Compare commits
4
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 jason.woltje
|
37171f65ba | ||
|
jason.woltje
|
ddf7dce6c6 | ||
|
jason.woltje
|
08578991c7 | ||
|
jason.woltje
|
ca500082af |
@@ -5177,17 +5177,3 @@ Before: managed project/thread verbs had no Console conversation area. After: fi
|
||||
2026-10-21T01:28:05Z | Darkwing | row 232 #1734 installer I1 build, round 1 in review | Before: stack-release.sh managed only user units (systemctl --user), and stack-copy.sh had no bundle copy. After: --units external (adopt, activate, rollback --to, status, confirm, revert, gate --since, AWAITING-UNITS, stale-start, external-pm, --plan --expect-from) and stack-copy check --units external, copy --bundle FILE SHA, wrapper ID --create; user mode byte-identical to the base by test. First build 0af0c73c6 on 00d4cc1f6; rebased onto row 200 (cb5fdb064) as a0ffabc3f on darkwing/row232-r1; --sso refused under external (D9), row 200 config_checks run under external (D10). Gate on Sage's slot (sage-1618): cli 561/0, every scripts/test-*.sh green; 17/17 mutants killed. Results commit 84f1a91e6 (pushed, seat branch only). Manifest 7a3b4ea1 (9 paths), queue revs 2595-2596, request comment 29825, reviewer Filbert. Packet agents/darkwing/work/queue-232/BUILD.md.
|
||||
2026-10-21T04:50:44Z | Darkwing | row 233 #1735 installer I3 build, round 1 in review | Before: root had no upgrade driver for root-owned units and no host run sheet; stack-release.sh had no rehearse --backup last and no external plan refusals. After: scripts/stack-upgrade.sh upgrade and rollback (r6 A1-A5, A2f, R1-R4) with 20 tests, docs/guides/host-run-sheet.md, TOOLS.md lines, and on Sage's rulings stack-release.sh --backup last, BACKUP_STORE and the --plan refusals open-activation and migrate-required (3 tests). Base e65a3ab4d (row 232's landing). Gate on Sage's slot (sage-1704) on d99166ade: cli 616/0, every scripts/test-*.sh green, 1201/0 summed by awk; m1-m8 8/8 killed. Correction: the process sweep after the gate found an orphaned sleep 60 from the lock test's flock holder (N1); 08db6ac3f fixes it test only, Sage ruled the gate stands (sage-1707), rerun c0 20/0 and m1 killed with 0 left (sage-1708). Tip 1a1dc80ca (pushed, seat branch only). Manifest 464ce9eb (7 paths), queue revs 2644 and 2647, request comment 29901, reviewer Filbert. Packet agents/darkwing/work/queue-233/BUILD.md.
|
||||
2026-10-21T06:37:41Z | Darkwing | row 240 #1746 installer I4 build, round 1 in review | Before: root had no host check for the bwrap AppArmor profile, its pins or a boot unit, and stack-upgrade.sh exited 1 args-failed when the args move after A5 failed, while exit 1 means the old copy runs. After: scripts/case1-hostcheck.sh (seven items, --check, --enforce, --upstream), scripts/case1-pins.sh, mosaic-hostcheck.service and 16 tests; the args move failure exits 5 args-failed, documented in TOOLS.md and run sheet section 6 and tested; run sheet section 3 puts the pinned npm on PATH and names the bin/claude.exe --claude path; sections 8 and 10 have precheck lines. Verification: slot run r1 on 47ec9fe2f failed at the singles (the new N1 test's after hook threw ENOENT after the fixture cleanup removed the root); b45852daa drops the hook; r2 on b45852daa green: singles 16/0 and 21/0, c0 plus M1-M8 8/8 killed, cli 639/0, scripts 585/0. Candidate darkwing/row240-r3 ad1b23ab2 on c771a36f4, manifest 573ece95 (9 paths), revs 2694 and 2695, comment 29943.
|
||||
2026-10-21T09:00Z | Herb | row 215 C2-04 implementation started | Before: business files reject library entries and root consumers assume code projects; the organization writer can change all project mappings. Plan: approved manifest 2522025af on C2-01 a2c72ac95, Filbert reply to herb-0056, scope sage-1848/1852/1860. Focused slot sage-1869 observed expected red mapping and M9 cases, then 14/0 green for new T1/T2 cases, no skips; clear herb-0062 with empty test/fixture process scan. After that clear, T3/T4 tests and host-only mirror/bus implementation continue under sage-1874, unrun while Sage holds the slot. Full singles, suites and implementation review remain pending. No source commit, push or live change.
|
||||
2026-10-21T13:29Z | Herb | row 215 C2-04 source verified for candidate review | Before: business code assumed every project had a root and organization writes could replace project mappings. After: library mappings load without agent checkouts or publish grants, project mappings are protected before and after serialization, host-only bare mirrors share a bounded publication lock with sync, and library.file/library.status are human-only async bus reads. Base f8276c5eb preserves all nine landed overlaps. Granted sage-2008 whole singles: 16 files, 451/0, no skips or cancellations, ended 13:27:27.279728Z; all source hashes unchanged, process scan empty, no own-path drift through 8a04f4aa4. Full landing gate and implementation review remain pending; no HTTP, sync writer or live change.
|
||||
|
||||
2026-10-20 19:09:44 UTC | Gander row 196 #1694 design phase | Before: tester TCP reaches every local uid and human proofs do not bind the socket peer. After: design draft at agents/gander/work/queue-196/DESIGN.md inventories listeners, proposes private tester HTTP and SO_PEERCRED binding, aligns the per-request principal contract with Morgana and Gizmoduck, and lists migration, tests, mutants and same-uid limits. Python versus other credential options and Console provenance require Duckworth ruling. Documentation only. No product code, suite, live probe, secret access or deployment.
|
||||
|
||||
2026-10-20 19:16:20 UTC | Gander row 196 #1694 design r2 | Before: Duckworth r1 requested concurrent helper-fd evidence (B1) and selected O1 with interpreter, proof-only and image conditions. After: design adds eight concurrent genuine proof processes plus a racing copier, M20 swapped socket and post-helper socket survival, root-owned system ELF pinning and activation evidence, safe gid validation, cap traffic without helpers, and unchanged P19 R2 text. Mos accepted socket-only tester access (mos-1015 via sage-1363); any authenticated browser relay is a separate row. Documentation coverage checks passed. No product code, suites or live action.
|
||||
|
||||
2026-10-20 19:21:19 UTC | Gander row 196 #1694 design approval and N5 | Before: Duckworth approved r2 (duckworth-0009, cb6d840df) with a nonblocking interpreter-upgrade note. After: r3 chooses startup safety revalidation, appends actual interpreter identity to bus/peercred-starts.jsonl and retains old activation evidence. Operator re-pin uses the next reviewed copy, respecting already-active refusal. Added task-by-task PLAN.md for inline implementation and independent manifest review. Documentation checks passed. No product code, suites or live action.
|
||||
|
||||
2026-10-20 19:34:28 UTC | Gander row 196 build paused at design mismatch | Before: approved design promised Unix tester cleanup only for the owned inode. After: scratch test shows Node/libuv close unlinks a replacement inode before JS close handlers. Evidence agents/gander/work/queue-196/evidence/tester-cleanup-blocker.txt. Sent Sage/Duckworth gander-0016/0017, recommending explicit same-uid residual with private 0700 parent retained. Interpreter, concurrent peer, principal, human, peer-transport, transport, tester and process single files passed. Partial code uncommitted, tester transport not wired. No suites, mutant batches or live actions.
|
||||
|
||||
2026-10-21 18:45 UTC | Gander row 196 preservation before rebase | Sage-2051, Mos order mos-1193, explicitly authorizes commit and fast-forward push of the current build before deferred full verification. Product and evidence preserved together; prior focused checks and stopped gates are recorded in the row196 packet, with no claim of full acceptance. Next: rebase onto a36523713 on new gander/row196-r2, report range-diff/patch-id/conflicts, then await Sage's clear for M1-M29 and all requested suites. No live action, force push, branch deletion or tests during hold.
|
||||
|
||||
2026-10-21 21:24:47 UTC | Gander row253 #1758 design r1 | Investigation began21:12Z under sage-2162; recorded now. Before: case2 installer still renders tester TCP and case1 acceptance requires it. After: proposed design covers socket marker migration, actual configured dataRoot within unchanged hardening, target-uid metadata queries, kernel-peer acceptance observation and explicit same-uid residual. Initial inventory saved; no passing final static-check claim, product edit, test, host or live action. Duckworth design review precedes code.
|
||||
|
||||
+4
-24
@@ -75,8 +75,7 @@ session's workspace and its own process group. Same contract, plus:
|
||||
| `MOSAIC_POLICY_FILE`, `MOSAIC_TOOLS_FILE` | The bundle's gate policy and typed tools. |
|
||||
| `MOSAIC_TOOL_SOCKET` | The runner's tool socket, which the typed tools call. |
|
||||
| `MOSAIC_TURN_MARKER` | `pi`: the extension writes it at `agent_end`; a pi turn that exits 0 without it failed. |
|
||||
| `MOSAIC_EXTENSIONS` | `pi` only: extension files loaded with `-e`; a missing one exits 2. The pi module names two: the gate and typed tools extension, then the unslop check's `tools/unslop-hook/extension.ts` (row 66). |
|
||||
| `MOSAIC_UNSLOP_LOG` | The unslop check's JSONL log, `<run>/unslop.jsonl`, which the runner sets for both adapters and reads after each turn (row 66). |
|
||||
| `MOSAIC_EXTENSIONS` | `pi` only: extension files loaded with `-e`; a missing one exits 2. |
|
||||
| `MOSAIC_CLAUDE_SETTINGS`, `MOSAIC_CLAUDE_MCP_CONFIG` | `claude` only: the bundle's gate hook and MCP server; required. |
|
||||
| `MOSAIC_THINKING` | The route's thinking level (row 65), which the harness module's `levels()` already checked. `pi` passes `--thinking` (`off`, `minimal`, `low`, `medium`, `high`, `xhigh`, `max`) and omits it when unset, as for `run-task.sh` workers. `claude` passes `--effort` (`low`, `medium`, `high`, `xhigh`, `max`) and requires it; unset exits 2. |
|
||||
| `MOSAIC_CLAUDE_BIN` | `claude` only: absolute path of the CLI to run, from the host's environment (the bus unit pins it). Unset or empty runs `claude` from `PATH`; a relative path or a non-executable file exits 2. |
|
||||
@@ -87,8 +86,7 @@ The layers each adapter relies on, and what they don't cover, are in
|
||||
### A role's skills (row 64)
|
||||
|
||||
A managed session's skills reach both adapters as text in the bundle's
|
||||
`prompt.md`, which they pass as a file: `pi` with `--system-prompt <path>`
|
||||
and `claude` with `--system-prompt-file <path>` (row 213). Neither adapter loads a
|
||||
`prompt.md`, which they pass with `--system-prompt`. Neither adapter loads a
|
||||
skill of its own: `pi` keeps `--no-skills`, since role sessions never get
|
||||
`MOSAIC_SKILLS`, and `claude` keeps `--disable-slash-commands` and
|
||||
`--restricted`. Sage chose this on 2026-10-19 from a probe, recorded in
|
||||
@@ -106,23 +104,5 @@ skill of its own: `pi` keeps `--no-skills`, since role sessions never get
|
||||
|
||||
The cost is prompt size: a role's skill text is in every turn, where the
|
||||
other routes load a skill when it's used. The bundle caps a role's skills at
|
||||
64 KiB together. The cap dates from when `claude` passed `prompt.md` as one
|
||||
argument, which Linux caps at 128 KiB; row 213 passes the file instead, so no
|
||||
local user reads the prompt in `/proc/<pid>/cmdline`. Pi 0.85.1 uses the path
|
||||
string itself as the prompt when the file is missing or can't be read, so the
|
||||
pi adapter exits 2 unless the path is a readable regular file.
|
||||
|
||||
### The unslop check (row 66)
|
||||
|
||||
Both adapters run the mechanical writing check from `tools/unslop-hook`,
|
||||
driven by one `lists.json`. `pi` loads it as its second `-e` extension.
|
||||
`claude` runs `claude-hook.js` from the bundle's `settings.json`: the Stop
|
||||
hook checks the turn's replies, and the UserPromptSubmit hook adds the
|
||||
correction notice as context on the next turn when the last reply had
|
||||
tells. Each hook command ends `; exit 0`, so neither blocks. Both log to
|
||||
`MOSAIC_UNSLOP_LOG`, and the runner adds a note for the operator to the
|
||||
next RESULT it sends (`packages/harness/README.md`, the runner). The
|
||||
harness modules mount the three files read-only at their own paths, and
|
||||
the manifest records their digests. `MOSAIC_UNSLOP_HOOK` and `UNSLOP_LISTS`
|
||||
aren't in the session environment's allowlist, so a managed session can't
|
||||
switch the check off or swap its lists.
|
||||
64 KiB together, since `claude` passes `prompt.md` as one argument and Linux
|
||||
caps one argument at 128 KiB.
|
||||
|
||||
@@ -27,11 +27,6 @@ need MOSAIC_CLAUDE_MCP_CONFIG
|
||||
for f in "$MOSAIC_SYSTEM_PROMPT_FILE" "$MOSAIC_CLAUDE_SETTINGS" "$MOSAIC_CLAUDE_MCP_CONFIG"; do
|
||||
[ -r "$f" ] || { echo "claude adapter: not readable: $f" >&2; exit 2; }
|
||||
done
|
||||
PROMPT_FILE=$MOSAIC_SYSTEM_PROMPT_FILE
|
||||
case "$PROMPT_FILE" in
|
||||
/*) ;;
|
||||
*) PROMPT_FILE="$(pwd)/$PROMPT_FILE" ;;
|
||||
esac
|
||||
[ "${MOSAIC_INTERACTIVE:-}" != "1" ] || { echo "claude adapter: interactive mode isn't supported" >&2; exit 2; }
|
||||
CLAUDE=claude
|
||||
if [ -n "${MOSAIC_CLAUDE_BIN:-}" ]; then
|
||||
@@ -61,10 +56,7 @@ fi
|
||||
# Flags:
|
||||
# -p one-shot: print the answer and exit
|
||||
# --output-format text stdout is the answer only
|
||||
# --system-prompt-file the generated prompt replaces the default, given
|
||||
# as a file so no local user reads it in
|
||||
# /proc/<pid>/cmdline (row 213); absolute, since
|
||||
# the cd above changed the working directory
|
||||
# --system-prompt the generated prompt replaces the default
|
||||
# --effort the instance's thinking var (row 65; 2.1.302 takes
|
||||
# low, medium, high, xhigh, max)
|
||||
# --restricted no user/project/local settings files; --settings
|
||||
@@ -84,9 +76,10 @@ fi
|
||||
# text in the system prompt (row 64)
|
||||
ALLOWED=mcp__mosaic
|
||||
[ -z "${MOSAIC_TOOLS:-}" ] || ALLOWED="$MOSAIC_TOOLS,mcp__mosaic"
|
||||
PROMPT_CONTENT="$(cat "$MOSAIC_SYSTEM_PROMPT_FILE")"
|
||||
"$CLAUDE" -p "$MOSAIC_REQUEST" \
|
||||
--output-format text \
|
||||
--system-prompt-file "$PROMPT_FILE" \
|
||||
--system-prompt "$PROMPT_CONTENT" \
|
||||
--model "$MOSAIC_MODEL" \
|
||||
--effort "$MOSAIC_THINKING" \
|
||||
--restricted \
|
||||
|
||||
+4
-14
@@ -8,17 +8,7 @@
|
||||
set -eu
|
||||
|
||||
[ -n "${MOSAIC_SYSTEM_PROMPT_FILE:-}" ] || { echo "pi adapter: MOSAIC_SYSTEM_PROMPT_FILE is required" >&2; exit 2; }
|
||||
# Row 213 (C2-08): pi gets the prompt as a path, so no local user reads it in /proc/<pid>/cmdline.
|
||||
# Pi 0.85.1 reads --system-prompt as a file only when the path exists and reads, and otherwise
|
||||
# uses the path string itself as the prompt, without a warning for a missing file
|
||||
# (dist/core/resource-loader.js resolvePromptInput). So the path must be a regular readable
|
||||
# file here, and is made absolute before the cd below, since pi resolves it from its own cwd.
|
||||
PROMPT_FILE=$MOSAIC_SYSTEM_PROMPT_FILE
|
||||
case "$PROMPT_FILE" in
|
||||
/*) ;;
|
||||
*) PROMPT_FILE="$(pwd)/$PROMPT_FILE" ;;
|
||||
esac
|
||||
[ -f "$PROMPT_FILE" ] && [ -r "$PROMPT_FILE" ] || { echo "pi adapter: system prompt not readable: $MOSAIC_SYSTEM_PROMPT_FILE" >&2; exit 2; }
|
||||
[ -r "$MOSAIC_SYSTEM_PROMPT_FILE" ] || { echo "pi adapter: system prompt not readable: $MOSAIC_SYSTEM_PROMPT_FILE" >&2; exit 2; }
|
||||
# MOSAIC_AGENT_NAME is optional in headless mode (identity section is then
|
||||
# omitted); interactive launches always set it via scripts/agent.sh.
|
||||
|
||||
@@ -104,8 +94,7 @@ fi
|
||||
# All flags documented in the pi package README (CLI Reference):
|
||||
# -p/--print one-shot mode: print the response and exit (omitted in
|
||||
# interactive TUI mode)
|
||||
# --system-prompt replace the default prompt with the generated one, given
|
||||
# as the file's absolute path (checked above), never its text
|
||||
# --system-prompt replace the default prompt with the generated one
|
||||
# --no-* no ambient context/skills/extensions/templates/themes
|
||||
# EXT_FLAGS the explicitly provided extensions only (-e)
|
||||
# SESSION_FLAGS ephemeral | persistent | forked (per env)
|
||||
@@ -114,6 +103,7 @@ fi
|
||||
# --offline no startup network operations (update checks/telemetry)
|
||||
# --no-approve ignore project-local .pi/ files (settings, SYSTEM.md)
|
||||
# whatever trust is saved for the workspace
|
||||
PROMPT_CONTENT="$(cat "$MOSAIC_SYSTEM_PROMPT_FILE")"
|
||||
set -- \
|
||||
--offline \
|
||||
--no-approve \
|
||||
@@ -128,7 +118,7 @@ set -- \
|
||||
--provider "$PI_PROVIDER" \
|
||||
--model "$PI_MODEL" \
|
||||
$THINKING_FLAG \
|
||||
--system-prompt "$PROMPT_FILE"
|
||||
--system-prompt "$PROMPT_CONTENT"
|
||||
# One-shot mode appends -p and the request (both safely quoted);
|
||||
# interactive mode appends nothing - clean TUI.
|
||||
[ "$INTERACTIVE" = "1" ] || set -- "$@" -p "$MOSAIC_REQUEST"
|
||||
|
||||
@@ -151,11 +151,3 @@ every run behind my busy check and Sage's, chained with `&&`.
