jason.woltje
155f643224
docs(row276): pin supervised-call candidate and fifteen mutants
2026-10-22 16:59:44 -05:00
jason.woltje
b96b4e303d
fix(case1): supervise legacy user calls across sudo sessions
2026-10-22 16:59:44 -05:00
jason.woltje
f2735bb6a1
queue: revs 3317-3324. Row 206: Launchpad claim and in-review (3317-3319), Sage review request (3320-3321), Duckworth approve record (3322), Sage landing note and done (3323-3324).
2026-10-22 15:14:46 -05:00
jason.woltje
0cbe2e9b35
row 206 ( #1704 ): BUILD.md Runs, gate GREEN on 9538e0fc8 (bus 850, cli 869, shell suites, M2-M9 and Q2 killed)
2026-10-22 14:40:53 -05:00
jason.woltje
9538e0fc86
row 206 ( #1704 ): thread-shares trail test threads the reply into A's default session, not the thread id (first-run red, mos-1272)
2026-10-22 14:19:00 -05:00
jason.woltje
1a228f395f
row 206 r4 ( #1704 ): BUILD.md records the slot rebase onto 17f415792 (269, 282 landed) and the drift sweep
2026-10-22 14:16:21 -05:00
jason.woltje
8295622600
row 206 ( #1704 ): BUILD.md records duckworth-0179/0180, C3 met on the pushed tip 670658dd1
2026-10-22 14:15:48 -05:00
jason.woltje
ac0e4dc9bc
row 206 r3 ( #1704 ): BUILD.md records the C3 rebase onto 275 at 3410df7c3 on 253's 48e450ce8, and the sweep
2026-10-22 14:15:47 -05:00
jason.woltje
c49fdb2692
row 206 ( #1704 ): BUILD.md records duckworth-0175 (round 2 meets C1/C2, APPROVE carries) and C3
2026-10-22 14:15:47 -05:00
jason.woltje
cfb86f1bd7
row 206 r2 ( #1704 ): rebased on 275 r3 957a9bfe0; share verbs need collaborator, viewer reads a share (duckworth-0169 C1, C2)
2026-10-22 14:15:47 -05:00
jason.woltje
178eefd5c4
row 206 ( #1704 ): BUILD.md records Duckworth's manifest APPROVE (duckworth-0169), C1/C2 for the 275 round, N1-N4
2026-10-22 14:15:47 -05:00
jason.woltje
8a29f94771
row 206 (193b2, #1704 ): sage-2818 rulings, only a human principal matches a share
...
#readable returns false for an agent session, so a `*` share no longer shows a user's message
in an agent's trail. New tests: a sharee's session.list refuses (Q1), and an agent bound to the
shared thread, a chief run and the tester match no share (Q2). BUILD.md records the Q1
follow-up, Q2-Q4 and the live --migrate as Mos's go under Q173. README names the agent rule.
2026-10-22 14:15:47 -05:00
jason.woltje
d78a9cc83c
row 206 (193b2, #1704 ): thread shares, schema 3l→3m
...
thread_shares (row 193 design 5.2) with its index and append-only triggers; the
3l-3m step only adds them. thread.share, thread.unshare and thread.shares for a
thread's owner; #readable holds design 5.4's four rules, #threadRead serves
thread.messages only, and thread.list {shared:true} adds owner. replies and
trail show shared user threads to the owner and readers. COUNTED, LISTED,
timedTables and the clock list take the table. Tests: thread-shares.test.mjs
and the 3l→3m pins. Packet agents/launchpad/work/queue-206/BUILD.md. Not run
yet: node waits for Sage's CLEAR (sage-2789).
