Manifest 4387c8d5. Rebase only: same added and removed lines, three files
re-digested after rows 58, 60 and 59. Gate green, round 1 mutants all killed.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Built on bbd22f1b, rebased on row 60 (3d298920): the bus.mjs header
comment conflict merged, serve.mjs BUS_VERBS and the README credentials
paragraphs merged cleanly. 21 of 21 mutants killed, full gate green.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Rebase-only round on 3d298920. Merged hunks against rows 58 and 60 keep
both sides; 21 round 1 mutants give round 1's results. Comment 27591.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Rebase only, per rev 571. Two conflicts resolved: the agents branch in
broker.mjs next to row 58's tasks line, and the bus.css widths line.
Merged hunks in broker.mjs and the bus README are named in build.md.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Packet agents/rocko/work/queue-79/ (packet manifest b6b11e7b, 42 files,
candidate manifest 16b12387), Rocko's BUILD-LOG and SESSIONS appends.
Committed by Sage for Rocko, who has no credential.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Packet agents/rocko/work/queue-78/ (packet manifest 9e067f40, 32 files,
candidate manifest 3016dbf1), Rocko's BUILD-LOG and SESSIONS appends.
Committed by Sage for Rocko, who has no credential.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Round 1's build.patch applies cleanly on 424ada49 (row 74 landed as 351464ce).
Only packages/webui/README.md's digest changes; the bullet text is the same.
Manifest eb2b26c1. Gate 23:41:10Z-23:44:25Z: bus 83, tasks 71, webui 61, every
scripts/test-*.sh green. 16 of 17 mutants fail, output identical to round 1.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Candidate 90d5bddc on f2f2861b. bus 86/0, webui 40/0, every scripts/test-*.sh
green 23:23:30Z-23:26:25Z; 20 of 21 mutants killed, any-role-msg equivalent.
Notes: a claim that outlives its runner, a stranded delivered message (bus
follow-up to Sage), overlap with row 58.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Round 2 candidate 17b6d7f6 on 17ea0dbc. 22 of 23 mutants killed, joined-value
equivalent; probes cover repeated Host, proxy Host, HEAD and absolute-form.
r1/ holds the round 1 findings sent to Dewey in place of a verdict.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Round 2 per Sage's notes revs 521 and 523: a repeated Host is 400 before
any check; HEADER with a Host other than NAME is 403 proxy Host refused;
HEAD, x.NAME and --auth-header tests; the README proxy contract lines.
Candidate manifest 17b6d7f6, base 17ea0dbc. 34 of 34 mutants killed;
gate green.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Rocko's packet agents/rocko/work/queue-73/ (candidate manifest bf4e5ed6,
packet manifest 41ffcd5c, 53 files), their BUILD-LOG entry and SESSIONS
line. Sage's SESSIONS line for the review request (comment 27467) and
row 79 (#1573) for the stale text the packet names.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Rocko's packet agents/rocko/work/queue-72/ (candidate manifest e6531a53,
base a0080da8) with their BUILD-LOG and SESSIONS appends, and Sage's
SESSIONS line for the jarvis review request (comment 27454).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Committed by sage for rocko (no credential). Candidate manifest 7dc571db, packet manifest 0bc9a870, base 43d2328f.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Candidate build.patch on ae428a54, manifest e63e4c4f. Gate on f2f2861b: bus 83,
tasks 71, webui 40, every scripts/test-*.sh exit 0. Mutants 16 of 17 killed.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
tick-62.mjs runs the candidate's discover(), reconcile() and tick()
against tasks.woltje.com with the sync key, a real Store and Broker in a
scratch root, and a fetch guard that refuses anything but GET. The
startup scope probes are not sent. Reconcile 15 GETs, 42 snapshots; tick
8 GETs, 0 snapshots; 18, 20 and 21 watch-only. A missing view id on #18
answers 404 code 3014 while #18 reads 200 (the fake says 13001).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Mos amended ruling (2): with no environment location for
MOSAIC_LEASE_VERSION_PROBE_COMMAND, the wrapper sends only
`__lease-capability` to ~/.npm-global/bin/mosaic-old, so the old CLI's
lease gate still gets its answer. Every other subcommand reaches the
pinned worktree; undo removes the forward with the wrapper. update now
rewrites the wrapper, and status flags a wrapper that differs from what
the script writes. Checked live at 21:17:58Z: the probe answered
{"name":"lease-runtime-activation","version":1}, exit 0.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
agents/sage/work/q81/mosaic-cli.sh does install, update, undo and status.
~/.npm-global/bin/mosaic is now a wrapper that execs scripts/mosaic in a
detached worktree at ~/.local/share/mosaic-cli/stack, pinned to pushed
ee129aa6. The estate CLI symlink was renamed in place to mosaic-old.
