta consistency review, whitespace and installed queue guard checked. No code, queue/PRD edits, builds/suites/live changes/provider calls/credential reads.
|
||||
@@ -1445,3 +1445,4 @@ are never rewritten or removed; corrections are new entries.
|
||||
2026-10-21T21:43:02Z | Della (GPT-6.1-Sol, mos-1223) | Vikunja 460 phase C merged email plan, della/email-plan | Mos-selected base plus Ludwig grafts; original plans/reviews unchanged. Sixteen post-v1 rows, eight READY and eight WAIT/optional; eleven Jason questions. Canonical queue next della: nothing. Docs-only checks. Commit/push then immediate della-0003 handoff to Ludwig/Mos; Sage landing/queueing follows approval.
|
||||
2026-10-21T21:45:20Z | Della (GPT-6.1-Sol, mos-1223 / ludwig-0004) | merged email plan focused review fixes | External content-key/expiry location and restore tests specified; fake registry work READY, production registry gated on PRD approval/Q4. Merged plan 399 lines, original plans/reviews unchanged. Commit/push and focused Ludwig review before Sage handoff.
|
||||
2026-10-21T22:24:12Z | Huey (gpt-6.1-sol) | mos-1232, MVP T1 item 7 sessions design, Vikunja 463, huey/t1-sessions-design from cca206cdc | design with pinned code/row194/PRD candidate evidence and acceptance proposals; doc checks only, no builds/suites/live changes/provider calls; review then Sage/Ludwig handoff
|
||||
2026-10-21T22:28:56Z | Huey (gpt-6.1-sol) | T1 item 7 r2, Vikunja 463, scrooge-0006 F1–F3/N1/N2, mos-1235/1236 | workspace/drain fixes and THREAD_DEFINITION scope recorded; Mos rulings in section 8; doc-only verification, re-review via Scrooge/Mos
|
||||
@@ -10,7 +10,8 @@ This is MVP work under Q176 and Mos’s Q211 reading, ahead of Q198 S1.
|
||||
No runtime changes, provider calls or activation are authorized by this document.
|
||||
|
||||
Brief: **mos-1232**, Vikunja **463**. Owner Huey, reviewer Scrooge, gate/landing Sage.
|
||||
Design r1. All proposed choices below are **Huey’s readings**, pending review.
|
||||
Design r2, scrooge-0006 and mos-1235/mos-1236. Section 8 records Mos’s rulings.
|
||||
Other proposed choices below are **Huey’s readings**, pending review.
|
||||
|
||||
## 1. Authority and pinned evidence
|
||||
|
||||
@@ -37,13 +38,13 @@ are labelled separately. Documentation proves a requirement/design, not implemen
|
||||
| --- | --- | --- |
|
||||
| F1 | PRD requires one assistant holder per thread and one assistant session per thread: `docs/prd/mosaic-stack.md:254-267,960-966`. | Replace those two requirements in section 7. Keep role and assistant authority protections. |
|
||||
| F2 | Thread rows bind project/instance/owner; claims and message links key on thread: `packages/bus/schema.sql:240-271`. Broker refuses a second thread holder: `packages/bus/src/broker.mjs:2646-2665`. | Add explicit session identity below a thread. A second process cannot simply reuse the current claim. |
|
||||
| F3 | Create chooses exactly one assistant instance, and open/send/read target thread: `packages/bus/src/broker.mjs:3460-3557`. | Preserve the primary assistant default, add an explicit session target and authorized agent instance selection. |
|
||||
| F3 | Create chooses exactly one assistant instance, and open/send/read target thread: `packages/bus/src/broker.mjs:3460-3557`. Thread eligibility is definition-based: `packages/cli/src/launcher.mjs:237-239`, `packages/bus/src/broker.mjs:389-390`. | Preserve that thread agent and eligibility policy. Add only a session selector, not other role instances. |
|
||||
| F4 | Persistent Pi and Claude transcript locations are per thread, with ownership/mode/symlink checks: `packages/seat/src/session.mjs:51-74`. Registry running key is business/instance/thread: `packages/seat/src/session.mjs:215-218`. | Add session to storage and liveness keys, retaining path safety. |
|
||||