2026-10-22 14:15:47 -05:00
jason.woltje
17f4157920
queue: revs 3217-3316. Q226 gap (rows 216-229, 265-267 re-pins; 217 unblocked; 223 blocked; rows 282-290 added), rows 253, 275, 269 and 282 reviews, notes and done moves, row 291 (PRD 1.16, #1796 ) added, claims and in-review moves for 173, 207, 211, 214, 224, 239, 252, 258, 276 (sage, darkwing, della, dewey, gander, herb, honker, megavolt, scrooge, ludwig, gizmoduck, gosalyn, webby, duckworth, morgana); review requests posted as jarvis by Sage
2026-10-22 14:13:04 -05:00
jason.woltje
647424442f
gosalyn: PRD 1.15 round 2 for Webby webby-0158 B1: requireCitation makes every reply carry a citation except the runner's four fixed notices, as the design keeps them passing, and the REQ-LIB-1 rewrap joins organization file to its sentence (N1)
2026-10-22 14:06:25 -05:00
jason.woltje
71fed6281c
gosalyn: PRD 1.15 rewrites REQ-LIB-6 to Q223 and Q226 (mos-1320 item 8): agents never write story and write .md files only in supporting folders a human marks, each as a commit by their own Gitea account with a notice she can revert, chat is free text, any citation is checked, and requireCitation is a human-only setting off by default. REQ-LIB-1 and REQ-LIB-2 gain supporting folders and the canon-cite rule. The 1.12 note's residual becomes the supporting-doc residual, and the 1.15 note records the old texts and lists REQ-LIB-3, 4, 5 and 7 as unchanged. requirements.json version 1.15 with three titles changed, and the test's version pin. The id count stays 85
2026-10-22 14:06:25 -05:00
jason.woltje
86a665bdf0
docs: PRD 1.16 brief, library.write routes under REQ-LIB-6 ( #1796 , mos-1328)
2026-10-22 13:51:55 -05:00
jason.woltje
efcc9ea8dd
row 269 (264b, #1774 ): BUILD.md M11 kill line is the survivor log assertion at session-launch.test.mjs:309, not the outcome assertion (mutant run 17:49Z, duckworth-0181)
2026-10-22 13:37:34 -05:00
jason.woltje
f39508c24f
row 269 (264b, #1774 ): the M6 halt test halts after mayLaunch answers
...
A halt inside the op reaches the bus's own fence first (runtime.mjs:564-566,
processingWork at :352-356), so the launcher refused limit-check-failed
(launcher.mjs:389-391) before its recheck admission() at :397. First-run red of
a new test on 6d9ab3503
2026-10-22 13:37:34 -05:00
jason.woltje
d20ef317fc
row 269 (264b, #1774 ): BUILD.md names the sessioned-survivor residual in Q2 and records N1's mos-1292 allowance (duckworth-0159 N3, N4)
2026-10-22 13:37:34 -05:00
jason.woltje
6e50bd6304
row 269 (264b, #1774 ): BUILD.md Q2 notes that a survivor's released claim doesn't prove its run has exited, and the per-leftover 5 s wait (duckworth-0158 N1, N2)
2026-10-22 13:37:34 -05:00
jason.woltje
6c80b12904
row 269 (264b, #1774 ): BUILD.md answers sage-2750 on the recover() change; the survivor log names its pids
...
The section "recover() change, for a design read" covers three things, with
file:line against aca16404c
2026-10-22 13:37:34 -05:00
jason.woltje
42fd3edd45
row 269 (264b, #1774 ): legacy-run-live gets its test (duckworth-0156)
...
recover() kept a survivor only when a bwrap outer pid outlived SIGKILL, so
the Q2 refusal (BUILD.md:177-179, t1-sessions.md:109) had no test. A leftover
whose runner still ran after its outer pid was gone was ended and dropped.
Now recover() waits on the outer pid and the runner, keeps any leftover where
either still runs, and logs that it still runs. check() reads only the
survivors that still run.
session-launch.test.mjs adds a test where a sessionless leftover's runner is
a sleep child and its outer pid is gone. It asserts the legacy-run-live
refusal with no launch and no session workspace, then one launch once the
child exits. BUILD.md adds mutants M10-M12 and replaces the "no test" note.
2026-10-22 13:37:34 -05:00
jason.woltje
dc5836c7df
row 269 (264b, #1774 ): refusedOnce in sessions.test.mjs pins actor_run, closing Duckworth N1 (DEFERRED.md:474-480)
...
Allowed by Mos in mos-1292 (copy mos-1294) on mos-1285's terms. The SELECT
reads actor_run, the expected row gets the run-name literal, and the three
callers pass `${name}-run`. Nothing else in the test changes. The old
expected row was:
[['action.refused', { code: 'not-holder' }]]
DEFERRED.md gets a closing line on the entry naming row 269.
2026-10-22 13:37:34 -05:00
jason.woltje
2133c5a0c6
row 269 (264b, #1774 ): per-session store, workspace and single-writer lock
...
threadsState gives one row per session with `session` and `legacy`; threadIdle
idles a run against its bound session. Each session gets its own store
(threads/<b>/<t>/sessions/<s>/, or the thread's old store for a legacy-3l
session) and its own workspace (session-workspaces/<b>/<i>/<s>/), held by an
O_EXCL <ws>.lock from before the clones to the run's proven exit. A legacy
session's workspace binds in-sandbox at the old instance path. sessions.json
is v2 and reads v1. New tests: cli session-launch.test.mjs, seat
session-workspace.test.mjs. Not yet run: tests wait for Sage's CLEAR.
