Commit Graph

641 Commits

Author SHA1 Message Date
mosaic-coder
dac9838b26 fix(framework): guard dispatch-level host resolution against a missing git origin (pr-review.sh)
All checks were successful
ci/woodpecker/pr/ci Pipeline was successful
Independent review of PR #896 found the -r/--repo + -H/--host overrides had a
real bug that this addresses:

1. The approve/request-changes/comment dispatch bodies each independently
   called a BARE `host=$(get_remote_host)` (used only for a best-effort
   tea-login guess) that ignored -H/--host entirely and, under `set -e`, died
   SILENTLY (exit 1, zero stdout/stderr) whenever there was no git origin at
   all — exactly the "reviewer worktree with no usable origin" case -r/-H
   exist to support. This was WORSE than the pre-5/5c baseline, which at
   least failed loud at detect_platform. Fixed by preferring -H/--host and
   otherwise tolerating a missing/failing git-remote lookup for that
   best-effort guess: `host="${HOST_OVERRIDE:-$(get_remote_host 2>/dev/null || true)}"`.

2. The regression test's "no git origin" fixture was a subdirectory NESTED
   inside this checkout, so `git remote get-url origin` resolved UPWARD to the
   checkout's own real origin — the "tolerates a missing origin" assertions
   never actually exercised a no-origin case. Fixed by creating that fixture
   via `mktemp -d` under the system /tmp (truly outside any .git ancestry) and
   additionally bounding it with GIT_CEILING_DIRECTORIES, plus a fixture
   self-check that fails the harness if `git remote get-url origin` ever
   resolves from inside it. Extended coverage to approve/request-changes (not
   just comment), each asserting the run is not silently dead (exit != 0 with
   zero combined output) in the true no-origin dir.

Reproduce-first evidence: with the CORRECTED fixture, re-running the
regression test against the previous (round-1) pr-review.sh reproduces the
exact reported failure — "died SILENTLY (exit 1, zero output)" — for the
`comment` action; the fix in this commit resolves it for comment, approve,
and request-changes alike.

Re-verified: pnpm run test:framework-shell (both pr-review tests + full
chain) green; shellcheck 0 new findings; grep -niE 'jason|woltje|jarvis' 0
hits; verify-sanitized.sh passed.

Part of #891
2026-07-25 16:46:13 -05:00
mosaic-coder
03e1cdbcd9 fix(framework): pr-review.sh -r/--repo + -H/--host overrides, UA header, repo preflight (Patch 5/5c)
Some checks failed
ci/woodpecker/pr/ci Pipeline was canceled
Upstreams the pr-review.sh -r/--repo and -H/--host override family from the
host-local tooling-patches kit (patch 5 + 5c), adapted to the framework's
current REST-native review/comment implementation:

- -r/--repo <owner/repo>: explicit slug override, skipping git-remote slug
  inference, for reviewer worktrees whose origin is nonstandard or missing.
  Mirrors the established -r convention of the sibling wrappers (pr-view.sh,
  pr-diff.sh, pr-ci-wait.sh; #867). detect_platform is now tolerant of a
  missing/foreign git origin when -r is given (assumes gitea), matching the
  same sibling-wrapper convention.
- -H/--host <host>: explicit Gitea host override, skipping remote-host
  inference, so ambient CWD/remote state cannot cross-wire a review/comment to
  the wrong instance.
- Repo-exists preflight: when -r is used, GET .../repos/<slug> BEFORE any
  write. A wrong-host cross-wire now surfaces as a clear preflight error
  instead of an opaque write-404.
- `User-Agent: mosaic-pr-review` header added to every Gitea curl call (write,
  read-back, /user, PR-head read, preflight) — some Cloudflare-fronted Gitea
  hosts intermittently reject curl's default User-Agent.

Reproduce-first evidence (against origin/main baseline, fresh clone):
- -r/-H: `./pr-review.sh -n 1 -a comment -c x -r foo/bar` / `-H example.test`
  both failed with "Unknown option" pre-patch; both parse post-patch.
- User-Agent: `grep -c User-Agent pr-review.sh` was 0 pre-patch.
- New regression test (test-pr-review-repo-host-override.sh) fails against the
  baseline file and passes against the patched file (red-first confirmed).