| F5 | Pi adapter resumes the most recent native session in its supplied directory; Claude persists a native ID and later uses resume: `adapters/pi/adapter.sh:39-53`, `adapters/claude/adapter.sh:49-59,87-101`. Both harness plugins resolve transcripts through the supplied store: `packages/plugins/harness/pi/index.mjs:73-75`, `packages/plugins/harness/claude-code/index.mjs:128-130`. | Separate directories and pinned native IDs, never “most recent across the thread”. |
|
||||
| F6 | Sandbox mounts the supplied thread store read-write and gives each run a fresh HOME: `packages/seat/src/sandbox.mjs:101-121,159-164`. | Mount only the selected session’s store. Do not expose siblings’ native stores or scratch HOME. |
|
||||
| F7 | Pi stream compaction start/end events are known but unshown, summaries map to compaction blocks: `packages/conversation/src/events.mjs:23-34,40-49,74-76`. Native history entries become compaction markers: `packages/conversation/src/pi.mjs:180-191,254-257`. | Count completed durable compactions, not stream fragments or starts. |
|
||||
| F8 | Console labels compaction blocks but the cited app.js:104 is now control-character handling; labels/fields are at `packages/webui/src/public/app.js:104-111`. Reader supports Pi histories and marks other harnesses unsupported: `packages/conversation/src/reader.mjs:1-12,22-24,36-51`. | The gap-map pointers still demonstrate markers, not a numeric counter or Claude support. Add a host counter for both harnesses. |
|
||||
| F9 | Launcher refuses duplicate instance/thread runs, checks limits and feeds the supplied store into start: `packages/cli/src/launcher.mjs:233-240,313-341,364-367`. | Extend one shared launch path. No special bypass for a cleared session. |
|
||||
| F9 | Launcher refuses duplicate instance/thread runs, checks limits and feeds the supplied store into start: `packages/cli/src/launcher.mjs:233-240,313-341,364-367`. Workspace is per instance and hostile-clone checks assume no session writes during setup: `packages/cli/src/launcher.mjs:345-354`, mounted rw at `packages/seat/src/sandbox.mjs:110-111`. | Add a per-session workspace and single-writer fence, not just a narrower duplicate-run key. The current per-thread registry key does not prove single writer across different threads. |
|
||||
| F10 | Conversation controller is explicitly fixture-only: `packages/conversation/src/controller.mjs:1-13`. Runner stop signals its child group TERM then KILL: `packages/harness/src/runner.mjs:396-418`. | Do not claim the Pi controller already supplies a production stop proof for both harnesses. Integrate the reviewed managed-run stop owner, and require its proof before replacement. |
|
||||
| F11 | State injected at a turn includes current launch state and task titles: `packages/harness/src/runner.mjs:109-122`. | Scope state, deliveries, task details and reply routing to the session’s permissions. A new native file alone does not clear copied prompt/context. |
|
||||
|
||||
@@ -69,12 +70,16 @@ landing at `3a853f35d`. T1 does not wait for post-MVP manager implementation to
|
||||
## 2. Session identity and independence
|
||||
|
||||
**D1 Model.** A project contains threads. A thread retains its owner, sharing and
|
||||
primary assistant, but contains N named sessions, each for one authorized agent instance.
|
||||
Several sessions for the same agent may run independently, on either supported harness.
|
||||
configured agent, and contains N named sessions for that same agent. **Per mos-1236,
|
||||
only THREAD_DEFINITION instances may hold thread sessions**. Keep the eligibility
|
||||
predicates at launcher.mjs:237-239 and broker.mjs:390 unchanged. Other roles holding
|
||||
thread sessions would change launch policy and are outside Vikunja 463. Several sessions
|
||||
for the thread’s agent may run independently, on either supported harness.
|
||||
Session = durable logical identity/context. Run = one process execution. Idle/restart
|
||||
resumes that session. Clear = a new logical session, not another run of the old context.
|
||||
Concurrency is allowed subject to instance/model/account/host limits, not promised as
|
||||
unlimited. This is an explicit claim/schema change for review, not added role authority.
