53 Commits

Author	SHA1	Message	Date
Hermes Agent	d12c5f7808	test(mosaic): make #791 PR2 Part 7 symlink control busybox-portable (#791 PR2) ... CI #1881 failed at head 8bee1b65: the durable-snapshot gate was 40/41, the sole failure being the Part 7 NEGATIVE control ("secret leaked through the symlink"). Root cause is a test-harness portability gap, not a code defect: node:24-alpine runs busybox cp as root, and busybox cp REPLACES a symlinked destination instead of following it, whereas GNU/BSD cp — what a real operator runs `mosaic update` under — follows the link and leaks. So under the CI harness the CWE-59 leak vector the control asserts simply cannot occur, and the negative control can't reproduce. Fix is test-only; install.sh (independently approved at 8bee1b65) and the real security assertions are untouched. make_symlink_leaf_shim now emulates GNU cp's follow-through-dest-symlink behavior portably: when the destination is a symlink it writes the source bytes through the link via redirection (which follows symlinks on every coreutils, busybox included); otherwise it delegates to the host cp unchanged. Both the shipped-case and the control run through this single shim, so the ONLY difference between them remains the SYMLINK-LEAF-GUARD — the control stays load-bearing and non-tautological, now on busybox too. With the guard present the symlinked leaf is dropped before this cp runs, so the shipped path is unchanged. Verified in the exact CI image (node:24-alpine, busybox, root, apk add bash rsync): durable-snapshot 41/41, manifest-guard 193, rollback 28. GNU host 41/41, shellcheck clean. Sole tracked delta vs 8bee1b65 = this test file. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-16 19:24:49 -05:00
Hermes Agent	8bee1b65ea	feat(mosaic): durable pre-update snapshot + verify net + restore CLI (#791 PR2) ... Third, independent recovery layer for keep-mode upgrades (Part of #791). PR1's manifest keeps the sync out of operator paths and the ephemeral /tmp snapshot rolls back a mid-write crash; this adds the case neither covers — a "successful" upgrade that a manifest/logic bug silently let touch an operator file. - install.sh make_durable_snapshot(): before any mutation, copy the operator-owned surface that exists to $XDG_STATE_HOME/mosaic/backups/pre-update-<UTC-ts>/ (0700 dirs / 0600 files, umask 077 scoped + restored). Fail-open; retention MOSAIC_BACKUP_RETENTION (default 5). - install.sh verify_operator_surface(): post-sync, restore any operator file the upgrade diverged/removed and warn loudly (a divergence = manifest bug). Honors intentional migration removals; refuses to restore through a symlink (CWE-59); guards mkdir under set -e. - mosaic restore (TS): --list (default dry-run), --from <ts> confirmation-gated restore. Strict timestamp selector (CWE-22), O_NOFOLLOW 0600 writes (CWE-59), containment + managed-dir checks via secure-file.ts. Counts/paths only — never emits file contents (secrev). - Gates: typecheck/lint/format ✓; mosaic vitest 1252; restore.spec 30; bash gates durable-snapshot 41 / manifest-guard 193 / rollback 28 / migration 21. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-16 19:04:14 -05:00
jason.woltje	32a0ffba13	feat(mosaic): manifest-owned upgrade guard so updates never wipe operator config (#791) (#802)	2026-07-16 23:01:26 +00:00
jason.woltje	8536454257	fix(glpi): accept HTTP 206 in list wrappers (#807) (#810)	2026-07-16 22:47:58 +00:00
jason.woltje	4f29cc604d	fix(tmux): correct cross-socket sender identity (#808) (#809)	2026-07-16 22:47:25 +00:00
jason.woltje	adad486b6f	fix(fleet): enforce exact comms authority (#787)	2026-07-16 00:32:23 +00:00