Two old assertions change as exact updates:
- mos-1285: end-launch.test.mjs threadsState deepEqual. The old row shape was
{ thread: 'th-1', instance: 'coder', pending: 0, unread: 0, lastMessage: null,
lastOpen: '2026-10-15T00:00:01.000Z', lastClaim: null, holder: null }; the
row keeps every key and value and adds session: 'th-1', legacy: true.
- mos-1289: thread-launch.test.mjs:182, old line
`const store = join(f.dataRoot, "threads", "acme", A);`
now reads A's default session id from threadsState's `session` key; :183-185
unchanged; one added assert that threads/acme/<A>/session is absent.
2026-10-22 13:37:34 -05:00
jason.woltje
194dec83d6
row 269 (264b, #1774 ): BUILD.md lists thread-launch.test.mjs:182 as a second old assertion that changes. A thread.create thread's default session isn't legacy-3l, so its store takes D2's layout (t1-sessions.md:100, :294). Proposed as an exact path update, for Mos through Sage
2026-10-22 13:37:34 -05:00
jason.woltje
84b32e3903
row 269 (264b, #1774 ): BUILD.md drops the planned bindLaunch session-running refusal. Two old tests bind a second unended run to one session and expect the claim refusal (threads.test.mjs:88-89, sessions.test.mjs:119-120), so the broker half of the fence is the existing per-session claim, thread-already-held (broker.mjs:4815)
2026-10-22 13:37:34 -05:00
jason.woltje
9d241fdcc2
row 269 (264b, #1774 ): design notes for Duckworth's early look (duckworth-0150). C1 adds the Console and R-guard sessions.json readers, the 264a refusals a v2 file causes, the /proc live check and the Console restart; C2 pins M6 to a generation change after check() with all eight start() admission calls named; C3 gives the realpath compare its own code and a symlinked workspaces root as M4's input; C4 lists the old threadsState assertions, end-launch.test:193 the only change, under mos-1285
2026-10-22 13:37:34 -05:00
jason.woltje
76a6524cfe
row 269 (264b, #1774 ): design notes for sage-2717. Rollback names the four steps past the 264a exit-3 refusal and the re-pin plan section that carries them; new M8 binds a non-default session at the legacy path, old M8 becomes M9; Duckworth's legacy-bind check
2026-10-22 13:37:34 -05:00
jason.woltje
693f7e745e
row 269 (264b, #1774 ): design notes. D9 audit of every sessions.json reader at 84f53540d and of threadsState's consumers; sessions.json goes to v2 because recover() rebinds without session; pi 0.85.1 resumes by cwd, so the legacy session keeps its in-sandbox path; mutants M1-M8 and run limits (sage-2707)
2026-10-22 13:37:34 -05:00
jason.woltje
94c33a43c0
docs: row 275 landing line; Researcher session line
2026-10-22 13:13:47 -05:00
jason.woltje
a870fd85bb
docs: seat log lines for rows 281, 224, 219, 214, 211 and 258, the row 253 landing line, Sage's SESSIONS line, and DEFERRED for the 224 residual and the 206 sharee list
2026-10-22 13:10:27 -05:00
jason.woltje
5b1f1dc885
docs: DEFERRED gains row 253 N1 (Vikunja 532, mos-1297), row 198 N2 (/api/seen 400, sage-2867) and the stale row 203 text in access.mjs (Quackerjack)
2026-10-22 13:10:27 -05:00
jason.woltje
8c638b6f66
agents: register Della, Scrooge, Huey, Louie and Ludwig as seats so the queue can name them as row owners (Q220, mos-1301)
2026-10-22 13:10:27 -05:00
jason.woltje
a700992cd4
docs: 193b2 brief, the live --migrate window needs Mos's go under Q173, not Jason (mos-1310 item 4)
2026-10-22 13:10:27 -05:00
jason.woltje
d30f35e292
docs: SESSIONS line for Gizmoduck, rows 264a and 268 after-landing docs and the row 269 plan
2026-10-22 13:10:27 -05:00
jason.woltje
e5b7d1d083
row 268 ( #1773 ): BUILD.md Runs records the r2 gate on ecd9b35eb and the r3 and r4 carry reruns with every count and skip; doc only (sage-2455)
2026-10-22 13:10:27 -05:00
jason.woltje
836b2f25ca
docs: preserve email hard-wait approval and tune parser limits
2026-10-22 13:10:27 -05:00
jason.woltje
73516da853
docs: apply Q217 and Q222 to email source settings
2026-10-22 13:10:27 -05:00
jason.woltje
95e3f71661
docs: address Q195 editor design review findings
2026-10-22 13:10:26 -05:00
jason.woltje
cde0cd0832
docs: Q195 writing editor design and Q196 options
2026-10-22 13:10:26 -05:00
jason.woltje
100f018af3