|
||||
unlimited. This changes claim/schema granularity for the already-eligible thread agent,
|
||||
not role eligibility or authority. No roles/ declaration is added or widened.
|
||||
|
||||
One holder per `(organization, thread, agent instance, session)` with generation fencing.
|
||||
Run capabilities, deliveries, reply correlation, task/approval consumption and native
|
||||
@@ -92,8 +97,22 @@ holder per session. A UI’s selected session is a request parameter, never glob
|
||||
Every turn/request names session ID and expected generation. Late old-run replies remain
|
||||
attached to the old session and never appear as a successor’s answer.
|
||||
|
||||
Generated safe storage: `<dataRoot>/threads/<business>/<thread>/sessions/<session>/`,
|
||||
with separate `session/`, `claude-projects/` and per-session workspace/scratch roots.
|
||||
Generated safe native storage: `<dataRoot>/threads/<business>/<thread>/sessions/<session>/`,
|
||||
with separate `session/` and `claude-projects/` directories. The exact workspace is
|
||||
`<dataRoot>/workspaces/<business>/<instance>/sessions/<session>/`, with the broker-bound
|
||||
session ID globally unique in that business and checked against its thread/instance.
|
||||
Scratch/HOME remains per run inside its selected session’s execution environment.
|
||||
|
||||
**Workspace invariant (F9):** exactly one owned writer per session workspace, including
|
||||
across thread IDs and concurrent launcher instances. Hold the session generation/start
|
||||
fence through checkout validation/setup and spawn. No old session run may write while
|
||||
host git performs hostile-clone checks. A restart waits for proven prior-run exit, not
|
||||
only claim release. Reject an alias/hardlink/shared checkout or unsafe path that would
|
||||
bind two session IDs to one mutable repository. A private per-session lock plus the
|
||||
broker’s unique holder/generation fence covers concurrent host-launcher processes.
|
||||
Do not treat the old per-thread `instance-running` check as proof of single writer.
|
||||
Keep non-thread work on its existing exclusive instance path. T2 covers cross-thread
|
||||
and same-thread sessions and malicious workspace substitution.
|
||||
Derive paths server-side from validated IDs, verify ownership/private mode and refuse
|
||||
symlinks/escapes. Mount only that session’s stores. Project files remain accessible only
|
||||
through existing project grants and isolated checkouts, not by mounting sibling stores.
|
||||
@@ -107,7 +126,8 @@ Creating another session does not silently change that default. Legacy history r
|
||||
associated with the original default. New sends bind session at acceptance, so a later
|
||||
UI selection cannot redirect an accepted message. Read/list/open enforce the same owner
|
||||
and sharing boundary as send and count. No implicit fan-out or inter-session context
|
||||
sharing. Selecting another agent must pass current instance/project and messaging grants.
|
||||
sharing. The agent remains the thread’s configured THREAD_DEFINITION instance. A request
|
||||
selecting another role/instance refuses rather than changing thread launch policy.
|
||||
|
||||
## 3. Human authorization and Console
|
||||
|
||||
@@ -118,9 +138,17 @@ sharing. Selecting another agent must pass current instance/project and messagin
|
||||
| A1 Thread-owning organization owner | Yes | Yes, subject to instance policy |
|
||||
| A2 Thread-owning collaborator | Yes while current project/instance grant covers it | Yes while that write grant covers it |
|
||||
| A3 Viewer or read-only share recipient, including organization owner viewing someone else’s share | Only with current read/share access | No. Opening a UI history pane is a read, not the side-effecting session-open verb. |
|
||||
| A4 Organization owner without a share to another human’s private thread | No private content/count/title | No context clear. Authorized administrative run-stop metadata remains separate. |
|
||||
| A4 Organization owner without a share to another human’s private thread | No messages, transcript/history or user-chosen title. May read compaction count as narrowly scoped agent-activity metadata under existing administrative authority, without its summary/content. | No context clear. Authorized administrative run-stop activity remains separate. |
|
||||
| A5 Agent/model output or unverified identity | Only existing scoped agent reads | Cannot issue human session-create/clear writes. No new agent grant. |
|
||||
|
||||
Titles/names are user content, so they follow private-message access. A compaction
|
||||
count is agent activity, not message content. For A4 provide a separately scoped
|
||||
`session.activity` read with opaque session/run IDs and count/status only, never names,
|
||||
user identity text, compaction summaries or transcript links. This aligns with F13’s
|
||||
owner-visible decisions, inbox entries, claims, tasks and project files. Ordinary
|
||||
history/count views still require thread read access. Admin activity access does not
|
||||
open the private thread or grant clear/send. T5 tests both projections independently.
