jason.woltje
6e50bd6304
row 269 (264b, #1774 ): BUILD.md Q2 notes that a survivor's released claim doesn't prove its run has exited, and the per-leftover 5 s wait (duckworth-0158 N1, N2)
2026-10-22 13:37:34 -05:00
jason.woltje
6c80b12904
row 269 (264b, #1774 ): BUILD.md answers sage-2750 on the recover() change; the survivor log names its pids
...
The section "recover() change, for a design read" covers three things, with
file:line against aca16404c
2026-10-22 13:37:34 -05:00
jason.woltje
42fd3edd45
row 269 (264b, #1774 ): legacy-run-live gets its test (duckworth-0156)
...
recover() kept a survivor only when a bwrap outer pid outlived SIGKILL, so
the Q2 refusal (BUILD.md:177-179, t1-sessions.md:109) had no test. A leftover
whose runner still ran after its outer pid was gone was ended and dropped.
Now recover() waits on the outer pid and the runner, keeps any leftover where
either still runs, and logs that it still runs. check() reads only the
survivors that still run.
session-launch.test.mjs adds a test where a sessionless leftover's runner is
a sleep child and its outer pid is gone. It asserts the legacy-run-live
refusal with no launch and no session workspace, then one launch once the
child exits. BUILD.md adds mutants M10-M12 and replaces the "no test" note.
2026-10-22 13:37:34 -05:00
jason.woltje
2133c5a0c6
row 269 (264b, #1774 ): per-session store, workspace and single-writer lock
...
threadsState gives one row per session with `session` and `legacy`; threadIdle
idles a run against its bound session. Each session gets its own store
(threads/<b>/<t>/sessions/<s>/, or the thread's old store for a legacy-3l
session) and its own workspace (session-workspaces/<b>/<i>/<s>/), held by an
O_EXCL <ws>.lock from before the clones to the run's proven exit. A legacy
session's workspace binds in-sandbox at the old instance path. sessions.json
is v2 and reads v1. New tests: cli session-launch.test.mjs, seat
session-workspace.test.mjs. Not yet run: tests wait for Sage's CLEAR.
Two old assertions change as exact updates:
- mos-1285: end-launch.test.mjs threadsState deepEqual. The old row shape was
{ thread: 'th-1', instance: 'coder', pending: 0, unread: 0, lastMessage: null,
lastOpen: '2026-10-15T00:00:01.000Z', lastClaim: null, holder: null }; the
row keeps every key and value and adds session: 'th-1', legacy: true.
- mos-1289: thread-launch.test.mjs:182, old line
`const store = join(f.dataRoot, "threads", "acme", A);`
now reads A's default session id from threadsState's `session` key; :183-185
unchanged; one added assert that threads/acme/<A>/session is absent.
2026-10-22 13:37:34 -05:00
jason.woltje
194dec83d6
row 269 (264b, #1774 ): BUILD.md lists thread-launch.test.mjs:182 as a second old assertion that changes. A thread.create thread's default session isn't legacy-3l, so its store takes D2's layout (t1-sessions.md:100, :294). Proposed as an exact path update, for Mos through Sage
2026-10-22 13:37:34 -05:00
jason.woltje
84b32e3903
row 269 (264b, #1774 ): BUILD.md drops the planned bindLaunch session-running refusal. Two old tests bind a second unended run to one session and expect the claim refusal (threads.test.mjs:88-89, sessions.test.mjs:119-120), so the broker half of the fence is the existing per-session claim, thread-already-held (broker.mjs:4815)
2026-10-22 13:37:34 -05:00
jason.woltje
9d241fdcc2
row 269 (264b, #1774 ): design notes for Duckworth's early look (duckworth-0150). C1 adds the Console and R-guard sessions.json readers, the 264a refusals a v2 file causes, the /proc live check and the Console restart; C2 pins M6 to a generation change after check() with all eight start() admission calls named; C3 gives the realpath compare its own code and a symlinked workspaces root as M4's input; C4 lists the old threadsState assertions, end-launch.test:193 the only change, under mos-1285
