Commit Graph
172 Commits
Author SHA1 Message Date
jason.woltje 2b3e3ec83b Merge row 334 (#1832): Case 2 proxy unit in case2-unit.sh and case2-install.sh 2026-11-02 12:50:15 -06:00
jason.woltje 418f00bce2 Merge PR #1836: Require verified OIDC for Console human writes (#385) 2026-11-02 12:31:19 -06:00
jason.woltje a7a433e271 Merge PR #1837: Pin the worker to the patched immutable Node24 base (#470) 2026-11-02 12:31:19 -06:00
jason.woltje 484aef7e2a fix(upgrade): refuse a pre-#385 library Console unit before units stop (#385) 2026-11-02 12:19:07 -06:00
jason.woltje d0ddfa8de2 fix(upgrade): refuse legacy library --send before units stop (#385) 2026-11-02 12:03:59 -06:00
jason.woltje ab2bc23c7f fix(console): keep preview deployment profiles read-only (#385) 2026-10-29 00:54:30 -05:00
jason.woltje 1d6dae6fe4 fix(worker): snapshot fork input before container binding (#156) 2026-10-29 00:46:50 -05:00
jason.woltje 7fff6a20e6 fix(testing): bind image receipts to pinned build base (#470) 2026-10-29 00:33:01 -05:00
jason.woltje ee151685e9 fix(worker): limit legacy mounts to selected inputs and outputs (#156) 2026-10-29 00:19:26 -05:00
jason.woltje 9936a1be1a fix(webui): require verified OIDC for human writes (#385) 2026-10-29 00:19:02 -05:00
jason.woltje c4bba5d2a3 row334: render P1 proxy system unit in Case 2 installs 2026-10-26 17:39:34 -05:00
jason.woltje 362893d043 feat: integrate reviewed proxy page and managed model keys
Source-candidate: poe d9a564e6d20f5f0fd75ce45b12cbbf8bb4c9d568\nSource-candidate: magica38ba5762b06716db1dee00d0afec162656488f5c\nValidated321whole-file phase plus whole bus1349/model-proxy100/webui490; final gate tooling checks pending, not landed.
2026-10-26 12:04:21 -05:00
jason.woltje c65fb34ee6 row329: finish pinned model proxy P1 and record final gate (#1827) 2026-10-24 18:30:11 -05:00
jason.woltje 94cde633e2 WIP row329: preserve P1 draft before required base rebase (#1827) 2026-10-24 18:30:11 -05:00
Steelbeak dc8f552819 Row 287: grant library collaborators with declared scopes 2026-10-24 10:55:31 -05:00
Lena 4f7bb95b33 Untested: row 296 scratch two-instance acceptance (#1802) 2026-10-24 05:39:13 -05:00
jason.woltje 1bd214e382 Detect binaries despite git attributes and reject unconfirmed reviews (#1825) 2026-10-24 01:40:50 -05:00
jason.woltje 56c1845505 Fix push-check binary checks from repository subdirectories (#1825) 2026-10-24 01:40:50 -05:00
jason.woltje 72a3125a6e Add reviewed-binary push check and scratch regression suite (#1825) 2026-10-24 01:40:50 -05:00
jason.woltje 467b05fe2b fix(case2): import library personas from the pinned copy (#1818)
(cherry picked from commit 7b4ea42171)
2026-10-23 18:15:16 -05:00
jason.woltje ea4eaf388f fix(precheck): require the explicit notifier decision before host start (#1816, Vikunja 614). Untested 2026-10-23 16:37:24 -05:00
jason.woltje f9202a7701 fix(installer): allow scoped Claude paths and leave unreadable cwd (#1816, Vikunja 614). Untested 2026-10-23 16:37:24 -05:00
jason.woltje 689a0a3c91 fix(hostcheck): accept dpkg octal mode and verify bundles in scratch repos (#1816, Vikunja 614). Untested 2026-10-23 16:37:24 -05:00
jason.woltje 661890e909 gosalyn: row 226 C2-13b build, case2-install.sh writes the business file and personas through a plan step before any write, case2-precheck.sh adds the D6a mode, persona and Discord checks and --library-status with lastError first and the wider escape, case2-install.test.mjs, run sheet lines; candidate before the gate (webby-0087 N2 N3, sage-2195, sage-2205, #1727) 2026-10-23 14:41:39 -05:00