|
||||
|
||||
Revocation, expiry or unshare invalidates the next read, stream poll and write. A queued
|
||||
clear/new-session launch rechecks the initiating human’s write grant before each effect.
|
||||
No `user` field chosen by the client substitutes for verified identity. Until row 193
|
||||
@@ -129,7 +157,7 @@ remain disabled. Tester writes are not implicitly granted and use fixtures only.
|
||||
|
||||
**D5 Proposed surface.** Session chooser under the current thread shows name, agent,
|
||||
harness, running/idle/held/clearing/retired/uncertain status and `Compactions: N` (or
|
||||
`unknown`, with reason). “New session” opens a blank session for an allowed agent.
|
||||
`unknown`, with reason). “New session” opens blank context for the thread’s existing agent.
|
||||
“Clear context” names the selected session in one confirmation: ends that session,
|
||||
keeps its history/project files, starts fresh context, and may wait for safe stop/capacity.
|
||||
Read-only viewers see disabled write actions with the reason. Refresh/deep links preserve
|
||||
@@ -146,7 +174,7 @@ human identity transport. Retries query the recorded operation, never resend bli
|
||||
|
||||
## 4. Compaction count on both harnesses
|
||||
|
||||
**D6 Meaning.** Count completed compactions over the lifetime of the logical session,
|
||||
**D6 Meaning (Q1 ruled by Mos).** Count completed compactions over the lifetime of the logical session,
|
||||
across its runs and native branches. Starts, failed/aborted compactions, branch summaries,
|
||||
stream fragments and repeated reads do not increment it. Idle/restart leaves it alone.
|
||||
New independent session and clear successor start at zero. The retired session retains
|
||||
@@ -173,7 +201,10 @@ independent of total history size. Known zero requires a fresh known-empty nativ
|
||||
or a complete validated scan. Existing stores with incomplete evidence show unknown.
|
||||
Acceptance requires exact known counts for supported new Pi **and** Claude sessions.
|
||||
If the Claude format cannot be established offline, report that implementation dependency
|
||||
rather than ship a false counter or silently drop one harness from MVP.
|
||||
rather than ship a false counter or silently drop one harness from MVP. **MVP risk N2:**
|
||||
T3 cannot pass until the Claude format is pinned offline and a new managed-store reader
|
||||
works for both harnesses. The existing .pi/state reader is not that dataRoot reader (F8).
|
||||
Sage/Mos must track this as a build dependency, not assume Pi marker support covers it.
|
||||
|
||||
## 5. Clear context: end, retain, replace
|
||||
|
||||
@@ -186,20 +217,36 @@ refuses. Two different clears of the same revision cannot both create successors
|
||||
1. Recheck ownership/write grant and lifecycle policy under the session fence. Mark
|
||||
undelivered old inputs cancelled-with-receipt, never silently replay them to the new
|
||||
session. Keep old messages, results and run evidence unchanged.
|
||||
2. Ask the managed-run owner for cooperative stop/drain of exactly that session and
|
||||
stop its polling runner through the reviewed lifecycle stop path. Do not stop sibling
|
||||
sessions or use whole-instance regenerate. Join an existing stop receipt rather than
|
||||
race it. A signal, revoked claim or dead socket alone is not exit proof. Verify owned
|
||||
processes/namespace and reconcile tools/external writes. The Pi fixture controller
|
||||
in F10 is not a new production launch/stop path for Claude.
