jason.woltje
69979bb8a8
docs(row276): record static approval and upstream deferred drift
2026-10-22 16:59:44 -05:00
jason.woltje
155f643224
docs(row276): pin supervised-call candidate and fifteen mutants
2026-10-22 16:59:44 -05:00
jason.woltje
0cbe2e9b35
row 206 ( #1704 ): BUILD.md Runs, gate GREEN on 9538e0fc8 (bus 850, cli 869, shell suites, M2-M9 and Q2 killed)
2026-10-22 14:40:53 -05:00
jason.woltje
1a228f395f
row 206 r4 ( #1704 ): BUILD.md records the slot rebase onto 17f415792 (269, 282 landed) and the drift sweep
2026-10-22 14:16:21 -05:00
jason.woltje
8295622600
row 206 ( #1704 ): BUILD.md records duckworth-0179/0180, C3 met on the pushed tip 670658dd1
2026-10-22 14:15:48 -05:00
jason.woltje
ac0e4dc9bc
row 206 r3 ( #1704 ): BUILD.md records the C3 rebase onto 275 at 3410df7c3 on 253's 48e450ce8, and the sweep
2026-10-22 14:15:47 -05:00
jason.woltje
c49fdb2692
row 206 ( #1704 ): BUILD.md records duckworth-0175 (round 2 meets C1/C2, APPROVE carries) and C3
2026-10-22 14:15:47 -05:00
jason.woltje
cfb86f1bd7
row 206 r2 ( #1704 ): rebased on 275 r3 957a9bfe0; share verbs need collaborator, viewer reads a share (duckworth-0169 C1, C2)
2026-10-22 14:15:47 -05:00
jason.woltje
178eefd5c4
row 206 ( #1704 ): BUILD.md records Duckworth's manifest APPROVE (duckworth-0169), C1/C2 for the 275 round, N1-N4
2026-10-22 14:15:47 -05:00
jason.woltje
8a29f94771
row 206 (193b2, #1704 ): sage-2818 rulings, only a human principal matches a share
...
#readable returns false for an agent session, so a `*` share no longer shows a user's message
in an agent's trail. New tests: a sharee's session.list refuses (Q1), and an agent bound to the
shared thread, a chief run and the tester match no share (Q2). BUILD.md records the Q1
follow-up, Q2-Q4 and the live --migrate as Mos's go under Q173. README names the agent rule.
2026-10-22 14:15:47 -05:00
jason.woltje
d78a9cc83c
row 206 (193b2, #1704 ): thread shares, schema 3l→3m
...
thread_shares (row 193 design 5.2) with its index and append-only triggers; the
3l-3m step only adds them. thread.share, thread.unshare and thread.shares for a
thread's owner; #readable holds design 5.4's four rules, #threadRead serves
thread.messages only, and thread.list {shared:true} adds owner. replies and
trail show shared user threads to the owner and readers. COUNTED, LISTED,
timedTables and the clock list take the table. Tests: thread-shares.test.mjs
and the 3l→3m pins. Packet agents/launchpad/work/queue-206/BUILD.md. Not run
yet: node waits for Sage's CLEAR (sage-2789).
2026-10-22 14:15:47 -05:00
jason.woltje
efcc9ea8dd
row 269 (264b, #1774 ): BUILD.md M11 kill line is the survivor log assertion at session-launch.test.mjs:309, not the outcome assertion (mutant run 17:49Z, duckworth-0181)
2026-10-22 13:37:34 -05:00
jason.woltje
d20ef317fc
row 269 (264b, #1774 ): BUILD.md names the sessioned-survivor residual in Q2 and records N1's mos-1292 allowance (duckworth-0159 N3, N4)
2026-10-22 13:37:34 -05:00
jason.woltje
6e50bd6304
row 269 (264b, #1774 ): BUILD.md Q2 notes that a survivor's released claim doesn't prove its run has exited, and the per-leftover 5 s wait (duckworth-0158 N1, N2)
2026-10-22 13:37:34 -05:00
jason.woltje
6c80b12904
row 269 (264b, #1774 ): BUILD.md answers sage-2750 on the recover() change; the survivor log names its pids
...