Scope note — two sub-changes from the source kit's patch family (5b: an
issue_url-empty html_url readback fallback; 5d: REST-native reviews replacing
`tea approve/reject`) were investigated and found ALREADY SUPERSEDED on this
baseline by a more robust, already-tested implementation:
- 5d: the current gitea_submit_review_verified() already POSTs to
  /pulls/{n}/reviews (no `tea pr approve/reject` call exists in this file —
  `grep -c 'tea pr' pr-review.sh` is 0), with additional hardening (identity
  binding, PR-head commit pinning, current-head TOCTOU close-out) beyond what
  the source patch describes.
- 5b: comment verification already keys off `pull_request_url` (not
  `issue_url`) with full origin+path pinning (see gitea_create_comment_verified
  / test-pr-review-gitea-comment.sh cases 15b, 17), which already handles the
  Gitea empty-issue_url-on-PR-comments behavior the source patch targets, via a
  stricter mechanism than a bare html_url fallback would provide. Porting the
  source kit's simpler fallback verbatim would have been a regression.

Per HALT-on-no-repro discipline, only the two sub-changes that actually
reproduced against baseline (5, 5c) are included here.

Part of #891
2026-07-25 16:18:06 -05:00
2698ddb7b5 feat(comms): P1 presence — minimal Synapse + fleet presence room + mosaic.presence heartbeat + liveness (#888)
Some checks failed
ci/woodpecker/push/ci-image Pipeline was successful
ci/woodpecker/push/ci Pipeline was successful
ci/woodpecker/push/publish Pipeline failed
Co-authored-by: jason.woltje <jason@diversecanvas.com>
Co-committed-by: jason.woltje <jason@diversecanvas.com>
2026-07-25 21:03:18 +00:00
fabde1c834 docs(rfc): add RFC-001 (MACP/Matrix-native comms) + RFC-002 (install/config/topology) (#886)
Some checks failed
ci/woodpecker/push/publish Pipeline was canceled
ci/woodpecker/push/ci Pipeline was canceled
Co-authored-by: jason.woltje <jason@diversecanvas.com>
Co-committed-by: jason.woltje <jason@diversecanvas.com>
2026-07-25 21:02:54 +00:00
3c7890f17f fix(framework): detect-platform get_gitea_token fail-loud on absent per-slot token (Patch 2b) (#890)
All checks were successful
ci/woodpecker/push/publish Pipeline was successful
ci/woodpecker/push/ci Pipeline was successful
Co-authored-by: jason.woltje <jason@diversecanvas.com>
Co-committed-by: jason.woltje <jason@diversecanvas.com>
2026-07-25 20:51:19 +00:00
529c177830 fix(update): mosaic update runs the install-ordering guard post-reseed (#882 --sync-only bypass) (#883)
All checks were successful
ci/woodpecker/push/publish Pipeline was successful
ci/woodpecker/push/ci Pipeline was successful
Co-authored-by: jason.woltje <jason@diversecanvas.com>
Co-committed-by: jason.woltje <jason@diversecanvas.com>
2026-07-23 22:18:34 +00:00
a32ce4c8f9 feat(869-c4): activation version-coupling assertion (Part of #869)
All checks were successful
ci/woodpecker/push/publish Pipeline was successful
ci/woodpecker/push/ci Pipeline was successful
Part of #869

Mos (id-11) Gate-16 merge: independent APPROVE @90eb48fa (fail-closed identity locks byte-unchanged verified), author id2 != approver id11, clean mosaic-coder author, CI green wp1992. #869 Point-1 CODE COMPLETE (C1/C3/C5/C2/C4).

Co-authored-by: jason.woltje <jason@diversecanvas.com>
Co-committed-by: jason.woltje <jason@diversecanvas.com>
2026-07-23 19:07:27 +00:00
d351caad36 feat(869-c2): install-ordering enforcement-hook guard (Part of #869)
All checks were successful
ci/woodpecker/push/publish Pipeline was successful
ci/woodpecker/push/ci Pipeline was successful
Part of #869

Mos (id-11) Gate-16 merge: independent APPROVE @b6f36564 (8/8, verified vs real production settings template), author id2 != approver id11, clean mosaic-coder author, CI green wp1988.

