- A checkout an earlier launch left for a project the instance may no longer
work in is covered by an empty tmpfs inside the sandbox; the host copy stays.
- The launcher rechecks every prepared project against the reloaded document
after preparation, and the bus's final admission takes the instance and
checks the broker's current unions.
- A project define whose vars changed since boot refuses its copy until the
next start.
- Instance-name collisions are recomputed at each reload from the frozen root
claims and the current project defines; every claimant refuses.
Review fix round for slice A3.
- Every project's union is recomputed from the current organization file
at each load. A refused union refuses the project's own copies and every
inherited root or org agent there: no mount at launch (checkout-skipped,
project-refused), no thread and no room, each naming the project and why.
- A project exclude removes that project's mount from the excluded agent;
a narrow reaches the instance's resolved limits, so its real bundle is
narrowed. A narrow in any project narrows the instance for every launch,
since one launch mounts every project it works in.
- Two copies whose instance names collide both refuse, naming each
claimant; the view lists the claimants. An organization instance of the
same name replaces a root or project copy, at boot and after it, and the
copy is gone rather than refused.
- Rooms hold only the thread instances that work in the room's project.
- The grid finds an agent's copy by name and project from the bus view,
never by rebuilding the instance name.
- Real-boot regressions: inherited agents in a refused union, exclude and
narrow in the bundle, an org override after boot, two organizations each
running a copy, a root file change while running, and a grid fed by a
booted bus.
Each root agent an organization does not exclude, and each agent a project
defines, becomes a copy when the organization's bus boots. The root file is
read once, through loadRootAgents, at the cli boot step; the snapshot is fixed
until the next boot. A bound copy joins the organization document's roles and
goes through validateBusinessDocument and checkRoles with the organization's
own credential map. A copy whose role needs a credential service is unbound
and refuses at launch by name and service (credential-unbound); a copy the
organization refuses is copy-refused; every agent in a project whose union
refuses is project-refused, naming the project. A project agent launches
only with its own project's mounts and takes a thread only in its project
(project-agent-elsewhere). Refusal events carry the code alone. The bus's
instances read carries the copies with their running runs, and the Agents
grid shows each copy's real status and reason.
channel-proof re-pins webui bus.mjs for four STATUS entries; no proof or
transport change. packages/business gets the agent-copies.mjs re-export.
Six review findings, one round:
- A selected task-tracker module that fails to load or has no factory refuses boot with tracker-config.
- The expect digest covers the task revision, so archive and unarchive invalidate an old token.
- Position exhaustion and an occupied explicit position refuse task-position-full; no rebalancing yet.
- The store adapter reads roles from the broker's current business document (Broker.taskRoles), so a role added by reload works.
- Only newly requested assignees are checked against live roles; stored ones survive edits, archive and delete.
- Human tasks.create requires a requirement citation (REQ-AREA-N); tasks.edit accepts one.
PRD 1.20 REQ-TASK-1, REQ-PLUG-1, REQ-WS-8. Each organization keeps its
tasks in its own bus through the new task-tracker plug-in kind. The
default module is the built-in store; Vikunja is the optional module
and a Vikunja organization keeps today's path.
- bus schema 3u to 3v (migration 3u-3v.sql): store_tasks, append-only,
one row per write, each citing its events row; seven guard triggers.
- broker: the eight role verbs on the store with the slice 1 field
table checked twice (module, then a before/after field diff); the
person's tasks.create/edit/archive/unarchive/delete as human.input
events; the tasks read returns store rows in board order (group,
position), filtered and paged like tracker rows.
- runtime: each business gets its module at start (organization file
plugin, else vikunja with a tracker entry, else store); a store
business with a Vikunja tracker refuses the boot (tracker-config).
- plugins: task-tracker kind with store and vikunja modules.
- cli: the launcher's tracker flag covers store organizations; trail
prints store writes.
- pins: schema.test counts, the bus migration tests, stack-release #811
and T46 (store_tasks on the always list; COUNTED unchanged),
budget-supervisor accepts 3v.