jason.woltje cabcb81d49 row 305 (#1812): each suite's network check also requires the network present under the run's project before the remove (mos-1445) 2026-10-23 06:49:49 -05:00
jason.woltje 353d65f577 row 305 (#1812, Vikunja 591) draft: per-run COMPOSE_PROJECT_NAME, exit trap removes that one network, one absent-network check per suite; for Mos through Sage before the build (mos-1272) 2026-10-23 06:49:49 -05:00
jason.woltje 39bde4fd43 fix(release): validate non-console config keys with target loader 2026-10-23 00:18:01 -05:00
jason.woltje 8c28ee7315 gizmoduck: row 270 (264c, #1775) round 3 for duckworth-0226 B4 (sage-3038): one collection opens at most the system config's compactionStreams stream files in name order (default 1024, 32 to 65536, a bad value takes the default and logs), not-collected past it with no cursor for an unopened stream; the missing-stream check uses a Set; readStreams, cap and launcher tests; mutants M22-M24, M10 anchor moved; docs/TOOLS.md has both keys and C1 (N4); BUILD.md round 3 with stream counts, the 231 KB bound, C1 and N5; not run 2026-10-22 21:07:51 -05:00
jason.woltje bce4917154 gizmoduck: row 270 (264c, #1775) round 2 for duckworth-0223 B1-B3 (sage-3030, sage-3031, mos-1352, sage-3033): pi streams read in 1 MiB chunks under a budget from the system config's compactionReadBytes (default 64 MiB, 1 MiB to 1 GiB, a bad value takes the default and logs), not-collected past it; Claude history from before the ledger is harness-unsupported for good; launcher, runtime reader, clear and legacy tests; mutants M13-M21; BUILD.md round 2 with sizes, schema change, rollback hazard, N1-N3; not run 2026-10-22 21:07:51 -05:00
jason.woltje aa8fc490f5 row 271 (264d, #1776): clear context build round 1, not run (slot held). Broker: session.clear, session.cancel and session.operation, the fence on send/open/claim, cancel at arrival for routed messages, the drained receive and the end drain, trusted ops sessionClears and sessionClearExited/Uncertain/Retire/Start. Launcher: clearPass before the threads loop (stop, proof, retire, successor start through check()/start()), waiting on a live row 269 survivor. Old tests per mos-1315, rebased on row 206 (sage-2968): label 3m to 3n, future step 3n to 3o, 3m-3n.sql in the engine copies and file lists, ready lines, later3l and the rows() exclusions gain both tables as 206 did for thread_shares (mos-1292, approved in mos-1336), schema.test counts 25 tables and 96 triggers, COUNTED and T45 LISTED gain both tables after thread_shares (mos-1318, mos-1319), TESTER_VERBS pin (mos-1325), fixtures/schema-3m.sql 2026-10-22 21:07:51 -05:00
jason.woltje 7c543fd4a1 row 203 FED R2: cases for missing self, peer id and label (webby-0191 B3)
The pattern test coerces an absent value to the string 'undefined', which
matches, so the typeof halves are the only refusal for a missing value. Adds
a case for each, and M15-M17 in BUILD.md; keeps the config-console-key check
name on purpose. Not run yet.
2026-10-22 17:57:25 -05:00
jason.woltje 284d55cf2c row 203 FED R2: stack-release probe reads federation; a refusal case per federation check
stack-release config_checks refuses a target whose loader refuses a key the
config holds; it looked only for console, so a federation-only config passed
to a pre-203 copy. The probe now reads console or federation. The fixture's
B loader replace follows the new rejectUnknownKeys list, which the federation
key changed.

Adds a test for each federation refusal in test-config.sh (six uncovered,
plus trailing slash and duplicate peer id), and one stack-release test for
the target-loader refusal. Mutants M7-M14 in BUILD.md. Not run yet.
