mosaicstack/stack
25
0 Fork 1
Code Issues 412 Pull Requests 13 Packages Projects Releases 15 Wiki Activity

researcher: row 120 round 2 packet (review paths gated, rebased on 66ea40580)

Browse Source 
Candidate diff and manifest against 66ea40580; messaging suite now 12 tests;
gate green; 21/21 mutants caught (m16, m17 added). No push.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
This commit is contained in:
jason.woltjeandClaude Sonnet 5.5 committed 2026-10-14 20:58:25 -05:00
1 parent 66ea40580e
commit f758a8e927
61 files changed
+2238 -1668
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

agents/researcher/work/queue-120/build.md
+72
View File
@@ -5,6 +5,78 @@ sends to and hears from". Requirement: REQ-ASSIST-2 (`docs/prd/mosaic-stack.md:1
owner: Sage. Gate text: "Filbert approves on #1614 naming the candidate manifest; Sage's full gate rerun at the
landing target; both directions refused and logged, a role without the field unchanged".
## Round 2 (2026-10-15)
Base: `66ea40580e3090674100292497a01f7c75c15ef3` (refactor tip, includes row 122 at 7b5b682ae). `row120.patch` is
the candidate diff against it, 6 files; `git apply --check` passes at the canonical HEAD (66ea40580), and no
commit from 66ea40580 to HEAD touches a candidate path. Candidate manifest digest:
`ae7515b97bb92fdde63e9d2e6fd8473700d3e0c12d9e70fff67e06129fbac1a9`. The Round 1 text below is kept; where it
says 85540a74e, 9 tests, 19 mutants or the Round 1 gate counts, this section supersedes it. The Round 1 patch
and outputs are in commit 07a967aec.
**Filbert F1 (comment 28539).** `#reviewMessage`, reached by `review.request` and `review.verdict`, stored a
message to a role without meeting the assistant's lists, even after a human approved the gating decision.
**Ruling (comment 28540), option (a):** widen the row to the review paths. Done by calling the existing
`#checkMessaging` in each case before anything is recorded; no new code path, `#reviewMessage` itself is
untouched, nothing else in `broker.mjs` widens.
| Where | Check | Refusal |
|---|---|---|
| `review.request`, after the stale/unknown-commit block, before the message id | `#checkMessaging(s, a.to)` | `message-recipient-refused` when the sender's `sendTo` omits the reviewer; `message-sender-refused` when the reviewer's `receiveFrom` omits the sender |
| `review.verdict`, after `verdict-exists`, before the message id | `#checkMessaging(s, r.from)` (the verdict is a message to the role that asked) | same two codes |
A refusal throws inside the request transaction, so no `REVIEW-REQUEST` or `REVIEW-RESULT` message, no
`review.requested` or `review.verdict` event and no authority is consumed. The catch writes `action.refused`
with the code and the actor role.
**Tests added to `messaging.test.mjs` (now 12).**
1. The assistant's `review.request` to a reviewer outside its `sendTo` is refused as `message-recipient-refused`
and logged, even after a human resolves the `review.request` decision `yes`. Run twice: the decision is
unconsumed, no message, no event, `action.allowed` count unchanged.
2. A `review.verdict` to the assistant from a role outside its `receiveFrom` is refused as
`message-sender-refused` and logged, with no `REVIEW-RESULT`, no `review.verdict` event and no authority
consumed. The request is made by a first broker on the same store with permissive definitions (a request that
predates the lists); the reviewer releases the role; a second broker with the real definitions takes the verdict.
3. A coder-to-reviewer request and the verdict back are unchanged (roles without the field), no refusals.
**Mutants added.** m16 removes the `review.request` check (caught by test 1). m17 removes the `review.verdict`
check (caught by test 2). m1, m2, m3, m7, m8 and m15a also fail the new tests. Total now 21 mutants plus 3
controls; all 21 are caught, none survived. Names and per-mutant output, return code and patch are in
`mutants/`; `mutants-run.txt` is the run log. Controls: messaging 12/12, role 14/14, assistant 8/8.
**Gate on the rebased tree** (slot sage-0284, decision 136, `suites.sh`; outputs in `suites/`):
| Run | Result |
|---|---|
| business | 88 / 88 |
| bus | 171 / 171 |
| harness | 84 / 84 |
| cli | 195 / 195 |
| webui | 112 / 112 |
| tasks | 92 / 92 |
| conversation | 182 / 182 |
| seat | 132 / 132 |
| `scripts/test-task.sh` | 98 passed, 0 failed |
No flake from #258, #261, #262 or #263 occurred. (My first gate launch stopped at the busy check: it flagged my
own shell, whose cwd was the bare scratch directory. Nothing ran; I reran from inside the worktree.)
**Merge with row 122, checked by hand.** 122 added the `organization` constructor argument and a limits/limits.set
block before the store transaction. This row's constructor loop, `#checkMessaging` and the three call sites sit
beside those hunks with no overlap. 122's one-line change to `assistant.test.mjs` merged cleanly. The five
touched single files passed on the rebased tree before the full gate.
**Noted follow-up, not gated here (comment 28540).** The DECISION message that `decision.resolve` inserts to the
raising role still doesn't go through `#checkMessaging`. Today the assistant holds no decision authority and its
`crossRole` is `[]`, so it can't be the raiser or the target of one. If a role with a `receiveFrom` list ever gains
decision authority, gate that insert too.
**Files.** `row120.patch`, `candidate-manifest.sha256`, `build.md`, `suites.sh`, `suites/`, `mutants.sh`,
`mutants-run.txt`, `mutants/`, `packet-manifest.sha256`.
## Round 1
Base: 85540a74e. `row120.patch` applies to it by `git apply --cached --check`, and to the canonical checkout's
HEAD at packet time (9f1c14e57, `git apply --check` passes). No commit between 85540a74e and 9f1c14e57 touches
a candidate path.
agents/researcher/work/queue-120/candidate-manifest.sha256
+3 -3
View File
@@ -1,6 +1,6 @@
c9cc5a3b2a1ace84b2fcef8849a940118d30e57f4709dd98b284bd625f674da6 packages/bus/src/broker.mjs
2b2720420f6b67a6c1cecfe3dbe0f3046a2e838c9129a95e64780a40a3220fe0 packages/bus/src/broker.mjs
d756e762a696f40f102199d682570554c98c2ec1595a62c4fab511c35b77e48e packages/business/src/role.mjs
be21e269988255078825fb6dfb1431061378d77226b8f58801266c48169a8c03 roles/assistant.json
6a18989c1c467a94bba8d64f5267c43088e30826e94534f6c6cf5dc798b6642a packages/business/tests/role.test.mjs
a1cf8abc42b64f679aedd9bc9a64b032f003d23a660f1b044de428e831bc28b1 packages/business/tests/assistant.test.mjs
ed589e8f064325917d20dd7c8355910485da2b130f67b3ed511a3a385d8e3ae2 packages/bus/tests/messaging.test.mjs
1896e5a4eb6371b11fdb79a651791fc8ef5faf6b3d17f09e83582254bd5ef095 packages/business/tests/assistant.test.mjs
92f8dbff87b4403d924d0e2412990c932aaa97e820f86ba5b33258b34e1c1787 packages/bus/tests/messaging.test.mjs
agents/researcher/work/queue-120/mutants-run.txt
+31 -14
View File
@@ -1,50 +1,58 @@
control-messaging: exit 0; ℹ tests 9 ℹ pass 9 ℹ fail 0
control-messaging: exit 0; ℹ tests 12 ℹ pass 12 ℹ fail 0
control-role: exit 0; ℹ tests 14 ℹ pass 14 ℹ fail 0
control-assistant: exit 0; ℹ tests 8 ℹ pass 8 ℹ fail 0
m1-drop-sender-side-check: exit 1; ℹ tests 9 ℹ pass 6 ℹ fail 3
m1-drop-sender-side-check: exit 1; ℹ tests 12 ℹ pass 8 ℹ fail 4
failed: ✖ an assistant send to any other role, or to the tester, is refused and logged
failed: ✖ a sender-side list alone refuses a send to a role that has no list
failed: ✖ failing tests:
failed: ✖ the assistant's review.request to a reviewer is refused and logged, even with an approved decision
failed: ✖ the sender list is checked before the target list
m2-drop-target-side-check: exit 1; ℹ tests 9 ℹ pass 7 ℹ fail 2
m2-drop-target-side-check: exit 1; ℹ tests 12 ℹ pass 9 ℹ fail 3
failed: ✖ a review.verdict to the assistant from a role outside its receiveFrom is refused and logged
failed: ✖ a target-side list alone refuses a send from a role that has no list
failed: ✖ failing tests:
failed: ✖ only the user and the chief of staff may send to the assistant; the tester is refused by default
m3-drop-refusal-log: exit 1; ℹ tests 9 ℹ pass 4 ℹ fail 5
m3-drop-refusal-log: exit 1; ℹ tests 12 ℹ pass 5 ℹ fail 7
failed: ✖ an assistant send to any other role, or to the tester, is refused and logged
failed: ✖ a review.verdict to the assistant from a role outside its receiveFrom is refused and logged
failed: ✖ a sender-side list alone refuses a send to a role that has no list
failed: ✖ a target-side list alone refuses a send from a role that has no list
failed: ✖ failing tests:
failed: ✖ only the user and the chief of staff may send to the assistant; the tester is refused by default
failed: ✖ the assistant's review.request to a reviewer is refused and logged, even with an approved decision
failed: ✖ the sender list is checked before the target list
m4-sender-reads-receive-list: exit 1; ℹ tests 9 ℹ pass 7 ℹ fail 2
m4-sender-reads-receive-list: exit 1; ℹ tests 12 ℹ pass 10 ℹ fail 2
failed: ✖ a sender-side list alone refuses a send to a role that has no list
failed: ✖ failing tests:
failed: ✖ the sender list is checked before the target list
m5-target-reads-send-list: exit 1; ℹ tests 9 ℹ pass 8 ℹ fail 1
m5-target-reads-send-list: exit 1; ℹ tests 12 ℹ pass 11 ℹ fail 1
failed: ✖ a target-side list alone refuses a send from a role that has no list
failed: ✖ failing tests:
m6-tester-exempt: exit 1; ℹ tests 9 ℹ pass 7 ℹ fail 2
m6-tester-exempt: exit 1; ℹ tests 12 ℹ pass 10 ℹ fail 2
failed: ✖ a target-side list alone refuses a send from a role that has no list
failed: ✖ failing tests:
failed: ✖ only the user and the chief of staff may send to the assistant; the tester is refused by default
m7-no-field-refuses-sender: exit 1; ℹ tests 9 ℹ pass 5 ℹ fail 4
m7-no-field-refuses-sender: exit 1; ℹ tests 12 ℹ pass 6 ℹ fail 6
failed: ✖ a business with no role definitions at all is unlimited
failed: ✖ a review.verdict to the assistant from a role outside its receiveFrom is refused and logged
failed: ✖ a target-side list alone refuses a send from a role that has no list
failed: ✖ failing tests:
failed: ✖ only the user and the chief of staff may send to the assistant; the tester is refused by default
failed: ✖ review requests and verdicts between roles without the field are unchanged
failed: ✖ roles without the field behave exactly as before
m8-no-field-refuses-target: exit 1; ℹ tests 9 ℹ pass 4 ℹ fail 5
m8-no-field-refuses-target: exit 1; ℹ tests 12 ℹ pass 5 ℹ fail 7
failed: ✖ a business with no role definitions at all is unlimited
failed: ✖ an assistant send to any other role, or to the tester, is refused and logged
failed: ✖ a review.verdict to the assistant from a role outside its receiveFrom is refused and logged
failed: ✖ a sender-side list alone refuses a send to a role that has no list
failed: ✖ failing tests:
failed: ✖ review requests and verdicts between roles without the field are unchanged
failed: ✖ roles without the field behave exactly as before
failed: ✖ the assistant sends to the user and to the chief of staff only
m9-target-by-instance-name: exit 1; ℹ tests 9 ℹ pass 8 ℹ fail 1
m9-target-by-instance-name: exit 1; ℹ tests 12 ℹ pass 11 ℹ fail 1
failed: ✖ failing tests:
failed: ✖ the assistant sends to the user and to the chief of staff only
m10-boot-shape-unchecked: exit 1; ℹ tests 9 ℹ pass 8 ℹ fail 1
m10-boot-shape-unchecked: exit 1; ℹ tests 12 ℹ pass 11 ℹ fail 1
failed: ✖ a malformed messaging field refuses at boot
failed: ✖ failing tests:
m11-validator-accepts-tester: exit 1; ℹ tests 14 ℹ pass 13 ℹ fail 1
@@ -56,7 +64,7 @@ m12a-loader-drops-field: exit 1; ℹ tests 14 ℹ pass 13 ℹ fail 1
m12b-loader-drops-field: exit 1; ℹ tests 8 ℹ pass 7 ℹ fail 1
failed: ✖ failing tests:
failed: ✖ the assistant talks to the user and the chief of staff only, and no other shipped role is limited
m13a-assistant-sendTo-pm: exit 1; ℹ tests 9 ℹ pass 7 ℹ fail 2
m13a-assistant-sendTo-pm: exit 1; ℹ tests 12 ℹ pass 10 ℹ fail 2
failed: ✖ an assistant send to any other role, or to the tester, is refused and logged
failed: ✖ failing tests:
failed: ✖ the assistant sends to the user and to the chief of staff only
@@ -64,7 +72,7 @@ m13b-assistant-sendTo-pm: exit 1; ℹ tests 8 ℹ pass 6 ℹ fail 2
failed: ✖ failing tests:
failed: ✖ the assistant talks to the user and the chief of staff only, and no other shipped role is limited
failed: ✖ the shipped file is exactly the approved list
m14a-assistant-receiveFrom-coder: exit 1; ℹ tests 9 ℹ pass 7 ℹ fail 2
m14a-assistant-receiveFrom-coder: exit 1; ℹ tests 12 ℹ pass 10 ℹ fail 2
failed: ✖ failing tests:
failed: ✖ only the user and the chief of staff may send to the assistant; the tester is refused by default
failed: ✖ the assistant sends to the user and to the chief of staff only
@@ -72,13 +80,22 @@ m14b-assistant-receiveFrom-coder: exit 1; ℹ tests 8 ℹ pass 6 ℹ fail 2
failed: ✖ failing tests:
failed: ✖ the assistant talks to the user and the chief of staff only, and no other shipped role is limited
failed: ✖ the shipped file is exactly the approved list
m15a-assistant-unlimited: exit 1; ℹ tests 9 ℹ pass 6 ℹ fail 3
m15a-assistant-unlimited: exit 1; ℹ tests 12 ℹ pass 7 ℹ fail 5
failed: ✖ an assistant send to any other role, or to the tester, is refused and logged
failed: ✖ a review.verdict to the assistant from a role outside its receiveFrom is refused and logged
failed: ✖ failing tests:
failed: ✖ only the user and the chief of staff may send to the assistant; the tester is refused by default
failed: ✖ the assistant sends to the user and to the chief of staff only
failed: ✖ the assistant's review.request to a reviewer is refused and logged, even with an approved decision
m15b-assistant-unlimited: exit 1; ℹ tests 8 ℹ pass 6 ℹ fail 2
failed: ✖ failing tests:
failed: ✖ the assistant talks to the user and the chief of staff only, and no other shipped role is limited
failed: ✖ the shipped file is exactly the approved list
m16-review-request-unchecked: exit 1; ℹ tests 12 ℹ pass 11 ℹ fail 1
failed: ✖ failing tests:
failed: ✖ the assistant's review.request to a reviewer is refused and logged, even with an approved decision
m17-review-verdict-unchecked: exit 1; ℹ tests 12 ℹ pass 11 ℹ fail 1
failed: ✖ a review.verdict to the assistant from a role outside its receiveFrom is refused and logged
failed: ✖ failing tests:
done
exit=0
agents/researcher/work/queue-120/mutants.sh
+7
View File
@@ -83,4 +83,11 @@ for pair in "a $MSG" "b $AST"; do
}' '"credentials": []
}'
done
# m16: review.request skips the lists (round 1 F1)
mutant m16-review-request-unchecked "$MSG" "$B" "this.#checkMessaging(s, a.to);
const mid = randomUUID();
// Row 105" "const mid = randomUUID();
// Row 105"
# m17: review.verdict skips the lists (round 1 F1)
mutant m17-review-verdict-unchecked "$MSG" "$B" "this.#checkMessaging(s, r.from);" "void 0;"
echo done
agents/researcher/work/queue-120/mutants/control-assistant.out
+9 -9
View File
@@ -1,11 +1,11 @@
✔ the role file loads and resolves through loadBusiness (5.025749ms)
✔ the shipped file is exactly the approved list (0.628134ms)
✔ the assistant's authority is message.send within role and nothing else (1.389008ms)
✔ the assistant talks to the user and the chief of staff only, and no other shipped role is limited (0.490198ms)
✔ a business grant through limits does not widen the role (1.095085ms)
✔ a launch block whose by is the assistant is refused (1.149384ms)
✔ the instance takes no credential references and no tracker (1.875469ms)
✔ the contract passes work to the chief of staff and directs no one (0.452619ms)
✔ the role file loads and resolves through loadBusiness (4.346689ms)
✔ the shipped file is exactly the approved list (0.520551ms)
✔ the assistant's authority is message.send within role and nothing else (1.302822ms)
✔ the assistant talks to the user and the chief of staff only, and no other shipped role is limited (0.500204ms)
✔ a business grant through limits does not widen the role (1.143576ms)
✔ a launch block whose by is the assistant is refused (1.220948ms)
✔ the instance takes no credential references and no tracker (1.920509ms)
✔ the contract passes work to the chief of staff and directs no one (0.444991ms)
ℹ tests 8
ℹ suites 0
ℹ pass 8
@@ -13,4 +13,4 @@
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 66.143037
ℹ duration_ms 59.562187
agents/researcher/work/queue-120/mutants/control-messaging.out
+15 -12
View File
@@ -1,17 +1,20 @@
✔ the assistant sends to the user and to the chief of staff only (27.538171ms)
✔ an assistant send to any other role, or to the tester, is refused and logged (23.196209ms)
✔ only the user and the chief of staff may send to the assistant; the tester is refused by default (19.913919ms)
✔ a sender-side list alone refuses a send to a role that has no list (15.839581ms)
✔ a target-side list alone refuses a send from a role that has no list (16.275671ms)
✔ the sender list is checked before the target list (14.353692ms)
✔ roles without the field behave exactly as before (21.162362ms)
✔ a business with no role definitions at all is unlimited (14.803918ms)
✔ a malformed messaging field refuses at boot (7.089064ms)
ℹ tests 9
✔ the assistant sends to the user and to the chief of staff only (21.493731ms)
✔ an assistant send to any other role, or to the tester, is refused and logged (19.550575ms)
✔ only the user and the chief of staff may send to the assistant; the tester is refused by default (17.53625ms)
✔ a sender-side list alone refuses a send to a role that has no list (15.700638ms)
✔ a target-side list alone refuses a send from a role that has no list (16.956774ms)
✔ the sender list is checked before the target list (14.417895ms)
✔ roles without the field behave exactly as before (22.015999ms)
✔ a business with no role definitions at all is unlimited (16.104533ms)
✔ a malformed messaging field refuses at boot (6.873928ms)
✔ the assistant's review.request to a reviewer is refused and logged, even with an approved decision (18.176379ms)
✔ a review.verdict to the assistant from a role outside its receiveFrom is refused and logged (20.006489ms)
✔ review requests and verdicts between roles without the field are unchanged (16.288454ms)
ℹ tests 12
ℹ suites 0
ℹ pass 9
ℹ pass 12
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 217.792497
ℹ duration_ms 260.749393
agents/researcher/work/queue-120/mutants/control-role.out
+15 -15
View File
@@ -1,17 +1,17 @@
✔ the four shipped version 2 roles load (2.531838ms)
✔ shipped role scopes match addendum B section 2 and the SR runbook (0.835081ms)
✔ shipped authority follows the note's table (0.476996ms)
✔ every role file in roles/ loads through the validator, and a v2 contract exists (0.553728ms)
✔ version 1 files keep loading with no authority (0.844998ms)
✔ the conductor policy isn't a role (0.164697ms)
✔ a missing role file is exit 4, a symbolic link too (0.370168ms)
✔ version 2 refusals (1.000344ms)
✔ authority: closed vocabulary, no gated-only action, no overlap (1.605938ms)
✔ messaging: optional, role definitions and human, never the tester (1.199491ms)
✔ credentials: Gitea scopes (0.934977ms)
✔ credentials: Vikunja scopes are a group-to-verbs map from the grantable list (0.837613ms)
✔ credentials: services (0.514901ms)
✔ contract: a non-empty regular Markdown file beside the role file (0.703454ms)
✔ the four shipped version 2 roles load (2.066694ms)
✔ shipped role scopes match addendum B section 2 and the SR runbook (0.686769ms)
✔ shipped authority follows the note's table (0.437486ms)
✔ every role file in roles/ loads through the validator, and a v2 contract exists (0.516656ms)
✔ version 1 files keep loading with no authority (0.71103ms)
✔ the conductor policy isn't a role (0.140674ms)
✔ a missing role file is exit 4, a symbolic link too (0.269238ms)
✔ version 2 refusals (0.932121ms)
✔ authority: closed vocabulary, no gated-only action, no overlap (1.562199ms)
✔ messaging: optional, role definitions and human, never the tester (1.109356ms)
✔ credentials: Gitea scopes (0.797725ms)
✔ credentials: Vikunja scopes are a group-to-verbs map from the grantable list (0.71924ms)
✔ credentials: services (0.446141ms)
✔ contract: a non-empty regular Markdown file beside the role file (0.470914ms)
ℹ tests 14
ℹ suites 0
ℹ pass 14
@@ -19,4 +19,4 @@
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 75.812975
ℹ duration_ms 61.65172
agents/researcher/work/queue-120/mutants/m1-drop-sender-side-check.out
+52 -31
View File
@@ -1,27 +1,30 @@
✔ the assistant sends to the user and to the chief of staff only (21.787903ms)
✖ an assistant send to any other role, or to the tester, is refused and logged (16.192101ms)
✔ only the user and the chief of staff may send to the assistant; the tester is refused by default (17.833444ms)
✖ a sender-side list alone refuses a send to a role that has no list (14.625389ms)
✔ a target-side list alone refuses a send from a role that has no list (16.956965ms)
✖ the sender list is checked before the target list (14.945376ms)
✔ roles without the field behave exactly as before (21.700633ms)
✔ a business with no role definitions at all is unlimited (15.78649ms)
✔ a malformed messaging field refuses at boot (7.562985ms)
ℹ tests 9
✔ the assistant sends to the user and to the chief of staff only (22.742319ms)
✖ an assistant send to any other role, or to the tester, is refused and logged (18.810262ms)
✔ only the user and the chief of staff may send to the assistant; the tester is refused by default (23.385036ms)
✖ a sender-side list alone refuses a send to a role that has no list (20.821195ms)
✔ a target-side list alone refuses a send from a role that has no list (21.672827ms)
✖ the sender list is checked before the target list (16.359745ms)
✔ roles without the field behave exactly as before (22.526589ms)
✔ a business with no role definitions at all is unlimited (16.785713ms)
✔ a malformed messaging field refuses at boot (10.174246ms)
✖ the assistant's review.request to a reviewer is refused and logged, even with an approved decision (19.732604ms)
✔ a review.verdict to the assistant from a role outside its receiveFrom is refused and logged (21.374516ms)
✔ review requests and verdicts between roles without the field are unchanged (17.471079ms)
ℹ tests 12
ℹ suites 0
ℹ pass 6
ℹ fail 3
ℹ pass 8
ℹ fail 4
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 202.671166
ℹ duration_ms 291.085843
✖ failing tests:
test at packages/bus/tests/messaging.test.mjs:88:1
✖ an assistant send to any other role, or to the tester, is refused and logged (16.192101ms)
test at packages/bus/tests/messaging.test.mjs:97:1
✖ an assistant send to any other role, or to the tester, is refused and logged (18.810262ms)
AssertionError [ERR_ASSERTION]: Missing expected exception: pm
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:94:35)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:103:35)
at Test.runInAsyncScope (node:async_hooks:226:14)
at Test.run (node:internal/test_runner/test:1402:25)
at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
@@ -36,10 +39,10 @@ test at packages/bus/tests/messaging.test.mjs:88:1
diff: 'simple'
}
test at packages/bus/tests/messaging.test.mjs:125:1
✖ a sender-side list alone refuses a send to a role that has no list (14.625389ms)
test at packages/bus/tests/messaging.test.mjs:134:1
✖ a sender-side list alone refuses a send to a role that has no list (20.821195ms)
AssertionError [ERR_ASSERTION]: Missing expected exception.
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:128:10)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:137:10)
at Test.runInAsyncScope (node:async_hooks:226:14)
at Test.run (node:internal/test_runner/test:1402:25)
at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
@@ -54,8 +57,8 @@ test at packages/bus/tests/messaging.test.mjs:125:1
diff: 'simple'
}
test at packages/bus/tests/messaging.test.mjs:143:1
✖ the sender list is checked before the target list (14.945376ms)
test at packages/bus/tests/messaging.test.mjs:152:1
✖ the sender list is checked before the target list (16.359745ms)
AssertionError [ERR_ASSERTION]: Expected values to be strictly deep-equal:
+ actual - expected
@@ -64,7 +67,7 @@ test at packages/bus/tests/messaging.test.mjs:143:1
- code: 'message-recipient-refused'
}
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:146:10)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:155:10)
at Test.runInAsyncScope (node:async_hooks:226:14)
at Test.run (node:internal/test_runner/test:1402:25)
at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
@@ -74,17 +77,35 @@ test at packages/bus/tests/messaging.test.mjs:143:1
generatedMessage: true,
code: 'ERR_ASSERTION',
actual: Error: message-sender-refused
at fail (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:76:9)
at #checkMessaging (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:338:59)
at #dispatch (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:969:29)
at file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:701:38
at Store.transaction (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/store.mjs:156:22)
at Broker.request (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:695:26)
at call (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:64:44)
at send (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:66:5)
at assert.throws.code (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:146:23)
at fail (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:76:9)
at #checkMessaging (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:341:59)
at #dispatch (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:991:29)
at file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:723:38
at Store.transaction (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/store.mjs:156:22)
at Broker.request (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:717:26)
at call (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:73:44)
at send (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:75:5)
at assert.throws.code (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:155:23)
at getActual (node:assert:580:5),
expected: { code: 'message-recipient-refused' },
operator: 'throws',
diff: 'simple'
}
test at packages/bus/tests/messaging.test.mjs:239:1
✖ the assistant's review.request to a reviewer is refused and logged, even with an approved decision (19.732604ms)
AssertionError [ERR_ASSERTION]: Missing expected exception.
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:248:10)
at Test.runInAsyncScope (node:async_hooks:226:14)
at Test.run (node:internal/test_runner/test:1402:25)
at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
at Test.postRun (node:internal/test_runner/test:1542:19)
at Test.run (node:internal/test_runner/test:1467:12)
at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) {
generatedMessage: false,
code: 'ERR_ASSERTION',
actual: undefined,
expected: { code: 'message-recipient-refused' },
operator: 'throws',
diff: 'simple'
}
agents/researcher/work/queue-120/mutants/m1-drop-sender-side-check.patch
+3 -3
View File
@@ -1,6 +1,6 @@
--- /mnt/storage/src/mosaic-stack/agents/researcher/work/queue-120/mutants/.bak.yvAdpu/packages/bus/src/broker.mjs 2026-10-14 20:22:06.948510829 -0500
+++ packages/bus/src/broker.mjs 2026-10-14 20:22:06.967292843 -0500
@@ -333,7 +333,7 @@
--- /mnt/storage/scratch/researcher/r120r2-mutants/.bak.aROvEt/packages/bus/src/broker.mjs 2026-10-14 20:57:29.701567176 -0500
+++ packages/bus/src/broker.mjs 2026-10-14 20:57:29.721664478 -0500
@@ -336,7 +336,7 @@
const sender = s.human ? 'human' : s.tester ? 'tester' : b.roles[s.role]?.definition;
const target = to === 'human' || to === 'tester' ? to : b.roles[to]?.definition;
const out = s.human || s.tester ? undefined : definition(s.role)?.messaging;
agents/researcher/work/queue-120/mutants/m10-boot-shape-unchecked.out
+18 -15
View File
@@ -1,27 +1,30 @@
✔ the assistant sends to the user and to the chief of staff only (21.403361ms)
✔ an assistant send to any other role, or to the tester, is refused and logged (19.076295ms)
✔ only the user and the chief of staff may send to the assistant; the tester is refused by default (18.146519ms)
✔ a sender-side list alone refuses a send to a role that has no list (16.862936ms)
✔ a target-side list alone refuses a send from a role that has no list (17.710285ms)
✔ the sender list is checked before the target list (14.879144ms)
✔ roles without the field behave exactly as before (22.021223ms)
✔ a business with no role definitions at all is unlimited (15.278317ms)
✖ a malformed messaging field refuses at boot (6.684574ms)
ℹ tests 9
✔ the assistant sends to the user and to the chief of staff only (21.008595ms)
✔ an assistant send to any other role, or to the tester, is refused and logged (19.223535ms)
✔ only the user and the chief of staff may send to the assistant; the tester is refused by default (16.832782ms)
✔ a sender-side list alone refuses a send to a role that has no list (15.511693ms)
✔ a target-side list alone refuses a send from a role that has no list (16.435305ms)
✔ the sender list is checked before the target list (14.310683ms)
✔ roles without the field behave exactly as before (23.277097ms)
✔ a business with no role definitions at all is unlimited (15.78828ms)
✖ a malformed messaging field refuses at boot (5.809993ms)
✔ the assistant's review.request to a reviewer is refused and logged, even with an approved decision (18.178455ms)
✔ a review.verdict to the assistant from a role outside its receiveFrom is refused and logged (20.013604ms)
✔ review requests and verdicts between roles without the field are unchanged (15.21476ms)
ℹ tests 12
ℹ suites 0
ℹ pass 8
ℹ pass 11
ℹ fail 1
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 212.467116
ℹ duration_ms 252.629678
✖ failing tests:
test at packages/bus/tests/messaging.test.mjs:180:1
✖ a malformed messaging field refuses at boot (6.684574ms)
test at packages/bus/tests/messaging.test.mjs:189:1
✖ a malformed messaging field refuses at boot (5.809993ms)
AssertionError [ERR_ASSERTION]: Missing expected exception: "human"
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:201:12)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:210:12)
at Test.runInAsyncScope (node:async_hooks:226:14)
at Test.run (node:internal/test_runner/test:1402:25)
at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
agents/researcher/work/queue-120/mutants/m10-boot-shape-unchecked.patch
+3 -3
View File
@@ -1,6 +1,6 @@
--- /mnt/storage/src/mosaic-stack/agents/researcher/work/queue-120/mutants/.bak.yvAdpu/packages/bus/src/broker.mjs 2026-10-14 20:22:06.948510829 -0500
+++ packages/bus/src/broker.mjs 2026-10-14 20:22:09.305316657 -0500
@@ -157,7 +157,7 @@
--- /mnt/storage/scratch/researcher/r120r2-mutants/.bak.aROvEt/packages/bus/src/broker.mjs 2026-10-14 20:57:29.701567176 -0500
+++ packages/bus/src/broker.mjs 2026-10-14 20:57:32.480699863 -0500
@@ -159,7 +159,7 @@
(k) => Array.isArray(m[k]) && m[k].every((r) => id(r) && r !== 'tester'),
)
)
agents/researcher/work/queue-120/mutants/m11-validator-accepts-tester.out
+18 -18
View File
@@ -1,17 +1,17 @@
✔ the four shipped version 2 roles load (2.37926ms)
✔ shipped role scopes match addendum B section 2 and the SR runbook (0.71676ms)
✔ shipped authority follows the note's table (0.443335ms)
✔ every role file in roles/ loads through the validator, and a v2 contract exists (0.544356ms)
✔ version 1 files keep loading with no authority (0.848602ms)
✔ the conductor policy isn't a role (0.145786ms)
✔ a missing role file is exit 4, a symbolic link too (0.321409ms)
✔ version 2 refusals (1.009939ms)
✔ authority: closed vocabulary, no gated-only action, no overlap (1.692185ms)
✖ messaging: optional, role definitions and human, never the tester (1.424799ms)
✔ credentials: Gitea scopes (0.618981ms)
✔ credentials: Vikunja scopes are a group-to-verbs map from the grantable list (1.056203ms)
✔ credentials: services (0.375785ms)
✔ contract: a non-empty regular Markdown file beside the role file (0.557179ms)
✔ the four shipped version 2 roles load (2.232114ms)
✔ shipped role scopes match addendum B section 2 and the SR runbook (0.691429ms)
✔ shipped authority follows the note's table (0.430109ms)
✔ every role file in roles/ loads through the validator, and a v2 contract exists (0.55716ms)
✔ version 1 files keep loading with no authority (0.754446ms)
✔ the conductor policy isn't a role (0.141171ms)
✔ a missing role file is exit 4, a symbolic link too (0.2798ms)
✔ version 2 refusals (0.937504ms)
✔ authority: closed vocabulary, no gated-only action, no overlap (1.479841ms)
✖ messaging: optional, role definitions and human, never the tester (1.258337ms)
✔ credentials: Gitea scopes (0.811515ms)
✔ credentials: Vikunja scopes are a group-to-verbs map from the grantable list (0.694184ms)
✔ credentials: services (0.405446ms)
✔ contract: a non-empty regular Markdown file beside the role file (0.436697ms)
ℹ tests 14
ℹ suites 0
ℹ pass 13
@@ -19,15 +19,15 @@
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 66.135454
ℹ duration_ms 59.62854
✖ failing tests:
test at packages/business/tests/role.test.mjs:135:1
✖ messaging: optional, role definitions and human, never the tester (1.424799ms)
✖ messaging: optional, role definitions and human, never the tester (1.258337ms)
AssertionError [ERR_ASSERTION]: Missing expected exception.