The section "recover() change, for a design read" covers three things, with
file:line against aca16404c
2026-10-22 13:37:34 -05:00
jason.woltje
42fd3edd45
row 269 (264b, #1774 ): legacy-run-live gets its test (duckworth-0156)
...
recover() kept a survivor only when a bwrap outer pid outlived SIGKILL, so
the Q2 refusal (BUILD.md:177-179, t1-sessions.md:109) had no test. A leftover
whose runner still ran after its outer pid was gone was ended and dropped.
Now recover() waits on the outer pid and the runner, keeps any leftover where
either still runs, and logs that it still runs. check() reads only the
survivors that still run.
session-launch.test.mjs adds a test where a sessionless leftover's runner is
a sleep child and its outer pid is gone. It asserts the legacy-run-live
refusal with no launch and no session workspace, then one launch once the
child exits. BUILD.md adds mutants M10-M12 and replaces the "no test" note.
2026-10-22 13:37:34 -05:00
jason.woltje
2133c5a0c6
row 269 (264b, #1774 ): per-session store, workspace and single-writer lock
...
threadsState gives one row per session with `session` and `legacy`; threadIdle
idles a run against its bound session. Each session gets its own store
(threads/<b>/<t>/sessions/<s>/, or the thread's old store for a legacy-3l
session) and its own workspace (session-workspaces/<b>/<i>/<s>/), held by an
O_EXCL <ws>.lock from before the clones to the run's proven exit. A legacy
session's workspace binds in-sandbox at the old instance path. sessions.json
is v2 and reads v1. New tests: cli session-launch.test.mjs, seat
session-workspace.test.mjs. Not yet run: tests wait for Sage's CLEAR.
Two old assertions change as exact updates:
- mos-1285: end-launch.test.mjs threadsState deepEqual. The old row shape was
{ thread: 'th-1', instance: 'coder', pending: 0, unread: 0, lastMessage: null,
lastOpen: '2026-10-15T00:00:01.000Z', lastClaim: null, holder: null }; the
row keeps every key and value and adds session: 'th-1', legacy: true.
- mos-1289: thread-launch.test.mjs:182, old line
`const store = join(f.dataRoot, "threads", "acme", A);`
now reads A's default session id from threadsState's `session` key; :183-185
unchanged; one added assert that threads/acme/<A>/session is absent.
2026-10-22 13:37:34 -05:00
jason.woltje
194dec83d6
row 269 (264b, #1774 ): BUILD.md lists thread-launch.test.mjs:182 as a second old assertion that changes. A thread.create thread's default session isn't legacy-3l, so its store takes D2's layout (t1-sessions.md:100, :294). Proposed as an exact path update, for Mos through Sage
2026-10-22 13:37:34 -05:00
jason.woltje
84b32e3903
row 269 (264b, #1774 ): BUILD.md drops the planned bindLaunch session-running refusal. Two old tests bind a second unended run to one session and expect the claim refusal (threads.test.mjs:88-89, sessions.test.mjs:119-120), so the broker half of the fence is the existing per-session claim, thread-already-held (broker.mjs:4815)
2026-10-22 13:37:34 -05:00
jason.woltje
9d241fdcc2
row 269 (264b, #1774 ): design notes for Duckworth's early look (duckworth-0150). C1 adds the Console and R-guard sessions.json readers, the 264a refusals a v2 file causes, the /proc live check and the Console restart; C2 pins M6 to a generation change after check() with all eight start() admission calls named; C3 gives the realpath compare its own code and a symlinked workspaces root as M4's input; C4 lists the old threadsState assertions, end-launch.test:193 the only change, under mos-1285
2026-10-22 13:37:34 -05:00
jason.woltje
76a6524cfe
row 269 (264b, #1774 ): design notes for sage-2717. Rollback names the four steps past the 264a exit-3 refusal and the re-pin plan section that carries them; new M8 binds a non-default session at the legacy path, old M8 becomes M9; Duckworth's legacy-bind check