|
||||
Summed: 818 node tests passed with 0 failed, and 429 selftests passed with 0 failed. The compose network
|
||||
was removed afterwards, and the sweep found no process left in the worktree, the output directory or the
|
||||
TMPDIR. This file's results are a doc-only commit on top of the build, so nothing that ran has changed.
|
||||
|
||||
## Correction to deviation 6 (follow-up, 2026-10-21)
|
||||
|
||||
Deviation 6 says the node F9 runs is root's own. At 37171f65b the script didn't check that. F9 ran
|
||||
`--node` as root before F10's path check, so the header's "root itself only reads" was false
|
||||
(Duckworth's N1, `agents/duckworth/work/row195/REVIEW-m1.md` at 6afcee2a5). A host installed as designed
|
||||
was safe, because `case2-unit.sh` refused a non-root-owned `--node`. Row 245 carries the fix and its
|
||||
tests: `agents/darkwing/work/queue-245/BUILD.md`.
|
||||
|
||||
@@ -1,91 +0,0 @@
|
||||
# Row 245 build: Duckworth's N1-N3 on `scripts/case1-accept.sh` (row 195 follow-up)
|
||||
|
||||
Duckworth approved row 195's manifest round 1 (duckworth-0088, `agents/duckworth/work/row195/REVIEW-m1.md`
|
||||
at 6afcee2a5) with three notes that don't block. Row 195's code landed as b65014647, and the notes are in
|
||||
`docs/plans/DEFERRED.md` (d6cff0cdd). Row 245 carries them: brief `docs/plans/2026-10-20_hub-own-uid.md` §
|
||||
"Row 195 follow-up" at 62ddc96cc, owner Darkwing, reviewer Duckworth, gate owner Sage (sage-1923).
|
||||
|
||||
The branch is `darkwing/row245`, on 62ddc96cc. Its first commit is a cherry-pick of `darkwing/row195-n1`
|
||||
1e3c4767c, which was written on 37171f65b and never run. The script, test and TOOLS.md blobs are the same
|
||||
as in 1e3c4767c, and none of those paths changed between 37171f65b and 62ddc96cc.
|
||||
|
||||
## What changes
|
||||
|
||||
N1. F9 ran `$ROOT$NODE` as root (`case1-accept.sh:298` at 37171f65b) before F10 checked that `--node` is
|
||||
the pinned path. Duckworth offered two fixes: F9's parse through `AS_USER`, or F10's path check first. I
|
||||
took the path check, plus one more:
|
||||
- F9 now runs node only when `--node` equals `/opt/mosaic-stack/node-<--node-pin>/bin/node`.
|
||||
- Then `not_root_only` walks from that file up to `/`. Each entry must be the running user's (root's on the
|
||||
host) with no group or other write, the rule `case2-unit.sh` `root_only` applied when it rendered the
|
||||
units. A symlink fails it, because its mode is 777. The first entry that breaks the rule goes in the
|
||||
evidence.
|
||||
|
||||
I didn't run the parse through `AS_USER`. That would hand a check about a root file to the stack's user,
|
||||
and a process running as `mosaic` shares that node's uid. Whether it could change what node prints then
|
||||
turns on the host's ptrace setting, and the root-only check doesn't depend on that. Sage agreed in
|
||||
sage-1877. Rechecking ownership costs one loop and doesn't depend on
|
||||
how the host was installed.
|
||||
|
||||
N2. The header (:9-15) and the `docs/TOOLS.md` entry now list what root runs: `systemctl show` and
|
||||
`is-enabled` (F1, P11), `curl` on the loopback healthz (F2), `sudo -l` (P1, P3), `sudo -u jarvis bwrap
|
||||
--version` and `hostcheck.sh --check` (P9), and node for F9 under the rule above.
|
||||
|
||||
N3. F6 matched `--claude` by prefix, so `/opt/mosaic-stack/claude-<pin>/../claude-2.0.9/...` passed the
|
||||
path check. F6 now fails on any `..` segment, before it runs `--version`. F10 compares for equality, so
|
||||
it needed no change.
|
||||
|
||||
Row 195's BUILD.md gets a correction entry for deviation 6. Row 195's DESIGN.md is unchanged. Its "either
|
||||
works" wording at `DESIGN.md:336-338` is superseded by gosalyn-0087 (root writes `dev.args` at W10), and
|
||||
it stays in place: an approved design isn't edited (sage-1877).
|
||||
|
||||
## Tests
|
||||
|
||||
`packages/cli/tests/case1-accept.test.mjs`:
|
||||
- The node stub touches `node-as-root` in the state directory when something runs it outside the fake
|
||||
`sudo` (which sets HOME to the stack's home). `host()` sets the node file's directories and the scratch
|
||||
root to 0755, so the umask can't fail F9.
|
||||
- "every check passing" also asserts that root ran the pinned node.
|
||||
- New: "F9 won't run --node as root off the pin path or with a writable directory above it". Another node
|
||||
path fails F9 and F10, with no root run. A group-writable `bin/` and a symlinked node each fail F9
|
||||
alone, with the bad path in the evidence and no root run.
|
||||
- The F6 test gains a `..` case: a path under `claude-<pin>/` by prefix that names 2.0.9's binary, which
|
||||
prints the pin. F6 alone fails, with "has a .. segment".
|
||||
|
||||
That makes 23 tests. All 23 pass on Sage's slot (results below).
|
||||
|
||||
## Mutants
|
||||
|
||||
The twelve from row 195 still apply, unchanged. These four are new, each one exact replacement:
|
||||
|
||||
| # | Mutant | Expected killer |
|
||||
|---|---|---|
|
||||
| 13 | F9 runs any `--node` (the pin check becomes `true`) | F9 won't run (another node) |
|
||||
| 14 | F9 skips the ownership walk (`bad=""`) | F9 won't run (writable `bin/`, symlink) |
|
||||
| 15 | `not_root_only` checks only the file, not the directories above it | F9 won't run (writable `bin/`) |
|
||||
| 16 | F6 accepts a `..` segment | F6 stub, path and `..` |
|
||||
|
||||
The brief's gate asks for a mutant for each of N1 and N3. Mutants 13-15 are N1's, and 16 is N3's.
|
||||
|
||||
## Slot plan
|
||||
|
||||
Same shape as row 195's steps, on this row's tip: the single test file, then the sixteen mutants, then
|
||||
the gate (the cli suite and every `scripts/test-*.sh`), each behind the busy checks and chained with
|
||||
`&&`. The scripts are in `/mnt/storage/scratch/darkwing-245-out/`.
|
||||
|
||||
## Slot results (grant sage-1961, 2026-10-21)
|
||||
|
||||
All three steps ran on 0590a29fc with node v26.8.1, launched from `/`. Both busy checks were CLEAR
|
||||
before each step.
|
||||
|
||||
- Singles, 11:27:46-11:27:59Z: `case1-accept.test.mjs` passed 23, failed 0.
|
||||
- Mutants, 11:28:10-11:31:20Z: all 16 killed, each with exit 1. The runner restored the script, and
|
||||
its sha256 875bb5b7 matches the committed blob. Rows 1-12 died as in row 195. 13, 14 and 15 died on
|
||||
"F9 won't run --node as root off the pin path or with a writable directory above it". 16 died on
|
||||
"F6 fails on a stub that prints nothing, on a path outside claude-<pin> and on a .. segment".
|
||||
- Gate, 11:31:20-11:42:51Z: the cli suite passed 664, failed 0, skipped 0. Every `scripts/test-*.sh`
|
||||
exited 0: auth 15, conductor 17, config 31, discord 78, extension-package 18, foundation 44,
|
||||
land-work 86, queue 28 (its node part 156/0), release 14, task 98. That's 429 selftests, none failed.
|
||||
- Afterwards no process had its cwd in the worktree, the out dir or TMPDIR, and the
|
||||
`darkwing-r245_default` network was gone.
|
||||
|
||||
Logs: `/mnt/storage/scratch/darkwing-245-out/` (`step1.log`, `mut.out`, `mut/m1-16.log`, `gate.out`).
|
||||
@@ -1,711 +0,0 @@
|
||||
{
|
||||
"base": "c3d88840c",
|
||||
"stage": "pre-implementation; not the passing final static check",
|
||||
"occurrences": [
|
||||
{
|
||||
"file": "scripts/case2-unit.sh",
|
||||
"line": 25,
|
||||
"text": "# optional --tester-port N (1024..65535, never --port). Only factory takes"
|
||||
},
|
||||
{
|
||||
"file": "scripts/case2-unit.sh",
|
||||
"line": 163,
|
||||
"text": " --tester-port) [ \"$PROFILE\" = factory ] || die \"the library profile refuses --tester-port: the tester listener takes writes from loopback with no sign-in\" ;;"
|
||||
},
|
||||
{
|
||||
"file": "scripts/case2-unit.sh",
|
||||
"line": 193,
|
||||
"text": " --tester-port) tester_port=\"$value\""
|
||||
},
|
||||
{
|
||||
"file": "scripts/case2-unit.sh",
|
||||
"line": 194,
|
||||
"text": " [[ \"$value\" =~ ^[1-9][0-9]{3,4}$ ]] && [ \"$value\" -ge 1024 ] && [ \"$value\" -le 65535 ] || die \"--tester-port must be 1024..65535: $value\" ;;"
|
||||
},
|
||||
{
|
||||
"file": "scripts/case2-unit.sh",
|
||||
"line": 204,
|
||||
"text": " [ -z \"$tester_port\" ] || [ \"$tester_port\" -ne \"$port\" ] || die \"--tester-port must differ from --port\""
|
||||
},
|
||||
{
|
||||
"file": "scripts/instance.sh",
|
||||
"line": 114,
|
||||
"text": "# this instance's, whose ExecStart takes PORT as --port or --tester-port."
|
||||
},
|
||||
{
|
||||
"file": "scripts/instance.sh",
|
||||
"line": 132,
|
||||
"text": " --tester-port) [[ \"$tok\" =~ ^[0-9]{1,5}$ ]] && ports+=(\"$((10#$tok))\") ;;"
|
||||
},
|
||||
{
|
||||
"file": "scripts/case1-accept.sh",
|
||||
"line": 65,
|
||||
"text": " case \"$a\" in --port) PORT=\"$v\"; i=$((i + 1)) ;; --tester-port) TESTER_PORT=\"$v\"; i=$((i + 1)) ;; esac"
|
||||
},
|
||||
{
|
||||
"file": "scripts/case1-accept.sh",
|
||||
"line": 88,
|
||||
"text": " refuse \"$ARGS_FILE lacks a numeric --port or --tester-port after --\""
|
||||
},
|
||||
{
|
||||
"file": "scripts/webui-service.sh",
|
||||
"line": 43,
|
||||
"text": "# Console), --tester-socket (private Unix tester), or legacy --tester-port N"
|
||||
},
|
||||
{
|
||||
"file": "scripts/webui-service.sh",
|
||||
"line": 74,
|
||||
"text": "# --tester-port that another installed Console unit in the unit directory"
|
||||
},
|
||||
{
|
||||
"file": "scripts/webui-service.sh",
|
||||
"line": 96,
|
||||
"text": " FLAGS: [--port N] [--business ID] [--board URL] [--sso [--send] | --public-host NAME --auth-header HEADER --allow-user ID [--send]] [--tester-socket | --tester-port N (legacy copies)] [--proof-header NAME --proof-file PATH]"
|
||||
},
|
||||
{
|
||||
"file": "scripts/webui-service.sh",
|
||||
"line": 97,
|
||||
"text": " --tester-port: legacy copies only; 1024..65535, different from --port and never 7332; loopback tester listener."
|
||||
},
|
||||
{
|
||||
"file": "scripts/webui-service.sh",
|
||||
"line": 137,
|
||||
"text": " --tester-port) [ $# -ge 2 ] || usage; TESTER_PORT=\"$2\"; TESTER_SET=1; SERVE_SET=1; shift 2 ;;"
|
||||
},
|
||||
{
|
||||
"file": "scripts/webui-service.sh",
|
||||
"line": 182,
|
||||
"text": " echo \"webui-service: --tester-port must be 1024..65535, different from --port and never 7332: $TESTER_PORT\" >&2"
|
||||
},
|
||||
{
|
||||
"file": "scripts/webui-service.sh",
|
||||
"line": 266,
|
||||
"text": " [ \"$TESTER_SET\" = 0 ] || flags=\"$flags --tester-port $TESTER_PORT\""
|
||||
},
|
||||
{
|
||||
"file": "scripts/webui-service.sh",
|
||||
"line": 462,
|
||||
"text": " if grep -Eq '^ExecStart=.*( --allow-user [^ ][^ ]*( --proof-header [^ ]+ --proof-file /[^ ]+)?| --sso) --send( --tester-port [0-9]+| --tester-socket)?$' \"$target\"; then"
|
||||
},
|
||||
{
|
||||
"file": "scripts/webui-service.sh",
|
||||
"line": 467,
|
||||
"text": " if grep -Eq '^ExecStart=.* --sso( --send)?( --tester-port [0-9]+)?$' \"$target\"; then"
|
||||
},
|
||||
{
|
||||
"file": "scripts/webui-service.sh",
|
||||
"line": 471,
|
||||
"text": " tester_port=\"$(sed -n 's/^ExecStart=.* --tester-port \\([0-9][0-9]*\\)$/\\1/p' \"$target\")\""
|
||||
},
|
||||
{
|
||||
"file": "scripts/stack-release.sh",
|
||||
"line": 47,
|
||||
"text": " stack-release.sh activate ID BUSINESS [--pm | --pm-after-harness] [--migrate] [--tester-socket | --tester-port N (legacy copies)]"
|
||||
},
|
||||
{
|
||||
"file": "scripts/stack-release.sh",
|
||||
"line": 63,
|
||||
"text": "activate and rollback --plan take --expect-from OLD. --pm, --pm-after-harness, --tester-port, the"
|
||||
},
|
||||
{
|
||||
"file": "scripts/stack-release.sh",
|
||||
"line": 126,
|
||||
"text": " --tester-port) [ \"$OP\" = activate ] && [ $# -ge 2 ] && [ -n \"$2\" ] || usage; TESTER_PORT=\"$2\"; shift 2 ;;"
|
||||
},
|
||||
{
|
||||
"file": "scripts/stack-release.sh",
|
||||
"line": 797,
|
||||
"text": " elif grep -q -- '--tester-port' \"$cli\"; then supported=1; fi"
|
||||
},
|
||||
{
|
||||
"file": "scripts/stack-release.sh",
|
||||
"line": 800,
|
||||
"text": " --tester-port) i=$((i + 1)); inherited=\"${BASE_CONSOLE[i]:-}\" ;;"
|
||||
},
|
||||
{
|
||||
"file": "scripts/stack-release.sh",
|
||||
"line": 814,
|
||||
"text": " [ -z \"$inherited\" ] || DROP_TESTER=\"--tester-port $inherited (replaced by private Unix socket)\""
|
||||
},
|
||||
{
|
||||
"file": "scripts/stack-release.sh",
|
||||
"line": 830,
|
||||
"text": " check_refuse tester-port-invalid \"--tester-port $TESTER_PORT is not a whole port from 1024 to 65535 other than 7332$other\""
|
||||
},
|
||||
{
|
||||
"file": "scripts/stack-release.sh",
|
||||
"line": 832,
|
||||
"text": " [ \"$supported\" = 1 ] || check_refuse tester-port-target \"$TO's Console does not support --tester-port\""
|
||||
},
|
||||
{
|
||||
"file": "scripts/stack-release.sh",
|
||||
"line": 833,
|
||||
"text": " RUN_CONSOLE=(\"${without_tester[@]}\" --tester-port \"$TESTER_PORT\")"
|
||||
},
|
||||
{
|
||||
"file": "scripts/stack-release.sh",
|
||||
"line": 837,
|
||||
"text": " RUN_CONSOLE=(\"${without_tester[@]}\") DROP_TESTER=\"--tester-port $inherited\""
|
||||
},
|
||||
{
|
||||
"file": "scripts/stack-release.sh",
|
||||
"line": 878,
|
||||
"text": " # --send and --tester-port follow the pointer, so a --no-send or a tester port set after that"
|
||||
},
|
||||
{
|
||||
"file": "scripts/stack-release.sh",
|
||||
"line": 885,
|
||||
"text": " --tester-port) i=$((i + 1)) ;;"
|
||||
},
|
||||
{
|
||||
"file": "scripts/stack-release.sh",
|
||||
"line": 893,
|
||||
"text": " --tester-port) i=$((i + 1)); BASE_CONSOLE+=(--tester-port \"${P_CONSOLE[i]:-}\") ;;"
|
||||
},
|
||||
{
|
||||
"file": "scripts/stack-release.sh",
|
||||
"line": 897,
|
||||
"text": " SSO_PLAN=\"sso: dropped; $TO's Console does not support --sso, so the rollback takes the Console flags from $set/$f, with --send and --tester-port as the pointer has them\""
|
||||
},
|
||||
{
|
||||
"file": "scripts/stack-release.sh",
|
||||
"line": 903,
|
||||
"text": "# --tester-port. Sets SSO_DROP (the plan's dropped preview flags), PROOF_PLAN and PROOF_STEP."