2026-10-22 13:37:34 -05:00
jason.woltje
76a6524cfe
row 269 (264b, #1774 ): design notes for sage-2717. Rollback names the four steps past the 264a exit-3 refusal and the re-pin plan section that carries them; new M8 binds a non-default session at the legacy path, old M8 becomes M9; Duckworth's legacy-bind check
2026-10-22 13:37:34 -05:00
jason.woltje
693f7e745e
row 269 (264b, #1774 ): design notes. D9 audit of every sessions.json reader at 84f53540d and of threadsState's consumers; sessions.json goes to v2 because recover() rebinds without session; pi 0.85.1 resumes by cwd, so the legacy session keeps its in-sandbox path; mutants M1-M8 and run limits (sage-2707)
2026-10-22 13:37:34 -05:00
jason.woltje
8c638b6f66
agents: register Della, Scrooge, Huey, Louie and Ludwig as seats so the queue can name them as row owners (Q220, mos-1301)
2026-10-22 13:10:27 -05:00
jason.woltje
e5b7d1d083
row 268 ( #1773 ): BUILD.md Runs records the r2 gate on ecd9b35eb and the r3 and r4 carry reruns with every count and skip; doc only (sage-2455)
2026-10-22 13:10:27 -05:00
jason.woltje
100f018af3
gosalyn: row 229 design round 2 for Webby webby-0148: the settings.json allowlist is three keys a fresh /login writes, written in Mosaic code with httpProxy and the path and command keys refused by name and a sha256 bump test on pi's setter names, models-store.json and keybindings.json now refuse, auth.json.lock is the only allowed dir, pi-login runs --offline and --no-session in an empty temporary cwd with a 229b allowlist test, the contents check runs before preflight, and creativeHumanOnly covers the fallback (R1, R2, N1-N5)
2026-10-22 13:10:26 -05:00
jason.woltje
4a8215e3a1
gosalyn: row 229 design draft 1 after mos-1306: Chet's route has no fallback by default with a human-only fallback still possible through routes, and the dates note records that the live check gates every build row, not the design
2026-10-22 13:10:26 -05:00
jason.woltje
669e680368
gosalyn: row 229 design draft 1, a per-instance pi agent dir for Chet's Codex login: the host-made 0700 store per instance, a same-path rw bind with PI_CODING_AGENT_DIR through the pi module env, a contents allowlist since pi reads models.json and settings.json there, a refusal for roles with bash, a no-refresh auth check preflight, no fallback for Chet, a fresh-grant mosaic pi-login, the live check that gates the build, and rows 229a and 229b ( #428 , #1730 )
2026-10-22 13:10:26 -05:00
jason.woltje
271cef205c
gosalyn: Case 2 design round 3 for Webby webby-0156 R4: the fetch fallback reads GRANT_EVIDENCE events with method gitea and agent the chief in the append-only events table, never gitea_grants, and names no project, so it survives a revoke, a grant-lost and a fire and fails safe. The ruling paragraph, 7.2 and section 10 steps 4 and 4b say so, cited at aca16404c
2026-10-22 13:10:26 -05:00
jason.woltje
3e5db651b7
gosalyn: Case 2 design ruling after r11, agents never write story (Q223, Q226, mos-1309), with Webby's round webby-0151 and Mos's mos-1320 folded in. Supporting prefix lists agents may write .md files under through library.doc.write and library.doc.delete, fenced by M12 supportingPath, plumbing commits pushed fast-forward only with a Mosaic-Agent trailer, a notice and a human revert authored by her editor on slot library-human. Chat is free text with optional citations, replyLimits keys requireCitation and citationsPerReply, and an unreadable business file resolves requireCitation to true (R2). A send over 64 KiB gets the one retry and then a fixed text (R1). The fetch falls back to slot library-gitea only while no chief grant record has ever existed, and Jason deletes the slot once status shows the chief's grant (R3). A missing editor or slot refuses before any git call (N1), runner and tools cites fixed at aca16404c (N2, N3), two record-only Gitea facts at C2-21 (N4, mos-1320 item 5), mos-1163 narrowed to gitea library projects (mos-1320 item 2), M3 at eight or ten (mos-1320 item 4). C2-05b is row 224 as built and C2-05c carries the supporting scope and blob (sage-2833). New rows C2-01d, C2-05c, C2-08b, C2-12b and C2-21
2026-10-22 13:10:26 -05:00
jason.woltje
e1c9c09935
gosalyn: Case 2 Q222 round 2 for Webby webby-0144: the M11 fence compares against the on-disk human and refuses agent actor shapes, checks document and written as M9 does, a failed business file read checks at the defaults and never skips, the fallback reads keys by Object.hasOwn and Number.isInteger with booleans, arrays and objects named, the verb refuses unknown keys, the ceilings residual line, and cites at aca16404c (R1-R3, N1-N3, N5, N6)
2026-10-22 13:10:26 -05:00
jason.woltje
aaaf45576a
gosalyn: Case 2 design ruling after r11, reply limits are settings: every M5 limit is a replyLimits key in the business file with Q219's numbers as defaults, changed only by the human's library.limits.set and fenced in organizationWriter.write as M11, read at check time, with a missing or invalid value using its default. C2-06 carries it and waits on Q29 (Q222, mos-1302)
2026-10-22 13:10:26 -05:00
jason.woltje
cf6abca9c0
gosalyn: Case 2 design ruling after r11, idea items capped at 3 of 120 characters: M5, the B5 note, the 5.1 residual (now 360 characters per reply) and 10 step 8 closed by Jason; the rest of M5 unchanged, C2-06 builds and tests the new boundaries (Q219, mos-1299, Vikunja 465, ludwig-0014 Q4)
2026-10-22 13:10:26 -05:00
jason.woltje
3410df7c3b
morgana: row 275 r3 (duckworth-0166): B1 bob asks create only, open and send on alice's own thread; N1 thread B holds a message and the viewer read asserts its id
2026-10-22 12:46:09 -05:00
jason.woltje
1e3db53436
morgana: row 275 r2 (mos-1311): downgraded viewer keeps send and open refusals with nothing stored in the R3 test; BUILD.md lists each changed assertion, old and new, with design 4.3 lines
2026-10-22 12:46:09 -05:00
jason.woltje
4dd85c6716
morgana: row 275 (193b1b, #1780 ): viewer verbs and board refusals. VIEWER_VERBS at any grant level, collaborator for thread.create/open/send per verb, BOARD_VERBS exported and refused to users, user-side governance pin, mutants 6 and 10; FED R3 viewer-refused assertions reversed per design 4.3
2026-10-22 12:46:09 -05:00
jason.woltje
48e450ce8f
docs(row253): pin mos1298 session assertion candidate
2026-10-22 10:53:50 -05:00
jason.woltje
a6c71e6d99
docs(row253): preserve fresh gate stop at M38 survivor
2026-10-22 10:49:46 -05:00
jason.woltje
e1bc766d87
docs(row253): pin mos1297 fixture repair for review
2026-10-22 10:34:06 -05:00
jason.woltje
f5ef1c33a3
docs(row253): preserve single P10 diagnostic and reason mismatches
2026-10-22 10:27:24 -05:00
jason.woltje
2bef9124c4
docs(row253): preserve M21 survivor stop and static call trace
2026-10-22 10:10:42 -05:00
jason.woltje
34401e7c90
docs(row253): record green 27-file run and measured timeout basis
2026-10-22 09:46:35 -05:00
jason.woltje
0604d91fcf
docs(row253): pin final aca1 integration and focused file bounds
2026-10-22 09:28:15 -05:00
jason.woltje
ed3bb376cd
docs(row253): preserve doc sweep appends on corrected interim base
2026-10-22 09:26:31 -05:00
jason.woltje
cd269e7337
docs(row253): record schema3l integration before final base correction
2026-10-22 09:26:31 -05:00
jason.woltje