at refuses (file:///mnt/storage/scratch/researcher/q120/packages/business/tests/role.test.mjs:9:10)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120/packages/business/tests/role.test.mjs:147:3)
at refuses (file:///mnt/storage/scratch/researcher/q120r2/packages/business/tests/role.test.mjs:9:10)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/business/tests/role.test.mjs:147:3)
at Test.runInAsyncScope (node:async_hooks:226:14)
at Test.run (node:internal/test_runner/test:1402:25)
at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
agents/researcher/work/queue-120/mutants/m11-validator-accepts-tester.patch
+2 -2
View File
@@ -1,5 +1,5 @@
--- /mnt/storage/src/mosaic-stack/agents/researcher/work/queue-120/mutants/.bak.yvAdpu/packages/business/src/role.mjs 2026-10-14 20:22:09.559150184 -0500
+++ packages/business/src/role.mjs 2026-10-14 20:22:09.576319417 -0500
--- /mnt/storage/scratch/researcher/r120r2-mutants/.bak.aROvEt/packages/business/src/role.mjs 2026-10-14 20:57:32.767396720 -0500
+++ packages/business/src/role.mjs 2026-10-14 20:57:32.784703761 -0500
@@ -58,7 +58,7 @@
for (const key of ["sendTo", "receiveFrom"]) {
lists[key] = requireDistinctList(messaging[key], `role messaging.${key}`, (entry) => {
agents/researcher/work/queue-120/mutants/m12a-loader-drops-field.out
+17 -17
View File
@@ -1,17 +1,17 @@
✔ the four shipped version 2 roles load (2.339623ms)
✔ shipped role scopes match addendum B section 2 and the SR runbook (0.720739ms)
✔ shipped authority follows the note's table (0.475548ms)
✔ every role file in roles/ loads through the validator, and a v2 contract exists (0.47729ms)
✔ version 1 files keep loading with no authority (0.84248ms)
✔ the conductor policy isn't a role (0.152063ms)
✔ a missing role file is exit 4, a symbolic link too (0.305545ms)
✔ version 2 refusals (0.961716ms)
✔ authority: closed vocabulary, no gated-only action, no overlap (1.575172ms)
✖ messaging: optional, role definitions and human, never the tester (1.194184ms)
✔ credentials: Gitea scopes (0.609496ms)
✔ credentials: Vikunja scopes are a group-to-verbs map from the grantable list (1.010414ms)
✔ credentials: services (0.404915ms)
✔ contract: a non-empty regular Markdown file beside the role file (0.494346ms)
✔ the four shipped version 2 roles load (2.032405ms)
✔ shipped role scopes match addendum B section 2 and the SR runbook (0.665114ms)
✔ shipped authority follows the note's table (0.43323ms)
✔ every role file in roles/ loads through the validator, and a v2 contract exists (0.424955ms)
✔ version 1 files keep loading with no authority (0.707712ms)
✔ the conductor policy isn't a role (0.133575ms)
✔ a missing role file is exit 4, a symbolic link too (0.281889ms)
✔ version 2 refusals (0.857751ms)
✔ authority: closed vocabulary, no gated-only action, no overlap (1.572681ms)
✖ messaging: optional, role definitions and human, never the tester (1.041831ms)
✔ credentials: Gitea scopes (0.613258ms)
✔ credentials: Vikunja scopes are a group-to-verbs map from the grantable list (0.928876ms)
✔ credentials: services (0.376001ms)
✔ contract: a non-empty regular Markdown file beside the role file (0.522307ms)
ℹ tests 14
ℹ suites 0
ℹ pass 13
@@ -19,12 +19,12 @@
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 69.541098
ℹ duration_ms 59.326676
✖ failing tests:
test at packages/business/tests/role.test.mjs:135:1
✖ messaging: optional, role definitions and human, never the tester (1.194184ms)
✖ messaging: optional, role definitions and human, never the tester (1.041831ms)
AssertionError [ERR_ASSERTION]: Expected values to be strictly deep-equal:
+ actual - expected
@@ -37,7 +37,7 @@ test at packages/business/tests/role.test.mjs:135:1
- ]
- }
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120/packages/business/tests/role.test.mjs:138:10)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/business/tests/role.test.mjs:138:10)
at Test.runInAsyncScope (node:async_hooks:226:14)
at Test.run (node:internal/test_runner/test:1402:25)
at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
agents/researcher/work/queue-120/mutants/m12a-loader-drops-field.patch
+2 -2
View File
@@ -1,5 +1,5 @@
--- /mnt/storage/src/mosaic-stack/agents/researcher/work/queue-120/mutants/.bak.yvAdpu/packages/business/src/role.mjs 2026-10-14 20:22:09.559150184 -0500
+++ packages/business/src/role.mjs 2026-10-14 20:22:09.697320650 -0500
--- /mnt/storage/scratch/researcher/r120r2-mutants/.bak.aROvEt/packages/business/src/role.mjs 2026-10-14 20:57:32.767396720 -0500
+++ packages/business/src/role.mjs 2026-10-14 20:57:32.897705210 -0500
@@ -152,7 +152,7 @@
network: checkNetwork(document.network),
authority: checkAuthority(document.authority),
agents/researcher/work/queue-120/mutants/m12b-loader-drops-field.out
+11 -11
View File
@@ -1,11 +1,11 @@
✔ the role file loads and resolves through loadBusiness (4.582399ms)
✔ the shipped file is exactly the approved list (0.6061ms)
✔ the assistant's authority is message.send within role and nothing else (1.429422ms)
✖ the assistant talks to the user and the chief of staff only, and no other shipped role is limited (1.10325ms)
✔ a business grant through limits does not widen the role (1.227914ms)
✔ a launch block whose by is the assistant is refused (1.149985ms)
✔ the instance takes no credential references and no tracker (2.048903ms)
✔ the contract passes work to the chief of staff and directs no one (0.40784ms)
✔ the role file loads and resolves through loadBusiness (4.316171ms)
✔ the shipped file is exactly the approved list (0.532919ms)
✔ the assistant's authority is message.send within role and nothing else (1.243452ms)
✖ the assistant talks to the user and the chief of staff only, and no other shipped role is limited (0.944495ms)
✔ a business grant through limits does not widen the role (1.047438ms)
✔ a launch block whose by is the assistant is refused (1.132234ms)
✔ the instance takes no credential references and no tracker (1.70505ms)
✔ the contract passes work to the chief of staff and directs no one (0.359419ms)
ℹ tests 8
ℹ suites 0
ℹ pass 7
@@ -13,12 +13,12 @@
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 66.844399
ℹ duration_ms 61.551049
✖ failing tests:
test at packages/business/tests/assistant.test.mjs:83:1
✖ the assistant talks to the user and the chief of staff only, and no other shipped role is limited (1.10325ms)
✖ the assistant talks to the user and the chief of staff only, and no other shipped role is limited (0.944495ms)
AssertionError [ERR_ASSERTION]: Expected values to be strictly deep-equal:
+ actual - expected
@@ -34,7 +34,7 @@ test at packages/business/tests/assistant.test.mjs:83:1
- ]
- }
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120/packages/business/tests/assistant.test.mjs:85:10)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/business/tests/assistant.test.mjs:85:10)
at Test.runInAsyncScope (node:async_hooks:226:14)
at Test.run (node:internal/test_runner/test:1402:25)
at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
agents/researcher/work/queue-120/mutants/m12b-loader-drops-field.patch
+2 -2
View File
@@ -1,5 +1,5 @@
--- /mnt/storage/src/mosaic-stack/agents/researcher/work/queue-120/mutants/.bak.yvAdpu/packages/business/src/role.mjs 2026-10-14 20:22:09.559150184 -0500
+++ packages/business/src/role.mjs 2026-10-14 20:22:09.825321954 -0500
--- /mnt/storage/scratch/researcher/r120r2-mutants/.bak.aROvEt/packages/business/src/role.mjs 2026-10-14 20:57:32.767396720 -0500
+++ packages/business/src/role.mjs 2026-10-14 20:57:33.007706621 -0500
@@ -152,7 +152,7 @@
network: checkNetwork(document.network),
authority: checkAuthority(document.authority),
agents/researcher/work/queue-120/mutants/m13a-assistant-sendTo-pm.out
+21 -18
View File
@@ -1,25 +1,28 @@
✖ the assistant sends to the user and to the chief of staff only (20.769902ms)
✖ an assistant send to any other role, or to the tester, is refused and logged (16.325872ms)
✔ only the user and the chief of staff may send to the assistant; the tester is refused by default (18.475084ms)
✔ a sender-side list alone refuses a send to a role that has no list (16.408895ms)
✔ a target-side list alone refuses a send from a role that has no list (17.662367ms)
✔ the sender list is checked before the target list (15.950453ms)
✔ roles without the field behave exactly as before (25.309787ms)
✔ a business with no role definitions at all is unlimited (16.157386ms)
✔ a malformed messaging field refuses at boot (8.764075ms)
ℹ tests 9
✖ the assistant sends to the user and to the chief of staff only (22.96533ms)
✖ an assistant send to any other role, or to the tester, is refused and logged (16.173765ms)
✔ only the user and the chief of staff may send to the assistant; the tester is refused by default (17.484325ms)
✔ a sender-side list alone refuses a send to a role that has no list (15.530897ms)
✔ a target-side list alone refuses a send from a role that has no list (18.094105ms)
✔ the sender list is checked before the target list (14.606125ms)
✔ roles without the field behave exactly as before (21.459134ms)
✔ a business with no role definitions at all is unlimited (15.503562ms)
✔ a malformed messaging field refuses at boot (7.076003ms)
✔ the assistant's review.request to a reviewer is refused and logged, even with an approved decision (18.069563ms)
✔ a review.verdict to the assistant from a role outside its receiveFrom is refused and logged (20.783466ms)
✔ review requests and verdicts between roles without the field are unchanged (15.904433ms)
ℹ tests 12
ℹ suites 0
ℹ pass 7
ℹ pass 10
ℹ fail 2
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 215.618916
ℹ duration_ms 255.140935
✖ failing tests:
test at packages/bus/tests/messaging.test.mjs:78:1
✖ the assistant sends to the user and to the chief of staff only (20.769902ms)
test at packages/bus/tests/messaging.test.mjs:87:1
✖ the assistant sends to the user and to the chief of staff only (22.96533ms)
AssertionError [ERR_ASSERTION]: Expected values to be strictly deep-equal:
+ actual - expected
... Skipped lines
@@ -35,7 +38,7 @@ test at packages/bus/tests/messaging.test.mjs:78:1
]
}
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:80:10)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:89:10)
at Test.runInAsyncScope (node:async_hooks:226:14)
at Test.run (node:internal/test_runner/test:1402:25)
at Test.start (node:internal/test_runner/test:1262:17)
@@ -48,10 +51,10 @@ test at packages/bus/tests/messaging.test.mjs:78:1
diff: 'simple'
}
test at packages/bus/tests/messaging.test.mjs:88:1
✖ an assistant send to any other role, or to the tester, is refused and logged (16.325872ms)
test at packages/bus/tests/messaging.test.mjs:97:1
✖ an assistant send to any other role, or to the tester, is refused and logged (16.173765ms)
AssertionError [ERR_ASSERTION]: Missing expected exception: pm
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:94:35)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:103:35)
at Test.runInAsyncScope (node:async_hooks:226:14)
at Test.run (node:internal/test_runner/test:1402:25)
at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
agents/researcher/work/queue-120/mutants/m13a-assistant-sendTo-pm.patch
+2 -2
View File
@@ -1,5 +1,5 @@
--- /mnt/storage/src/mosaic-stack/agents/researcher/work/queue-120/mutants/.bak.yvAdpu/roles/assistant.json 2026-10-14 20:22:09.932589062 -0500
+++ roles/assistant.json 2026-10-14 20:22:09.951323237 -0500
--- /mnt/storage/scratch/researcher/r120r2-mutants/.bak.aROvEt/roles/assistant.json 2026-10-14 20:57:33.106137955 -0500
+++ roles/assistant.json 2026-10-14 20:57:33.121708083 -0500
@@ -11,7 +11,7 @@
},
"credentials": [],
agents/researcher/work/queue-120/mutants/m13b-assistant-sendTo-pm.out
+13 -13
View File
@@ -1,11 +1,11 @@
✔ the role file loads and resolves through loadBusiness (5.98655ms)
✖ the shipped file is exactly the approved list (1.759309ms)
✔ the assistant's authority is message.send within role and nothing else (1.866542ms)
✖ the assistant talks to the user and the chief of staff only, and no other shipped role is limited (0.499937ms)
✔ a business grant through limits does not widen the role (1.532646ms)
✔ a launch block whose by is the assistant is refused (1.821923ms)
✔ the instance takes no credential references and no tracker (2.235276ms)
✔ the contract passes work to the chief of staff and directs no one (0.454049ms)
✔ the role file loads and resolves through loadBusiness (4.22197ms)
✖ the shipped file is exactly the approved list (1.344469ms)
✔ the assistant's authority is message.send within role and nothing else (1.289471ms)
✖ the assistant talks to the user and the chief of staff only, and no other shipped role is limited (0.328909ms)
✔ a business grant through limits does not widen the role (1.07293ms)
✔ a launch block whose by is the assistant is refused (1.212085ms)
✔ the instance takes no credential references and no tracker (1.778008ms)
✔ the contract passes work to the chief of staff and directs no one (0.358556ms)
ℹ tests 8
ℹ suites 0
ℹ pass 6
@@ -13,12 +13,12 @@
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 78.690293
ℹ duration_ms 61.742582
✖ failing tests:
test at packages/business/tests/assistant.test.mjs:63:1
✖ the shipped file is exactly the approved list (1.759309ms)
✖ the shipped file is exactly the approved list (1.344469ms)
AssertionError [ERR_ASSERTION]: Expected values to be strictly deep-equal:
+ actual - expected
... Skipped lines
@@ -37,7 +37,7 @@ test at packages/business/tests/assistant.test.mjs:63:1
network: 'api-only',
roleVersion: 2,
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120/packages/business/tests/assistant.test.mjs:67:10)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/business/tests/assistant.test.mjs:67:10)
at Test.runInAsyncScope (node:async_hooks:226:14)
at Test.run (node:internal/test_runner/test:1402:25)
at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
@@ -53,7 +53,7 @@ test at packages/business/tests/assistant.test.mjs:63:1
}
test at packages/business/tests/assistant.test.mjs:83:1
✖ the assistant talks to the user and the chief of staff only, and no other shipped role is limited (0.499937ms)
✖ the assistant talks to the user and the chief of staff only, and no other shipped role is limited (0.328909ms)
AssertionError [ERR_ASSERTION]: Expected values to be strictly deep-equal:
+ actual - expected
... Skipped lines
@@ -69,7 +69,7 @@ test at packages/business/tests/assistant.test.mjs:83:1
]
}
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120/packages/business/tests/assistant.test.mjs:85:10)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/business/tests/assistant.test.mjs:85:10)
at Test.runInAsyncScope (node:async_hooks:226:14)
at Test.run (node:internal/test_runner/test:1402:25)
at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
agents/researcher/work/queue-120/mutants/m13b-assistant-sendTo-pm.patch
+2 -2
View File
@@ -1,5 +1,5 @@
--- /mnt/storage/src/mosaic-stack/agents/researcher/work/queue-120/mutants/.bak.yvAdpu/roles/assistant.json 2026-10-14 20:22:09.932589062 -0500
+++ roles/assistant.json 2026-10-14 20:22:10.225326028 -0500
--- /mnt/storage/scratch/researcher/r120r2-mutants/.bak.aROvEt/roles/assistant.json 2026-10-14 20:57:33.106137955 -0500
+++ roles/assistant.json 2026-10-14 20:57:33.432712070 -0500
@@ -11,7 +11,7 @@
},
"credentials": [],
agents/researcher/work/queue-120/mutants/m14a-assistant-receiveFrom-coder.out
+21 -18
View File
@@ -1,25 +1,28 @@
✖ the assistant sends to the user and to the chief of staff only (20.84959ms)
✔ an assistant send to any other role, or to the tester, is refused and logged (23.432859ms)
✖ only the user and the chief of staff may send to the assistant; the tester is refused by default (20.255769ms)
✔ a sender-side list alone refuses a send to a role that has no list (17.734573ms)
✔ a target-side list alone refuses a send from a role that has no list (19.809218ms)
✔ the sender list is checked before the target list (17.466006ms)
✔ roles without the field behave exactly as before (23.672218ms)
✔ a business with no role definitions at all is unlimited (17.675763ms)
✔ a malformed messaging field refuses at boot (8.83104ms)
ℹ tests 9
✖ the assistant sends to the user and to the chief of staff only (23.383188ms)
✔ an assistant send to any other role, or to the tester, is refused and logged (20.101907ms)
✖ only the user and the chief of staff may send to the assistant; the tester is refused by default (18.298095ms)
✔ a sender-side list alone refuses a send to a role that has no list (15.839937ms)
✔ a target-side list alone refuses a send from a role that has no list (16.951438ms)
✔ the sender list is checked before the target list (13.631867ms)
✔ roles without the field behave exactly as before (20.930133ms)
✔ a business with no role definitions at all is unlimited (15.673311ms)
✔ a malformed messaging field refuses at boot (7.237993ms)
✔ the assistant's review.request to a reviewer is refused and logged, even with an approved decision (17.8814ms)
✔ a review.verdict to the assistant from a role outside its receiveFrom is refused and logged (19.726685ms)
✔ review requests and verdicts between roles without the field are unchanged (16.063527ms)
ℹ tests 12
ℹ suites 0
ℹ pass 7
ℹ pass 10
ℹ fail 2
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 231.983215
ℹ duration_ms 266.85873
✖ failing tests:
test at packages/bus/tests/messaging.test.mjs:78:1
✖ the assistant sends to the user and to the chief of staff only (20.84959ms)
test at packages/bus/tests/messaging.test.mjs:87:1
✖ the assistant sends to the user and to the chief of staff only (23.383188ms)
AssertionError [ERR_ASSERTION]: Expected values to be strictly deep-equal:
+ actual - expected
@@ -34,7 +37,7 @@ test at packages/bus/tests/messaging.test.mjs:78:1
'chief-of-staff'
]
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:80:10)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:89:10)
at Test.runInAsyncScope (node:async_hooks:226:14)
at Test.run (node:internal/test_runner/test:1402:25)
at Test.start (node:internal/test_runner/test:1262:17)
@@ -47,10 +50,10 @@ test at packages/bus/tests/messaging.test.mjs:78:1
diff: 'simple'
}
test at packages/bus/tests/messaging.test.mjs:110:1
✖ only the user and the chief of staff may send to the assistant; the tester is refused by default (20.255769ms)
test at packages/bus/tests/messaging.test.mjs:119:1
✖ only the user and the chief of staff may send to the assistant; the tester is refused by default (18.298095ms)
AssertionError [ERR_ASSERTION]: Missing expected exception: coder
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:119:37)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:128:37)
at Test.runInAsyncScope (node:async_hooks:226:14)
at Test.run (node:internal/test_runner/test:1402:25)
at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
agents/researcher/work/queue-120/mutants/m14a-assistant-receiveFrom-coder.patch
+2 -2
View File
@@ -1,5 +1,5 @@
--- /mnt/storage/src/mosaic-stack/agents/researcher/work/queue-120/mutants/.bak.yvAdpu/roles/assistant.json 2026-10-14 20:22:09.932589062 -0500
+++ roles/assistant.json 2026-10-14 20:22:10.367327475 -0500
--- /mnt/storage/scratch/researcher/r120r2-mutants/.bak.aROvEt/roles/assistant.json 2026-10-14 20:57:33.106137955 -0500
+++ roles/assistant.json 2026-10-14 20:57:33.545713520 -0500
@@ -12,6 +12,6 @@
"credentials": [],
"messaging": {
agents/researcher/work/queue-120/mutants/m14b-assistant-receiveFrom-coder.out
+13 -13
View File
@@ -1,11 +1,11 @@
✔ the role file loads and resolves through loadBusiness (5.719343ms)
✖ the shipped file is exactly the approved list (1.730876ms)
✔ the assistant's authority is message.send within role and nothing else (1.704473ms)
✖ the assistant talks to the user and the chief of staff only, and no other shipped role is limited (0.421776ms)
✔ a business grant through limits does not widen the role (1.242733ms)
✔ a launch block whose by is the assistant is refused (1.885922ms)
✔ the instance takes no credential references and no tracker (2.664525ms)
✔ the contract passes work to the chief of staff and directs no one (0.500417ms)
✔ the role file loads and resolves through loadBusiness (4.178521ms)
✖ the shipped file is exactly the approved list (1.308817ms)
✔ the assistant's authority is message.send within role and nothing else (1.318105ms)
✖ the assistant talks to the user and the chief of staff only, and no other shipped role is limited (0.306439ms)
✔ a business grant through limits does not widen the role (1.060325ms)
✔ a launch block whose by is the assistant is refused (1.119712ms)
✔ the instance takes no credential references and no tracker (1.726597ms)
✔ the contract passes work to the chief of staff and directs no one (0.368394ms)
ℹ tests 8
ℹ suites 0
ℹ pass 6
@@ -13,12 +13,12 @@
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 86.98472
ℹ duration_ms 62.02484
✖ failing tests:
test at packages/business/tests/assistant.test.mjs:63:1
✖ the shipped file is exactly the approved list (1.730876ms)
✖ the shipped file is exactly the approved list (1.308817ms)
AssertionError [ERR_ASSERTION]: Expected values to be strictly deep-equal:
+ actual - expected
... Skipped lines
@@ -37,7 +37,7 @@ test at packages/business/tests/assistant.test.mjs:63:1
'chief-of-staff'
]
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120/packages/business/tests/assistant.test.mjs:67:10)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/business/tests/assistant.test.mjs:67:10)
at Test.runInAsyncScope (node:async_hooks:226:14)
at Test.run (node:internal/test_runner/test:1402:25)
at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
@@ -53,7 +53,7 @@ test at packages/business/tests/assistant.test.mjs:63:1
}
test at packages/business/tests/assistant.test.mjs:83:1
✖ the assistant talks to the user and the chief of staff only, and no other shipped role is limited (0.421776ms)
✖ the assistant talks to the user and the chief of staff only, and no other shipped role is limited (0.306439ms)
AssertionError [ERR_ASSERTION]: Expected values to be strictly deep-equal:
+ actual - expected
@@ -68,7 +68,7 @@ test at packages/business/tests/assistant.test.mjs:83:1
'chief-of-staff'
]
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120/packages/business/tests/assistant.test.mjs:85:10)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/business/tests/assistant.test.mjs:85:10)
at Test.runInAsyncScope (node:async_hooks:226:14)
at Test.run (node:internal/test_runner/test:1402:25)
at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
agents/researcher/work/queue-120/mutants/m14b-assistant-receiveFrom-coder.patch
+2 -2
View File
@@ -1,5 +1,5 @@
--- /mnt/storage/src/mosaic-stack/agents/researcher/work/queue-120/mutants/.bak.yvAdpu/roles/assistant.json 2026-10-14 20:22:09.932589062 -0500
+++ roles/assistant.json 2026-10-14 20:22:10.663330490 -0500
--- /mnt/storage/scratch/researcher/r120r2-mutants/.bak.aROvEt/roles/assistant.json 2026-10-14 20:57:33.106137955 -0500
+++ roles/assistant.json 2026-10-14 20:57:33.862717584 -0500
@@ -12,6 +12,6 @@
"credentials": [],
"messaging": {
agents/researcher/work/queue-120/mutants/m15a-assistant-unlimited.out
+61 -22
View File
@@ -1,25 +1,28 @@
✖ the assistant sends to the user and to the chief of staff only (23.868594ms)
✖ an assistant send to any other role, or to the tester, is refused and logged (19.195695ms)
✖ only the user and the chief of staff may send to the assistant; the tester is refused by default (18.400643ms)
✔ a sender-side list alone refuses a send to a role that has no list (19.513217ms)
✔ a target-side list alone refuses a send from a role that has no list (21.131124ms)
✔ the sender list is checked before the target list (16.357066ms)
✔ roles without the field behave exactly as before (23.902634ms)
✔ a business with no role definitions at all is unlimited (16.737314ms)
✔ a malformed messaging field refuses at boot (8.906114ms)
ℹ tests 9
✖ the assistant sends to the user and to the chief of staff only (18.27432ms)
✖ an assistant send to any other role, or to the tester, is refused and logged (16.484651ms)
✖ only the user and the chief of staff may send to the assistant; the tester is refused by default (15.842821ms)
✔ a sender-side list alone refuses a send to a role that has no list (16.854175ms)
✔ a target-side list alone refuses a send from a role that has no list (17.411318ms)
✔ the sender list is checked before the target list (15.141841ms)
✔ roles without the field behave exactly as before (22.904587ms)
✔ a business with no role definitions at all is unlimited (14.952951ms)
✔ a malformed messaging field refuses at boot (6.681222ms)
✖ the assistant's review.request to a reviewer is refused and logged, even with an approved decision (18.062067ms)
✖ a review.verdict to the assistant from a role outside its receiveFrom is refused and logged (18.858749ms)
✔ review requests and verdicts between roles without the field are unchanged (15.514228ms)
ℹ tests 12
ℹ suites 0
ℹ pass 6
ℹ fail 3
ℹ pass 7
ℹ fail 5
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 241.137788
ℹ duration_ms 246.901942
✖ failing tests:
test at packages/bus/tests/messaging.test.mjs:78:1
✖ the assistant sends to the user and to the chief of staff only (23.868594ms)
test at packages/bus/tests/messaging.test.mjs:87:1
✖ the assistant sends to the user and to the chief of staff only (18.27432ms)
AssertionError [ERR_ASSERTION]: Expected values to be strictly deep-equal:
+ actual - expected
@@ -35,7 +38,7 @@ test at packages/bus/tests/messaging.test.mjs:78:1
- ]
- }
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:80:10)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:89:10)
at Test.runInAsyncScope (node:async_hooks:226:14)
at Test.run (node:internal/test_runner/test:1402:25)
at Test.start (node:internal/test_runner/test:1262:17)
@@ -48,10 +51,10 @@ test at packages/bus/tests/messaging.test.mjs:78:1
diff: 'simple'
}
test at packages/bus/tests/messaging.test.mjs:88:1
✖ an assistant send to any other role, or to the tester, is refused and logged (19.195695ms)
test at packages/bus/tests/messaging.test.mjs:97:1
✖ an assistant send to any other role, or to the tester, is refused and logged (16.484651ms)
AssertionError [ERR_ASSERTION]: Missing expected exception: pm
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:94:35)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:103:35)
at Test.runInAsyncScope (node:async_hooks:226:14)
at Test.run (node:internal/test_runner/test:1402:25)
at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
@@ -66,10 +69,46 @@ test at packages/bus/tests/messaging.test.mjs:88:1
diff: 'simple'
}
test at packages/bus/tests/messaging.test.mjs:110:1
✖ only the user and the chief of staff may send to the assistant; the tester is refused by default (18.400643ms)
test at packages/bus/tests/messaging.test.mjs:119:1
✖ only the user and the chief of staff may send to the assistant; the tester is refused by default (15.842821ms)
AssertionError [ERR_ASSERTION]: Missing expected exception: pm
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:119:37)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:128:37)
at Test.runInAsyncScope (node:async_hooks:226:14)
at Test.run (node:internal/test_runner/test:1402:25)
at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
at Test.postRun (node:internal/test_runner/test:1542:19)
at Test.run (node:internal/test_runner/test:1467:12)
at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) {
generatedMessage: false,
code: 'ERR_ASSERTION',
actual: undefined,
expected: { code: 'message-sender-refused' },
operator: 'throws',
diff: 'simple'
}
test at packages/bus/tests/messaging.test.mjs:239:1
✖ the assistant's review.request to a reviewer is refused and logged, even with an approved decision (18.062067ms)
AssertionError [ERR_ASSERTION]: Missing expected exception.
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:248:10)
at Test.runInAsyncScope (node:async_hooks:226:14)
at Test.run (node:internal/test_runner/test:1402:25)
at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
at Test.postRun (node:internal/test_runner/test:1542:19)
at Test.run (node:internal/test_runner/test:1467:12)
at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) {
generatedMessage: false,
code: 'ERR_ASSERTION',
actual: undefined,
expected: { code: 'message-recipient-refused' },
operator: 'throws',
diff: 'simple'
}
test at packages/bus/tests/messaging.test.mjs:256:1
✖ a review.verdict to the assistant from a role outside its receiveFrom is refused and logged (18.858749ms)
AssertionError [ERR_ASSERTION]: Missing expected exception.
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:268:10)
at Test.runInAsyncScope (node:async_hooks:226:14)
at Test.run (node:internal/test_runner/test:1402:25)
at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
agents/researcher/work/queue-120/mutants/m15a-assistant-unlimited.patch
+2 -2
View File
@@ -1,5 +1,5 @@
--- /mnt/storage/src/mosaic-stack/agents/researcher/work/queue-120/mutants/.bak.yvAdpu/roles/assistant.json 2026-10-14 20:22:09.932589062 -0500
+++ roles/assistant.json 2026-10-14 20:22:10.822332110 -0500
--- /mnt/storage/scratch/researcher/r120r2-mutants/.bak.aROvEt/roles/assistant.json 2026-10-14 20:57:33.106137955 -0500
+++ roles/assistant.json 2026-10-14 20:57:33.975719033 -0500
@@ -9,9 +9,5 @@
"withinRole": ["message.send"],
"crossRole": []
agents/researcher/work/queue-120/mutants/m15b-assistant-unlimited.out
+13 -13
View File
@@ -1,11 +1,11 @@
✔ the role file loads and resolves through loadBusiness (4.841503ms)
✖ the shipped file is exactly the approved list (1.562422ms)
✔ the assistant's authority is message.send within role and nothing else (1.720263ms)
✖ the assistant talks to the user and the chief of staff only, and no other shipped role is limited (0.396779ms)
✔ a business grant through limits does not widen the role (1.271116ms)
✔ a launch block whose by is the assistant is refused (1.369824ms)
✔ the instance takes no credential references and no tracker (2.231741ms)
✔ the contract passes work to the chief of staff and directs no one (0.503261ms)
✔ the role file loads and resolves through loadBusiness (4.251292ms)
✖ the shipped file is exactly the approved list (1.253033ms)
✔ the assistant's authority is message.send within role and nothing else (1.361646ms)
✖ the assistant talks to the user and the chief of staff only, and no other shipped role is limited (0.29426ms)
✔ a business grant through limits does not widen the role (1.018578ms)
✔ a launch block whose by is the assistant is refused (1.105823ms)
✔ the instance takes no credential references and no tracker (1.682098ms)
✔ the contract passes work to the chief of staff and directs no one (0.368453ms)
ℹ tests 8
ℹ suites 0
ℹ pass 6
@@ -13,12 +13,12 @@
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 77.349587
ℹ duration_ms 63.041751
✖ failing tests:
test at packages/business/tests/assistant.test.mjs:63:1
✖ the shipped file is exactly the approved list (1.562422ms)
✖ the shipped file is exactly the approved list (1.253033ms)
AssertionError [ERR_ASSERTION]: Expected values to be strictly deep-equal:
+ actual - expected
... Skipped lines
@@ -46,7 +46,7 @@ test at packages/business/tests/assistant.test.mjs:63:1
tools: [
'read',
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120/packages/business/tests/assistant.test.mjs:67:10)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/business/tests/assistant.test.mjs:67:10)
at Test.runInAsyncScope (node:async_hooks:226:14)
at Test.run (node:internal/test_runner/test:1402:25)
at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
@@ -62,7 +62,7 @@ test at packages/business/tests/assistant.test.mjs:63:1
}
test at packages/business/tests/assistant.test.mjs:83:1
✖ the assistant talks to the user and the chief of staff only, and no other shipped role is limited (0.396779ms)
✖ the assistant talks to the user and the chief of staff only, and no other shipped role is limited (0.29426ms)
AssertionError [ERR_ASSERTION]: Expected values to be strictly deep-equal:
+ actual - expected
@@ -78,7 +78,7 @@ test at packages/business/tests/assistant.test.mjs:83:1
- ]
- }
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120/packages/business/tests/assistant.test.mjs:85:10)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/business/tests/assistant.test.mjs:85:10)
at Test.runInAsyncScope (node:async_hooks:226:14)
at Test.run (node:internal/test_runner/test:1402:25)
at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
agents/researcher/work/queue-120/mutants/m15b-assistant-unlimited.patch
+2 -2
View File
@@ -1,5 +1,5 @@
--- /mnt/storage/src/mosaic-stack/agents/researcher/work/queue-120/mutants/.bak.yvAdpu/roles/assistant.json 2026-10-14 20:22:09.932589062 -0500
+++ roles/assistant.json 2026-10-14 20:22:11.127335217 -0500
--- /mnt/storage/scratch/researcher/r120r2-mutants/.bak.aROvEt/roles/assistant.json 2026-10-14 20:57:33.106137955 -0500
+++ roles/assistant.json 2026-10-14 20:57:34.277722906 -0500
@@ -9,9 +9,5 @@
"withinRole": ["message.send"],
"crossRole": []
agents/researcher/work/queue-120/mutants/m16-review-request-unchecked.out
+40
View File
@@ -0,0 +1,40 @@
✔ the assistant sends to the user and to the chief of staff only (21.887846ms)
✔ an assistant send to any other role, or to the tester, is refused and logged (20.266668ms)
✔ only the user and the chief of staff may send to the assistant; the tester is refused by default (18.780004ms)
✔ a sender-side list alone refuses a send to a role that has no list (15.951039ms)
✔ a target-side list alone refuses a send from a role that has no list (19.721388ms)
✔ the sender list is checked before the target list (14.910714ms)
✔ roles without the field behave exactly as before (22.138717ms)
✔ a business with no role definitions at all is unlimited (16.262739ms)
✔ a malformed messaging field refuses at boot (7.060334ms)
✖ the assistant's review.request to a reviewer is refused and logged, even with an approved decision (17.428456ms)
✔ a review.verdict to the assistant from a role outside its receiveFrom is refused and logged (18.778894ms)
✔ review requests and verdicts between roles without the field are unchanged (15.36327ms)
ℹ tests 12
ℹ suites 0
ℹ pass 11
ℹ fail 1
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 259.438489
✖ failing tests:
test at packages/bus/tests/messaging.test.mjs:239:1
✖ the assistant's review.request to a reviewer is refused and logged, even with an approved decision (17.428456ms)
AssertionError [ERR_ASSERTION]: Missing expected exception.
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:248:10)
at Test.runInAsyncScope (node:async_hooks:226:14)
at Test.run (node:internal/test_runner/test:1402:25)
at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
at Test.postRun (node:internal/test_runner/test:1542:19)
at Test.run (node:internal/test_runner/test:1467:12)
at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) {
generatedMessage: false,
code: 'ERR_ASSERTION',
actual: undefined,
expected: { code: 'message-recipient-refused' },
operator: 'throws',
diff: 'simple'
}
agents/researcher/work/queue-120/mutants/m16-review-request-unchecked.patch
+10
View File
@@ -0,0 +1,10 @@
--- /mnt/storage/scratch/researcher/r120r2-mutants/.bak.aROvEt/packages/bus/src/broker.mjs 2026-10-14 20:57:29.701567176 -0500
+++ packages/bus/src/broker.mjs 2026-10-14 20:57:34.393724393 -0500
@@ -1093,7 +1093,6 @@
fail(older ? 'stale-commit' : 'unknown-commit');
}
// REQ-ASSIST-2 has no approval exception: a review request is a message to the reviewer.
- this.#checkMessaging(s, a.to);
const mid = randomUUID();
// Row 105 (#1599): the run holding the reviewer role, or null when nobody holds it and the
// request waits for a claim. #reviewMessage routes on the same holder.
agents/researcher/work/queue-120/mutants/m16-review-request-unchecked.rc
+1
View File
@@ -0,0 +1 @@
1
agents/researcher/work/queue-120/mutants/m17-review-verdict-unchecked.out
+40
View File
@@ -0,0 +1,40 @@
✔ the assistant sends to the user and to the chief of staff only (23.46499ms)
✔ an assistant send to any other role, or to the tester, is refused and logged (19.609055ms)
✔ only the user and the chief of staff may send to the assistant; the tester is refused by default (17.775067ms)
✔ a sender-side list alone refuses a send to a role that has no list (15.785529ms)
✔ a target-side list alone refuses a send from a role that has no list (18.134463ms)
✔ the sender list is checked before the target list (14.45761ms)
✔ roles without the field behave exactly as before (23.058203ms)
✔ a business with no role definitions at all is unlimited (15.204704ms)
✔ a malformed messaging field refuses at boot (7.229115ms)
✔ the assistant's review.request to a reviewer is refused and logged, even with an approved decision (16.974412ms)
✖ a review.verdict to the assistant from a role outside its receiveFrom is refused and logged (18.323341ms)
✔ review requests and verdicts between roles without the field are unchanged (14.928722ms)
ℹ tests 12
ℹ suites 0
ℹ pass 11
ℹ fail 1
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 257.628646
✖ failing tests:
test at packages/bus/tests/messaging.test.mjs:256:1
✖ a review.verdict to the assistant from a role outside its receiveFrom is refused and logged (18.323341ms)
AssertionError [ERR_ASSERTION]: Missing expected exception.
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:268:10)
at Test.runInAsyncScope (node:async_hooks:226:14)
at Test.run (node:internal/test_runner/test:1402:25)
at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
at Test.postRun (node:internal/test_runner/test:1542:19)
at Test.run (node:internal/test_runner/test:1467:12)
at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) {
generatedMessage: false,
code: 'ERR_ASSERTION',
actual: undefined,
expected: { code: 'message-sender-refused' },
operator: 'throws',
diff: 'simple'
}
agents/researcher/work/queue-120/mutants/m17-review-verdict-unchecked.patch
+11
View File
@@ -0,0 +1,11 @@
--- /mnt/storage/scratch/researcher/r120r2-mutants/.bak.aROvEt/packages/bus/src/broker.mjs 2026-10-14 20:57:29.701567176 -0500
+++ packages/bus/src/broker.mjs 2026-10-14 20:57:34.704728381 -0500
@@ -1136,7 +1136,7 @@
)
fail('verdict-exists');
// The verdict is a message to the role that asked, so it meets that role's receive list.
- this.#checkMessaging(s, r.from);
+ void 0;
const mid = randomUUID();
const eid = this.#event(
s,
agents/researcher/work/queue-120/mutants/m17-review-verdict-unchecked.rc
+1
View File
@@ -0,0 +1 @@
1
agents/researcher/work/queue-120/mutants/m2-drop-target-side-check.out
+40 -19
View File
@@ -1,27 +1,30 @@
✔ the assistant sends to the user and to the chief of staff only (19.109502ms)
✔ an assistant send to any other role, or to the tester, is refused and logged (18.653247ms)
✖ only the user and the chief of staff may send to the assistant; the tester is refused by default (16.256796ms)
✔ a sender-side list alone refuses a send to a role that has no list (15.960754ms)
✖ a target-side list alone refuses a send from a role that has no list (15.363056ms)
✔ the sender list is checked before the target list (13.870364ms)
✔ roles without the field behave exactly as before (21.989586ms)
✔ a business with no role definitions at all is unlimited (15.370555ms)
✔ a malformed messaging field refuses at boot (7.531603ms)
ℹ tests 9
✔ the assistant sends to the user and to the chief of staff only (22.24511ms)
✔ an assistant send to any other role, or to the tester, is refused and logged (20.113967ms)
✖ only the user and the chief of staff may send to the assistant; the tester is refused by default (17.409861ms)
✔ a sender-side list alone refuses a send to a role that has no list (18.350833ms)
✖ a target-side list alone refuses a send from a role that has no list (17.865186ms)
✔ the sender list is checked before the target list (14.598304ms)
✔ roles without the field behave exactly as before (23.298583ms)
✔ a business with no role definitions at all is unlimited (16.086887ms)
✔ a malformed messaging field refuses at boot (7.090745ms)
✔ the assistant's review.request to a reviewer is refused and logged, even with an approved decision (17.683294ms)
✖ a review.verdict to the assistant from a role outside its receiveFrom is refused and logged (20.14825ms)
✔ review requests and verdicts between roles without the field are unchanged (17.678951ms)
ℹ tests 12
ℹ suites 0
ℹ pass 7
ℹ fail 2
ℹ pass 9
ℹ fail 3
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 199.65459
ℹ duration_ms 271.197529
✖ failing tests:
test at packages/bus/tests/messaging.test.mjs:110:1
✖ only the user and the chief of staff may send to the assistant; the tester is refused by default (16.256796ms)
test at packages/bus/tests/messaging.test.mjs:119:1
✖ only the user and the chief of staff may send to the assistant; the tester is refused by default (17.409861ms)
AssertionError [ERR_ASSERTION]: Missing expected exception: pm
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:119:37)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:128:37)
at Test.runInAsyncScope (node:async_hooks:226:14)
at Test.run (node:internal/test_runner/test:1402:25)
at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
@@ -36,10 +39,28 @@ test at packages/bus/tests/messaging.test.mjs:110:1
diff: 'simple'
}
test at packages/bus/tests/messaging.test.mjs:134:1
✖ a target-side list alone refuses a send from a role that has no list (15.363056ms)
test at packages/bus/tests/messaging.test.mjs:143:1
✖ a target-side list alone refuses a send from a role that has no list (17.865186ms)
AssertionError [ERR_ASSERTION]: Missing expected exception: coder
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:138:12)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:147:12)
at Test.runInAsyncScope (node:async_hooks:226:14)
at Test.run (node:internal/test_runner/test:1402:25)
at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
at Test.postRun (node:internal/test_runner/test:1542:19)
at Test.run (node:internal/test_runner/test:1467:12)
at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) {
generatedMessage: false,
code: 'ERR_ASSERTION',
actual: undefined,
expected: { code: 'message-sender-refused' },
operator: 'throws',
diff: 'simple'
}
test at packages/bus/tests/messaging.test.mjs:256:1
✖ a review.verdict to the assistant from a role outside its receiveFrom is refused and logged (20.14825ms)
AssertionError [ERR_ASSERTION]: Missing expected exception.
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:268:10)
at Test.runInAsyncScope (node:async_hooks:226:14)
at Test.run (node:internal/test_runner/test:1402:25)
at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
agents/researcher/work/queue-120/mutants/m2-drop-target-side-check.patch
+3 -3
View File
@@ -1,6 +1,6 @@
--- /mnt/storage/src/mosaic-stack/agents/researcher/work/queue-120/mutants/.bak.yvAdpu/packages/bus/src/broker.mjs 2026-10-14 20:22:06.948510829 -0500
+++ packages/bus/src/broker.mjs 2026-10-14 20:22:07.227295491 -0500
@@ -335,7 +335,7 @@
--- /mnt/storage/scratch/researcher/r120r2-mutants/.bak.aROvEt/packages/bus/src/broker.mjs 2026-10-14 20:57:29.701567176 -0500
+++ packages/bus/src/broker.mjs 2026-10-14 20:57:30.066668903 -0500
@@ -338,7 +338,7 @@
const out = s.human || s.tester ? undefined : definition(s.role)?.messaging;
if (out && !out.sendTo.includes(target)) fail('message-recipient-refused');
const inbound = to === 'human' || to === 'tester' ? undefined : definition(to)?.messaging;
agents/researcher/work/queue-120/mutants/m3-drop-refusal-log.out
+91 -28
View File
@@ -1,25 +1,28 @@
✔ the assistant sends to the user and to the chief of staff only (19.820151ms)
✖ an assistant send to any other role, or to the tester, is refused and logged (16.694624ms)
✖ only the user and the chief of staff may send to the assistant; the tester is refused by default (15.38874ms)
✖ a sender-side list alone refuses a send to a role that has no list (14.850664ms)
✖ a target-side list alone refuses a send from a role that has no list (14.820406ms)
✖ the sender list is checked before the target list (14.90961ms)
✔ roles without the field behave exactly as before (23.530851ms)
✔ a business with no role definitions at all is unlimited (15.506059ms)
✔ a malformed messaging field refuses at boot (7.585977ms)
ℹ tests 9
✔ the assistant sends to the user and to the chief of staff only (20.451246ms)
✖ an assistant send to any other role, or to the tester, is refused and logged (16.353853ms)
✖ only the user and the chief of staff may send to the assistant; the tester is refused by default (15.409097ms)
✖ a sender-side list alone refuses a send to a role that has no list (14.336753ms)
✖ a target-side list alone refuses a send from a role that has no list (15.677829ms)
✖ the sender list is checked before the target list (14.21774ms)
✔ roles without the field behave exactly as before (21.64497ms)
✔ a business with no role definitions at all is unlimited (15.75462ms)
✔ a malformed messaging field refuses at boot (7.173107ms)
✖ the assistant's review.request to a reviewer is refused and logged, even with an approved decision (17.050164ms)
✖ a review.verdict to the assistant from a role outside its receiveFrom is refused and logged (19.417854ms)
✔ review requests and verdicts between roles without the field are unchanged (16.23484ms)
ℹ tests 12
ℹ suites 0
ℹ pass 4
ℹ fail 5
ℹ pass 5
ℹ fail 7
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 199.817541
ℹ duration_ms 251.882603
✖ failing tests:
test at packages/bus/tests/messaging.test.mjs:88:1
✖ an assistant send to any other role, or to the tester, is refused and logged (16.694624ms)
test at packages/bus/tests/messaging.test.mjs:97:1
✖ an assistant send to any other role, or to the tester, is refused and logged (16.353853ms)
AssertionError [ERR_ASSERTION]: Expected values to be strictly deep-equal:
+ actual - expected
@@ -47,7 +50,7 @@ test at packages/bus/tests/messaging.test.mjs:88:1
- ]
- ]
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:97:10)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:106:10)
at Test.runInAsyncScope (node:async_hooks:226:14)
at Test.run (node:internal/test_runner/test:1402:25)
at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
@@ -62,8 +65,8 @@ test at packages/bus/tests/messaging.test.mjs:88:1
diff: 'simple'
}
test at packages/bus/tests/messaging.test.mjs:110:1
✖ only the user and the chief of staff may send to the assistant; the tester is refused by default (15.38874ms)
test at packages/bus/tests/messaging.test.mjs:119:1
✖ only the user and the chief of staff may send to the assistant; the tester is refused by default (15.409097ms)
AssertionError [ERR_ASSERTION]: Expected values to be strictly deep-equal:
+ actual - expected
@@ -83,7 +86,7 @@ test at packages/bus/tests/messaging.test.mjs:110:1
- ]
- ]
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:120:10)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:129:10)
at Test.runInAsyncScope (node:async_hooks:226:14)
at Test.run (node:internal/test_runner/test:1402:25)
at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
@@ -98,8 +101,8 @@ test at packages/bus/tests/messaging.test.mjs:110:1
diff: 'simple'
}
test at packages/bus/tests/messaging.test.mjs:125:1
✖ a sender-side list alone refuses a send to a role that has no list (14.850664ms)
test at packages/bus/tests/messaging.test.mjs:134:1
✖ a sender-side list alone refuses a send to a role that has no list (14.336753ms)
AssertionError [ERR_ASSERTION]: Expected values to be strictly deep-equal:
+ actual - expected
@@ -115,7 +118,7 @@ test at packages/bus/tests/messaging.test.mjs:125:1
- ]
- ]
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:130:10)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:139:10)
at Test.runInAsyncScope (node:async_hooks:226:14)
at Test.run (node:internal/test_runner/test:1402:25)
at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
@@ -130,8 +133,8 @@ test at packages/bus/tests/messaging.test.mjs:125:1
diff: 'simple'
}
test at packages/bus/tests/messaging.test.mjs:134:1
✖ a target-side list alone refuses a send from a role that has no list (14.820406ms)
test at packages/bus/tests/messaging.test.mjs:143:1
✖ a target-side list alone refuses a send from a role that has no list (15.677829ms)
AssertionError [ERR_ASSERTION]: Expected values to be strictly deep-equal:
+ actual - expected
@@ -155,7 +158,7 @@ test at packages/bus/tests/messaging.test.mjs:134:1
- ]
- ]
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:139:10)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:148:10)
at Test.runInAsyncScope (node:async_hooks:226:14)
at Test.run (node:internal/test_runner/test:1402:25)
at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
@@ -170,8 +173,8 @@ test at packages/bus/tests/messaging.test.mjs:134:1
diff: 'simple'
}
test at packages/bus/tests/messaging.test.mjs:143:1
✖ the sender list is checked before the target list (14.90961ms)
test at packages/bus/tests/messaging.test.mjs:152:1
✖ the sender list is checked before the target list (14.21774ms)
AssertionError [ERR_ASSERTION]: Expected values to be strictly deep-equal:
+ actual - expected
@@ -183,7 +186,7 @@ test at packages/bus/tests/messaging.test.mjs:143:1
- ]
- ]
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:147:10)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:156:10)
at Test.runInAsyncScope (node:async_hooks:226:14)
at Test.run (node:internal/test_runner/test:1402:25)
at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
@@ -197,3 +200,63 @@ test at packages/bus/tests/messaging.test.mjs:143:1
operator: 'deepStrictEqual',
diff: 'simple'
}
test at packages/bus/tests/messaging.test.mjs:239:1
✖ the assistant's review.request to a reviewer is refused and logged, even with an approved decision (17.050164ms)
AssertionError [ERR_ASSERTION]: Expected values to be strictly deep-equal:
+ actual - expected
+ []
- [
- [
- 'assistant',
- 'message-recipient-refused'
- ],
- [
- 'assistant',
- 'message-recipient-refused'
- ]
- ]
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:250:10)
at Test.runInAsyncScope (node:async_hooks:226:14)
at Test.run (node:internal/test_runner/test:1402:25)
at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
at Test.postRun (node:internal/test_runner/test:1542:19)
at Test.run (node:internal/test_runner/test:1467:12)
at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) {
generatedMessage: true,
code: 'ERR_ASSERTION',
actual: [],
expected: [ [ 'assistant', 'message-recipient-refused' ], [ 'assistant', 'message-recipient-refused' ] ],
operator: 'deepStrictEqual',
diff: 'simple'
}
test at packages/bus/tests/messaging.test.mjs:256:1
✖ a review.verdict to the assistant from a role outside its receiveFrom is refused and logged (19.417854ms)
AssertionError [ERR_ASSERTION]: Expected values to be strictly deep-equal:
+ actual - expected
+ []
- [
- [
- 'reviewer',
- 'message-sender-refused'
- ]
- ]
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:269:10)
at Test.runInAsyncScope (node:async_hooks:226:14)
at Test.run (node:internal/test_runner/test:1402:25)
at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
at Test.postRun (node:internal/test_runner/test:1542:19)
at Test.run (node:internal/test_runner/test:1467:12)
at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) {
generatedMessage: true,
code: 'ERR_ASSERTION',
actual: [],
expected: [ [ 'reviewer', 'message-sender-refused' ] ],
operator: 'deepStrictEqual',
diff: 'simple'
}
agents/researcher/work/queue-120/mutants/m3-drop-refusal-log.patch
+3 -3
View File
@@ -1,6 +1,6 @@
--- /mnt/storage/src/mosaic-stack/agents/researcher/work/queue-120/mutants/.bak.yvAdpu/packages/bus/src/broker.mjs 2026-10-14 20:22:06.948510829 -0500
+++ packages/bus/src/broker.mjs 2026-10-14 20:22:07.477298037 -0500
@@ -665,6 +665,7 @@
--- /mnt/storage/scratch/researcher/r120r2-mutants/.bak.aROvEt/packages/bus/src/broker.mjs 2026-10-14 20:57:29.701567176 -0500
+++ packages/bus/src/broker.mjs 2026-10-14 20:57:30.388673033 -0500
@@ -668,6 +668,7 @@
}
#refused(s, e, request, other = 'storage-refused') {
const error = e instanceof BusError ? e : new BusError(other);
agents/researcher/work/queue-120/mutants/m4-sender-reads-receive-list.out
+30 -27
View File
@@ -1,27 +1,30 @@
✔ the assistant sends to the user and to the chief of staff only (20.09624ms)
✔ an assistant send to any other role, or to the tester, is refused and logged (18.849682ms)
✔ only the user and the chief of staff may send to the assistant; the tester is refused by default (17.758286ms)
✖ a sender-side list alone refuses a send to a role that has no list (16.09345ms)
✔ a target-side list alone refuses a send from a role that has no list (17.984013ms)
✖ the sender list is checked before the target list (15.730753ms)
✔ roles without the field behave exactly as before (22.334483ms)
✔ a business with no role definitions at all is unlimited (15.701319ms)
✔ a malformed messaging field refuses at boot (7.02954ms)
ℹ tests 9
✔ the assistant sends to the user and to the chief of staff only (21.930494ms)
✔ an assistant send to any other role, or to the tester, is refused and logged (19.008657ms)
✔ only the user and the chief of staff may send to the assistant; the tester is refused by default (17.380245ms)
✖ a sender-side list alone refuses a send to a role that has no list (15.281127ms)
✔ a target-side list alone refuses a send from a role that has no list (17.074235ms)
✖ the sender list is checked before the target list (14.581476ms)
✔ roles without the field behave exactly as before (21.197229ms)
✔ a business with no role definitions at all is unlimited (14.939267ms)
✔ a malformed messaging field refuses at boot (6.875434ms)
✔ the assistant's review.request to a reviewer is refused and logged, even with an approved decision (18.706879ms)
✔ a review.verdict to the assistant from a role outside its receiveFrom is refused and logged (19.950713ms)
✔ review requests and verdicts between roles without the field are unchanged (15.317524ms)
ℹ tests 12
ℹ suites 0
ℹ pass 7
ℹ pass 10
ℹ fail 2
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 211.857974
ℹ duration_ms 254.431752
✖ failing tests:
test at packages/bus/tests/messaging.test.mjs:125:1
✖ a sender-side list alone refuses a send to a role that has no list (16.09345ms)
test at packages/bus/tests/messaging.test.mjs:134:1
✖ a sender-side list alone refuses a send to a role that has no list (15.281127ms)
AssertionError [ERR_ASSERTION]: Missing expected exception.