jason.woltje	191efaefeb	feat(fleet): enforce generated environment boundary (#772)	2026-07-15 08:40:32 +00:00
jason.woltje	e3b5113be2	feat(tess): add configurable Pi interaction service (#728)	2026-07-13 02:59:27 +00:00
jason.woltje	b580d37d51	Fixes #703 (#705)	2026-07-12 20:49:43 +00:00
jason.woltje	a99aded26d	fix(tools/git): -h/--help now exits 0 across 7 wrappers (#702)	2026-07-11 09:23:46 +00:00
jason.woltje	4df38f7e81	fix(tools/_lib): /etc/mosaic host-level fallback for credential resolution (#700)	2026-07-10 01:57:12 +00:00
jason.woltje	4e9e053800	fix(tools/tmux): unique per-invocation paste buffer; track auto-submit-drafts.sh (#697)	2026-07-09 17:37:40 +00:00
jason.woltje	248193cd3b	fix(fleet): export MOSAIC_AGENT_CLASS into the agent pane so personas inject (#669)	2026-06-24 19:38:15 +00:00
jason.woltje	aa27c42129	fix(fleet): pre-trust claude agent workdir to clear the folder-trust gate (#644) (#645)	2026-06-24 05:16:46 +00:00
jason.woltje	e6b53ea103	fix(tools): default AGENT_WORK_ROOT to $HOME/mosaic/agent-work (#641)	2026-06-23 13:40:13 +00:00
jason.woltje	4da87640e8	feat(tmux): agent-send.sh --class triage tag for the comms daemon (#552)	2026-06-23 03:25:16 +00:00
jason.woltje	94e5cd7a81	ci: eliminate cold pnpm install via pre-baked CI base image (Phase 1) (#635)	2026-06-22 22:50:21 +00:00
Jason Woltje	bf2a6745c8	fix(install): preserve user fleet data on re-seed + refresh active units (CRITICAL) (#632) ... Co-authored-by: Jason Woltje <jason@diversecanvas.com> Co-committed-by: Jason Woltje <jason@diversecanvas.com>	2026-06-22 21:38:09 +00:00
Jason Woltje	d539d61e0e	refactor(fleet): rename tmux socket mosaic-factory → mosaic-fleet (#630) ... Co-authored-by: Jason Woltje <jason@diversecanvas.com> Co-committed-by: Jason Woltje <jason@diversecanvas.com>	2026-06-22 21:08:43 +00:00
Jason Woltje	7342415a32	fix(fleet): consume model_hint + fix socket-default trap (stand-up fixes) (#627) ... Co-authored-by: Jason Woltje <jason@diversecanvas.com> Co-committed-by: Jason Woltje <jason@diversecanvas.com>	2026-06-22 19:18:01 +00:00
Jason Woltje	528700ceea	feat(framework): P6 — docs + compliance matrix + resident-budget CI (#607) ... Co-authored-by: Jason Woltje <jason@diversecanvas.com> Co-committed-by: Jason Woltje <jason@diversecanvas.com>	2026-06-22 02:20:35 +00:00
Jason Woltje	6dbe452a9f	fix(fleet): watch viewer-session leak + workdir test settle-race (#601) ... Co-authored-by: Jason Woltje <jason@diversecanvas.com> Co-committed-by: Jason Woltje <jason@diversecanvas.com>	2026-06-22 01:43:21 +00:00
Jason Woltje	59c755067e	feat(fleet): F3-m2 — native Pi heartbeat + model surface + mosaic_mission_status tool (#602) ... Co-authored-by: Jason Woltje <jason@diversecanvas.com> Co-committed-by: Jason Woltje <jason@diversecanvas.com>	2026-06-22 01:43:18 +00:00
Jason Woltje	6ffb27787e	fix(fleet): complete HB reader/writer consistency + sidecar hardening (#599) ... Co-authored-by: Jason Woltje <jason@diversecanvas.com> Co-committed-by: Jason Woltje <jason@diversecanvas.com>	2026-06-22 01:22:35 +00:00
Jason Woltje	60a309d5a4	fix(fleet): heartbeat consistency — MOSAIC_HOME path + configurable interval (#595) ... Co-authored-by: Jason Woltje <jason@diversecanvas.com> Co-committed-by: Jason Woltje <jason@diversecanvas.com>	2026-06-21 23:25:53 +00:00
Jason Woltje	bb7d549080	feat(framework): P4 — upgrade-safe Constitution migration (both installers) (#590) ... Co-authored-by: Jason Woltje <jason@diversecanvas.com> Co-committed-by: Jason Woltje <jason@diversecanvas.com>	2026-06-21 23:03:48 +00:00
jason.woltje	7ced5588c9	feat(fleet): launcher heartbeat sidecar — HB for all runtimes (pi/claude/codex) (#584)	2026-06-21 21:14:20 +00:00