Rebased onto SYS1 by the lead: SYS1 took 3t-3u, so this step is 3u-3v.
Adds the system-type kind with five modules (coding, creative-writing,
marketing, montage, business-management), an org-level enabled list
validated fail-closed, project selections limited to the org's list,
read verbs, and bus migration 3t-3u. REQ-SYS-2 toolsets are designed and
deferred: they need a role authority contract.
Adding an agent with a store credential on an instance with no
<configDir>/secrets/agents left the bus unable to start
(credential-file): Credentials refuses a missing store root, and only
issue() made it, which needs a running bus. Start now makes the root
(0700) the same way issue() does, only when some reference has
store: true. Credentials' own refusal (credential-store T1) is unchanged,
and a root with loose modes or a symlink still refuses start.
Tests: two new credential-verbs tests; the creation test fails on
483eccb3d with credential-file. All 171 bus test files run one at a
time: 1713 pass, 0 fail.
git mv packages/business -> packages/organization (@mosaic/organization). The
old package stays as one-line re-export shims of each moved module, with
src/business.mjs re-exporting src/organization-config.mjs and src/cli.mjs
forwarding to the moved executable. BusinessError is OrganizationConfigError
(one constructor, name kept BusinessError); OrganizationError stays distinct.
The bus adapter gains organization-context.mjs (busOrganization), with
business.mjs (busBusiness) as the same function.
Import consumers, manifests, the lockfile, scripts/mosaic, stack-copy.sh
COPY_PATHS (both roots), seat sandbox RUNNER_FILES and the copy closure
walker (organization-imports.mjs, both roots required) move to the new path.
v1 serialization, v1 writers and the stage A fixtures are unchanged; the stage
A contract tests stay where they were and pass as before.
readCandidate called readPrdMaterial with the org data root directly, so
prd.submit and the Console PRD draft kept working while project.files refused
the same conflict. It now resolves through recordArgs like the file adapters.
Fixes the P2 from the E2E4 review.
BUILD-LOG.md: append-only union, refactor entries first, then the branch's.
docs/SESSIONS.md: append-only union, refactor entries first, then the branch's.
packages/bus/src/runtime.mjs: keep the organization usage timer and refactor's halted/invalid startup-recovery gate.
packages/harness/src/first-output.mjs: keep the branch's harness-neutral markers; refactor's empty-length rejection moves into the Pi monitor (packages/plugins/harness/pi/model-stream.mjs).
packages/harness/tests/runner.test.mjs: keep refactor's length-continuation cases and the branch's output-policy cases.
packages/plugins/harness/pi/index.mjs: keep the documented GLM limits and the branch's transport-based bundle.
Suites: 6356 pass, 32 fail; all 32 fail identically on both parents
(node_modules symlink EISDIR in pinned-copy and stack copy/release tests,
missing Python jsonschema in two conversation tests).
The tester-cli test makes about 20 Console reads and chat calls in a
row. Each one spawns TESTER_CLI, which re-executes itself so the nonce
is in its initial environment; both processes statically imported the
client and the broker module graph behind it, though the parent only
spawns the child. The child now imports Client and readProcess after
the re-exec branch, so the parent is a bare node start. Interleaved
over 20 calls at load 19: 258 ms per call before, 192 ms after. The
proof, nonce and argv are unchanged.
What remains is legitimate serial work: about 20 round trips of two
node processes each, about 3 s idle and 10 s at load 20 on 16 cores
(before this change). 30 s left under 3x room on a busy machine, so the
test's hang guard is now 60 s.
Review round 1 on 4048e0f60 found two defects.
Startup recovery ran unconditionally. A continuation retry now refuses
while processing is halted, so a broker restart with a waiting
continuation failed with processing-halted. Startup recovery now waits
while processing is halted or invalid, as the periodic pass does;
processing.resume schedules it again.
