jason.woltje
9538e0fc86
row 206 ( #1704 ): thread-shares trail test threads the reply into A's default session, not the thread id (first-run red, mos-1272)
2026-10-22 14:19:00 -05:00
jason.woltje
cfb86f1bd7
row 206 r2 ( #1704 ): rebased on 275 r3 957a9bfe0; share verbs need collaborator, viewer reads a share (duckworth-0169 C1, C2)
2026-10-22 14:15:47 -05:00
jason.woltje
8a29f94771
row 206 (193b2, #1704 ): sage-2818 rulings, only a human principal matches a share
...
#readable returns false for an agent session, so a `*` share no longer shows a user's message
in an agent's trail. New tests: a sharee's session.list refuses (Q1), and an agent bound to the
shared thread, a chief run and the tester match no share (Q2). BUILD.md records the Q1
follow-up, Q2-Q4 and the live --migrate as Mos's go under Q173. README names the agent rule.
2026-10-22 14:15:47 -05:00
jason.woltje
d78a9cc83c
row 206 (193b2, #1704 ): thread shares, schema 3l→3m
...
thread_shares (row 193 design 5.2) with its index and append-only triggers; the
3l-3m step only adds them. thread.share, thread.unshare and thread.shares for a
thread's owner; #readable holds design 5.4's four rules, #threadRead serves
thread.messages only, and thread.list {shared:true} adds owner. replies and
trail show shared user threads to the owner and readers. COUNTED, LISTED,
timedTables and the clock list take the table. Tests: thread-shares.test.mjs
and the 3l→3m pins. Packet agents/launchpad/work/queue-206/BUILD.md. Not run
yet: node waits for Sage's CLEAR (sage-2789).
2026-10-22 14:15:47 -05:00
jason.woltje
dc5836c7df
row 269 (264b, #1774 ): refusedOnce in sessions.test.mjs pins actor_run, closing Duckworth N1 (DEFERRED.md:474-480)
...
Allowed by Mos in mos-1292 (copy mos-1294) on mos-1285's terms. The SELECT
reads actor_run, the expected row gets the run-name literal, and the three
callers pass `${name}-run`. Nothing else in the test changes. The old
expected row was:
[['action.refused', { code: 'not-holder' }]]
DEFERRED.md gets a closing line on the entry naming row 269.
2026-10-22 13:37:34 -05:00
jason.woltje
2133c5a0c6
row 269 (264b, #1774 ): per-session store, workspace and single-writer lock
...
threadsState gives one row per session with `session` and `legacy`; threadIdle
idles a run against its bound session. Each session gets its own store
(threads/<b>/<t>/sessions/<s>/, or the thread's old store for a legacy-3l
session) and its own workspace (session-workspaces/<b>/<i>/<s>/), held by an
O_EXCL <ws>.lock from before the clones to the run's proven exit. A legacy
session's workspace binds in-sandbox at the old instance path. sessions.json
is v2 and reads v1. New tests: cli session-launch.test.mjs, seat
session-workspace.test.mjs. Not yet run: tests wait for Sage's CLEAR.
Two old assertions change as exact updates:
- mos-1285: end-launch.test.mjs threadsState deepEqual. The old row shape was
{ thread: 'th-1', instance: 'coder', pending: 0, unread: 0, lastMessage: null,
lastOpen: '2026-10-15T00:00:01.000Z', lastClaim: null, holder: null }; the
row keeps every key and value and adds session: 'th-1', legacy: true.
- mos-1289: thread-launch.test.mjs:182, old line
`const store = join(f.dataRoot, "threads", "acme", A);`
now reads A's default session id from threadsState's `session` key; :183-185
unchanged; one added assert that threads/acme/<A>/session is absent.