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:128:10)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:137:10)
at Test.runInAsyncScope (node:async_hooks:226:14)
at Test.run (node:internal/test_runner/test:1402:25)
at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
@@ -36,8 +39,8 @@ test at packages/bus/tests/messaging.test.mjs:125:1
diff: 'simple'
}
test at packages/bus/tests/messaging.test.mjs:143:1
✖ the sender list is checked before the target list (15.730753ms)
test at packages/bus/tests/messaging.test.mjs:152:1
✖ the sender list is checked before the target list (14.581476ms)
AssertionError [ERR_ASSERTION]: Expected values to be strictly deep-equal:
+ actual - expected
@@ -46,7 +49,7 @@ test at packages/bus/tests/messaging.test.mjs:143:1
- code: 'message-recipient-refused'
}
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:146:10)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:155:10)
at Test.runInAsyncScope (node:async_hooks:226:14)
at Test.run (node:internal/test_runner/test:1402:25)
at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
@@ -56,15 +59,15 @@ test at packages/bus/tests/messaging.test.mjs:143:1
generatedMessage: true,
code: 'ERR_ASSERTION',
actual: Error: message-sender-refused
at fail (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:76:9)
at #checkMessaging (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:338:59)
at #dispatch (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:969:29)
at file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:701:38
at Store.transaction (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/store.mjs:156:22)
at Broker.request (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:695:26)
at call (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:64:44)
at send (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:66:5)
at assert.throws.code (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:146:23)
at fail (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:76:9)
at #checkMessaging (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:341:59)
at #dispatch (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:991:29)
at file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:723:38
at Store.transaction (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/store.mjs:156:22)
at Broker.request (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:717:26)
at call (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:73:44)
at send (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:75:5)
at assert.throws.code (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:155:23)
at getActual (node:assert:580:5),
expected: { code: 'message-recipient-refused' },
operator: 'throws',
agents/researcher/work/queue-120/mutants/m4-sender-reads-receive-list.patch
+3 -3
View File
@@ -1,6 +1,6 @@
--- /mnt/storage/src/mosaic-stack/agents/researcher/work/queue-120/mutants/.bak.yvAdpu/packages/bus/src/broker.mjs 2026-10-14 20:22:06.948510829 -0500
+++ packages/bus/src/broker.mjs 2026-10-14 20:22:07.735300665 -0500
@@ -333,7 +333,7 @@
--- /mnt/storage/scratch/researcher/r120r2-mutants/.bak.aROvEt/packages/bus/src/broker.mjs 2026-10-14 20:57:29.701567176 -0500
+++ packages/bus/src/broker.mjs 2026-10-14 20:57:30.695676970 -0500
@@ -336,7 +336,7 @@
const sender = s.human ? 'human' : s.tester ? 'tester' : b.roles[s.role]?.definition;
const target = to === 'human' || to === 'tester' ? to : b.roles[to]?.definition;
const out = s.human || s.tester ? undefined : definition(s.role)?.messaging;
agents/researcher/work/queue-120/mutants/m5-target-reads-send-list.out
+18 -15
View File
@@ -1,27 +1,30 @@
✔ the assistant sends to the user and to the chief of staff only (19.959065ms)
✔ an assistant send to any other role, or to the tester, is refused and logged (18.049066ms)
✔ only the user and the chief of staff may send to the assistant; the tester is refused by default (17.532892ms)
✔ a sender-side list alone refuses a send to a role that has no list (16.202063ms)
✖ a target-side list alone refuses a send from a role that has no list (15.966992ms)
✔ the sender list is checked before the target list (14.719369ms)
✔ roles without the field behave exactly as before (21.882411ms)
✔ a business with no role definitions at all is unlimited (15.716027ms)
✔ a malformed messaging field refuses at boot (7.354747ms)
ℹ tests 9
✔ the assistant sends to the user and to the chief of staff only (19.825364ms)
✔ an assistant send to any other role, or to the tester, is refused and logged (18.158173ms)
✔ only the user and the chief of staff may send to the assistant; the tester is refused by default (17.599154ms)
✔ a sender-side list alone refuses a send to a role that has no list (16.402436ms)
✖ a target-side list alone refuses a send from a role that has no list (14.942545ms)
✔ the sender list is checked before the target list (13.487153ms)
✔ roles without the field behave exactly as before (21.18854ms)
✔ a business with no role definitions at all is unlimited (15.370016ms)
✔ a malformed messaging field refuses at boot (7.050466ms)
✔ the assistant's review.request to a reviewer is refused and logged, even with an approved decision (17.865052ms)
✔ a review.verdict to the assistant from a role outside its receiveFrom is refused and logged (19.576193ms)
✔ review requests and verdicts between roles without the field are unchanged (15.726222ms)
ℹ tests 12
ℹ suites 0
ℹ pass 8
ℹ pass 11
ℹ fail 1
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 206.581795
ℹ duration_ms 250.043314
✖ failing tests:
test at packages/bus/tests/messaging.test.mjs:134:1
✖ a target-side list alone refuses a send from a role that has no list (15.966992ms)
test at packages/bus/tests/messaging.test.mjs:143:1
✖ a target-side list alone refuses a send from a role that has no list (14.942545ms)
AssertionError [ERR_ASSERTION]: Missing expected exception: coder
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:138:12)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:147:12)
at Test.runInAsyncScope (node:async_hooks:226:14)
at Test.run (node:internal/test_runner/test:1402:25)
at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
agents/researcher/work/queue-120/mutants/m5-target-reads-send-list.patch
+3 -3
View File
@@ -1,6 +1,6 @@
--- /mnt/storage/src/mosaic-stack/agents/researcher/work/queue-120/mutants/.bak.yvAdpu/packages/bus/src/broker.mjs 2026-10-14 20:22:06.948510829 -0500
+++ packages/bus/src/broker.mjs 2026-10-14 20:22:08.002303385 -0500
@@ -335,7 +335,7 @@
--- /mnt/storage/scratch/researcher/r120r2-mutants/.bak.aROvEt/packages/bus/src/broker.mjs 2026-10-14 20:57:29.701567176 -0500
+++ packages/bus/src/broker.mjs 2026-10-14 20:57:31.000479574 -0500
@@ -338,7 +338,7 @@
const out = s.human || s.tester ? undefined : definition(s.role)?.messaging;
if (out && !out.sendTo.includes(target)) fail('message-recipient-refused');
const inbound = to === 'human' || to === 'tester' ? undefined : definition(to)?.messaging;
agents/researcher/work/queue-120/mutants/m6-tester-exempt.out
+21 -18
View File
@@ -1,27 +1,30 @@
✔ the assistant sends to the user and to the chief of staff only (20.761108ms)
✔ an assistant send to any other role, or to the tester, is refused and logged (18.599261ms)
✖ only the user and the chief of staff may send to the assistant; the tester is refused by default (18.061049ms)
✔ a sender-side list alone refuses a send to a role that has no list (16.343731ms)
✖ a target-side list alone refuses a send from a role that has no list (17.855671ms)
✔ the sender list is checked before the target list (14.644244ms)
✔ roles without the field behave exactly as before (20.985724ms)
✔ a business with no role definitions at all is unlimited (15.368113ms)
✔ a malformed messaging field refuses at boot (7.00822ms)
ℹ tests 9
✔ the assistant sends to the user and to the chief of staff only (20.92676ms)
✔ an assistant send to any other role, or to the tester, is refused and logged (18.838817ms)
✖ only the user and the chief of staff may send to the assistant; the tester is refused by default (16.99329ms)
✔ a sender-side list alone refuses a send to a role that has no list (15.354254ms)
✖ a target-side list alone refuses a send from a role that has no list (16.416479ms)
✔ the sender list is checked before the target list (13.93761ms)
✔ roles without the field behave exactly as before (20.83782ms)
✔ a business with no role definitions at all is unlimited (15.146228ms)
✔ a malformed messaging field refuses at boot (9.926941ms)
✔ the assistant's review.request to a reviewer is refused and logged, even with an approved decision (17.438104ms)
✔ a review.verdict to the assistant from a role outside its receiveFrom is refused and logged (18.957927ms)
✔ review requests and verdicts between roles without the field are unchanged (15.606226ms)
ℹ tests 12
ℹ suites 0
ℹ pass 7
ℹ pass 10
ℹ fail 2
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 211.46733
ℹ duration_ms 251.684999
✖ failing tests:
test at packages/bus/tests/messaging.test.mjs:110:1
✖ only the user and the chief of staff may send to the assistant; the tester is refused by default (18.061049ms)
test at packages/bus/tests/messaging.test.mjs:119:1
✖ only the user and the chief of staff may send to the assistant; the tester is refused by default (16.99329ms)
AssertionError [ERR_ASSERTION]: Missing expected exception: tester
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:119:37)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:128:37)
at Test.runInAsyncScope (node:async_hooks:226:14)
at Test.run (node:internal/test_runner/test:1402:25)
at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
@@ -36,10 +39,10 @@ test at packages/bus/tests/messaging.test.mjs:110:1
diff: 'simple'
}
test at packages/bus/tests/messaging.test.mjs:134:1
✖ a target-side list alone refuses a send from a role that has no list (17.855671ms)
test at packages/bus/tests/messaging.test.mjs:143:1
✖ a target-side list alone refuses a send from a role that has no list (16.416479ms)
AssertionError [ERR_ASSERTION]: Missing expected exception: tester
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:138:12)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:147:12)
at Test.runInAsyncScope (node:async_hooks:226:14)
at Test.run (node:internal/test_runner/test:1402:25)
at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
agents/researcher/work/queue-120/mutants/m6-tester-exempt.patch
+3 -3
View File
@@ -1,6 +1,6 @@
--- /mnt/storage/src/mosaic-stack/agents/researcher/work/queue-120/mutants/.bak.yvAdpu/packages/bus/src/broker.mjs 2026-10-14 20:22:06.948510829 -0500
+++ packages/bus/src/broker.mjs 2026-10-14 20:22:08.266306074 -0500
@@ -335,7 +335,7 @@
--- /mnt/storage/scratch/researcher/r120r2-mutants/.bak.aROvEt/packages/bus/src/broker.mjs 2026-10-14 20:57:29.701567176 -0500
+++ packages/bus/src/broker.mjs 2026-10-14 20:57:31.303684768 -0500
@@ -338,7 +338,7 @@
const out = s.human || s.tester ? undefined : definition(s.role)?.messaging;
if (out && !out.sendTo.includes(target)) fail('message-recipient-refused');
const inbound = to === 'human' || to === 'tester' ? undefined : definition(to)?.messaging;
agents/researcher/work/queue-120/mutants/m7-no-field-refuses-sender.out
+92 -57
View File
@@ -1,83 +1,118 @@
✔ the assistant sends to the user and to the chief of staff only (20.013574ms)
✔ an assistant send to any other role, or to the tester, is refused and logged (18.046013ms)
✖ only the user and the chief of staff may send to the assistant; the tester is refused by default (14.850868ms)
✔ a sender-side list alone refuses a send to a role that has no list (15.380157ms)
✖ a target-side list alone refuses a send from a role that has no list (13.597071ms)
✔ the sender list is checked before the target list (13.874663ms)
✖ roles without the field behave exactly as before (13.094404ms)
✖ a business with no role definitions at all is unlimited (13.891916ms)
✔ a malformed messaging field refuses at boot (7.826936ms)
ℹ tests 9
✔ the assistant sends to the user and to the chief of staff only (19.765467ms)
✔ an assistant send to any other role, or to the tester, is refused and logged (18.376239ms)
✖ only the user and the chief of staff may send to the assistant; the tester is refused by default (14.662737ms)
✔ a sender-side list alone refuses a send to a role that has no list (15.319708ms)
✖ a target-side list alone refuses a send from a role that has no list (14.121911ms)
✔ the sender list is checked before the target list (14.01703ms)
✖ roles without the field behave exactly as before (14.018647ms)
✖ a business with no role definitions at all is unlimited (14.378692ms)
✔ a malformed messaging field refuses at boot (6.987041ms)
✔ the assistant's review.request to a reviewer is refused and logged, even with an approved decision (18.665126ms)
✖ a review.verdict to the assistant from a role outside its receiveFrom is refused and logged (16.375732ms)
✖ review requests and verdicts between roles without the field are unchanged (14.250721ms)
ℹ tests 12
ℹ suites 0
ℹ pass 5
ℹ fail 4
ℹ pass 6
ℹ fail 6
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 186.529051
ℹ duration_ms 235.698614
✖ failing tests:
test at packages/bus/tests/messaging.test.mjs:110:1
✖ only the user and the chief of staff may send to the assistant; the tester is refused by default (14.850868ms)
test at packages/bus/tests/messaging.test.mjs:119:1
✖ only the user and the chief of staff may send to the assistant; the tester is refused by default (14.662737ms)
Error: message-recipient-refused
at fail (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:76:9)
at #checkMessaging (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:336:46)
at #dispatch (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:969:29)
at file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:701:38
at Store.transaction (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/store.mjs:156:22)
at Broker.request (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:695:26)
at call (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:64:44)
at send (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:66:5)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:113:18)
at fail (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:76:9)
at #checkMessaging (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:339:46)
at #dispatch (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:991:29)
at file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:723:38
at Store.transaction (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/store.mjs:156:22)
at Broker.request (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:717:26)
at call (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:73:44)
at send (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:75:5)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:122:18)
at Test.runInAsyncScope (node:async_hooks:226:14) {
code: 'message-recipient-refused'
}
test at packages/bus/tests/messaging.test.mjs:134:1
✖ a target-side list alone refuses a send from a role that has no list (13.597071ms)
test at packages/bus/tests/messaging.test.mjs:143:1
✖ a target-side list alone refuses a send from a role that has no list (14.121911ms)
Error: message-recipient-refused
at fail (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:76:9)
at #checkMessaging (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:336:46)
at #dispatch (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:969:29)
at file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:701:38
at Store.transaction (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/store.mjs:156:22)
at Broker.request (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:695:26)
at call (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:64:44)
at send (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:66:5)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:136:3)
at fail (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:76:9)
at #checkMessaging (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:339:46)
at #dispatch (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:991:29)
at file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:723:38
at Store.transaction (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/store.mjs:156:22)
at Broker.request (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:717:26)
at call (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:73:44)
at send (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:75:5)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:145:3)
at Test.runInAsyncScope (node:async_hooks:226:14) {
code: 'message-recipient-refused'
}
test at packages/bus/tests/messaging.test.mjs:150:1
✖ roles without the field behave exactly as before (13.094404ms)
test at packages/bus/tests/messaging.test.mjs:159:1
✖ roles without the field behave exactly as before (14.018647ms)
Error: message-recipient-refused
at fail (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:76:9)
at #checkMessaging (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:336:46)
at #dispatch (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:969:29)
at file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:701:38
at Store.transaction (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/store.mjs:156:22)
at Broker.request (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:695:26)
at call (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:64:44)
at send (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:66:5)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:162:5)
at fail (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:76:9)
at #checkMessaging (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:339:46)
at #dispatch (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:991:29)
at file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:723:38
at Store.transaction (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/store.mjs:156:22)
at Broker.request (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:717:26)
at call (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:73:44)
at send (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:75:5)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:171:5)
at Test.runInAsyncScope (node:async_hooks:226:14) {
code: 'message-recipient-refused'
}
test at packages/bus/tests/messaging.test.mjs:172:1
✖ a business with no role definitions at all is unlimited (13.891916ms)
test at packages/bus/tests/messaging.test.mjs:181:1
✖ a business with no role definitions at all is unlimited (14.378692ms)
Error: message-recipient-refused
at fail (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:76:9)
at #checkMessaging (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:336:46)
at #dispatch (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:969:29)
at file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:701:38
at Store.transaction (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/store.mjs:156:22)
at Broker.request (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:695:26)
at call (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:64:44)
at send (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:66:5)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:176:97)
at fail (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:76:9)
at #checkMessaging (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:339:46)
at #dispatch (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:991:29)
at file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:723:38
at Store.transaction (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/store.mjs:156:22)
at Broker.request (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:717:26)
at call (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:73:44)
at send (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:75:5)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:185:97)
at Test.runInAsyncScope (node:async_hooks:226:14) {
code: 'message-recipient-refused'
}
test at packages/bus/tests/messaging.test.mjs:256:1
✖ a review.verdict to the assistant from a role outside its receiveFrom is refused and logged (16.375732ms)
Error: message-recipient-refused
at fail (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:76:9)
at #checkMessaging (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:339:46)
at #dispatch (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:1096:29)
at file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:723:38
at Store.transaction (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/store.mjs:156:22)
at Broker.request (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:717:26)
at Object.call (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:73:44)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:261:23)
at Test.runInAsyncScope (node:async_hooks:226:14)
at Test.run (node:internal/test_runner/test:1402:25) {
code: 'message-recipient-refused'
}
test at packages/bus/tests/messaging.test.mjs:279:1
✖ review requests and verdicts between roles without the field are unchanged (14.250721ms)
Error: message-recipient-refused
at fail (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:76:9)
at #checkMessaging (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:339:46)
at #dispatch (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:1096:29)
at file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:723:38
at Store.transaction (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/store.mjs:156:22)
at Broker.request (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:717:26)
at call (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:73:44)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:282:17)
at Test.runInAsyncScope (node:async_hooks:226:14)
at Test.run (node:internal/test_runner/test:1402:25) {
code: 'message-recipient-refused'
}
agents/researcher/work/queue-120/mutants/m7-no-field-refuses-sender.patch
+3 -3
View File
@@ -1,6 +1,6 @@
--- /mnt/storage/src/mosaic-stack/agents/researcher/work/queue-120/mutants/.bak.yvAdpu/packages/bus/src/broker.mjs 2026-10-14 20:22:06.948510829 -0500
+++ packages/bus/src/broker.mjs 2026-10-14 20:22:08.535308814 -0500
@@ -332,7 +332,7 @@
--- /mnt/storage/scratch/researcher/r120r2-mutants/.bak.aROvEt/packages/bus/src/broker.mjs 2026-10-14 20:57:29.701567176 -0500
+++ packages/bus/src/broker.mjs 2026-10-14 20:57:31.604688628 -0500
@@ -335,7 +335,7 @@
const definition = (role) => b.definitions?.[b.roles[role]?.definition];
const sender = s.human ? 'human' : s.tester ? 'tester' : b.roles[s.role]?.definition;
const target = to === 'human' || to === 'tester' ? to : b.roles[to]?.definition;
agents/researcher/work/queue-120/mutants/m8-no-field-refuses-target.out
+103 -68
View File
@@ -1,99 +1,134 @@
✖ the assistant sends to the user and to the chief of staff only (20.294334ms)
✖ an assistant send to any other role, or to the tester, is refused and logged (15.232281ms)
✔ only the user and the chief of staff may send to the assistant; the tester is refused by default (18.256702ms)
✖ a sender-side list alone refuses a send to a role that has no list (14.003341ms)
✔ a target-side list alone refuses a send from a role that has no list (17.138062ms)
✔ the sender list is checked before the target list (15.313361ms)
✖ roles without the field behave exactly as before (16.371822ms)
✖ a business with no role definitions at all is unlimited (18.730179ms)
✔ a malformed messaging field refuses at boot (10.166546ms)
ℹ tests 9
✖ the assistant sends to the user and to the chief of staff only (19.247813ms)
✖ an assistant send to any other role, or to the tester, is refused and logged (14.176827ms)
✔ only the user and the chief of staff may send to the assistant; the tester is refused by default (17.064587ms)
✖ a sender-side list alone refuses a send to a role that has no list (13.550237ms)
✔ a target-side list alone refuses a send from a role that has no list (16.302907ms)
✔ the sender list is checked before the target list (13.74079ms)
✖ roles without the field behave exactly as before (13.623625ms)
✖ a business with no role definitions at all is unlimited (14.595898ms)
✔ a malformed messaging field refuses at boot (6.598206ms)
✔ the assistant's review.request to a reviewer is refused and logged, even with an approved decision (18.779244ms)
✖ a review.verdict to the assistant from a role outside its receiveFrom is refused and logged (15.579627ms)
✖ review requests and verdicts between roles without the field are unchanged (13.914103ms)
ℹ tests 12
ℹ suites 0
ℹ pass 4
ℹ fail 5
ℹ pass 5
ℹ fail 7
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 206.467275
ℹ duration_ms 234.029749
✖ failing tests:
test at packages/bus/tests/messaging.test.mjs:78:1
✖ the assistant sends to the user and to the chief of staff only (20.294334ms)
test at packages/bus/tests/messaging.test.mjs:87:1
✖ the assistant sends to the user and to the chief of staff only (19.247813ms)
Error: message-sender-refused
at fail (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:76:9)
at #checkMessaging (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:338:59)
at #dispatch (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:969:29)
at file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:701:38
at Store.transaction (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/store.mjs:156:22)
at Broker.request (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:695:26)
at call (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:64:44)
at send (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:66:5)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:82:18)
at fail (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:76:9)
at #checkMessaging (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:341:59)
at #dispatch (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:991:29)
at file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:723:38
at Store.transaction (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/store.mjs:156:22)
at Broker.request (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:717:26)
at call (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:73:44)
at send (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:75:5)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:91:18)
at Test.runInAsyncScope (node:async_hooks:226:14) {
code: 'message-sender-refused'
}
test at packages/bus/tests/messaging.test.mjs:88:1
✖ an assistant send to any other role, or to the tester, is refused and logged (15.232281ms)
test at packages/bus/tests/messaging.test.mjs:97:1
✖ an assistant send to any other role, or to the tester, is refused and logged (14.176827ms)
Error: message-sender-refused
at fail (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:76:9)
at #checkMessaging (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:338:59)
at #dispatch (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:969:29)
at file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:701:38
at Store.transaction (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/store.mjs:156:22)
at Broker.request (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:695:26)
at call (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:64:44)
at send (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:66:5)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:90:17)
at fail (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:76:9)
at #checkMessaging (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:341:59)
at #dispatch (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:991:29)
at file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:723:38
at Store.transaction (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/store.mjs:156:22)
at Broker.request (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:717:26)
at call (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:73:44)
at send (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:75:5)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:99:17)
at Test.runInAsyncScope (node:async_hooks:226:14) {
code: 'message-sender-refused'
}
test at packages/bus/tests/messaging.test.mjs:125:1
✖ a sender-side list alone refuses a send to a role that has no list (14.003341ms)
test at packages/bus/tests/messaging.test.mjs:134:1
✖ a sender-side list alone refuses a send to a role that has no list (13.550237ms)
Error: message-sender-refused
at fail (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:76:9)
at #checkMessaging (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:338:59)
at #dispatch (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:969:29)
at file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:701:38
at Store.transaction (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/store.mjs:156:22)
at Broker.request (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:695:26)
at call (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:64:44)
at send (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:66:5)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:127:3)
at fail (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:76:9)
at #checkMessaging (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:341:59)
at #dispatch (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:991:29)
at file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:723:38
at Store.transaction (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/store.mjs:156:22)
at Broker.request (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:717:26)
at call (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:73:44)
at send (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:75:5)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:136:3)
at Test.runInAsyncScope (node:async_hooks:226:14) {
code: 'message-sender-refused'
}
test at packages/bus/tests/messaging.test.mjs:150:1
✖ roles without the field behave exactly as before (16.371822ms)
test at packages/bus/tests/messaging.test.mjs:159:1
✖ roles without the field behave exactly as before (13.623625ms)
Error: message-sender-refused
at fail (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:76:9)
at #checkMessaging (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:338:59)
at #dispatch (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:969:29)
at file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:701:38
at Store.transaction (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/store.mjs:156:22)
at Broker.request (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:695:26)
at call (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:64:44)
at send (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:66:5)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:162:5)
at fail (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:76:9)
at #checkMessaging (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:341:59)
at #dispatch (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:991:29)
at file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:723:38
at Store.transaction (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/store.mjs:156:22)
at Broker.request (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:717:26)
at call (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:73:44)
at send (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:75:5)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:171:5)
at Test.runInAsyncScope (node:async_hooks:226:14) {
code: 'message-sender-refused'
}
test at packages/bus/tests/messaging.test.mjs:172:1
✖ a business with no role definitions at all is unlimited (18.730179ms)
test at packages/bus/tests/messaging.test.mjs:181:1
✖ a business with no role definitions at all is unlimited (14.595898ms)
Error: message-sender-refused
at fail (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:76:9)
at #checkMessaging (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:338:59)
at #dispatch (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:969:29)
at file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:701:38
at Store.transaction (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/store.mjs:156:22)
at Broker.request (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:695:26)
at call (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:64:44)
at send (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:66:5)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:176:97)
at fail (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:76:9)
at #checkMessaging (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:341:59)
at #dispatch (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:991:29)
at file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:723:38
at Store.transaction (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/store.mjs:156:22)
at Broker.request (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:717:26)
at call (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:73:44)
at send (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:75:5)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:185:97)
at Test.runInAsyncScope (node:async_hooks:226:14) {
code: 'message-sender-refused'
}
test at packages/bus/tests/messaging.test.mjs:256:1
✖ a review.verdict to the assistant from a role outside its receiveFrom is refused and logged (15.579627ms)
Error: message-sender-refused
at fail (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:76:9)
at #checkMessaging (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:341:59)
at #dispatch (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:1096:29)
at file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:723:38
at Store.transaction (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/store.mjs:156:22)
at Broker.request (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:717:26)
at Object.call (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:73:44)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:261:23)
at Test.runInAsyncScope (node:async_hooks:226:14)
at Test.run (node:internal/test_runner/test:1402:25) {
code: 'message-sender-refused'
}
test at packages/bus/tests/messaging.test.mjs:279:1
✖ review requests and verdicts between roles without the field are unchanged (13.914103ms)
Error: message-sender-refused
at fail (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:76:9)
at #checkMessaging (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:341:59)
at #dispatch (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:1096:29)
at file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:723:38
at Store.transaction (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/store.mjs:156:22)
at Broker.request (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:717:26)
at call (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:73:44)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:282:17)
at Test.runInAsyncScope (node:async_hooks:226:14)
at Test.run (node:internal/test_runner/test:1402:25) {
code: 'message-sender-refused'
}
agents/researcher/work/queue-120/mutants/m8-no-field-refuses-target.patch
+3 -3
View File
@@ -1,6 +1,6 @@
--- /mnt/storage/src/mosaic-stack/agents/researcher/work/queue-120/mutants/.bak.yvAdpu/packages/bus/src/broker.mjs 2026-10-14 20:22:06.948510829 -0500
+++ packages/bus/src/broker.mjs 2026-10-14 20:22:08.776319285 -0500
@@ -334,7 +334,7 @@
--- /mnt/storage/scratch/researcher/r120r2-mutants/.bak.aROvEt/packages/bus/src/broker.mjs 2026-10-14 20:57:29.701567176 -0500
+++ packages/bus/src/broker.mjs 2026-10-14 20:57:31.894692348 -0500
@@ -337,7 +337,7 @@
const target = to === 'human' || to === 'tester' ? to : b.roles[to]?.definition;
const out = s.human || s.tester ? undefined : definition(s.role)?.messaging;
if (out && !out.sendTo.includes(target)) fail('message-recipient-refused');
agents/researcher/work/queue-120/mutants/m9-target-by-instance-name.out
+26 -23
View File
@@ -1,35 +1,38 @@
✖ the assistant sends to the user and to the chief of staff only (20.994601ms)
✔ an assistant send to any other role, or to the tester, is refused and logged (18.964598ms)
✔ only the user and the chief of staff may send to the assistant; the tester is refused by default (18.25924ms)
✔ a sender-side list alone refuses a send to a role that has no list (16.346553ms)
✔ a target-side list alone refuses a send from a role that has no list (17.434642ms)
✔ the sender list is checked before the target list (15.414156ms)
✔ roles without the field behave exactly as before (22.546149ms)
✔ a business with no role definitions at all is unlimited (16.20482ms)
✔ a malformed messaging field refuses at boot (7.705473ms)
ℹ tests 9
✖ the assistant sends to the user and to the chief of staff only (20.197777ms)
✔ an assistant send to any other role, or to the tester, is refused and logged (18.435071ms)
✔ only the user and the chief of staff may send to the assistant; the tester is refused by default (16.342006ms)
✔ a sender-side list alone refuses a send to a role that has no list (15.02274ms)
✔ a target-side list alone refuses a send from a role that has no list (16.510874ms)
✔ the sender list is checked before the target list (13.56025ms)
✔ roles without the field behave exactly as before (20.214016ms)
✔ a business with no role definitions at all is unlimited (14.428869ms)
✔ a malformed messaging field refuses at boot (6.666663ms)
✔ the assistant's review.request to a reviewer is refused and logged, even with an approved decision (16.904033ms)
✔ a review.verdict to the assistant from a role outside its receiveFrom is refused and logged (18.835534ms)
✔ review requests and verdicts between roles without the field are unchanged (16.409061ms)
ℹ tests 12
ℹ suites 0
ℹ pass 8
ℹ pass 11
ℹ fail 1
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 209.198363
ℹ duration_ms 245.959615
✖ failing tests:
test at packages/bus/tests/messaging.test.mjs:78:1
✖ the assistant sends to the user and to the chief of staff only (20.994601ms)
test at packages/bus/tests/messaging.test.mjs:87:1
✖ the assistant sends to the user and to the chief of staff only (20.197777ms)
Error: message-recipient-refused
at fail (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:76:9)
at #checkMessaging (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:336:46)
at #dispatch (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:969:29)
at file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:701:38
at Store.transaction (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/store.mjs:156:22)
at Broker.request (file:///mnt/storage/scratch/researcher/q120/packages/bus/src/broker.mjs:695:26)
at call (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:64:44)
at send (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:66:5)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120/packages/bus/tests/messaging.test.mjs:82:18)
at fail (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:76:9)
at #checkMessaging (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:339:46)
at #dispatch (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:991:29)
at file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:723:38
at Store.transaction (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/store.mjs:156:22)
at Broker.request (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/src/broker.mjs:717:26)
at call (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:73:44)
at send (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:75:5)
at TestContext.<anonymous> (file:///mnt/storage/scratch/researcher/q120r2/packages/bus/tests/messaging.test.mjs:91:18)
at Test.runInAsyncScope (node:async_hooks:226:14) {
code: 'message-recipient-refused'
}
agents/researcher/work/queue-120/mutants/m9-target-by-instance-name.patch
+3 -3
View File
@@ -1,6 +1,6 @@
--- /mnt/storage/src/mosaic-stack/agents/researcher/work/queue-120/mutants/.bak.yvAdpu/packages/bus/src/broker.mjs 2026-10-14 20:22:06.948510829 -0500
+++ packages/bus/src/broker.mjs 2026-10-14 20:22:09.038313937 -0500
@@ -331,7 +331,7 @@
--- /mnt/storage/scratch/researcher/r120r2-mutants/.bak.aROvEt/packages/bus/src/broker.mjs 2026-10-14 20:57:29.701567176 -0500
+++ packages/bus/src/broker.mjs 2026-10-14 20:57:32.185696079 -0500
@@ -334,7 +334,7 @@
const b = this.#business(s.business);
const definition = (role) => b.definitions?.[b.roles[role]?.definition];
const sender = s.human ? 'human' : s.tester ? 'tester' : b.roles[s.role]?.definition;
agents/researcher/work/queue-120/packet-manifest.sha256
+70 -64
View File
@@ -1,78 +1,84 @@
0716725543024bc6aa727aca17cef9e507057078fcb4f4734ff7a97305c3071c ./build.md
cbe2794506ad434b972c14bea74c9def4bee2b5478b7eba224987500e5e1dbce ./candidate-manifest.sha256
3c4a5a2a0428ad104cba34ce024352a1518c9fea335309c89dec698bf9bacd29 ./mutants/control-assistant.out
3fe6840a9206f40243c1826ae430cc41d1874b422c520628a4c67560c454daf3 ./build.md
ae7515b97bb92fdde63e9d2e6fd8473700d3e0c12d9e70fff67e06129fbac1a9 ./candidate-manifest.sha256
7efda293b80a270938fadb0efa90901c04a1b0777b4b279b4019831df02c55f9 ./mutants-run.txt
093aff15be141f14d39011cb8ac56ac8179a2783c6cc289f4f362ca481394f04 ./mutants.sh
931fac5c6158e08fdb0458e3ed0a2d61882a7d9bcaf6ae601c40281f88edbcfa ./mutants/control-assistant.out
9a271f2a916b0b6ee6cecb2426f0b3206ef074578be55d9bc94f6f3fe3ab86aa ./mutants/control-assistant.rc
ba63f7a68ccac8bda77a4b011943a54890f11f40291ff65aea18419fb245602b ./mutants/control-messaging.out
e31a323521d33ff2a9cc1b8ff7261fb6b5d75c700d06002347d26841b064e771 ./mutants/control-messaging.out
9a271f2a916b0b6ee6cecb2426f0b3206ef074578be55d9bc94f6f3fe3ab86aa ./mutants/control-messaging.rc
29864e2f3f56f5087691a9470a616b5c56d8294ba966426b138943e3c99202af ./mutants/control-role.out
f5d81a8098c3fbcf51051f4a335a57a37c3a25ed86bbd3229b157937a71a3723 ./mutants/control-role.out
9a271f2a916b0b6ee6cecb2426f0b3206ef074578be55d9bc94f6f3fe3ab86aa ./mutants/control-role.rc
ce0d8abf656dc468c60be6f56c0648652c54a632a10d6ee4140f200d7c1a2c2d ./mutants/m10-boot-shape-unchecked.out
707278bc5e7f68a7cd664c6ec0fd9723bbd6271dd9f927bd35bb8bd2b5c6fd4d ./mutants/m10-boot-shape-unchecked.patch
4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865 ./mutants/m10-boot-shape-unchecked.rc
28d4062c6d599bb7b9ce4b6942444941f9d7c5127ff48089f8b8f2047ffc9866 ./mutants/m11-validator-accepts-tester.out
1d0c33c69374bb1940924443fa5fdde19bfc980dbc7d46e3d8229e09b3d5cb63 ./mutants/m11-validator-accepts-tester.patch
4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865 ./mutants/m11-validator-accepts-tester.rc
133403c7acfaff97577bf618aaabbd41764ebb95c98caa10d9dbb1fe2fca654a ./mutants/m12a-loader-drops-field.out
dd03bc08f1380dd84fc066c36367233c1a8739c3b1d7a147c54a6d039e004208 ./mutants/m12a-loader-drops-field.patch
4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865 ./mutants/m12a-loader-drops-field.rc
f30598ca7554eb67417db43621a52e4406a7a83e795ca4c9983ff1766841fa8b ./mutants/m12b-loader-drops-field.out
e13182fd9692ff530986752cf0e468c35ab69f8884d6b512dcecf7d3e8ddd18a ./mutants/m12b-loader-drops-field.patch
4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865 ./mutants/m12b-loader-drops-field.rc
61bd44b4d6cc4981ae77188b232c661095aeec62c76df9f1afb282676ae23f72 ./mutants/m13a-assistant-sendTo-pm.out
eba88f196654216b21b2f4a8cd9bd9bc512eaa00027347b0f03ca550409fc7f9 ./mutants/m13a-assistant-sendTo-pm.patch