2026-10-22 17:57:25 -05:00
jason.woltje 93a491d732 row 203 FED R2: federation key in the system config (#1701)
The loader validates an optional federation block: self and peers[].id
labels, peers[].origin as an https origin with no path, query or userinfo,
peers[].label non-empty and at most 80 characters, peer ids unique and
distinct from self. Unknown sub-keys refuse. Labels and URLs only; the key
grants no trust. Absent key: config loads with no federation output.

Tests in scripts/test-config.sh cover each refusal and the no-key case.
Notes and mutants M1-M6 in agents/quackerjack/work/queue-203/BUILD.md.
Not run yet: the gate runs on CLEAR.
2026-10-22 17:57:25 -05:00
jason.woltje 931fab079a perf(case): remove duplicate head validation per mos-1350 2026-10-22 16:59:44 -05:00
jason.woltje 47906e4fde fix(case): isolate legacy stdout after outer timeout per mos-1345 2026-10-22 16:59:44 -05:00
jason.woltje 537ce2dd4a fix(case): silence vanished stat opens per mos-1337 N5 2026-10-22 16:59:44 -05:00
jason.woltje b96b4e303d fix(case1): supervise legacy user calls across sudo sessions 2026-10-22 16:59:44 -05:00
jason.woltje d78a9cc83c row 206 (193b2, #1704): thread shares, schema 3l→3m
thread_shares (row 193 design 5.2) with its index and append-only triggers; the
3l-3m step only adds them. thread.share, thread.unshare and thread.shares for a
thread's owner; #readable holds design 5.4's four rules, #threadRead serves
thread.messages only, and thread.list {shared:true} adds owner. replies and
trail show shared user threads to the owner and readers. COUNTED, LISTED,
timedTables and the clock list take the table. Tests: thread-shares.test.mjs
and the 3l→3m pins. Packet agents/launchpad/work/queue-206/BUILD.md. Not run
yet: node waits for Sage's CLEAR (sage-2789).
2026-10-22 14:15:47 -05:00
jason.woltje 950cf47f3e fix(row253): bound cleanup retries after initial inventory 2026-10-22 09:26:31 -05:00
jason.woltje cca9367168 fix(row253): supervise socket queries across sudo sessions 2026-10-22 09:26:31 -05:00
jason.woltje d6301dffce row 264a (#1769, T1 item 7): bus schema 3k to 3l, sessions below a thread
sessions and session_defaults are new and append-only. thread_claims, message_threads and
thread_opens are rebuilt in place with a session column, and thread_claims gains a generation
counted from claim rows. Each existing thread gets a default session with the thread's id; new
threads get a random one. Holder, per-run, release and delivery triggers key on the session,
and two id triggers keep session and thread ids apart (Duckworth checks 1-7, duckworth-0106).

The broker binds a thread run to a session (the default when the record names none), and
thread.open, thread.send and thread.messages take an optional session. New verbs session.list
and session.create (idempotent on op). Tests: sessions.test.mjs for T1 bus half, T2 and T7 with
a pinned 3k fixture; count, version and verb pins; hand-made test threads write the legacy
default session.

Built on row 236 (8f51900b5), which takes 3j-3k, so this step is 3k-3l by landing order
(row264 Q2, sage-2412). The op values are legacy-3l and migration-3l. gitea-migration.test reads
its store after both steps. Not run yet: every run waits for Sage's CLEAR.
2026-10-22 08:07:43 -05:00
jason.woltje d87483d683 bus, cli: #436b Gitea grant path, schema 3j-3k (row 236, #1742)
Gitea grant executor (steps 0-8, settle, restart, revoke and fire, sweep,
status), the grants.* verbs and mosaic grants, the 3j-3k migration with
gitea_users and gitea_grants, and the section 9 tests with a fake Gitea and
a scratch gitea/gitea:1.27.1 X-G3 test. Build notes in
agents/megavolt/work/queue-236/BUILD.md.