|
||||
},
|
||||
{
|
||||
"file": "scripts/stack-release.sh",
|
||||
"line": 919,
|
||||
"text": " case \"${kept[i]}\" in --send | --tester-port | --tester-socket) break ;; esac"
|
||||
},
|
||||
{
|
||||
"file": "scripts/stack-release.sh",
|
||||
"line": 1076,
|
||||
"text": " case \"${without_proof[i]}\" in --send | --tester-port | --tester-socket) break ;; esac"
|
||||
},
|
||||
{
|
||||
"file": "scripts/stack-release.sh",
|
||||
"line": 1134,
|
||||
"text": "# Row 190: the target Console's --port (7332 when absent) and --tester-port against every other"
|
||||
},
|
||||
{
|
||||
"file": "scripts/stack-release.sh",
|
||||
"line": 1142,
|
||||
"text": " --tester-port) ports+=(\"${RUN_CONSOLE[i + 1]:-}\") ;;"
|
||||
},
|
||||
{
|
||||
"file": "scripts/stack-release.sh",
|
||||
"line": 2106,
|
||||
"text": " for ((i = 0; i < ${#P_CONSOLE[@]}; i++)); do [ \"${P_CONSOLE[i]}\" != --tester-port ] || reserved+=(\"${P_CONSOLE[i + 1]:-}\"); done"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/case2-unit.test.mjs",
|
||||
"line": 80,
|
||||
"text": "const factoryFlags = () => [\"--port\", \"443\", \"--business\", \"acme\", \"--tester-port\", \"7333\"];"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/case2-unit.test.mjs",
|
||||
"line": 328,
|
||||
"text": " [\"--tester-port\", \"7333\", /the library profile refuses --tester-port/],"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/case2-unit.test.mjs",
|
||||
"line": 364,
|
||||
"text": " refuses(unit(h, { profile: \"factory\", flags: [\"--port\", \"443\", \"--business\", \"acme\", \"--tester-port\", \"443\"] }), /--tester-port must be 1024\\.\\.65535|--tester-port must differ from --port/);"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/case2-unit.test.mjs",
|
||||
"line": 365,
|
||||
"text": " refuses(unit(h, { profile: \"factory\", flags: [\"--port\", \"443\", \"--business\", \"acme\", \"--tester-port\", \"1443\", \"--port\", \"1443\"] }), /given twice/);"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/case2-unit.test.mjs",
|
||||
"line": 378,
|
||||
"text": " refuses(unit(h, { profile: \"factory\", flags: [\"--port\", \"443\", \"--business\", \"acme\", \"--tester-port\", \"443\"] }), /--tester-port must be 1024\\.\\.65535/);"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/case2-unit.test.mjs",
|
||||
"line": 380,
|
||||
"text": " assert.match(read(UNIT), /--tester-port must differ from --port/);"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release-fixture.mjs",
|
||||
"line": 306,
|
||||
"text": " for(const [f,text,mode] of [['scripts/mosaic',script(mosaicStub),0o755],['packages/webui/src/cli.mjs',[B,C1,C].includes(id)?`// fixture Console, never run\\n// serve accepts '--tester-port'\\n// serve accepts '--proof-header' (row 178)\\n${[C1,C].includes(id)?\"// serve accepts '--sso' (row 192)\\n\":''}`:'// fixture Console before tester listener, never run\\n',0o644],['packages/bus/src/store.mjs',store,0o644],['packages/bus/src/migrate-schema.mjs',`(${migrateStub})();\\n`,0o644],['packages/plugins/src/kinds.mjs',[C1,C].includes(id)?KINDS_NEW:KINDS_OLD,0o644],...ssoFiles(id).map(([f,text])=>[f,text,0o644])]){"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 681,
|
||||
"text": "const testerFlags=(e,port='7333')=>['--port',e.port,'--business','acme','--tester-port',port];"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 687,
|
||||
"text": " let r=await run(e,'activate',C1,'acme','--tester-port','7333');assert.equal(r.code,0,r.out+r.err);"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 688,
|
||||
"text": " assert.deepEqual(pointer(e).console,testerFlags(e));assert.match(consoleText(e),/--tester-port 7333(?:\\n|$)/);"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 690,
|
||||
"text": " r=await run(e,'activate',B,'acme','--tester-port','7334');assert.equal(r.code,0,r.out+r.err);"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 692,
|
||||
"text": " assert.match(consoleText(e),/--tester-port 7334(?:\\n|$)/);assert.doesNotMatch(consoleText(e),/--tester-port 7333/);"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 693,
|
||||
"text": " assert.equal((consoleText(e).match(/--tester-port/g)||[]).length,1);"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 694,
|
||||
"text": " r=await run(e,'activate',C1,'acme','--plan');assert.equal(r.code,0,r.out+r.err);assert.match(r.out,/Console: .*--tester-port 7334/);"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 697,
|
||||
"text": " assert.deepEqual(pointer(e).console,testerFlags(e,'7334'));assert.match(consoleText(e),/--tester-port 7334(?:\\n|$)/);"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 702,
|
||||
"text": " let r=await run(e,'activate',B,'acme','--tester-port','7333');assert.equal(r.code,0,r.out+r.err);"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 705,
|
||||
"text": " assert.match(r.out,/drop[^\\n]*--tester-port 7333/i);assert.doesNotMatch(r.out.split('\\n').find((l)=>l.startsWith('Console: ')),/--tester-port/);"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 708,
|
||||
"text": " assert.deepEqual(pointer(e).console,['--port',e.port,'--business','acme']);assert.doesNotMatch(consoleText(e),/--tester-port/);"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 709,
|
||||
"text": " assert.match(stepText(e),/drop[^\\n]*--tester-port 7333/i);"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 714,
|
||||
"text": " const r=await run(e,'activate',A,'acme','--tester-port','7333');assert.equal(r.code,3,r.out+r.err);"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 718,
|
||||
"text": " assert.match(readFileSync(join(repo,'packages/webui/src/cli.mjs'),'utf8'),/--tester-port/);"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 724,
|
||||
"text": " const r=await run(e,'activate',C1,'acme','--tester-port',value);assert.equal(r.code,4,`${value}: ${r.out}${r.err}`);"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 731,
|
||||
"text": " let r=await run(e,'activate',C1,'acme','--tester-port','7333');assert.equal(r.code,0,r.out+r.err);"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 732,
|
||||
"text": " r=await run(e,'activate',A,'acme','--plan');assert.equal(r.code,0,r.out+r.err);assert.match(r.out,/drop[^\\n]*--tester-port 7333/i);"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 736,
|
||||
"text": " edit(join(e.units,CON),'--tester-port 7333','--tester-port 7334');const n=calls(e).length;"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 738,
|
||||
"text": " edit(join(e.units,CON),'--tester-port 7334','--tester-port 7333');"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 740,
|
||||
"text": " assert.deepEqual(pointer(e).console,['--port',e.port,'--business','acme']);assert.doesNotMatch(consoleText(e),/--tester-port/);"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 741,
|
||||
"text": " assert.match(stepText(e),/drop[^\\n]*--tester-port 7333/i);"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 746,
|
||||
"text": " let r=await run(e,'activate',C1,'acme','--pm-after-harness','--tester-port','7333');assert.equal(r.code,0,r.out+r.err);"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 749,
|
||||
"text": " assert.deepEqual(pointer(e).console,testerFlags(e));assert.match(consoleText(e),/--tester-port 7333(?:\\n|$)/);"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 821,
|
||||
"text": " const rule=(port,main)=>`--tester-port ${port} is not a whole port from 1024 to 65535 other than 7332${main?` and the Console's --port ${main}`:''}`;"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 827,
|
||||
"text": " const r=await run(e,'activate',C1,'acme','--pm-after-harness','--plan','--tester-port',port);"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 830,
|
||||
"text": " const u=await run(e,'activate',C1,'acme','--pm-after-harness','--tester-port',port);"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 839,
|
||||
"text": " const n=calls(e).length,u=await run(e,'activate',C1,'acme','--tester-port','80');"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 843,
|
||||
"text": " await t.test('a target Console without --tester-port',async(t)=>{"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 846,
|
||||
"text": " const r=await run(e,'activate',A,'acme','--tester-port','7333','--plan');"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 848,
|
||||
"text": " assert.deepEqual(r.out.split('\\n').filter((l)=>l.startsWith('refuses ')),[`refuses tester-port-target: ${A}'s Console does not support --tester-port`,`refuses unknown-kind-for-target: the business file names plug-in kind(s) harness, which ${A} does not know`]);"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 850,
|
||||
"text": " await refused(e,['activate',A,'acme','--tester-port','7333'],'tester-port-target',`${A}'s Console does not support --tester-port`);"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 1056,
|
||||
"text": " const r=await run(e,'activate',C1,'acme','--tester-port','7333');assert.equal(r.code,0,r.out+r.err);"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 1057,
|
||||
"text": " assert.deepEqual(pointer(e).console,[...expected,'--tester-port','7333']);"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 1058,
|
||||
"text": " assert.ok(consoleText(e).includes([...expected,'--tester-port','7333'].join(' ')));"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 1129,
|
||||
"text": " await t.test('tests 1 and 9: the pair goes after the preview flags, before --send and the kept --tester-port, as the unit renders it; a new pair replaces it',async(t)=>{"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 1132,
|
||||
"text": " let r=await prun(e,'activate',C1,'acme','--tester-port','7333');assert.equal(r.code,0,r.out+r.err);"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 1135,
|
||||
"text": " assert.ok(out.find((l)=>l.startsWith('Console: ')).endsWith(` ${PREVIEW.join(' ')} ${pair(f).join(' ')} --send --tester-port 7333`));"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 1137,
|
||||
"text": " assert.deepEqual(pointer(e).console,[...pre,...pair(f),'--send','--tester-port','7333']);"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 1138,
|
||||
"text": " assert.ok(conExec(e).endsWith(` --checkout ${repo} ${[...pre,...pair(f),'--send','--tester-port','7333'].join(' ')}`),conExec(e));"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 1141,
|
||||
"text": " assert.deepEqual(pointer(e).console,[...pre,...pair(g,'X-Proof-Two'),'--send','--tester-port','7333']);"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 1162,
|
||||
"text": " await refused(e,['activate',B,'acme','--tester-port','7333'],'already-active',`${B} is the pointer's copy`);"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 1351,
|
||||
"text": " const e=await mk(t),base=await seedPreview(e,undefined,['--send','--tester-port','7333']),want=noSend(base);"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 1352,
|
||||
"text": " assert.deepEqual(want.slice(-2),['--tester-port','7333']);"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 1367,
|
||||
"text": " await refused(e,['activate',B,'acme','--tester-port','7333'],'already-active',`${B} is the pointer's copy`);"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 1468,
|
||||
"text": "const ROLLBACK_PLAN=(set)=>`sso: dropped; ${B}'s Console does not support --sso, so the rollback takes the Console flags from ${set}/${SHOW}, with --send and --tester-port as the pointer has them`;"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 1480,
|
||||
"text": " let r=await prun(e,'activate',B,'acme','--tester-port','7333',...pair(f));assert.equal(r.code,0,r.out+r.err);"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 1481,
|
||||
"text": " assert.deepEqual(pointer(e).console,[...pre,...pair(f),'--send','--tester-port','7333']);"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 1483,
|
||||
"text": " const want=['--port',e.port,'--business','acme','--sso','--send','--tester-port','7333'];"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 1486,
|
||||
"text": " `sso: on; drops ${DROPS}; carries --port ${e.port} --business acme --send --tester-port 7333`]);"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 1563,
|
||||
"text": " const out=await planOnly(e,3,'activate',C,'acme','--sso','--tester-port','80');"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 1564,
|
||||
"text": " assert.deepEqual(out.filter((l)=>l.startsWith('refuses ')),[`refuses tester-port-invalid: --tester-port 80 is not a whole port from 1024 to 65535 other than 7332 and the Console's --port ${e.port}`,`refuses sso-slot: ${bad('is inside the repository or the copies')}`]);"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 1584,
|
||||
"text": " const e=await mk(t),base=await seedPreview(e,undefined,['--send','--tester-port','7333']);await ssoConfig(e);"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 1594,
|
||||
"text": " const want=[...noSend(base.slice(0,-2)),'--tester-port','7333'];"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 1682,
|
||||
"text": " assert.deepEqual(ssoLines(await planOnly(a,0,'rollback','acme')),[`sso: dropped; ${B}'s Console does not support --sso, so the rollback takes the Console flags from ${set}/${show}, with --send and --tester-port as the pointer has them`]);"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 1811,
|
||||
"text": " writeFileSync(e.pointer,JSON.stringify({copy,business:'acme',pm:true,claude:e.claude,console:['--port',e.port,'--business','acme','--tester-port',TESTER],schema:store,activation:'manual',at:'2026-10-20T00:00:00Z'})+'\\n');"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 2198,
|
||||
"text": " ['beta\\'s tester port on alpha\\'s port',b,['--port',free,'--tester-port',a.port],1,`webui-service: refusing port-claimed: ${held}; nothing was changed\\n`],"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 2202,
|
||||
"text": " ['beta\\'s tester port on 7333',b,['--port',free,'--tester-port','7333'],4,'webui-service: port-reserved: 7333 is reserved for the default instance (7330 7332 7333)\\n'],"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 2217,
|
||||
"text": " await refused('--tester-port','--tester-port',a.port);"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 2280,
|
||||
"text": " let r=await run(e,'activate',B,'acme','--tester-port','7333');assert.equal(r.code,0,r.out+r.err);"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 2290,
|
||||
"text": " r=await run(e,'activate',C1,'acme','--tester-socket','--plan');assert.equal(r.code,0,r.out+r.err);assert.match(r.out,/--tester-socket/);assert.match(r.out,/drop.*--tester-port 7333/);"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 2292,
|
||||
"text": " assert.deepEqual(pointer(e).console,[...base,...pair(proof),'--tester-socket']);assert.match(consoleText(e),/--tester-socket/);assert.doesNotMatch(consoleText(e),/--tester-port/);"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 2319,
|
||||
"text": " assert.doesNotMatch(conExec(e),/ --send(?: |$)|--tester-port|--public-host|--proof-header/);"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"line": 2388,
|
||||
"text": " assert.equal(context.argv.includes('--tester-socket'),marked);assert.equal(context.argv.includes('--tester-port'),false);"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/case1-accept.test.mjs",
|
||||
"line": 28,
|
||||
"text": " \"--node\", NODE, \"--claude\", CLAUDE, \"--pm\", \"--\", \"--port\", \"732\", \"--business\", \"mosaic-stack\", \"--tester-port\", \"7333\"];"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/case1-accept.test.mjs",
|
||||
"line": 477,
|
||||
"text": " \"no tester port\": [(h) => put(h.args, ARGS.slice(0, -2).join(\"\\n\") + \"\\n\", 0o644), /lacks a numeric --port or --tester-port after --$/],"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/case1-hostcheck.test.mjs",
|
||||
"line": 68,
|
||||
"text": " \"[Service]\\nExecStart=/opt/mosaic-stack/node/bin/node /srv/mosaic/copies/x/packages/webui/src/cli.mjs serve --port 732 --business mosaic-stack --tester-port 7333\\n\");"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/case1-hostcheck.test.mjs",
|
||||
"line": 215,
|
||||
"text": " put(join(h.root, \"etc\", \"systemd\", \"system\", \"mosaic-webui.service\"), \"[Service]\\nExecStart=/x serve --business mosaic-stack --tester-port 7333\\n\");"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release-external.test.mjs",
|
||||
"line": 75,
|
||||
"text": " for(const a of [['activate',C1,'acme','--pm'],['activate',C1,'acme','--tester-port','7444'],['activate',C1,'acme','--no-proof'],['activate',C1,'acme','--no-send'],['activate',C1,'acme','--sso'],['activate',C1,'acme','--proof-header','X','--proof-file','/p'],['rollback','acme'],['gate',B,'acme'],['activate',C1,'acme','--expect-from',B],['confirm',C1,'acme','--rollback',B],['confirm',C1,'acme','--cause','A5']]){"
|
||||
},
|
||||
{
|
||||
"file": "packages/webui/README.md",
|
||||
"line": 128,
|
||||
"text": "need `--port`, and 7330, 7332 or 7333 as `--port` or `--tester-port` exits 4"
|
||||
},
|
||||
{
|
||||
"file": "packages/webui/README.md",
|
||||
"line": 130,
|
||||
"text": "`--tester-port` that another installed Console unit in the unit directory"
|
||||
},
|
||||
{
|
||||
"file": "packages/webui/README.md",
|
||||
"line": 144,
|
||||
"text": "`serve --sso [--send] [--tester-port N]` makes the Console an OpenID Connect"
|
||||
},
|
||||
{
|
||||
"file": "packages/webui/README.md",
|
||||
"line": 176,
|
||||
"text": "- With `--tester-port`, the tester listener refuses any request carrying an"
|
||||
},
|
||||
{
|
||||
"file": "packages/webui/README.md",
|
||||
"line": 1001,
|
||||
"text": "There is no tester TCP listener. `--tester-port` is retired for this copy."
|
||||
},
|
||||
{
|
||||
"file": "packages/webui/tests/tester-cli.test.mjs",
|
||||
"line": 25,
|
||||
"text": " for (const flags of [['--tester-port', '7332'], ['--port', '7444', '--tester-port', '7444'], ['--tester-port', '7444', '--port', '7444'], ...['1023', '65536', '1.5', '-1', 'nope'].map(p => ['--tester-port', p])]) {"
|
||||
},
|
||||
{
|
||||
"file": "packages/webui/tests/service.test.mjs",
|
||||
"line": 125,
|
||||
"text": " const r = await run(dir, ['render', '--tester-port', port, ...PREVIEW, '--send']);"
|
||||
},
|
||||
{
|
||||
"file": "packages/webui/tests/service.test.mjs",
|
||||
"line": 127,
|
||||
"text": " assert.match(execStart(r.stdout), new RegExp(` --tester-port ${port}( |$)`));"
|
||||
},
|
||||
{
|
||||
"file": "packages/webui/tests/service.test.mjs",
|
||||
"line": 129,
|
||||
"text": " assert.ok(execStart(r.stdout).endsWith(` ${PREVIEW_FLAGS} --send --tester-port ${port}`));"
|
||||
},
|
||||
{
|
||||
"file": "packages/webui/tests/service.test.mjs",
|
||||
"line": 136,
|
||||
"text": " const r = await run(dir, ['render', '--port', main, '--tester-port', '7332']);"
|
||||
},
|
||||
{
|
||||
"file": "packages/webui/tests/service.test.mjs",
|
||||
"line": 150,
|
||||
"text": " ['--tester-port', ''], ['--tester-port', '1023'], ['--tester-port', '65536'],"
|
||||
},
|
||||
{
|
||||
"file": "packages/webui/tests/service.test.mjs",
|
||||
"line": 151,
|
||||
"text": " ['--tester-port', '-1'], ['--tester-port', '3.5'], ['--tester-port', '1e4'],"
|
||||
},
|
||||
{
|
||||
"file": "packages/webui/tests/service.test.mjs",
|
||||
"line": 152,
|
||||
"text": " ['--tester-port', 'abc'], ['--tester-port', '7333 '], ['--tester-port', '7333\\n'],"
|
||||
},
|
||||
{
|
||||
"file": "packages/webui/tests/service.test.mjs",
|
||||
"line": 153,
|
||||
"text": " ['--port', '7444', '--tester-port', '7444'],"
|
||||
},
|
||||
{
|
||||
"file": "packages/webui/tests/service.test.mjs",
|
||||
"line": 154,
|
||||
"text": " ['--tester-port', '7444', '--port', '7444'],"
|
||||
},
|
||||
{
|
||||
"file": "packages/webui/tests/service.test.mjs",
|
||||
"line": 164,
|
||||
"text": " assert.equal((await run(dir, ['render', '--tester-port'])).status, 4);"
|
||||
},
|
||||
{
|
||||
"file": "packages/webui/tests/service.test.mjs",
|
||||
"line": 172,
|
||||
"text": " const six = await run(dir, ['render', '--tester-port', '007333']);"
|
||||
},
|
||||
{
|
||||
"file": "packages/webui/tests/service.test.mjs",
|
||||
"line": 175,
|
||||
"text": " assert.equal(six.stderr, 'webui-service: --tester-port must be 1024..65535, different from --port and never 7332: 007333\\n');"
|
||||
},
|
||||
{
|
||||
"file": "packages/webui/tests/service.test.mjs",
|
||||
"line": 176,
|
||||
"text": " const five = await run(dir, ['render', '--tester-port', '07333']);"
|
||||
},
|
||||
{
|
||||
"file": "packages/webui/tests/service.test.mjs",
|
||||
"line": 178,
|
||||
"text": " assert.ok(execStart(five.stdout).endsWith(' --tester-port 07333'), execStart(five.stdout));"
|
||||
},
|
||||
{
|
||||
"file": "packages/webui/tests/service.test.mjs",
|
||||
"line": 186,
|
||||
"text": " const installed = await run(dir, ['install', ...INSTALL, '--dir', unitDir, '--no-reload', '--port', String(port), '--tester-port', '1024', ...PREVIEW, '--send'], bin);"
|
||||
},
|
||||
{
|
||||
"file": "packages/webui/tests/service.test.mjs",
|
||||
"line": 188,
|
||||
"text": " assert.match(installed.stdout, /^serve: .* --tester-port 1024( |$)/m);"
|
||||
},
|
||||
{
|
||||
"file": "packages/webui/tests/service.test.mjs",
|
||||
"line": 189,
|
||||
"text": " assert.match(execStart(readFileSync(join(unitDir, 'mosaic-webui.service'), 'utf8')), / --tester-port 1024( |$)/);"
|
||||
},
|
||||
{
|
||||
"file": "packages/webui/tests/service.test.mjs",
|
||||
"line": 199,
|
||||
"text": " const refused = await run(dir, [verb, '--dir', unitDir, '--tester-port', '7333'], bin);"
|
||||
},
|
||||
{
|
||||
"file": "packages/webui/tests/service.test.mjs",
|
||||
"line": 799,
|
||||
"text": " const r = await run(dir, ['install', ...INSTALL, '--dir', unitDir, '--no-reload', '--port', String(port), ...PREVIEW, '--send', '--tester-port', '1024', '--proof-header', 'x-console-proof', '--proof-file', file], bin);"
|
||||
},
|
||||
{
|
||||
"file": "packages/webui/tests/service.test.mjs",
|
||||
"line": 813,
|
||||
"text": " const both=await run(dir,['render','--tester-socket','--tester-port','7333']);"
|
||||
},
|
||||
{
|
||||
"file": "packages/webui/src/cli.mjs",
|
||||
"line": 30,
|
||||
"text": " if (flag === '--tester-port') throw new Error('--tester-port retired; activate explicitly with --tester-socket');"
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -1,7 +0,0 @@
|
||||
# Row253 build record
|
||||
|
||||
2026-10-21 design stage. Read brief Static check and Gate before starting. Busy check was CLEAR; claimant gander-253-start recorded rev2995. Branch gander/row253 starts from origin/refactor c3d88840c, after196 landed7247d80c7. Plain linked node_modules retained.