Only commits on origin/refactor can be pinned. `mosaic queue` refuses
from the worktree (the queue runs only in the canonical checkout), so
queue work stays on scripts/mosaic. status flags a wrapper replaced by
`npm i -g --force`.
lease-gate-notes.md: no single environment location for
MOSAIC_LEASE_VERSION_PROBE_COMMAND exists outside fleet state, so the
old-path lease gate fails closed, as Mos ruled for that case.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
R2/B1: after a forbidden or not-found refusal on a child, the tick reads
GET /projects/<id> and drops the child only on 403 or 404; a deleted
kanban view (project read 200) fails the tick as in round 1. Tests 18
and 19, 23/23 mutants killed, gate on ae428a54 green (14 suites).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
One rule for Filbert's R3 and Dewey's B1: y resolves only while the
whole decide box is shown. Adds N9 widths, the start-unguarded and
timeout fixes, and two defects found by the cheap tests (wrap at
graphemes, answer render throw). 51/51 mutants killed; gate on
122b1223 green, cli 110.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Filbert's R1 (27279) and Dewey's matching blocking item (27280): a child
that answers 403 or 404 in a tick leaves the tree, and the root still
refuses. Tests for Filbert's N1-N3 and Dewey's three gaps. 18 mutants
killed; all 13 suites green at 122b1223. Manifest sha256 55316d88.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Jason: "Q80: Have the PM decide. Then fix". project-manager decided to
delete all four and moved their tasks to todo. Mos ruled no standing
delete scope on any bot key. svc-mosaic-stack minted key 10 for the pm
user with only projects.views_buckets_delete and a 30-minute expiry,
held in memory only. The pre-read showed all four buckets empty. Four
DELETEs answered 200, and key 10 was revoked (204) at once. The pm user
now lists only key 8. The read-back shows buckets 57 done, 159 todo
(default), 161 in-progress, 248 in-review and 162 blocked, with task
counts unchanged.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
GETs only, sync key 9. Project list 200, total 30 (31 with archived #15).
#18, #20 and #21 have parent 19, none archived. GET /tasks with
filter project in 19, 18, 20, 21: 200, 42 tasks across all four. The
per-project open reads give 18, 4, 3 and 1. A follow-up row moves a tick
to the single read after row 62 is done.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Candidate manifest sha256 ec3f7a42f3bf6436634a5a83a12bb5678ca1e58a10ff4f66a23dfca7ff3f375f,
13 files on edc5de71. Gate on 6ae8b844: 13 suites green. The candidate
itself is not committed.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Jason ran run.sh (sha256 c609c682) from a human shell on fe5c68fa,
2026-10-11T18:32:45Z to 18:32:54Z. The PM launched coder r2810c6373900,
recorded by pm in the launch log, and mosaic agents shows it.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
install-19.mjs renames 57 done, 159 todo, 161 in-progress, 162 blocked,
adds 248 in-review and moves the default to 159; no task moved. Writes go
to /api/v1 (v2.7.0 405s bucket writes under /api/v2). create-33.mjs adds
#35 and #36 under #33. Records hold no secret; shares-read titles removed.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
svc-mosaic-stack created mosaic-agents (team 1, bots pm/cto/coder/reviewer)
and mosaic-sync (team 2, bot sync), made jason.woltje team admin, then left
both teams so a team share gives svc no project access. The pm key gained
projects read_all, read_one and update; no key has task or project delete
or a share route (read back via GET /tokens?owner_id). Old pm key 2 revoked,
now 401. Record holds ids and scopes only; checked for secrets.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
BUILD.md records Sage's 2026-10-11 ruling that packages/queue/tests/
dispatch.test.mjs is in scope. FOLLOWUP-transport-code.md writes up the
transport's did-not-finish error with no .code, for the 10-12 batch.
The candidate (manifest 93fa48c1cdfe) is unchanged.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The full-screen terminal app (#1544): BUILD.md, build.patch over fe5c68fa
(9 files), candidate manifest, the gate logs on 23d566d6 and the pty smoke
script. The candidate itself is not committed.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The Console gains three read-only views. Queue lists every row from
rows() in packages/queue (lead decision 83: the same lock-free read as
`queue list`, writing nothing), run in a child with a timeout and an
output cap; a row page shows the full row. Business shows names, an
allowlist of vars, arbiters, authority per action and credential
metadata (service, account, role, date, never a value, file or
variable). Settings shows RELEASE, the board origin and the notifier
binding. Every route is GET only, and every string in a body or
refusal passes a redactor: the config directory and dataRoot become
<config> and <dataRoot>, other absolute, ~/ and file:// paths <path>,
and 17 to 20 digit runs <id>. A queue-read that fails to start sends a
fixed message, never node's stderr.
Four fixes to HEAD behaviour, each with a test: the bus view's refresh
timer is cleared at render, a same-page refresh keeps focus on the H1,
#conv-pick is emptied when a conversation opens, and error() returns
focus to <main> only when something had focus. Filbert's T8 tests the
failed first read.
Dewey built it in two rounds. Round 1 (dba2429e) got changes from
Filbert (27185: After rendered [object Object], ~/ and :/ paths leaked)
and Darkwing (27186: Arbiters always none, queue-read import failure
leaked a file:// path and stack). Round 2 (afb2ae0e) was approved by
Filbert (27190) and Darkwing (27191, correction 27192). Sage's gate on
d64f434f plus the candidate: 13 package node suites 0 failed (queue
149, webui 39), every scripts/test-*.sh 0 failed (task 98/0 with
Docker, 26/0 without; release 14/0), build-tokens --check current.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