4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865 ./mutants/m13a-assistant-sendTo-pm.rc
49208663921b4ea13193d8d3c1cb07d761f085868320db975fcfb9790b901e1a ./mutants/m13b-assistant-sendTo-pm.out
2010b3b5ec2a79c028f8083622d31a0f12c21c2a7a5c53c8d891c7b87b5bf7f5 ./mutants/m13b-assistant-sendTo-pm.patch
4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865 ./mutants/m13b-assistant-sendTo-pm.rc
98653e82d61a2928000c6992321b6d5aa8b77378e3fb5547a88a4ef61ea20fa5 ./mutants/m14a-assistant-receiveFrom-coder.out
269ae21f8324a7671c814869f7785b4c5a1ff8baeeb5c283e9de12a8335c20ed ./mutants/m14a-assistant-receiveFrom-coder.patch
4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865 ./mutants/m14a-assistant-receiveFrom-coder.rc
247042483605cb76c9de9514c45cb64ce27f1b93b12efcada84d90b381bc7379 ./mutants/m14b-assistant-receiveFrom-coder.out
fc6abdcc137b9b889405a3254f0cf673d7c7901c157acf1454a8e4fdbefe6b31 ./mutants/m14b-assistant-receiveFrom-coder.patch
4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865 ./mutants/m14b-assistant-receiveFrom-coder.rc
1fac9f1ac650ccabe7f60c2bfb1c674d3668ff646db726de159e51b7a109fbe4 ./mutants/m15a-assistant-unlimited.out
8b561aa012a382c6c1c8f0c5b9a3bce909e1aef44ee5a5de70001e6619bcb799 ./mutants/m15a-assistant-unlimited.patch
4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865 ./mutants/m15a-assistant-unlimited.rc
347b09c9afa418582c28d4a6db8f59da85e0cc3ca699f1039eba0565bd0ccd58 ./mutants/m15b-assistant-unlimited.out
5ead81433005b28ea02122874f6a0240d8f1e420628bfa501a6ff0a89f2dd528 ./mutants/m15b-assistant-unlimited.patch
4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865 ./mutants/m15b-assistant-unlimited.rc
efba9c03493787aa0c1f739c150d5cb5404b54c54bd6c0f7d96e205c2ee5a77b ./mutants/m1-drop-sender-side-check.out
2753279f077ba063b7859aec6a1f6a7874172bb85b772104126828979526ae3f ./mutants/m1-drop-sender-side-check.patch
675b7f898b7c23680e92add1319f1886d79c7de480723ea8bb9320070ada420a ./mutants/m1-drop-sender-side-check.out
70146299c0a16de18be759b50a7ed8eb00cc8735593e51dd7118c740e24fd75b ./mutants/m1-drop-sender-side-check.patch
4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865 ./mutants/m1-drop-sender-side-check.rc
b439643c2126a735cba13f5ef7557e58791fca62a05c8f5c62f4178820646aa6 ./mutants/m2-drop-target-side-check.out
a1d04100aed36befffcb8ca18a3437d1ecb40039c9856575a04b907aa4bd89af ./mutants/m2-drop-target-side-check.patch
ffea0298f985348328451f7460e7ceba64e319ed1e7b66fe9620c8a326a30571 ./mutants/m10-boot-shape-unchecked.out
33c57bf42ccc169bfb7223a0cdf9ecb3ecafc90715ef0c74368bbc09630188ff ./mutants/m10-boot-shape-unchecked.patch
4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865 ./mutants/m10-boot-shape-unchecked.rc
41b02eda7f05b4e766de0bf961e713dab0507a5c325cd18563302a702386cf80 ./mutants/m11-validator-accepts-tester.out
752017d841e9562bdb241b9374227eb67003e699ddc766fccf1ffa6990c48708 ./mutants/m11-validator-accepts-tester.patch
4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865 ./mutants/m11-validator-accepts-tester.rc
b55bc67cf884865a88d2df11ad9efac643ed0dc4c24b0c7959d72434b4d3b9eb ./mutants/m12a-loader-drops-field.out
966f1036abed0d912c81a6c7cf31950c3f3e76615f6b856ffb998431cd543493 ./mutants/m12a-loader-drops-field.patch
4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865 ./mutants/m12a-loader-drops-field.rc
0899f69f9844fce132a43051976d78bdea2d1342690765e34197c0e102f1424b ./mutants/m12b-loader-drops-field.out
3381f97add232b329fd1a5d2a35b8ad439a2b4340aeeabc8e887d9e295b24d53 ./mutants/m12b-loader-drops-field.patch
4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865 ./mutants/m12b-loader-drops-field.rc
3734fa7c5dc4e815f5593effed02647e76d4d2a334cb27bd5caf52a75e2ea13f ./mutants/m13a-assistant-sendTo-pm.out
7ddad6a71c809b78668f12a792076025876b6c596b5ae4251a04d969bae0645a ./mutants/m13a-assistant-sendTo-pm.patch
4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865 ./mutants/m13a-assistant-sendTo-pm.rc
9e0a0ebeed8a27e5caf14ba4d5d316e5af5d2db1c34f6fc617a70c0e47a46d08 ./mutants/m13b-assistant-sendTo-pm.out
be36a336899acc8563c5ae407f11291426562e0cdf48786c2912196982522f28 ./mutants/m13b-assistant-sendTo-pm.patch
4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865 ./mutants/m13b-assistant-sendTo-pm.rc
84b8dcc49ac50c0f9e93dd765a735c877d97bb71d5bc2c0f01957336e2d23aff ./mutants/m14a-assistant-receiveFrom-coder.out
09b37dcf5e358e0737cef5cd42c6ceaec20d0a4b18f983774e659ef19da507a1 ./mutants/m14a-assistant-receiveFrom-coder.patch
4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865 ./mutants/m14a-assistant-receiveFrom-coder.rc
44df78af8928fa42f005421d5e97b14b58ad3b5c04ed67a961b9057218f61888 ./mutants/m14b-assistant-receiveFrom-coder.out
43a5e94bb107257e5445d1e5027a76b85df8fc1a297698ac68a14b9c568b98fb ./mutants/m14b-assistant-receiveFrom-coder.patch
4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865 ./mutants/m14b-assistant-receiveFrom-coder.rc
a1720748c0a2595850b6cf6b79058886e1fb12a5945d77d04378e59fda0dced1 ./mutants/m15a-assistant-unlimited.out
684cbf852d07ff36fe135b13fd16b700615a55d53179326bdd63f5afd919329b ./mutants/m15a-assistant-unlimited.patch
4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865 ./mutants/m15a-assistant-unlimited.rc
f90496b221728a4a59be2dca71722e8e062dafb5fc502f81b1732436f27b68c7 ./mutants/m15b-assistant-unlimited.out
c619a79ae5c39e178b511253d18fb1e42dbb9180739e6eb46a0f5413288ab4ec ./mutants/m15b-assistant-unlimited.patch
4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865 ./mutants/m15b-assistant-unlimited.rc
b02a9e4754398b199947a642287fc60851e1ea59ba2f0310755e2e9086ed9c23 ./mutants/m16-review-request-unchecked.out
53827bc457ab317d518490f726bf87d81a3c295c1fcdb8d90f06e3562f45d2ae ./mutants/m16-review-request-unchecked.patch
4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865 ./mutants/m16-review-request-unchecked.rc
f54614f14ad7750f59698585726232deb9d6c44247fbcf590e8695955e717e92 ./mutants/m17-review-verdict-unchecked.out
524ccceff1ce9e557bb761db27b3de7609279f7b409adacf88c28cc221ac5253 ./mutants/m17-review-verdict-unchecked.patch
4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865 ./mutants/m17-review-verdict-unchecked.rc
541a6b491bbe4a98bc118a2704116572f52e712a92f923dc2d5a5a77df15c1e7 ./mutants/m2-drop-target-side-check.out
17d1aefec76c4bd1bf45b2c76e81e00bc5420422d1faa910263af9d16d9b73d7 ./mutants/m2-drop-target-side-check.patch
4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865 ./mutants/m2-drop-target-side-check.rc
0bc239bfdb02243057d2df29fbe430e36bf7290dea06c74fccaa4386a5aff85a ./mutants/m3-drop-refusal-log.out
bc5ac544c64145b706c91e40199bbb5f12ee68ccb853ef0b067c8a1b1405038d ./mutants/m3-drop-refusal-log.patch
d1d35433f97c17a6439fb0dfed6ae018d5952f56b8cc31ea6147ba588934cdfd ./mutants/m3-drop-refusal-log.out
74d87dfc30c0e468275596994f63c8a93a506c46eefe629e2c01eddb0920a900 ./mutants/m3-drop-refusal-log.patch
4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865 ./mutants/m3-drop-refusal-log.rc
7987148145039a008e360f991a542d242c5ec65463ebc69a8579cabaf2289ba8 ./mutants/m4-sender-reads-receive-list.out
8e711305da0886541c37077f06d07fbe5ab2b457158274ee284df0d43c208677 ./mutants/m4-sender-reads-receive-list.patch
2fc047dc1623edaf1a964eb928ac989309e98b76c31d07669b5520e7eaacd3a8 ./mutants/m4-sender-reads-receive-list.out
74b1f94f0dec548a9ec0bad44cf42ceab0c7a58f1143b27b99e16eed9c5cc7a6 ./mutants/m4-sender-reads-receive-list.patch
4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865 ./mutants/m4-sender-reads-receive-list.rc
f0daf3c6f934d05a17525dd76131c67e1bdf2ff0735c3da7fdd7ae42a4886766 ./mutants/m5-target-reads-send-list.out
3c11d716a49065746f05d405e2c391a35f12b059f8a1057126bde350335a6ddd ./mutants/m5-target-reads-send-list.patch
311b87ad070b3ecd1368eeb494ed994217da7d041d4c45bd06d1a019274e315b ./mutants/m5-target-reads-send-list.out
0e9faef87085f204df3e213a2712f3fb9792d3a95ea5b57a9311119ca70015c3 ./mutants/m5-target-reads-send-list.patch
4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865 ./mutants/m5-target-reads-send-list.rc
12f13f7556d2ab75741f55af2d782adea1b8e7edc8cddb2e7e8413afb9049dd6 ./mutants/m6-tester-exempt.out
f1405fef34b363f98a3fe02db0cb0fb431b0e2dc24838a3cd95bb88916241b11 ./mutants/m6-tester-exempt.patch
b5d3fc3fbb6b68362df5b5019d874534bacd29e765be0e3d645e4f4c70734ce1 ./mutants/m6-tester-exempt.out
4fc898ac09d334fbfc096ff1fbcd2441c6f0110ba5ad90923b535276c52f6836 ./mutants/m6-tester-exempt.patch
4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865 ./mutants/m6-tester-exempt.rc
72789ab63bd4aff24eac78a9a12b7db3c522675d4f6977104a258a2fe7c8fb5c ./mutants/m7-no-field-refuses-sender.out
e386026671ece337244e6067683b1a408195797098adc02bb9c696e94fcfdf4b ./mutants/m7-no-field-refuses-sender.patch
f01b4d78908e2beb3174d92194d8f3cd5bb8a0da36f01bcd5b05b0efc37250eb ./mutants/m7-no-field-refuses-sender.out
a0c6d00cc39e02480279051bd6dd0a90b3d047135585f36bbeea58038dbadb14 ./mutants/m7-no-field-refuses-sender.patch
4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865 ./mutants/m7-no-field-refuses-sender.rc
4f2e17eac7a59a84c1eee14231bcd5ced50f983ec5491fe4e4ff95093b676d74 ./mutants/m8-no-field-refuses-target.out
fcb265e09e1f6dcc2e3df019b20994e97c37eea55e05773e89fd486f7acee1f5 ./mutants/m8-no-field-refuses-target.patch
df73f57aaa231f188801fcbc042a81736310421943b7fe5336d55fff4b4a8a7c ./mutants/m8-no-field-refuses-target.out
5e76166e8f2c29d6b7f4a5393646e429f63e321947ce2289d21d7052d7503909 ./mutants/m8-no-field-refuses-target.patch
4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865 ./mutants/m8-no-field-refuses-target.rc
1324349c8030f3137c07cfb82e635dc9b9a1071fd4c05e9ec935db726c603f74 ./mutants/m9-target-by-instance-name.out
6c92efb6682803d80bea7c417d51e2a21c8770e582c14f188ab8f73059075ee9 ./mutants/m9-target-by-instance-name.patch
b530921ee00743771f14d81665c7d20da8369052c5e6639c4fa82afa52332b46 ./mutants/m9-target-by-instance-name.out
4caa923f374b2791e89b8e00a3c653b6edfa6ef8a0d14450000693303630ec2b ./mutants/m9-target-by-instance-name.patch
4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865 ./mutants/m9-target-by-instance-name.rc
f66b96e094e67bb18204ee486a084629be71433045a786c2388cae2d2ab4d487 ./mutants-run.txt
32487046e90a4fb131541b2e3b5a0e8104fc66948f9305fe56c78eb01c05ae1a ./mutants.sh
511bd9eb1f2c1331b9039398cbaa4d2415c5dbca33295f2fa81153850b0d8b4d ./row120.patch
9f86e4b36ec077dfb2305b9f22be1947e88ec168acd1cf3f7015a652080d4fde ./suites/business.txt
baeee568156e3a83e254d1faea8c9eb52aad723e28824b63cc2b8840437afb9e ./suites/bus.txt
385125f144fac9af16f621712b7081d2156c8df0407011a62a00cee4b2c37e65 ./suites/cli.txt
516344350d2d91143dc6dd143bbe11f4ecf77093a0adc125f9889822a034b091 ./suites/conversation.txt
ff91d180b1ce2cb7ec4794d20b716de946b14815ca7410a8daa8b0c5e9c6151c ./suites/harness.txt
4942038b6ef1427b1563b5b92e83c7b48f0c7e2b71563402879e775c7db01919 ./suites/seat.txt
3a857ab9413fb55bd18a9bce7c467937446d6462bf3941386e33dd5b1eb8876a ./row120.patch
251402da8aa8cc8caae6bc5954702eb5cad6ef350eb89937b3d0f527d3543c41 ./suites.sh
c51b022a499f0737c7a44f3333f468e146eaf800fe8f52e3342d1a1eff6961be ./suites/tasks.txt
b8566b952f55a459cea32d42cf6cc56922b7a79f64d83a112a3829cd92c94498 ./suites/bus.txt
bea18271ba7e845af6e9d30f0e482dbe4970cda1b284945b2069001b6568a633 ./suites/business.txt
75b49f4e0b545747cfaec1584c1f2ace0f68b32ceab59b7b8e52a61df3ae7f42 ./suites/cli.txt
6e7a7f2335aa476b996822657f3275e5799c96ee64baed710a5957cfa51826a6 ./suites/conversation.txt
5392d2f149ddf2a8f78a0c8632e3534a6c349b049567ddc1345f5d48b70fb715 ./suites/harness.txt
6b2e46ed442ac7a09b03cd7f95d6124516295f8f297d0af207be161154ee7326 ./suites/seat.txt
e0c1f17d41cdcda2ac7276a1ee6ac37637cd7e9d2cda3c57ef9cbdb24e37307a ./suites/tasks.txt
ccea37f4ffde1f160dcd1a1864988083a645d974e892065c956b338d0f8c853a ./suites/test-task.txt
30270163980e5ef9dd02a4b9350ffc81eb287a9866563bb3d9857e085eb2ab21 ./suites/webui.txt
6042f286461c1f57f93f836bf643ff284c72486858124fda4963a4f258018595 ./suites/webui.txt
agents/researcher/work/queue-120/row120.patch
+113 -9
View File
@@ -1,8 +1,8 @@
diff --git a/packages/bus/src/broker.mjs b/packages/bus/src/broker.mjs
index 4ab951135..54a4eb0d6 100644
index 64689c573..f10e11b37 100644
--- a/packages/bus/src/broker.mjs
+++ b/packages/bus/src/broker.mjs
@@ -147,6 +147,18 @@ export class Broker {
@@ -149,6 +149,18 @@ export class Broker {
}
if (!Object.hasOwn(b.roles, b.arbiters.technical) || !Object.hasOwn(b.roles, b.arbiters.delivery))
fail('invalid-arbiter');
@@ -21,14 +21,15 @@ index 4ab951135..54a4eb0d6 100644
}
}
#now() {
@@ -311,6 +323,20 @@ export class Broker {
@@ -313,6 +325,21 @@ export class Broker {
? 'cross-role'
: 'gated';
}
+ // Row 120 (#1614, REQ-ASSIST-2). A role definition may carry messaging { sendTo, receiveFrom },
+ // naming the role definitions it may send to and receive from; "human" is the user. A definition
+ // without the lists is unlimited, as before. The sender's lists are checked first, then the
+ // target's, so a tester or the human sending to a limited role is refused unless listed.
+ // target's, so a tester or the human sending to a limited role is refused unless listed. Every
+ // path that stores a message from a role checks it: message.send, review.request, review.verdict.
+ #checkMessaging(s, to) {
+ const b = this.#business(s.business);
+ const definition = (role) => b.definitions?.[b.roles[role]?.definition];
@@ -42,7 +43,7 @@ index 4ab951135..54a4eb0d6 100644
#decision(s, id) {
const d = this.#store.get('SELECT * FROM decisions WHERE id=? AND business=?', id, s.business);
if (!d) fail('decision-not-found');
@@ -940,6 +966,7 @@ export class Broker {
@@ -961,6 +988,7 @@ export class Broker {
if (a.to === 'tester') fail('unknown-role');
}
if (a.to !== 'human' && a.to !== 'tester' && !Object.hasOwn(b.roles, a.to)) fail('unknown-role');
@@ -50,12 +51,30 @@ index 4ab951135..54a4eb0d6 100644
string(a.body, 32768);
if (
a.class !== undefined &&
@@ -1064,6 +1092,8 @@ export class Broker {
);
fail(older ? 'stale-commit' : 'unknown-commit');
}
+ // REQ-ASSIST-2 has no approval exception: a review request is a message to the reviewer.
+ this.#checkMessaging(s, a.to);
const mid = randomUUID();
// Row 105 (#1599): the run holding the reviewer role, or null when nobody holds it and the
// request waits for a claim. #reviewMessage routes on the same holder.
@@ -1105,6 +1135,8 @@ export class Broker {
)
)
fail('verdict-exists');
+ // The verdict is a message to the role that asked, so it meets that role's receive list.
+ this.#checkMessaging(s, r.from);
const mid = randomUUID();
const eid = this.#event(
s,
diff --git a/packages/bus/tests/messaging.test.mjs b/packages/bus/tests/messaging.test.mjs
new file mode 100644
index 000000000..def8d9b7e
index 000000000..a1d6f9e53
--- /dev/null
+++ b/packages/bus/tests/messaging.test.mjs
@@ -0,0 +1,202 @@
@@ -0,0 +1,287 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
@@ -78,15 +97,23 @@ index 000000000..def8d9b7e
+ chief: { definition: 'chief-of-staff', ...within },
+ assistant: { definition: 'assistant', ...within },
+ pm: { definition: 'pm', ...within },
+ coder: { definition: 'coder', ...within },
+ coder: {
+ definition: 'coder',
+ authority: { withinRole: ['message.send', 'git.push.working', 'review.request'], crossRole: [] },
+ },
+ scribe: { definition: 'scribe', ...within },
+ warden: { definition: 'warden', ...within },
+ reviewer: {
+ definition: 'reviewer',
+ authority: { withinRole: ['message.send', 'review.verdict'], crossRole: [] },
+ },
+};
+const definitions = {
+ 'chief-of-staff': {},
+ assistant: { messaging: assistantLists },
+ pm: {},
+ coder: {},
+ reviewer: {},
+ // Only a send limit: tells a dropped sender-side check apart from the target-side check.
+ scribe: { messaging: { sendTo: ['pm'], receiveFrom: ['human', 'pm', 'coder', 'warden', 'chief-of-staff'] } },
+ // Only a receive limit: the same for the target side.
@@ -99,6 +126,7 @@ index 000000000..def8d9b7e
+ arbiters: { technical: 'pm', delivery: 'chief' },
+ roles,
+ definitions,
+ projects: { stack: { root: '/nonexistent' } },
+ vars: { 'bus.tester': true },
+ ...extra,
+ },
@@ -258,6 +286,82 @@ index 000000000..def8d9b7e
+ ])
+ assert.throws(boot(bad), { code: 'invalid-messaging' }, JSON.stringify(bad));
+});
+
+// Round 1 F1: review.request and review.verdict store a message too, so the same lists bind them.
+// REQ-ASSIST-2 has no approval exception, so an approved decision doesn't open a path.
+const TASK = 'vikunja:1/2';
+const COMMIT = 'a'.repeat(40);
+const options = [
+ { key: 'yes', text: 'Allow' },
+ { key: 'no', text: 'Decline' },
+];
+const pushed = (b, caps) => {
+ b.checkPush(caps.coder, TASK);
+ b.recordPush(caps.coder, { task_ref: TASK, project: 'stack', branch: 'feat', ref: 'work/vikunja-1-2', commit: COMMIT, previous: null });
+};
+// The assistant holds no review.request, so it raises a decision for it, and the human approves.
+const approved = (call) => {
+ const d = call('assistant', 'decision.raise', {
+ action: 'review.request',
+ target: TASK,
+ question: 'review?',
+ options,
+ recommendation: 'yes',
+ blocking: false,
+ });
+ call('human', 'decision.resolve', { id: d.id, choice: 'yes' });
+ return d.id;
+};
+
+test("the assistant's review.request to a reviewer is refused and logged, even with an approved decision", (t) => {
+ const { b, caps, call, count, refusals } = setup(t);
+ pushed(b, caps);
+ const decision = approved(call);
+ const messages = count('SELECT count(*) n FROM messages');
+ const used = "SELECT count(*) n FROM events WHERE kind='action.allowed' AND json_extract(body,'$.action')='review.request'";
+ const before = count(used);
+ const ask = () => call('assistant', 'review.request', { task_ref: TASK, commit: COMMIT, to: 'reviewer', decision });
+ // The refusal leaves the decision unconsumed, so a retry meets the same list, not decision-consumed.
+ assert.throws(ask, { code: RECIPIENT });
+ assert.throws(ask, { code: RECIPIENT });
+ assert.deepEqual(refusals(), [['assistant', RECIPIENT], ['assistant', RECIPIENT]]);
+ assert.equal(count('SELECT count(*) n FROM messages'), messages, 'no REVIEW-REQUEST stored');
+ assert.equal(count("SELECT count(*) n FROM events WHERE kind='review.requested'"), 0);
+ assert.equal(count(used), before, 'a refused request consumes no authority');
+});
+
+test('a review.verdict to the assistant from a role outside its receiveFrom is refused and logged', (t) => {
+ // A request from before the lists existed: a first broker without the assistant's lists lets it through.
+ const first = setup(t, demo({ definitions: { ...definitions, assistant: {} } }));
+ pushed(first.b, first.caps);
+ const decision = approved(first.call);
+ const asked = first.call('assistant', 'review.request', { task_ref: TASK, commit: COMMIT, to: 'reviewer', decision });
+ // A second broker on the same store enforces the shipped lists.
+ first.call('reviewer', 'role.release');
+ const b2 = new Broker({ store: first.store, businesses: demo() });
+ const cap = b2.bindLaunch({ business: 'demo', role: 'reviewer', run: 'reviewer-run-2', harness: 'pi' });
+ b2.request(cap, { verb: 'role.claim' });
+ const args = { task_ref: TASK, request: asked.request, verdict: 'approve', body: 'looks fine' };
+ assert.throws(() => b2.request(cap, { verb: 'review.verdict', args }), { code: SENDER });
+ assert.deepEqual(first.refusals(), [['reviewer', SENDER]]);
+ assert.equal(first.count("SELECT count(*) n FROM messages WHERE class='REVIEW-RESULT'"), 0, 'no REVIEW-RESULT stored');
+ assert.equal(first.count("SELECT count(*) n FROM events WHERE kind='review.verdict'"), 0);
+ assert.equal(
+ first.count("SELECT count(*) n FROM events WHERE kind='action.allowed' AND json_extract(body,'$.action')='review.verdict'"),
+ 0,
+ 'a refused verdict consumes no authority',
+ );
+});
+
+test('review requests and verdicts between roles without the field are unchanged', (t) => {
+ const { b, caps, call, store, refusals } = setup(t);
+ pushed(b, caps);
+ const asked = call('coder', 'review.request', { task_ref: TASK, commit: COMMIT, to: 'reviewer' });
+ const verdict = call('reviewer', 'review.verdict', { task_ref: TASK, request: asked.request, verdict: 'approve', body: 'ok' });
+ assert.equal(store.get('SELECT to_role FROM messages WHERE id=?', asked.message).to_role, 'reviewer');
+ assert.equal(store.get('SELECT to_role FROM messages WHERE id=?', verdict.message).to_role, 'coder');
+ assert.deepEqual(refusals(), []);
+});
diff --git a/packages/business/src/role.mjs b/packages/business/src/role.mjs
index 37f99ce14..b990e8e12 100644
--- a/packages/business/src/role.mjs
@@ -329,7 +433,7 @@ index 37f99ce14..b990e8e12 100644
}
diff --git a/packages/business/tests/assistant.test.mjs b/packages/business/tests/assistant.test.mjs
index aaa809c44..ec421ef47 100644
index ce2648fab..9cdbff49a 100644
--- a/packages/business/tests/assistant.test.mjs
+++ b/packages/business/tests/assistant.test.mjs
@@ -14,6 +14,11 @@ const APPROVED = Object.freeze({
agents/researcher/work/queue-120/suites/bus.txt
+174 -168
View File
@@ -1,173 +1,179 @@
✔ agents: a held role with nothing on the bus is idle; a role session gets the claim rows unchanged (33.018172ms)
✔ agents: working counts what the holder received and has not read; routed alone is not working (31.700437ms)
✔ agents: input needed is the role's open decisions routed to the human, gated first, then oldest (48.974624ms)
✔ agents: working wins over waiting, and Input needed still shows (21.247823ms)
✔ agents: a new holder doesn't inherit what the last one left unread; decisions stay with the role (26.752407ms)
✔ agents: state reads only its own business, even for a run name both use (24.931388ms)
✔ agents: a message the holder released unread is stranded; the next holder gets nothing and cannot read it (28.059106ms)
✔ agents: a message the holder read is not stranded; one the current holder has not read is not listed (28.753582ms)
✔ agents: stranded is oldest first and capped at 50 for a role (147.24456ms)
✔ agents: stranded is per role and per business (42.22657ms)
✔ agents: a message routed to a held role and not yet received is not stranded (17.749002ms)
✔ launch identity is stamped, payload identity is refused and stale holder cannot send (33.45022ms)
✔ decision classes route from policy; gated resolution is human-only, choice and target must match (35.012338ms)
✔ claim exclusion, holder release, gated revoke and rerouting to a new holder are atomic (34.641582ms)
✔ launch events require a human CLI capability; generic emit cannot forge authority events (22.226379ms)
✔ within-role decisions close atomically and invalid options or blocking omissions refuse (24.25032ms)
✔ a recommendation that is not exactly one option key refuses invalid-recommendation after the options (35.118199ms)
✔ observer capabilities read human inbox but cannot mutate or forge launch identity (24.172124ms)
✔ task action subjects and linked decision trail are complete and ordered (36.827595ms)
✔ launch binding is durable and reconnecting requires the identical trusted record (17.293527ms)
✔ business isolation includes inherited object names and cross-business message references (31.527562ms)
✔ authority never transfers between action, run, target, unresolved or replaced role holder (46.867338ms)
✔ task projection uses schema current view, skipping earlier and equal-start polls (27.861857ms)
✔ revocation permanently bars the old run from reclaiming first, including after broker restart (32.709455ms)
✔ empty message references refuse before storage; refusal-evidence failure stays a typed error (20.24977ms)
✔ both arbiters require human resolution when their cross-role route is themselves (32.411524ms)
✔ the shipped coder role raises task.reassign as gated to the human; task.scope.change stays cross-role (25.437031ms)
✔ S1 adapter takes resolved limits and refs, rejects mismatched instance, never mutates input (2.648677ms)
✔ credentials gives human and reader sessions service, account, role, date and state, and nothing else (26.164423ms)
✔ credentials refuses a role session and any argument (25.450923ms)
✔ credentials reads the status on each request, and a broker without one lists none (24.458604ms)
✔ the broker process answers credentials without a token, path or variable in its output, log or store (98.714704ms)
✔ only validated broker references load; returned data and exceptions cannot expose a known token (5.697333ms)
✔ bad file modes, symlinks, repository/data paths, malformed tokens and missing dates refuse (3.139342ms)
✔ expiry refuses use and env references never become client data (1.008487ms)
✔ S1 parsed service refs work, service mismatch refuses, Gitea rotation due is a warning state (2.769815ms)
✔ opaque tokens shorter than 16 characters refuse before use (0.597386ms)
✔ a human resolve sends the raising role one message from the human, and its request is the answer (55.155801ms)
✔ a cross-role decision resolved by its arbiter comes from that role and run, with no request (26.785051ms)
✔ a human withdraw sends one message with the note (31.840319ms)
✔ a human seen before the close leaves the request on the close's answer, not the seen (38.711116ms)
✔ the raising run's withdraw, a supersede, a within-role raise and seen send nothing (42.521025ms)
✔ refused closes send nothing: invalid-choice, decision-closed, not-resolver (40.552613ms)
✔ a raising role nobody holds at the close gets the message on the next claim (35.701283ms)
✔ a human DECISION send keeps its own instruction as the request, not a close's answer (34.82851ms)
✔ roles lists open decisions routed to a role, and never the human inbox (42.52987ms)
✔ recent lists closed decisions of every route, newest close first, with how each closed (38.150644ms)
✔ recent gives the closing event as closed when the decision was seen first (36.456963ms)
✔ recent stops at RECENT rows (134.457951ms)
✔ every row is what trail already gives the same session for that id (58.602583ms)
✔ a role session can't list decisions, so it can't read another role's open decisions (74.056209ms)
✔ decisions is a read: one business, strict arguments, nothing written (50.624963ms)
✔ endLaunch writes session.ended, releases the run claim and kills its capabilities (26.291467ms)
✔ endLaunch refuses an unknown run, a second end and a rebind of the ended run (17.799488ms)
✔ a restarted broker refuses to rebind an ended run; a refused rebind leaves the run unbound (20.709103ms)
✔ endLaunch leaves a claim another run took alone (25.717541ms)
✔ refuse records action.refused against the caller with the code only (15.430986ms)
✔ launches off refuses role.launch with launch-revoked until launches on (25.491186ms)
✔ broker process: launch ops authorize role.launch, record refusals and end runs (127.879124ms)
✔ human proof binds CLI entry, process start and nonce; agents and incomplete ancestry refuse (4.180153ms)
✔ process reader gets own kernel identity without exposing environment values (0.792573ms)
✔ EACCES ancestor environments skip only markers; commands and registered launches still refuse (1.075175ms)
✔ real pid 1 remains inspectable when its environment is protected (0.529502ms)
✔ within-role sends cite an open gated launch decision without spending it or naming it in grants (37.459832ms)
✔ missing and foreign-business citations refuse and roll back message and grant (25.038095ms)
✔ cross-role sends still need a matching resolved decision and consume it once (35.918347ms)
✔ messages pages all human messages newest first without writes; read state is history (466.127328ms)
✔ messages refuses role callers, invalid paging and cursors outside this human feed (26.924423ms)
✔ views messages passes only its paging arguments through (0.333235ms)
✔ messages isolates businesses even with a valid foreign cursor (15.19104ms)
✔ the assistant sends to the user and to the chief of staff only (43.459795ms)
✔ an assistant send to any other role, or to the tester, is refused and logged (41.332066ms)
✔ only the user and the chief of staff may send to the assistant; the tester is refused by default (39.641094ms)
✔ a sender-side list alone refuses a send to a role that has no list (36.99997ms)
✔ a target-side list alone refuses a send from a role that has no list (37.999199ms)
✔ the sender list is checked before the target list (33.170239ms)
✔ roles without the field behave exactly as before (63.034123ms)
✔ a business with no role definitions at all is unlimited (47.396555ms)
✔ a malformed messaging field refuses at boot (16.653703ms)
✔ broker process binds trusted launches, offers reader capabilities, refuses human mutation, closes cleanly (96.752567ms)
✔ startup token refusal returns safe code without value or partial listening broker (65.144963ms)
✔ loaded fixture token is absent from socket replies and SQLite, including refusal evidence (92.687062ms)
✔ killed broker leaves an explicit stale lock; another process cannot silently reclaim it (144.713997ms)
✔ trusted host registers later launches; socket clients never have a registration verb (74.945846ms)
✔ runtime excludes declared project roots even when host supplies no repoRoots (43.931453ms)
✔ a refused launch binding leaves the broker and existing capabilities alive; bad protocol stops it (57.567732ms)
✔ a reply is listed for human and reader sessions, and its delivery rows are unchanged (46.836662ms)
✔ the reply still reaches the human message.receive (mosaic talk) after the Console showed it (25.085931ms)
✔ a message with no reply gives an empty list (21.312843ms)
✔ replies come oldest first and stop at REPLIES (109.858017ms)
✔ an id that names no message in the business refuses message-not-found, and the refusal is recorded (44.827884ms)
✔ strict arguments; a role session gets human-required (62.405686ms)
✔ views passes replies through as one call with the id (0.397755ms)
✔ requirements returns the committed list to a holding role session, and no one else (32.382145ms)
✔ the PM's prd.approve with no task, when no id fits, reaches the human's Inbox (20.447891ms)
✔ the PM's non-blocking role.revoke with no task reaches the human's Inbox (22.126643ms)
✔ a push is recorded as the action.allowed for git.push.working on the task, and only the host records one (36.27257ms)
✔ review.request names the latest pushed commit and sends the reviewer a REVIEW-REQUEST (30.485028ms)
✔ review.request says which run holds the reviewer role, or null, and a null request waits for a claim (38.496864ms)
✔ review.request refuses a commit that isn't the latest push, a non-reviewer and a role without the action (51.053593ms)
✔ reviewFetch answers only the addressed reviewer, for the request it cites (35.772469ms)
✔ review.verdict answers one request once, to the role that asked (52.566248ms)
✔ task.close on a pushed task needs an approve verdict for the latest push (64.057817ms)
✔ a refusal the host decided is filed on the task it names, and only a task ref counts (30.385057ms)
✔ v3b prototype refusals, views and append-only mutations (104.702739ms)
✔ gated approval authorizes once, survives store reopen, and fresh approval works (39.642463ms)
✔ another run cannot consume an approval; a failed check leaves it usable (28.526393ms)
✔ two scheduled callers have exactly one grant and one consumed refusal (22.689644ms)
✔ failed commit rolls consumption back; cross-role consumes and within-role stays reusable (45.879173ms)
✔ class drift gated to cross-role refuses before consumption (33.372714ms)
✔ class drift cross-role to gated refuses before consumption (44.695732ms)
✔ class drift gated to within-role refuses before consumption (40.303413ms)
✔ class drift cross-role to within-role refuses before consumption (38.377449ms)
✔ class drift within-role to gated refuses before consumption (26.732121ms)
✔ class drift within-role to cross-role refuses before consumption (29.50482ms)
✔ message.send consumes approval and prevents a later send or authorize (26.9419ms)
✔ role.revoke consumes approval and prevents a later revoke or authorize (27.824253ms)
✔ a business that never switched launches reads allowed with no time and no event (24.978622ms)
✔ launches revoked and then restored read allowed, with the restore time and event id (22.271336ms)
✔ a task closed on the tracker leaves the open list, and total counts the open ones (21.204647ms)
✔ a tombstone is not open (20.007994ms)
✔ the open list stops at the cap and says so; total still counts every open task (29.186134ms)
✔ a role and a reader session read state; arguments, and an unbound cap, refuse (28.49025ms)
✔ a human session reads the same state, with the same cap (30.84651ms)
✔ reading state writes nothing: every table keeps its row count (25.284332ms)
✔ creates private WAL store and excludes a second writer until explicit close (20.830814ms)
✔ rollback is atomic and schema metadata is checked against trusted DDL, not just itself (24.909985ms)
✔ existing empty database and symlink runtime directory refuse, never initialize over damage (23.209544ms)
✔ crash during a transaction recovers no partial event after explicit fixture-only lock removal (88.335963ms)
✔ writer refuses mixed at/read_at forms atomically, even through trusted SQL helpers (17.770709ms)
✔ async transactions refuse before invoking their function (11.551344ms)
✔ the session default fits under the reply cap and pages to the end with next (216.737892ms)
✔ the short form: no description, assignees by role, every listed key (91.04615ms)
✔ each filter, alone and together, and total counts every match (157.186363ms)
✔ task_ref reads one task in full, as the whole board has it (108.622816ms)
✔ no arguments is the read the Console and mosaic make, unchanged (82.669351ms)
✔ an unknown argument or a bad value refuses invalid-request (332.934773ms)
✔ tasks rows carry priority and requirement for every session that reads tasks (64.729979ms)
✔ the read model rebuilds from the ledger: a reopened bus and each trail give the same values (73.721608ms)
✔ an empty business and one with snapshots but no task.created read cleanly (16.265275ms)
✔ recordTask keeps sync reads and a role write apart (35.028954ms)
✔ read_at must be one canonical UTC format, so the projection compares strings safely (14.386426ms)
✔ a bad entry refuses the whole record (14.83913ms)
✔ taskView reads the projection for one business (17.374197ms)
✔ requestTask hands only a holder and a task verb to the handler, and records refusals (30.463452ms)
✔ the server sends task verbs to the adapter with its own timeout; other verbs stay synchronous (277.119261ms)
✔ without an adapter the server refuses every task verb (16.162486ms)
✔ the runtime refuses an invalid adapter and closes a valid one (17.503514ms)
✔ the process loads the S3 adapter from plain-data trackers (114.294212ms)
✔ the tester binds only when the business sets bus.tester to exactly true (96.126382ms)
✔ a business may not name a role tester, so the tester address is never a role (24.930271ms)
✔ every verb outside the tester list refuses tester-refused and is recorded against the tester (42.958567ms)
✔ a tester message is from tester, starts [mos test], and writes no human.input or authority (18.216883ms)
✔ a role answers a tester only in reply to a tester message, and the answer never reaches the human (24.51164ms)
✔ the tester reads the human views a reader reads (26.517098ms)
✔ tester proof binds its own CLI, start time and nonce, refuses a managed run and allows an agent (1.350702ms)
✔ neither CLI's nonce proves the other: each proof is bound to its own CLI and nonce variable (1.008321ms)
✔ testerNonce reads only the tester's variable and gives null on any read error (0.246245ms)
✔ an envelope carries exactly one of cap, human and tester; no tester authenticator refuses (16.183925ms)
✔ tester-cli.mjs binds through the runtime when the switch is on, and refuses off or under a run marker (674.940177ms)
✔ socket capability stamps launch identity; shared views use wire, no SQL client (34.929356ms)
✔ two wire claims serialize; a lost reply never automatically retries (24.362054ms)
✔ malformed, oversized and identity-forging envelopes refuse without echoing input (13.152774ms)
✔ client preserves UTF-8 when a response divides a multibyte character (11.894657ms)
✔ committed mutation followed by dropped reply reports unknown and is never retried (13.704895ms)
ℹ tests 165
✔ agents: a held role with nothing on the bus is idle; a role session gets the claim rows unchanged (29.803898ms)
✔ agents: working counts what the holder received and has not read; routed alone is not working (23.34018ms)
✔ agents: input needed is the role's open decisions routed to the human, gated first, then oldest (41.324518ms)
✔ agents: working wins over waiting, and Input needed still shows (18.808876ms)
✔ agents: a new holder doesn't inherit what the last one left unread; decisions stay with the role (24.602811ms)
✔ agents: state reads only its own business, even for a run name both use (22.55882ms)
✔ agents: a message the holder released unread is stranded; the next holder gets nothing and cannot read it (29.96198ms)
✔ agents: a message the holder read is not stranded; one the current holder has not read is not listed (25.424027ms)
✔ agents: stranded is oldest first and capped at 50 for a role (115.526451ms)
✔ agents: stranded is per role and per business (42.445299ms)
✔ agents: a message routed to a held role and not yet received is not stranded (14.26086ms)
✔ launch identity is stamped, payload identity is refused and stale holder cannot send (25.838263ms)
✔ decision classes route from policy; gated resolution is human-only, choice and target must match (29.219066ms)
✔ claim exclusion, holder release, gated revoke and rerouting to a new holder are atomic (32.010293ms)
✔ launch events require a human CLI capability; generic emit cannot forge authority events (19.013315ms)
✔ within-role decisions close atomically and invalid options or blocking omissions refuse (18.688411ms)
✔ a recommendation that is not exactly one option key refuses invalid-recommendation after the options (30.798436ms)
✔ observer capabilities read human inbox but cannot mutate or forge launch identity (20.61444ms)
✔ task action subjects and linked decision trail are complete and ordered (32.158714ms)
✔ launch binding is durable and reconnecting requires the identical trusted record (14.63623ms)
✔ business isolation includes inherited object names and cross-business message references (22.847308ms)
✔ authority never transfers between action, run, target, unresolved or replaced role holder (31.037126ms)
✔ task projection uses schema current view, skipping earlier and equal-start polls (21.839115ms)
✔ revocation permanently bars the old run from reclaiming first, including after broker restart (29.722476ms)
✔ empty message references refuse before storage; refusal-evidence failure stays a typed error (20.286182ms)
✔ both arbiters require human resolution when their cross-role route is themselves (28.693659ms)
✔ the shipped coder role raises task.reassign as gated to the human; task.scope.change stays cross-role (23.354047ms)
✔ S1 adapter takes resolved limits and refs, rejects mismatched instance, never mutates input (2.220781ms)
✔ credentials gives human and reader sessions service, account, role, date and state, and nothing else (16.985899ms)
✔ credentials refuses a role session and any argument (21.235375ms)
✔ credentials reads the status on each request, and a broker without one lists none (24.391706ms)
✔ the broker process answers credentials without a token, path or variable in its output, log or store (85.667235ms)
✔ only validated broker references load; returned data and exceptions cannot expose a known token (3.950059ms)
✔ bad file modes, symlinks, repository/data paths, malformed tokens and missing dates refuse (3.089552ms)
✔ expiry refuses use and env references never become client data (0.738541ms)
✔ S1 parsed service refs work, service mismatch refuses, Gitea rotation due is a warning state (2.089148ms)
✔ opaque tokens shorter than 16 characters refuse before use (0.333188ms)
✔ a human resolve sends the raising role one message from the human, and its request is the answer (43.568498ms)
✔ a cross-role decision resolved by its arbiter comes from that role and run, with no request (26.700162ms)
✔ a human withdraw sends one message with the note (25.702724ms)
✔ a human seen before the close leaves the request on the close's answer, not the seen (31.5591ms)
✔ the raising run's withdraw, a supersede, a within-role raise and seen send nothing (32.670172ms)
✔ refused closes send nothing: invalid-choice, decision-closed, not-resolver (34.769121ms)
✔ a raising role nobody holds at the close gets the message on the next claim (32.439446ms)
✔ a human DECISION send keeps its own instruction as the request, not a close's answer (27.582348ms)
✔ roles lists open decisions routed to a role, and never the human inbox (33.542674ms)
✔ recent lists closed decisions of every route, newest close first, with how each closed (33.195643ms)
✔ recent gives the closing event as closed when the decision was seen first (33.071521ms)
✔ recent stops at RECENT rows (116.778871ms)
✔ every row is what trail already gives the same session for that id (50.55323ms)
✔ a role session can't list decisions, so it can't read another role's open decisions (54.9699ms)
✔ decisions is a read: one business, strict arguments, nothing written (45.599614ms)
✔ endLaunch writes session.ended, releases the run claim and kills its capabilities (20.950203ms)
✔ endLaunch refuses an unknown run, a second end and a rebind of the ended run (14.422037ms)
✔ a restarted broker refuses to rebind an ended run; a refused rebind leaves the run unbound (17.87087ms)
✔ endLaunch leaves a claim another run took alone (19.515885ms)
✔ refuse records action.refused against the caller with the code only (13.809786ms)
✔ launches off refuses role.launch with launch-revoked until launches on (20.309907ms)
✔ broker process: launch ops authorize role.launch, record refusals and end runs (109.049256ms)
✔ human proof binds CLI entry, process start and nonce; agents and incomplete ancestry refuse (2.565598ms)
✔ process reader gets own kernel identity without exposing environment values (0.785406ms)
✔ EACCES ancestor environments skip only markers; commands and registered launches still refuse (0.730713ms)
✔ real pid 1 remains inspectable when its environment is protected (0.276412ms)
✔ limits binds actor from human proof and rejects role, reader, tester and forged actor (26.243242ms)
✔ runtime wires verified human settings to the actual shared file writer and actor receipt (49.47704ms)
✔ uncertain organization receipts leave bus startup and reads alone but refuse writes until reconciled (46.398854ms)
✔ within-role sends cite an open gated launch decision without spending it or naming it in grants (27.743348ms)
✔ missing and foreign-business citations refuse and roll back message and grant (21.428831ms)
✔ cross-role sends still need a matching resolved decision and consume it once (27.417184ms)
✔ messages pages all human messages newest first without writes; read state is history (384.092514ms)
✔ messages refuses role callers, invalid paging and cursors outside this human feed (23.613762ms)
✔ views messages passes only its paging arguments through (0.242735ms)
✔ messages isolates businesses even with a valid foreign cursor (17.333333ms)
✔ the assistant sends to the user and to the chief of staff only (37.538389ms)
✔ an assistant send to any other role, or to the tester, is refused and logged (35.032689ms)