|
||||
|
||||
Only DESIGN.md and this record/inventory are written. No product code, tests, host config, units or slot files changed. BASE-PORT-INVENTORY.json records the initial source hits; it is not a passing final static check. The final check must classify every remaining hit after implementation.
|
||||
|
||||
Design r1 proposes configured dataRoot resolution as the target user, socket metadata plus an isolated system-Python SO_PEERCRED observation, unchanged hardening, P8 migration and honest unnamed P10 same-uid evidence. Duckworth approval is required before implementation. No test slot requested until the final static check passes; every single/pattern run also needs the slot under sage-2142.
|
||||
@@ -1,248 +0,0 @@
|
||||
# Row 253: private tester socket in the host scripts
|
||||
|
||||
Gander, 2026-10-21. F27, #1758. Base c3d88840c, after row196 landing
|
||||
7247d80c7. Brief: docs/plans/2026-10-21_tester-socket-scripts.md at
|
||||
0cdead66c. Reviewer Duckworth; gate owner Sage. Status: proposed, no product
|
||||
code or tests changed. Claim gander-253-start is queue rev2995.
|
||||
|
||||
## Outcome and scope
|
||||
|
||||
The factory installer renders a bare --tester-socket flag instead of a TCP
|
||||
port. Case1 acceptance consumes that saved form and examines the private
|
||||
listener without claiming that a private pathname defeats hostile same-uid
|
||||
processes. The library profile still has no tester. No .53 or .54 host may
|
||||
take a copy carrying196 before253 lands, per mos-1198.
|
||||
|
||||
Change scripts/case2-unit.sh, scripts/case1-accept.sh and their two existing
|
||||
CLI test files. Their comments/usage and fixture docs move with the code.
|
||||
Do not edit the deliberate legacy paths named in the brief. No runtime bus,
|
||||
Console, role, grant, control-board, dependency or systemd-template change.
|
||||
No live installer or acceptance run, provider, home/config, unit or host access.
|
||||
|
||||
## Choices
|
||||
|
||||
1. Recommended: resolve the configured dataRoot as the stack user, preserve
|
||||
hardening, check the final pathname's metadata and use SO_PEERCRED on a
|
||||
connection to identify its listener. This supports custom roots within the
|
||||
unit's existing writable home and matches196's kernel-peer approach.
|
||||
2. Assume <home>/.mosaic-dev and inspect a pathname in /proc/net/unix. This
|
||||
misses a custom config and is not a reliable final-path ownership check:
|
||||
196 binds a temporary name and renames it. A socket's filesystem inode also
|
||||
must not be confused with its kernel socket inode. Do not use this option.
|
||||
3. Add a TCP relay, relax hardening or give acceptance a configurable probe
|
||||
executable. All widen the surface or trust inputs and are outside this row.
|
||||
|
||||
There is no second bus principal verifier. The acceptance probe observes an
|
||||
OS endpoint; it grants no capability and sends no HTTP or bus request.
|
||||
|
||||
## Installer arguments and preflight
|
||||
|
||||
Factory keeps required --port (1..1023) and --business; tester remains optional
|
||||
for the installer. --tester-socket is a single marker, takes no value and keeps
|
||||
its position in the rendered flags. The existing duplicate-flag check applies.
|
||||
A following stray value is an unknown flag. --tester-port always refuses in
|
||||
serve arguments, for both profiles, before unit writes or systemctl actions:
|
||||
|
||||
case2-unit: case2-unit.sh retires tester TCP; use --tester-socket
|
||||
|
||||
Library rejects --tester-socket with an explicit library-profile refusal. Its
|
||||
other flags, proof-file checks and install behavior are unchanged. No legacy
|
||||
conversion or fallback to TCP is introduced in this installer.
|
||||
|
||||
When the factory socket marker is present, a small inline metadata query runs
|
||||
the selected copy's config loader under the target uid with sudo -u USER -H,
|
||||
env -i, explicit HOME and the same pinned-node-first PATH used by the unit.
|
||||
Root never imports user-writable copy code as root. It invokes the previously
|
||||
validated --node path after dropping uid, with the copy module path as a
|
||||
separate argument. This resolves the default instance just as the rendered
|
||||
unit does; no MOSAIC_CONFIG or named-instance override is inherited.
|
||||
|
||||
The query returns only dataRoot and whether that copy's Console carries the
|
||||
MOSAIC_TESTER_SOCKET_V1 marker. It prints no config values, credentials or child
|
||||
diagnostics. Bound it to five seconds and 4096 output bytes; reject errors,
|
||||
extra output/keys, malformed results, missing config and unsupported targets.
|
||||
No root process opens a config or credential under the user's home. Existing
|
||||
root metadata checks remain root metadata checks. Both script headers explain
|
||||
the new, explicitly unprivileged config query.
|
||||
|
||||
Before any unit writes, validate the socket location:
|
||||
|
||||
- dataRoot is an absolute normalized plain path, below the declared home,
|
||||
with no symlink in its existing path. Never expand the unit's writable scope.
|
||||
- Neither home nor dataRoot is under /home, /root, /run/user, /tmp or /var/tmp.
|
||||
These roots conflict with the existing ProtectHome/PrivateTmp contract.
|
||||
- <dataRoot>/console/tester.sock is at most 107 ASCII bytes, matching196.
|
||||
- A missing console parent is allowed; runtime creates it. An existing parent
|
||||
must be a real directory, not a symlink, owned by the target uid with no
|
||||
group/other permissions. A foreign owner, non-directory or unsafe mode refuses.
|
||||
- Do not create/chmod the parent or inspect/delete an existing tester entry in
|
||||
the installer. A running Console may own it during a re-pin. Runtime196 owns
|
||||
binding and cleanup. Reinstall still does not restart running units.
|
||||
|
||||
The dataRoot query and all refusal families get fake-only tests. A failed
|
||||
preflight leaves both units and the systemctl log unchanged.
|
||||
|
||||
## How the rendered unit reaches the socket
|
||||
|
||||
The unit still has User/Group for the stack account, ProtectSystem=strict,
|
||||
ReadWritePaths=<home>, ProtectHome=yes and PrivateTmp=yes, in the same order.
|
||||
Its ExecStart contains --tester-socket, with no pathname argument. The Console
|
||||
loads dataRoot and derives console/tester.sock itself. Case1/2's /srv/mosaic
|
||||
home is outside ProtectHome's protected hierarchies; the allowed dataRoot is
|
||||
inside the existing writable home, and the socket is outside private /tmp.
|
||||
No extra capability or writable directory is added. Systemd's documented
|
||||
namespace rules motivate the location refusals, rather than a hardening change.
|
||||
[systemd.exec](https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html)
|
||||
|
||||
A mutable same-uid config can change between preflight and start. The unit's
|
||||
writable boundary is still home; runtime's own config/socket checks still
|
||||
refuse unsafe state. This row does not promise an immutable same-uid config.
|
||||
The host window must verify the rendered unit actually starts under its
|
||||
namespace; scratch tests inspect its directives, not a real systemd namespace.
|
||||
|
||||
## Acceptance arguments and endpoint observation
|
||||
|
||||
The saved args must contain one --tester-socket and the numeric --port.
|
||||
Reject a missing/duplicate marker, a marker with an old numeric value, and
|
||||
--tester-port with the same migration wording naming case1-accept.sh. Preserve
|
||||
all existing pre-- argument validation and the default-instance contract.
|
||||
Malformed saved inputs still refuse with exit2 before functional checks.
|
||||
|
||||
Acceptance resolves the actual configured tester dataRoot with the same
|
||||
unprivileged, bounded query. It does not silently use the default path. An
|
||||
unreadable/invalid config or a root outside the unit's allowed home refuses
|
||||
before the functional talk. The old DATA_ROOT used by F11 remains unchanged;
|
||||
generalizing that separate Discord check is outside this row.
|
||||
|
||||
P10 independently requires the Console's systemd MainPID to be positive and
|
||||
stable, and its four /proc uid fields to be the stack uid. Check the private
|
||||
parent's type, owner and mode, and the final entry's non-symlink socket type,
|
||||
owner and exact 0600 mode. Snapshot parent/socket dev+ino and metadata before
|
||||
and after the peer probe; a replacement or MainPID change fails observation.
|
||||
The port floor must still be numeric and above the privileged main Console
|
||||
port, retaining that existing part of the observation.
|
||||
|
||||
The bounded probe runs as the stack user with an empty inherited environment,
|
||||
the fixed system /usr/bin/python3 resolved to a root-owned ELF, safe root-owned
|
||||
ancestors, and -I -S. This is the system Python dependency already required by
|
||||
196; never use PATH python, a home shim or a configurable helper. Unsafe/missing
|
||||
Python is a failed P10 observation, not a fallback. Resolve/check the system
|
||||
entry and target using metadata and the ELF header; do not run copy Python code
|
||||
as root. Test seams emulate these root facts and the system executable.
|
||||
|
||||
The probe opens AF_UNIX/SOCK_STREAM, uses a one-second connect timeout, reads
|
||||
SO_PEERCRED and closes. An outer three-second process-group bound applies. It
|
||||
returns only pid/uid/gid, with exact structure, bounded output and numeric
|
||||
validation. pid must equal MainPID and uid the stack uid; gid is validated but
|
||||
not an identity grant. No application bytes, cookies, credentials or proof
|
||||
envelope are sent. Linux supplies the peer credentials for the connected
|
||||
stream, so the check does not depend on the temporary bind pathname.
|
||||
[unix(7), SO_PEERCRED](https://man7.org/linux/man-pages/man7/unix.7.html)
|
||||
|
||||
This is a snapshot. Hostile same-uid processes can alter same-uid state or
|
||||
interfere with the unprivileged probe. Root, ptrace and later pathname changes
|
||||
are not defeated here. The probe does not prove another uid is denied; that
|
||||
remains a host-window observation, not a fake test claim.
|
||||
|
||||
## P8 and P10 outcome lines
|
||||
|
||||
P8 must change with removal of TESTER_PORT. It checks the main Console port is
|
||||
loopback-only and held only by MainPID, and that nothing listens on TCP7331 or
|
||||
the retired TCP7333. Socket ownership belongs to P10. Its healthy line is:
|
||||
|
||||
P8 lan-listeners closed <port> is on 127.0.0.1 only by MainPID <pid>; no TCP listener on 7331 or 7333; tester uses <socket>
|
||||
|
||||
An unexpected listener, missing main listener or wrong owner produces P8
|
||||
lan-listeners unnamed with the observed listener summaries, as today.
|
||||
|
||||
Do not reuse accepted mos-1101 for a new Unix-socket claim: that ruling named a
|
||||
TCP-port condition. Proposed safe default pending any new Mos classification:
|
||||
|
||||
P10 tester-socket-squat unnamed boundary=observed path=<socket> parent=0700 owner=<uid> socket=0600 peer_pid=<pid> peer_uid=<uid> floor=<floor> port=<port>; hostile same-uid substitution remains
|
||||
|
||||
Any missing/unsafe metadata, wrong peer, unsafe interpreter, malformed/timeout
|
||||
probe, floor miss or changed snapshot produces one P10 line instead:
|
||||
|
||||
P10 tester-socket-squat unnamed boundary=failed reason=<bounded-code> path=<socket> MainPID=<pid>; hostile same-uid substitution remains
|
||||
|
||||
Healthy observation does not mark the same-uid squat path closed or invent an
|
||||
accepted ruling. P checks still never change exit status. Tests pin the reason
|
||||
and observed/failed distinction, so validation cannot disappear behind an
|
||||
always-unnamed mark. Sage/Mos may supply a new classification at design review;
|
||||
it must be explicit before changing this proposed mark. No Jason question is
|
||||
needed merely to retain unnamed evidence.
|
||||
|
||||
## Evidence and planned checks
|
||||
|
||||
Keep the existing scratch fixtures, fake account database/systemctl/curl/ss/
|
||||
sudo/stat and fake interpreter. Add copy config/marker fixtures and probe
|
||||
metadata under those same roots. No test connects to a live socket or runs the
|
||||
real host scripts without their existing seams. Fixture fakes verify the
|
||||
unprivileged command argv; no test claims a real uid drop or namespace.
|
||||
The fake system interpreter executes the actual probe payload against a fake
|
||||
Python socket API, checking AF_UNIX/SOCK_STREAM, timeout, connect, getsockopt
|
||||
arguments and returned peer bytes. This catches errors in the inline probe
|
||||
without opening an OS listener. The metadata query is tested with nonzero
|
||||
status plus valid-looking output as well as malformed output, so removing its
|
||||
status refusal cannot hide behind a later parse error.
|
||||
|
||||
| Checks | Required observations |
|
||||
|---|---|
|
||||
| T1 factory render | Bare marker exactly once, argument order retained, no TCP flag, hardening unchanged; duplicate/stray value refuses |
|
||||
| T2 profile/migration | Both profiles refuse retired TCP; library refuses socket; all refuse before writes/start |
|
||||
| T3 config/target | Invalid/missing/noisy/timed-out metadata and unmarked target refuse; query uses target uid and clean environment |
|
||||
| T4 location | Default and custom in-home roots work; outside-home, protected/private hierarchies, symlinks and >107-byte pathname refuse |
|
||||
| T5 parent | Missing parent allowed; file/symlink/foreign owner/group-other mode refuse without mutation or systemctl calls |
|
||||
| T6 saved args | Required socket marker; missing/duplicate/stray value and retired TCP refuse exit2 before talk |
|
||||
| T7 P8 | Main-only loopback succeeds; LAN/wrong owner/7331 or7333 listener gives unnamed |
|
||||
| T8 P10 | Exact metadata, stable MainPID and matching peer produce boundary=observed; custom configured root used |
|
||||
| T9 failed P10 | Parent/socket faults, wrong PID/uid, malformed/timeout probe, unsafe Python, bad floor and changed snapshot each give failed reason |
|
||||
| T10 preserved behavior | Functional checks, their exit semantics, library behavior and all other P paths retained |
|
||||
|
||||
Planned checks to kill, one target change at a time in isolated snapshots:
|
||||
|
||||
| IDs | Removed requirement |
|
||||
|---|---|
|
||||
| M1-M3 | Installer TCP refusal, library socket refusal, duplicate socket refusal |
|
||||
| M4-M5 | Config-query failure refusal, unsupported-target refusal |
|
||||
| M6-M8 | Home containment, protected/private path refusal,107-byte limit |
|
||||
| M9-M11 | Existing parent type/symlink, uid, mode checks |
|
||||
| M12-M15 | Acceptance TCP refusal, required marker, duplicate/stray marker rejection, config-query refusal |
|
||||
| M16 | P8 retired TCP7333 check |
|
||||
| M17-M18 | P10 parent and final socket metadata checks |
|
||||
| M19-M21 | Peer PID, peer uid, malformed/timeout probe refusal |
|
||||
| M22-M23 | Safe fixed system interpreter, stable metadata/MainPID snapshot |
|
||||
| M24-M25 | Target-uid invocation in installer and acceptance metadata/probe paths |
|
||||
| M26 | Privileged main-port floor observation |
|
||||
| M27 | Probe returns its own PID rather than the connected peer's credentials |
|
||||
|
||||
Before execution, give every definition one unique source target and a named
|
||||
killer test. Preserve raw logs, base times, syntax preflight and byte-identical
|
||||
SHA/Git restoration. A timeout counts only under Sage's explicit rules and
|
||||
must kill the process group. Refusal variants in T1-T9 must not be merely
|
||||
assertions of a generic nonzero exit.
|
||||
|
||||
## Static inventory and gate
|
||||
|
||||
After implementation, enumerate every --tester-port hit in scripts/packages
|
||||
in BUILD.md and a machine-readable file. The only permitted hits are the brief's
|
||||
deliberate legacy producers/parsers/tests and this row's explicit refusals and
|
||||
negative fixtures. Inspect arguments and generated units, not just filenames.
|
||||
Readmes must describe retirement rather than produce old argv. No modification
|
||||
to webui-service, stack-release, instance, their tests/fixture, case1-hostcheck
|
||||
or tester-cli negative calls is planned. Stop and ask Sage if one is needed.
|
||||
|
||||
Then request Sage's slot. Under that grant, run CLI whole, WebUI whole, every
|
||||
shell test suite whole and all named checks above. Use an isolated candidate,
|
||||
plain linked node_modules, a short gXXX TMPDIR under /mnt/storage/scratch/tmp,
|
||||
busy &&, pipefail and tee. Single/pattern runs need the slot too, per sage-2142.
