Sol's F2 review: a refused interview start threw on the null
currentTarget after the await and left Start disabled (P2); the panel
cached /api/config for the life of the page, so Approve outlived the
capability (P3). Hold the button before the await; reread config on
each offer. Lead P3: on Quick Setup done, Start onboarding interview
gets the accent fill; Open organization stays secondary.
onboarding-retry-browser is red 0/2 on the old source, 2/0 now.
roles/assistant.json grants record.write and the harness exposes it
as write_record, but the prose said 'You have no write tool', which
could make a model refuse the onboarding draft. The grant is
unchanged; spec/ stays human-only.
The word-boundary cut removed everything after '# ' when the first
500 characters were one long heading, leaving '#…'. Keep the hard cut
when the soft cut would leave only a markdown marker. Review P3 on
F1 (#1873).
The overview's Project direction panel printed north-star.md source as one
paragraph. It now mounts the same DOM-building markdown renderer the
requirements view uses, trims the preview to 500 characters at a word
boundary, and links to the full document in Docs. No raw HTML from the
document reaches the page; the fallback is a text node.
Quick Setup leaving no records was not reproduced on 00ef0bd30: all six
steps report done and the records step writes where the project view
reads. org-quick-live gains a records case that checks the six setup
POSTs, the records repository on disk and the live north-star read with
no button press. The manual records button stays for older projects.
Tests: projects-north-star-browser 1/0 (red before the change),
org-quick-live 4/0 twice on a fresh scratch instance.
- Quick Setup's done state offers Start onboarding interview next to Open
organization. It opens a conversation with the assistant and sends the
template's first message; Open organization skips it.
- The project overview offers the interview while the north star is the
init template, then shows the assistant's draft with Approve as north
star and the equivalent CLI command.
- GET /api/onboarding/interview serves the template and the assistant
instance. POST /api/north-star/approve runs approveNorthStarDraft with
the save's boundary (header user, exact Origin, same-origin Fetch
Metadata, strict JSON). In an organization it is the one project write
the fence lets through; the tester and granted users never reach it.
/api/config says northStarApprove where the route can pass.
- GET /api/project-file adds `committed`, the file's last commit time; `at`
stays the read time.
REQ-SETUP-2 (PRD 1.20 draft), unified workspace direction ruling 14 and
phase F2.
- packages/project/templates/onboarding-interview.json: the interview's
conversation name, four questions, draft paths and first message.
loadInterviewTemplate(url) reads it and validateInterviewTemplate checks
it, so an organization file or a plug-in can pass a replacement later.
- approveNorthStarDraft: agents never write spec/, so the assistant
proposes docs/north-star-draft.md with its existing record.write grant
and the human approves. The approval copies the exact reviewed draft
commit into spec/north-star.md through the human save verb, pinned to
the reviewed spec commit. A rewritten draft or a moved spec writes
nothing. No new verb, grant or role change.
- mosaic project north-star <project> [--approve <draft> --base <spec>]
shows the spec and the draft and approves as the human; mosaic project
interview <project> prints the first message; mosaic thread create
takes --instance.
Node leaves the -- option delimiter out of process.execArgv, so
'node -- /abs/cli.mjs' picked '--' as the script and re-executed an
already absolute launch, running preloads twice. Review P3 on #1873
reqget-2.
The refused Queue read keeps Queue as its heading, and the owner's
Initialize project records button is a new POST in bus.js. Both older
tests predated those intended changes.
readCandidate called readPrdMaterial with the org data root directly, so
prd.submit and the Console PRD draft kept working while project.files refused
the same conflict. It now resolves through recordArgs like the file adapters.
Fixes the P2 from the E2E4 review.
The refresh shortcuts (unchanged view, transcript-only change) skipped the request
summary and file rereads, so a request's phase change showed only after a full
repaint. One refreshRequestData helper now runs on every paint path; a quiet reread
keeps the present content until a changed result arrives.
s6b's error matrix waited for the 'Reading' placeholder to go, which a quiet
reread no longer shows, so it could read the previous scenario. It now waits for
the expected text.
A stale-record init now renames the record aside, checks it is still the one it
observed, and puts it back otherwise. Two inits racing over the same stale record
can no longer delete the record of a live endpoint the other one just started.