✔ only the user and the chief of staff may send to the assistant; the tester is refused by default (36.596148ms)
✔ a sender-side list alone refuses a send to a role that has no list (36.535911ms)
✔ a target-side list alone refuses a send from a role that has no list (36.975286ms)
✔ the sender list is checked before the target list (30.30108ms)
✔ roles without the field behave exactly as before (48.858791ms)
✔ a business with no role definitions at all is unlimited (37.795269ms)
✔ a malformed messaging field refuses at boot (16.042838ms)
✔ the assistant's review.request to a reviewer is refused and logged, even with an approved decision (38.189282ms)
✔ a review.verdict to the assistant from a role outside its receiveFrom is refused and logged (36.265665ms)
✔ review requests and verdicts between roles without the field are unchanged (26.067838ms)
✔ broker process binds trusted launches, offers reader capabilities, refuses human mutation, closes cleanly (85.883934ms)
✔ startup token refusal returns safe code without value or partial listening broker (55.322867ms)
✔ loaded fixture token is absent from socket replies and SQLite, including refusal evidence (89.012967ms)
✔ killed broker leaves an explicit stale lock; another process cannot silently reclaim it (136.619447ms)
✔ trusted host registers later launches; socket clients never have a registration verb (67.209327ms)
✔ runtime excludes declared project roots even when host supplies no repoRoots (40.835471ms)
✔ a refused launch binding leaves the broker and existing capabilities alive; bad protocol stops it (57.799537ms)
✔ a reply is listed for human and reader sessions, and its delivery rows are unchanged (36.500255ms)
✔ the reply still reaches the human message.receive (mosaic talk) after the Console showed it (21.937999ms)
✔ a message with no reply gives an empty list (17.644347ms)
✔ replies come oldest first and stop at REPLIES (91.820539ms)
✔ an id that names no message in the business refuses message-not-found, and the refusal is recorded (34.083011ms)
✔ strict arguments; a role session gets human-required (41.573755ms)
✔ views passes replies through as one call with the id (0.363847ms)
✔ requirements returns the committed list to a holding role session, and no one else (27.165634ms)
✔ the PM's prd.approve with no task, when no id fits, reaches the human's Inbox (17.654488ms)
✔ the PM's non-blocking role.revoke with no task reaches the human's Inbox (20.46887ms)
✔ a push is recorded as the action.allowed for git.push.working on the task, and only the host records one (30.323653ms)
✔ review.request names the latest pushed commit and sends the reviewer a REVIEW-REQUEST (29.232433ms)
✔ review.request says which run holds the reviewer role, or null, and a null request waits for a claim (34.971168ms)
✔ review.request refuses a commit that isn't the latest push, a non-reviewer and a role without the action (46.059249ms)
✔ reviewFetch answers only the addressed reviewer, for the request it cites (27.991807ms)
✔ review.verdict answers one request once, to the role that asked (36.906493ms)
✔ task.close on a pushed task needs an approve verdict for the latest push (53.871978ms)
✔ a refusal the host decided is filed on the task it names, and only a task ref counts (28.311675ms)
✔ v3b prototype refusals, views and append-only mutations (92.675365ms)
✔ gated approval authorizes once, survives store reopen, and fresh approval works (37.558171ms)
✔ another run cannot consume an approval; a failed check leaves it usable (26.603484ms)
✔ two scheduled callers have exactly one grant and one consumed refusal (18.828722ms)
✔ failed commit rolls consumption back; cross-role consumes and within-role stays reusable (37.857329ms)
✔ class drift gated to cross-role refuses before consumption (31.041474ms)
✔ class drift cross-role to gated refuses before consumption (35.382756ms)
✔ class drift gated to within-role refuses before consumption (27.642061ms)
✔ class drift cross-role to within-role refuses before consumption (27.482054ms)
✔ class drift within-role to gated refuses before consumption (21.876315ms)
✔ class drift within-role to cross-role refuses before consumption (20.064325ms)
✔ message.send consumes approval and prevents a later send or authorize (19.99923ms)
✔ role.revoke consumes approval and prevents a later revoke or authorize (18.361353ms)
✔ a business that never switched launches reads allowed with no time and no event (23.679381ms)
✔ launches revoked and then restored read allowed, with the restore time and event id (17.510123ms)
✔ a task closed on the tracker leaves the open list, and total counts the open ones (19.536924ms)
✔ a tombstone is not open (16.96769ms)
✔ the open list stops at the cap and says so; total still counts every open task (22.344557ms)
✔ a role and a reader session read state; arguments, and an unbound cap, refuse (20.925016ms)
✔ a human session reads the same state, with the same cap (24.967346ms)
✔ reading state writes nothing: every table keeps its row count (20.303151ms)
✔ creates private WAL store and excludes a second writer until explicit close (18.566988ms)
✔ rollback is atomic and schema metadata is checked against trusted DDL, not just itself (18.023185ms)
✔ existing empty database and symlink runtime directory refuse, never initialize over damage (17.690481ms)
✔ crash during a transaction recovers no partial event after explicit fixture-only lock removal (68.049078ms)
✔ writer refuses mixed at/read_at forms atomically, even through trusted SQL helpers (15.128136ms)
✔ async transactions refuse before invoking their function (12.418567ms)
✔ the session default fits under the reply cap and pages to the end with next (183.825673ms)
✔ the short form: no description, assignees by role, every listed key (80.168705ms)
✔ each filter, alone and together, and total counts every match (141.219198ms)
✔ task_ref reads one task in full, as the whole board has it (84.642667ms)
✔ no arguments is the read the Console and mosaic make, unchanged (68.563479ms)
✔ an unknown argument or a bad value refuses invalid-request (294.097527ms)
✔ tasks rows carry priority and requirement for every session that reads tasks (43.407421ms)
✔ the read model rebuilds from the ledger: a reopened bus and each trail give the same values (62.433439ms)
✔ an empty business and one with snapshots but no task.created read cleanly (14.369535ms)
✔ recordTask keeps sync reads and a role write apart (32.26515ms)
✔ read_at must be one canonical UTC format, so the projection compares strings safely (12.696825ms)
✔ a bad entry refuses the whole record (13.628177ms)
✔ taskView reads the projection for one business (15.483792ms)
✔ requestTask hands only a holder and a task verb to the handler, and records refusals (26.436019ms)
✔ the server sends task verbs to the adapter with its own timeout; other verbs stay synchronous (274.60029ms)
✔ without an adapter the server refuses every task verb (15.951382ms)
✔ the runtime refuses an invalid adapter and closes a valid one (16.061298ms)
✔ the process loads the S3 adapter from plain-data trackers (110.349504ms)
✔ the tester binds only when the business sets bus.tester to exactly true (85.319309ms)
✔ a business may not name a role tester, so the tester address is never a role (21.672202ms)
✔ every verb outside the tester list refuses tester-refused and is recorded against the tester (41.550165ms)
✔ a tester message is from tester, starts [mos test], and writes no human.input or authority (14.677238ms)
✔ a role answers a tester only in reply to a tester message, and the answer never reaches the human (19.111774ms)
✔ the tester reads the human views a reader reads (17.669226ms)
✔ tester proof binds its own CLI, start time and nonce, refuses a managed run and allows an agent (1.115686ms)
✔ neither CLI's nonce proves the other: each proof is bound to its own CLI and nonce variable (0.338816ms)
✔ testerNonce reads only the tester's variable and gives null on any read error (0.200203ms)
✔ an envelope carries exactly one of cap, human and tester; no tester authenticator refuses (15.828675ms)
✔ tester-cli.mjs binds through the runtime when the switch is on, and refuses off or under a run marker (611.345286ms)
✔ socket capability stamps launch identity; shared views use wire, no SQL client (30.467276ms)
✔ two wire claims serialize; a lost reply never automatically retries (22.042361ms)
✔ malformed, oversized and identity-forging envelopes refuse without echoing input (12.891822ms)
✔ client preserves UTF-8 when a response divides a multibyte character (10.518262ms)
✔ committed mutation followed by dropped reply reports unknown and is never retried (13.405659ms)
ℹ tests 171
ℹ suites 0
ℹ pass 165
ℹ pass 171
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 1403.780689
ℹ duration_ms 1239.892038
agents/researcher/work/queue-120/suites/business.txt
+91 -83
View File
@@ -1,88 +1,96 @@
✔ the role file loads and resolves through loadBusiness (9.018074ms)
✔ the shipped file is exactly the approved list (1.075329ms)
✔ the assistant's authority is message.send within role and nothing else (2.582336ms)
✔ the assistant talks to the user and the chief of staff only, and no other shipped role is limited (1.138324ms)
✔ a business grant through limits does not widen the role (2.224994ms)
✔ a launch block whose by is the assistant is refused (2.321146ms)
✔ the instance takes no credential references and no tracker (3.91734ms)
✔ the contract passes work to the chief of staff and directs no one (0.780767ms)
✔ config directory and file path follow MOSAIC_CONFIG (2.290712ms)
✔ the fixture business validates and comes back frozen (6.287203ms)
✔ two instances may share a definition (2.117529ms)
✔ top-level refusals (6.141234ms)
✔ arbiters and projects (9.692522ms)
✔ role instances (3.752044ms)
✔ Vikunja bots (10.352519ms)
✔ a role without Vikunja takes no tracker block (2.567228ms)
✔ credential references match the definition's services (2.923626ms)
✔ launch (8.773364ms)
✔ loadBusiness: file checks (2.084699ms)
✔ loadBusiness: not a regular file (42.426391ms)
✔ loading writes nothing (1.317938ms)
✔ names that are Object.prototype properties don't count as declared (3.023732ms)
✔ the shipped example refuses as written and validates once filled in (0.744414ms)
✔ the role file loads and resolves through loadBusiness (7.181072ms)
✔ the shipped file is exactly the approved list (0.216983ms)
✔ the resolved record matches the approved list, so a widened file fails (1.698263ms)
✔ the chief of staff holds role.launch and message.send; every other action is gated (1.612438ms)
✔ the pm does not hold role.launch (1.67743ms)
✔ a business grant of a gated action through limits does not widen the role (1.941551ms)
✔ a limit that drops role.launch leaves the chief of staff with no launch block (2.074753ms)
✔ a launch block whose by is the pm instance is refused (2.636124ms)
✔ the contract names no duty to talk to the human and the pm contract no launch (0.471693ms)
✔ the instance takes no credential references and no tracker (2.76813ms)
✔ usage errors exit 4 (288.285205ms)
✔ validate: a good business exits 0 and prints instance digests (72.349868ms)
✔ validate: project files (349.295627ms)
✔ validate: missing files and a broken system config (246.13448ms)
✔ validate: credential reference problems exit 2 and name each one (65.704383ms)
✔ validate: a token file inside the repository is refused (65.162002ms)
✔ validate: role definitions come from MOSAIC_ROLES_DIR (192.946962ms)
✔ resolve: prints one instance's record (267.766922ms)
✔ resolve: refusals (390.370732ms)
✔ parse: exactly one of file or env, plus the service's date (3.901125ms)
✔ check: a good file has no problems (1.835461ms)
✔ check never opens the file: a write-only token passes (0.561639ms)
✔ check: file problems (1.650812ms)
✔ check: token files can't live in the repository or dataRoot, even through a linked directory (1.471809ms)
✔ check: dates and environment references (0.690788ms)
✔ path and load (3.024475ms)
✔ refusals (1.783692ms)
✔ systemVars flattens the validated config (2.504468ms)
✔ precedence: system, business, project, project role, agent (6.682658ms)
✔ limits narrow the definition and never widen it (3.523077ms)
✔ role.launch stays within-role only for the instance the launch block names (8.403471ms)
✔ limits.authority without role.launch leaves the launcher with no launch block (2.445734ms)
✔ limits.authority narrows cross-role actions too (1.40432ms)
✔ classify (1.255286ms)
✔ the record carries what the broker and launcher need (1.173596ms)
✔ digest: key order doesn't matter, any value change does (7.56278ms)
✔ refusals (2.551652ms)
✔ the four shipped version 2 roles load (4.300439ms)
✔ shipped role scopes match addendum B section 2 and the SR runbook (1.313518ms)
✔ shipped authority follows the note's table (0.816291ms)
✔ every role file in roles/ loads through the validator, and a v2 contract exists (0.945573ms)
✔ version 1 files keep loading with no authority (1.238984ms)
✔ the conductor policy isn't a role (0.205618ms)
✔ a missing role file is exit 4, a symbolic link too (0.47218ms)
✔ version 2 refusals (1.391278ms)
✔ authority: closed vocabulary, no gated-only action, no overlap (2.315443ms)
✔ messaging: optional, role definitions and human, never the tester (1.602377ms)
✔ credentials: Gitea scopes (0.790311ms)
✔ credentials: Vikunja scopes are a group-to-verbs map from the grantable list (1.475666ms)
✔ credentials: services (0.794478ms)
✔ contract: a non-empty regular Markdown file beside the role file (0.720032ms)
✔ every key names known layers and a merge rule (1.201689ms)
✔ unknown keys and wrong layers refuse (1.052112ms)
✔ types (2.473527ms)
✔ merge: defaults, then the most specific layer wins (0.427686ms)
✔ merge: limits only narrow, and provenance lists each source (0.569149ms)
✔ merge doesn't change its inputs (0.263011ms)
ℹ tests 80
✔ the role file loads and resolves through loadBusiness (4.839701ms)
✔ the shipped file is exactly the approved list (0.74432ms)
✔ the assistant's authority is message.send within role and nothing else (1.763387ms)
✔ the assistant talks to the user and the chief of staff only, and no other shipped role is limited (0.540276ms)
✔ a business grant through limits does not widen the role (1.543799ms)
✔ a launch block whose by is the assistant is refused (1.914491ms)
✔ the instance takes no credential references and no tracker (3.033926ms)
✔ the contract passes work to the chief of staff and directs no one (0.673197ms)
✔ config directory and file path follow MOSAIC_CONFIG (1.245609ms)
✔ the fixture business validates and comes back frozen (3.680605ms)
✔ two instances may share a definition (1.438602ms)
✔ top-level refusals (3.494236ms)
✔ arbiters and projects (5.63428ms)
✔ role instances (3.383333ms)
✔ Vikunja bots (8.985505ms)
✔ a role without Vikunja takes no tracker block (3.189678ms)
✔ credential references match the definition's services (3.636892ms)
✔ launch (10.970991ms)
✔ loadBusiness: file checks (2.348033ms)
✔ loadBusiness: not a regular file (37.879114ms)
✔ loading writes nothing (1.000118ms)
✔ names that are Object.prototype properties don't count as declared (2.615018ms)
✔ the shipped example refuses as written and validates once filled in (0.898654ms)
✔ the role file loads and resolves through loadBusiness (7.539071ms)
✔ the shipped file is exactly the approved list (0.261377ms)
✔ the resolved record matches the approved list, so a widened file fails (2.04923ms)
✔ the chief of staff holds role.launch and message.send; every other action is gated (1.798278ms)
✔ the pm does not hold role.launch (1.910659ms)
✔ a business grant of a gated action through limits does not widen the role (1.862538ms)
✔ a limit that drops role.launch leaves the chief of staff with no launch block (1.469008ms)
✔ a launch block whose by is the pm instance is refused (1.913034ms)
✔ the contract names no duty to talk to the human and the pm contract no launch (0.448979ms)
✔ the instance takes no credential references and no tracker (2.173603ms)
✔ usage errors exit 4 (287.971918ms)
✔ validate: a good business exits 0 and prints instance digests (61.170224ms)
✔ validate: project files (305.841365ms)
✔ validate: missing files and a broken system config (240.151983ms)
✔ validate: credential reference problems exit 2 and name each one (61.496325ms)
✔ validate: a token file inside the repository is refused (63.040676ms)
✔ validate: role definitions come from MOSAIC_ROLES_DIR (182.28775ms)
✔ resolve: prints one instance's record (254.564879ms)
✔ resolve: refusals (358.099738ms)
✔ parse: exactly one of file or env, plus the service's date (2.30941ms)
✔ check: a good file has no problems (0.752086ms)
✔ check never opens the file: a write-only token passes (0.379958ms)
✔ check: file problems (0.771694ms)
✔ check: token files can't live in the repository or dataRoot, even through a linked directory (0.785471ms)
✔ check: dates and environment references (0.38758ms)
✔ REQ-LIMIT-1 schema: every scope unset or zero, adjustable above four, bad values and unknown models refuse (12.600881ms)
✔ REQ-LIMIT-1 counts each exact scope at/over limit, unlimited and old tuple after model reassignment (0.826537ms)
✔ REQ-ROLE-3 writer: atomic validated revision, immutable previous bytes and authenticated actor/old/new receipt (22.288997ms)
✔ REQ-ROLE-3 writer: pre-rename fault leaves old file, post-rename recovery records commit, conflicting recovery refuses (12.419052ms)
✔ REQ-LIMIT-1 / decision145 migration prints only, preserves values, rejects ambiguity, and is idempotent (3.182069ms)
✔ REQ-LIMIT-1 shared settings validates the complete proposed selection and logs exact actor (15.773865ms)
✔ REQ-LIMIT-1 provider is table data: another provider routes separately and aliases share exact counts (1.724633ms)
✔ REQ-ROLE-3 refuses live writer locks, symlink targets and uncertain recovery without changing bytes (9.095975ms)
✔ path and load (2.644116ms)
✔ refusals (1.255024ms)
✔ systemVars flattens the validated config (2.478387ms)
✔ precedence: system, business, project, project role, agent (6.6717ms)
✔ limits narrow the definition and never widen it (3.007382ms)
✔ role.launch stays within-role only for the instance the launch block names (6.349452ms)
✔ limits.authority without role.launch leaves the launcher with no launch block (2.000877ms)
✔ limits.authority narrows cross-role actions too (1.659176ms)
✔ classify (1.148347ms)
✔ the record carries what the broker and launcher need (1.112337ms)
✔ digest: key order doesn't matter, any value change does (7.458042ms)
✔ refusals (2.471322ms)
✔ the four shipped version 2 roles load (3.940803ms)
✔ shipped role scopes match addendum B section 2 and the SR runbook (1.257907ms)
✔ shipped authority follows the note's table (0.684195ms)
✔ every role file in roles/ loads through the validator, and a v2 contract exists (0.613977ms)
✔ version 1 files keep loading with no authority (0.926209ms)
✔ the conductor policy isn't a role (0.171975ms)
✔ a missing role file is exit 4, a symbolic link too (0.336464ms)
✔ version 2 refusals (1.120876ms)
✔ authority: closed vocabulary, no gated-only action, no overlap (3.411446ms)
✔ messaging: optional, role definitions and human, never the tester (1.425993ms)
✔ credentials: Gitea scopes (1.51578ms)
✔ credentials: Vikunja scopes are a group-to-verbs map from the grantable list (1.137129ms)
✔ credentials: services (0.512374ms)
✔ contract: a non-empty regular Markdown file beside the role file (0.680411ms)
✔ every key names known layers and a merge rule (0.744926ms)
✔ unknown keys and wrong layers refuse (0.634188ms)
✔ types (1.634514ms)
✔ merge: defaults, then the most specific layer wins (0.239938ms)
✔ merge: limits only narrow, and provenance lists each source (0.307461ms)
✔ merge doesn't change its inputs (0.121813ms)
ℹ tests 88
ℹ suites 0
ℹ pass 80
ℹ pass 88
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 2020.969416
ℹ duration_ms 1875.31794
agents/researcher/work/queue-120/suites/cli.txt
+198 -194
View File
@@ -1,201 +1,205 @@
✔ every screen and overlay fits 120x36, 80x24 and the narrow layout, row for row (2116.411917ms)
✔ width counts terminal cells: wide CJK and emoji 2, U+FE0F after a one-cell base 1, marks 0 (125.041866ms)
✔ broker text is shown, never interpreted: no raw control character or bidi override reaches the terminal (260.670531ms)
✔ NO_COLOR: no escape codes, except reverse video on the selected row (393.684622ms)
✔ 1-9 shows the decide flow's own lines and question; only y resolves (83.046938ms)
✔ the app shows the same decide text as mosaic decide (29.459716ms)
✔ any key but y or Y at the question answers No; nothing is sent (286.245324ms)
✔ below 40x10 the question is hidden, so every key answers it No, y included (Filbert R3) (110.741056ms)
✔ under 40 columns a tall terminal shows the too-small screen even where the decide box would fit; y sends nothing (Filbert N10) (455.440909ms)
✔ a hidden decide box names the way out, and the status line under it does not promise y (Filbert N12) (57.536474ms)
✔ a throw while answering the question goes to crash, sends nothing and leaves no job pending (32.781937ms)
✔ type-ahead never answers the question: a paste, keys typed before it is drawn, keys inside askMs (478.172212ms)
✔ quitting at the question answers No and sends nothing, armed or not (63.769302ms)
✔ a timer tick reads nothing under an overlay, never answers the question, and keeps a resolved status (75.355971ms)
✔ a long question is cut inside the question; the action, target, choice and prompt stay (Dewey B1) (86.605575ms)
✔ a decide box too big for the terminal says so, and every key answers it No, y included (Dewey B1, round 3) (431.114966ms)
✔ at every size the decide box shows each line y depends on, or says it is hidden (9884.060969ms)
✔ outcome unknown: the CLI's sentence, no retry, then the trail or a re-read (68.033548ms)
✔ refused and failed reads keep the last list, marked stale; a refused decide says refused (30.703387ms)
✔ help or a detail box cut to fit keeps its last line, Esc included (Dewey) (16.461242ms)
✔ keys: views, moving, trail of a selection, the command line, help and quit (75.540115ms)
✔ one option: the status line says Press 1, not 1-1 (19.712525ms)
✔ no business: the app says so and :business picks one (9.418059ms)
✔ mosaic with no argument: exit 3 in an agent run, exit 4 with the usage off a terminal, the app on one (1.875933ms)
✔ scripts/mosaic with no argument reaches the app entry; the seat usage it printed before has not drifted (177.927723ms)
✔ strings to keep exactly live once, in the decide flow and the transport; the app does not restate them (0.504322ms)
✔ decide with --note still asks; a No sends nothing (10.204586ms)
✔ the app's business comes from a live bus host only (1.196595ms)
✔ runApp leaves the terminal as it found it on q, end of input, SIGTERM, SIGINT, SIGHUP and an error, the first frame's included (7.275953ms)
✔ draw is pure: same state, same frame (0.860564ms)
✔ inbox lists only decisions routed to the human, with what approving authorizes and how to decide (39.005329ms)
✔ decide resolves by id prefix with --yes, and the trail shows it in broker order with the task to follow (30.307267ms)
✔ decide refuses without a terminal or --yes, on an unknown option and on a short reference (22.670088ms)
✔ decide prints a declining choice as declining (19.988508ms)
✔ an unknown outcome is reported once and never resent (22.848019ms)
✔ a decision closed before the answer arrives exits 2 and points at its trail (19.489389ms)
✔ a prefix that matches two open decisions exits 2 and resolves neither (19.341497ms)
✔ without --business a command uses the live host's business, and a stale host.json is not a host (15.584132ms)
✔ every human command refuses inside an agent run before it touches the bus (15.904131ms)
✔ usage errors exit 4; no business and no host is a usage error (16.156684ms)
✔ agents and tasks print through the broker (15.959341ms)
✔ notify.json: missing, loose, malformed and extra keys refuse; a binding or null passes (2.570445ms)
✔ bootConfig builds the broker's boot message for one business, with no trackers key when no project names one (80.201337ms)
✔ trackers come from the tracker.* variables of the one project that names a tracker project (132.03746ms)
✔ with two projects, the one that sets tracker.project supplies the tracker and the other is no conflict (54.997926ms)
✔ two projects that each name a tracker project refuse, since the boot shape holds one (51.258077ms)
✔ a business without tracker.baseUrl gets no trackers entry (62.568593ms)
✔ an unknown business and a broken system config refuse with exit 3 (78.02683ms)
✔ follow prints an unsolicited message after plain talk returned (53.816156ms)
✔ talk --follow continues after reply and prints a later unsolicited message (44.004268ms)
✔ inbox lists all unread human messages under decisions, does not deliver or read them (355.994745ms)
✔ follow refuses agent context and bad arguments (10.262534ms)
✔ follow Ctrl-C wakes the poll sleep and removes its handler; transport errors also clean up (13.468838ms)
✔ plain talk leaves the process SIGINT handlers unchanged (12.145606ms)
✔ empty views say so (1.155634ms)
✔ the trail keeps the broker's order and names a decision's task without its rows (1.463924ms)
✔ tasks print the tracker fields the snapshot carries (0.246609ms)
✔ the review loop: the coder pushes and asks, the reviewer fetches and approves, and the task's trail holds each step (570.496326ms)
✔ refusals: no action, non-fast-forward, an unknown commit or request, and a push for another task moves only that task's ref (401.023112ms)
✔ the size cap refuses a push before any byte (297.302987ms)
✔ a fetch over the cap refuses before any byte reaches the reviewer (544.912812ms)
✔ the socket refuses a request with no capability, an unknown one, and a bad request line (237.782023ms)
✔ a rigged clone runs nothing: hooks, fsmonitor, a filter, a gitlink and a symlinked .git/config leave no marker (441.642002ms)
✔ an identity with no role, or of another business, refuses not-a-role and moves no ref (304.113419ms)
✔ a review of a project the business no longer has refuses unknown-project (304.422315ms)
✔ past maxActive connections the socket refuses git-busy, and a hung-up connection frees its slot (187.072605ms)
✔ close() answers host-closing to a connection still sending its request line (214.672439ms)
✔ a bundle that trickles in refuses body-timeout at its deadline and frees its slot (656.543337ms)
✔ a reviewer gone before its bundle was sent is filed fetch-aborted, not as the host's fault (663.683325ms)
✔ a reviewer that hangs up the moment it has the whole bundle was served, not aborted (673.620838ms)
✔ send: a close after every byte left is served; one that fails a queued write is fetch-aborted (43.315798ms)
✔ a bundle with no bytes for bodyIdle refuses body-timeout long before its deadline (484.624556ms)
✔ send: a close once the loop is past its last chunk is served, and a failed write there is fetch-aborted (45.361863ms)
✔ letGo waits for an answer to leave for at most its cap, then destroys the socket (301.296985ms)
✔ a record that fails and can't be undone refuses rollback-failed, which the host logs (374.693898ms)
✔ the host boots the broker, binds a launch in process, and the notifier DMs a blocking decision exactly once (983.91634ms)
✔ a notifier that dies takes the host down with exit 1, so the unit restarts the pair (266.381755ms)
✔ a second host for the same data root refuses with exit 3 while the first runs (156.832536ms)
✔ two bus starts racing for one data root leave one host running; the other refuses that a host already runs (666.402491ms)
✔ a host takes over a host.lock its dead host left, and puts back a live claim that replaced it meanwhile (2.635772ms)
✔ a host.lock that goes between the check and the read is tried again; one that can't be parsed still refuses as unreadable (1.645445ms)
✔ a live host's lock stays, however old the file is (0.967894ms)
✔ a host.lock left by a host killed with SIGKILL doesn't stop the next bus start (989.338016ms)
✔ while a host boots, a reader sees no host: the human commands still ask for --business, stop and status find none (322.474013ms)
✔ a host started before host.lock existed, holding only host.json, still refuses a second start, which leaves no lock (50.78441ms)
✔ a broker fork that throws leaves no host.lock and no host.json (47.437672ms)
✔ a broker send that throws leaves no host.lock and no host.json (64.733604ms)
✔ a broker that misses its boot wait leaves no host.lock and no host.json (75.996801ms)
✔ a notifier fork that throws stops the broker and leaves no host.lock and no host.json (128.935076ms)
✔ a notifier send that throws stops the broker and leaves no host.lock and no host.json (128.361029ms)
✔ a boot reply with no reader for the business refuses with exit 3 naming it, before the notifier starts, and leaves no host.lock and no live broker (116.81384ms)
✔ a boot reply with no reader for the business refuses with exit 3 naming it, with no notifier, and leaves no host.lock and no live broker (125.106622ms)
✔ a host.json that can't be written stops both children and leaves no host.lock (328.099308ms)
✔ an error event on the broker before it replies fails the start at once, and leaves no host.lock and no live child (66.58687ms)
✔ an error event on the notifier before it replies fails the start at once, and leaves no host.lock and no live child (147.13617ms)
✔ an error event on the broker while the notifier starts fails the start once the notifier replies (250.46078ms)
✔ an error event on the broker once the host is up stops the host with exit 1, and leaves no host.lock and no host.json (264.447458ms)
✔ an error event on the notifier once the host is up stops the host with exit 1, and leaves no host.lock and no host.json (261.248466ms)
✔ a broker reply that misses the wait breaks the channel: the late reply answers nothing, later requests refuse, the host exits 1 (1117.621663ms)
✔ a broker reply with another request's id, or none, breaks the channel and the host exits 1 (185.809604ms)
✔ a broker reply with no request waiting breaks the channel and the host exits 1 (91.788126ms)
✔ a notifier that refuses stops the broker and the host refuses with exit 3 (165.133814ms)
✔ a notifier that refuses after the broker died still refuses with exit 3, without a send to the dead broker (167.407504ms)
✔ a notifier that dies before it replies, after the broker died, still refuses, without a send to the dead broker (95.358177ms)
✔ a close send that fails with EPIPE after the notifier refuses still gives the notifier's refusal, exit 3 (153.511536ms)
✔ a close send that fails with EPIPE after the notifier dies unanswered still gives the notifier's error (109.914511ms)
✔ close() whose stop and close sends fail with EPIPE still finishes, with exit 1 (189.602837ms)
✔ watchChildren reports a child that died before it was called, and one that dies later (27.531598ms)
✔ bus stop refuses to signal a live pid that is not a bus host (203.401817ms)
✔ bus start refuses with exit 3 and the code when the broker refuses to boot; bus status names the lock (288.573632ms)
✔ bus start refuses with exit 3 without a notifier config (131.367558ms)
✔ bus start runs until bus stop; status reports it while it runs (756.806ms)
✔ bus-service.sh renders the unit and installs it into a given directory (69.346682ms)
✔ bus-service.sh pins the claude binary, refuses one the unit can't carry, and renders without one (87.59192ms)
✔ bus-service.sh refuses a directory pin and keeps a symlink default unresolved (17.676233ms)
✔ bus-service.sh refuses a default claude without the execute bit, or in a PATH dir with a space (11.588406ms)
✔ bus start --pm: the launcher instance (the chief of staff) runs under its own PID namespace, registered, with a manifest (1319.321052ms)
✔ the chief of staff launches a coder through its launch tool; the coder answers; refusals name their code (643.207922ms)
✔ each launch makes sure the workspace has a clone of the project: cloned, fast-forwarded, or fetched and logged (3793.868669ms)
✔ a project clone that can't be made refuses checkout-failed, from --chief and from a session, with no run and no clone left (132.059ms)
✔ a runner that stops at once ends its launch with the runner's reason (207.561032ms)
✔ a Claude Code launch with no session credential refuses before it starts (139.033826ms)
✔ a pi launch needs no session credential: pi logs in through its own ENV_ALLOW variables (221.645576ms)
✔ a runner killed from the host ends its launch as killed, not failed (252.541668ms)
✔ a missing or failing bwrap refuses sandbox-unavailable before anything starts; there is no unconfined fallback (115.191945ms)
✔ a real Claude Code coder's shell can't read a stand-in secret or anything else its sandbox doesn't hold (1324.444421ms)
✔ a host that died hard leaves its sessions to the next host, which kills them and ends their runs so the role can be launched again (667.81756ms)
✔ a host that died hard leaves its sessions to the next host, which finds one already exited (23) and ends their runs so the role can be launched again (3615.885662ms)
✔ a malformed sessions.json refuses the host start with exit 3 and stays as it was (88.802705ms)
✔ an over-long launch request is refused at once, not at the 10 s idle timeout (97.747241ms)
✔ a launch client that never closes its side doesn't hold the host's close (103.27127ms)
✔ a runner that ignores SIGTERM is killed when the host closes (1222.972891ms)
✔ claudeVersion asks MOSAIC_CLAUDE_BIN when set, else claude on PATH (5.187645ms)
✔ zoned uses the IANA zone across DST (27.702014ms)
✔ each open blocking decision is DM'd once, across polls and a restart; non-blocking ones are not (51.868019ms)
✔ two blocking decisions get two DMs with different nonces (23.618183ms)
✔ the digest nonce differs per business and per day and fits Discord's 25 characters (0.551569ms)
✔ a failed DM is journaled, backs off, and is retried until it lands (27.017461ms)
✔ five definite refusals stop a DM: one gave-up line, one log line, and a restart keeps the count (29.717272ms)
✔ 429s, 5xx-style unknowns and refusals without a status never count toward the limit (29.275162ms)
✔ a crash between the fifth refusal and its gave-up line: the next poll appends it and sends nothing (20.721551ms)
✔ polled every POLL_MS against a permanent 403, a DM is sent at 0, 30, 60, 90 and 120 min and gives up only then (146.29667ms)
✔ a restart after the second refusal does not send before that refusal's 30 min are up (55.706245ms)
✔ the digest goes at 08:00 Chicago once a day, with blocking ones marked as DM'd (15.153107ms)
✔ a late start with no digest for the day sends one at once; an empty inbox gets one line (11.632718ms)
✔ an inbox read failure is logged and the next poll retries (0.96808ms)
✔ no Discord id reaches the journal or the log (12.009976ms)
✔ the journal: a torn tail is copied out and truncated, so an append after it reopens cleanly (3.390838ms)
✔ the journal: a crash between the copy and the truncate leaves a tail the next open repairs (3.034848ms)
✔ the journal: a whole file that is one torn line truncates to empty (1.590129ms)
✔ the journal: a malformed complete line refuses and leaves the file and any torn tail alone (0.695344ms)
✔ the journal: a loose file mode, a loose directory or a symlinked journal refuses (0.711994ms)
✔ the journal: a line with a wrong type refuses with exit 3 and names the field (2.613363ms)
✔ the journal: a symlinked directory refuses and says it is a link (0.393952ms)
✔ the journal: a dangling directory link, a parent that is a file and a journal that is a directory each refuse with exit 3 (2.292983ms)
✔ the journal: an append after the file was swapped for a symlink refuses and writes nothing through it (0.578418ms)
✔ the journal: a directory it cannot write or create refuses with exit 3 and names the path (0.617417ms)
✔ digest content stays within Discord's 2000 characters (0.351395ms)
✔ runLoop never overlaps ticks and stops after the one in flight (110.388253ms)
✔ a human command refused with human-required prints the other-tree line and exits 3 (3.735127ms)
✔ a --tester command refused with tester-required prints the other-tree line and exits 3 (1.87476ms)
✔ other exit-3 refusals print no other-tree line (2.284622ms)
✔ the line names no path (0.2046ms)
✔ shared copy: npm ci, pushed reachability, readonly/existing copy, webui delegation (788.013264ms)
✔ wrapper preserves Q81 lease and marker, rejects foreign/symlink; check uses effective roots (682.506446ms)
✔ bus unit copy/pm pins, install refuses all busy states and failed reads, drop-in refusal (697.84633ms)
✔ missing package manifest refuses before npm; npm failure removes the unpublished temp copy (411.97049ms)
✔ real pinned install loads bus and Console; same-copy mosaic talk passes proof, other trees refuse (4613.202521ms)
✔ bus status reads effective copy/pm/drop-ins without writes; check refuses an overridden ExecStart (598.712143ms)
✔ drop-ins in either override field and malformed metadata refuse; uninstall also checks --no-reload (174.897206ms)
✔ install never shows a template name on systemd 261; template drop-ins still refuse (186.717041ms)
✔ unlisted instance drop-in is found in another unit lookup directory; path discovery errors refuse (165.047911ms)
✔ inherited mosaic-.service.d override refuses without changing the unit (199.519586ms)
✔ inherited service.d override refuses without changing the unit (203.415349ms)
✔ inherited drop-in unreadable directory or file refuses before writing (150.440788ms)
✔ talk --tester sends a [mos test] message as tester from inside an agent and prints the role's reply (39.682822ms)
✔ talk --tester refuses text without the [mos test] prefix before any call (18.182238ms)
✔ the read verbs take --tester inside an agent, and the trail shows the tester as the sender (27.528075ms)
✔ decide, stop and launches take no --tester (19.49056ms)
✔ the tester transport runs tester-cli.mjs, and the tester's refusals exit 3 (0.555408ms)
✔ with no stand-in transport, --tester runs tester-cli.mjs on the data root's socket (1.029717ms)
✔ every screen and overlay fits 120x36, 80x24 and the narrow layout, row for row (1775.739531ms)
✔ width counts terminal cells: wide CJK and emoji 2, U+FE0F after a one-cell base 1, marks 0 (96.29175ms)
✔ broker text is shown, never interpreted: no raw control character or bidi override reaches the terminal (257.201968ms)
✔ NO_COLOR: no escape codes, except reverse video on the selected row (347.78978ms)
✔ 1-9 shows the decide flow's own lines and question; only y resolves (72.601829ms)
✔ the app shows the same decide text as mosaic decide (29.623662ms)
✔ any key but y or Y at the question answers No; nothing is sent (226.509488ms)
✔ below 40x10 the question is hidden, so every key answers it No, y included (Filbert R3) (63.625438ms)
✔ under 40 columns a tall terminal shows the too-small screen even where the decide box would fit; y sends nothing (Filbert N10) (275.755838ms)
✔ a hidden decide box names the way out, and the status line under it does not promise y (Filbert N12) (32.766011ms)
✔ a throw while answering the question goes to crash, sends nothing and leaves no job pending (22.432327ms)
✔ type-ahead never answers the question: a paste, keys typed before it is drawn, keys inside askMs (402.540486ms)
✔ quitting at the question answers No and sends nothing, armed or not (49.003394ms)
✔ a timer tick reads nothing under an overlay, never answers the question, and keeps a resolved status (37.307301ms)
✔ a long question is cut inside the question; the action, target, choice and prompt stay (Dewey B1) (52.069533ms)
✔ a decide box too big for the terminal says so, and every key answers it No, y included (Dewey B1, round 3) (346.702933ms)
✔ at every size the decide box shows each line y depends on, or says it is hidden (8263.002089ms)
✔ outcome unknown: the CLI's sentence, no retry, then the trail or a re-read (63.267618ms)
✔ refused and failed reads keep the last list, marked stale; a refused decide says refused (31.193913ms)
✔ help or a detail box cut to fit keeps its last line, Esc included (Dewey) (15.247589ms)
✔ keys: views, moving, trail of a selection, the command line, help and quit (74.038859ms)
✔ one option: the status line says Press 1, not 1-1 (15.196636ms)
✔ no business: the app says so and :business picks one (7.884298ms)
✔ mosaic with no argument: exit 3 in an agent run, exit 4 with the usage off a terminal, the app on one (1.721797ms)
✔ scripts/mosaic with no argument reaches the app entry; the seat usage it printed before has not drifted (169.344685ms)
✔ strings to keep exactly live once, in the decide flow and the transport; the app does not restate them (0.445313ms)
✔ decide with --note still asks; a No sends nothing (9.643331ms)
✔ the app's business comes from a live bus host only (0.97225ms)
✔ runApp leaves the terminal as it found it on q, end of input, SIGTERM, SIGINT, SIGHUP and an error, the first frame's included (6.650341ms)
✔ draw is pure: same state, same frame (0.713152ms)
✔ inbox lists only decisions routed to the human, with what approving authorizes and how to decide (34.029325ms)
✔ decide resolves by id prefix with --yes, and the trail shows it in broker order with the task to follow (35.663636ms)
✔ decide refuses without a terminal or --yes, on an unknown option and on a short reference (35.471991ms)
✔ decide prints a declining choice as declining (27.537735ms)
✔ an unknown outcome is reported once and never resent (26.996404ms)
✔ a decision closed before the answer arrives exits 2 and points at its trail (49.482601ms)
✔ a prefix that matches two open decisions exits 2 and resolves neither (67.168157ms)
✔ without --business a command uses the live host's business, and a stale host.json is not a host (33.364615ms)
✔ every human command refuses inside an agent run before it touches the bus (14.219215ms)
✔ usage errors exit 4; no business and no host is a usage error (18.953873ms)
✔ agents and tasks print through the broker (18.581997ms)
✔ notify.json: missing, loose, malformed and extra keys refuse; a binding or null passes (2.416313ms)
✔ bootConfig builds the broker's boot message for one business, with no trackers key when no project names one (77.00268ms)
✔ trackers come from the tracker.* variables of the one project that names a tracker project (132.480751ms)
✔ with two projects, the one that sets tracker.project supplies the tracker and the other is no conflict (79.082283ms)
✔ two projects that each name a tracker project refuse, since the boot shape holds one (102.017946ms)
✔ a business without tracker.baseUrl gets no trackers entry (61.142643ms)
✔ an unknown business and a broken system config refuse with exit 3 (98.544273ms)
✔ follow prints an unsolicited message after plain talk returned (54.040325ms)
✔ talk --follow continues after reply and prints a later unsolicited message (51.73873ms)
✔ inbox lists all unread human messages under decisions, does not deliver or read them (463.190038ms)
✔ follow refuses agent context and bad arguments (10.51728ms)
✔ follow Ctrl-C wakes the poll sleep and removes its handler; transport errors also clean up (9.970864ms)
✔ plain talk leaves the process SIGINT handlers unchanged (12.001001ms)
✔ empty views say so (1.166981ms)