|
||||
No harness/helper/log argument may match the busy detector pattern, per
|
||||
mos-1205. Two failures end the window; report any stop to Sage/Mos before a
|
||||
retry. Return the slot with script-summed counts/timings and a leftover sweep.
|
||||
|
||||
Design approval precedes code. The manifest, immutable candidate hashes,
|
||||
static inventory and gate evidence go to Duckworth before Sage's landing.
|
||||
Queue moves use the helper, with a coordinated queue-write gap. Sage posts the
|
||||
jarvis review request after the in-review move. BUILD-LOG/session history stays
|
||||
append-only; Sage continues session registration. No host deployment is part
|
||||
of row253 acceptance.
|
||||
@@ -1,598 +0,0 @@
|
||||
# Row 235 build: machine grant row b (#436, Gitea #1741)
|
||||
|
||||
Brief: `docs/plans/2026-10-20_host-credentials.md`, "Machine grant row b: raise binding, executor,
|
||||
reconcile and revoke". Design r6 f9039682e. Built on row 234's landing c771a36f4 (sage-1775), branch
|
||||
gizmoduck/row235-b. Line numbers below were read on b0320d395, whose src files are byte-identical to the landing's.
|
||||
|
||||
## Squash onto 4ced5e63d (sage-1812, sage-1831)
|
||||
|
||||
Steps 1-6 were six local commits on c771a36f4 (gizmoduck/row235-b, tip f9fff4300). Sage named
|
||||
4ced5e63d as the base, so this branch, gizmoduck/row235-c, holds one commit on it: the diff
|
||||
c771a36f4..f9fff4300 applied with `git apply --index`. N10 is in that commit. N12 needs no change,
|
||||
because row b doesn't touch schema.sql.
|
||||
|
||||
Rows 240, 228 and 238 landed between c771a36f4 and 4ced5e63d and changed 18 paths. One of them is
|
||||
also mine:
|
||||
|
||||
- `packages/cli/README.md`. Row 228 (86249ac55) changed the session credential paragraphs at about
|
||||
lines 432 and 706. My hunk adds three lines on `hosts revoke` and `hosts sweep` at about line 1052.
|
||||
The two don't overlap, so the blob here is row 228's blob plus my three lines, with no landed line
|
||||
reverted. cli tests/host.test.mjs:855 reads this README, and run 1's cli suite covers it.
|
||||
|
||||
The other 12 paths are byte-identical to f9fff4300. The line numbers in the step notes below were read
|
||||
on the old base.
|
||||
|
||||
## Run 1 (sage-1831, sage-1833, sage-1838)
|
||||
|
||||
Run 1 on 4d4bb4af6, 07:45-07:54Z, failed: 1351 tests, 1285 pass, 66 fail. The 66 are 33 tests counted
|
||||
twice, once in the files run and once in the bus suite. The cli suite, the cli hosts test, seat
|
||||
sandbox.test and bus project-runtime.test passed. Two defects, both mine:
|
||||
|
||||
- grant-executor.test.mjs, 32 tests. setup() never made `dir/data`, and `new Store` lstats its root
|
||||
(store.mjs:137), so every test stopped at setup with ENOENT. setup() now makes it, mode 0700.
|
||||
- credential-claim.test.mjs:76 (X4), 1 test. A register after a revoke left the key in `#revoked`, so
|
||||
status() said `revoked` for a new grant's reference that has no token yet. register now clears
|
||||
`#revoked`, as unregister does. `#revoked` feeds only status(), and issue clears it as well.
|
||||
|
||||
Both fixes are amended into the one commit. The rerun covers the five bus files, the bus suite, and
|
||||
cli credentials.test.mjs and verbs.test.mjs, which read credential state strings.
|
||||
|
||||
## Run 1 rerun (sage-1842, sage-1843)
|
||||
|
||||
The rerun on ac7c45975, 08:06-08:07Z, failed: 701 tests, 695 pass, 6 fail, which are 3 grant-executor
|
||||
tests counted in both the files run and the bus suite. All three were test defects that run 1's setup
|
||||
failure had hidden. No src file changed for them:
|
||||
|
||||
- G10. The two fixture decisions were built after `before`, and grantDecision (host-fixtures.mjs)
|
||||
INSERTs one events row each, so the count read 13 for 11. The test now builds them first, asserts
|
||||
they added exactly 2 rows, and then pins the executor's 0 against that count.
|
||||
- G27. setup's t.after removes the scratch dir before a hook the test adds later runs, so the test's
|
||||
chmod hook hit ENOENT after the body had passed. The body now restores the mode in a try/finally.
|
||||
- G22. The slow run's promise had no handler until `refusesWith`, four lines on. The revoke rejected it
|
||||
first, and node failed the test on the unhandled rejection. The handler now goes on at creation.
|
||||
|
||||
The fix is one more amend of the single commit. The rerun is grant-executor.test.mjs whole plus the bus
|
||||
suite.
|
||||
|
||||
Rerun 1c on 5df4b52c5, 08:15Z, was green: 623 of 623, grant-executor 34 of 34 and the bus suite 589 of 589.
|
||||
|
||||
## Mutants B1-B37 (sage-1894, sage-1899, sage-1904)
|
||||
|
||||
Three chunks ran on 5df4b52c5, 09:22-09:37Z. Restores matched HEAD after each. 33 were killed and four
|
||||
survived. Two of the misses were mine, in the file lists:
|
||||
|
||||
- B2 and B23 listed only grant-executor, and that file never makes the raise either mutant changes.
|
||||
grant-enroll.test.mjs:227 (A2, A4) resolves a plain `credential.mint` yes and a host grant no, and
|
||||
asserts no grant events for either. mutants.py now lists grant-enroll and grant-executor for both.
|
||||
B2 then ran alone and A2 killed it. B23 runs again with this round's tests.
|
||||
|
||||
The other two survivors needed tests, and Sage ruled on all four (sage-1904):
|
||||
|
||||
- B16 drops the abort check after `verify`. The check after `step('commit')` still ends the grant
|
||||
revoked, so G23 X5's asserts held. The run then logs a commit step for a grant that never committed.
|
||||
G23 X5 now asserts that its only `grant.step` is `install`.
|
||||
- B17 adds `await null` after the commit check. Sage accepted it as equivalent. `await null` yields
|
||||
only to microtasks. Every revoke starts in a macrotask of its own (a socket request, or a test's
|
||||
call), so none can land in that gap. There is no test for it.
|
||||
- B27 makes issue's commit callback async. issue() doesn't await it, so the executor returns `applied`
|
||||
before the INSERT runs. The two differ only when the commit transaction throws, and a real store can
|
||||
throw there with a full disk, an I/O error or a busy timeout. Under the mutant that throw becomes an
|
||||
unhandled rejection after the key file is written, and the catch's undo never runs. The new G8 test
|
||||
makes the store's `run` throw SQLITE_FULL once on the host_grants INSERT. It asserts host-failed, no
|
||||
record, key file, reference or line, and the steps install, commit, failed. The store object comes
|
||||
from the test's setup, so src gains no seam.
|
||||
|
||||
These two test changes went in as a new commit on gizmoduck/row235-d (8b13d0ca0). That branch then
|
||||
moved onto row 213's landing as gizmoduck/row235-e, below. B16, B23 and B27 run there, after the touched
|
||||
test files run whole.
|
||||
|
||||
## Rebase onto 62ddc96cc (sage-1922)
|
||||
|
||||
Row 213 landed as 361ba2387, and refactor's tip is 62ddc96cc, with only docs past it. gizmoduck/row235-e
|
||||
starts at 62ddc96cc and cherry-picks 8b13d0ca0's one commit. The patch-id is unchanged (c062b73fa9f1).
|
||||
row235-c and row235-d stay as they were.
|
||||
|
||||
Between 4ced5e63d and 62ddc96cc, 361ba2387 is the only commit that touches a file of mine. The one
|
||||
drifted path is `packages/bus/src/broker.mjs`:
|
||||
|
||||
- 213 adds `CREATIVE_DEFINITIONS` to the vocabulary import at :6, and refuses `decision.raise` from a
|
||||
creative role with `decision-not-allowed` at :2176. Both hunks stay as landed.
|
||||
- My 31 removed broker lines read the same before and after the cherry-pick, so no landed line is
|
||||
reverted.
|
||||
|
||||
`packages/cli/README.md` isn't in 361ba2387. Every other path of mine is byte-identical to 8b13d0ca0.
|
||||
Line numbers in the section below were read on the row235-e working tree; earlier sections keep theirs.
|
||||
|
||||
## Creative roles get no host grant (mos-1163, sage-1905, sage-1908, sage-1916)
|
||||
|
||||
Brief blob b16e236188f6 (4364dddb0, rev 2784) requires two refusals: the writer, at the raise and at the
|
||||
step 1 recheck, and host.run at spend time, with the record kept. Webby's N2 on row 213 r4 asks whether
|
||||
a creative role can spend a decision another role raised.
|
||||
|
||||
The spend answer. Mos confirmed it read-only (mos-1164, sage-1916) on 8b13d0ca0 and 01e1fe512; the
|
||||
row235-e line follows each:
|
||||
|
||||
- Only the chief raises a host grant. `#raiseGrant` refuses `grant-chief-only` for any other
|
||||
definition: :1232 on 8b13d0ca0, :870 on 01e1fe512, :1238 here. The hosts verbs check the same at
|
||||
:1307 on 8b13d0ca0, :896 on 01e1fe512, :1313 here. `chief-of-staff` isn't in `CREATIVE_DEFINITIONS`.
|
||||
- No agent spends one. `#consumeGrant` (:697) is called for a host grant only from `#runHostGrant`
|
||||
(:902) and from the restart reconcile (:1106), which ends it interrupted. `#runHostGrant` starts from
|
||||
the resolve hook (:2881) only when `#approvedGrant` returns a grant, and that needs a close by the
|
||||
business's human, via cli, with the raise's approval choice (:691). An agent's resolve records via
|
||||
`broker`, so it starts nothing (grant-enroll A3). The public `runHostGrant` (:891) is a trusted API
|
||||
that no verb reaches.
|
||||
|
||||
So a creative role can't raise, approve or spend a host grant. The gap was a different one: the chief
|
||||
could raise a grant whose `agent` is a creative role, and the human could approve it. The only check on
|
||||
that agent was `#hostDefinition`, which refuses `host-not-declared` (:864) unless the definition's
|
||||
`credentials` names `host`. Row 213's `checkCreative` (business/src/role.mjs:143) limits a creative
|
||||
role's tools, authority and messaging, not its `credentials`, so a creative role file naming `host`
|
||||
passed both the raise and the step 1 recheck.
|
||||
|
||||
As built:
|
||||
|
||||
- Writer. `#hostDefinition` refuses `host-creative-role` (:862) before the `host-not-declared` check.
|
||||
The raise binding (:1266) and the step 1 recheck (:879) both call it, so a grant raised before its
|
||||
agent's instance moved to a creative definition ends at step 1, spent, with no remote step.
|
||||
- Spend. `#hostAccess` refuses `host-creative-role` (:714) when the agent's current definition is
|
||||
creative, before it reads the record. Both callers go through it: host.run (:2543) and the host.sudo
|
||||
raise (:2778). The record stays, because revoke still owns the cleanup (sage-1908). This goes past
|
||||
the brief's writer line in the same direction; Sage tells Mos.
|
||||
|
||||
Tests:
|
||||
|
||||
- grant-host.test.mjs:115. A `muse` role on a `research` definition that declares host. The raise
|
||||
refuses `host-creative-role` and adds no decision.
|
||||
- grant-executor.test.mjs:947. The restart moves `ops` to a creative definition that declares host,
|
||||
then a fixture grant runs. It ends `host-creative-role` at step 1, the decision is spent, and there is
|
||||
no remote request and no record. The fixture comes after the restart, because the restart's reconcile
|
||||
ends any resolved, unspent host grant as interrupted.
|
||||
- grant-executor.test.mjs:958. An applied grant, then a restart with `ops` creative, then host.run
|
||||
refuses `host-creative-role`. No remote request is added, sudo.log has no `systemctl`, and the record
|
||||
is still there.
|
||||
|
||||
The broker clones `businesses` when it's built, so a definition change needs a new Broker. The test's
|
||||
`restart()` gains a `business` parameter, default unchanged, for that.
|
||||
|
||||
Mutants: B38 removes the `#hostDefinition` line, run against grant-host and grant-executor. B39 removes
|
||||
the `#hostAccess` line, run against grant-executor.
|
||||
|
||||
## Run 2 (sage-1928)
|
||||
|
||||
Run 2 on 534f2254a, 10:12:52-10:14:51Z, was green. grant-host.test.mjs 9 of 9, grant-executor.test.mjs
|
||||
37 of 37 and grant-enroll.test.mjs 24 of 24, each run whole. grant-enroll is unchanged, but it drives the
|
||||
broker, and broker.mjs changed. Then the five mutants, all killed, with the restore matching HEAD:
|
||||
|
||||
| Id | Killed by |
|
||||
|---|---|
|
||||
| B16 | G23 (X5), the revoke as verify returns |
|
||||
| B23 | A2, A4 |
|
||||
| B27 | G8, the store fault in the commit transaction |
|
||||
| B38 | both mos-1163 tests |
|
||||
| B39 | the sage-1908 test |
|
||||
|
||||
## Mutant results, B1-B39
|
||||
|
||||
| Run | Head | Killed | Survived |
|
||||
|---|---|---|---|
|
||||
| B1-B13, 09:22Z | 5df4b52c5 | 12 | B2 (file list) |
|
||||
| B2 alone, B14-B37, 09:28-09:37Z | 5df4b52c5 | 21 | B16, B17, B23, B27 |
|
||||
| B16 B23 B27 B38 B39, 10:13Z | 534f2254a | 5 | none |
|
||||
|
||||
38 of 39 are killed. B17 is equivalent (sage-1904), for the macrotask reason in the B1-B37 section.
|
||||
B1-B37 ran on 5df4b52c5, before the move onto row 213's landing, and weren't rerun on 534f2254a.
|
||||
`--check` matches all 39 anchors once on 534f2254a.
|
||||
|
||||
## Carry list
|
||||
|
||||
- N10 (duckworth-0084, row 234 r1): `cli/src/hosts.mjs:30-31` reads `shape[verb]` off a plain object,
|
||||
so `mosaic hosts constructor` passes usage and the bus refuses it with exit 2 instead of 4. Row b adds
|
||||
`hosts revoke` and `hosts sweep` to the same table (design r6 :562, :680), so the fix goes in with
|
||||
them: `Object.hasOwn(shape, verb)` and a usage test for an `Object.prototype` name (sage-1726).
|
||||
- Untimed tables (sage-1745, row 234 r3): stack-release T46 lists hosts and host_grants as untimed
|
||||
because every write to them shares one store transaction with a `grant.*` events row. Row a writes only
|
||||
hosts. Every host_grants INSERT, UPDATE and DELETE row b adds must do the same, and BUILD.md lists each
|
||||
with its event line. A write without one is a stop to raise with Sage.
|
||||
- N12 (duckworth-0086, row 234 r3, doc-only): row 234's round 3 list of other schema hits leaves out
|
||||
`packages/cli/tests/stack-release-fixture.mjs:214` and `scripts/test-land-work.sh:254`. Both look up
|
||||
one table by name and need no change. If row b changes the schema, its grep list names them.
|
||||
|
||||
## What row a already gives row b (b0320d395)
|
||||
|
||||
- `#approvedGrant`, `#consumeGrant(business, decision, method)` and `GRANT_EVIDENCE` (broker.mjs:667-690).
|
||||
Row b calls `#consumeGrant` with `'host'`.
|
||||
- `#openGrantDecisions(business, method)` and `reconcileGrants()` (broker.mjs:823-860), which today handle
|
||||
`host-enroll` only. Row b adds the `host` method, the `grant.step` undo table (r6 X3) and the
|
||||
revoke-marker reconcile (r6 section 6, N4).
|
||||
- The resolve hook at broker.mjs:2444-2445 starts `#runEnrollment` for `host-enroll`. Row b adds the same
|
||||
start for `host`, under the same human, via cli and choice checks.
|
||||
- `host.run` already reads the store grant record and checks the Approve record (broker.mjs:691-703).
|
||||
- The raise check `grant-chief-only` (broker.mjs:870, :896). `host-grant.mjs:55` refuses every method but
|
||||
`host-enroll`, and row b opens it to `host`.
|
||||
- `Credentials` has `#inflight` with the `host-busy` claim inside `runHost` (credentials.mjs:118, :355).
|
||||
It has no `claim`, `abortClaim`, `register` or `unregister`. Row b adds those (r6 X4, X5).
|
||||
|
||||
## Plan, in build order
|
||||
|
||||
1. Raise binding (r6 R1-R4): the `grant` argument for `method: 'host'`, `host-not-declared`,
|
||||
`host-not-ready`, the 210 D6 argv rules, `rotateBy`, the rendered block and the 4096 cap, and the raise
|
||||
body hashes. Tests G1-G5, G19.
|
||||
2. `Credentials.claim`, `release`, `abortClaim`, `register`, `unregister`, with the shared reference check.
|
||||
3. The executor in `bus/src/host-grants.mjs`, steps 1-6 (r6 X2), with failure undo (X3) and the abort rule
|
||||
(X5, C1). Tests G7-G10, G15, G23, G24.
|
||||
4. Restart reconcile for `grant.step`, unspent `host` decisions, and the start sweep of `host.<id>` key
|
||||
files with no record (r6 X3, N1). Tests G11, G27, G28.
|
||||
5. `hosts.revoke` and `hosts.sweep` verbs, plus the CLI `revoke` and `sweep` with N10. Tests G12, G13,
|
||||
G26, G27.
|
||||
6. G22 end to end on one bus. Then the mutant list from r6 section 10 for row b, numbered B1 onward in
|
||||
this file, with the upsert mutant and the abort-after-commit mutant included.
|
||||
|
||||
There is no schema step. If one turns out to be needed, I stop and ask Sage to re-brief first.
|
||||
|
||||
## Step 1 notes (raise binding, read on b0320d395)
|
||||
|
||||
Where the code goes:
|
||||
|
||||
- `#raiseGrant` (broker.mjs:866-885) runs the checks and keyscan for `host-enroll` today, and every raise
|
||||
with `grant` reaches it (:1738-1739). Row b branches on `a.grant?.method`. `host` takes no keyscan, so
|
||||
its checks can all run inside the one raise transaction, as R4 asks.
|
||||
- `enrollCheck` (host-grant.mjs:50-69) refuses every method but `host-enroll` (:55). Row b adds a sibling
|
||||
`hostGrantCheck` for the R4 shape `{method, agent, host, commands, rotateBy}` and keeps `enrollCheck`
|
||||
as it is, so the 234 tests don't move.
|
||||
- The raise body is at broker.mjs:2270, :2345-2353 and :2391. `enroll` becomes a generic `grant`
|
||||
binding. The question block for `host` follows the `host.sudo` block (:2337-2341): agent, host id,
|
||||
address, user, sudo, each prefix JSON-quoted, rotate date, and new key or changed commands. The
|
||||
4096 cap comes from `string(question)` (:2354).