Jason Woltje	c9cfe36204	docs(framework): P3.1 fast-follow — governance wording + gate scope + bare-launch note (#577) ... Co-authored-by: Jason Woltje <jason@diversecanvas.com> Co-committed-by: Jason Woltje <jason@diversecanvas.com>	2026-06-21 18:56:50 +00:00
jason.woltje	fc90c89913	fix(fleet): durable runtime PATH for detached agent launch (#581)	2026-06-21 17:30:40 +00:00
Jason Woltje	5118be74cb	feat(framework): P3 — extract Constitution (L0) + gut AGENTS dispatcher (#575) ... Co-authored-by: Jason Woltje <jason@diversecanvas.com> Co-committed-by: Jason Woltje <jason@diversecanvas.com>	2026-06-21 03:20:32 +00:00
Jason Woltje	bf24066a49	feat(framework): P1+P2 — public sanitization + blocking CI gate (#572) ... Co-authored-by: Jason Woltje <jason@diversecanvas.com> Co-committed-by: Jason Woltje <jason@diversecanvas.com>	2026-06-21 02:40:11 +00:00
Jason Woltje	92316ab41e	feat(framework): P0 — MIT license + executable-leak sanitization (#570) ... Co-authored-by: Jason Woltje <jason@diversecanvas.com> Co-committed-by: Jason Woltje <jason@diversecanvas.com>	2026-06-21 01:43:49 +00:00
jason.woltje	45e2c2aad8	docs: plan durable tmux fleet install (#557)	2026-06-20 16:19:19 +00:00
jason.woltje	57919c38d8	fix(framework/tools): wrapper hardening — TLS validation, cred-path fallback, no-CI fast-exit (#551)	2026-06-20 10:16:38 +00:00
jason.woltje	ee584ab48c	fix(framework/tools): prettier-format woodpecker README — restore main format gate (#553)	2026-06-18 22:39:35 +00:00
jason.woltje	ab4e138003	feat(framework/tools): orchestration helpers — lane-brief.sh + ci-wait.sh (#547)	2026-06-18 22:08:40 +00:00
jason.woltje	719c6ac3db	fix(framework/tools): eval injection, broken JSON, tmpfile leak (#549)	2026-06-18 21:35:32 +00:00
jason.woltje	b8807e60df	feat(agent-reflection): durable kernel — reflection.v1 capture + risk-floor + Phase-0 (#545)	2026-06-16 21:35:40 +00:00
jason.woltje	98a771c8f8	Fix Gitea wrapper login resolution (#538)	2026-06-12 02:34:18 +00:00
jason.woltje	dfa0be42f6	feat(framework/tools): inter-agent tmux comms — agent-send.sh + addressing standard (#533)	2026-06-11 18:01:44 +00:00
jason.woltje	dde95a59b3	fix(pi): reduce startup skill-token overhead (#527)	2026-06-05 18:36:42 +00:00
jason.woltje	821e19dcbb	fix(mosaic-tools): roll up Gitea and Woodpecker wrapper fixes (#524)	2026-05-26 20:56:09 +00:00
jason.woltje	45e8f02c91	feat(mosaic-portainer): PORTAINER_INSECURE flag for self-signed TLS (#484)	2026-04-22 01:21:54 +00:00
Jason Woltje	026382325c	feat(framework): superpowers enforcement, typecheck hook, file-ownership rules (#451) ... Co-authored-by: Jason Woltje <jason@diversecanvas.com> Co-committed-by: Jason Woltje <jason@diversecanvas.com>	2026-04-07 00:44:22 +00:00
jason.woltje	172bacb30f	feat(mosaic): IUV-M02 — CORS/FQDN UX polish + skill installer rework (#444)	2026-04-05 23:44:07 +00:00
jason.woltje	732f8a49cf	feat: unified first-run flow — merge wizard + gateway install (IUH-M03) (#433)	2026-04-05 19:13:02 +00:00
jason.woltje	2e31626f87	fix: simplify updater to @mosaic/mosaic only, add explicit tea repo/login flags (#388)	2026-04-05 02:09:23 +00:00
jason.woltje	a23c117ea4	fix: auto-migrate customized skills to skills-local/ on sync (#359)	2026-04-03 02:11:03 +00:00
jason.woltje	0cf80dab8c	fix: stale update banner + skill sync dirty worktree crash (#358)	2026-04-03 02:04:05 +00:00
Jarvis	e83674ac51	fix: mosaic sync — auto-stash dirty worktree before pull --rebase ... git pull --rebase fails with 'cannot pull with rebase: You have unstaged changes' when the skills repo has local modifications. Fix: detect dirty index/worktree, stash before pull, restore after. Also gracefully handle pull failures (warn and continue with existing checkout) and stash pop conflicts.	2026-04-02 20:41:11 -05:00