e75ef1b19f
docs(row253): integrate 385a base and record dependency drift and bounds
2026-10-22 09:26:31 -05:00
jason.woltje
72b17562d9
docs(row253): integrate row191 base and refresh manifest
2026-10-22 09:26:31 -05:00
jason.woltje
ad67d95955
docs(row253): record integration onto refactor 378a76b85
2026-10-22 09:26:31 -05:00
jason.woltje
3b142c9c69
docs(row253): record static approval and pre-confirmation residual
2026-10-22 09:26:31 -05:00
jason.woltje
950cf47f3e
fix(row253): bound cleanup retries after initial inventory
2026-10-22 09:26:31 -05:00
jason.woltje
cca9367168
fix(row253): supervise socket queries across sudo sessions
2026-10-22 09:26:31 -05:00
jason.woltje
c8cca3a688
docs(row253): store repair patch without context whitespace
2026-10-22 09:26:31 -05:00
jason.woltje
62de848820
docs(row253): freeze C4 repair for static review
2026-10-22 09:26:31 -05:00
jason.woltje
6f320b4b0c
docs: propose row253 C4 session supervisor and draft hop fake
2026-10-22 09:26:31 -05:00
jason.woltje
643d16528b
test: prepare row253 socket fixtures and fix gate collisions
2026-10-22 09:26:31 -05:00
jason.woltje
730a78aa91
gander: design tester socket migration for host scripts
2026-10-22 09:26:31 -05:00
jason.woltje
f7e4ec3df5
row 264a ( #1769 ): BUILD.md records the r13 gate on 2cc34aef8 (phases 1-3 green, M2 thrown at the trigger) and the r13p4 rerun at 84f53540d (M1-M4 killed on assertions, M2's four edits and kill rule), and the limits row gets the measured probe time; doc only (mos-1280 item 1, sage-2701)
2026-10-22 09:23:39 -05:00
jason.woltje
84f53540dd
row 264a r13 ( #1769 ): BUILD.md writes M2's four edits before phase 4 reruns: the receive filter, delivery_same_session dropped from 3k-3l.sql and schema.sql, and store.mjs's SCHEMA_SHA256 set to the mutated schema; a kill counts only as a receive-test assertion; doc only (mos-1279, sage-2688, sage-2690, duckworth-0143, duckworth-0144)
2026-10-22 09:08:25 -05:00
jason.woltje
2cc34aef87
row 264a r13 ( #1769 ): threads.test :341 takes the 3l trigger's text, 'only to its session's holder' (delivery_same_session, 3k-3l.sql:153); BUILD.md raises the stack-release limit to 1800 s from the survey's 575 s and records the r10 and r11 reds and the r12 survey with M1 in Runs; test only (mos-1278, sage-2682)
2026-10-22 08:36:56 -05:00
jason.woltje
93f4af12bc
row 264a r12 ( #1769 ): sessions.test T2's refused() keeps every table but events equal and pins one action.refused {code: not-holder} event per refused call in call order; the old every-table check could never pass since request()'s catch (broker.mjs:4242) writes the refusal through #refused; BUILD.md records Mos's reading of sage-2257; test only (mos-1277, sage-2676)
2026-10-22 08:21:41 -05:00
jason.woltje
54f65f9abd
row 264a r10 ( #1769 ): rebase on landed 281 ( e479521d3), all 16 =; broker.mjs overlap read; cli limit 1800 s from 281's 591 s run (sage-2665, sage-2668, sage-2647)
2026-10-22 08:08:28 -05:00
jason.woltje
7451878b66
row 264a r9 ( #1769 ): rebase on landed 278 ( 385a7194c), all 15 =; webui read check; run limits at 3x the longest recorded run (sage-2647, mos-1275)
2026-10-22 08:07:43 -05:00
jason.woltje
16889a46be
row 264a r8 ( #1769 ): build notes correction for the r7 red (account-migration, sqlite_sequence rows from the 3k-3l inserts), the whole-snapshot audit of every migrating test, the r7 run in Runs (sage-2621, duckworth-0129)
2026-10-22 08:07:43 -05:00
jason.woltje
0431778465
row 264a r7 ( #1769 ): build notes for the rebase onto landed 277 ( 980cec88c, sage-2608) and the per-session thread.claims; DEFERRED entry binds row 272 to make 274's user reply check session-scoped (sage-2591)
2026-10-22 08:07:43 -05:00
jason.woltje