P3-1: releasing a console start lock marks it released through its own
descriptor and removes the path only while it is still that file; a
released lock put back by a racing clear is cleared by the next start or
stop.
P3-2: org definitions reports unknown-organization only when the
organization file itself is missing; another missing file names the
operation.
P3-3: the path cut also covers a path after ':' or inside backticks.
1. Stale bus host lock refusals from bus status, start, stop and restart
name mosaic bus recover ORG.
2. org definitions: unknown org, unknown or malformed name and bad id give
one refusal or usage line, no stack trace, no host path.
3. Pack, board and workflow refusals print their hint as template save does;
tested with the real CliError transport shape.
4. console start and stop clear a console/start.lock whose named supervisor
(pid and start time) is gone; a live or unnamed holder refuses.
5. Template save keeps free text verbatim and writes no placeholders; the
preview lists each field that mentions an org-specific name.
6. A request the shim never sent (no socket, connect refused) exits 5 and
the CLI reports bus-not-running with the start and recover line.
7. autonomy-precondition carries the check that failed, including on the
hire paths.
8. Saving under an existing template name refuses template-exists with a
next step; refusal table entry added, channel-proof pins moved.
T1 follow-up. A definition's text becomes an agent's contract, but a load ran the
held-secret check with an empty store. Bus start now checks every definitions entry
(the boot copy's org: entries and the file's own) with the live store, and the
launch check asks the bus the same question for the org: definition it just read,
before a contract exists. A hit refuses as definition-holds-credential, a new code
in the refusal table; the refusal names the definition and key, never the text or
the credential. bus start records the refusal in the boot status.
Review P1: the CLI wrote definitions with a no-op secret check. setDefinition
now refuses definition-secret-check-required when a write that adds or changes
an entry has no assertClean. New bus verbs definition.import|invent|edit|remove
run the writes for the business's human at the cli with the credential
store's assertClean; the tester, agents and readers refuse. The CLI's
definition writes call the bus and map its codes to messages that never
quote the definition.
Roles round 2, slice T1 (roles-and-rails design sections 4, 5 and 13).
- The org file's definitions key: each entry {rev, from?, role, instructions,
personality?} passes checkComposition; a bad entry refuses the whole file,
naming the definition and key, never a value.
- org:<name> instance references resolve to the file's definition; a missing
one refuses definition-missing, naming the instance. Template names are
unchanged.
- Template identity is the name plus a sha256 over the template JSON and its
contract; templateHashes reads the current hash for each template.
- The writer's setDefinition is the only path that changes definitions: it
checks the composition, bumps rev, refuses agent actors, and refuses
definition-in-use for a definition an instance names (A4 adds the change
decision). write() refuses organization-definitions-protected.
- Definition verbs import, edit, invent and remove need org.hire
(definition.*.console in VERB_RIGHTS) and refuse every agent caller.
- The diff read lists the primitives that changed and a line diff of the
instructions. It applies nothing.
- CLI: mosaic org definitions templates|list|show|diff|import|invent|edit|remove.
jason.woltje