Co-authored-by: jason.woltje <jason@diversecanvas.com>
Co-committed-by: jason.woltje <jason@diversecanvas.com>
2026-07-23 18:48:33 +00:00
76b86a246e feat(869-c5): mosaic doctor activation-check (Part of #869)
Some checks failed
ci/woodpecker/push/publish Pipeline was successful
ci/woodpecker/push/ci Pipeline was canceled
Part of #869

Mos (id-11) Gate-16 merge: independent APPROVE @e75e3238 (8/8), author id2 != approver id11, clean mosaic-coder author, CI green wp1987.

Co-authored-by: jason.woltje <jason@diversecanvas.com>
Co-committed-by: jason.woltje <jason@diversecanvas.com>
2026-07-23 18:38:21 +00:00
4422231bdb feat: per-agent Gitea identity resolution (#873)
All checks were successful
ci/woodpecker/push/publish Pipeline was successful
ci/woodpecker/push/ci Pipeline was successful
Closes #873

Mos (id-11) Gate-16 merge: independent APPROVE @4b472a22 (author-blocker dissolved via (a) re-author, identical tree hash to tech-approved head), author id2 != approver id11, clean mosaic-coder commit-author, CI green wp1985. Framework train COMPLETE 6/6.

Co-authored-by: jason.woltje <jason@diversecanvas.com>
Co-committed-by: jason.woltje <jason@diversecanvas.com>
2026-07-23 18:09:34 +00:00
8504216964 fix(pr-review): case-insensitive _belongs slug compare (#875)
All checks were successful
ci/woodpecker/push/publish Pipeline was successful
ci/woodpecker/push/ci Pipeline was successful
Closes #875

Mos (id-11) Gate-16 merge: independent APPROVE @9d8d58ae, author id2 != approver id11, clean mosaic-coder commit-author, CI green wp1982.

Co-authored-by: jason.woltje <jason@diversecanvas.com>
Co-committed-by: jason.woltje <jason@diversecanvas.com>
2026-07-23 17:53:26 +00:00
7edc9b3121 fix(gitea): direct REST comment/review with fail-closed read-back (#865)
All checks were successful
ci/woodpecker/push/publish Pipeline was successful
ci/woodpecker/push/ci Pipeline was successful
Closes #865

Mos (id-11) Gate-16 merge: fresh confirmatory independent APPROVE @8ac7e70f (1241-case fuzz 0 fail-open), author id2 != approver id11, clean commit-author, CI green wp1966.

Co-authored-by: jason.woltje <jason@diversecanvas.com>
Co-committed-by: jason.woltje <jason@diversecanvas.com>
2026-07-23 17:25:32 +00:00
2f50c0876b feat(869-c3): lease-broker supervisor unit (Part of #869)
Some checks failed
ci/woodpecker/push/publish Pipeline was successful
ci/woodpecker/push/ci Pipeline was canceled
Part of #869

Mos (id-11) Gate-16 merge: independent APPROVE @75235ef8 (9/9, no live host mutation), author id2 != approver id11, CI green wp1971.

Co-authored-by: jason.woltje <jason@diversecanvas.com>
Co-committed-by: jason.woltje <jason@diversecanvas.com>
2026-07-23 17:19:48 +00:00
db90da347e feat(869-c1): activation-capability probe (Part of #869)
Some checks failed
ci/woodpecker/push/publish Pipeline was successful
ci/woodpecker/push/ci Pipeline was canceled
Part of #869

Mos (id-11) Gate-16 merge: independent 3-round APPROVE @c5a2bcc5, author id2 != approver id11, CI green wp1973.

