jason.woltje
71fed6281c
gosalyn: PRD 1.15 rewrites REQ-LIB-6 to Q223 and Q226 (mos-1320 item 8): agents never write story and write .md files only in supporting folders a human marks, each as a commit by their own Gitea account with a notice she can revert, chat is free text, any citation is checked, and requireCitation is a human-only setting off by default. REQ-LIB-1 and REQ-LIB-2 gain supporting folders and the canon-cite rule. The 1.12 note's residual becomes the supporting-doc residual, and the 1.15 note records the old texts and lists REQ-LIB-3, 4, 5 and 7 as unchanged. requirements.json version 1.15 with three titles changed, and the test's version pin. The id count stays 85
2026-10-22 14:06:25 -05:00
jason.woltje
86a665bdf0
docs: PRD 1.16 brief, library.write routes under REQ-LIB-6 ( #1796 , mos-1328)
2026-10-22 13:51:55 -05:00
jason.woltje
efcc9ea8dd
row 269 (264b, #1774 ): BUILD.md M11 kill line is the survivor log assertion at session-launch.test.mjs:309, not the outcome assertion (mutant run 17:49Z, duckworth-0181)
2026-10-22 13:37:34 -05:00
jason.woltje
f39508c24f
row 269 (264b, #1774 ): the M6 halt test halts after mayLaunch answers
...
A halt inside the op reaches the bus's own fence first (runtime.mjs:564-566,
processingWork at :352-356), so the launcher refused limit-check-failed
(launcher.mjs:389-391) before its recheck admission() at :397. First-run red of
a new test on 6d9ab3503
2026-10-22 13:37:34 -05:00
jason.woltje
d20ef317fc
row 269 (264b, #1774 ): BUILD.md names the sessioned-survivor residual in Q2 and records N1's mos-1292 allowance (duckworth-0159 N3, N4)
2026-10-22 13:37:34 -05:00
jason.woltje
6e50bd6304
row 269 (264b, #1774 ): BUILD.md Q2 notes that a survivor's released claim doesn't prove its run has exited, and the per-leftover 5 s wait (duckworth-0158 N1, N2)
2026-10-22 13:37:34 -05:00
jason.woltje
6c80b12904
row 269 (264b, #1774 ): BUILD.md answers sage-2750 on the recover() change; the survivor log names its pids
...
The section "recover() change, for a design read" covers three things, with
file:line against aca16404c
2026-10-22 13:37:34 -05:00
jason.woltje
42fd3edd45
row 269 (264b, #1774 ): legacy-run-live gets its test (duckworth-0156)
...
recover() kept a survivor only when a bwrap outer pid outlived SIGKILL, so
the Q2 refusal (BUILD.md:177-179, t1-sessions.md:109) had no test. A leftover
whose runner still ran after its outer pid was gone was ended and dropped.
Now recover() waits on the outer pid and the runner, keeps any leftover where
either still runs, and logs that it still runs. check() reads only the
survivors that still run.
session-launch.test.mjs adds a test where a sessionless leftover's runner is
a sleep child and its outer pid is gone. It asserts the legacy-run-live
refusal with no launch and no session workspace, then one launch once the
child exits. BUILD.md adds mutants M10-M12 and replaces the "no test" note.
2026-10-22 13:37:34 -05:00
jason.woltje
dc5836c7df
row 269 (264b, #1774 ): refusedOnce in sessions.test.mjs pins actor_run, closing Duckworth N1 (DEFERRED.md:474-480)
...
Allowed by Mos in mos-1292 (copy mos-1294) on mos-1285's terms. The SELECT
reads actor_run, the expected row gets the run-name literal, and the three
callers pass `${name}-run`. Nothing else in the test changes. The old
expected row was:
[['action.refused', { code: 'not-holder' }]]
DEFERRED.md gets a closing line on the entry naming row 269.