✔ the trail keeps the broker's order and names a decision's task without its rows (1.429722ms)
✔ tasks print the tracker fields the snapshot carries (0.215257ms)
✔ the review loop: the coder pushes and asks, the reviewer fetches and approves, and the task's trail holds each step (662.555456ms)
✔ refusals: no action, non-fast-forward, an unknown commit or request, and a push for another task moves only that task's ref (371.137887ms)
✔ the size cap refuses a push before any byte (179.329452ms)
✔ a fetch over the cap refuses before any byte reaches the reviewer (401.685999ms)
✔ the socket refuses a request with no capability, an unknown one, and a bad request line (190.422201ms)
✔ a rigged clone runs nothing: hooks, fsmonitor, a filter, a gitlink and a symlinked .git/config leave no marker (353.677386ms)
✔ an identity with no role, or of another business, refuses not-a-role and moves no ref (296.33825ms)
✔ a review of a project the business no longer has refuses unknown-project (267.16814ms)
✔ past maxActive connections the socket refuses git-busy, and a hung-up connection frees its slot (139.957152ms)
✔ close() answers host-closing to a connection still sending its request line (131.5718ms)
✔ a bundle that trickles in refuses body-timeout at its deadline and frees its slot (547.342999ms)
✔ a reviewer gone before its bundle was sent is filed fetch-aborted, not as the host's fault (442.19503ms)
✔ a reviewer that hangs up the moment it has the whole bundle was served, not aborted (510.71722ms)
✔ send: a close after every byte left is served; one that fails a queued write is fetch-aborted (41.547104ms)
✔ a bundle with no bytes for bodyIdle refuses body-timeout long before its deadline (437.35879ms)
✔ send: a close once the loop is past its last chunk is served, and a failed write there is fetch-aborted (44.422664ms)
✔ letGo waits for an answer to leave for at most its cap, then destroys the socket (301.12308ms)
✔ a record that fails and can't be undone refuses rollback-failed, which the host logs (348.920229ms)
✔ the host boots the broker, binds a launch in process, and the notifier DMs a blocking decision exactly once (1054.015426ms)
✔ a notifier that dies takes the host down with exit 1, so the unit restarts the pair (188.880912ms)
✔ a second host for the same data root refuses with exit 3 while the first runs (120.517778ms)
✔ two bus starts racing for one data root leave one host running; the other refuses that a host already runs (579.968349ms)
✔ a host takes over a host.lock its dead host left, and puts back a live claim that replaced it meanwhile (1.668043ms)
✔ a host.lock that goes between the check and the read is tried again; one that can't be parsed still refuses as unreadable (1.112782ms)
✔ a live host's lock stays, however old the file is (0.652598ms)
✔ a host.lock left by a host killed with SIGKILL doesn't stop the next bus start (915.967837ms)
✔ while a host boots, a reader sees no host: the human commands still ask for --business, stop and status find none (199.752799ms)
✔ a host started before host.lock existed, holding only host.json, still refuses a second start, which leaves no lock (32.68608ms)
✔ a broker fork that throws leaves no host.lock and no host.json (34.574795ms)
✔ a broker send that throws leaves no host.lock and no host.json (38.454766ms)
✔ a broker that misses its boot wait leaves no host.lock and no host.json (29.307786ms)
✔ a notifier fork that throws stops the broker and leaves no host.lock and no host.json (82.621366ms)
✔ a notifier send that throws stops the broker and leaves no host.lock and no host.json (80.98448ms)
✔ a boot reply with no reader for the business refuses with exit 3 naming it, before the notifier starts, and leaves no host.lock and no live broker (85.367878ms)
✔ a boot reply with no reader for the business refuses with exit 3 naming it, with no notifier, and leaves no host.lock and no live broker (81.027373ms)
✔ a host.json that can't be written stops both children and leaves no host.lock (196.906037ms)
✔ an error event on the broker before it replies fails the start at once, and leaves no host.lock and no live child (36.761462ms)
✔ an error event on the notifier before it replies fails the start at once, and leaves no host.lock and no live child (95.079082ms)
✔ an error event on the broker while the notifier starts fails the start once the notifier replies (202.690197ms)
✔ an error event on the broker once the host is up stops the host with exit 1, and leaves no host.lock and no host.json (208.093115ms)
✔ an error event on the notifier once the host is up stops the host with exit 1, and leaves no host.lock and no host.json (204.104184ms)
✔ a broker reply that misses the wait breaks the channel: the late reply answers nothing, later requests refuse, the host exits 1 (1098.052407ms)
✔ a broker reply with another request's id, or none, breaks the channel and the host exits 1 (175.78119ms)
✔ a broker reply with no request waiting breaks the channel and the host exits 1 (96.542312ms)
✔ a notifier that refuses stops the broker and the host refuses with exit 3 (147.629258ms)
✔ a notifier that refuses after the broker died still refuses with exit 3, without a send to the dead broker (153.623395ms)
✔ a notifier that dies before it replies, after the broker died, still refuses, without a send to the dead broker (87.34362ms)
✔ a close send that fails with EPIPE after the notifier refuses still gives the notifier's refusal, exit 3 (139.187249ms)
✔ a close send that fails with EPIPE after the notifier dies unanswered still gives the notifier's error (84.850642ms)
✔ close() whose stop and close sends fail with EPIPE still finishes, with exit 1 (155.943596ms)
✔ watchChildren reports a child that died before it was called, and one that dies later (26.542536ms)
✔ bus stop refuses to signal a live pid that is not a bus host (203.163295ms)
✔ bus start refuses with exit 3 and the code when the broker refuses to boot; bus status names the lock (278.901117ms)
✔ bus start refuses with exit 3 without a notifier config (107.24069ms)
✔ bus start runs until bus stop; status reports it while it runs (735.863248ms)
✔ bus-service.sh renders the unit and installs it into a given directory (60.03843ms)
✔ bus-service.sh pins the claude binary, refuses one the unit can't carry, and renders without one (79.760254ms)
✔ bus-service.sh refuses a directory pin and keeps a symlink default unresolved (14.963983ms)
✔ bus-service.sh refuses a default claude without the execute bit, or in a PATH dir with a space (9.263272ms)
✔ each launch rereads limits and model selections; lowered limits keep sessions and log exact hit (55.01628ms)
✔ bus start --pm: the launcher instance (the chief of staff) runs under its own PID namespace, registered, with a manifest (1394.212085ms)
✔ the chief of staff launches a coder through its launch tool; the coder answers; refusals name their code (637.982257ms)
✔ each launch makes sure the workspace has a clone of the project: cloned, fast-forwarded, or fetched and logged (3635.225136ms)
✔ a project clone that can't be made refuses checkout-failed, from --chief and from a session, with no run and no clone left (140.74732ms)
✔ a runner that stops at once ends its launch with the runner's reason (212.878344ms)
✔ a Claude Code launch with no session credential refuses before it starts (104.005376ms)
✔ a pi launch needs no session credential: pi logs in through its own ENV_ALLOW variables (189.089502ms)
✔ a runner killed from the host ends its launch as killed, not failed (249.793094ms)
✔ a missing or failing bwrap refuses sandbox-unavailable before anything starts; there is no unconfined fallback (106.250183ms)
✔ a real Claude Code coder's shell can't read a stand-in secret or anything else its sandbox doesn't hold (1164.453364ms)
✔ a host that died hard leaves its sessions to the next host, which kills them and ends their runs so the role can be launched again (637.728481ms)
✔ a host that died hard leaves its sessions to the next host, which finds one already exited (23) and ends their runs so the role can be launched again (3572.61182ms)
✔ a malformed sessions.json refuses the host start with exit 3 and stays as it was (85.566988ms)
✔ an over-long launch request is refused at once, not at the 10 s idle timeout (88.838712ms)
✔ a launch client that never closes its side doesn't hold the host's close (94.114ms)
✔ a runner that ignores SIGTERM is killed when the host closes (1211.443294ms)
✔ claudeVersion asks MOSAIC_CLAUDE_BIN when set, else claude on PATH (4.283509ms)
✔ migration needs no bus/config, prints whole converted document, is idempotent and never writes (21.270704ms)
✔ limits view/set use the human bus transport and pass only the explicit patch (2.124387ms)
✔ post-119 example and Jason fixture migrate with checked inherited models; wrong or absent config refuses (382.155772ms)
✔ zoned uses the IANA zone across DST (25.772326ms)
✔ each open blocking decision is DM'd once, across polls and a restart; non-blocking ones are not (38.680231ms)
✔ two blocking decisions get two DMs with different nonces (31.508456ms)
✔ the digest nonce differs per business and per day and fits Discord's 25 characters (0.318443ms)
✔ a failed DM is journaled, backs off, and is retried until it lands (35.972211ms)
✔ five definite refusals stop a DM: one gave-up line, one log line, and a restart keeps the count (30.863035ms)
✔ 429s, 5xx-style unknowns and refusals without a status never count toward the limit (34.145824ms)
✔ a crash between the fifth refusal and its gave-up line: the next poll appends it and sends nothing (30.984498ms)
✔ polled every POLL_MS against a permanent 403, a DM is sent at 0, 30, 60, 90 and 120 min and gives up only then (193.928339ms)
✔ a restart after the second refusal does not send before that refusal's 30 min are up (61.585041ms)
✔ the digest goes at 08:00 Chicago once a day, with blocking ones marked as DM'd (19.943032ms)
✔ a late start with no digest for the day sends one at once; an empty inbox gets one line (10.710114ms)
✔ an inbox read failure is logged and the next poll retries (0.790602ms)
✔ no Discord id reaches the journal or the log (12.470073ms)
✔ the journal: a torn tail is copied out and truncated, so an append after it reopens cleanly (2.628135ms)
✔ the journal: a crash between the copy and the truncate leaves a tail the next open repairs (3.659202ms)
✔ the journal: a whole file that is one torn line truncates to empty (1.690805ms)
✔ the journal: a malformed complete line refuses and leaves the file and any torn tail alone (1.150759ms)
✔ the journal: a loose file mode, a loose directory or a symlinked journal refuses (0.964242ms)
✔ the journal: a line with a wrong type refuses with exit 3 and names the field (3.619151ms)
✔ the journal: a symlinked directory refuses and says it is a link (0.597938ms)
✔ the journal: a dangling directory link, a parent that is a file and a journal that is a directory each refuse with exit 3 (0.753208ms)
✔ the journal: an append after the file was swapped for a symlink refuses and writes nothing through it (0.476729ms)
✔ the journal: a directory it cannot write or create refuses with exit 3 and names the path (2.633713ms)
✔ digest content stays within Discord's 2000 characters (0.494119ms)
✔ runLoop never overlaps ticks and stops after the one in flight (110.656197ms)
✔ a human command refused with human-required prints the other-tree line and exits 3 (3.478107ms)
✔ a --tester command refused with tester-required prints the other-tree line and exits 3 (1.327265ms)
✔ other exit-3 refusals print no other-tree line (2.261486ms)
✔ the line names no path (0.178431ms)
✔ shared copy: npm ci, pushed reachability, readonly/existing copy, webui delegation (740.612412ms)
✔ wrapper preserves Q81 lease and marker, rejects foreign/symlink; check uses effective roots (494.834311ms)
✔ bus unit copy/pm pins, install refuses all busy states and failed reads, drop-in refusal (534.682375ms)
✔ missing package manifest refuses before npm; npm failure removes the unpublished temp copy (386.061556ms)
✔ real pinned install loads bus and Console; same-copy mosaic talk passes proof, other trees refuse (3413.785986ms)
✔ bus status reads effective copy/pm/drop-ins without writes; check refuses an overridden ExecStart (508.870196ms)
✔ drop-ins in either override field and malformed metadata refuse; uninstall also checks --no-reload (172.93144ms)
✔ install never shows a template name on systemd 261; template drop-ins still refuse (165.927909ms)
✔ unlisted instance drop-in is found in another unit lookup directory; path discovery errors refuse (151.591554ms)
✔ inherited mosaic-.service.d override refuses without changing the unit (176.866061ms)
✔ inherited service.d override refuses without changing the unit (186.965804ms)
✔ inherited drop-in unreadable directory or file refuses before writing (162.246952ms)
✔ talk --tester sends a [mos test] message as tester from inside an agent and prints the role's reply (38.279774ms)
✔ talk --tester refuses text without the [mos test] prefix before any call (21.896799ms)
✔ the read verbs take --tester inside an agent, and the trail shows the tester as the sender (34.946422ms)
✔ decide, stop and launches take no --tester (29.323538ms)
✔ the tester transport runs tester-cli.mjs, and the tester's refusals exit 3 (0.710714ms)
✔ with no stand-in transport, --tester runs tester-cli.mjs on the data root's socket (3.75491ms)
task.close {} answered: invalid-request; fake saw 18 requests, first GET /info 200, GET /projects/1 200, GET /projects/1/views 200
task.close on a missing task answered: task-not-found; it made GET /tasks/999 404
✔ bootConfig trackers reach the S3 adapter in the real broker child, which goes ready against a fake Vikunja (365.68751ms)
✔ the transport writes {business, verb, args} to the child and reads its JSON (60.374616ms)
✔ a bus code on stderr becomes the exit code; garbage and timeouts are outcome problems (2263.973176ms)
✔ busExit and refuseInsideAgent (0.964095ms)
✔ talk sends a REQUEST, prints and reads everything that arrives, and stops at the reply (63.564983ms)
✔ talk --wait 0 only sends; no reply within --wait exits 1 and says where it will show (1036.007604ms)
✔ a late reply the Console has listed still reaches the next talk (2041.249387ms)
✔ talk, stop and launches off/on refuse inside an agent run; bad arguments are usage errors (18.43057ms)
✔ launches off and on go to the broker and change the business's launch state (16.930524ms)
✔ launches list reads sessions.json and marks a stale entry; stop reports it and refuses a non-runner (16.00052ms)
ℹ tests 191
✔ bootConfig trackers reach the S3 adapter in the real broker child, which goes ready against a fake Vikunja (428.720566ms)
✔ the transport writes {business, verb, args} to the child and reads its JSON (56.535014ms)
✔ a bus code on stderr becomes the exit code; garbage and timeouts are outcome problems (2324.091033ms)
✔ busExit and refuseInsideAgent (0.741113ms)
✔ talk sends a REQUEST, prints and reads everything that arrives, and stops at the reply (86.875275ms)
✔ talk --wait 0 only sends; no reply within --wait exits 1 and says where it will show (1034.801506ms)
✔ a late reply the Console has listed still reaches the next talk (2027.42113ms)
✔ talk, stop and launches off/on refuse inside an agent run; bad arguments are usage errors (11.489506ms)
✔ launches off and on go to the broker and change the business's launch state (11.710619ms)
✔ launches list reads sessions.json and marks a stale entry; stop reports it and refuses a non-runner (10.399239ms)
ℹ tests 195
ℹ suites 0
ℹ pass 191
ℹ pass 195
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 15562.129506
ℹ duration_ms 13730.767426
agents/researcher/work/queue-120/suites/conversation.txt
+183 -183
View File
@@ -1,185 +1,185 @@
✔ W1: two processes acquire the same pair at once; exactly one claim (147.314124ms)
✔ W1: two writers publish the same revision at once: one wins, the other gets null, the winner's record stays (8.169187ms)
✔ W1: a revision name appears only after its bytes are synced; before that, only a temp file exists (4.973806ms)
✔ W2: acquire while a claim is reserved or active refuses already-active (136.133248ms)
✔ W3: acquire while stopping, uncertain, or stopped without proof refuses unsafe-replacement (211.202132ms)
✔ W4: same session with another seat tuple, and the reverse, both refuse; a loser on the seat key closes it no-unit (178.70552ms)
✔ W4: a hard link of one session under another seat is the same session: the second controller refuses already-active and launches nothing (20.31256ms)
✔ W4: a copy of one session under another seat is the same session: the second controller refuses already-active and launches nothing (18.004249ms)
✔ W4: a session header ID that changes after construction refuses target; nothing is claimed or launched (3.239547ms)
✔ W5: SIGKILL between every publication barrier of acquire and transition; restart never finds two holders or a lost claim (5909.421347ms)
✔ W5: SIGKILL between every publication barrier of release; restart finishes or holds the release (24845.03757ms)
✔ W6: controller killed mid-turn while the engine lives; restart is uncertain, no launch, prompts refuse (151.469683ms)
✔ W12: a live owner paused with SIGSTOP; a second controller refuses already-active and changes nothing (98.292251ms)
✔ W13: crash after the engine spawns, before active; restart finds the live unit: uncertain, no second spawn, force stop only (272.179518ms)
✔ W14: crash after reservation, before the spawn marker: stopped with a no-unit observation; the pair is free (196.814744ms)
✔ W20: crash after the spawn marker, scope collected; uncertain in both runs, the marker is copied, no launch until a boot proof (223.432208ms)
✔ W15: crash between the two keys during release; restart finishes it under the same claim ID (33.903418ms)
✔ W7: recorded boot ID differs on the same machine: stopped with a boot proof; open tool calls become uncertain (108.818575ms)
✔ W8: resume after a proven stop with the same pins: new claim ID, generation +1, same conversation, branch and leaf (34.379195ms)
✔ W9: resume with a changed binary, argv digest, branch or leaf is refused and the claim is unchanged (97.664158ms)
✔ W11: the controller writes no session file; only the fake engine's own appends appear (23.638195ms)
✔ W16: a highest revision that won't parse holds the pair uncertain; the older stopped revision is not reused (52.55234ms)
✔ W17: a claim root copied from another host refuses foreign-host and promotes nothing (50.084663ms)
✔ G1: a session path or claim root under .pi/state, ~/.claude, the data root or a registration refuses at construction (4.869492ms)
✔ G2: a symlink inside the fixture root to a live session file is refused by the real-path check (1.238263ms)
✔ G3: a fixture path swapped for a live path after construction is refused at bind (1.993733ms)
✔ no shim from this file's tests is left running for the after hook (6.085784ms)
✔ K1: force stop kills a tool child that called setsid; stopped with a verified proof (326.228134ms)
✔ K2: K1 on the process-group fallback ends uncertain, never stopped (184.676408ms)
✔ K3: SIGTERM acknowledged while a member lives: stopping until the kill phase, never stopped from TERM (313.031586ms)
✔ K4: two engines; force stop one; the other survives by independent observation (2346.333994ms)
✔ K5: a stop during a tool call leaves the effect uncertain, and it is shown (176.797833ms)
✔ K12: a member forking in a loop: the freeze stops it, enumeration is complete, populated 0 after cgroup.kill (295.103557ms)
✔ K13: a member writing its pid into another cgroup is refused by the namespace; the kill is complete (192.813929ms)
✔ K15: the shim gone, engine/cgroup.events unreadable, or the engine cgroup missing: evidence unavailable, not empty; uncertain (4430.504157ms)
✔ K10: controller killed between the TERM and kill phases: restart checks the invocation ID and re-runs from TERM for the same stop (455.386665ms)
✔ K11: controller killed after the confirmation is recorded, before TERM: restart checks the invocation ID and re-runs from TERM for the same stop (360.197047ms)
✔ K14: a unit with the recorded name but another invocation ID: evidence unavailable, no signals, uncertain (286.101868ms)
✔ K6: recover without proof, without confirmation, or with changed pins is refused (72.722874ms)
✔ K7: recover after proof, then launch: new claim and execution, generation +1, same leaf; the cancelled prompt is not replayed (32.211902ms)
✔ K8: an engine that loads another leaf on resume is refused before admission; it stays claimed until a proven stop (41.964345ms)
✔ K9: an interrupt that never settles stays uncertain; force stop stays available; takeover is refused while fenced (3031.547882ms)
✔ K16: a claim from another machine ID refuses foreign-host; no boot proof is issued (5.844001ms)
✔ K17: two launcher calls with one eligibility record: one launch, the other refuses, no second engine (31.325106ms)
✔ K18: the leaf changes after eligibility: launch refused; the reservation stays until released with proof (26.89116ms)
✔ K19: a scope launched with only the engine environment still reaches the user manager; the engine sees no other names (88.033228ms)
✔ R1: after a proven force stop the controller releases the scope; the shim and the unit are gone (187.926163ms)
✔ R2: close releases the scope of a binding proven stopped, once, when the stop's own release hasn't run (298.337515ms)
✔ R3: no release after an unavailable stop or an unverified proof: the scope and its shim stay as evidence (703.115156ms)
✔ E1: a natural engine exit with no member left: an engine-exit stop, stopped on a proof naming the engine, and the scope released (214.726372ms)
✔ E2: an engine exit with a tool child alive: the stop ends uncertain and nothing is released; a force stop then ends it (2252.994853ms)
✔ E3: an engine exit and a force stop take one escalation slot, in either order (648.311458ms)
✔ E4: a shim that doesn't answer: the engine-exit stop misses its deadline, ends uncertain and frees the slot (713.225069ms)
✔ E5: an engine exit after a force stop ended uncertain starts no engine-exit stop; the force stop stays current (2437.193775ms)
✔ E6: the engine-exit observation refuses a reaped process that isn't the recorded engine: another PID or start ticks (190.701737ms)
✔ R5: the harness finds a running shim and reaps it, and never signals a shim outside a mosaic-chat- scope (Filbert N1 and N2 on #1533) (378.980285ms)
✔ R6: releaseCohort releases nothing while the engine runs, for another invocation ID, or for a cohort without a scope (124.182458ms)
✔ R7: controller killed after the claim is stopped, before the release: the restart releases the scope (2338.522488ms)
✔ R8: controller killed between the two keys' stopped revisions: the restart releases the scope (248.409137ms)
✔ R9: a release that ended unavailable is tried again on a confirmed recover, not a refused one (226.277464ms)
✔ R10: close releases and signals nothing for a stopped binding whose proof no longer verifies (Filbert N3 on #1536) (182.005224ms)
✔ R11: close({ killEngine: true }) after a proven stop sends no signal to the recorded engine PID; a restart releases nothing more (2280.103732ms)
✔ R12: a restart onto a claim stopped on a boot proof releases nothing, though its scope is listed (182.913047ms)
✔ no shim from this file's tests is left running for the after hook (5.944422ms)
✔ S1: `/goal x`, with leading spaces or a tab, refuses text-policy at admission; zero engine bytes (46.673749ms)
✔ S2: every prefix pinned Pi interprets is refused, from the list the code uses; the rest reach the engine exactly (31.620248ms)
✔ S3: `/goal` on the second line is pinned from the source: Pi checks only index 0, so it is admitted and sent exactly (25.922721ms)
✔ S4: a `/` left in the composer is cleared when control transfers and returns; the next submit sends only the new text (36.098628ms)
✔ S5: an observer terminal gets a paste then Enter, as send-message.sh does: not admitted: controller, nothing sent (20.520817ms)
✔ S6: a mediated-shaped registration (no tmux) passed to the board's replyToRow: 409 no tmux session; exec never runs (0.822662ms)
✔ S7: ESC, bracketed-paste markers and U+2028/U+2029 travel as one JSON string; the engine receives the exact text in one record (20.675984ms)
✔ P3: a Pi confirm, select, input or editor dialog is shown disabled with a reason and never answered (125.903763ms)
✔ E1: send, ack, user, toolCall, toolResult, final answer: shown once, no refresh, draft and reading position kept (37.196412ms)
✔ E2: U+2028, U+2029 inside JSON strings and CRLF line ends each parse as one record, on the splitter and through the controller (20.335031ms)
✔ E3: a multipart final, two blocks, null request correlation and duplicate delivery (37.832584ms)
✔ E4: a page read after message_end but before its entry is persisted: marker at the seam, re-read after run-settled, each message once (35.009043ms)
✔ E4: a gap or a new epoch also reconciles; nothing is concatenated across a gap (11.323894ms)
✔ E5: an unknown native event gives no client event; evidence records its type and bytes; the terminal count goes up (32.087678ms)
✔ E6: a tool result delayed across a pause and a reconnect is reconciled without a manual refresh (46.332174ms)
✔ E7: the terminal renders the same stream as the library client, as observer and then as controller, and submits only as controller (39.943669ms)
✔ terminal: engine control characters are made visible; a lost connection refuses submit (24.386121ms)
✔ terminal: outcome unknown is shown as such, with no resend offer, and nothing is resent (0.754873ms)
✔ terminal: text after Enter in the same input chunk starts the next message; it never joins the one submitted (0.788311ms)
✔ terminal: a paste-start marker split right after its ESC still opens the paste; the Enter inside it never submits (0.602081ms)
✔ terminal: Ctrl-T then Enter in one chunk is judged after the takeover, as if typed one key at a time (Filbert F2, #1507) (0.739317ms)
✔ terminal: input held behind Ctrl-T waits for that takeover while an earlier action is still pending (Darkwing T1 on #1522) (31.424058ms)
✔ terminal: a hold inside held input holds again, and once it is drained later input and Ctrl-C still reach the terminal (Darkwing note 1 on #1522) (0.843673ms)
✔ terminal: an action that throws still releases the input held behind it, in order, then rethrows (6.079769ms)
✔ terminal: after an action throws, later input still runs; input() puts the error in the status line (Filbert N1 on #1522) (0.611154ms)
✔ terminal: input() reports an error when it happens, so it never overwrites a later status; held input's promise doesn't carry the holder's error (Filbert N4 on #1522) (0.482935ms)
✔ terminal: invisible and bidi characters are made visible; head, status and notice lines stay one line (0.135434ms)
✔ every record these fixtures produced is a valid CHAT-01 record (E5: no record fails the schema) (324.842274ms)
✔ H1: two takeovers with the same expected generation: one wins, +1; the other refuses generation (58.92724ms)
✔ H2: the old controller's prompt after a takeover commits is refused with zero engine bytes (81.298244ms)
✔ H3: a takeover while a prompt holds the dispatch lock: written under the old actor, or refused; never both (139.149165ms)
✔ H4: self-takeover is refused (17.124571ms)
✔ H9: Interrupt racing a prompt's dispatch: before the write, dispatch-refused and no-turn; after, §3 rules (99.989269ms)
✔ H10: Interrupt and force stop together: one stop chain, force stop supersedes (99.625155ms)
✔ H10: an overlap during the pause before the abort: no abort, the stop ends uncertain (24.315053ms)
✔ H10: a no-turn Interrupt lifts only its own fence; admission stays closed under force stop, overlap or revocation (83.717162ms)
✔ H11: the controller disconnects mid-turn: work continues, the claim is unchanged, control stays put (135.676924ms)
✔ H12: an exact retry after reconnecting to the same incarnation returns the same receipt; one dispatch (20.388562ms)
✔ H13: a retry with the same request ID and different text is refused (18.216305ms)
✔ H14: late stdout from the old engine after a replacement is dropped by incarnation, counted, never rendered (141.875874ms)
✔ H15: a revoked connection's command is refused; the revocation fence holds (71.25178ms)
✔ H16: a second controller for the same session refuses already-active; the first is untouched (20.340538ms)
✔ H10: a second force stop while the first escalation runs refuses fenced; one escalation, and the claim records only the first stop's phases (66.087564ms)
✔ a force stop whose fence throws leaves no escalation flag behind, so the next force stop runs (Darkwing F2, #1507) (25.756544ms)
✔ H17: a confirmation reused, answered from another connection, or used after the stop changed is refused (58.438373ms)
✔ H18: two prompts before any native output: the second refuses busy; one engine write (15.643318ms)
✔ H19: the pipe fails mid-line under a large prompt: delivery-unknown transport-unknown, poisoned, no later write (121.407664ms)
✔ H19: the link itself never writes again after an unknown outcome, whoever calls it (0.881168ms)
✔ H19: the controller dies mid-write of a large line: after restart the outcome is unknown and nothing is resent (474.537487ms)
✔ H20: the line is written but the ack is lost when the controller dies: orphan, outcome unknown, nothing resent (373.526082ms)
✔ H21: a retry of the exact request with the old token after a crash is stale-incarnation; no second write (338.523382ms)
✔ H22: after H21 and a valid recovery, a new request with the new token is admitted (2404.172484ms)
✔ H23: requests pending at a restart are not resent; each shows outcome unknown (464.81979ms)
✔ no shim from this file's tests is left running for the after hook (5.483997ms)
✔ a plain conversation: catalogue row, one page, CHAT-01 records (7.59437ms)
✔ native entries map to blocks: tools, thinking, bash, notices, ids that do not fit (2.244514ms)
✔ F1: a malformed line is an unavailable part at its position, and reading continues (2.170991ms)
✔ F1: a missing parent stops the history with a notice that names the unreadable lines (3.072478ms)
✔ F1: an unreadable fork is never merged into another branch's history (2.740145ms)
✔ F1: a follow stays on its branch when the next entry's parent is unreadable (5.331747ms)
✔ F1: a file whose entries are all unreadable shows a notice per line (1.722364ms)
✔ F2: a truncated trailing line marks the view incomplete, not an error (2.062629ms)
✔ pagination: 100 parts, then the rest; parts concatenate to the whole branch (4.210193ms)
✔ F3: a replaced file (new inode) refuses old cursors with reconcile (5.499166ms)
✔ F4: a same-inode rewrite of the prefix refuses old cursors with reconcile (7.492917ms)
✔ F5: growth between pages keeps the epoch and the page stops at the pinned length (6.521299ms)
✔ F6: unknown, foreign and expired cursors refuse and leave the cursor usable (12.950365ms)
✔ F7: a symlinked file and a symlinked directory component are refused, never opened (15.95767ms)
✔ F8: a file swapped for a symlink after the catalogue is refused (3.028829ms)
✔ F9: registrations never add or redirect a root (2.021271ms)
✔ F10: a header cwd naming another project is refused (4.900495ms)
✔ F11: parentSession renders with a marker and the parent is never opened (0.980309ms)
✔ F12: two leaves: the default leaf is shown and the other branch reads alone (5.905018ms)
✔ F12: a follow refuses when an appended duplicate id changes the branch's earlier parts (2.937872ms)
✔ F12: a second root (Pi's resetLeaf) starts its own branch (1.446615ms)
✔ F13: compaction is a marker in place, then the retained content (0.839393ms)
✔ F14: long strings split into fragments and parts, reassemble exactly, and pages respect the byte cap (628.733969ms)
✔ fragments never cut a surrogate pair and keep an empty string (5.451232ms)
✔ F15: a Claude seat is an unsupported-harness placeholder whose directory is never read (1.725356ms)
✔ unknown conversations, empty files and non-Pi files refuse (2.708436ms)
✔ an unreadable file or root inside the roots is refused per row, not a failed catalogue (1.312487ms)
✔ a seat directory without search permission refuses that root, not the catalogue (2.243135ms)
✔ every page and cursor is a valid CHAT-01 record (861.402855ms)
✔ the engine pin holds for the installed package (2.305156ms)
✔ pinned Pi, sealed and without credentials, answers the controller's commands with the shapes the fake models (337.910614ms)
✔ sealed, pinned Pi ignores a trusted project's .pi resources; --approve past the seal would load them, and checkSeal refuses it (Filbert F2 on #1522) (665.490366ms)
✔ pinned Pi appends thinking_level_change at start when the branch lacks one, so the leaf moves (K8 then fails closed) (279.533657ms)
✔ N25: ordinary Interrupt reconciles; a non-empty queue_update in the window is O5 (95.539877ms)
✔ N1: an extension's follow-up queued after the fence is cleared before any abort; O5, Unknown (51.388007ms)
✔ N1: a follow-up queued before the fence is O5 at once; the Interrupt refuses fenced (25.719496ms)
✔ N2: with abort first, the fake runs the external item (the ordering guard has teeth) (20.932096ms)
✔ N3: the fence lands in preflight, preflight errors, no run: failed, No run, uncertain (30.184421ms)
✔ N4: the ack arrives after the first abort and a run starts: clear and abort again; Interrupted (23.272921ms)
✔ N5: an input handler takes the prompt: ack, no run, delivery-unknown handled-without-run (118.821664ms)
✔ N6: an extension queues between clear_queue and abort: O5 and O6, Unknown (55.559963ms)
✔ N7: clear_queue times out: no abort, nativeQueue unknown, force stop still ends it (1534.850576ms)
✔ N7: clear_queue answers an error: no abort, nativeQueue unknown, the link not poisoned (15.34435ms)
✔ N8: an extension prompt starts a run during Mosaic preflight; the losing settle is O3 (70.856514ms)
✔ N9: a run that started before the fence and ends aborted: failed interrupted, Interrupted (14.854192ms)
✔ N9: decision 34: a run that ends aborted with no stop in progress: aborted-without-stop, uncertain, outcome unknown (16.029904ms)
✔ N9: an aborted that lands after the fence but before any abort is written: aborted-without-stop, Unknown (33.682146ms)
✔ N10: fake conformance (32.569765ms)
✔ N11: the run fails before any user message_start: delivery-unknown ack-without-start, never failed (32.121098ms)
✔ N12: input that starts a run after the final empty clear is O1 and not part of the stop's proof (20.555326ms)
✔ N13: agent_start with no slot held is O1; a later prompt refuses with zero engine bytes (65.41769ms)
✔ N14: the run completes while clear_queue is in flight: finished, Completed first, uncertain (28.467046ms)
✔ N14: the run completes after the abort is written, before Pi applies it: finished, never relabelled (29.604154ms)
✔ N15: the fence lands in preflight, then an input handler takes it: handled-without-run, No run (23.672948ms)
✔ N16: Interrupt with no slot and no run refuses no-turn: no stop, no bytes, admission open (13.474106ms)
✔ N17: the run fails on its own during the exchange: failed, Failed on its own (27.731744ms)
✔ N18: no final assistant message_end, or a lost line: working stays working; before working, transport-unknown (108.676482ms)
✔ N19: a losing extension prompt settles inside the Mosaic run before its user message: O3, run-overlap (136.310368ms)
✔ N20: an extension triggerTurn during Mosaic preflight starts first; while streaming it queues with no signal (84.960867ms)
✔ N21: a losing settle after the receipt settled finished is O2; the receipt stays finished (15.496162ms)
✔ N22: an agent-level custom message is dropped by the clear with no signal; evidence names the seal (15.293063ms)
✔ N23: a nextTurn message survives clear and abort and attaches to the next prompt, with no signal (15.88726ms)
✔ N24: the seal is an allow-list: --extension, a missing --no-* flag, a second --mode or --session, a session or output flag, or a stray word refuses unsealed-engine; no engine starts (39.239883ms)
✔ N24b: the seal covers the engine command and environment: config can't name either, the env is built from names, and a mutated command is refused at bind (29.400749ms)
✔ W1: two processes acquire the same pair at once; exactly one claim (114.992725ms)
✔ W1: two writers publish the same revision at once: one wins, the other gets null, the winner's record stays (6.298032ms)
✔ W1: a revision name appears only after its bytes are synced; before that, only a temp file exists (3.284393ms)
✔ W2: acquire while a claim is reserved or active refuses already-active (113.375788ms)
✔ W3: acquire while stopping, uncertain, or stopped without proof refuses unsafe-replacement (168.162973ms)
✔ W4: same session with another seat tuple, and the reverse, both refuse; a loser on the seat key closes it no-unit (136.298205ms)
✔ W4: a hard link of one session under another seat is the same session: the second controller refuses already-active and launches nothing (21.494844ms)
✔ W4: a copy of one session under another seat is the same session: the second controller refuses already-active and launches nothing (17.497463ms)
✔ W4: a session header ID that changes after construction refuses target; nothing is claimed or launched (2.879132ms)
✔ W5: SIGKILL between every publication barrier of acquire and transition; restart never finds two holders or a lost claim (5374.842207ms)
✔ W5: SIGKILL between every publication barrier of release; restart finishes or holds the release (24127.601432ms)
✔ W6: controller killed mid-turn while the engine lives; restart is uncertain, no launch, prompts refuse (140.467661ms)
✔ W12: a live owner paused with SIGSTOP; a second controller refuses already-active and changes nothing (85.5724ms)
✔ W13: crash after the engine spawns, before active; restart finds the live unit: uncertain, no second spawn, force stop only (259.308759ms)
✔ W14: crash after reservation, before the spawn marker: stopped with a no-unit observation; the pair is free (176.271161ms)
✔ W20: crash after the spawn marker, scope collected; uncertain in both runs, the marker is copied, no launch until a boot proof (209.735706ms)
✔ W15: crash between the two keys during release; restart finishes it under the same claim ID (37.204005ms)
✔ W7: recorded boot ID differs on the same machine: stopped with a boot proof; open tool calls become uncertain (102.461446ms)
✔ W8: resume after a proven stop with the same pins: new claim ID, generation +1, same conversation, branch and leaf (30.511787ms)
✔ W9: resume with a changed binary, argv digest, branch or leaf is refused and the claim is unchanged (89.096634ms)
✔ W11: the controller writes no session file; only the fake engine's own appends appear (22.343538ms)
✔ W16: a highest revision that won't parse holds the pair uncertain; the older stopped revision is not reused (53.167806ms)
✔ W17: a claim root copied from another host refuses foreign-host and promotes nothing (56.654787ms)
✔ G1: a session path or claim root under .pi/state, ~/.claude, the data root or a registration refuses at construction (3.396028ms)
✔ G2: a symlink inside the fixture root to a live session file is refused by the real-path check (1.014311ms)
✔ G3: a fixture path swapped for a live path after construction is refused at bind (1.717005ms)
✔ no shim from this file's tests is left running for the after hook (5.481185ms)
✔ K1: force stop kills a tool child that called setsid; stopped with a verified proof (285.636099ms)
✔ K2: K1 on the process-group fallback ends uncertain, never stopped (154.736433ms)
✔ K3: SIGTERM acknowledged while a member lives: stopping until the kill phase, never stopped from TERM (275.360674ms)
✔ K4: two engines; force stop one; the other survives by independent observation (2315.776598ms)
✔ K5: a stop during a tool call leaves the effect uncertain, and it is shown (169.040274ms)
✔ K12: a member forking in a loop: the freeze stops it, enumeration is complete, populated 0 after cgroup.kill (275.97434ms)
✔ K13: a member writing its pid into another cgroup is refused by the namespace; the kill is complete (173.075247ms)
✔ K15: the shim gone, engine/cgroup.events unreadable, or the engine cgroup missing: evidence unavailable, not empty; uncertain (4380.67997ms)
✔ K10: controller killed between the TERM and kill phases: restart checks the invocation ID and re-runs from TERM for the same stop (428.485702ms)
✔ K11: controller killed after the confirmation is recorded, before TERM: restart checks the invocation ID and re-runs from TERM for the same stop (351.962515ms)
✔ K14: a unit with the recorded name but another invocation ID: evidence unavailable, no signals, uncertain (255.434443ms)
✔ K6: recover without proof, without confirmation, or with changed pins is refused (59.756759ms)
✔ K7: recover after proof, then launch: new claim and execution, generation +1, same leaf; the cancelled prompt is not replayed (29.215826ms)
✔ K8: an engine that loads another leaf on resume is refused before admission; it stays claimed until a proven stop (47.348824ms)
✔ K9: an interrupt that never settles stays uncertain; force stop stays available; takeover is refused while fenced (3025.28024ms)
✔ K16: a claim from another machine ID refuses foreign-host; no boot proof is issued (4.539629ms)
✔ K17: two launcher calls with one eligibility record: one launch, the other refuses, no second engine (31.432368ms)
✔ K18: the leaf changes after eligibility: launch refused; the reservation stays until released with proof (25.473897ms)
✔ K19: a scope launched with only the engine environment still reaches the user manager; the engine sees no other names (61.045784ms)
✔ R1: after a proven force stop the controller releases the scope; the shim and the unit are gone (184.316878ms)
✔ R2: close releases the scope of a binding proven stopped, once, when the stop's own release hasn't run (292.595148ms)
✔ R3: no release after an unavailable stop or an unverified proof: the scope and its shim stay as evidence (704.147775ms)
✔ E1: a natural engine exit with no member left: an engine-exit stop, stopped on a proof naming the engine, and the scope released (161.624881ms)
✔ E2: an engine exit with a tool child alive: the stop ends uncertain and nothing is released; a force stop then ends it (2232.018289ms)
✔ E3: an engine exit and a force stop take one escalation slot, in either order (611.853607ms)
✔ E4: a shim that doesn't answer: the engine-exit stop misses its deadline, ends uncertain and frees the slot (664.155489ms)
✔ E5: an engine exit after a force stop ended uncertain starts no engine-exit stop; the force stop stays current (2437.645219ms)
✔ E6: the engine-exit observation refuses a reaped process that isn't the recorded engine: another PID or start ticks (186.233819ms)
✔ R5: the harness finds a running shim and reaps it, and never signals a shim outside a mosaic-chat- scope (Filbert N1 and N2 on #1533) (388.639113ms)
✔ R6: releaseCohort releases nothing while the engine runs, for another invocation ID, or for a cohort without a scope (114.447004ms)
✔ R7: controller killed after the claim is stopped, before the release: the restart releases the scope (2323.279219ms)