Co-authored-by: jason.woltje <jason@diversecanvas.com>
Co-committed-by: jason.woltje <jason@diversecanvas.com>
2026-07-23 17:14:57 +00:00
48fd1df28a fix(ci-queue-wait): treat absent branch (404) as queue-clear (#872)
Some checks failed
ci/woodpecker/push/publish Pipeline was successful
ci/woodpecker/push/ci Pipeline was canceled
Closes #872

Mos (id-11) Gate-16 merge: independent review APPROVE @23cbdaf8, author jason.woltje(id2) != approver Mos(id11), CI green wp1974.

Co-authored-by: jason.woltje <jason@diversecanvas.com>
Co-committed-by: jason.woltje <jason@diversecanvas.com>
2026-07-23 17:08:57 +00:00
b79336a8c1 feat(orchestrator): board-roll.sh — auto-roll LIVE board to LEDGER under byte cap (#868)
Some checks failed
ci/woodpecker/push/publish Pipeline was successful
ci/woodpecker/push/ci Pipeline failed
feat(orchestrator): board-roll.sh - auto-roll LIVE board to LEDGER under byte cap

Closes #868
2026-07-22 09:20:03 +00:00
4e5af23214 Merge pull request 'skills: add glpi-* family (solve, followup, sweep, list, create)' (#863) from feat/glpi-skills into main
All checks were successful
ci/woodpecker/push/publish Pipeline was successful
ci/woodpecker/push/ci Pipeline was successful
2026-07-21 01:09:50 +00:00
Hermes Agent
880c28b191 docs(glpi-skills): genericize operator-specific content per review
All checks were successful
ci/woodpecker/pr/ci Pipeline was successful
2026-07-20 19:45:50 -05:00
Jason Woltje
7bc2dfb6c8 skills: add glpi-* family (solve, followup, sweep, list, create)
All checks were successful
ci/woodpecker/pr/ci Pipeline was successful
GLPI helpdesk workflow skills written against the portable
tools/glpi/ tooling (session-init.sh, ticket-list.sh, ticket-create.sh),
cross-linked via [[glpi-*]]:

- glpi-solve    — close a ticket by setting status Solved (5); GLPI auto-closes
- glpi-followup — add a followup via the top-level /ITILFollowup endpoint
- glpi-sweep    — read-only hunt for done-but-open tickets needing Solve
- glpi-list     — query tickets by status/recency
- glpi-create   — open a new ticket

Core rule encoded: completing work means setting status Solved, not just
posting a resolution followup (a followup documents; only Solved auto-closes).