2026-10-22 13:37:34 -05:00
jason.woltje
2133c5a0c6
row 269 (264b, #1774 ): per-session store, workspace and single-writer lock
...
threadsState gives one row per session with `session` and `legacy`; threadIdle
idles a run against its bound session. Each session gets its own store
(threads/<b>/<t>/sessions/<s>/, or the thread's old store for a legacy-3l
session) and its own workspace (session-workspaces/<b>/<i>/<s>/), held by an
O_EXCL <ws>.lock from before the clones to the run's proven exit. A legacy
session's workspace binds in-sandbox at the old instance path. sessions.json
is v2 and reads v1. New tests: cli session-launch.test.mjs, seat
session-workspace.test.mjs. Not yet run: tests wait for Sage's CLEAR.
Two old assertions change as exact updates:
- mos-1285: end-launch.test.mjs threadsState deepEqual. The old row shape was
{ thread: 'th-1', instance: 'coder', pending: 0, unread: 0, lastMessage: null,
lastOpen: '2026-10-15T00:00:01.000Z', lastClaim: null, holder: null }; the
row keeps every key and value and adds session: 'th-1', legacy: true.
- mos-1289: thread-launch.test.mjs:182, old line
`const store = join(f.dataRoot, "threads", "acme", A);`
now reads A's default session id from threadsState's `session` key; :183-185
unchanged; one added assert that threads/acme/<A>/session is absent.
2026-10-22 13:37:34 -05:00
jason.woltje
194dec83d6
row 269 (264b, #1774 ): BUILD.md lists thread-launch.test.mjs:182 as a second old assertion that changes. A thread.create thread's default session isn't legacy-3l, so its store takes D2's layout (t1-sessions.md:100, :294). Proposed as an exact path update, for Mos through Sage
2026-10-22 13:37:34 -05:00
jason.woltje
84b32e3903
row 269 (264b, #1774 ): BUILD.md drops the planned bindLaunch session-running refusal. Two old tests bind a second unended run to one session and expect the claim refusal (threads.test.mjs:88-89, sessions.test.mjs:119-120), so the broker half of the fence is the existing per-session claim, thread-already-held (broker.mjs:4815)
2026-10-22 13:37:34 -05:00
jason.woltje
9d241fdcc2
row 269 (264b, #1774 ): design notes for Duckworth's early look (duckworth-0150). C1 adds the Console and R-guard sessions.json readers, the 264a refusals a v2 file causes, the /proc live check and the Console restart; C2 pins M6 to a generation change after check() with all eight start() admission calls named; C3 gives the realpath compare its own code and a symlinked workspaces root as M4's input; C4 lists the old threadsState assertions, end-launch.test:193 the only change, under mos-1285
2026-10-22 13:37:34 -05:00
jason.woltje
76a6524cfe
row 269 (264b, #1774 ): design notes for sage-2717. Rollback names the four steps past the 264a exit-3 refusal and the re-pin plan section that carries them; new M8 binds a non-default session at the legacy path, old M8 becomes M9; Duckworth's legacy-bind check
2026-10-22 13:37:34 -05:00
jason.woltje
693f7e745e
row 269 (264b, #1774 ): design notes. D9 audit of every sessions.json reader at 84f53540d and of threadsState's consumers; sessions.json goes to v2 because recover() rebinds without session; pi 0.85.1 resumes by cwd, so the legacy session keeps its in-sandbox path; mutants M1-M8 and run limits (sage-2707)
2026-10-22 13:37:34 -05:00
jason.woltje
94c33a43c0
docs: row 275 landing line; Researcher session line
2026-10-22 13:13:47 -05:00
jason.woltje
a870fd85bb
docs: seat log lines for rows 281, 224, 219, 214, 211 and 258, the row 253 landing line, Sage's SESSIONS line, and DEFERRED for the 224 residual and the 206 sharee list
2026-10-22 13:10:27 -05:00
jason.woltje
5b1f1dc885