gosalyn: row 229 design round 2 for Webby webby-0148: the settings.json allowlist is three keys a fresh /login writes, written in Mosaic code with httpProxy and the path and command keys refused by name and a sha256 bump test on pi's setter names, models-store.json and keybindings.json now refuse, auth.json.lock is the only allowed dir, pi-login runs --offline and --no-session in an empty temporary cwd with a 229b allowlist test, the contents check runs before preflight, and creativeHumanOnly covers the fallback (R1, R2, N1-N5)
2026-10-22 13:10:26 -05:00
jason.woltje
4a8215e3a1
gosalyn: row 229 design draft 1 after mos-1306: Chet's route has no fallback by default with a human-only fallback still possible through routes, and the dates note records that the live check gates every build row, not the design
2026-10-22 13:10:26 -05:00
jason.woltje
669e680368
gosalyn: row 229 design draft 1, a per-instance pi agent dir for Chet's Codex login: the host-made 0700 store per instance, a same-path rw bind with PI_CODING_AGENT_DIR through the pi module env, a contents allowlist since pi reads models.json and settings.json there, a refusal for roles with bash, a no-refresh auth check preflight, no fallback for Chet, a fresh-grant mosaic pi-login, the live check that gates the build, and rows 229a and 229b ( #428 , #1730 )
2026-10-22 13:10:26 -05:00
jason.woltje
c06ccc9ba4
gosalyn: Case 2 C2-03b round 3 for Webby webby-0156 R4: the fetch fallback reads the append-only events table for any GRANT_EVIDENCE event with method gitea and agent the chief, never gitea_grants, whose row a revoke and a grant-lost delete. It names no project, since grant.applied and grant.revoked carry none, so a chief grant on any project ends the fallback and fails safe. The revoked and fired tests go through grants.revoke and instance.fire and assert the row is gone before the fetch
2026-10-22 13:10:26 -05:00
jason.woltje
136e5c1ca3
gosalyn: Case 2 Q226 row briefs with Webby's round webby-0151, Mos's mos-1320 and Sage's sage-2833 folded in. C2-06 rewritten and taking in C2-07: an unreadable business file resolves requireCitation to true (R2), a send over 64 KiB gets the one retry and then a fourth fixed text (R1). C2-03b falls back to slot library-gitea only while no chief grant record has ever existed and refuses library-fetch-no-grant after (R3), with library-human-missing for her save and revert. C2-02 after C2-05c, revert and save by her editor (N1). C2-21 cites mos-1320 item 2 and keeps the host-creative-role refusals, and records two Gitea facts that don't gate it (N4, item 5). C2-08b names what the chief's credential needs (N5). C2-05b restored to the brief row 224 built, which lands as built, and new row C2-05c carries the supporting scope and blob. A PRD row brief for REQ-LIB-6 (mos-1320 item 8). New briefs C2-01d, 05c, 08b, 03b, 21, 02, 11b and 12b
2026-10-22 13:10:26 -05:00
jason.woltje
cf17ab387b
gosalyn: C2-06 brief Q222 round 2 for Webby webby-0144: M11 compares against the on-disk human and replyLimits on document and written and refuses agent actor shapes, an unreadable business file checks at the defaults, keys read by Object.hasOwn and Number.isInteger, the verb refuses unknown keys, the new tests, the residual line, cites at aca16404c, and the hold moves to Q30 (mos-1305, design f164dcef8)
2026-10-22 13:10:26 -05:00
jason.woltje
09948da187
gosalyn: C2-06 brief makes every M5 limit a replyLimits setting with Q219's numbers as defaults, the human's library.limits.set and mosaic limits replies, the M11 writer check, read at check time with per-key fallback to the default, the setup sheet's settings line, the settings and M11 tests, After C2-04, and the build held for Q29 (Q222, mos-1302, design df29550c9)
2026-10-22 13:10:26 -05:00
jason.woltje
35615b01b7
gosalyn: C2-06 brief cites the setup sheet's reply limits paragraph at :115-118 (webby-0140 N4)
2026-10-22 13:10:26 -05:00
jason.woltje
3f1f4e44fa
gosalyn: C2-06 brief owns the setup sheet's reply limits paragraph, which says 3 ideas of up to 120 characters and drops the lower-limits offer, and the tests paragraph is rewrapped (webby-0139 N1, N2, Q219)
2026-10-22 13:10:26 -05:00
jason.woltje