Fixes the P2 from the test-health review.
A refresh that drops the displayed request no longer hands its open
requirement and focus to another request's requirement with the same
local id: the restore key now carries the request id. Keyed disclosures
also remember a closed state, so desktop provenance the user closed
stays closed through a repaint. Adds Sol's two R3 probes as tests.
land-work takes --org as --business in one scope. A repeated, conflicting,
missing, empty or flag-shaped value exits 4 before the config is read. The
id keeps its old grammar (none): any other text names businesses/<ID>.json
and a missing file exits 3. A value of --subject or --attribution is never
read as a selector.
check takes --org as --business in one scope: each spelling once, both only
with the same value. A repeated, conflicting, missing, empty or flag-shaped
value exits 4 before any unit is read; an id outside check's own grammar
still exits 1. copy and wrapper refuse either spelling with usage, as
before. The sourced-library path used by stack-release.sh does not read
selector.sh; the command path refuses if it cannot.
The rehearsal builds fake copies from an explicit file list. f198cfd47 made
packages/cli/src/access.mjs import org-selector.mjs, which the list lacked,
so every rehearsal that ran the copied CLI failed with "Cannot find module"
(17 of 226 tests) from f198cfd47 until this commit. Real copies were not
affected: stack-copy.sh COPY_PATHS takes packages/cli/src whole.
Sol's re-check of c0b2f7d86 found two failures. A refresh that changed only an
unselected request kept the page and so kept the request selector's old closure;
selecting that request then drew its old PRD. Retained handlers now draw from the
newest accepted read for their container.
Requirement disclosures and focus were saved by position, so a requirement
inserted above the focused one handed its open state and focus to a neighbour.
Requirement and provenance details carry a restore key; open state and summary
focus are restored by that key and a key that no longer exists is dropped. The
outer chat capture uses the same helper.
org-live-fix-r3-browser.test.mjs holds Sol's two probes: 0/2 on c0b2f7d86, 2/0
here. Nineteen live-update, chat, project, request and s10-s15 files: 231/0.
read_args takes --org as --business in the unit flags before -- and in the
serve flags after it, with per-scope duplicate and conflict refusal, and
refuses a file whose serve flags name no selector or another business, as
case2-unit.sh would at the render after A2 stopped the units. The serve
flags are walked with case2-unit.sh's grammar so a value is never read as a
selector. The file is not rewritten; only --copy's value changes, as before.
A checkout without scripts/selector.sh refuses checkout-unreadable.
BUILD-LOG.md: append-only union, refactor entries first, then the branch's.
docs/SESSIONS.md: append-only union, refactor entries first, then the branch's.
packages/bus/src/runtime.mjs: keep the organization usage timer and refactor's halted/invalid startup-recovery gate.
packages/harness/src/first-output.mjs: keep the branch's harness-neutral markers; refactor's empty-length rejection moves into the Pi monitor (packages/plugins/harness/pi/model-stream.mjs).
packages/harness/tests/runner.test.mjs: keep refactor's length-continuation cases and the branch's output-policy cases.
packages/plugins/harness/pi/index.mjs: keep the documented GLM limits and the branch's transport-based bundle.
Suites: 6356 pass, 32 fail; all 32 fail identically on both parents
(node_modules symlink EISDIR in pinned-copy and stack copy/release tests,
missing Python jsonschema in two conversation tests).
Rename design r2, "Selector scopes and parser matrix", case2-install row. --org/--business
and --org-file/--business-file are two families, each its own scope: each spelling once, and
a second spelling must carry the same text (file paths compared as given). Missing values
are usage; a flag-shaped or invalid id keeps the business-id refusal; a flag-shaped file, a
repeated spelling and a conflict say why. All exit 4 before anything is read or written.
The persona-import call it spawns still passes --business.
Rename design r2, "Selector scopes and parser matrix". case2-persona-import.mjs takes --org
through selectorScope and case2-precheck.sh through scripts/selector.sh, one scope each. Both
keep their exit codes and their old business-id wording; a repeated or conflicting selector
says why. persona-import now checks the id while parsing, so stage refuses an invalid
selector before it reads anything.