#continuationStarting matched any launch without an end, so an older
launch whose end was lost (#1851) hid every later run's end. Only the
target's latest lifecycle event counts now.
Both regression tests fail on 4048e0f60 and pass here.
Expose the parent message class on agent delivery so the runner can stop automatic replies to answers while preserving requests and ordinary relays. Scope continuation retry versions to the target, suppress notices during processing halts and unclaimed launches, and clarify the instance-running refusal.
The bus suite excludes project-files.test.mjs because its 1 MiB socket test timed out on both the candidate and the untouched 1186cf7b1 base.
The oversize and unresolved ask-PM notices were appended without
checking the room left by the lead, so a lead with 0-130 bytes left
pushed a 972-task request past exec capacity (E2BIG at 131,086).
quoteBlock now returns at most max(room, 0): the full notice, the
47-byte short line, or nothing. Tests sweep rooms -3..160 for both
steps and run a 972-task lifecycle that must still exec.
BUILD-LOG appends a correction to the r4 limits (40,774 / 88,234).
Jason's owner report 2026-11-06: no way to archive or delete projects.
Archive is the reversible half; delete stays out of scope because project
and run records are write-once evidence.
- project.archive / project.unarchive: human-only (project.create's gate
minus the tester carve-out; tester, user and agent refused). State is the
latest row of a new append-only project_archives journal (3s->3t, additive;
the rows are the audit trail), so projects itself never changes and nothing
is deleted. Repeats refuse project-already-archived / project-not-archived.
- project.list hides archived projects until {includeArchived:true}, which
flags each with archived:true; a user still lists granted projects only.
- While archived, thread.create, thread.send, room.open and room.send refuse
project-archived; every existing record stays readable and unarchive
restores everything.
- Console: new public/project-archive.js (+css) and project-archive-http.mjs
routes (chatHTTP's write fence); chat.js gains two one-line hooks,
index.html one script and one link tag; styling only through the shell's
.project-archive-control / .project-archived-filter hooks.
- CLI: mosaic project archive|unarchive <name-or-id> and list --archived.
- stack-release COUNTED/LISTED gain project_archives (schema order); schema
step-count pins and migration fixtures updated for 3t.
bus 1601/1601 (Node 24; Node 26 has the pre-existing project-file socket
stall), webui 582/582, plugins 132/132, cli 1191/1194 (two pre-existing
load flakes of the row253 C4 and land_work families; both pass isolated and
the base commit's full suite fails four of the same family).
The r2 review found that counting raw bytes let JSON and control
escaping grow one quote six-fold, so the runner's MOSAIC_REQUEST
exceeded the exec string limit (E2BIG). The continuation renderer now
applies the 16384-byte budget to encoded title and text bytes, cutting
on whole code points. Adds an execution-boundary regression.
Gate on the merged tree: business 307/0, bus 1596 pass with one
pre-existing hang (project-files.test.mjs, same on relay base 2f1cef4c1),
harness 243/1 on the row 66 unslop test, which also fails 1 in 3 runs
on the relay base (timing flake, pre-existing).
D3: coder/reviewer sandboxes cannot read the product records repo and
list_requirements stays PM/CTO-only (row 90, #1584). The bus now quotes
the task-cited approved requirement texts (exact text, id, title, citing
task refs, snapshot id, product key, records commit) into the
implementation and review continuations, resolved host-side through the
same catalog resolver behind the scoped requirements verb, never from
model input. Quotes are bounded at 16384 bytes and framed as quoted
data; an unresolvable or revoked snapshot degrades to an ask-PM line
without blocking the task. No role, tool or schema widened; one duty
note each in roles/coder.md and roles/reviewer.md.
Review M1 on 62bece4a9: a failed notice insert or route threw past
#refused, replacing request-evidence-required and skipping its audit.
The notice is now best-effort; its transaction still rolls back whole.
Tests: insert and route failures keep code, audit and lifecycle; retry
publishes once. Both red on 62bece4a9.
jason.woltje