2026-10-22 13:37:34 -05:00
jason.woltje
3410df7c3b
morgana: row 275 r3 (duckworth-0166): B1 bob asks create only, open and send on alice's own thread; N1 thread B holds a message and the viewer read asserts its id
2026-10-22 12:46:09 -05:00
jason.woltje
1e3db53436
morgana: row 275 r2 (mos-1311): downgraded viewer keeps send and open refusals with nothing stored in the R3 test; BUILD.md lists each changed assertion, old and new, with design 4.3 lines
2026-10-22 12:46:09 -05:00
jason.woltje
4dd85c6716
morgana: row 275 (193b1b, #1780 ): viewer verbs and board refusals. VIEWER_VERBS at any grant level, collaborator for thread.create/open/send per verb, BOARD_VERBS exported and refused to users, user-side governance pin, mutants 6 and 10; FED R3 viewer-refused assertions reversed per design 4.3
2026-10-22 12:46:09 -05:00
jason.woltje
2cc34aef87
row 264a r13 ( #1769 ): threads.test :341 takes the 3l trigger's text, 'only to its session's holder' (delivery_same_session, 3k-3l.sql:153); BUILD.md raises the stack-release limit to 1800 s from the survey's 575 s and records the r10 and r11 reds and the r12 survey with M1 in Runs; test only (mos-1278, sage-2682)
2026-10-22 08:36:56 -05:00
jason.woltje
93f4af12bc
row 264a r12 ( #1769 ): sessions.test T2's refused() keeps every table but events equal and pins one action.refused {code: not-holder} event per refused call in call order; the old every-table check could never pass since request()'s catch (broker.mjs:4242) writes the refusal through #refused; BUILD.md records Mos's reading of sage-2257; test only (mos-1277, sage-2676)
2026-10-22 08:21:41 -05:00
jason.woltje
75f049ed23
row 264a r11 ( #1769 ): later3l in account-, gitea- and grant-migration names threads_id_not_session, the 3l trigger on threads (3k-3l.sql:104) the sqlite_master compares missed; test only (mos-1276 option A, sage-2672)
2026-10-22 08:14:15 -05:00
jason.woltje
c3f43960eb
row 264a r8 ( #1769 ): the six migration tests that compare a whole store with sqlite_sequence after the 3k-3l step leave out the sessions and session_defaults sequence rows and assert them exactly, so any other new row still fails; usage-migration reads sqlite_sequence by name (sage-2621, duckworth-0129); unrun
2026-10-22 08:07:43 -05:00
jason.woltje
f3e9b6512c
row 264a r7 ( #1769 ): thread.claims reads each session's latest claim, so a thread with two held sessions lists both (sage-2591, duckworth-0124 C4); thread-claims.test threads get their default session and its T5 message names it (C5), T6 two held sessions; unrun
2026-10-22 08:07:43 -05:00
jason.woltje
5baaaa447b
row 264a r5 ( #1769 ): build notes for the 3k-3l step on row 236 ( 8f51900b5, sage-2412): the renames, the merged pins and lists, gitea-migration reading both steps, and the in-memory dry run on 236's schema; README op value legacy-3l
2026-10-22 08:07:43 -05:00
jason.woltje
72fc5a330b
row 264a r2 ( #1769 ): generation fence for thread runs, a retired generation's approval, delivery and read refuse and write nothing (sage-2257); #route refuses an unknown session, README default-op note, Row 155 comment reworded, mutants M1-M3 in the build notes (duckworth-0107)
2026-10-22 08:07:43 -05:00
jason.woltje
d6301dffce
row 264a ( #1769 , T1 item 7): bus schema 3k to 3l, sessions below a thread
...
sessions and session_defaults are new and append-only. thread_claims, message_threads and
thread_opens are rebuilt in place with a session column, and thread_claims gains a generation
counted from claim rows. Each existing thread gets a default session with the thread's id; new
threads get a random one. Holder, per-run, release and delivery triggers key on the session,
and two id triggers keep session and thread ids apart (Duckworth checks 1-7, duckworth-0106).
The broker binds a thread run to a session (the default when the record names none), and
thread.open, thread.send and thread.messages take an optional session. New verbs session.list
and session.create (idempotent on op). Tests: sessions.test.mjs for T1 bus half, T2 and T7 with
a pinned 3k fixture; count, version and verb pins; hand-made test threads write the legacy
default session.