|
||||
2. Fence the runner’s next-turn dequeue first and request **cooperative drain to a
|
||||
completed turn boundary** for exactly this session. Do not invoke the runner stop
|
||||
while a harness child/tool is running: F10’s handler escalates TERM to KILL after
|
||||
5 seconds. Obtain a generation-bound idle/drained acknowledgement and verify no
|
||||
child remains. Keep the dequeue fence held so no child can start between that
|
||||
acknowledgement and stop. **Only then** stop the idle polling runner through the
|
||||
reviewed lifecycle path and collect process/namespace exit proof. If drain does
|
||||
not finish, leave `clearing`, keep reservations, and do not signal the runner.
|
||||
A stop/kill from an independently authorized human safety action remains separate.
|
||||
Do not stop siblings or use whole-instance regenerate. Reconcile external effects
|
||||
and join applicable existing stop evidence. F10’s Pi fixture controller is not a
|
||||
production Claude stop path. A signal/revoked claim/dead socket is not exit proof.
|
||||
3. Until stop/quiescence is proven, keep `clearing`/`uncertain`, old capacity reserved,
|
||||
successor unstarted and an actionable status. No automatic force-stop, kill clear or
|
||||
duplicate effect. Proposed CLI wait is 30 seconds, then reports pending with operation
|
||||
ID. Timeout does not mean completed or authorize a second clear. Recovery resumes the
|
||||
same operation after evidence is available and authorization remains valid.
|
||||
4. After proof, append old-session `retired` and a fresh successor creation/binding in
|
||||
one bus transaction. Allocate fresh native stores/IDs and scratch HOME. No old native
|
||||
history, compaction summary, dialogue, old prompt, draft or pending input is copied.
|
||||
one bus transaction. Allocate fresh native stores/IDs, scratch HOME and a new
|
||||
successor workspace under its own session ID. **Clear never copies or reuses the
|
||||
predecessor checkout.** Retain the old workspace at its original path with no new
|
||||
writer mount, including untracked files, dirty files and unpushed commits, associated
|
||||
with the retired session. It is not deleted, reset or automatically pushed. The
|
||||
successor checks out only the configured approved repository revision through the
|
||||
normal hostile-clone setup, never an implicit commit from that retained checkout.
|
||||
Source project files and old unpushed work are preserved, but the latter are not
|
||||
silently carried into fresh context. The confirmation names this distinction and
|
||||
offers authorized historical workspace inspection separately. Importing retained
|
||||
work requires an explicit later authorized project operation, not context clear.
|
||||
No old native history, compaction summary, dialogue, old prompt, draft or pending input is copied.
|
||||
Retain role/system policy and currently authorized project sources. Clear is context
|
||||
replacement, not deletion of project files, credentials or evidence.
|
||||
5. Request successor startup through D8. A held launch shows `fresh session created,
|
||||
@@ -236,8 +283,13 @@ changing context. The separately authorized stop remains available while halted.
|
||||
## 6. Compatibility, review and acceptance
|
||||
|
||||
**D9 Migration.** Old thread-only stores/messages become a default legacy session through
|
||||
an immutable mapping to their existing locations, without rewriting transcripts or run
|
||||
records. New stores use D2’s layout. Do not bind legacy stores to more than one session.
|
||||
an immutable mapping to their existing native locations, without rewriting transcripts
|
||||
or run records. Before any migrated session launches, drain all possible writers to
|
||||
its old per-instance workspace, prove quiescence and retain that workspace as historical
|
||||
work. Provision unique workspaces for migrated sessions through approved-revision setup.
|
||||
Do not map the shared old instance checkout into several legacy sessions. Report any
|
||||
unpushed work left in that retained checkout to its authorized user without exposing
|
||||
private transcript data. Activation waits if quiescence cannot be established. New stores use D2’s layout. Do not bind legacy stores to more than one session.
