From f41729178eb21f4df0ff013fa7ecd1acc179dd36 Mon Sep 17 00:00:00 2001 From: Jason Woltje Date: Tue, 20 Oct 2026 16:39:50 -0500 Subject: [PATCH] plans: re-pin plan 490e2771d to 4429a104f (row 192, Q175 phase 1), npm ci in the new copy, for Mos's check (mos-1099 item 3) --- .../sage/work/window-plan/repin-4429a104f.md | 124 ++++++++++++++++++ 1 file changed, 124 insertions(+) create mode 100644 agents/sage/work/window-plan/repin-4429a104f.md diff --git a/agents/sage/work/window-plan/repin-4429a104f.md b/agents/sage/work/window-plan/repin-4429a104f.md new file mode 100644 index 000000000..0b573a47c --- /dev/null +++ b/agents/sage/work/window-plan/repin-4429a104f.md @@ -0,0 +1,124 @@ +# Re-pin 490e2771d to 4429a104f (row 192, Q175 phase 1), with npm ci in the new copy + +Sage, 2026-10-20, draft 1, for mos-1099 item 3 under DECISIONS Q173. Mos checks this file at its commit before +P0. Any change to this file or to NEW after the check means Mos checks again (mos-0849/0850). + +This is a smaller window than `repin-rows-177-185.md` (draft 2, which Mos checked in mos-0929). Where a step is +the same, this file names that file's step and says what differs. The 7332 matrix, the snapshot, the W9 list and +the rollback compare are reused unchanged. + +## Who, and what nobody does + +- Sage operates, as the tester. Darkwing holds the gate lane for row 190 round 3 tonight, so I take the + operator seat. Mos verifies each step's output before the next one and runs `rehearse` (P3), which reads the + live config and a live backup (`docs/TOOLS.md` `rehearse`: Jason or Mos runs it). +- Jason has no step. Q173 covers a re-pin of this test system with a backup first and a STATE report after. + Nothing is pruned. +- Nobody acts as Jason: no `--by jason`, no human shell or tmux pane, every bus read and write carries + `--tester`, and no request carries `jason.woltje`. `bus.tester` stays as it is; if it isn't `true`, stop at P1. +- No pi (mos-0865 D2, P19 #383). No Save in the human Console, no `mosaic name`. +- Outside reach doesn't change. The Console keeps its current flags. `--sso` stays off: row 192's sign-in code is + dormant without the flag, and `cli.mjs:57` refuses `--sso` with the preview flags the pointer carries anyway. + The proof pair stays unset. The tunnel still forwards 7332 only (P4 and W10 check it). + +## Names + +- OLD, live: `490e2771d3d057ab76991e2c7859cd251857e64c`, activation `20261020T192956Z-490e2771d3d0`, pointer + `pm: true`, schema 3i, Console `--port 7332 --public-host mosaic.woltje.com --auth-header X-authentik-username + --allow-user jason.woltje --tester-port 7333` (no `--send`, read from `stack-release.sh status` between 21:36Z and 21:39Z). +- NEW: `4429a104f6d65ccf165f6c83b5d1dce3147dfde0`, row 192's landing, 106 commits past OLD counting records. + The commits after it (5b8def2f1 plans, 176a6bf4b sessions, 305857c8f queue) are records and don't move NEW. If + another code row lands before W0 (row 190 is the likely one), NEW stays here unless Mos rules otherwise. +- REPO: the canonical checkout. `activate` runs REPO's `webui-service.sh`, so the four service scripts are held + at NEW for the window (P5). +- `P=/mnt/storage/scratch/sage-pin-de352dfaf` (`business-check.mjs`, `console-check.sh`, checked against + `agents/sage/work/window-plan/repin-de352dfaf/SCRIPTS.sha256`). +- `WIN=agents/sage/work/window-repin-4429a104f/`, where every transcript goes. +- `SNAP=$WIN/snapshot.mjs`, a copy of `agents/darkwing/work/window-rows-177-185/snapshot.mjs`, sha256 + `639fd28a2674aaa03ce824e3394b4052f21cdef7d6fa49bae61a9927ed341e67` (mos-0899). I check the sha before S1, S2 + and any D3. + +## What NEW carries over OLD + +The path-limited log over `packages`, `scripts`, `roles`, `contracts`, `adapters`, `skills` and the package files: + +| Row | Commit | Live effect | +|---|---|---| +| 186 | 269134d8d | Tool only: the activate plan's backup line says what the run will do. | +| 187 | 9a71e4e80 | Tool: activate sets, carries and drops the proof pair. The pointer has no pair, so nothing changes. | +| 188 | 8fc0ee216 | Tool: proof file checks on a carried pair. No pair, no effect. | +| 163 | 8ecc7a239 | Tool: `rehearse`, which P3 uses, and `bus start --no-launch`. CLI `cli.mjs` and `launcher.mjs` gain the `--no-launch` path; the default start is unchanged. | +| 189 | ace27dc5e | Tool: `activate --no-send`. Live already runs without `--send`; the pointer carries that. | +| 192 | 4429a104f | Console `--sso` (off here), `scripts/mosaic-config.mjs` load becomes async, `webui-service.sh` renders `--sso` only when given, and a new dependency, oauth4webapi 3.8.8. `cli.mjs` imports `sso.mjs` at the top, so the Console won't start from a copy without that module. | + +No schema step: `SCHEMA_VERSION` (`packages/bus/src/store.mjs:17`) is 3i at OLD and NEW, and no migration was +added. `--plan` must say `migration: none`. No roles, skills, contracts, adapters or plug-in kinds changed. So: no +harness set, no skill carry, no `pm-on`. One `activate --pm`. + +## npm ci in the new copy + +mos-1099 asks for npm ci in the new copy. `stack-copy.sh copy` already does it: it extracts the archive to a temp +dir, refuses without `package.json` and `package-lock.json` (:55), runs `npm ci --no-audit --no-fund` there and +writes no copy if it fails (:56). W0 checks the result: `node_modules/oauth4webapi/package.json` in the copy reads +3.8.8, and `node --input-type=module -e "await import('oauth4webapi')"` from the copy exits 0. The live copy is +163M; `/home` has 30G free (94% used), enough for one more. + +## Backups + +| Before | Backup | Taken by | +|---|---|---| +| W5 | the stopped store, `$DATA/backups/stack//` with SHA256SUMS, DATA_ROOT, SCHEMA 3i, STAMP | `stack-release.sh` (row 185: every activate) | +| W5 | the rollback set (units, wrapper, pointer) | `stack-release.sh` | +| W9 | the business file, `cp -p` to `~/.config/mosaic-dev/businesses/mosaic-stack.json.pre-window-` with its sha256, as evidence nothing wrote it | Sage, in W0b | + +## Before the window (nothing stopped) + +| # | Who | Step | +|---|-----|------| +| P0 | Mos | The `$P` sha check, as in the 177-185 plan P0. | +| P1 | Sage | The business file, read only, the same values as the 177-185 plan P1. I report its sha256 now rather than assume the 06:15Z value. `business-check.mjs` for OLD now and for NEW after W0: LOAD_OK both. | +| W0 | Sage | `cd $REPO && scripts/stack-copy.sh copy $NEW`, in a gap between gate-lane runs, since npm ci is heavy. Then the two npm checks above, and `diff <(git -C $REPO show $NEW:package-lock.json) $COPIES/$NEW/package-lock.json` empty. W0 writes only under `copies/` and changes nothing live, so it moves before P2 and P3, which need the copy. | +| P2 | Sage | `console-check.sh $NEW` against a stub Console of NEW on a scratch port, once without and once with `--tester-port` on a second scratch port. CONSOLE_PASS both. | +| P3 | Mos | `scripts/stack-release.sh rehearse $NEW mosaic-stack --backup 20261020T192956Z-490e2771d3d0 --port `. It must pass every gate check but the PM's, with the