2026-10-22 13:37:34 -05:00
jason.woltje
693f7e745e
row 269 (264b, #1774 ): design notes. D9 audit of every sessions.json reader at 84f53540d and of threadsState's consumers; sessions.json goes to v2 because recover() rebinds without session; pi 0.85.1 resumes by cwd, so the legacy session keeps its in-sandbox path; mutants M1-M8 and run limits (sage-2707)
2026-10-22 13:37:34 -05:00
jason.woltje
8c638b6f66
agents: register Della, Scrooge, Huey, Louie and Ludwig as seats so the queue can name them as row owners (Q220, mos-1301)
2026-10-22 13:10:27 -05:00
jason.woltje
e5b7d1d083
row 268 ( #1773 ): BUILD.md Runs records the r2 gate on ecd9b35eb and the r3 and r4 carry reruns with every count and skip; doc only (sage-2455)
2026-10-22 13:10:27 -05:00
jason.woltje
100f018af3
gosalyn: row 229 design round 2 for Webby webby-0148: the settings.json allowlist is three keys a fresh /login writes, written in Mosaic code with httpProxy and the path and command keys refused by name and a sha256 bump test on pi's setter names, models-store.json and keybindings.json now refuse, auth.json.lock is the only allowed dir, pi-login runs --offline and --no-session in an empty temporary cwd with a 229b allowlist test, the contents check runs before preflight, and creativeHumanOnly covers the fallback (R1, R2, N1-N5)
2026-10-22 13:10:26 -05:00
jason.woltje
4a8215e3a1
gosalyn: row 229 design draft 1 after mos-1306: Chet's route has no fallback by default with a human-only fallback still possible through routes, and the dates note records that the live check gates every build row, not the design
2026-10-22 13:10:26 -05:00
jason.woltje
669e680368
gosalyn: row 229 design draft 1, a per-instance pi agent dir for Chet's Codex login: the host-made 0700 store per instance, a same-path rw bind with PI_CODING_AGENT_DIR through the pi module env, a contents allowlist since pi reads models.json and settings.json there, a refusal for roles with bash, a no-refresh auth check preflight, no fallback for Chet, a fresh-grant mosaic pi-login, the live check that gates the build, and rows 229a and 229b ( #428 , #1730 )
2026-10-22 13:10:26 -05:00
jason.woltje
271cef205c
gosalyn: Case 2 design round 3 for Webby webby-0156 R4: the fetch fallback reads GRANT_EVIDENCE events with method gitea and agent the chief in the append-only events table, never gitea_grants, and names no project, so it survives a revoke, a grant-lost and a fire and fails safe. The ruling paragraph, 7.2 and section 10 steps 4 and 4b say so, cited at aca16404c
2026-10-22 13:10:26 -05:00
jason.woltje
3e5db651b7
gosalyn: Case 2 design ruling after r11, agents never write story (Q223, Q226, mos-1309), with Webby's round webby-0151 and Mos's mos-1320 folded in. Supporting prefix lists agents may write .md files under through library.doc.write and library.doc.delete, fenced by M12 supportingPath, plumbing commits pushed fast-forward only with a Mosaic-Agent trailer, a notice and a human revert authored by her editor on slot library-human. Chat is free text with optional citations, replyLimits keys requireCitation and citationsPerReply, and an unreadable business file resolves requireCitation to true (R2). A send over 64 KiB gets the one retry and then a fixed text (R1). The fetch falls back to slot library-gitea only while no chief grant record has ever existed, and Jason deletes the slot once status shows the chief's grant (R3). A missing editor or slot refuses before any git call (N1), runner and tools cites fixed at aca16404c (N2, N3), two record-only Gitea facts at C2-21 (N4, mos-1320 item 5), mos-1163 narrowed to gitea library projects (mos-1320 item 2), M3 at eight or ten (mos-1320 item 4). C2-05b is row 224 as built and C2-05c carries the supporting scope and blob (sage-2833). New rows C2-01d, C2-05c, C2-08b, C2-12b and C2-21