|
||||
Existing thread-only clients continue through D3’s default until explicitly selecting
|
||||
a session. New session selectors on cursors, streams and tools must reject mismatched
|
||||
session/generation, not fall back to another session. Preserve existing non-thread role
|
||||
@@ -252,17 +304,18 @@ an old binary resume a session from the wrong store. This design makes no live c
|
||||
|
||||
| Ref | Required acceptance evidence (future fixtures on Sage’s grant) |
|
||||
| --- | --- |
|
||||
| T1 | Pi and Claude each run two sessions for the same agent in one thread with distinct sentinel histories/native IDs. Stop/restart one resumes only itself. Two different agents are also isolated. Cross-thread and cross-organization sentinels never appear. |
|
||||
| T2 | Two concurrent dispatchers claim the same session: one holder. Different sessions can run subject to aggregate limits. Approval/delivery/cursor replay from a sibling or retired generation refuses. Workspace/native-store symlink or path escape refuses. |
|
||||
| T1 | Pi and Claude each run two sessions for the same agent in one thread with distinct sentinel histories/native IDs. Stop/restart one resumes only itself. Non-THREAD_DEFINITION roles refuse thread-session creation/launch. Cross-thread and cross-organization sentinels never appear. |
|
||||
| T2 | Two concurrent dispatchers claim the same session: one holder. Different sessions can run subject to aggregate limits. Approval/delivery/cursor replay from a sibling or retired generation refuses. Workspace/native-store symlink or path escape refuses. Mutant: map two session IDs to the same writable checkout (within one thread and across threads), and prove the single-writer fence prevents setup while another run can write. |
|
||||
| T3 | Both harness compaction fixtures: zero, one, three, duplicate history/live hints, failed start, partial write, branches, resume and clear. Full lifetime count is stable across pagination/restart, old count remains, successor zero, unsupported legacy count unknown. Pin Claude’s source contract before claiming this test proves native compatibility. |
|
||||
| T4 | Clear busy and idle sessions, two concurrent clears, delayed stop, ambiguous remote write, late output and every journal crash boundary. No replacement starts before proof; one successor; sibling session untouched; old input never replayed. Held startup remains visible and first new turn contains no old sentinel. |
|
||||
| T5 | Owner/collaborator/viewer/shared-owner/private-owner matrix, expired/revoked grants before read and after clear acceptance, forged identity and cross-instance IDs. Counts/title/history reveal nothing without read access. Clear/open/send require current owner write grant at effect. |
|
||||
| T4 | Clear busy and idle sessions, two concurrent clears, delayed stop, ambiguous remote write, late output and every journal crash boundary. No replacement starts before proof; one successor; sibling session untouched; old input never replayed. A busy child ignores drain: no runner signal or forced kill, operation remains clearing. Idle acknowledgement racing new dequeue is fenced. Clear preserves dirty/untracked/unpushed old workspace bytes and starts from an independent approved checkout. Held startup remains visible and first new turn contains no old sentinel. |
|
||||
| T5 | Owner/collaborator/viewer/shared-owner/private-owner matrix, expired/revoked grants before read and after clear acceptance, forged identity and cross-instance IDs. Private messages/history/titles never leak without a share. A4’s separately authorized activity projection exposes count/opaque IDs only, without summaries or transcript access. Clear/open/send require current owner write grant at effect. |
|
||||
| T6 | Fresh start/clear/restart under kill, grant revocation, limits and Q198 hold; halt between reservation/spawn/bind; manager configured but unavailable. No hidden launch, model call, route choice or capacity release from an unproven stop. |
|
||||
| T7 | Legacy thread clients/default migration, old claim semantics for non-thread roles, exact native store binding, schema rollback refusal and no rewritten evidence. Console selection/clear confirmation/status, disabled viewer writes and count refresh work for both harnesses. |
|
||||
|
||||
Named review: new bus schema and public session selectors/verbs, claim key changes,
|
||||
RBAC mapping, harness store/binding/counter contracts, stop evidence, launcher admission
|
||||
hook, approval/delivery correlation, migration/rollback and CLI/Console writes. Add
|
||||
RBAC/activity projections, explicit per-session workspace layout and single-writer setup,
|
||||
clear-workspace retention, idle-only runner stop, harness store/binding/counter contracts,
|
||||
stop evidence, launcher admission hook, approval/delivery correlation, migration/rollback and CLI/Console writes. Add
|
||||
mutants for shared thread store, omitted session filter, double compaction increment,
|
||||
clear-before-stop-proof, copied old prompt, forged human, missing kill check and duplicate
|
||||
successor. No tests/builds run for this design assignment.