2026-10-22 03:42:05 -05:00
jason.woltje e7fb59f225 honker: row 194 on row 199's landing cb5fdb064 (sage-1601): honker/row194-b2 85edab7c7 squashed, five conflicts kept both sides (broker imports, constructor, dispatch, the credential and lifecycle verbs; runtime imports; organization write takes detail and context; cli credentials and veto dispatch; vocabulary comment as row 199 wrote it) 2026-10-22 03:06:41 -05:00
rocko f1267e49af fix: account for processing controls in image inputs and launch fixtures 2026-10-21 22:42:12 -05:00
rocko 4bdc7e0e86 processing: inspectable per-run stop seam for lifecycle fire
Unify halt and fire cancellation by verified run identity with durable first-owner receipts and shared deadlines. Integrate the instance control with the current host, library and tester-socket paths. Focused nine-file evidence is 62 passing tests; broad suites, mutants and review remain pending.
2026-10-21 22:42:12 -05:00
jason.woltje d8034c51bc stack-release: a rollback that drops --sso drops --send; the --no-sso walk refuses an ok line with no activation (row 273, sage-2315)
B1: row 200's rollback to a Console without --sso kept the pointer's --send,
which F39 b forbids once --send can sit beside --sso. send_for_target drops it
whenever the run drops the pointer's --sso, and the plan and steps say so.
N1: an ok line with no activation refuses sso-off-flags instead of being
skipped.
2026-10-21 22:15:36 -05:00
jason.woltje 3673463182 stack-release: --no-sso drops --send in one place, send_for_target (row 273) 2026-10-21 22:15:36 -05:00
jason.woltje 7991662dc0 stack-release: activate --send and --no-sso (row 273, #1778)
activate --send turns send on only when the run's Console flags hold
--sso, given or carried (F39 b), and puts it after --sso and before the
tester flags. activate --no-sso turns --sso off with the Console flags
from the set of the activation that turned it on, drops --send (F39 a)
and keeps the pointer's tester. Both are usage errors under --units
external. T58 covers the brief's T1-T4; the external test covers T5.
Design and the set-walk choice: agents/darkwing/work/queue-273/BUILD.md.
2026-10-21 22:15:36 -05:00
jason.woltje ddfb29af7c row 202: FED R5, mosaic access list, grant and revoke (#1700)
Candidate quackerjack/fed-r5-r5 a74cd9f87 on c3d88840c, manifest of 6
paths (CANDIDATE.sha256). Duckworth APPROVE round 5, rev 3026 (#1700
c30184). C1 gate on Sage's slot by Quackerjack on the merge of a74cd9f87
onto a849d89b7 (3b86180b9), finished 01:56:24Z: cli suite 771/771, skip 0
(run 2; run 1 red on a too-long gate TMPDIR, harness only), every
scripts/test-*.sh rc 0 with Docker up, mutants M1-M13 killed by their
named tests. Landed onto 9c9732983 with the candidate's blobs and modes
for the 6 paths; c3d88840c..9c9732983 touches none of them.
2026-10-21 21:00:28 -05:00
jason.woltje e69260a3ce row 244: gate runs mount a 0600 fixture pi auth file, test-release activates on the mock adapter, and real-model test-task cases sit behind MOSAIC_LIVE_PROVIDER=1 (#1757)
Candidate morgana/row244 94ab4c2fe on a36523713, manifest 6e7e3e3c (8 paths).
Webby APPROVE r1, rev 3008 (webby-0084, REVIEW-r1.md at webby/reviews
ebb3d83bf; request #1757 c30154). Gate on Sage's slot at 81e037d20
(sage-2147): the five gate-lane files whole 51/0, test-task.sh 91/0,
test-release.sh 14/0, mutants M-G, M-L, M-A, M-T and M-F killed.
94ab4c2fe adds only BUILD.md results. Webby's drift check: a36523713..d37210288
changes none of the 8 paths and no path either suite reads; merge-tree clean.
Rulings A and C (sage-1914, sage-2061). The dropped real-model coverage goes
to DEFERRED in the follow-up doc commit.
2026-10-21 16:44:37 -05:00