|
||||
- The argv rules come from `checkCommands` (business/src/hosts.mjs:67-87): no wildcard, no empty prefix,
|
||||
no glob characters, a bare name or an absolute path, and `refusedCommand` for shells and runners. It
|
||||
throws `refuse(...)` with a message, so the bus maps any throw to `invalid-request`, as `enrollCheck`
|
||||
maps `checkAddress` (host-grant.mjs:57-61).
|
||||
- `host-not-declared`: the agent's definition must list `{"service": "host"}`. business.mjs:126-129 reads
|
||||
`definition.credentials` and filters out `HOST_SERVICE` (vocabulary.mjs:113). The bus needs the
|
||||
definition's service list. Read how the running business exposes the definition before choosing.
|
||||
- Both lookups are answered. `loadBusiness` returns `definitions`, each role file's validated document
|
||||
(business/src/business.mjs:114-124, :159, returned at :267). `busBusiness` clones the whole business
|
||||
(bus/src/business.mjs:7), so the broker has `b.definitions`. `#definitions` already reads it
|
||||
(broker.mjs:1027-1029), and the comment there says the broker doesn't read `roles/` (sage-0590).
|
||||
- `host-not-declared` checks `b.definitions[b.roles[agent].definition].credentials` for
|
||||
`{service: 'host'}`. role.mjs:118 normalizes a host entry to exactly that.
|
||||
- Deviation from R4: `definitionSha256` is sha256 over `canonicalJson` of that validated definition,
|
||||
not over the file's bytes. The broker doesn't read `roles/`. A whitespace-only edit to the file no
|
||||
longer voids an approval, but any change to a field the loader keeps still does. The bus sees a
|
||||
definition change only after a business reload or restart, the same as every other role field.
|
||||
This goes in the round 1 note.
|
||||
|
||||
Assumption, accepted for round 1 by Sage (sage-1782), for Duckworth to check in review: design R4 says `rotateBy` is "a date inside 210's rotation window", but 210
|
||||
defines no window in code. It checks only that the value is a real calendar day (bus
|
||||
credentials.mjs:16-20, issue at :245). The business load calls a past `rotateBy` a problem
|
||||
(business/src/credentials.mjs:114). So the raise takes a real day strictly after today, UTC, and refuses
|
||||
`invalid-request` otherwise. There is no upper bound, because no requirement states one and 210
|
||||
checks none.
|
||||
|
||||
## Step 1 as built (not run yet; no slot)
|
||||
|
||||
- `hostGrantCheck(grant, today)` in host-grant.mjs takes exactly `method`, `agent`, `host`, `commands` and
|
||||
`rotateBy`. `agent` must match ID_PATTERN and `host` HOST_ID. `commands` goes through `checkCommands`,
|
||||
and any throw becomes `invalid-request`. `rotateBy` must pass 210's `day` (now exported from bus
|
||||
credentials.mjs) and be later than the bus clock's UTC day.
|
||||
- `#raiseGrant` branches on `a.grant?.method === 'host'` after the chief check and before `enrollCheck`.
|
||||
So a host-enroll shape with `method: 'host'` still refuses `invalid-request`, and the 234 G1 list holds.
|
||||
- `#hostGrantBinding` runs inside the raise transaction. It refuses `unknown-role` for an agent that
|
||||
isn't a role instance (the code bindLaunch uses, broker.mjs:522). It refuses `host-not-declared`, and
|
||||
`host-unknown` for a host with no record, as `#hostAccess` does. A record in `pending-install` refuses
|
||||
`host-not-ready`. R4 names only `host-not-ready`. I picked `host-unknown` for a missing record so
|
||||
"not enrolled" and "enrolled but not checked" stay apart.
|
||||
- `commandsSha256` is sha256 over `JSON.stringify(commands)`. For arrays of strings this equals
|
||||
canonicalJson, and step 3's executor recomputes it the same way.
|
||||
- `#dispatch` takes `binding = {body, block}` in place of `enroll`. The enrollment block moved into
|
||||
`enrollBinding` at module level with its text unchanged, so the 234 G4 test reads the same question.
|
||||
- No new import in broker.mjs, so RUNNER_FILES doesn't change. host-grant.mjs now imports
|
||||
business/src/util.mjs for canonicalJson. Nothing in the sandbox loads host-grant.mjs. Before in-review
|
||||
I still run seat sandbox.test.mjs and bus project-runtime.test.mjs whole.
|
||||
- The new-key line reads host_grants (a SELECT). Step 1 writes no host_grants row.
|
||||
- Tests: bus/tests/grant-host.test.mjs, G1 (host), G2, G3, rotateBy, G19, R4/G5 body hashes, G4 block.
|
||||
The G5 tester-thread case: a thread run is always THREAD_DEFINITION, never chief-of-staff, so
|
||||
`grant-chief-only` refuses it first. The test covers the tester's own cap (`tester-refused`).
|
||||
|
||||
## Step 2 as built (not run yet)
|
||||
|
||||
- The constructor's per-reference checks moved into `#checkRef`, in the same order, and `register` calls
|
||||
it (r6 X4). `register` reads no file. A key file that a failed revoke unlink left at the path stays
|
||||
unused until the start sweep (step 4) removes it. `register` refuses `credential-reference` while the
|
||||
entry holds a live token. An entry with no token, revoked or never issued, is replaced, so a new grant
|
||||
after a revoke registers again.
|
||||
- `unregister` drops an entry with no token and clears its revoked mark. A live token refuses.
|
||||
- `claim` refuses `host-busy` when the slot is held, by a claim or a `host.run`, and returns the signal.
|
||||
It needs no reference, because the executor claims at step 1 and registers at step 5.
|
||||
`release(instance, service, signal)` frees the slot only for its own signal. I added the signal
|
||||
argument so a late release can't free a later claim.
|
||||
- `abortClaim` aborts whatever holds the slot and returns `{pending}`. An aborted claim keeps the slot
|
||||
until the executor releases it in its `finally` (X2).
|
||||
- Tests: bus/tests/credential-claim.test.mjs. The D5 `use(` allowlist is unchanged.
|
||||
|
||||
## Step 3 as built (not run yet)
|
||||
|
||||
Where the code goes. The remote steps are in host-grant.mjs (`grantKey`, `install`, `verify`, `remove`)
|
||||
and the orchestration is `#runHostGrant` in broker.mjs, next to `#runEnrollment`. BUILD.md's plan said a
|
||||
new `bus/src/host-grants.mjs`. I kept row 234's split instead: the broker holds every store write and
|
||||
host-grant.mjs holds the network and key files. A new broker import would also change what the sandbox
|
||||
must mount (RUNNER_FILES), and this way broker.mjs gains none.
|
||||
|
||||
The broker gets `hostKeys`, made by `grantKeys({credentials, storeRoot})` in host-grant.mjs. It wraps
|
||||
only `claim`, `release`, `abortClaim`, `register`, `unregister`, `issue` and `revoke`, keyed by
|
||||
(business, agent, hostId). The broker still never gets `use()`. runtime.mjs builds it and passes it in.
|
||||
`hostReference` gives the store reference, and the runtime's start load uses the same function.
|
||||
|
||||
Every host_grants write in step 3, with its event (sage-1745):
|
||||
|
||||
| Write | Where | Event in the same transaction |
|
||||
|---|---|---|
|
||||
| INSERT, a new key | the `commit` callback that `issue` calls | `grant.applied` |
|
||||
| UPDATE commands and decision, a commands change | step 5's transaction | `grant.applied` |
|
||||
|
||||
No other step 3 code writes host_grants.
|
||||
|
||||
Deviations from r6, for the round 1 note:
|
||||
|
||||
- `grant.applied` commits with the record, inside `commit`, not after `issue` at step 6. The untimed-table
|
||||
rule needs an event in the record's transaction. `grant.step commit` can't be that event, because X2
|
||||
writes it before the key file. So X3's "5 after commit" row has nothing to undo in the executor: once the
|
||||
record commits, `grant.applied` has too. What's left in `issue` after `commit` is the memory fill, which
|
||||
writes no file and no store row. The executor sets `committed` after the transaction returns and from
|
||||
then ignores an abort (C1). The restart reconcile (step 4) keeps the commit row, because a crash can fall
|
||||
between the key file write and `commit`.
|
||||
- Event bodies name the decision as `grantDecision`, as row 234's enrollment events do. The consume record
|
||||
is the only grant body with `decision`, so `#spent` counts it and nothing else.
|
||||
- For a commands change, `grant.applied` has `fingerprint: null`. The executor holds no key on that path.
|
||||
The record's `rotate_by` stays. X2 names only commands and the decision id.
|
||||
- The keygen dir goes as soon as `grantKey` has read the key back into memory, not in step 5's `finally`.
|
||||
- Step 4 runs `true` as the remote command as is, not through the sudo argv, since a user with no sudo
|
||||
must pass it too.
|
||||
- `hostGrant()` takes `installerUser`, `mosaic-installer` by default. Only the tests change it, because
|
||||
the scratch sshd logs in only as the test's own user.
|
||||
- A commands-change UPDATE that changes no row ends `host-changed`. Only a revoke deletes a live record,
|
||||
and a revoke aborts the claim first, so this is a guard.
|
||||
|
||||
Step 1 codes, after the spend and in its transaction: `host-not-configured`, `unknown-role`,
|
||||
`host-not-declared`, `decision-mismatch` (definition, registry or commands hash), `host-unknown`,
|
||||
`host-not-ready`, `revoked` (a `grant.revoked` of the agent and host after the raise). The definition
|
||||
check moved into `#hostDefinition`, which the raise binding uses too.
|
||||
|
||||
Tests: bus/tests/grant-executor.test.mjs, a scratch sshd on 127.0.0.1 with stub `list`, `add` and
|
||||
`remove` that edit a second authorized-keys file. G7 (new key, and a commands change), G8 (install, verify,
|
||||
a failed remove, step 5 before commit, a failed step 1 check), G9, G10, G15, G23 (a revoke during install
|
||||
through `abortClaim`, a `grant.revoked` before start, and a held slot), G24's tag part. G23's held slot
|
||||
uses `claim` in place of a running `host.run`. Both hold the same `#inflight` entry. The `revoke` verb
|
||||
comes in step 5, so G23 here writes `grant.revoked` through the fixture writer and aborts through
|
||||
`abortClaim`. Step 5 adds the verb's own path.
|
||||
|
||||
## Step 4 as built (not run yet)
|
||||
|
||||
The restart reconcile has three parts, in start order:
|
||||
|
||||
1. `sweepHostKeys` (host-grant.mjs), in runtime.mjs right before `Credentials` loads. In each loaded
|
||||
business's agent store it unlinks every `host.<id>` file that has no `host_grants` record, and logs
|
||||
one `hosts: {"event":"host-key-swept",...}` line per file to stderr. A store dir that isn't private
|
||||
refuses `credential-file`, and so does the start. A name that isn't `host.` plus a valid host id
|
||||
stays, so ssh-keygen's `.pub` stays too. A business the bus didn't load is left alone.
|
||||
2. `reconcileGrants`, where row 234 already calls it, after `Credentials` loads and before the socket
|
||||
opens. For a `host` grant it ends a spent decision that has no `grant.applied` and no `grant.failed`.
|
||||
It also spends and ends an unspent one the human resolved yes. Each ends `grant.failed interrupted`,
|
||||
with the tag and a notice. When the last step is `install`, or `commit` with `previous: null`, a line
|
||||
may be left. For those, it claims the (agent, `host.<id>`) slot and queues the decision for part 3.
|
||||
3. `reconcileHosts`, which runtime.mjs calls once `serve` returns, with no await, so a start doesn't
|
||||
wait on the network. Each queued decision runs `remove <user> <tag>` through the installer, as the
|
||||
step's `user`. Then it ends `grant.failed interrupted`, with `hostLineLeft` if the remove failed or
|
||||
there's no host record, and releases the claim. The claim makes a new grant for the same agent and
|
||||
host refuse `host-busy` while the remove runs. Otherwise its new line, with the same tag, could be
|
||||
removed.
|
||||
|
||||
Deviations from r6's restart table, for the round 1 note:
|
||||
|
||||
- No record write on restart. Step 3 commits the record with `grant.applied` in one transaction. So a
|
||||
decision with no `grant.applied` has no record. For a new key, the record undo has nothing to delete.
|
||||
For a commands change, the "back to `previous`" undo has nothing to put back. What's left of the
|
||||
`commit, new key` row is the key file, written before `commit`, and the start sweep unlinks it.
|
||||
The `commit, commands change` row ends interrupted with nothing undone. G28's "a revoke before
|
||||
`grant.applied`" can't happen, because they commit together. Step 5 tests G28 as a change, then a
|
||||
revoke, then a restart.
|
||||
- The local undo of row 234's enrollments stays after `Credentials` loads, where row 234 put it. That
|
||||
undo touches only the installer key and the host record, and `Credentials` reads neither.
|
||||
- The host grant part writes no `host_grants` row, so the untimed-table rule (sage-1745) adds nothing
|
||||
here.
|
||||
|
||||
Fixture change: `hostGrantRecord` (tests/host-fixtures.mjs) writes `grant.applied` after a `grant.host`
|
||||
spend, as the executor always does. Without it, a start over a fixture record ends that record's
|
||||
decision `interrupted`. Row 234's M3 start test (host-run.test.mjs:602) does that start. No test counts
|
||||
the fixture's grant events (checked by grep across the bus tests).
|
||||
|
||||
Tests in grant-executor.test.mjs, through a `restart` helper that follows runtime.mjs's order on the
|
||||
same store:
|
||||
|
||||
- G11 after `install`: the line goes, the slot is held between the two parts, and the grant ends
|
||||
interrupted. A second start adds nothing, and `runHostGrant` refuses `decision-consumed`.
|
||||
- G11 after a new key's `commit` with the key file written: no key file, record, reference or line.
|
||||
- G11 after a change's `commit`: the record, key and line are unchanged, and the host gets no request.
|
||||
- G11 (B2) before step 1, spent and unspent: each ends interrupted with a notice, and the unspent one
|
||||
is spent exactly once.
|
||||
- A failed remote undo, and a missing host record: each ends with `hostLineLeft` and the sweep hint.
|
||||
- A finished grant: the reconcile adds nothing.
|
||||
- N1 (G27's sweep part): only files with no record in loaded businesses go, and a dir that isn't private
|
||||
refuses.
|
||||
|
||||
The revoke-marker part of the reconcile (section 6, N4) comes with the revoke verb in step 5.
|
||||
|
||||
## Step 5 as built (not run yet)
|
||||
|
||||
Two new bus verbs, `hosts.revoke` and `hosts.sweep`, join `HOSTS_VERBS`. The CLI gets
|
||||
`mosaic hosts revoke AGENT HOST --reason R` and `mosaic hosts sweep HOST`.
|
||||
|
||||
`hosts.revoke {agent, host, reason}` follows r6 section 6:
|
||||
|
||||
1. One transaction deletes the `host_grants` record and writes `grant.revoked` with a new `revoke` id
|
||||
(a UUID), the computed tag, `hostLine: "pending"`, `granted`, `reason` and `by`. With no record it
|
||||
still writes the marker, with `granted: false`, so a stale line can be named (N4). A host with no
|
||||
record refuses `host-unknown` and writes nothing.
|
||||
2. With no await between, `Credentials.revoke` drops the key from memory, aborts a `host.run` in flight
|
||||
and unlinks the file. With no reference (`credential-unknown`), an executor holds only a claim, so
|
||||
`abortClaim` stops it. Any other throw, such as an unlink that fails, comes back as `keyFile: "left"`.
|
||||
The record is already gone, so the next start's sweep unlinks that file.
|
||||
3. `remove <user> <tag>` through the installer, as the host record's user (the executor's user too).
|
||||
Then `grant.revoke.closed` with the same `revoke` id and `hostLine: "removed"`, or `hostLineLeft`.
|
||||
|
||||
Callers (G26): the human, and the assistant of the session's business, checked with `#threaded`. The
|
||||
tester can call it when `bus.tester` is exactly `true`, read again at the call. Any other agent gets
|
||||
`revoke-refused`, a code new in this row. A tester session can't hold a business whose `bus.tester`
|
||||
isn't `true`, since `bindTester` refuses `tester-off`, and the broker's businesses don't change while
|
||||
it runs. So `tester-dev-only` can't be reached from a test. The check stays for N8, in case a later
|
||||
row reloads businesses.
|
||||
|
||||
`hosts.sweep {host}` is the human's or the tester's; an agent gets `human-required`. It runs
|
||||
`list <user>`, then removes each listed tag that this business recorded for the host in a `grant.step`
|
||||
or `grant.revoked` and that no live grant holds. Another business's line and an unrecorded `mosaic-`
|
||||
line stay (G24's sweep part). It writes `grant.host.swept {host, removed, left, by}`, where `left` is
|
||||
each earlier left tag still listed and not removed. `#hostLinesLeft` now starts from the last
|
||||
`grant.host.swept` and adds only later `hostLineLeft` bodies (F4).
|
||||
|
||||
The restart reconcile adds the marker part: `reconcileGrants` collects each `grant.revoked` with
|
||||
`hostLine: "pending"`, a text `revoke` id and no `grant.revoke.closed` of that id. `reconcileHosts`
|
||||
runs step 3 for each. A `grant.revoked` with no `revoke` id, as G23's fixtures write, isn't reopened.
|
||||
`hosts.status` adds `revoking`, the tags of the open markers on the host.
|
||||
|
||||
Other changes:
|
||||
|
||||
- N10: the CLI checks the verb with `Object.hasOwn`, so `constructor`, `toString` or `__proto__` is a
|
||||
usage error.
|
||||
- `--reason` is required with `revoke` and refused with any other verb.
|
||||
- The reason goes through the broker's `string(x, 500)`, as `credentials.revoke`'s does, so a reason of
|
||||
only spaces is accepted there too.
|
||||
- Correction to step 4: the first G11 test expected `list` then `remove`. `reconcileHosts` sends only
|
||||
`remove`, so the test now expects that.
|
||||
|
||||
Residuals for the round 1 note:
|
||||
|
||||
- A new grant whose line goes in while a revoke's step 3 or a sweep runs can lose that line, if it has
|
||||
the revoked tag. Revoke holds no claim during step 3. If the remove lands after the new grant's
|
||||
verify, the grant is recorded but its line is gone, so its logins fail. I didn't add a claim, because
|
||||
a revoke must not wait on a slot.
|
||||
- The enrollment's installer tag is never in the sweep's set, so a `hostLineLeft` naming it stays
|
||||
until the human removes it by hand.
|
||||
|
||||
Tests in grant-executor.test.mjs:
|
||||
|
||||
- G12: the human's revoke of a live grant, and the bodies of both markers. A restart adds nothing.
|
||||
- G12 (N4): a revoke with no record removes the computed tag's line. Bad args refuse
|
||||
`invalid-request` and an unknown host `host-unknown`.