|
||||
@@ -272,7 +325,7 @@ successor. No tests/builds run for this design assignment.
|
||||
**REQ-ROLE-2 replacement**, preserving its existing revoke/assistant protections:
|
||||
|
||||
> Each role instance has one holder at a time outside thread-scoped sessions. Within
|
||||
> a thread, an authorized agent instance may have several independent sessions, each
|
||||
> a thread, its configured THREAD_DEFINITION agent may have several independent sessions, each
|
||||
> with at most one holder. Claims bind organization, thread, agent instance and session
|
||||
> identity. Release/end frees only that holder. Aggregate authority, limits and the
|
||||
> existing assistant end/revoke protections still apply. Creating or clearing a session
|
||||
@@ -284,7 +337,8 @@ clauses verbatim. This changes holder granularity, not who may end/revoke the as
|
||||
**REQ-THREAD-2 replacement:**
|
||||
|
||||
> The user creates projects and named threads from the CLI or Console. A thread may
|
||||
> contain several independent sessions for its authorized agents, on Pi or Claude Code.
|
||||
> contain several independent sessions for its configured THREAD_DEFINITION agent, on
|
||||
> Pi or Claude Code. Other role definitions are not admitted to thread sessions.
|
||||
> Messages, native context and compaction counts belong to the selected session.
|
||||
> Returning after idle stop or restart resumes that session, never a sibling. Thread-only
|
||||
> clients use an explicit persisted default. History is retained and isolation holds
|
||||
@@ -295,17 +349,23 @@ completed-compaction count per session, context-clear retirement/successor opera
|
||||
and admission/kill/authorization parity for every start. D4–D8 and T1–T7 define their
|
||||
acceptance. No edit to `docs/prd/mosaic-stack.md` is made in this design branch.
|
||||
|
||||
## 8. Questions for Jason
|
||||
## 8. Mos’s rulings (mos-1235, 2026-10-21)
|
||||
|
||||
- **Q1 Session count semantics:** should the displayed number be lifetime completed
|
||||
compactions for the selected session, across native branches? **Recommend yes.**
|
||||
No page-dependent or active-branch-only total. Clear successor starts at zero.
|
||||
- **Q2 Clear active work:** should clear wait for a proven safe stop and expose pending
|
||||
status rather than force-stop external effects automatically? **Recommend yes.**
|
||||
Explicit authorized emergency stop remains separate. No new force-stop authority.
|
||||
- **Q3 Administration versus privacy:** may the organization owner clear another user’s
|
||||
private/shared session without that user’s write authority? **Recommend no.**
|
||||
Read-only shares remain read-only. Existing authorized instance/run stops stay separate.
|
||||
These are **Mos’s readings** of Jason’s lines and the existing record, not additional
|
||||
verbatim rulings by Jason. They do not go back to Jason as questions. Ludwig reports
|
||||
them in the PRD 1.13 change list after landing.
|
||||
|
||||
- **Q1 Lifetime count: yes.** TARGET.md:104 asks for “the number of compactions that
|
||||
have occurred for a session”. Count lifetime completed compactions for the selected
|
||||
session, across native branches. Under :105 a clear successor is a new session and
|
||||
starts at zero. D6 retains this meaning.
|
||||
- **Q2 Proven safe stop: yes.** Clear waits for proof and shows pending status. It adds
|
||||
no force-stop authority. The human kill switch remains separate, following Q198 D1
|
||||
and D13. D7/D8 retain those boundaries.
|
||||
- **Q3 Owner access to another user’s context: no.** PRD 1.12 at `1509c7cc5`,
|
||||
`docs/prd/mosaic-stack.md:1048` says “A user's messages stay private from the owner.”
|
||||
The organization owner cannot clear another user’s session without that user’s write
|
||||
authority. D4’s read-only-share and private-thread restrictions remain.
|
||||
|
||||
## Verification and handoff
|
||||
|
||||
|
||||
Reference in new issue
Block a user