pointer's Console flags. It stops no unit and writes no pointer. Transcript in `$WIN/p3/`. | +| P4 | Sage | The tunnel read, as in the 177-185 plan P4. | +| P5 | Sage | `git -C $REPO diff --quiet $NEW HEAD -- scripts/stack-release.sh scripts/webui-service.sh scripts/bus-service.sh scripts/stack-copy.sh` and an empty `git status --porcelain` on the same four. Row 190 round 3 touches `webui-service.sh`; if it lands before W5, P5 fails and the window waits for Mos's ruling. | +| P6 | Sage | The 7332 matrix (a)-(g) on OLD, as in the 177-185 plan, saved as `$WIN/matrix-old.txt`. | + +## The window + +| # | Who | Step | +|---|-----|------| +| W0b | Sage | The business file copy. | +| W1 | Sage | Idle check (`mosaic agents --business mosaic-stack --tester`, `mosaic launches list`), the start stamp from `date -u`, then S1 `node $SNAP --store "$DATA/bus/bus.sqlite" --held`. | +| W2 | Sage | `stack-release.sh status mosaic-stack`: pointer on OLD, `pm: true`, 3i, last line ok, unit flags match. | +| W3 | Sage | `stack-release.sh activate $NEW mosaic-stack --pm --plan`. Must show from OLD to NEW, `migration: none`, the backup line, and the Console line with OLD's flags exactly: no `--send`, no `--sso`, no proof pair, `--tester-port 7333`. Any other difference stops here. | +| W4 | Sage | The unit reads, as in the 177-185 plan W4. | +| W5 | Sage, on Mos's go | `stack-release.sh activate $NEW mosaic-stack --pm`. Exit 0, `result ok`, every gate check including `pm_launched`. Record the activation id, the backup path and STAMP, and the backup SHA256SUMS sha256. Then `status`. | +| W9 | Sage, after Mos verifies W5 | The 177-185 plan's W9 list unchanged, the chief turn and the one `assistant` thread turn included (mos-0929 Q3), plus two lines: the webui journal since the W5 stamp (with `UTC`) has one `Proxy: proxy proof off` and no `Sign-in:` line, and `ls -l /proc//cwd` names the NEW copy. | +| W10 | Sage | The browser check on 127.0.0.1:7333 and the matrix again as `$WIN/matrix-new.txt`, identical to `matrix-old.txt`. Then P4 again. | +| W11 | Sage | STATE report in `$WIN/STATE.md`, posted on P19 386 and P19 412 and on Gitea #1690. | + +## Stop conditions and rollback + +The same as the 177-185 plan. Two failures in one window: stop and report (mos-0823). + +Rollback: `stack-release.sh rollback mosaic-stack --plan`, then the real run. The previous distinct copy in the +log is 490e2771d, both are 3i, so no `--restore` and no data loss. OLD takes the same Console flags. The R1 and +R1post compares are as in the 177-185 plan. A restore past W5 follows that plan's D3 steps, with Mos deciding. + +Keep every copy. Prune nothing. + +## Questions for the plan check + +- Q1: NEW is row 192 alone, not bundled with row 190. Row 190 (several instances) changes `stack-release.sh` + and `webui-service.sh` and deserves its own window. I recommend running this one first. +- Q2: Sage operates instead of Darkwing, who is on the row 190 gate. OK? +- Q3: W0 before P2 and P3. It writes a copy only. OK? + +## What Sage ran for this plan + +Read only, 2026-10-20 between 21:36Z and 21:39Z (clock read 21:39:50Z at the commit): `stack-release.sh status mosaic-stack` (pointer, last five log +lines, unit flags match, 106 commits of drift), `git rev-list --count`, `SCHEMA_VERSION` at both ends, the +path-limited log, `git diff --stat` on the service scripts, CLI and config loader, `stack-copy.sh:23-56`, +`webui/src/cli.mjs:15-120`, `docs/TOOLS.md` on `rehearse`, `du -sh` of the live copy and `df -h /home`. Nothing +live was changed.