The factory profile of scripts/case2-unit.sh now takes the bare pair
--sso --send, ported from the lane's serve_flags rule (b00019548). Either
flag alone refuses, and the proxy preview set and the proof pair still
refuse. Before any unit write, a bounded query run as the stack user,
through the existing config-query supervisor, checks that the stack
user's system config has console.sso; the Console refuses --sso without
it at start (packages/webui/src/cli.mjs:95). The server needs no change.
The library profile is unchanged: still read-only, still refusing --send
and --sso. Taking library --send with forward-auth and proof would need
the #385 refusal reverted in cli.mjs:63, serve.mjs:681 and the service,
release and upgrade scripts, so it is not done here.
docs/guides/case1-business.mosaic-stack.json now launches
claude-opus-5-5 with provider proxy, route anthropic, under account
factory with credential proxy.
Appends a BUILD-LOG entry that corrects the R1 entry without editing it: the
R1 walk change also dropped the recursive lstat, which R2 restores; the
tester-cli freePort helper has no callers and binds nothing; the stack-release
and control-board probe-then-bind window stays a known risk for a follow-up.
Appends one SESSIONS line.
GPT review of the 1.19 rebase found the test header still called the PRD a candidate and the rebase record placed lines 793 and 645 in the wrong requirements. Comment and record only; no assertion changes.
Rebased onto refactor as 1.19 because row 335 landed 1.18 first. Requirement text, IDs, order and the 101
records match the approved fd9ae104d apart from version labels. GPT review APPROVE with two P3s, fixed in the
next commit.
Row 335 landed PRD version 1.18 first, for the REQ-INST-2 correction. The
disk-space governance text that Jason approved as 1.18 in Q289 therefore
lands as 1.19. Only version labels move: the status line, the disk version
source bullet, the "since version" labels in the disk sections, the disk
milestone, and requirements.json "version". The requirement text, IDs,
order, defaults, settings and the 101 records are unchanged.
The prior approval history bullet now runs through version 1.18 and carries
the row 335 lines. The two test pins follow the renumbering.
Records the replayed join of row 333 R2 (0ef269da9) onto landed row 332 (5df0e9d6f) in merge c0c291cda: the two conflict hunks and their resolution, the comparison with the earlier join resolution, and the nine suite results. Adds the docs/SESSIONS.md line.
Appends the R3 section to agents/steelbeak/work/queue-227/BUILD.md: the
R2 red on dummy links, the fixes, how the TMPDIR limit is derived, the
namespace containment and control table, runs, signal probes, the tip
check on 5df0e9d6f and follow-ups. One line each in BUILD-LOG.md and
docs/SESSIONS.md. Earlier entries are unchanged.
Joins row 333 R2 head 0ef269da9 (base 09a847eda: R1 503b91e56, overlay
2627321f6, docs c012b2e0a and ddb3e961f, R2 fixtures 12eba4b59 and
0ef269da9) onto refactor with row 332 landed at 5df0e9d6f. Run with the
union attributes for BUILD-LOG.md and docs/SESSIONS.md. Two files
conflicted; no other path did.
packages/business/src/launch.mjs, import block: 332 changed the errors
import to `{ BusinessError, refuse }` for the proxy route refusals; 333
added `isDailyModelQuota` from plugins/src/model-quota.mjs for the daily
model leaves under limits.tokens.keys. Kept both: the model-quota import
and the `{ BusinessError, refuse }` import. The rest of launch.mjs merged
without conflict (332's checkModels route handling and checkAccount
credential "proxy"; 333's checkTokenLimits keys block).
packages/plugins/README.md, end of file: 332 appended "Per-session proxy
context (P3)" and 333 appended "Proxy usage telemetry (row333 / P5)" at
the same spot. Kept both sections, P3 first, one blank line between.
The resolved files match the earlier 332 R1 join resolution
(join-resolution.patch) line for line apart from hunk offsets.
Appends the "R2" section to agents/steelbeak/work/queue-227/BUILD.md: findings and fixes,
no step failures past launchFixture, the environment and signal controls, the mutant table
(m6 on requireCitation survived and is a follow-up), run times and the tip check. One line
each in BUILD-LOG.md and docs/SESSIONS.md. Earlier sections are unchanged.
Unclaimed files left in the canonical checkout. Inventory: canonical-cleanup-inventory.md (commit-as-evidence groups). detect-secrets scan clean on 2026-11-02: hits are sha256 pins, git object ids, test sentinels already in tracked tests and unit-file lines.
The row 173 test called setup(false), which starts the page with Show machine sessions off, so the sessions table it waits for never renders. Its sibling uses setup(true). Change the one argument; app.js is unchanged. The same test fails on the r2 tip 6d15eb5fc2, so base drift was not the cause.
(cherry picked from commit 996c79524f)
Commits the row 227 evidence under agents/steelbeak/work/queue-227/: the remaining gate/ files, runs/ (first, corrected1, priorityprobe), target-packet, target-packet-r2, target-packet-r3, target-packet-r4, static/, and the two top-level manifests. Also commits BUILD.md and the append-only BUILD-LOG.md and docs/SESSIONS.md entries. The R4 packet hashes are PACKET.sha256 4eb60915b2144137df9b5a42afd0c5b266718d71de051fb8be53a27430a2cad4 and CURRENT-SOURCE.sha256 0cfd47c2073bc18a3ba7bff1ce6fdf39fe33a64b7fca209be71517b9feb89020, both checked against the files. The overlay bytes are committed in 4ac6f13bc. This commit adds receipts and packets only and records no scripts/test-case2.sh run on the R4 overlay.
Commits agents/codex/work/queue-333/r1-repair/ (packet, receipts, review and author files) and the append-only BUILD-LOG.md and docs/SESSIONS.md entries. The packet INDEX.json sha256 is 3eb9b8d10445aa328be3b854385e4792dda2c5712b19d443d485d1b00a18d0f8 and source-tests.patch is a78bc385801b64be270fb9d6e84672c443738a5fce8eb68f7d2a01359a57a770; the product commit for these bytes is 2627321f. Two packet tarballs are deliberately not committed: packet/baseline-input-bytes.tar.gz and packet/fixed-input-bytes.tar.gz. The secret check reported a -----BEGIN marker in each (members packages/bus/src/credentials.mjs and packages/discord/src/tools.mjs, byte-identical to 503b91e56 and with no PEM body). They stay untracked until the lead rules on them.
#156 changes src/run-agent.sh and src/load-contracts.sh, which are baked into
the worker image. Its run-agent.sh refuses to start unless the launcher sets
MOSAIC_SYSTEM_PROMPT_FILE, and no launcher before #156 does. Rebuilding the
shared 0.0.12 tag would break the live pinned copy and rollback targets, so the
new image gets its own tag. No code change.
jason.woltje