|
||||
- G13: a revoke during `install` aborts the executor, which ends `revoked`. A raise before a revoke
|
||||
and started after it ends `revoked` at step 1.
|
||||
- G26: who may revoke and who may sweep.
|
||||
- G27: a restart after step 1 (the sweep takes the key file, then step 3 runs), after step 2 with the
|
||||
host down (`hostLineLeft`, then a sweep clears it), and a file a revoke couldn't unlink.
|
||||
- G28: a commands change, then a revoke, then a restart.
|
||||
- G24 (B4): the sweep's tag set, a failing `list`, and the left list it records.
|
||||
|
||||
The CLI tests in packages/cli/tests/hosts.test.mjs cover revoke and sweep, the N10 usage cases and the
|
||||
`revoking` field in a status line.
|
||||
|
||||
## Step 6 as built (not run yet)
|
||||
|
||||
New tests in grant-executor.test.mjs:
|
||||
|
||||
- G22 (B1), one bus with no restart. The chief enrolls web1, the human approves, and `hosts.check`
|
||||
marks it ready. A grant of `echo` follows, then a `host.run` of `echo hi` that prints `hi`. A
|
||||
`sleep` raise refuses `command-not-granted`, and after a commands change to `echo` and `sleep` the
|
||||
next `host.run` of `sleep 30` starts. A revoke kills that run with `credential-unavailable`. The next
|
||||
call refuses `host-not-granted`.
|
||||
- G12: the local steps finish before the host step. With the host's `remove` held, the record and key
|
||||
file are already gone and `hosts.status` shows the tag under `revoking`.
|
||||
- G13: a revoke whose host `remove` fails returns `hostLineLeft`, drops the record and key, and closes
|
||||
the marker, so a restart adds nothing.
|
||||
- G23 (X5): a revoke right after the executor's spend reaches its claim and the grant ends `revoked`.
|
||||
- G23 (X5): a revoke that lands as `verify` returns ends `revoked` with no record, key file or line.
|
||||
Only the abort check after `verify` catches it.
|
||||
|
||||
The fixture gains a `sudo` stub (logs to sudo.log, then runs the command as the test's user), a
|
||||
`hold-remove` flag, `opts.enroll` (no host record and no installer key) and `opts.wrap` (changes the
|
||||
host API the broker gets). `hostGrant` gets a fake `scan` that returns the scratch sshd's host key.
|
||||
|
||||
G22 deviations, for the round 1 note:
|
||||
|
||||
- `checkAddress` (business/src/hosts.mjs:62) refuses this machine's address, so the test enrolls
|
||||
192.0.2.10 with the fake keyscan. It then points the record at the scratch sshd with an SQL update
|
||||
and adds the enrolled installer key to the sshd's authorized keys. Enrollment, check, grant, run and
|
||||
revoke all go through the real code after that.
|
||||
- r6 B1 says the next `host.run` after a revoke refuses `credential-unavailable`. Here it refuses
|
||||
`host-not-granted`, because step 1 deletes the record and `requestHost` checks the record
|
||||
(`#hostAccess`) before it reaches the key. The call in flight does refuse `credential-unavailable`.
|
||||
|
||||
### Mutants
|
||||
|
||||
`/mnt/storage/scratch/gizmo-235-out/mutants.py` holds each mutant as anchored edits. `--check` applies
|
||||
them in memory and runs no test. All 39 anchors match once. Each mutant runs its named test files.
|
||||
|
||||
From r6 section 10, as they apply to row b:
|
||||
|
||||
| Id | Mutant | Test file |
|
||||
|---|---|---|
|
||||
| B1 | drop the chief check on a host grant raise | grant-host (G1) |
|
||||
| B2 | start the executor on a `credential.mint` with no `grant` | grant-enroll (A2), grant-executor |
|
||||
| B3 | skip the `ready` check at the raise | grant-host (G19) |
|
||||
| B4 | skip the `ready` check at step 1 | grant-executor |
|
||||
| B5 | skip the definition hash compare | grant-executor (G9) |
|
||||
| B6 | drop the definition check (`host-not-declared`) | grant-host (G2), grant-executor (G9) |
|
||||
| B7 | skip the commands hash compare | grant-executor (G9) |
|
||||
| B8 | skip the host record hash compare | grant-executor (G9) |
|
||||
| B9 | write the grant record before install | grant-executor (G8) |
|
||||
| B10 | skip `remove` on a verify failure | grant-executor (G8) |
|
||||
| B11 | skip the start sweep of key files with no record | grant-executor (N1, G27) |
|
||||
| B12 | skip the reconcile's remote `remove` | grant-executor (G11) |
|
||||
| B13 | skip the `grant.step` before install | grant-executor (G11) |
|
||||
| B14 | revoke leaves the grant record | grant-executor (G12) |
|
||||
| B15 | skip `register` before `issue` | grant-executor (G7) |
|
||||
| B16 | drop the abort check after `verify`, the last one before `issue` | grant-executor (G23 X5) |
|
||||
| B17 | add an `await` between the abort check and `issue` | grant-executor |
|
||||
| B18 | revoke ignores a claim with no reference | grant-executor (G13, G23 X5) |
|
||||
| B19 | build the tag without the business | grant-executor (G24) |
|
||||
| B20 | `sweep` removes any `mosaic-` line | grant-executor (G24 B4) |
|
||||
| B21 | run revoke's host step before the local steps | grant-executor (G12) |
|
||||
| B22 | start the executor on an arbiter resolve | grant-executor (G10) |
|
||||
| B23 | start it on `no` | grant-enroll (A2, A4), grant-executor |
|
||||
| B24 | write the private key into the event body | grant-executor (G15) |
|
||||
| B25 | put an `await` between the spend and the claim | grant-executor (G23 X5) |
|
||||
| B26 | skip the start check for a resolved, unspent grant decision | grant-executor (G11 B2) |
|
||||
| B27 | make `commit` async | grant-executor (G8) |
|
||||
| B28 | route `hosts.revoke` to `Credentials.revoke` alone, as `credential-verbs.mjs` would | grant-executor (G12, G27) |
|
||||
| B29 | skip the revoke marker reconcile | grant-executor (G27) |
|
||||
|
||||
Row 235's own:
|
||||
|
||||
| Id | Mutant | Test file |
|
||||
|---|---|---|
|
||||
| B30 | skip the `grant.revoked` check at step 1 | grant-executor (G13, G23) |
|
||||
| B31 | the sweep set keeps a live grant's tag | grant-executor (G24 B4) |
|
||||
| B32 | reopen a `grant.revoked` with no revoke id | grant-executor (G27) |
|
||||
| B33 | step 3 reports `removed` when the host remove fails | grant-executor (G13, G27) |
|
||||
| B34 | any agent revokes, not just the assistant | grant-executor (G26) |
|
||||
| B35 | `hostLineLeft` ignores the last sweep | grant-executor (G24 B4, G27) |
|
||||
| B36 | a stale `release` frees a later claim | credential-claim (X5), grant-executor |
|
||||
| B37 | `register` replaces an entry with a live token | credential-claim (X4) |
|
||||
| B38 | drop the creative check in `#hostDefinition` | grant-host (mos-1163), grant-executor (mos-1163) |
|
||||
| B39 | drop the creative check in `#hostAccess` | grant-executor (sage-1908) |
|
||||
|
||||
B17 may survive. `await null` yields only to microtasks, and every revoke starts in a macrotask of its
|
||||
own (a socket request, or a test's call), so none can land in that gap. If it survives I'll report it
|
||||
as equivalent under this build, not add a test that fakes a microtask revoke.
|
||||
|
||||
Section 10 items not run as row b mutants, and why:
|
||||
|
||||
- The upsert mutant ("let the undo to `previous` insert a record") and "run past a newer
|
||||
`grant.revoked`". Row 235 has no undo to `previous`. A commands change commits the UPDATE and
|
||||
`grant.applied` in one transaction (sage-1745), so a restart after it leaves the record as it is
|
||||
(G11). The UPDATE can't meet a missing record either: step 1 reads the live record, and nothing
|
||||
awaits between there and the UPDATE. An upsert there would be equivalent.
|
||||
- "let the executor act on an abort after step 5 commits". The record and `grant.applied` commit
|
||||
together, and no abort check follows the commit, so no code path reaches the `if (committed)` guard
|
||||
with an abort. Removing the guard is equivalent. C1's case is covered by G28 with a later revoke.
|
||||
- "treat a missing `bus.tester` as dev". The tester check can't be reached from a test (step 5 notes).
|
||||
- Row a's: the keyscan compare, the writer items, the "not yet enrolled" check, the `hosts` primary key
|
||||
and `host.run` reading the business file. Row 234 ran those as A5, A6, A8, A9, A11 and A13-A19.
|
||||
@@ -1,98 +0,0 @@
|
||||
# Row 249 build notes (Gizmoduck)
|
||||
|
||||
Gitea #1751, Vikunja P19 445 under #436. Brief: docs/plans/2026-10-20_host-credentials.md, section
|
||||
"Machine grant row b follow-up: the undo can't prove the remote add has ended" (6de1ebc62). Reviewer
|
||||
Duckworth, gate owner Sage. Branch gizmoduck/row249-on-8a04, on row 248's landing 8a04f4aa4 (sage-2012).
|
||||
No file under packages/bus/src changed between 6d5545d44 and 8a04f4aa4, so the brief's src line numbers
|
||||
hold on the base. Line numbers below are on this branch.
|
||||
|
||||
## Correction to the brief
|
||||
|
||||
The brief, copying gizmoduck-0139, puts the sweep's host-unknown refusal at broker.mjs:1350. On
|
||||
6d5545d44 it is :1349. On this branch it is :1354.
|
||||
|
||||
## The change
|
||||
|
||||
`#runHostGrant` in packages/bus/src/broker.mjs:
|
||||
|
||||
- :943 adds `installed = false` next to `installing`.
|
||||
- :956 sets `installed = true` on the line after `await this.#hostGrant.install(...)`, before the
|
||||
`stop()` that follows it. An abort that lands after install returned still ends revoked, with no hint,
|
||||
because install returning means every request it sent has exited.
|
||||
- :1025, in the catch, inside `if (installing)` and after the remove: `if (!installed) extra =
|
||||
{ hostLineLeft: tag };`. The remove still runs first and its result doesn't matter. A remove that
|
||||
throws sets the same hint as before (:1021).
|
||||
|
||||
The rule keys on install not returning, not on `signal.aborted`. That covers an abort (host-run.mjs:136,
|
||||
SIGKILL to the local group), a timeout (host-run.mjs:131-134, SIGTERM, then SIGKILL after `graceMs`) and
|
||||
a dropped connection, which fails the request with no signal at all. `#hostGrantFailed` (:845) already
|
||||
adds "A line tagged X may be left on the host. Run: mosaic hosts sweep <host>" when `hostLineLeft` is
|
||||
set (:852), so the message needed no change.
|
||||
|
||||
False hints. install is one call that runs `list`, maybe `remove`, then `add` (host-grant.mjs:329-333).
|
||||
Any failure inside it now records the hint, including a `list` that exits 1 before any add was sent, and
|
||||
an abort that lands before the first ssh starts (the G23 X5 case at "a revoke right after the spend").
|
||||
The brief accepts this for an add that exits nonzero. The other cases are the same kind: the line isn't
|
||||
on the host, and a sweep that doesn't list the tag drops the hint (G24, "a left tag no longer on the
|
||||
host", broker.mjs:1358). Narrowing it would need install to report which request was in flight, which is
|
||||
a change to host-grant.mjs's API that the brief doesn't ask for.
|
||||
|
||||
## Row a's enroll
|
||||
|
||||
The race can't happen there, because enrollment sends nothing to the host. `#runEnrollment`
|
||||
(broker.mjs:772-842) writes the record, calls `this.#hostGrant.enroll(business, host)` (:800) and
|
||||
commits the fingerprint. `enroll` (host-grant.mjs:247-286) runs ssh-keygen locally and writes the
|
||||
private half to its file. It opens no ssh session. The installer line goes on the host by hand: the
|
||||
notice tells ops-01 to write it, then to run `mosaic hosts check`. The undo at :835 is `unenroll`, which
|
||||
deletes the local key file. There is no remote add to outlive a kill, and no remote undo to race with.
|
||||
|
||||
## Tests
|
||||
|
||||
packages/bus/tests/grant-executor.test.mjs:
|
||||
|
||||
- `lateAdd` (:451) is the shared tail. After the grant ends it asserts the code, `hostLineLeft` on
|
||||
grant.failed, the sweep line in the notice, and that the undo's remove was the last request. Then it
|
||||
writes `release`, so the held add writes its line and exits 0, and waits for the line in `granted`. It
|
||||
checks there's no record, `hosts.status` lists the tag in `hostLineLeft`, `hosts.remove` refuses
|
||||
host-line-left, `hosts.sweep` returns `removed: [tag]` and the line is gone, then `hosts.remove`
|
||||
succeeds.
|
||||
- :468, the abort case. `hold-add`, the human approves, the add holds, `abortClaim` aborts the
|
||||
executor's claim. Ends revoked.
|
||||
- :480, the timeout case. A 30 s wait is too long for the file, and making the timeout an option would
|
||||
add a src seam, so the test wraps `install` through `opts.wrap` instead. The wrapper passes install its
|
||||
own AbortController signal, waits for `holding`, aborts it, which SIGKILLs the local ssh group as the
|
||||
timer does, then throws as a timed-out request does. The executor's signal isn't aborted, so it ends
|
||||
host-failed. Nothing under src changes for it.
|
||||
- G8 (:283) changes. fail-list and fail-add now carry `hostLineLeft` and the sweep line. noop-add fails at
|
||||
verify, after install returned, so it keeps no hint and the old message.
|
||||
- The comment at :436 (:432 at 6d5545d44) now says `skip` makes the held add exit without writing and that a
|
||||
killed session's add can still write. G13 has no such comment.
|
||||
|
||||
Both new tests write `release`, so their held stub exits before `t.after` removes the dir. Row 248's dir
|
||||
check (:67, :72) is the backstop.
|
||||
|
||||
## Mutant
|
||||
|
||||
/mnt/storage/scratch/gizmo-235-out/mutants-249.py, on row 235's runner. C1 removes the :1025 line and
|
||||
runs grant-executor.test.mjs. Both new tests and G8 should fail under it. `--check` matches its anchor
|
||||
once.
|
||||
|
||||
## Runs
|
||||
|
||||
On Sage's grant sage-2015, at 8457af076 (7cee1a1ab plus this file), TMPDIR /mnt/storage/scratch/g249t:
|
||||
|
||||
| Run | Window | Result |
|
||||
|---|---|---|
|
||||
| grant-executor.test.mjs whole | 13:29:01-13:29:21Z | 39 of 39 pass |
|
||||
| C1 | 13:29:21-13:29:40Z | killed: both row 249 tests and G8 fail on `hostLineLeft` undefined |
|
||||
|
||||
After C1 the worktree was clean and broker.mjs matched HEAD. After the runs, no node, sshd or sh process had a
|
||||
cwd under the worktree or g249t, and no `fake/add` or `fake/remove` stub was running. The bus suite runs on
|
||||
Sage's gate.
|
||||
|
||||
## Rebase onto 8a04f4aa4 (sage-2012)
|
||||
|
||||
The first commit, 02bfd184b, sat on bc579f7a8 as gizmoduck/row249, which was never pushed. Row 248 landed
|
||||
as 8a04f4aa4, changing grant-executor.test.mjs at :54, :67 and :72. gizmoduck/row249-on-8a04 starts at
|
||||
8a04f4aa4 and cherry-picks 02bfd184b with no conflict. 248's lines stay as landed. The patch-id is the
|
||||
same on both (c33823941e61). Test line numbers moved down by one, and this file was updated for that.
|
||||
@@ -1,100 +0,0 @@
|
||||
# Row 250 build notes (Gizmoduck)
|
||||
|
||||
Vikunja #450, Mos ruling mos-1182 item 3. Brief: docs/plans/2026-10-21_k12-cohort-events.md. Reviewer
|
||||
Filbert, gate owner Sage. Branch gizmoduck/row250 from origin/refactor 3b0aef995. Line numbers below are on
|
||||
this branch unless a commit is named.
|
||||
|
||||
## Step 1
|
||||
|
||||
cbba6ff07 changes only the K12 assertion (packages/conversation/tests/cohort.test.mjs:292 on 3b0aef995).
|
||||
On failure it prints the shim's answer, with `ok` and `unavailable`, and `h.ctrl.evidence.releases`.
|
||||
|
||||
## Step 2: the cause
|
||||
|
||||
K12 reads the shim after the controller has started to release it.
|
||||
|
||||
- The force stop sets the binding `stopped` (packages/conversation/src/controller.mjs:1615). Then it pauses at
|
||||
`scope-release` (:1623) and calls `#releaseScope` (:1624).
|
||||
- `#releaseScope` calls `releaseCohort` (:1639). That sends `hello`, then `release`
|
||||
(packages/conversation/src/cohort.mjs:261-265).
|
||||
- The shim answers `release` and exits 10 ms later. It unlinks its socket first (shim.mjs:165-176). systemd
|
||||
then collects the empty scope, `engine` included.
|
||||
- K12's `forceStop` helper returns once it sees `stopped` (cohort.test.mjs:148, polling every 10 ms). The
|
||||
test then reads `engine/cgroup.freeze` (:281 on 3b0aef995) and asks the shim for `events` (:291).
|
||||
|
||||
Nothing in K12 orders those reads before the release. Unloaded, the test usually sends its `events` request
|
||||
within the 10 ms before the shim exits, so it passes. Under load the release wins. `shimRequest` then
|
||||
returns `{ ok: false, unavailable: "the shim socket is gone" }` (cohort.mjs:46), or "unreachable" or
|
||||
"closed the connection" (:62-63), and `ev.populated` is undefined. Both recorded failures fit this
|
||||
pattern:
|
||||
|
||||
- Row 197 proof 4, pair1-b: K12 failed in 339 ms on `undefined !== 0` at :292. 339 ms is far below the
|
||||
3 s `shimRequest` timeout (cohort.mjs:56), so the request didn't time out. The `cgroup.freeze` read at
|
||||
:281 passed, so the scope still existed then.
|
||||
- BUILD-LOG.md:4092, row 56's gate: "`populated` undefined with load around 12".
|
||||
|
||||
Row 50 (a9cc522a0, #1536) added the release after a proven stop. K12 is older. Its comment still says
|
||||
"the shim holds the scope", and that stopped being true in row 50. E1 (cohort.test.mjs:923-925) already
|
||||
holds `scope-release` so it can read the shim while the shim still answers. K12 never got the hold. No
|
||||
other test reads the shim after a proven stop and expects an answer. R1 expects the shim gone, R3 is an
|
||||
uncertain stop, and K15 reads before its stop.
|
||||
|
||||
The cgroup read itself has no race. The kill's `waitFor` (shim.mjs:117-126) had already read `populated 0`
|
||||
for the stop to be proven. The read is the shim's call to `events()` (shim.mjs:83-96), and it reads one
|
||||
kernel file. So the brief's allowance for a bounded retry doesn't apply, and there is none.