Built on row 236 (8f51900b5
2026-10-22 08:07:43 -05:00
jason.woltje
54ebc5d71c
row 281 b5: T14 pins that the human's no takes a declined host decision out of the set, after hosts.remove left it with no host (N1); M22 drops the closed check and T14 kills it; test only, not yet run (sage-2653, dewey-0844, #1786 )
2026-10-22 07:42:10 -05:00
jason.woltje
6b6eb533e8
row 281 b4: T6b pins step 0's four Gitea reads in order and says 'before any Gitea write'; M1-M21 all killed on b4a 3f29375a8 with the M1 exit check, table in the build notes (dewey-0839, sage-2627, sage-2643, #1786 )
2026-10-22 07:42:10 -05:00
jason.woltje
f9fcf5d7b3
row 281 b4a: the M1 hang was T6c's held web1:add loop, which only the fire's abort ends; setup's t.after clears held and failing, and T6c and T10 release their Gitea gate; test only, no code change (mos-1273, sage-2636, #1786 )
2026-10-22 07:42:10 -05:00
jason.woltje
c055dddf44
row 281 b3: the first base run's five red tests were test faults, no code change; T4b reads the manual's revoke id from its event, T5b expects gitea-left:<id>,tokens (N10), T6b allows step 0's GET checks, gitea T8 leaves the call log out, cli T10 makes the 0700 store root; rebase onto 980cec88c noted (sage-2605, sage-2615, #1786 )
2026-10-22 07:42:10 -05:00
jason.woltje
4982fa0adf
row 281 b2: T1-T13 tests (fire-revokes-grants, lifecycle-revoke T1, T8 tester refusals, cli T10 pass) and the test choices in the build notes ( #1786 )
2026-10-22 07:42:10 -05:00
jason.woltje
7c2c876319
row 281 b1: step G in the broker (fire and delete jobs, the grant set, the lock, boot's interrupted check) and build notes ( #1786 )
2026-10-22 07:42:10 -05:00
rocko
407c8d7be2
test: harden processing failure diagnostics and cleanup
2026-10-22 06:24:27 -05:00
jason.woltje
3a5275a9ad
morgana: row 277 ( #1782 ) build r2: thread-claims test helper passes a run's capability through, T1 copies store rows before the strict compare (early look sage-2504)
2026-10-22 06:01:09 -05:00
jason.woltje
eccd6e276e
morgana: row 277 ( #1782 ) build: thread.claims bus verb for human and reader sessions (D1), mosaic agents adds thread lines without --tester or --json (C1/C2), message-filter pin moves to thread.claims (C3), tests T1-T8
2026-10-22 06:01:08 -05:00
jason.woltje
e617543b8d
honker: row 256 ( #1761 ) b1: the human deletes a creative instance and any other actor is refused organization-creative-human-only; protectedRefusal is the delete check and the listing's per-reader endProtected; actor threaded through planDelete/checkDelete/instances.check; fire unchanged; DEFERRED entry closed for delete; tests T1-T8, unrun
2026-10-22 05:33:13 -05:00
jason.woltje
4c485c63b9
morgana: FED R3 r6 (sage-2576): the collaborator-list test pins USER_VERBS as the ruled seven so M3x and M6x fail it, and its off-list set adds the grants, lifecycle, web and host verb lists; test only, unrun
2026-10-22 05:06:52 -05:00
jason.woltje
f58cfc3617
morgana: FED R3 r5 (sage-2566): covers, LEVELS and the all marker move into the business vocabulary so the broker keeps its sandbox import closure; access.mjs re-exports them, the pin test lists covers on the vocabulary line, RUNNER_FILES unchanged, M16 on the pin, the closure walk and the confined load; unrun
2026-10-22 04:48:41 -05:00
jason.woltje
cee3f25a37
morgana: FED R3 r4 (sage-2486, sage-2557): halt refuses a granted user's thread.send while thread.messages answers (test), row 194's hire refuses an instance named user at the broker and the writer (S1, one test each), the access argument check moves before the store read (S2, test), M12-M15; unrun
2026-10-22 04:48:22 -05:00
jason.woltje
618fe0f0b3
morgana: FED R3 r2 (dewey-0777): role key user refused at the broker load check and by the instance writer (N1, one test each), #threadFor user clause listed as an equivalent mutant, 193b1a filter mutant not applicable, M10/M11 and the M3x two-walls run in the kit; unrun
2026-10-22 04:48:22 -05:00
jason.woltje
d20c92bf65
morgana: FED R3 build ( #414 , sage-2292): user principal on the bus, bindUser with a per-request grant read, the collaborator verb list and its filters, user threads and the B6 reply path, runner user header; unrun
2026-10-22 04:48:22 -05:00
jason.woltje
bd5f11dedd
bus: row 236, a gitea grant raise on a broker with no Gitea path refuses gitea-not-configured (sage-2559, #1742 )
2026-10-22 03:59:40 -05:00
jason.woltje
e40b74bebc
bus: row 236, two out-of-manifest pins: gitea is a known grant method, and the broker imports giteaName and parseGiteaUrl (gate run sage-2554, #1742 )
2026-10-22 03:57:48 -05:00
jason.woltje
ce74477e14
bus: row 236, grants.status is a read under the kill switch, as hosts.status is (sage-2453, #1742 )
...
Row 191's #processingGate refuses agent verbs off its read list while
processing is halted. grants.status joins hosts.status on that list, per
the kill-switch plan (2026-10-20_kill-switch.md:16): reads still work.
An agent's grants.revoke stays refused while halted, as hosts.revoke is.