Note: illustrative examples in the bodies are USC-flavored (M2M / helpdesk
ticket numbers) and can be genericized in review if preferred.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019GjBgrb9tHgvq414Fqj37c
2026-07-20 18:04:53 -05:00
b0d78d8632 fix(mosaic): de-flake mutator-class lease gate TTL-expiry test (#861)
All checks were successful
ci/woodpecker/push/publish Pipeline was successful
ci/woodpecker/push/ci Pipeline was successful
2026-07-20 10:32:45 +00:00
344d86a635 fix(#812 follow-up): normalize detect-platform.sh host-match port comparison by scheme (#859)
All checks were successful
ci/woodpecker/push/publish Pipeline was successful
ci/woodpecker/push/ci Pipeline was successful
2026-07-20 10:13:29 +00:00
acd7d380f6 fix(framework): install deps on worktree bootstrap + legible deps-preflight at gate seam (#856) (#858)
Some checks failed
ci/woodpecker/push/ci Pipeline failed
ci/woodpecker/push/publish Pipeline was successful
2026-07-20 09:38:12 +00:00
3b70c66c07 fix(framework): drop unsupported --comment from tea pr approve/reject; route review body via durable comment (#835) (#857)
All checks were successful
ci/woodpecker/push/publish Pipeline was successful
ci/woodpecker/push/ci Pipeline was successful
2026-07-20 09:19:48 +00:00
11d2818453 docs(tasks): FCM-M5-001 done — verified completion evidence (supersedes #848) (#853)
All checks were successful
ci/woodpecker/push/publish Pipeline was successful
ci/woodpecker/push/ci Pipeline was successful
2026-07-20 07:45:08 +00:00
aa999daf1b fix(framework): durable Gitea comment posting in pr-review.sh via REST + read-back verify (#812) (#852)
All checks were successful
ci/woodpecker/push/publish Pipeline was successful
ci/woodpecker/push/ci Pipeline was successful
2026-07-20 06:45:48 +00:00
77c9a82614 fix(lease-broker): de-flake recovery_runtime b2 broker-socket ConnectionRefused race (#849) (#851)
Some checks failed
ci/woodpecker/push/publish Pipeline was canceled
ci/woodpecker/push/ci Pipeline was canceled
2026-07-20 06:44:37 +00:00
627cf2bb38 docs(fleet): add operator configuration guide (#789)
Some checks failed
ci/woodpecker/push/ci Pipeline failed
ci/woodpecker/push/publish Pipeline was successful
2026-07-20 05:22:25 +00:00
0582a8912b WI-7 #834: T-C server-side branch-protection posture + R1 honesty amendment (#847)
All checks were successful
ci/woodpecker/push/publish Pipeline was successful
ci/woodpecker/push/ci Pipeline was successful
2026-07-20 04:20:02 +00:00
2509eb7646 WI-6 (#833): constrained recovery command + mosaic-context-refresh skill wrapper (#846)
All checks were successful
ci/woodpecker/push/publish Pipeline was successful
ci/woodpecker/push/ci Pipeline was successful
2026-07-20 03:33:00 +00:00
07553ead33 WI-5 #832: Receipt-challenge protocol (compaction-refresh, milestone 188) (#845)
All checks were successful
ci/woodpecker/push/publish Pipeline was successful
ci/woodpecker/push/ci Pipeline was successful
2026-07-19 23:18:56 +00:00
e522b22fa4 WI-4 (#831): verbatim-hashed normative fragments (B_payload/H_payload) (#844)
All checks were successful
ci/woodpecker/push/publish Pipeline was successful
ci/woodpecker/push/ci Pipeline was successful
2026-07-19 20:34:20 +00:00
e4d7d4502d WI-3 (#830): compaction observers → revoke + D4 same-PID generation auto-revoke (#842)
All checks were successful
ci/woodpecker/push/publish Pipeline was successful
ci/woodpecker/push/ci Pipeline was successful
2026-07-19 19:46:28 +00:00
8dfcf1903e fix(#838): bound broker reply deadlines + fail-close empty-read; de-flake acceptance harness (#839)
All checks were successful
ci/woodpecker/push/publish Pipeline was successful
ci/woodpecker/push/ci Pipeline was successful
Bound broker reply deadlines (separate read/lock/send budgets, BROKER_BUSY-before-mutation, fresh post-handle send budget → closes drop-after-commit window); fail-close empty/truncated read → GATE_UNAVAILABLE deny. De-flakes the 1917 acceptance surface. terra CODE APPROVE (pi) + Opus SECREV APPROVED (claude) — RoR comment 18143. Promote-lease-lost-ACK residual = fail-safe two-generals observability-gap, routed to WI-3 D2-v5 as named-disclosed-bounded-residual (route i). Gate-16 3-principal author=gpt-sol.

closes #838
2026-07-18 07:15:50 +00:00
abd2791f59 feat(mosaic): WI-2 mutator-class guard for directive-freshness (#837)
Some checks failed
ci/woodpecker/push/ci Pipeline failed
ci/woodpecker/push/publish Pipeline was successful
WI-2: mutator-class guard for the compaction directive-freshness mechanism — command-position parser (prefix x var-indirection unified) + primitive-anchored invariant backstop + all-tools-hook fail-close. Parser-complete on principle: realistic evasion matrix RED-regression-covered, residual exotic evasions proven backstop-caught (B-tests), lens-convergence reached.