✔ R8: controller killed between the two keys' stopped revisions: the restart releases the scope (241.393899ms)
✔ R9: a release that ended unavailable is tried again on a confirmed recover, not a refused one (192.351243ms)
✔ R10: close releases and signals nothing for a stopped binding whose proof no longer verifies (Filbert N3 on #1536) (176.114992ms)
✔ R11: close({ killEngine: true }) after a proven stop sends no signal to the recorded engine PID; a restart releases nothing more (2258.938179ms)
✔ R12: a restart onto a claim stopped on a boot proof releases nothing, though its scope is listed (154.488347ms)
✔ no shim from this file's tests is left running for the after hook (4.378507ms)
✔ S1: `/goal x`, with leading spaces or a tab, refuses text-policy at admission; zero engine bytes (36.347272ms)
✔ S2: every prefix pinned Pi interprets is refused, from the list the code uses; the rest reach the engine exactly (28.117841ms)
✔ S3: `/goal` on the second line is pinned from the source: Pi checks only index 0, so it is admitted and sent exactly (21.027242ms)
✔ S4: a `/` left in the composer is cleared when control transfers and returns; the next submit sends only the new text (31.340248ms)
✔ S5: an observer terminal gets a paste then Enter, as send-message.sh does: not admitted: controller, nothing sent (14.904571ms)
✔ S6: a mediated-shaped registration (no tmux) passed to the board's replyToRow: 409 no tmux session; exec never runs (0.5922ms)
✔ S7: ESC, bracketed-paste markers and U+2028/U+2029 travel as one JSON string; the engine receives the exact text in one record (19.399722ms)
✔ P3: a Pi confirm, select, input or editor dialog is shown disabled with a reason and never answered (124.96121ms)
✔ E1: send, ack, user, toolCall, toolResult, final answer: shown once, no refresh, draft and reading position kept (36.187071ms)
✔ E2: U+2028, U+2029 inside JSON strings and CRLF line ends each parse as one record, on the splitter and through the controller (18.647971ms)
✔ E3: a multipart final, two blocks, null request correlation and duplicate delivery (28.217966ms)
✔ E4: a page read after message_end but before its entry is persisted: marker at the seam, re-read after run-settled, each message once (32.857977ms)
✔ E4: a gap or a new epoch also reconciles; nothing is concatenated across a gap (10.946125ms)
✔ E5: an unknown native event gives no client event; evidence records its type and bytes; the terminal count goes up (29.120091ms)
✔ E6: a tool result delayed across a pause and a reconnect is reconciled without a manual refresh (44.178987ms)
✔ E7: the terminal renders the same stream as the library client, as observer and then as controller, and submits only as controller (38.192352ms)
✔ terminal: engine control characters are made visible; a lost connection refuses submit (24.946502ms)
✔ terminal: outcome unknown is shown as such, with no resend offer, and nothing is resent (0.488642ms)
✔ terminal: text after Enter in the same input chunk starts the next message; it never joins the one submitted (0.322351ms)
✔ terminal: a paste-start marker split right after its ESC still opens the paste; the Enter inside it never submits (0.399226ms)
✔ terminal: Ctrl-T then Enter in one chunk is judged after the takeover, as if typed one key at a time (Filbert F2, #1507) (0.58057ms)
✔ terminal: input held behind Ctrl-T waits for that takeover while an earlier action is still pending (Darkwing T1 on #1522) (31.516003ms)
✔ terminal: a hold inside held input holds again, and once it is drained later input and Ctrl-C still reach the terminal (Darkwing note 1 on #1522) (0.614675ms)
✔ terminal: an action that throws still releases the input held behind it, in order, then rethrows (5.895185ms)
✔ terminal: after an action throws, later input still runs; input() puts the error in the status line (Filbert N1 on #1522) (0.464012ms)
✔ terminal: input() reports an error when it happens, so it never overwrites a later status; held input's promise doesn't carry the holder's error (Filbert N4 on #1522) (0.387693ms)
✔ terminal: invisible and bidi characters are made visible; head, status and notice lines stay one line (0.1166ms)
✔ every record these fixtures produced is a valid CHAT-01 record (E5: no record fails the schema) (238.058324ms)
✔ H1: two takeovers with the same expected generation: one wins, +1; the other refuses generation (48.661556ms)
✔ H2: the old controller's prompt after a takeover commits is refused with zero engine bytes (79.686768ms)
✔ H3: a takeover while a prompt holds the dispatch lock: written under the old actor, or refused; never both (130.114901ms)
✔ H4: self-takeover is refused (13.319052ms)
✔ H9: Interrupt racing a prompt's dispatch: before the write, dispatch-refused and no-turn; after, §3 rules (88.499688ms)
✔ H10: Interrupt and force stop together: one stop chain, force stop supersedes (84.544255ms)
✔ H10: an overlap during the pause before the abort: no abort, the stop ends uncertain (19.612033ms)
✔ H10: a no-turn Interrupt lifts only its own fence; admission stays closed under force stop, overlap or revocation (76.463623ms)
✔ H11: the controller disconnects mid-turn: work continues, the claim is unchanged, control stays put (129.889858ms)
✔ H12: an exact retry after reconnecting to the same incarnation returns the same receipt; one dispatch (15.028704ms)
✔ H13: a retry with the same request ID and different text is refused (16.28154ms)
✔ H14: late stdout from the old engine after a replacement is dropped by incarnation, counted, never rendered (136.248069ms)
✔ H15: a revoked connection's command is refused; the revocation fence holds (66.670025ms)
✔ H16: a second controller for the same session refuses already-active; the first is untouched (15.638208ms)
✔ H10: a second force stop while the first escalation runs refuses fenced; one escalation, and the claim records only the first stop's phases (62.310635ms)
✔ a force stop whose fence throws leaves no escalation flag behind, so the next force stop runs (Darkwing F2, #1507) (22.75586ms)
✔ H17: a confirmation reused, answered from another connection, or used after the stop changed is refused (55.924793ms)
✔ H18: two prompts before any native output: the second refuses busy; one engine write (13.204282ms)
✔ H19: the pipe fails mid-line under a large prompt: delivery-unknown transport-unknown, poisoned, no later write (118.137326ms)
✔ H19: the link itself never writes again after an unknown outcome, whoever calls it (0.657696ms)
✔ H19: the controller dies mid-write of a large line: after restart the outcome is unknown and nothing is resent (460.560975ms)
✔ H20: the line is written but the ack is lost when the controller dies: orphan, outcome unknown, nothing resent (355.292419ms)
✔ H21: a retry of the exact request with the old token after a crash is stale-incarnation; no second write (314.956531ms)
✔ H22: after H21 and a valid recovery, a new request with the new token is admitted (2373.243034ms)
✔ H23: requests pending at a restart are not resent; each shows outcome unknown (456.270414ms)
✔ no shim from this file's tests is left running for the after hook (5.466679ms)
✔ a plain conversation: catalogue row, one page, CHAT-01 records (5.631508ms)
✔ native entries map to blocks: tools, thinking, bash, notices, ids that do not fit (1.521324ms)
✔ F1: a malformed line is an unavailable part at its position, and reading continues (1.50515ms)
✔ F1: a missing parent stops the history with a notice that names the unreadable lines (2.121801ms)
✔ F1: an unreadable fork is never merged into another branch's history (1.414301ms)
✔ F1: a follow stays on its branch when the next entry's parent is unreadable (1.68393ms)
✔ F1: a file whose entries are all unreadable shows a notice per line (0.672899ms)
✔ F2: a truncated trailing line marks the view incomplete, not an error (1.058407ms)
✔ pagination: 100 parts, then the rest; parts concatenate to the whole branch (3.616021ms)
✔ F3: a replaced file (new inode) refuses old cursors with reconcile (5.817828ms)
✔ F4: a same-inode rewrite of the prefix refuses old cursors with reconcile (8.325995ms)
✔ F5: growth between pages keeps the epoch and the page stops at the pinned length (5.220241ms)
✔ F6: unknown, foreign and expired cursors refuse and leave the cursor usable (8.705099ms)
✔ F7: a symlinked file and a symlinked directory component are refused, never opened (8.292671ms)
✔ F8: a file swapped for a symlink after the catalogue is refused (3.01867ms)
✔ F9: registrations never add or redirect a root (1.880954ms)
✔ F10: a header cwd naming another project is refused (3.330655ms)
✔ F11: parentSession renders with a marker and the parent is never opened (0.853883ms)
✔ F12: two leaves: the default leaf is shown and the other branch reads alone (4.373008ms)
✔ F12: a follow refuses when an appended duplicate id changes the branch's earlier parts (2.657263ms)
✔ F12: a second root (Pi's resetLeaf) starts its own branch (1.188463ms)
✔ F13: compaction is a marker in place, then the retained content (0.636329ms)
✔ F14: long strings split into fragments and parts, reassemble exactly, and pages respect the byte cap (527.464809ms)
✔ fragments never cut a surrogate pair and keep an empty string (5.146222ms)
✔ F15: a Claude seat is an unsupported-harness placeholder whose directory is never read (1.640888ms)
✔ unknown conversations, empty files and non-Pi files refuse (2.5801ms)
✔ an unreadable file or root inside the roots is refused per row, not a failed catalogue (1.145285ms)
✔ a seat directory without search permission refuses that root, not the catalogue (1.962792ms)
✔ every page and cursor is a valid CHAT-01 record (772.722345ms)
✔ the engine pin holds for the installed package (2.284046ms)
✔ pinned Pi, sealed and without credentials, answers the controller's commands with the shapes the fake models (264.902248ms)
✔ sealed, pinned Pi ignores a trusted project's .pi resources; --approve past the seal would load them, and checkSeal refuses it (Filbert F2 on #1522) (513.060277ms)
✔ pinned Pi appends thinking_level_change at start when the branch lacks one, so the leaf moves (K8 then fails closed) (252.408044ms)
✔ N25: ordinary Interrupt reconciles; a non-empty queue_update in the window is O5 (70.308907ms)
✔ N1: an extension's follow-up queued after the fence is cleared before any abort; O5, Unknown (47.279418ms)
✔ N1: a follow-up queued before the fence is O5 at once; the Interrupt refuses fenced (20.471866ms)
✔ N2: with abort first, the fake runs the external item (the ordering guard has teeth) (22.416627ms)
✔ N3: the fence lands in preflight, preflight errors, no run: failed, No run, uncertain (31.558241ms)
✔ N4: the ack arrives after the first abort and a run starts: clear and abort again; Interrupted (20.559521ms)
✔ N5: an input handler takes the prompt: ack, no run, delivery-unknown handled-without-run (113.965035ms)
✔ N6: an extension queues between clear_queue and abort: O5 and O6, Unknown (45.049792ms)
✔ N7: clear_queue times out: no abort, nativeQueue unknown, force stop still ends it (1532.094328ms)
✔ N7: clear_queue answers an error: no abort, nativeQueue unknown, the link not poisoned (13.173864ms)
✔ N8: an extension prompt starts a run during Mosaic preflight; the losing settle is O3 (69.462584ms)
✔ N9: a run that started before the fence and ends aborted: failed interrupted, Interrupted (13.633966ms)
✔ N9: decision 34: a run that ends aborted with no stop in progress: aborted-without-stop, uncertain, outcome unknown (14.96154ms)
✔ N9: an aborted that lands after the fence but before any abort is written: aborted-without-stop, Unknown (31.217548ms)
✔ N10: fake conformance (31.770244ms)
✔ N11: the run fails before any user message_start: delivery-unknown ack-without-start, never failed (27.488109ms)
✔ N12: input that starts a run after the final empty clear is O1 and not part of the stop's proof (21.48194ms)
✔ N13: agent_start with no slot held is O1; a later prompt refuses with zero engine bytes (64.094889ms)
✔ N14: the run completes while clear_queue is in flight: finished, Completed first, uncertain (27.473097ms)
✔ N14: the run completes after the abort is written, before Pi applies it: finished, never relabelled (26.820808ms)
✔ N15: the fence lands in preflight, then an input handler takes it: handled-without-run, No run (20.38814ms)
✔ N16: Interrupt with no slot and no run refuses no-turn: no stop, no bytes, admission open (13.598639ms)
✔ N17: the run fails on its own during the exchange: failed, Failed on its own (26.840173ms)
✔ N18: no final assistant message_end, or a lost line: working stays working; before working, transport-unknown (105.520323ms)
✔ N19: a losing extension prompt settles inside the Mosaic run before its user message: O3, run-overlap (133.011392ms)
✔ N20: an extension triggerTurn during Mosaic preflight starts first; while streaming it queues with no signal (79.223095ms)
✔ N21: a losing settle after the receipt settled finished is O2; the receipt stays finished (14.047376ms)
✔ N22: an agent-level custom message is dropped by the clear with no signal; evidence names the seal (13.60788ms)
✔ N23: a nextTurn message survives clear and abort and attaches to the next prompt, with no signal (14.675806ms)
✔ N24: the seal is an allow-list: --extension, a missing --no-* flag, a second --mode or --session, a session or output flag, or a stray word refuses unsealed-engine; no engine starts (37.374513ms)
✔ N24b: the seal covers the engine command and environment: config can't name either, the env is built from names, and a mutated command is refused at bind (26.771706ms)
ℹ tests 182
ℹ suites 0
ℹ pass 182
@@ -187,4 +187,4 @@
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 34698.863517
ℹ duration_ms 33212.59907
agents/researcher/work/queue-120/suites/harness.txt
+85 -85
View File
@@ -1,87 +1,87 @@
✔ sessionModel: agent vars win, then the system's execution settings (14.614198ms)
✔ a pi bundle: prompt, policy, tools and manifest, 0600 in a 0700 directory (8.183231ms)
✔ a chief-of-staff bundle lists launch among the bus tools and the manifest's typed tools (3.9943ms)
✔ a claude-code bundle adds the wrapped gate hook and the MCP config (4.050297ms)
✔ the prompt's built-in tools line is the harness's own names, as the manifest lists them (11.980502ms)
✔ the prompt names the project clones in the workspace, and none when there are none (7.515601ms)
✔ the prompt explains the review loop to a role with push_working, and reviews to one with fetch_review (9.605105ms)
✔ a bundle is written once: an existing file refuses (1.948565ms)
✔ a path with a single quote can't go into the hook command (2.273895ms)
✔ allow exits 0, a deny exits 2 with the reason on stderr (138.772682ms)
✔ a missing or wrong policy, or a bad event, exits 2 (101.906662ms)
✔ the bundle's wrapped command: a missing gate or node still blocks (1119.718996ms)
✔ claude: typed tools through MCP, the hook blocks, builtins outside --tools don't exist (870.320284ms)
✔ claude: the hook alone blocks a path outside the workspace (529.857591ms)
✔ claude: a second turn resumes the first turn's session (815.01276ms)
✔ claude adapter: --restricted is always passed (6.251245ms)
✔ claude adapter: MOSAIC_CLAUDE_BIN wins over PATH and must be an absolute executable (21.484195ms)
✔ claude adapter: a directory pin exits 2 before it runs; a pin with a space runs (7.844731ms)
✔ claude: CLAUDE.md files and auto-memory don't reach the model; without --restricted they do (768.379655ms)
✔ claude: a missing hook or MCP file refuses before claude starts (8.453723ms)
✔ pi: policy tools and typed tools pass, anything else is blocked (4.64508ms)
✔ claude: builtins map from pi names, typed tools need the mcp prefix (0.953931ms)
✔ file tool paths must resolve inside the workspace (1.362013ms)
✔ pi's own path normalisation can't be used to step out (1.467704ms)
✔ a symlink inside the workspace that points out is outside (1.095105ms)
✔ a dangling symlink is refused at any depth, in both harnesses (4.272429ms)
✔ read is checked under every spelling pi's read would open, in both harnesses (21.167594ms)
✔ other spellings cover directories, dangling links and pi's cwd (1.677166ms)
✔ a relative path climbs from the workspace's real path, in both harnesses (6.219838ms)
✔ claude path fields per tool (0.7262ms)
✔ glob patterns stay inside the workspace (0.686564ms)
✔ a path that can't be checked is blocked (0.50161ms)
✔ fetch_review's have lists the working refs before origin's, and no more than HAVE_MAX (320.065372ms)
✔ fetch_review's have orders the working refs newest first within each clone, one clone after another (171.348337ms)
✔ a runner git past its time: SIGTERM reaches its process group, and SIGKILL follows after the grace period (1808.942059ms)
✔ once a signalled runner git has closed, its group gets SIGKILL, so a process that ignored SIGTERM dies too (303.226141ms)
✔ initialize, ping and tools/list (62.762515ms)
✔ tools/call goes through the tool socket; a refusal is an isError result (39.278044ms)
✔ replies are compact JSON; over the cap a tool error names the size and the cap (43.90636ms)
✔ unknown tools and methods are JSON-RPC errors and never reach the socket (35.355401ms)
✔ a missing argument is a usage error (35.71761ms)
✔ pi: typed tools reach the socket, the gate blocks, agent_end writes the marker (452.832946ms)
✔ pi: a reply over the cap is a tool error naming the size and the cap; list_tasks asks for open tasks (359.48369ms)
✔ pi: a write through a dangling symlink is blocked, and nothing appears outside (407.609399ms)
✔ pi: a read is refused when pi would open another spelling outside (362.119518ms)
✔ pi: a relative path climbs from the real path of a workspace behind a symlink (379.921719ms)
✔ pi: a relative path climbs from the real path of a dataRoot behind a symlink (350.772403ms)
✔ pi: a missing extension refuses before any model call (7.048822ms)
✔ pi: an extension without its configuration fails pi's start (288.668919ms)
✔ founderCheck: founder variables, then a needed service without a usable token (1.579601ms)
✔ turnRequest names the sender, class, reply and decision (0.299611ms)
✔ turnRequest says a tester's message is a test and never Jason's instruction (0.243177ms)
✔ turnRequest shows the message's own sent time, a day old as well as new (0.168091ms)
✔ stateBlock names the launch state with its time and event, and the open tasks with the cap (0.295487ms)
✔ a message becomes a turn, the answer goes back as a RESULT, SIGTERM releases and exits 0 (141.677217ms)
✔ launches revoked and then restored: the turn's block reads allowed and gives the restore time (172.84021ms)
✔ a task closed on the tracker is missing from the next turn's open list (198.909429ms)
✔ a message read a day after it was sent shows the time it was sent (88.509962ms)
✔ a decision the human resolves becomes a turn citing the decision and the answer (169.468591ms)
✔ a failed state read fails the turn: no adapter runs, the sender hears why, the message is read (66.554151ms)
✔ a SIGTERM before the claim stops the runner with exit 0 and no claim (58.553156ms)
✔ typed tools carry the runner's capability; launch goes to the host's launch socket (352.922977ms)
✔ a RESULT gets no automatic reply; failed turns reply with the reason (1222.134351ms)
✔ SIGTERM during a turn kills the turn's process group and still exits 0 (121.204369ms)
✔ founder credentials stop before the claim (20) (91.154159ms)
✔ a refused claim exits 21; an ended run's capability exits 22 (95.675319ms)
✔ the launch ending under a running session exits 22 (104.266503ms)
✔ a broker that stays unreachable exits 23 after brokerRetries polls (205.343038ms)
✔ a broker that is down at the claim exits 23, not 21 (46.094233ms)
✔ no capability, or a malformed one, on stdin exits 2 (149.787469ms)
✔ a missing or malformed policy exits 2 before the claim (88.082295ms)
✔ the PM gets its task verbs and the reads, and no launch (9.367656ms)
✔ the chief of staff gets launch and send_message, and no task verbs (2.497347ms)
✔ the assistant gets send_message and the reads, no launch (3.990869ms)
✔ list_requirements reads the requirement ids, for a task.create holder with a tracker (4.791673ms)
✔ a coder gets no launch, no resolve_decision, and no task tools without a tracker (1.870443ms)
✔ a coder with a tracker gets its own task tools and no task_reassign (1.953543ms)
✔ launch only when the business's launch block names the instance as launcher (3.505102ms)
✔ an action outside the instance's authority has no tool (3.08216ms)
✔ the review loop: push_working and request_review for the coder, fetch_review and review_verdict for the reviewer, none for the PM (6.597497ms)
✔ callTool: one JSON line out, the result back, a refusal rejects (12.03723ms)
✔ list_tasks takes the broker's filters and pages; get_task takes a task_ref (2.63551ms)
✔ callTool sends list_tasks done false unless the session names done; other tools as given (3.288482ms)
✔ replyText: compact JSON up to the cap, an error naming the size and the cap over it (0.980106ms)
✔ sessionModel: agent vars win, then the system's execution settings (14.759686ms)
✔ a pi bundle: prompt, policy, tools and manifest, 0600 in a 0700 directory (4.996997ms)
✔ a chief-of-staff bundle lists launch among the bus tools and the manifest's typed tools (2.377887ms)
✔ a claude-code bundle adds the wrapped gate hook and the MCP config (3.127982ms)
✔ the prompt's built-in tools line is the harness's own names, as the manifest lists them (9.279316ms)
✔ the prompt names the project clones in the workspace, and none when there are none (6.026785ms)
✔ the prompt explains the review loop to a role with push_working, and reviews to one with fetch_review (9.581544ms)
✔ a bundle is written once: an existing file refuses (2.267467ms)
✔ a path with a single quote can't go into the hook command (2.277482ms)
✔ allow exits 0, a deny exits 2 with the reason on stderr (126.65485ms)
✔ a missing or wrong policy, or a bad event, exits 2 (82.5597ms)
✔ the bundle's wrapped command: a missing gate or node still blocks (1107.177701ms)
✔ claude: typed tools through MCP, the hook blocks, builtins outside --tools don't exist (702.665386ms)
✔ claude: the hook alone blocks a path outside the workspace (402.107955ms)
✔ claude: a second turn resumes the first turn's session (791.639357ms)
✔ claude adapter: --restricted is always passed (5.225782ms)
✔ claude adapter: MOSAIC_CLAUDE_BIN wins over PATH and must be an absolute executable (17.548761ms)
✔ claude adapter: a directory pin exits 2 before it runs; a pin with a space runs (5.967367ms)
✔ claude: CLAUDE.md files and auto-memory don't reach the model; without --restricted they do (692.230713ms)
✔ claude: a missing hook or MCP file refuses before claude starts (7.219694ms)
✔ pi: policy tools and typed tools pass, anything else is blocked (3.235145ms)
✔ claude: builtins map from pi names, typed tools need the mcp prefix (0.68943ms)
✔ file tool paths must resolve inside the workspace (1.110483ms)
✔ pi's own path normalisation can't be used to step out (0.867776ms)
✔ a symlink inside the workspace that points out is outside (0.763672ms)
✔ a dangling symlink is refused at any depth, in both harnesses (2.393668ms)
✔ read is checked under every spelling pi's read would open, in both harnesses (14.783826ms)
✔ other spellings cover directories, dangling links and pi's cwd (1.680903ms)
✔ a relative path climbs from the workspace's real path, in both harnesses (5.142125ms)
✔ claude path fields per tool (0.659631ms)
✔ glob patterns stay inside the workspace (0.745988ms)
✔ a path that can't be checked is blocked (0.384356ms)
✔ fetch_review's have lists the working refs before origin's, and no more than HAVE_MAX (222.211535ms)
✔ fetch_review's have orders the working refs newest first within each clone, one clone after another (135.811003ms)
✔ a runner git past its time: SIGTERM reaches its process group, and SIGKILL follows after the grace period (1809.814508ms)
✔ once a signalled runner git has closed, its group gets SIGKILL, so a process that ignored SIGTERM dies too (304.042732ms)
✔ initialize, ping and tools/list (44.002551ms)
✔ tools/call goes through the tool socket; a refusal is an isError result (35.389466ms)
✔ replies are compact JSON; over the cap a tool error names the size and the cap (34.230055ms)
✔ unknown tools and methods are JSON-RPC errors and never reach the socket (28.377091ms)
✔ a missing argument is a usage error (26.367965ms)
✔ pi: typed tools reach the socket, the gate blocks, agent_end writes the marker (364.97599ms)
✔ pi: a reply over the cap is a tool error naming the size and the cap; list_tasks asks for open tasks (304.983787ms)
✔ pi: a write through a dangling symlink is blocked, and nothing appears outside (307.656166ms)
✔ pi: a read is refused when pi would open another spelling outside (320.864168ms)
✔ pi: a relative path climbs from the real path of a workspace behind a symlink (375.845268ms)
✔ pi: a relative path climbs from the real path of a dataRoot behind a symlink (326.345085ms)
✔ pi: a missing extension refuses before any model call (6.312682ms)
✔ pi: an extension without its configuration fails pi's start (261.493585ms)
✔ founderCheck: founder variables, then a needed service without a usable token (1.528502ms)
✔ turnRequest names the sender, class, reply and decision (0.319212ms)
✔ turnRequest says a tester's message is a test and never Jason's instruction (0.403113ms)
✔ turnRequest shows the message's own sent time, a day old as well as new (0.222456ms)
✔ stateBlock names the launch state with its time and event, and the open tasks with the cap (0.310521ms)
✔ a message becomes a turn, the answer goes back as a RESULT, SIGTERM releases and exits 0 (185.974022ms)
✔ launches revoked and then restored: the turn's block reads allowed and gives the restore time (171.652592ms)
✔ a task closed on the tracker is missing from the next turn's open list (166.782441ms)
✔ a message read a day after it was sent shows the time it was sent (87.57929ms)
✔ a decision the human resolves becomes a turn citing the decision and the answer (139.635332ms)
✔ a failed state read fails the turn: no adapter runs, the sender hears why, the message is read (61.104061ms)
✔ a SIGTERM before the claim stops the runner with exit 0 and no claim (47.607343ms)
✔ typed tools carry the runner's capability; launch goes to the host's launch socket (272.352677ms)
✔ a RESULT gets no automatic reply; failed turns reply with the reason (1198.776392ms)
✔ SIGTERM during a turn kills the turn's process group and still exits 0 (91.430313ms)
✔ founder credentials stop before the claim (20) (87.502247ms)
✔ a refused claim exits 21; an ended run's capability exits 22 (93.152481ms)
✔ the launch ending under a running session exits 22 (99.236711ms)
✔ a broker that stays unreachable exits 23 after brokerRetries polls (198.872413ms)
✔ a broker that is down at the claim exits 23, not 21 (41.195479ms)
✔ no capability, or a malformed one, on stdin exits 2 (149.836151ms)
✔ a missing or malformed policy exits 2 before the claim (76.42916ms)
✔ the PM gets its task verbs and the reads, and no launch (7.827216ms)
✔ the chief of staff gets launch and send_message, and no task verbs (2.07883ms)
✔ the assistant gets send_message and the reads, no launch (2.87548ms)
✔ list_requirements reads the requirement ids, for a task.create holder with a tracker (3.712297ms)
✔ a coder gets no launch, no resolve_decision, and no task tools without a tracker (1.429638ms)
✔ a coder with a tracker gets its own task tools and no task_reassign (1.364158ms)
✔ launch only when the business's launch block names the instance as launcher (2.561627ms)
✔ an action outside the instance's authority has no tool (1.939242ms)
✔ the review loop: push_working and request_review for the coder, fetch_review and review_verdict for the reviewer, none for the PM (4.055555ms)
✔ callTool: one JSON line out, the result back, a refusal rejects (8.459192ms)
✔ list_tasks takes the broker's filters and pages; get_task takes a task_ref (2.983741ms)
✔ callTool sends list_tasks done false unless the session names done; other tools as given (2.57943ms)
✔ replyText: compact JSON up to the cap, an error naming the size and the cap over it (0.875027ms)
ℹ tests 84
ℹ suites 0
ℹ pass 84
@@ -89,4 +89,4 @@
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 10745.981848
ℹ duration_ms 10555.418024
agents/researcher/work/queue-120/suites/seat.txt
+133 -133
View File
@@ -1,140 +1,140 @@
✔ a first launch clones the root at its branch, with the root's path as origin (43.404857ms)
✔ the clone is not at its place until git clone has finished (27.564982ms)
✔ a later launch fast-forwards a clean clone after a commit to the root, then finds it current (82.634971ms)
✔ a clone ahead of the root keeps its commits and counts as current (50.054047ms)
✔ a first launch clones the root at its branch, with the root's path as origin (33.552844ms)
✔ the clone is not at its place until git clone has finished (21.357309ms)
✔ a later launch fast-forwards a clean clone after a commit to the root, then finds it current (60.619091ms)
✔ a clone ahead of the root keeps its commits and counts as current (36.011997ms)
▶ a dirty clone and one on another branch are fetched, and nothing but refs/remotes moves
✔ a modified file (55.814391ms)
✔ an untracked file (51.957487ms)
✔ a staged file (53.241086ms)
✔ another branch (48.096881ms)
✔ a detached HEAD (53.963358ms)
✔ a dirty clone and one on another branch are fetched, and nothing but refs/remotes moves (264.380479ms)
✔ a diverged clone gets the fetch into refs/remotes and is kept, not-fast-forward (55.256863ms)
✔ a modified file (42.530728ms)
✔ an untracked file (42.124706ms)
✔ a staged file (43.676612ms)
✔ another branch (42.197058ms)
✔ a detached HEAD (41.840106ms)
✔ a dirty clone and one on another branch are fetched, and nothing but refs/remotes moves (213.480486ms)
✔ a diverged clone gets the fetch into refs/remotes and is kept, not-fast-forward (42.008062ms)
▶ a clone kept before the branch check, or for a failed status, gets no fetch
✔ not-a-clone (27.388417ms)
✔ hooks-present (30.693498ms)
✔ submodule (49.263341ms)
✔ config-changed (38.339207ms)
✔ root-unreadable (32.680873ms)
✔ root-detached (41.767031ms)
✔ status-failed, on the root's branch and clean (45.765674ms)
✔ status-failed, dirty (45.56937ms)
✔ a clone kept before the branch check, or for a failed status, gets no fetch (313.275551ms)
✔ a dirty clone whose fetch fails is kept, fetch-failed, exactly as it was (54.730505ms)
✔ every git call the host makes, for a new clone and an existing one, carries maintenance.auto=false and gc.auto=0 (62.197275ms)
✔ a clone with loose objects enough for gc --auto gets no maintenance or gc from the fetch and the merge (93.44514ms)
✔ not-a-clone (22.898807ms)
✔ hooks-present (24.744247ms)
✔ submodule (30.97533ms)
✔ config-changed (27.177655ms)
✔ root-unreadable (27.194934ms)
✔ root-detached (32.569047ms)
✔ status-failed, on the root's branch and clean (35.353023ms)
✔ status-failed, dirty (35.561757ms)
✔ a clone kept before the branch check, or for a failed status, gets no fetch (237.729167ms)
✔ a dirty clone whose fetch fails is kept, fetch-failed, exactly as it was (37.495882ms)
✔ every git call the host makes, for a new clone and an existing one, carries maintenance.auto=false and gc.auto=0 (44.926622ms)
✔ a clone with loose objects enough for gc --auto gets no maintenance or gc from the fetch and the merge (71.501164ms)
▶ a clone with user.name or user.email in its config is kept, and git runs nothing in it
✔ user.name (33.651838ms)
✔ user.email (31.234936ms)
✔ a clone with user.name or user.email in its config is kept, and git runs nothing in it (65.452353ms)
✔ a commit git can't read after the fast-forward is null (53.1729ms)
✔ a new clone whose commit can't be read refuses the launch and leaves nothing behind (21.808732ms)
✔ user.name (24.660156ms)
✔ user.email (25.572793ms)
✔ a clone with user.name or user.email in its config is kept, and git runs nothing in it (50.667636ms)
✔ a commit git can't read after the fast-forward is null (46.109986ms)
✔ a new clone whose commit can't be read refuses the launch and leaves nothing behind (17.999275ms)
▶ a clone the session rigged is kept, and git runs nothing and writes nothing outside it
✔ core.fsmonitor (39.891688ms)
✔ core.hooksPath (38.470916ms)
✔ a hook file (38.185371ms)
✔ include.path (37.783747ms)
✔ includeIf (39.256286ms)
✔ a filter driver (38.72543ms)
✔ origin moved (39.223475ms)
✔ a second origin url (38.093661ms)
✔ the origin url twice, both the root (45.909975ms)
✔ an ext:: origin (52.07397ms)
✔ a branch tracking another remote (40.216865ms)
✔ a branch merging a tag (41.118033ms)
✔ a fetch line onto local branches (45.71208ms)
✔ no origin (39.822309ms)
✔ a config file over the size cap (35.792902ms)
✔ config a symlink to /dev/zero (36.893189ms)
✔ the clone a symlink to the bait (36.9515ms)
✔ the clone a file (38.850721ms)
✔ the clone a plain directory (36.559539ms)
✔ .git a gitdir: file (37.751367ms)
✔ .git a symlink (36.566473ms)
✔ .git/logs a symlink (37.161928ms)
✔ .git/refs/heads a symlink (36.12055ms)
✔ .git/objects a symlink (40.875677ms)
✔ a reflog hard-linked to a file outside (35.505026ms)
✔ HEAD a fifo (38.967347ms)
✔ a commondir file (39.282462ms)
✔ an alternates file (36.477766ms)
✔ a gitlink staged, no .gitmodules (51.117722ms)
✔ a gitlink and .gitmodules staged (51.964361ms)
✔ a gitlink to a repository with its own gitlink (60.573909ms)
✔ a gitlink and .gitmodules committed (55.97076ms)
✔ a gitlink and submodule.active in config (53.202678ms)
✔ a .git/modules with no gitlink (38.553537ms)
✔ a clone the session rigged is kept, and git runs nothing and writes nothing outside it (1414.761528ms)
✔ core.fsmonitor (32.57725ms)
✔ core.hooksPath (33.576352ms)
✔ a hook file (30.523932ms)
✔ include.path (32.732065ms)
✔ includeIf (32.915157ms)
✔ a filter driver (33.504955ms)
✔ origin moved (32.81282ms)
✔ a second origin url (32.413995ms)
✔ the origin url twice, both the root (33.687667ms)
✔ an ext:: origin (32.955406ms)
✔ a branch tracking another remote (33.192575ms)
✔ a branch merging a tag (33.998262ms)
✔ a fetch line onto local branches (32.638391ms)
✔ no origin (34.625453ms)
✔ a config file over the size cap (31.291322ms)
✔ config a symlink to /dev/zero (30.299051ms)
✔ the clone a symlink to the bait (31.992008ms)
✔ the clone a file (30.446335ms)
✔ the clone a plain directory (30.192965ms)
✔ .git a gitdir: file (29.936614ms)
✔ .git a symlink (30.395246ms)
✔ .git/logs a symlink (30.890931ms)
✔ .git/refs/heads a symlink (30.938526ms)
✔ .git/objects a symlink (30.480664ms)
✔ a reflog hard-linked to a file outside (30.973693ms)
✔ HEAD a fifo (31.066319ms)
✔ a commondir file (31.009465ms)
✔ an alternates file (29.853099ms)
✔ a gitlink staged, no .gitmodules (43.121737ms)
✔ a gitlink and .gitmodules staged (44.308351ms)
✔ a gitlink to a repository with its own gitlink (51.884772ms)
✔ a gitlink and .gitmodules committed (47.397324ms)
✔ a gitlink and submodule.active in config (44.866017ms)
✔ a .git/modules with no gitlink (32.873979ms)
✔ a clone the session rigged is kept, and git runs nothing and writes nothing outside it (1160.746313ms)
▶ a root that can't be cloned refuses with the project id and leaves nothing behind
✔ missing (12.458554ms)
✔ not a repository (12.839438ms)
✔ a plain directory inside another repository (18.321853ms)
✔ unreadable (11.43209ms)
✔ on no branch (14.339871ms)
✔ missing an object (18.353125ms)
✔ a root that can't be cloned refuses with the project id and leaves nothing behind (88.967302ms)
✔ a clone whose root is on no branch, or gone, is kept and named (33.925065ms)
✔ no credential or forge remote of the root reaches a clone (55.220367ms)
✔ every project in the business file gets its own clone at its own branch (39.77505ms)
✔ a clone past its time gets SIGTERM and refuses the launch, with nothing left in the workspace (516.218149ms)
✔ a clone that ignores SIGTERM gets SIGKILL once the grace period is over (1019.594421ms)
✔ a timeout signals git's process group, so a process git started dies with it (518.507345ms)
✔ once a signalled git has closed, its group gets SIGKILL, so a process that ignored SIGTERM dies too (517.042897ms)
✔ RUNNER_FILES is exactly what the runner and the harness sources it starts import (1.859159ms)
✔ sandboxProblem names a missing bwrap and a bwrap that fails (9.624115ms)
✔ every bind says why; the bundle and session file stay read-only over the run directory (1.451475ms)
✔ the host's git socket is bound only when given, read-only and before the writable binds (0.963571ms)
✔ the git identity is the instance's, at <instance>@<business>.mosaic.invalid, and sandboxArgv refuses without it (1.438803ms)
✔ a confined session's shell reaches its own workspace and run directory and nothing of the founder's or another session's (1842.958863ms)
✔ a bind that exposes a stand-in, or a missing workspace bind, fails the matching check (2887.39789ms)
✔ a confined session that runs tester-cli.mjs is refused as tester, and the same shim outside the sandbox binds (215.841802ms)
✔ resolveSeat: by name under --repo resolves the repo layout (1.643297ms)
✔ resolveSeat: by path resolves the fleet layout (0.407826ms)
✔ resolveSeat: refusals for missing dir, missing launch.sh, non-executable launch.sh, invalid name, and unknown layout (0.764288ms)
✔ tmuxContext: outside tmux, default socket, custom socket, and exec failure (0.703689ms)
✔ makeRegistration produces a record that validates; each shape violation throws SeatError (0.899822ms)
✔ writeRegistration/readRegistration: round trip, permissions, absence, and malformed records (1.618498ms)
✔ updateTask: changes task, taskSetBy and updatedAt only, and refuses appropriately (1.39823ms)
✔ CLI launch: registers, execs the fake launch script, and passes args through (33.906101ms)
✔ CLI launch: --harness lands in the record (33.936108ms)
✔ CLI launch: the launch script's own exit code passes through (44.133685ms)
✔ CLI launch: relaunching a seat rewrites the one registration record (76.521405ms)
✔ CLI launch: omitting --task records an empty string, not null (32.253603ms)
✔ CLI seat task: updates only the task after a launch, and refuses on an unlaunched seat (93.240228ms)
✔ CLI refusals: no args, unknown flag, missing config, already-registered env, and exec failure (149.786589ms)
✔ samePath: equal paths, symlinked dirs, distinct dirs, and non-strings (0.502607ms)
✔ resolveSetBy: explicit --by wins over the environment; absent or empty environment gives unknown; invalid explicit or environment values refuse with exit 4 (0.859748ms)
✔ validateRegistration/readRegistration: taskSetBy is optional; a record without it (written before #1511) still loads unchanged; an invalid one is refused; the version does not change (0.906078ms)
✔ updateTask: records setBy, preserves startedAt and every unrelated field, upgrades an old record in place only when the task is set, and replaces a previous attribution (1.050485ms)
✔ CLI seat task: --by beats MOSAIC_AGENT_NAME, the environment beats nothing, empty environment is unknown, invalid --by or environment refuses with exit 4 and leaves the record byte for byte (312.028942ms)
✔ family: exactly one launch.max key in the model name, else null (0.759209ms)
✔ sessionEnv passes only the allowlist, the repo's bin on PATH, and the run id (0.76273ms)
✔ sessionExit gives a runner's signal death back as the signal; a session credential is one whole set of nonempty variables (0.300908ms)
✔ newRun: short ids, 0700 directories, and a refusal when the socket path won't fit (1.682661ms)
✔ session file and launch log: 0600, the session file written once (1.14756ms)
✔ endReason maps the runner's exit codes; a signal is killed (0.118692ms)
✔ Registry mirrors to sessions.json; readSessions marks live entries; bad files refuse (1.2617ms)
✔ stopSession refuses an unknown run, reports a stale one, and won't signal a pid that isn't a runner (1.277834ms)
✔ a session runs in its sandbox as pid 1 of its namespace, claims, answers, and stops on mosaic stop (248.955506ms)
✔ workRef and validBranch take only what a ref name can hold (1.430498ms)
✔ a push lands as the task's work ref, a fast-forward lands after it, and main is the root's (131.943134ms)
✔ a rewritten branch refuses non-fast-forward and the work ref stays (112.262522ms)
✔ a branch with no history in common with main refuses unrelated-history (54.785663ms)
✔ a bundle that needs commits the working repository lacks refuses missing-prerequisite (45.354562ms)
✔ main is fetched from the root again before each push, so a clone of a newer root pushes (113.360079ms)
✔ a root moved back after the clone leaves the push's base unknown: missing-prerequisite (76.724472ms)
✔ a commit with a broken object refuses invalid-bundle, and only because fsck is on (81.551961ms)
✔ only a v2 bundle with the named branch is read (61.52326ms)
✔ a branch named main, or named for another task, moves only this task's work ref (91.420396ms)
✔ a record that throws moves the work ref back, or removes a new one (137.536251ms)
✔ a work ref that can't go back refuses rollback-failed, naming the ref and the commit (396.410578ms)
✔ a root that can't be read refuses root-unreadable (32.319413ms)
✔ a git past its time gets SIGTERM, leaves no ref lock, and the next push lands (2128.687725ms)
✔ a git that ignores SIGTERM gets SIGKILL once the grace period is over (1032.500747ms)
✔ a working repository path that isn't a directory refuses (28.304368ms)
✔ review bundles a pushed commit as refs/mosaic/review, leaving out what the reviewer has (132.338564ms)
✔ review of a project with no working repository refuses unknown-commit (16.327165ms)
✔ the runner's git tools hold the host's limits and branch rule (1.220025ms)
✔ missing (9.933032ms)
✔ not a repository (9.987851ms)
✔ a plain directory inside another repository (14.11272ms)
✔ unreadable (9.986188ms)
✔ on no branch (12.528563ms)
✔ missing an object (14.767569ms)
✔ a root that can't be cloned refuses with the project id and leaves nothing behind (72.109145ms)
✔ a clone whose root is on no branch, or gone, is kept and named (27.256122ms)
✔ no credential or forge remote of the root reaches a clone (46.238388ms)
✔ every project in the business file gets its own clone at its own branch (33.479003ms)
✔ a clone past its time gets SIGTERM and refuses the launch, with nothing left in the workspace (513.276061ms)
✔ a clone that ignores SIGTERM gets SIGKILL once the grace period is over (1016.517001ms)
✔ a timeout signals git's process group, so a process git started dies with it (514.518862ms)
✔ once a signalled git has closed, its group gets SIGKILL, so a process that ignored SIGTERM dies too (514.029855ms)
✔ RUNNER_FILES is exactly what the runner and the harness sources it starts import (1.63019ms)
✔ sandboxProblem names a missing bwrap and a bwrap that fails (8.441761ms)
✔ every bind says why; the bundle and session file stay read-only over the run directory (1.29757ms)
✔ the host's git socket is bound only when given, read-only and before the writable binds (0.634349ms)
✔ the git identity is the instance's, at <instance>@<business>.mosaic.invalid, and sandboxArgv refuses without it (1.055506ms)
✔ a confined session's shell reaches its own workspace and run directory and nothing of the founder's or another session's (1620.333217ms)
✔ a bind that exposes a stand-in, or a missing workspace bind, fails the matching check (2670.815839ms)
