Adding an agent with a store credential on an instance with no
<configDir>/secrets/agents left the bus unable to start
(credential-file): Credentials refuses a missing store root, and only
issue() made it, which needs a running bus. Start now makes the root
(0700) the same way issue() does, only when some reference has
store: true. Credentials' own refusal (credential-store T1) is unchanged,
and a root with loose modes or a symlink still refuses start.
Tests: two new credential-verbs tests; the creation test fails on
483eccb3d with credential-file. All 171 bus test files run one at a
time: 1713 pass, 0 fail.
Jason approved draft 2 on 2026-11-09 at 22:57Z: "The file looks fine
other than that." The exception is the Montage module name, deferred
since 19:26Z. Amends REQ-ASSIST-1, REQ-USER-1, REQ-TASK-1 and REQ-WEB-3
and adds 17 requirements (101 to 118): REQ-WS-1..8, REQ-AGENT-1..3,
REQ-SYS-1..2, REQ-ACCT-1..2, REQ-SETUP-1..2. requirements.json and the
tasks and bus count pins follow.
Tests: 68 pass, 1 fail. The failure is stack-copy.test.mjs (20/1), which
fails the same way on origin/refactor 483eccb3d: npm's pinned install
can't find node-gyp/bin/node-gyp.js in the test Node installation.
Conflict in packages/webui/src/serve.mjs imports: kept F2's
THREAD_DEFINITION and onboarding imports on stage B's organization path.
The F2 assistant test edit followed the move to packages/organization;
onboarding-browser now imports the organization service directly.
REQ-SETUP-2 (PRD 1.20 draft), unified workspace direction ruling 14 and
phase F2.
- packages/project/templates/onboarding-interview.json: the interview's
conversation name, four questions, draft paths and first message.
loadInterviewTemplate(url) reads it and validateInterviewTemplate checks
it, so an organization file or a plug-in can pass a replacement later.
- approveNorthStarDraft: agents never write spec/, so the assistant
proposes docs/north-star-draft.md with its existing record.write grant
and the human approves. The approval copies the exact reviewed draft
commit into spec/north-star.md through the human save verb, pinned to
the reviewed spec commit. A rewritten draft or a moved spec writes
nothing. No new verb, grant or role change.
- mosaic project north-star <project> [--approve <draft> --base <spec>]
shows the spec and the draft and approves as the human; mosaic project
interview <project> prints the first message; mosaic thread create
takes --instance.
git mv packages/business -> packages/organization (@mosaic/organization). The
old package stays as one-line re-export shims of each moved module, with
src/business.mjs re-exporting src/organization-config.mjs and src/cli.mjs
forwarding to the moved executable. BusinessError is OrganizationConfigError
(one constructor, name kept BusinessError); OrganizationError stays distinct.
The bus adapter gains organization-context.mjs (busOrganization), with
business.mjs (busBusiness) as the same function.
Import consumers, manifests, the lockfile, scripts/mosaic, stack-copy.sh
COPY_PATHS (both roots), seat sandbox RUNNER_FILES and the copy closure
walker (organization-imports.mjs, both roots required) move to the new path.
v1 serialization, v1 writers and the stage A fixtures are unchanged; the stage
A contract tests stay where they were and pass as before.
readCandidate called readPrdMaterial with the org data root directly, so
prd.submit and the Console PRD draft kept working while project.files refused
the same conflict. It now resolves through recordArgs like the file adapters.
Fixes the P2 from the E2E4 review.
BUILD-LOG.md: append-only union, refactor entries first, then the branch's.
docs/SESSIONS.md: append-only union, refactor entries first, then the branch's.
packages/bus/src/runtime.mjs: keep the organization usage timer and refactor's halted/invalid startup-recovery gate.
packages/harness/src/first-output.mjs: keep the branch's harness-neutral markers; refactor's empty-length rejection moves into the Pi monitor (packages/plugins/harness/pi/model-stream.mjs).
packages/harness/tests/runner.test.mjs: keep refactor's length-continuation cases and the branch's output-policy cases.
packages/plugins/harness/pi/index.mjs: keep the documented GLM limits and the branch's transport-based bundle.
Suites: 6356 pass, 32 fail; all 32 fail identically on both parents
(node_modules symlink EISDIR in pinned-copy and stack copy/release tests,
missing Python jsonschema in two conversation tests).
Review round 1 on 4048e0f60 found two defects.
Startup recovery ran unconditionally. A continuation retry now refuses
while processing is halted, so a broker restart with a waiting
continuation failed with processing-halted. Startup recovery now waits
while processing is halted or invalid, as the periodic pass does;
processing.resume schedules it again.
#continuationStarting matched any launch without an end, so an older
launch whose end was lost (#1851) hid every later run's end. Only the
target's latest lifecycle event counts now.