docs: DEFERRED gains row 253 N1 (Vikunja 532, mos-1297), row 198 N2 (/api/seen 400, sage-2867) and the stale row 203 text in access.mjs (Quackerjack)
2026-10-22 13:10:27 -05:00
jason.woltje
8c638b6f66
agents: register Della, Scrooge, Huey, Louie and Ludwig as seats so the queue can name them as row owners (Q220, mos-1301)
2026-10-22 13:10:27 -05:00
jason.woltje
a700992cd4
docs: 193b2 brief, the live --migrate window needs Mos's go under Q173, not Jason (mos-1310 item 4)
2026-10-22 13:10:27 -05:00
jason.woltje
d30f35e292
docs: SESSIONS line for Gizmoduck, rows 264a and 268 after-landing docs and the row 269 plan
2026-10-22 13:10:27 -05:00
jason.woltje
e5b7d1d083
row 268 ( #1773 ): BUILD.md Runs records the r2 gate on ecd9b35eb and the r3 and r4 carry reruns with every count and skip; doc only (sage-2455)
2026-10-22 13:10:27 -05:00
jason.woltje
836b2f25ca
docs: preserve email hard-wait approval and tune parser limits
2026-10-22 13:10:27 -05:00
jason.woltje
73516da853
docs: apply Q217 and Q222 to email source settings
2026-10-22 13:10:27 -05:00
jason.woltje
95e3f71661
docs: address Q195 editor design review findings
2026-10-22 13:10:26 -05:00
jason.woltje
cde0cd0832
docs: Q195 writing editor design and Q196 options
2026-10-22 13:10:26 -05:00
jason.woltje
100f018af3
gosalyn: row 229 design round 2 for Webby webby-0148: the settings.json allowlist is three keys a fresh /login writes, written in Mosaic code with httpProxy and the path and command keys refused by name and a sha256 bump test on pi's setter names, models-store.json and keybindings.json now refuse, auth.json.lock is the only allowed dir, pi-login runs --offline and --no-session in an empty temporary cwd with a 229b allowlist test, the contents check runs before preflight, and creativeHumanOnly covers the fallback (R1, R2, N1-N5)
2026-10-22 13:10:26 -05:00
jason.woltje
4a8215e3a1
gosalyn: row 229 design draft 1 after mos-1306: Chet's route has no fallback by default with a human-only fallback still possible through routes, and the dates note records that the live check gates every build row, not the design
2026-10-22 13:10:26 -05:00
jason.woltje
669e680368
gosalyn: row 229 design draft 1, a per-instance pi agent dir for Chet's Codex login: the host-made 0700 store per instance, a same-path rw bind with PI_CODING_AGENT_DIR through the pi module env, a contents allowlist since pi reads models.json and settings.json there, a refusal for roles with bash, a no-refresh auth check preflight, no fallback for Chet, a fresh-grant mosaic pi-login, the live check that gates the build, and rows 229a and 229b ( #428 , #1730 )
2026-10-22 13:10:26 -05:00
jason.woltje
c06ccc9ba4
gosalyn: Case 2 C2-03b round 3 for Webby webby-0156 R4: the fetch fallback reads the append-only events table for any GRANT_EVIDENCE event with method gitea and agent the chief, never gitea_grants, whose row a revoke and a grant-lost delete. It names no project, since grant.applied and grant.revoked carry none, so a chief grant on any project ends the fallback and fails safe. The revoked and fired tests go through grants.revoke and instance.fire and assert the row is gone before the fetch
2026-10-22 13:10:26 -05:00
jason.woltje
136e5c1ca3