✔ a confined session that runs tester-cli.mjs is refused as tester, and the same shim outside the sandbox binds (204.117293ms)
✔ resolveSeat: by name under --repo resolves the repo layout (1.237871ms)
✔ resolveSeat: by path resolves the fleet layout (0.33214ms)
✔ resolveSeat: refusals for missing dir, missing launch.sh, non-executable launch.sh, invalid name, and unknown layout (0.703599ms)
✔ tmuxContext: outside tmux, default socket, custom socket, and exec failure (0.647498ms)
✔ makeRegistration produces a record that validates; each shape violation throws SeatError (0.790374ms)
✔ writeRegistration/readRegistration: round trip, permissions, absence, and malformed records (1.324706ms)
✔ updateTask: changes task, taskSetBy and updatedAt only, and refuses appropriately (1.568514ms)
✔ CLI launch: registers, execs the fake launch script, and passes args through (26.985779ms)
✔ CLI launch: --harness lands in the record (29.370821ms)
✔ CLI launch: the launch script's own exit code passes through (27.284373ms)
✔ CLI launch: relaunching a seat rewrites the one registration record (55.670527ms)
✔ CLI launch: omitting --task records an empty string, not null (26.858493ms)
✔ CLI seat task: updates only the task after a launch, and refuses on an unlaunched seat (86.828368ms)
✔ CLI refusals: no args, unknown flag, missing config, already-registered env, and exec failure (129.463959ms)
✔ samePath: equal paths, symlinked dirs, distinct dirs, and non-strings (0.373659ms)
✔ resolveSetBy: explicit --by wins over the environment; absent or empty environment gives unknown; invalid explicit or environment values refuse with exit 4 (0.663289ms)
✔ validateRegistration/readRegistration: taskSetBy is optional; a record without it (written before #1511) still loads unchanged; an invalid one is refused; the version does not change (0.68614ms)
✔ updateTask: records setBy, preserves startedAt and every unrelated field, upgrades an old record in place only when the task is set, and replaces a previous attribution (0.846341ms)
✔ CLI seat task: --by beats MOSAIC_AGENT_NAME, the environment beats nothing, empty environment is unknown, invalid --by or environment refuses with exit 4 and leaves the record byte for byte (252.775575ms)
✔ REQ-LIMIT-1: family substring matching is no longer exported (0.707648ms)
✔ sessionEnv passes only the allowlist, the repo's bin on PATH, and the run id (0.659391ms)
✔ sessionExit gives a runner's signal death back as the signal; a session credential is one whole set of nonempty variables (0.235542ms)
✔ newRun: short ids, 0700 directories, and a refusal when the socket path won't fit (1.456715ms)
✔ session file and launch log: 0600, the session file written once (0.988803ms)
✔ endReason maps the runner's exit codes; a signal is killed (0.116203ms)
✔ Registry mirrors to sessions.json; readSessions marks live entries; bad files refuse (1.226757ms)
✔ stopSession refuses an unknown run, reports a stale one, and won't signal a pid that isn't a runner (1.073205ms)
✔ a session runs in its sandbox as pid 1 of its namespace, claims, answers, and stops on mosaic stop (241.495141ms)
✔ workRef and validBranch take only what a ref name can hold (1.091323ms)
✔ a push lands as the task's work ref, a fast-forward lands after it, and main is the root's (100.352106ms)
✔ a rewritten branch refuses non-fast-forward and the work ref stays (83.354922ms)
✔ a branch with no history in common with main refuses unrelated-history (44.577403ms)
✔ a bundle that needs commits the working repository lacks refuses missing-prerequisite (38.25294ms)
✔ main is fetched from the root again before each push, so a clone of a newer root pushes (92.715993ms)
✔ a root moved back after the clone leaves the push's base unknown: missing-prerequisite (60.743579ms)
✔ a commit with a broken object refuses invalid-bundle, and only because fsck is on (60.074822ms)
✔ only a v2 bundle with the named branch is read (44.362975ms)
✔ a branch named main, or named for another task, moves only this task's work ref (73.187733ms)
✔ a record that throws moves the work ref back, or removes a new one (100.62447ms)
✔ a work ref that can't go back refuses rollback-failed, naming the ref and the commit (312.86981ms)
✔ a root that can't be read refuses root-unreadable (27.354059ms)
✔ a git past its time gets SIGTERM, leaves no ref lock, and the next push lands (2112.555418ms)
✔ a git that ignores SIGTERM gets SIGKILL once the grace period is over (1027.350868ms)
✔ a working repository path that isn't a directory refuses (24.763506ms)
✔ review bundles a pushed commit as refs/mosaic/review, leaving out what the reviewer has (98.378491ms)
✔ review of a project with no working repository refuses unknown-commit (13.405084ms)
✔ the runner's git tools hold the host's limits and branch rule (1.177668ms)
ℹ tests 132
ℹ suites 0
ℹ pass 132
@@ -142,4 +142,4 @@
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 5459.944449
ℹ duration_ms 4862.151734
agents/researcher/work/queue-120/suites/tasks.txt
+93 -93
View File
@@ -1,95 +1,95 @@
✔ the boot config is checked before anything starts (25.781318ms)
✔ a business with no tracker entry refuses task verbs (17.508069ms)
✔ credential.expiring and .expired are recorded once per instance (37.706391ms)
✔ a token file that changes on disk records credential.changed (17.768487ms)
✔ autostart polls, reconciles and retries a startup the tracker was down for (42.257219ms)
✔ a refusal a restart must clear is not retried by the poll (13.768382ms)
✔ a poll that fires while two are queued is dropped (16.150669ms)
✔ close waits for a running verb and refuses one that has not started (53.742099ms)
✔ the bundled Vikunja is the pinned upstream image the runbook names (1.024956ms)
✔ every published port is on 127.0.0.1, and no secret is in the file (0.734362ms)
✔ the committed table loads frozen; its verbs are the broker task verbs (3.023018ms)
✔ a write names a verb the table has as its own key, not one it inherits (1.03756ms)
✔ the schema refuses any other shape (5.14694ms)
✔ the Field table in the slice 1 plan names the verbs each field is written by (1.226542ms)
✔ each verb refuses, asks for a decision and writes as the table and the role files say (249.859558ms)
✔ the list holds the PRD's requirement ids, in its order, at its version (2.254163ms)
✔ the committed list loads frozen (1.247074ms)
✔ the schema refuses any other shape (6.356786ms)
✔ the fake answers each route with the statuses and shapes Vikunja v2.7.0 sent (126.555819ms)
✔ the project list holds recorded project objects in the recorded list envelope (13.500261ms)
✔ the recorded task bodies pass the checks S3 applies to every read (0.574667ms)
✔ the client works against the fake over real HTTP with the platform fetch (131.415103ms)
✔ a correct install starts, and the first reconcile records tasks that already exist (37.744797ms)
✔ verbs refuse while a business is starting and after startup refused it (19.578388ms)
✔ startup refuses a token that can do more than its role needs (49.362086ms)
✔ startup refuses an unsupported version and flags an untested one (39.671867ms)
✔ startup refuses a board that the runbook did not install (49.617591ms)
✔ startup refuses a project the sync bot cannot read (12.586776ms)
✔ startup refuses a configured label the pm bot cannot see (12.607427ms)
✔ startup refuses an expired credential and a missing sync credential (19.620313ms)
✔ an unreachable tracker refuses with tracker-unavailable (9.644199ms)
✔ an edit in the UI is recorded once, with the fields that changed (92.127393ms)
✔ a move between open buckets is seen on the board, though updated does not change (46.844419ms)
✔ a person's comment is counted and a bot's is not (82.334504ms)
✔ the hourly reconcile catches a comment through comment_count (87.307151ms)
✔ a task closed in the UI leaves the open view with its done bucket (120.199919ms)
✔ a task that leaves the board is recorded as deleted, moved or out of reach (70.901013ms)
✔ a poll that read before a verb wrote does not overwrite the verb (42.364137ms)
✔ a tracker fault during a tick is reported and the next tick catches up (37.188458ms)
✔ a malformed answer refuses the tick with tracker-shape (13.932165ms)
✔ no token value reaches the database, the log or a refusal (50.334001ms)
✔ the first look at a task counts only comments inside the window (34.537002ms)
✔ with descendants off the adapter reads no project list and no child, as in v0 (54.761806ms)
✔ a three-level tree is read per project, and a project outside it is not (26.431563ms)
✔ a watch-only child keeps the business ready, and a failed child read refuses as transient (31.736429ms)
✔ a root without the installed buckets refuses with descendants on (12.711468ms)
✔ the project list refuses without read_all, and skips archived projects and saved filters (31.050596ms)
✔ descendants must be true or false (13.456072ms)
✔ a move inside the tree is a moved tombstone plus a snapshot under the new ref (69.89001ms)
✔ a child made after startup joins the tree at the next reconcile (58.337455ms)
✔ a child that leaves the tree has its tasks recorded missing, and the ledger keeps their history (62.372931ms)
✔ a child deleted or hidden between reconciles drops out at the next tick, and the root still refuses (87.445447ms)
✔ a reconcile that fails keeps the previous tree (37.978164ms)
✔ a closed task the cursor missed takes its own project's done bucket (39.188431ms)
✔ closed tasks read at startup take their own project's done bucket (11.935044ms)
✔ a closed task the cursor returns takes its own project's done bucket (36.961131ms)
✔ a task moved out of a child that leaves the tree at the same time is moved, not no-access (34.029839ms)
✔ a task in a bucket outside the five keeps its raw bucket id (31.570071ms)
✔ bucket 0 on a watch-only task never becomes a bucket or a state (79.409698ms)
✔ a child whose kanban view is deleted still refuses the tick, and the reconcile reads it watch-only (57.745456ms)
✔ a child dropped at a tick comes back at the next reconcile once the bot reads it again (34.754159ms)
✔ task.create needs a recorded human request and a requirement id (55.066915ms)
✔ task.create takes only an approved requirement id (30.665227ms)
✔ task.create cites the request a received message carries, not the message's id (24.081762ms)
✔ only labels named in the business file can be written (39.334465ms)
✔ task.schedule sets and clears a due date and relations (45.777395ms)
✔ assign and reassign move the role bots and record task.assigned (68.753853ms)
✔ task.update.assigned is for the assignee and records task.state (53.099643ms)
✔ a wrong expected digest records task.conflict and writes nothing (19.845705ms)
✔ a cross-role verb needs a resolved decision, used once (25.311339ms)
✔ task.close needs a verdict; after it every verb refuses with task-done (27.567547ms)
✔ a task with pushed work closes only citing an approve verdict for its latest push, and a refusal writes nothing (36.52325ms)
✔ a lost answer is settled by a re-read and never retried (30.529512ms)
✔ a create whose answer is lost is reported uncertain, and the poll finds the task (43.212972ms)
✔ a task the sync bot cannot read refuses and records nothing (19.876207ms)
✔ verbs and polls for one business run one at a time (93.692392ms)
✔ a due date with milliseconds is written to the second (65.837523ms)
✔ every write landed and the final read failed: the verb succeeds and records what it wrote (38.157924ms)
✔ some writes landed and the final read failed: write-uncertain, and nothing is recorded (14.680481ms)
✔ a create whose final read fails succeeds and records task.created (33.553686ms)
✔ an edit between the last write and the final read shows as external on the next poll (35.950536ms)
✔ task.created is recorded when a later label write fails (12.424119ms)
✔ every verb acts in an installed child, on the child's own board (47.068002ms)
✔ task.create refuses a project outside the tree, a watch-only one and one that is not an id (24.211461ms)
✔ with descendants off, task.create takes only the root project (12.415245ms)
✔ a verb on a watch-only task, or a relation to one, refuses with project-not-installed (17.815602ms)
✔ a related task is read before authority: in another project than its ref names, task-moved; missing, task-not-found (23.59126ms)
✔ a task moved to another project of the tree refuses its old ref with task-moved and takes its new one (16.31585ms)
✔ a verb and a create in the child record the final read of the child's board (14.544316ms)
✔ a create in the child whose final read fails records the child's todo bucket (34.602144ms)
✔ a lost answer in the child is settled by a re-read of the child's board (20.233963ms)
✔ every related task is read before authority, not only the first (16.821789ms)
✔ the boot config is checked before anything starts (15.500787ms)
✔ a business with no tracker entry refuses task verbs (13.542062ms)
✔ credential.expiring and .expired are recorded once per instance (26.618393ms)
✔ a token file that changes on disk records credential.changed (12.714535ms)
✔ autostart polls, reconciles and retries a startup the tracker was down for (35.973981ms)
✔ a refusal a restart must clear is not retried by the poll (9.756308ms)
✔ a poll that fires while two are queued is dropped (12.389276ms)
✔ close waits for a running verb and refuses one that has not started (42.778958ms)
✔ the bundled Vikunja is the pinned upstream image the runbook names (0.786007ms)
✔ every published port is on 127.0.0.1, and no secret is in the file (0.272259ms)
✔ the committed table loads frozen; its verbs are the broker task verbs (1.383461ms)
✔ a write names a verb the table has as its own key, not one it inherits (0.514077ms)
✔ the schema refuses any other shape (3.705609ms)
✔ the Field table in the slice 1 plan names the verbs each field is written by (0.954802ms)
✔ each verb refuses, asks for a decision and writes as the table and the role files say (167.415152ms)
✔ the list holds the PRD's requirement ids, in its order, at its version (1.324621ms)
✔ the committed list loads frozen (0.603952ms)
✔ the schema refuses any other shape (2.542274ms)
✔ the fake answers each route with the statuses and shapes Vikunja v2.7.0 sent (90.166981ms)
✔ the project list holds recorded project objects in the recorded list envelope (9.471179ms)
✔ the recorded task bodies pass the checks S3 applies to every read (0.421904ms)
✔ the client works against the fake over real HTTP with the platform fetch (98.86827ms)
✔ a correct install starts, and the first reconcile records tasks that already exist (27.306667ms)
✔ verbs refuse while a business is starting and after startup refused it (14.315873ms)
✔ startup refuses a token that can do more than its role needs (37.603075ms)
✔ startup refuses an unsupported version and flags an untested one (30.585174ms)
✔ startup refuses a board that the runbook did not install (38.658445ms)
✔ startup refuses a project the sync bot cannot read (7.768892ms)
✔ startup refuses a configured label the pm bot cannot see (10.004989ms)
✔ startup refuses an expired credential and a missing sync credential (13.490781ms)
✔ an unreachable tracker refuses with tracker-unavailable (7.00632ms)
✔ an edit in the UI is recorded once, with the fields that changed (78.154024ms)
✔ a move between open buckets is seen on the board, though updated does not change (40.70971ms)
✔ a person's comment is counted and a bot's is not (70.058778ms)
✔ the hourly reconcile catches a comment through comment_count (77.126298ms)
✔ a task closed in the UI leaves the open view with its done bucket (109.935577ms)
✔ a task that leaves the board is recorded as deleted, moved or out of reach (62.476863ms)
✔ a poll that read before a verb wrote does not overwrite the verb (33.317147ms)
✔ a tracker fault during a tick is reported and the next tick catches up (33.864532ms)
✔ a malformed answer refuses the tick with tracker-shape (10.932803ms)
✔ no token value reaches the database, the log or a refusal (43.754126ms)
✔ the first look at a task counts only comments inside the window (34.464309ms)
✔ with descendants off the adapter reads no project list and no child, as in v0 (45.193593ms)
✔ a three-level tree is read per project, and a project outside it is not (19.384003ms)
✔ a watch-only child keeps the business ready, and a failed child read refuses as transient (24.111508ms)
✔ a root without the installed buckets refuses with descendants on (9.809497ms)
✔ the project list refuses without read_all, and skips archived projects and saved filters (23.021343ms)
✔ descendants must be true or false (9.28786ms)
✔ a move inside the tree is a moved tombstone plus a snapshot under the new ref (61.195676ms)
✔ a child made after startup joins the tree at the next reconcile (53.066535ms)
✔ a child that leaves the tree has its tasks recorded missing, and the ledger keeps their history (55.247848ms)
✔ a child deleted or hidden between reconciles drops out at the next tick, and the root still refuses (81.460698ms)
✔ a reconcile that fails keeps the previous tree (32.889119ms)
✔ a closed task the cursor missed takes its own project's done bucket (31.746927ms)
✔ closed tasks read at startup take their own project's done bucket (8.813051ms)
✔ a closed task the cursor returns takes its own project's done bucket (32.46842ms)
✔ a task moved out of a child that leaves the tree at the same time is moved, not no-access (31.634595ms)
✔ a task in a bucket outside the five keeps its raw bucket id (30.237967ms)
✔ bucket 0 on a watch-only task never becomes a bucket or a state (79.213451ms)
✔ a child whose kanban view is deleted still refuses the tick, and the reconcile reads it watch-only (56.381646ms)
✔ a child dropped at a tick comes back at the next reconcile once the bot reads it again (34.0052ms)
✔ task.create needs a recorded human request and a requirement id (37.645323ms)
✔ task.create takes only an approved requirement id (22.978689ms)
✔ task.create cites the request a received message carries, not the message's id (18.478707ms)
✔ only labels named in the business file can be written (26.725862ms)
✔ task.schedule sets and clears a due date and relations (36.515117ms)
✔ assign and reassign move the role bots and record task.assigned (55.701767ms)
✔ task.update.assigned is for the assignee and records task.state (45.127552ms)
✔ a wrong expected digest records task.conflict and writes nothing (16.338081ms)
✔ a cross-role verb needs a resolved decision, used once (23.533949ms)
✔ task.close needs a verdict; after it every verb refuses with task-done (20.642026ms)
✔ a task with pushed work closes only citing an approve verdict for its latest push, and a refusal writes nothing (27.114027ms)
✔ a lost answer is settled by a re-read and never retried (22.727487ms)
✔ a create whose answer is lost is reported uncertain, and the poll finds the task (34.485713ms)
✔ a task the sync bot cannot read refuses and records nothing (15.585188ms)
✔ verbs and polls for one business run one at a time (84.148728ms)
✔ a due date with milliseconds is written to the second (61.126359ms)
✔ every write landed and the final read failed: the verb succeeds and records what it wrote (36.723541ms)
✔ some writes landed and the final read failed: write-uncertain, and nothing is recorded (12.92368ms)
✔ a create whose final read fails succeeds and records task.created (32.077456ms)
✔ an edit between the last write and the final read shows as external on the next poll (36.360434ms)
✔ task.created is recorded when a later label write fails (11.623916ms)
✔ every verb acts in an installed child, on the child's own board (43.694237ms)
✔ task.create refuses a project outside the tree, a watch-only one and one that is not an id (22.337939ms)
✔ with descendants off, task.create takes only the root project (11.266416ms)
✔ a verb on a watch-only task, or a relation to one, refuses with project-not-installed (17.116933ms)
✔ a related task is read before authority: in another project than its ref names, task-moved; missing, task-not-found (20.428612ms)
✔ a task moved to another project of the tree refuses its old ref with task-moved and takes its new one (14.527174ms)
✔ a verb and a create in the child record the final read of the child's board (12.977856ms)
✔ a create in the child whose final read fails records the child's todo bucket (33.267911ms)
✔ a lost answer in the child is settled by a re-read of the child's board (18.990072ms)
✔ every related task is read before authority, not only the first (15.766814ms)
ℹ tests 92
ℹ suites 0
ℹ pass 92
@@ -97,4 +97,4 @@
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 1171.659914
ℹ duration_ms 977.525682
agents/researcher/work/queue-120/suites/webui.txt
+116 -111
View File
@@ -1,117 +1,122 @@
✔ the Board: held roles with no machine sessions, a claim with no address, the toggle kept across a reload, and Message addressed to the role (7450.917035ms)
✔ a redirect answer on a Board read, a bus read, a conversation read, a board POST, a module read and a send signs the page out: one line, nothing stale, no further reads (6027.399527ms)
✔ browser edge states: loading, empty, malformed, stale, hostile/long values, in-flight reply and appearance fallback (5009.22866ms)
✔ the Board: held roles with no machine sessions, a claim with no address, the toggle kept across a reload, and Message addressed to the role (6426.046032ms)
✔ a redirect answer on a Board read, a bus read, a conversation read, a board POST, a module read and a send signs the page out: one line, nothing stale, no further reads (5427.295206ms)
✔ browser edge states: loading, empty, malformed, stale, hostile/long values, in-flight reply and appearance fallback (3081.372425ms)
Rendered contrast: {"failures":[],"count":330,"lowest":4.504658476260286}
✔ served Console browser: real board fixtures, keyboard, drafts, receipts, themes, 320px and failures (6684.717767ms)
✔ the README says a refused field table names the file or the key at fault, never a path (1.613208ms)
✔ S5 pages in a browser: real broker rows, inert text, Copy, routes, failures, layout and no writes (8848.968379ms)
✔ bus routes serve the four reads from the reader view, unescaped JSON for the page to escape (138.256803ms)
✔ decisions route serves the roles and recent lists from the reader view (101.782201ms)
✔ credentials route serves the broker credential status from the reader view (38.135388ms)
✔ replies route serves the replies to one message from the reader view (139.194389ms)
✔ bus routes are GET-only, have no write verb, and keep the same-origin checks (286.901522ms)
✔ bus refusals map to statuses and never carry a path or a stack (257.058587ms)
✔ humanCall speaks the human transport protocol without blocking the server (3493.646637ms)
✔ busReader takes --business, else the live bus host, else refuses (592.672538ms)
✔ humanCall kills a transport that runs past its timeout (545.114965ms)
✔ serve refuses a --business value that is not a business id (1119.36074ms)
✔ conversation view: full history, collapsed tools, hidden thinking, inert hostile content, malformed and reconcile markers (5055.64655ms)
✔ conversation view: a fork keeps the open branch, says so, and opens the new one on request (3386.620311ms)
✔ conversation view: a newer session with no readable history keeps the marker (1484.085042ms)
✔ conversation view: seats without history say so and offer no reply (1013.457164ms)
✔ Discord row through real board/WebUI: independent brake/liveness, no Reply, literal content (3781.62246ms)
✔ return flow through the conversation view: send, tool call, delayed result, peer message, exact long answers, relaunch (54795.919858ms)
✔ messages HTTP read pages and preserves metadata; bad arguments refuse before a read; other reads unchanged (177.100893ms)
✔ Console Messages lists late unsolicited messages on polling with sender class time read state and trail; nav count includes beyond the page; reads never deliver (5145.553357ms)
✔ Messages nav count polls on Tasks and Board and clears on a Board refusal; messages 403 refuses local pages (3800.760001ms)
✔ copy writes the Console paths at the full id, read-only, and leaves an existing copy alone (4357.740243ms)
✔ copy refuses a commit off refactor, an unknown one, a worktree and a bad copies directory (2951.697706ms)
✔ copy writes nothing when an archived path is missing at the commit (657.455292ms)
✔ a copy that loses the rename race leaves no read-only temp directory behind (1161.981026ms)
✔ a copy whose rename fails with no target refuses, writes no copy and leaves no temp directory (620.290167ms)
✔ a copy that meets a target holding files says exists: and moves nothing into it (741.267322ms)
✔ a copy that meets an empty target directory replaces it by rename, not by moving into it (461.892323ms)
✔ serve runs from a copy: /healthz 200, the config check, roles and RELEASE from the copy, the queue from --checkout (920.664419ms)
✔ serve refuses a --checkout that is not an absolute directory path (238.290799ms)
✔ consoleReads runs the queue read under queueRoot and reads RELEASE under root (51.388122ms)
✔ preview options are all three or none, and each is checked (13.695009ms)
✔ the CLI refuses a partial or invalid preview flag set at start (2737.160843ms)
✔ the CLI with all three flags serves the preview mode (774.189948ms)
✔ a request for the public name needs the header equal to the user id, else 401 and nothing read (67.987951ms)
✔ the header name matches without regard to case, and the value compare is exact (8.423834ms)
✔ the public name with the header reads the bus views, and the Host and Origin are checked first (72.365765ms)
✔ in preview mode every write answers 403 read-only, from the public name and loopback, and reaches nothing (27.743392ms)
✔ loopback requests are unchanged in preview mode, and the bus views work with the board down (10.053997ms)
✔ a proxy that rewrites Host to the loopback port gets 403 on its first request, whatever the user (63.945506ms)
✔ a repeated Host is 400 before any other check, in preview mode and without it (16.007107ms)
✔ without the preview flags the public name is refused and writes still reach the board (14.249158ms)
✔ redactor: config, dataRoot, any absolute path, Discord ids and the JSON parser quote (7.818438ms)
✔ credential state from the date alone, as the bus states it (0.322931ms)
✔ queue: rows, one row, ids and methods, notes; no path or id from a row (2713.763077ms)
✔ queue: a refused read fails closed with the store's text, redacted (1062.919501ms)
✔ queue: a store that fails to load, or a child that dies, gives a fixed message with no path or stack (2563.40116ms)
✔ business: names, vars on the allowlist, authority, credential metadata only (55.707507ms)
✔ business: missing or invalid file refuses with the module's text, redacted (46.901887ms)
✔ business without --business: the live bus host, else no-bus-host; no system config: not-configured (51.987087ms)
✔ settings: release, board, loopback address, notifier binding name only (503.048136ms)
✔ task fields: the committed table with no reads configured, GET only; a bad table refuses with no path (91.768465ms)
✔ both presentations replace old activity with relaunch notice, label retained history, then resume after new activity (4056.725083ms)
✔ reported return flow and relative Age: reply sent from the inspector, then the new answer appears there without manual refresh (23593.757427ms)
✔ the send box: held roles, the draft and caret across a refresh, each receipt, one POST per Send, and the trail link; the board Reply on a 4xx and a 5xx (7305.549721ms)
✔ a sent receipt lists its replies as the page refreshes, oldest first and capped, and marks none delivered or read (11983.82136ms)
✔ startServer takes send only as a function and only with the preview mode (11.371981ms)
✔ the CLI refuses --send without the preview flags, and without a configured bus (1325.682991ms)
✔ the CLI with --send and a configured bus sends through the human transport and logs one line (502.924376ms)
✔ without --send the route is read-only like every other write, and config says no send (109.032648ms)
✔ with --send every other write is still 403 read-only, and nothing reaches the board or bus (108.168615ms)
✔ config says send only on the public name with --send on (31.037411ms)
✔ a send without the signed-in user is 401 and is neither sent nor logged, loopback included (37.343399ms)
✔ each request check refuses before anything is sent, and logs the refusal without the body (132.345868ms)
✔ a send passes exactly to, body and in_reply_to, answers the id, and logs it (19.773191ms)
✔ a crafted role name cannot forge a log line (8.624604ms)
✔ a bus refusal is not sent, with its status; an outcome the bus could not confirm is unknown and never retried (37.233355ms)
✔ through the human transport the request is exactly the business, message.send and the keys (386.840742ms)
✔ against a real broker: the message is written once as a human send, and its refusals map (129.763539ms)
✔ loopback host and board origin fail closed (28.343991ms)
✔ real board fixture passes through WebUI; assets and isolated seen/reply work (228.012193ms)
✔ proxy preserves exact request bytes, status and receipt, rejects forms and malformed JSON, never follows redirect (154.92373ms)
✔ unreachable board reports URL; CLI rejects unsupported options (1290.643505ms)
✔ render prints the unit without the preview flags (67.052587ms)
✔ render carries every serve flag, the preview set included (42.735544ms)
✔ a partial preview set is refused (99.344251ms)
✔ a value the unit cannot carry is refused, for every flag (1787.929448ms)
✔ the rendered unit names none of the human proof agent markers and sets no agent variable (180.906207ms)
✔ install into --dir with --no-reload writes the file whole, then reports unchanged (353.63869ms)
✔ install without --no-reload runs daemon-reload and nothing that starts the unit (191.787045ms)
✔ uninstall refuses while the unit is running, with or without --no-reload, and removes it once it is not (594.963695ms)
✔ status prints the unit state and GET /healthz on the installed port (622.478764ms)
✔ usage: an unknown verb or flag, and start or enable, exit 4 (302.210319ms)
✔ without --send, render is the template with its placeholders filled, byte for byte (138.262474ms)
✔ render --send with the preview set ends ExecStart with --send and changes nothing else (163.617822ms)
✔ --send without the whole preview set is refused and writes nothing (329.849117ms)
✔ install --send into --dir with --no-reload writes the sending unit, and status says whether it sends (350.11987ms)
✔ uninstall and status take no --send (45.710351ms)
✔ install refuses while the unit is running, in any state but inactive or failed, and changes nothing (381.227682ms)
✔ when the state read fails, install and uninstall refuse with one line and change nothing (107.315944ms)
✔ install needs --copy naming a copy that exists, and refuses outside the canonical checkout without --allow-worktree (141.394312ms)
✔ install refuses unless the bus unit runs from the same copy, naming both paths, and changes nothing (481.342049ms)
✔ render --copy runs the copy and reads the queue in the checkout; without --copy the unit is unchanged (19.693826ms)
✔ the uid header takes only an Authentik uid; the username header still takes a username (428.286087ms)
✔ a preview value cannot start with - or . (40.381367ms)
✔ status names the copy and whether refactor has moved past it, and says when the unit runs from no copy (495.525432ms)
✔ tokens.css and icons.svg are byte copies of docs/design (1.760157ms)
✔ JetBrains Mono files match the digests in their sources file, with the OFL text (8.883249ms)
✔ shipped strings are unchanged, and the web keeps its write boundary (4.039573ms)
✔ shell in a browser: System default, seeded states, 400px, focus and the Ctrl+K palette (7697.078635ms)
✔ five states on Board, Inbox, Tasks, Agents and Trail (2436.803941ms)
✔ Queue, Business and Settings in their five states, with no move button (4933.832887ms)
✔ seeded secrets, Discord ids and paths reach no response and no page; business refusals in the module's words (1367.213279ms)
✔ the server log names no config path when the system config refuses (314.418886ms)
ℹ tests 108
✔ served Console browser: real board fixtures, keyboard, drafts, receipts, themes, 320px and failures (3712.886327ms)
✔ the README says a refused field table names the file or the key at fault, never a path (1.333922ms)
✔ S5 pages in a browser: real broker rows, inert text, Copy, routes, failures, layout and no writes (7302.066473ms)
✔ bus routes serve the four reads from the reader view, unescaped JSON for the page to escape (145.41216ms)
✔ decisions route serves the roles and recent lists from the reader view (96.744327ms)
✔ credentials route serves the broker credential status from the reader view (31.288335ms)
✔ replies route serves the replies to one message from the reader view (143.152938ms)
✔ bus routes are GET-only, have no write verb, and keep the same-origin checks (160.980688ms)
✔ bus refusals map to statuses and never carry a path or a stack (75.979845ms)
✔ humanCall speaks the human transport protocol without blocking the server (2405.191852ms)
✔ busReader takes --business, else the live bus host, else refuses (484.627085ms)
✔ humanCall kills a transport that runs past its timeout (539.678332ms)
✔ serve refuses a --business value that is not a business id (819.868353ms)
✔ conversation view: full history, collapsed tools, hidden thinking, inert hostile content, malformed and reconcile markers (3014.897842ms)
✔ conversation view: a fork keeps the open branch, says so, and opens the new one on request (2477.352993ms)
✔ conversation view: a newer session with no readable history keeps the marker (1650.215461ms)
✔ conversation view: seats without history say so and offer no reply (851.792482ms)
✔ Discord row through real board/WebUI: independent brake/liveness, no Reply, literal content (3521.457746ms)
✔ return flow through the conversation view: send, tool call, delayed result, peer message, exact long answers, relaunch (54018.811315ms)
✔ messages HTTP read pages and preserves metadata; bad arguments refuse before a read; other reads unchanged (155.939025ms)
✔ Console Messages lists late unsolicited messages on polling with sender class time read state and trail; nav count includes beyond the page; reads never deliver (3640.369398ms)
✔ Messages nav count polls on Tasks and Board and clears on a Board refusal; messages 403 refuses local pages (3178.167319ms)
✔ copy writes the Console paths at the full id, read-only, and leaves an existing copy alone (3282.376547ms)
✔ copy refuses a commit off refactor, an unknown one, a worktree and a bad copies directory (1838.461394ms)
✔ copy writes nothing when an archived path is missing at the commit (691.986258ms)
✔ a copy that loses the rename race leaves no read-only temp directory behind (1096.68161ms)
✔ a copy whose rename fails with no target refuses, writes no copy and leaves no temp directory (709.489858ms)
✔ a copy that meets a target holding files says exists: and moves nothing into it (471.564385ms)
✔ a copy that meets an empty target directory replaces it by rename, not by moving into it (363.741159ms)
✔ serve runs from a copy: /healthz 200, the config check, roles and RELEASE from the copy, the queue from --checkout (694.077423ms)
✔ serve refuses a --checkout that is not an absolute directory path (221.216815ms)
✔ consoleReads runs the queue read under queueRoot and reads RELEASE under root (53.187734ms)
✔ preview options are all three or none, and each is checked (10.242397ms)
✔ the CLI refuses a partial or invalid preview flag set at start (2366.835967ms)
✔ the CLI with all three flags serves the preview mode (630.066428ms)
✔ a request for the public name needs the header equal to the user id, else 401 and nothing read (46.581812ms)
✔ the header name matches without regard to case, and the value compare is exact (9.486761ms)
✔ the public name with the header reads the bus views, and the Host and Origin are checked first (62.074039ms)
✔ in preview mode every write answers 403 read-only, from the public name and loopback, and reaches nothing (22.666569ms)
✔ loopback requests are unchanged in preview mode, and the bus views work with the board down (15.378642ms)
✔ a proxy that rewrites Host to the loopback port gets 403 on its first request, whatever the user (38.084279ms)
✔ a repeated Host is 400 before any other check, in preview mode and without it (14.134017ms)
✔ without the preview flags the public name is refused and writes still reach the board (8.824167ms)
✔ redactor: config, dataRoot, any absolute path, Discord ids and the JSON parser quote (1.949738ms)
✔ credential state from the date alone, as the bus states it (0.188423ms)
✔ queue: rows, one row, ids and methods, notes; no path or id from a row (1686.766207ms)
✔ queue: a refused read fails closed with the store's text, redacted (1428.912851ms)
✔ queue: a store that fails to load, or a child that dies, gives a fixed message with no path or stack (1655.118836ms)
✔ business: names, vars on the allowlist, authority, credential metadata only (96.97694ms)
✔ business: missing or invalid file refuses with the module's text, redacted (48.181732ms)
✔ business without --business: the live bus host, else no-bus-host; no system config: not-configured (34.433155ms)
✔ settings: release, board, loopback address, notifier binding name only (434.978975ms)
✔ task fields: the committed table with no reads configured, GET only; a bad table refuses with no path (79.042894ms)
✔ both presentations replace old activity with relaunch notice, label retained history, then resume after new activity (3626.717633ms)
✔ reported return flow and relative Age: reply sent from the inspector, then the new answer appears there without manual refresh (23186.98ms)
✔ the send box: held roles, the draft and caret across a refresh, each receipt, one POST per Send, and the trail link; the board Reply on a 4xx and a 5xx (5996.373788ms)
✔ a sent receipt lists its replies as the page refreshes, oldest first and capped, and marks none delivered or read (11650.600389ms)
✔ startServer takes send only as a function and only with the preview mode (12.709721ms)
✔ the CLI refuses --send without the preview flags, and without a configured bus (1018.263098ms)
✔ the CLI with --send and a configured bus sends through the human transport and logs one line (414.156253ms)
✔ without --send the route is read-only like every other write, and config says no send (31.347631ms)
✔ with --send every other write is still 403 read-only, and nothing reaches the board or bus (66.331273ms)
✔ config says send only on the public name with --send on (16.024889ms)
✔ a send without the signed-in user is 401 and is neither sent nor logged, loopback included (11.694486ms)
✔ each request check refuses before anything is sent, and logs the refusal without the body (35.672217ms)
✔ a send passes exactly to, body and in_reply_to, answers the id, and logs it (11.881841ms)
✔ a crafted role name cannot forge a log line (5.428574ms)
✔ a bus refusal is not sent, with its status; an outcome the bus could not confirm is unknown and never retried (21.161189ms)
✔ through the human transport the request is exactly the business, message.send and the keys (220.850326ms)
✔ against a real broker: the message is written once as a human send, and its refusals map (75.835423ms)
✔ loopback host and board origin fail closed (15.038909ms)
✔ real board fixture passes through WebUI; assets and isolated seen/reply work (150.739478ms)
✔ proxy preserves exact request bytes, status and receipt, rejects forms and malformed JSON, never follows redirect (71.186661ms)
✔ unreachable board reports URL; CLI rejects unsupported options (1009.675216ms)
✔ render prints the unit without the preview flags (38.276953ms)
✔ render carries every serve flag, the preview set included (17.900902ms)
✔ a partial preview set is refused (34.161746ms)
✔ a value the unit cannot carry is refused, for every flag (1224.617373ms)
✔ the rendered unit names none of the human proof agent markers and sets no agent variable (108.732842ms)
✔ install into --dir with --no-reload writes the file whole, then reports unchanged (248.13084ms)
✔ install without --no-reload runs daemon-reload and nothing that starts the unit (133.469501ms)
✔ uninstall refuses while the unit is running, with or without --no-reload, and removes it once it is not (539.877859ms)
✔ status prints the unit state and GET /healthz on the installed port (427.09619ms)
✔ usage: an unknown verb or flag, and start or enable, exit 4 (226.849405ms)
✔ without --send, render is the template with its placeholders filled, byte for byte (99.00389ms)
✔ render --send with the preview set ends ExecStart with --send and changes nothing else (193.267971ms)
✔ --send without the whole preview set is refused and writes nothing (310.153864ms)
✔ install --send into --dir with --no-reload writes the sending unit, and status says whether it sends (330.101619ms)
✔ uninstall and status take no --send (50.867742ms)
✔ install refuses while the unit is running, in any state but inactive or failed, and changes nothing (294.473859ms)
✔ when the state read fails, install and uninstall refuse with one line and change nothing (78.416684ms)
✔ install needs --copy naming a copy that exists, and refuses outside the canonical checkout without --allow-worktree (70.145811ms)
✔ install refuses unless the bus unit runs from the same copy, naming both paths, and changes nothing (203.885901ms)
✔ render --copy runs the copy and reads the queue in the checkout; without --copy the unit is unchanged (14.771726ms)
✔ the uid header takes only an Authentik uid; the username header still takes a username (295.670255ms)
✔ a preview value cannot start with - or . (25.955159ms)
✔ status names the copy and whether refactor has moved past it, and says when the unit runs from no copy (370.538001ms)
✔ Settings form shows every scope and held role; gated save, exact payload, retained draft and no automatic retry (2631.398147ms)
2026-10-15T01:55:09.115Z settings user="jason" changed
✔ REQ-WEB-1 signed-in same-origin Settings write reaches exactly one human operation (27.88617ms)
✔ REQ-WEB-1 Settings writes require enabled send, named Host, identity, exact Origin and same-origin Fetch Metadata (12.91749ms)
✔ REQ-WEB-1 Settings validates JSON, size, revision and strict writable keys before broker call (11.69995ms)
✔ tokens.css and icons.svg are byte copies of docs/design (1.388852ms)
✔ JetBrains Mono files match the digests in their sources file, with the OFL text (2.66848ms)
✔ shipped strings are unchanged, and the web keeps its write boundary (3.018859ms)
✔ shell in a browser: System default, seeded states, 400px, focus and the Ctrl+K palette (7086.256726ms)
✔ five states on Board, Inbox, Tasks, Agents and Trail (2356.647421ms)
✔ Queue, Business and Settings in their five states, with no move button (4136.793027ms)
✔ seeded secrets, Discord ids and paths reach no response and no page; business refusals in the module's words (1086.270022ms)
✔ the server log names no config path when the system config refuses (213.207945ms)
ℹ tests 112
ℹ suites 0
ℹ pass 108
ℹ pass 112
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 55425.728446
ℹ duration_ms 54462.035185