2026-10-22 13:10:26 -05:00
jason.woltje
e1c9c09935
gosalyn: Case 2 Q222 round 2 for Webby webby-0144: the M11 fence compares against the on-disk human and refuses agent actor shapes, checks document and written as M9 does, a failed business file read checks at the defaults and never skips, the fallback reads keys by Object.hasOwn and Number.isInteger with booleans, arrays and objects named, the verb refuses unknown keys, the ceilings residual line, and cites at aca16404c (R1-R3, N1-N3, N5, N6)
2026-10-22 13:10:26 -05:00
jason.woltje
aaaf45576a
gosalyn: Case 2 design ruling after r11, reply limits are settings: every M5 limit is a replyLimits key in the business file with Q219's numbers as defaults, changed only by the human's library.limits.set and fenced in organizationWriter.write as M11, read at check time, with a missing or invalid value using its default. C2-06 carries it and waits on Q29 (Q222, mos-1302)
2026-10-22 13:10:26 -05:00
jason.woltje
cf6abca9c0
gosalyn: Case 2 design ruling after r11, idea items capped at 3 of 120 characters: M5, the B5 note, the 5.1 residual (now 360 characters per reply) and 10 step 8 closed by Jason; the rest of M5 unchanged, C2-06 builds and tests the new boundaries (Q219, mos-1299, Vikunja 465, ludwig-0014 Q4)
2026-10-22 13:10:26 -05:00
jason.woltje
3410df7c3b
morgana: row 275 r3 (duckworth-0166): B1 bob asks create only, open and send on alice's own thread; N1 thread B holds a message and the viewer read asserts its id
2026-10-22 12:46:09 -05:00
jason.woltje
1e3db53436
morgana: row 275 r2 (mos-1311): downgraded viewer keeps send and open refusals with nothing stored in the R3 test; BUILD.md lists each changed assertion, old and new, with design 4.3 lines
2026-10-22 12:46:09 -05:00
jason.woltje
4dd85c6716
morgana: row 275 (193b1b, #1780 ): viewer verbs and board refusals. VIEWER_VERBS at any grant level, collaborator for thread.create/open/send per verb, BOARD_VERBS exported and refused to users, user-side governance pin, mutants 6 and 10; FED R3 viewer-refused assertions reversed per design 4.3
2026-10-22 12:46:09 -05:00
jason.woltje
48e450ce8f
docs(row253): pin mos1298 session assertion candidate
2026-10-22 10:53:50 -05:00
jason.woltje
a6c71e6d99
docs(row253): preserve fresh gate stop at M38 survivor
2026-10-22 10:49:46 -05:00
jason.woltje
e1bc766d87
docs(row253): pin mos1297 fixture repair for review
2026-10-22 10:34:06 -05:00
jason.woltje
f5ef1c33a3
docs(row253): preserve single P10 diagnostic and reason mismatches
2026-10-22 10:27:24 -05:00
jason.woltje
2bef9124c4
docs(row253): preserve M21 survivor stop and static call trace
2026-10-22 10:10:42 -05:00
jason.woltje
34401e7c90
docs(row253): record green 27-file run and measured timeout basis
2026-10-22 09:46:35 -05:00
jason.woltje
0604d91fcf
docs(row253): pin final aca1 integration and focused file bounds
2026-10-22 09:28:15 -05:00
jason.woltje
ed3bb376cd
docs(row253): preserve doc sweep appends on corrected interim base
2026-10-22 09:26:31 -05:00
jason.woltje
cd269e7337
docs(row253): record schema3l integration before final base correction
2026-10-22 09:26:31 -05:00
jason.woltje
e75ef1b19f
docs(row253): integrate 385a base and record dependency drift and bounds
2026-10-22 09:26:31 -05:00
jason.woltje
72b17562d9
docs(row253): integrate row191 base and refresh manifest
2026-10-22 09:26:31 -05:00
jason.woltje
ad67d95955
docs(row253): record integration onto refactor 378a76b85
2026-10-22 09:26:31 -05:00
jason.woltje
3b142c9c69
docs(row253): record static approval and pre-confirmation residual
2026-10-22 09:26:31 -05:00
jason.woltje
950cf47f3e
fix(row253): bound cleanup retries after initial inventory
2026-10-22 09:26:31 -05:00
jason.woltje
cca9367168
fix(row253): supervise socket queries across sudo sessions
2026-10-22 09:26:31 -05:00
jason.woltje