Both regression tests fail on 4048e0f60 and pass here.
Expose the parent message class on agent delivery so the runner can stop automatic replies to answers while preserving requests and ordinary relays. Scope continuation retry versions to the target, suppress notices during processing halts and unclaimed launches, and clarify the instance-running refusal.
The bus suite excludes project-files.test.mjs because its 1 MiB socket test timed out on both the candidate and the untouched 1186cf7b1 base.
The oversize and unresolved ask-PM notices were appended without
checking the room left by the lead, so a lead with 0-130 bytes left
pushed a 972-task request past exec capacity (E2BIG at 131,086).
quoteBlock now returns at most max(room, 0): the full notice, the
47-byte short line, or nothing. Tests sweep rooms -3..160 for both
steps and run a 972-task lifecycle that must still exec.
BUILD-LOG appends a correction to the r4 limits (40,774 / 88,234).
Jason's owner report 2026-11-06: no way to archive or delete projects.
Archive is the reversible half; delete stays out of scope because project
and run records are write-once evidence.
- project.archive / project.unarchive: human-only (project.create's gate
minus the tester carve-out; tester, user and agent refused). State is the
latest row of a new append-only project_archives journal (3s->3t, additive;
the rows are the audit trail), so projects itself never changes and nothing
is deleted. Repeats refuse project-already-archived / project-not-archived.
- project.list hides archived projects until {includeArchived:true}, which
flags each with archived:true; a user still lists granted projects only.
- While archived, thread.create, thread.send, room.open and room.send refuse
project-archived; every existing record stays readable and unarchive
restores everything.
- Console: new public/project-archive.js (+css) and project-archive-http.mjs
routes (chatHTTP's write fence); chat.js gains two one-line hooks,
index.html one script and one link tag; styling only through the shell's
.project-archive-control / .project-archived-filter hooks.
- CLI: mosaic project archive|unarchive <name-or-id> and list --archived.
- stack-release COUNTED/LISTED gain project_archives (schema order); schema
step-count pins and migration fixtures updated for 3t.
bus 1601/1601 (Node 24; Node 26 has the pre-existing project-file socket
stall), webui 582/582, plugins 132/132, cli 1191/1194 (two pre-existing
load flakes of the row253 C4 and land_work families; both pass isolated and
the base commit's full suite fails four of the same family).
The r2 review found that counting raw bytes let JSON and control
escaping grow one quote six-fold, so the runner's MOSAIC_REQUEST
exceeded the exec string limit (E2BIG). The continuation renderer now
applies the 16384-byte budget to encoded title and text bytes, cutting
on whole code points. Adds an execution-boundary regression.
Gate on the merged tree: business 307/0, bus 1596 pass with one
pre-existing hang (project-files.test.mjs, same on relay base 2f1cef4c1),
harness 243/1 on the row 66 unslop test, which also fails 1 in 3 runs
on the relay base (timing flake, pre-existing).
D3: coder/reviewer sandboxes cannot read the product records repo and
list_requirements stays PM/CTO-only (row 90, #1584). The bus now quotes
the task-cited approved requirement texts (exact text, id, title, citing
task refs, snapshot id, product key, records commit) into the
implementation and review continuations, resolved host-side through the
same catalog resolver behind the scoped requirements verb, never from
model input. Quotes are bounded at 16384 bytes and framed as quoted
data; an unresolvable or revoked snapshot degrades to an ask-PM line
without blocking the task. No role, tool or schema widened; one duty
note each in roles/coder.md and roles/reviewer.md.
Review M1 on 62bece4a9: a failed notice insert or route threw past
#refused, replacing request-evidence-required and skipping its audit.
The notice is now best-effort; its transaction still rolls back whole.
Tests: insert and route failures keep code, audit and lifecycle; retry
publishes once. Both red on 62bece4a9.
Wake the existing PM when validated evidence arrives after its first notice,
including overlapping recovery across retained request history. Preserve durable
deduplication and current authority checks.
Put the exact verification record and verdict contract in the first scoped
review request. Carry linked owner-request provenance into runner headers and
expose the existing requirement-record example to planning tools.
Implementation: Codex Terra initial repair; Codex Sol lead R1 correction,
regressions and developer documentation. Independent R2 APPROVE, 115 focused
checks. Matching final local coverage proves 4,333 distinct required cases;
the intentional FEDR7 skip is covered by its standard scratch wrapper.
Reviewed patch: 18ff6455e7ab69bc55cef88845f86189ed5f67b114ad7996f714a35ca1a90239
Source manifest: 6daf0668101bbad030c45411304d0d049de5e4da32bdcb03c40095ed1c63128f
jason.woltje
mos