gosalyn: Case 2 Q226 row briefs with Webby's round webby-0151, Mos's mos-1320 and Sage's sage-2833 folded in. C2-06 rewritten and taking in C2-07: an unreadable business file resolves requireCitation to true (R2), a send over 64 KiB gets the one retry and then a fourth fixed text (R1). C2-03b falls back to slot library-gitea only while no chief grant record has ever existed and refuses library-fetch-no-grant after (R3), with library-human-missing for her save and revert. C2-02 after C2-05c, revert and save by her editor (N1). C2-21 cites mos-1320 item 2 and keeps the host-creative-role refusals, and records two Gitea facts that don't gate it (N4, item 5). C2-08b names what the chief's credential needs (N5). C2-05b restored to the brief row 224 built, which lands as built, and new row C2-05c carries the supporting scope and blob. A PRD row brief for REQ-LIB-6 (mos-1320 item 8). New briefs C2-01d, 05c, 08b, 03b, 21, 02, 11b and 12b
2026-10-22 13:10:26 -05:00
jason.woltje
cf17ab387b
gosalyn: C2-06 brief Q222 round 2 for Webby webby-0144: M11 compares against the on-disk human and replyLimits on document and written and refuses agent actor shapes, an unreadable business file checks at the defaults, keys read by Object.hasOwn and Number.isInteger, the verb refuses unknown keys, the new tests, the residual line, cites at aca16404c, and the hold moves to Q30 (mos-1305, design f164dcef8)
2026-10-22 13:10:26 -05:00
jason.woltje
09948da187
gosalyn: C2-06 brief makes every M5 limit a replyLimits setting with Q219's numbers as defaults, the human's library.limits.set and mosaic limits replies, the M11 writer check, read at check time with per-key fallback to the default, the setup sheet's settings line, the settings and M11 tests, After C2-04, and the build held for Q29 (Q222, mos-1302, design df29550c9)
2026-10-22 13:10:26 -05:00
jason.woltje
35615b01b7
gosalyn: C2-06 brief cites the setup sheet's reply limits paragraph at :115-118 (webby-0140 N4)
2026-10-22 13:10:26 -05:00
jason.woltje
3f1f4e44fa
gosalyn: C2-06 brief owns the setup sheet's reply limits paragraph, which says 3 ideas of up to 120 characters and drops the lower-limits offer, and the tests paragraph is rewrapped (webby-0139 N1, N2, Q219)
2026-10-22 13:10:26 -05:00
jason.woltje
65b8c8a9bd
gosalyn: C2-06 brief takes Jason's idea caps, 3 items of 120 characters per reply, tested one past each boundary, and the idea-text residual line reads 360 characters closed in Q219 (mos-1299, design 2852348d2)
2026-10-22 13:10:26 -05:00
jason.woltje
271cef205c
gosalyn: Case 2 design round 3 for Webby webby-0156 R4: the fetch fallback reads GRANT_EVIDENCE events with method gitea and agent the chief in the append-only events table, never gitea_grants, and names no project, so it survives a revoke, a grant-lost and a fire and fails safe. The ruling paragraph, 7.2 and section 10 steps 4 and 4b say so, cited at aca16404c
2026-10-22 13:10:26 -05:00
jason.woltje
3e5db651b7
gosalyn: Case 2 design ruling after r11, agents never write story (Q223, Q226, mos-1309), with Webby's round webby-0151 and Mos's mos-1320 folded in. Supporting prefix lists agents may write .md files under through library.doc.write and library.doc.delete, fenced by M12 supportingPath, plumbing commits pushed fast-forward only with a Mosaic-Agent trailer, a notice and a human revert authored by her editor on slot library-human. Chat is free text with optional citations, replyLimits keys requireCitation and citationsPerReply, and an unreadable business file resolves requireCitation to true (R2). A send over 64 KiB gets the one retry and then a fixed text (R1). The fetch falls back to slot library-gitea only while no chief grant record has ever existed, and Jason deletes the slot once status shows the chief's grant (R3). A missing editor or slot refuses before any git call (N1), runner and tools cites fixed at aca16404c (N2, N3), two record-only Gitea facts at C2-21 (N4, mos-1320 item 5), mos-1163 narrowed to gitea library projects (mos-1320 item 2), M3 at eight or ten (mos-1320 item 4). C2-05b is row 224 as built and C2-05c carries the supporting scope and blob (sage-2833). New rows C2-01d, C2-05c, C2-08b, C2-12b and C2-21