closes #829
2026-07-18 05:51:58 +00:00
8ec67a1126 feat(mosaic): add authenticated external lease broker (#836)
All checks were successful
ci/woodpecker/push/publish Pipeline was successful
ci/woodpecker/push/ci Pipeline was successful
2026-07-18 03:12:23 +00:00
d801d6c4c8 feat(mosaic): add secure skill registration CLI (#826)
All checks were successful
ci/woodpecker/push/ci-image Pipeline was successful
ci/woodpecker/push/ci Pipeline was successful
ci/woodpecker/push/publish Pipeline was successful
2026-07-17 23:45:35 +00:00
d3bf52898b fix: reject unknown installer arguments (#825)
All checks were successful
ci/woodpecker/push/ci Pipeline was successful
ci/woodpecker/push/publish Pipeline was successful
2026-07-17 22:16:51 +00:00
3f77229e88 fix(#792): fleet roster ENOENT actionable exit + installer heading printf (#818)
All checks were successful
ci/woodpecker/push/ci Pipeline was successful
ci/woodpecker/push/publish Pipeline was successful
2026-07-17 21:36:36 +00:00
686c881fe4 fix: fetch actual Gitea PR head for Codex reviews (#815)
All checks were successful
ci/woodpecker/push/publish Pipeline was successful
ci/woodpecker/push/ci Pipeline was successful
2026-07-17 19:44:56 +00:00
fe7a468c9d ci: bake jq into the prebuilt test image (#821)
All checks were successful
ci/woodpecker/push/ci-image Pipeline was successful
ci/woodpecker/push/ci Pipeline was successful
ci/woodpecker/push/publish Pipeline was successful
2026-07-17 19:12:43 +00:00
cabf02e7b9 ci: bake git into the prebuilt test image (#819)
All checks were successful
ci/woodpecker/push/ci-image Pipeline was successful
ci/woodpecker/push/ci Pipeline was successful
ci/woodpecker/push/publish Pipeline was successful
2026-07-17 18:11:16 +00:00
9ddc6fbda8 feat(fleet): mosaic fleet regen — regenerate roster-derived projections (PR3 of #791) (#813)
All checks were successful
ci/woodpecker/push/publish Pipeline was successful
ci/woodpecker/push/ci Pipeline was successful
2026-07-17 03:17:55 +00:00
31607a4af6 feat(mosaic): durable pre-update snapshot + verify net + restore CLI (#791 PR2) (#811)
All checks were successful
ci/woodpecker/push/publish Pipeline was successful
ci/woodpecker/push/ci Pipeline was successful
2026-07-17 00:43:18 +00:00
32a0ffba13 feat(mosaic): manifest-owned upgrade guard so updates never wipe operator config (#791) (#802)
All checks were successful
ci/woodpecker/push/publish Pipeline was successful
ci/woodpecker/push/ci Pipeline was successful
2026-07-16 23:01:26 +00:00
8536454257 fix(glpi): accept HTTP 206 in list wrappers (#807) (#810)
All checks were successful
ci/woodpecker/push/publish Pipeline was successful
ci/woodpecker/push/ci Pipeline was successful
2026-07-16 22:47:58 +00:00
4f29cc604d fix(tmux): correct cross-socket sender identity (#808) (#809)
Some checks failed
ci/woodpecker/push/publish Pipeline was canceled
ci/woodpecker/push/ci Pipeline was canceled
2026-07-16 22:47:25 +00:00
3be443c96d feat(mosaic): claudex isolated config + env-inject + yolo wiring (P2–P4 of #790) (#806)
All checks were successful
ci/woodpecker/push/publish Pipeline was successful
ci/woodpecker/push/ci Pipeline was successful
2026-07-16 22:10:33 +00:00
59f5f51ffd feat(mosaic): claudex proxy preflight + lifecycle (P1 of #790) (#793)
All checks were successful
ci/woodpecker/push/publish Pipeline was successful
ci/woodpecker/push/ci Pipeline was successful
2026-07-16 21:15:33 +00:00
9745bc3f29 feat(fleet): add reviewed v1-to-v2 migration preview (#788)
All checks were successful
ci/woodpecker/push/publish Pipeline was successful
ci/woodpecker/push/ci Pipeline was successful
2026-07-16 13:11:16 +00:00
adad486b6f fix(fleet): enforce exact comms authority (#787)
All checks were successful
ci/woodpecker/push/publish Pipeline was successful
ci/woodpecker/push/ci Pipeline was successful
2026-07-16 00:32:23 +00:00