2026-10-22 03:42:05 -05:00
jason.woltje
4d9d62ae89
bus: row 236 r3, one N5 test per settle branch; README notes for a left admin token and a running executor (sage-2388, #1742 )
2026-10-22 03:42:05 -05:00
jason.woltje
5e5ba94b19
bus: row 236 r3, a revoke during a settle whoami ends revoked in the 401 and token-unknown branches (Dewey N5, #1742 )
2026-10-22 03:42:05 -05:00
jason.woltje
97bbe7fd30
bus: row 236 r2, a revoke during step 7 or a settle ends revoked; sweep fire retry checks the user id (Dewey B1, B2, #1742 )
2026-10-22 03:42:05 -05:00
jason.woltje
91f7029923
bus: row 236 gap test takes any HTTP status in a grant.result (debug run 2, #1742 )
2026-10-22 03:42:05 -05:00
jason.woltje
be11a1f7e6
bus: row 236 tests for the static mutant gaps M8, M9, M16, M28, M29, M37 ( #1742 )
2026-10-22 03:42:05 -05:00
jason.woltje
d87483d683
bus, cli: #436b Gitea grant path, schema 3j-3k (row 236, #1742 )
...
Gitea grant executor (steps 0-8, settle, restart, revoke and fire, sweep,
status), the grants.* verbs and mosaic grants, the 3j-3k migration with
gitea_users and gitea_grants, and the section 9 tests with a fake Gitea and
a scratch gitea/gitea:1.27.1 X-G3 test. Build notes in
agents/megavolt/work/queue-236/BUILD.md.
2026-10-22 03:42:05 -05:00
jason.woltje
5fd178e44d
honker: row 194 b15 (a) (sage-2501): the Broker constructor's harnessOn, testerOn and roleFile type checks move ahead of the store reads, so a null store gets the argument error first (chief-of-staff T8b); 191's lines unchanged
2026-10-22 03:06:41 -05:00
jason.woltje
4f68485272
honker: row 194 b8 r2 (sage-2289): a fire stop stopRun can't confirm (unknown) reads as lifecycle.end.alive with reason unknown, never killed, and the Console flags it; cli T9a no-runtime-record test, bus T9a reason checks, M56; notes
2026-10-22 03:06:41 -05:00
jason.woltje
5d2c274420
honker: row 194 b8 S6 (sage-2241, sage-2246, sage-2261): fire's kill end goes through row 191's stopRun with the fire's request as owner, killed and alive come back as lifecycle.end.killed and lifecycle.end.alive and the Console flags a run still alive; terminate stays SIGTERM-only (V3); halted, the pass closes launches and regenerates processing-halted and a halt joins a fire's stop; terminate's pass narrows to runs spawned by the end's time (N6); T9a, T9b, T15, N6
2026-10-22 03:06:41 -05:00
jason.woltje
3521c23c3e
honker: row 194 b6 (webby-0094, sage-2241, sage-2245): every instance-writer verb answers restart (B1) and the CLI and Console show it for veto; fire runs the writer's checks against the file before step A, so an unloaded keep can't strand an instance firing; a fire of a delisted name revokes (N1); a host service makes no token reference (N2); only the human re-points a kept instance's model (N3); DEFERRED a human escape for a stuck fire (N4); S6 waits on row 191's stopRun contract
2026-10-22 03:06:41 -05:00
jason.woltje
2311a50e1c
honker: row 194 b4 (sage-2164, sage-2166, sage-2217): a hire and the role's hireable list refuse a creative definition; a library mapping change isn't reloaded (T14); the listing's endProtected hides a Delete the server refuses; DEFERRED creative delete; C1 testerNoSignIn closed; row 213's writer-restart pin follows D3 and T16 uses row 196's tester socket
2026-10-22 03:06:41 -05:00
jason.woltje
29daebf548
honker: row 194 b3 sage-1634: commit() checks the revision before the revoke, so a stale delete or fire refuses revision-conflict with nothing revoked (N1); bus T21; option 2 a follow-up
2026-10-22 03:06:41 -05:00
jason.woltje
b8c3d00362
honker: row 194 b3 sage-1620: credential-revoke-failed says the business file is unchanged and a retry is safe (CLI and Console), W2 checks the log per case
2026-10-22 03:06:41 -05:00
jason.woltje
14124d96d4
honker: row 194 b3 (sage-1605, sage-1610): fire and delete revoke before the write (T20), a human add takes a tracker bot, a store-only delete names the bot; the tester keeps the credential refusal (row 175 W2); channel-proof and project-runtime pins
2026-10-22 03:06:41 -05:00
jason.woltje
e7fb59f225
honker: row 194 on row 199's landing cb5fdb064 (sage-1601): honker/row194-b2 85edab7c7 squashed, five conflicts kept both sides (broker imports, constructor, dispatch, the credential and lifecycle verbs; runtime imports; organization write takes detail and context; cli credentials and veto dispatch; vocabulary comment as row 199 wrote it)
2026-10-22 03:06:41 -05:00
jason.woltje
rocko