2026-10-22 13:10:26 -05:00
jason.woltje
e1c9c09935
gosalyn: Case 2 Q222 round 2 for Webby webby-0144: the M11 fence compares against the on-disk human and refuses agent actor shapes, checks document and written as M9 does, a failed business file read checks at the defaults and never skips, the fallback reads keys by Object.hasOwn and Number.isInteger with booleans, arrays and objects named, the verb refuses unknown keys, the ceilings residual line, and cites at aca16404c (R1-R3, N1-N3, N5, N6)
2026-10-22 13:10:26 -05:00
jason.woltje
aaaf45576a
gosalyn: Case 2 design ruling after r11, reply limits are settings: every M5 limit is a replyLimits key in the business file with Q219's numbers as defaults, changed only by the human's library.limits.set and fenced in organizationWriter.write as M11, read at check time, with a missing or invalid value using its default. C2-06 carries it and waits on Q29 (Q222, mos-1302)
2026-10-22 13:10:26 -05:00
jason.woltje
cf6abca9c0
gosalyn: Case 2 design ruling after r11, idea items capped at 3 of 120 characters: M5, the B5 note, the 5.1 residual (now 360 characters per reply) and 10 step 8 closed by Jason; the rest of M5 unchanged, C2-06 builds and tests the new boundaries (Q219, mos-1299, Vikunja 465, ludwig-0014 Q4)
2026-10-22 13:10:26 -05:00
jason.woltje
3410df7c3b
morgana: row 275 r3 (duckworth-0166): B1 bob asks create only, open and send on alice's own thread; N1 thread B holds a message and the viewer read asserts its id
2026-10-22 12:46:09 -05:00
jason.woltje
1e3db53436
morgana: row 275 r2 (mos-1311): downgraded viewer keeps send and open refusals with nothing stored in the R3 test; BUILD.md lists each changed assertion, old and new, with design 4.3 lines
2026-10-22 12:46:09 -05:00
jason.woltje
4dd85c6716
morgana: row 275 (193b1b, #1780 ): viewer verbs and board refusals. VIEWER_VERBS at any grant level, collaborator for thread.create/open/send per verb, BOARD_VERBS exported and refused to users, user-side governance pin, mutants 6 and 10; FED R3 viewer-refused assertions reversed per design 4.3
2026-10-22 12:46:09 -05:00
jason.woltje
48e450ce8f
docs(row253): pin mos1298 session assertion candidate
2026-10-22 10:53:50 -05:00
jason.woltje
14e4600617
test(row253): assert direct query PID equals SID (mos-1298)
2026-10-22 10:53:16 -05:00
jason.woltje
a6c71e6d99
docs(row253): preserve fresh gate stop at M38 survivor
2026-10-22 10:49:46 -05:00
jason.woltje
e1bc766d87
docs(row253): pin mos1297 fixture repair for review
2026-10-22 10:34:06 -05:00
jason.woltje
362ec674c9
test(row253): expose peer failures and pin reasons (mos-1297)
...
The peer-output fixture execs isolated system Python to write its exact bytes
and exit with peer-status. This avoids masking parser/status faults behind the
supervisor session check. All17 faults assert an exact reason with a delimiter;
every existing assertion remains. No product change or timing delay.
Old packages/cli/tests/case1-accept.test.mjs💯
const PYTHON_STUB = `[ -f "$HC/peer-output" ] && { cat "$HC/peer-output"; exit "$(cat "$HC/peer-status")"; }
Diagnostic under sage-2752 found probe-inner-session for malformed output and
nonzero exit. Mos confirmed the fixture mask and authorized this repair.
No tests ran after the repair; Duckworth review and fresh whole gate follow.
2026-10-22 10:32:29 -05:00
jason.woltje
f5ef1c33a3
docs(row253): preserve single P10 diagnostic and reason mismatches
2026-10-22 10:27:24 -05:00
jason.woltje