The case2-install fake stack copy carries packages/business/src/selector.mjs, which the real
copy already does (COPY_PATHS takes packages/business/src).
cli.mjs serve and webui-service.sh each take --org as --business in their own
scope through the shared selector rules; the service unit still carries the
canonical --business. A flag-shaped or invalid value keeps each script's old
wording and exit code; a repeated or conflicting selector is a usage error.
Rename design r2, "Selector scopes and parser matrix". packages/business/src/selector.mjs
and scripts/selector.sh carry one rule set: in a parser's scope each spelling appears once,
and a second spelling must carry exactly the same value; a repeated spelling, a missing or
flag-shaped value, an invalid id and unequal values refuse. The file family
(--business-file/--org-file) compares paths as given.
Every CLI parser that took --business now takes --org through orgSelector, and the old
global --org rewrite in main() is gone, so a value another option consumes is never read as
a selector. The id is checked while parsing (OrgError org-invalid, exit 3), so grants admin
set no longer reads the token and proxy init no longer prompts for the key before an
invalid id refuses. access gains the same local id check.
mosaic console start --dev-local-owner --dev-insecure-bind ADDR
--dev-allow-host NAME[,NAME...] binds 0.0.0.0 or an IPv4 address and
answers only NAME:<bound port> plus the loopback names. Both flags are
refused without the dev owner, the bind without an allowed name, and a
specific ADDR that is not itself a name. Start and console status print
the no-sign-in warning; the state file records bind and allowHosts.
serve.mjs takes devAllowHosts only with the dev owner; SSO, preview and
tester listeners stay loopback. Writes need Origin http://<same Host>.
Chromium sends no Fetch Metadata from a LAN http origin, so for an
allowed name a write with that exact Origin and no Sec-Fetch-Site counts
as same-origin; an explicit header is still judged by the routes.
chat.js builds its operation keys without crypto.randomUUID, which an
insecure context lacks.
Once organizations existed, Quick Setup was reachable only through
Settings > Organizations > type an ID > New organization. This tree
has no header organization switcher, so the owner of a Console with
organization setup now gets "New organization" in the header avatar
menu, under the Organization picker on Settings > Organization, and
next to the Settings link in the no-organization empty state. Each
opens #/settings/organizations?new=1, which focuses the ID field and
then drops the flag. The form itself is unchanged.
The new browser test covers the menu at 1400 and 390px, the picker
and the empty state. It fails on 6ca7f3b65 and passes here.
"Projects / work / / Conversations / init" had no missing label.
Every project crumb link had min-width:44px, so a short name such as
"work" was padded with blank space after its text, and the separators
around it read as an empty crumb. The 44px target width now comes
from an ::after overlay centred on the link, so the layout box fits
the text on every project route.
The new browser test measures text-to-separator gaps and hit width
on the overview, conversations and conversation routes at 1440 and
390px. It fails on 6ca7f3b65 and passes here.
The organization options in cli.mjs carried no requestRead, so
/api/orgs/<id>/config never offered requests and the project and
conversation pages counted "requests not offered" as a failed read:
"Request status unavailable." on a conversation whose message went
through. The owner now reads request status over the organization's
own bus socket, as the root Console does. Request writes stay off,
per the README Console actions inventory.
The new browser test runs the real cli.mjs serve --dev-local-owner
against a real organization record with only the bus transports
shimmed. It fails on 6ca7f3b65 and passes here.
The endpoint ended after MOSAIC_FIXTURE_TTL_S, but init passed it only PATH, so
the lifetime was always the 14400 s default. Its record stayed after it ended,
and init refused fixture-exists until `dev fixture stop`.
init now takes --ttl SECONDS (0 = no expiry; otherwise 60 to 2147483, the
longest delay a Node timer holds; the default stays 14400), passes it to the
endpoint, and records ttlSeconds and expiresAt. /health and status report them.
A record whose pid is no longer the endpoint is stale: init removes it and says
which pid it replaced. A live endpoint still refuses fixture-exists.
A running bus keeps the endpoint it read at start, so after a replacement
the bus needs a restart; --ttl 0 avoids the expiry in the first place.
jason.woltje