|
||||
|
||||
The fix goes in the test's setup, which the brief allows ("Use the shim, the cohort controller or the
|
||||
test's setup and teardown, whichever the evidence points to"). The controller's release is correct and
|
||||
specified (README "Scope release", R1). Delaying it for a reader would change row 50's behavior.
|
||||
|
||||
## Step 2: the change
|
||||
|
||||
packages/conversation/tests/cohort.test.mjs, K12:
|
||||
|
||||
- It runs with `gate()`, holds `scope-release` before the stop, and waits until the hold is reached. Then it
|
||||
does every read that needs the scope: `cgroup.freeze`, `events` and `members`.
|
||||
- After the reads it lets the release go and asserts one entry, `["force-stop", "released"]`. This is new
|
||||
coverage: K12 now also shows the forking cohort's scope released.
|
||||
- The assertions are unchanged. `populated` must be 0 and the member list must be empty. The step 1 message
|
||||
stays.
|
||||
|
||||
packages/conversation/src/shim.mjs:167-168, `release` (:167 on 3b0aef995). It answered a failed `events()` with "the engine
|
||||
cgroup is not empty", so it reported unavailable as not empty. The refusal was already safe, but the reason
|
||||
was false. Now an `events()` answer that isn't `ok` is returned as it is, with the read's own reason. Only
|
||||
`populated` 1 gives "not empty". Nothing else matched that string (grep of packages/).
|
||||
|
||||
## Tests
|
||||
|
||||
- K12 as above.
|
||||
- R13, the brief's new case, placed after R3. After a proven stop, with `scope-release` held, the test makes
|
||||
`engine/cgroup.events` mode 000. Then:
|
||||
- `events` returns `ok: false`, has no `populated`, and the reason is "engine/cgroup.events unreadable
|
||||
(EACCES)".
|
||||
- On release, the controller records one entry `["force-stop", "unavailable", <that reason>]`.
|
||||
- The unit stays active, and the shim still answers `hello`.
|
||||
|
||||
Then `close()` reuses the stop's release, so there is still one entry. The `finally` closes the
|
||||
controller again (a second close is a no-op), restores mode 444, the kernel's mode for cgroup.events,
|
||||
and releases the scope. On
|
||||
3b0aef995's shim.mjs, R13 fails on the reason, because it reads "the engine cgroup is not empty".
|
||||
- K15 already covers a stop, as opposed to a release, with `events` unavailable: the shim gone, the file
|
||||
mode 000, or `engine` missing, each ending `uncertain` with its reason.
|
||||
|
||||
## File added beyond the brief
|
||||
|
||||
packages/conversation/README.md:599 listed "R1–R3, R5–R12" for cohort.test.mjs. With R13 it now reads
|
||||
"R1–R3, R5–R13". The brief's files don't include the README. Sage added it to this row in sage-2082.
|
||||
|
||||
## Runs
|
||||
|
||||
None yet. They need Sage's slot. Sage's sage-2082 says the run is on the pushed candidate in a clean
|
||||
worktree, and that it adds the control-board suite whole, so it counts as the gate run.
|
||||
|
||||
## Round 2
|
||||
|
||||
Filbert's C1 (#1755 comment 30125): R13 never closed its in-process controller, so the controller's
|
||||
socket server (controller.mjs:548) stayed open, and `reap` only kills units and engines. Only `close()`
|
||||
closes it (:1789). R13 now calls `h.ctrl.close()` after its checks and asserts one release entry, as R2
|
||||
does. Its `finally` also closes the controller, for a failure partway through. The second close is safe:
|
||||
`server` is null by then (:1791), and `#releaseScope` returns the cached release (:1634-1648). Branch
|
||||
gizmoduck/row250-r2, on e9cfd92f8.
|
||||
@@ -1,53 +0,0 @@
|
||||
# Row 212 build notes, C2-01 packages/library (#1713, Vikunja #416)
|
||||
|
||||
## Rounds
|
||||
|
||||
- Round 1: bdf18272a on gosalyn/c2-01, base 32b54ac3b. Webby approved it in Gitea comment 29704.
|
||||
- Round 2: d3c7bbf839d9c3bf50f154b18e7e4472fbd005ed on gosalyn/c2-01-r2, rebased onto 9b5362018 after row 232 drifted three paths (sage-1714). Webby approved it at merge scope, rev 2666 against comment 29921 (webby-0052).
|
||||
- Round 3: this commit on gosalyn/c2-01-r3, one commit on the row 234 landing c771a36f4 (sage-1736, sage-1779, mos-1160). Row 234 changed scripts/mosaic, so round 3 review covers that one file.
|
||||
|
||||
## Round 2 merge
|
||||
|
||||
range-diff 32b54ac3b..bdf18272a against 9b5362018..d3c7bbf83 shows one change, the context line where upstream added `credentials` to the scripts/mosaic case line. Patch-id moved from 8f80dfa3 to 175f45c6 for that reason only. All three drifted hunks keep both sides:
|
||||
|
||||
- scripts/stack-copy.sh COPY_PATHS reads `packages/queue/src packages/library/src`. Row 232's bundle, --create, --units and instance code is unchanged.
|
||||
- scripts/mosaic runs the `library survey` exec block before the case line, and the case line keeps `credentials`.
|
||||
- packages/cli/tests/stack-copy.test.mjs adds `packages/library/src/index.mjs` to the copy file list.
|
||||
|
||||
## Round 2 singles, evidence for the 19 paths other than scripts/mosaic
|
||||
|
||||
Run on d3c7bbf83 in Sage's slot (sage-1723) from 2026-10-21T05:00:09Z to 05:11:29Z. The HEAD and a clean tree were checked first. The counts are an awk sum over the 23 logs: 481 passed, 0 failed, 0 skipped, 0 cancelled, and every file exited rc=0.
|
||||
|
||||
| Package | File | Pass |
|
||||
|---|---|---|
|
||||
| library | links | 6 |
|
||||
| library | mapping | 7 |
|
||||
| library | reader | 11 |
|
||||
| library | render | 11 |
|
||||
| library | survey | 4 |
|
||||
| cli | app | 30 |
|
||||
| cli | case2-unit | 30 |
|
||||
| cli | credentials | 5 |
|
||||
| cli | host | 42 |
|
||||
| cli | instances | 5 |
|
||||
| cli | project | 4 |
|
||||
| cli | stack-copy | 16 |
|
||||
| cli | stack-instances | 23 |
|
||||
| cli | stack-release-external | 25 |
|
||||
| cli | stack-release | 192 |
|
||||
| cli | tester-reads | 6 |
|
||||
| cli | tester-threads | 5 |
|
||||
| cli | usage | 2 |
|
||||
| queue | dispatch | 4 |
|
||||
| runs | task-cli | 9 |
|
||||
| webui | pinned-copy | 10 |
|
||||
| webui | service | 31 |
|
||||
| webui | views | 3 |
|
||||
|
||||
The file list comes from the library tests plus every test that names scripts/mosaic or stack-copy.sh, by basename and by join() path. No 64-hex pin in the tests names a merged path.
|
||||
|
||||
## Round 3 scripts/mosaic
|
||||
|
||||
The only path both row 234 and this row change is scripts/mosaic. Row 234 added `hosts` to the cli case line and changed nothing else in the file. Round 3 takes the landed blob cce1fdee4 and adds this row's six-line `library survey` block before the case line by hand, so `hosts` stays. The mode stays 100755. The other 19 paths are byte-identical to d3c7bbf83. Against d3c7bbf83 the only difference is the `hosts` context line.
|
||||
|
||||
Round 3 runs only the tests that read scripts/mosaic, in Sage's slot. Their counts go to Sage in T3 and onto #1713, since this file can't hold them and stay one commit. Those tests are library survey, cli app, case2-unit, credentials, hosts, host, instances, project, stack-copy, stack-release, stack-release-external, stack-upgrade, tester-reads, tester-threads and usage, queue dispatch, runs task-cli, webui pinned-copy, service and views, plus scripts/test-queue.sh. hosts.test.mjs is new with row 234.
|
||||
@@ -1,158 +0,0 @@
|
||||
# Row 221 build notes, C2-20 Bean and Chet persona import (#1722, Vikunja #416)
|
||||
|
||||
Brief: docs/plans/2026-10-20_case2-rows.md "C2-20", blob 16847e94ae17 (sage-1834). Claimed rev 2736.
|
||||
Rulings: sage-1836 (fence, pairing) and sage-1840 (YAML parser, handoff).
|
||||
|
||||
## Base
|
||||
|
||||
Built on Morgana's row 213 r4 tip 2b3e67e36 (origin/morgana/row213-r4), since the brief says "After:
|
||||
C2-08" and 221 exports 213's fence check. Before review it goes onto 213's landing under a new branch
|
||||
name, and its tests run again there.
|
||||
|
||||
## What changed
|
||||
|
||||
- `scripts/case2-persona-import.mjs`, new. Verbs `stage` and `install`, usage in its header.
|
||||
- `packages/cli/tests/case2-persona-import.test.mjs`, new, and `packages/cli/tests/fixtures/case2-persona-import/`,
|
||||
a fixture Hermes home plus `trace.mjs`, the read trace.
|
||||
- `packages/harness/src/bundle.mjs`: the three text rules in `readPersona` move into an exported
|
||||
`personaTextFault(text)`, which returns null or the reason, and `readPersona` calls it. Nothing it
|
||||
checks changes and the messages are byte for byte the same, so 213's creative tests hold. There is
|
||||
one copy of the rules and the import calls it (sage-1836).
|
||||
- `package.json` and `package-lock.json`: `yaml` 2.9.0 becomes an exact direct dependency (sage-1840 Q3).
|
||||
|
||||
## Rulings recorded
|
||||
|
||||
Profile to name (sage-1836, answers DESIGN.md:1322 as an implementation ruling, not a PRD change).
|
||||
Hermes at df5700ebe has no field holding a profile's own name. `profile.yaml` has only `description`
|
||||
and `description_auto` (hermes_cli/profiles.py:798-850), and `agent_name` at cli.py:3494 is skin
|
||||
branding with the default "Hermes Agent". So the human passes the pairing as `--pair default=Bean
|
||||
--pair chet=Chet`. The script checks both profile directories exist, each name is exactly Bean or Chet
|
||||
and the two differ, then prints the pairing with each SOUL.md's byte count and sha256 before it writes.
|
||||
The brief's "confirm profile to name" is met by the human supplying and confirming the pairing.
|
||||
|
||||
The persona is `<profile dir>/SOUL.md`, where Hermes loads it (agent/prompt_builder.py:1829-1855).
|
||||
The default profile's directory is the Hermes root, and others are `profiles/<name>`, with names
|
||||
checked against hermes_cli/profiles.py:37. A missing or blank SOUL.md is "no persona", as in Hermes.
|
||||
The file is staged byte for byte. Hermes strips it and runs its own scan before use, but this import
|
||||
copies her text unchanged.
|
||||
|
||||
Handoff between the steps (sage-1840 Q4). `stage` writes 0600 files owned by whoever ran it. `install`
|
||||
runs as `<user>` and refuses a staging file that isn't its own or has a group or other bit. The script
|
||||
changes no owner. It prints the root step, `chown -R <user>: <staging>`, as an instruction. **Item for
|
||||
Jason's go:** who runs stage on `<host>`, and the root chown between the two steps.
|
||||
|
||||
## Word list
|
||||
|
||||
69 tool names: every literal `name="..."` in a `registry.register(` call under hermes-agent's
|
||||
`tools/*.py` at df5700ebe, plus Hermes and Discord. Two more registrations, in tools/mcp_tool.py:4997
|
||||
and :5034, and plugin tools (hermes_cli/plugins.py:430) get their names at run time, so a fixed list
|
||||
can't hold them. Matching is whole word, any case. `memory`, `terminal`, `todo`, `process`, `patch` and
|
||||
`clarify` are ordinary words, so a persona line using them in prose counts, and the count leans high.
|
||||
It is a hint for Jason and changes nothing in the import.
|
||||
|
||||
## Channel prompts
|
||||
|
||||
Hermes takes a platform's block from `<platform>` at the top level of config.yaml, else from
|
||||
`platforms.<platform>` or `gateway.platforms.<platform>` (gateway/config.py:1159-1178), and its
|
||||
prompts from `channel_prompts` (:1233). The script lists all three by platform, channel id and byte
|
||||
count, and says "not text" for a value that isn't a string. The dry run doesn't read config.yaml.
|
||||
|
||||
yaml parses with `intAsBigInt`, so an unquoted 18 or 19 digit Discord id prints exactly instead of
|
||||
rounding as a double, and with `uniqueKeys: false`, so a repeated key keeps the last value as Python's
|
||||
`safe_load` does. `logLevel: "silent"` stops yaml's warnings, which quote config text. yaml reads YAML
|
||||
1.2 and Hermes's PyYAML reads 1.1. They differ on scalars such as `yes` and `0123`, but neither
|
||||
changes a channel prompt's key or its byte count for a quoted or decimal id.
|
||||
|
||||
## yaml dependency (sage-1840 Q3)
|
||||
|
||||
Made with `npm install --save-exact [email protected] --package-lock-only --ignore-scripts` at the worktree
|
||||
root. `git config core.hooksPath` was unset before and after. npm moved nothing else:
|
||||
|
||||
```
|
||||
package-lock.json | 3 ++-
|
||||
package.json | 3 ++-
|
||||
2 files changed, 4 insertions(+), 2 deletions(-)
|
||||
```
|
||||
|
||||
```
|
||||
@@ -10,7 +10,8 @@
|
||||
"license": "UNLICENSED",
|
||||
"dependencies": {
|
||||
"@earendil-works/pi-coding-agent": "0.85.1",
|
||||
- "oauth4webapi": "3.8.8"
|
||||
+ "oauth4webapi": "3.8.8",
|
||||
+ "yaml": "2.9.0"
|
||||
}
|
||||
},
|
||||
```
|
||||
|
||||
node_modules/yaml is 2.9.0, from the pinned pi packages (package-lock.json:502 and :556).
|
||||
|
||||
Where it runs. `scripts/case2-persona-import.mjs` isn't in stack-copy's COPY_PATHS, and a copy carries
|
||||
no node_modules of its own beyond its `npm ci`. So the script runs from a checkout at the reviewed
|
||||
commit after `npm ci`, where `import "yaml"` resolves through the root package.json and
|
||||
`../packages/harness/src/bundle.mjs` is beside it. Whoever runs `stage` needs read access to that
|
||||
checkout and to her Hermes home, which is part of the item for Jason's go above.
|
||||
|
||||
## Tests
|
||||
|
||||
Round 1, on 213 r4 2b3e67e36, slot grants sage-1851 and sage-1863. One `node --test` per file.
|
||||
|
||||
Run 1 started at 08:19:44Z. A 600 s tool timeout on my wrapper killed it at about 08:29:45Z, inside
|
||||
stack-release-external, after stack-release took 494 s. One test in this row's file failed in run 1.
|
||||
Its filter `includes("per-channel prompt")` also matched the "profile chet: no per-channel prompts"
|
||||
line that the next assert checks on its own. That was a test defect, and the script's output was
|
||||
right. The filter is now `includes(": per-channel prompt ")`. The kill orphaned one fixture
|
||||
holder.cjs, which I killed, and I removed its tmp dirs. Sage counts this as one failure under mos-0823.
|
||||
|
||||
The rerun, 08:31:11Z to 08:33:31Z, covered this row's file, stack-release-external, stack-upgrade
|
||||
and the fixture dry run. The 15 files that run 1 finished green stand on code the fix didn't touch. Their counts come from run 1.
|
||||
|
||||
| File | pass | fail |
|
||||
|---|---|---|
|
||||
| packages/business/tests/launch-settings.test.mjs | 16 | 0 |
|
||||
| packages/cli/tests/stack-copy.test.mjs | 16 | 0 |
|
||||
| packages/cli/tests/stack-release.test.mjs | 195 | 0 |
|
||||
| packages/conversation/tests/cohort.test.mjs | 37 | 0 |
|
||||
| packages/harness/tests/bundle.test.mjs | 22 | 0 |
|
||||
| packages/harness/tests/claude-gate.test.mjs | 3 | 0 |
|
||||
| packages/harness/tests/claude-session.test.mjs | 8 | 0 |
|
||||
| packages/harness/tests/creative.test.mjs | 7 | 0 |
|
||||
| packages/harness/tests/mcp-server.test.mjs | 5 | 0 |
|
||||
| packages/harness/tests/pi-session.test.mjs | 8 | 0 |
|
||||
| packages/harness/tests/skills.test.mjs | 10 | 0 |
|
||||
| packages/plugins/tests/harness.test.mjs | 9 | 0 |
|
||||
| packages/seat/tests/sandbox.test.mjs | 10 | 0 |
|
||||
| packages/webui/tests/editor.test.mjs | 5 | 0 |
|
||||
| packages/webui/tests/pinned-copy.test.mjs | 10 | 0 |
|
||||
| packages/cli/tests/case2-persona-import.test.mjs | 11 | 0 |
|
||||
| packages/cli/tests/stack-release-external.test.mjs | 25 | 0 |
|
||||
| packages/cli/tests/stack-upgrade.test.mjs | 20 | 0 |
|
||||
|
||||
Total over the 18 files: 417 pass, 0 fail, 0 cancelled, summed by awk.
|
||||
|
||||
The dry run on the fixture, `stage --hermes-root packages/cli/tests/fixtures/case2-persona-import/hermes
|
||||
--pair default=Bean --pair chet=Chet --dry-run`, exited 0 and printed:
|
||||
|
||||
```
|
||||
files 2
|
||||
profile default: lines 3, lines starting "# " or "## " 0, lines naming a Hermes tool or channel 0
|
||||
profile chet: lines 2, lines starting "# " or "## " 0, lines naming a Hermes tool or channel 0
|
||||
```
|
||||
|
||||
## Rebase onto 213's landing (sage-1925)
|
||||
|
||||
213 landed as 361ba2387, with the same `git patch-id --stable` as r4 2b3e67e36, f313e69b6f7e. The
|
||||
refactor tip was 62ddc96cc. I cherry-picked 2d7a99aee onto it under the new branch gosalyn/c2-20-r2 as
|
||||
48f044ccc. The patch-id is eb094ae783e9 before and after. None of the 22 paths changed between 2b3e67e36
|
||||
and 62ddc96cc. The fence export from sage-1836 Q1 was already in the commit: `personaTextFault` from
|
||||
packages/harness/src/bundle.mjs, called by the script. I checked the test list again on the new base by
|
||||
grepping tests and scripts/test-*.sh for each non-test path's basename. The new hits name other packages'
|
||||
package.json files or write lockfiles in temp dirs, so the 18 files stand. 231 landed after that as
|
||||
29ce1e360. It touches only packages/library and the queue-231 packet, none of these 22 paths.
|
||||
|
||||
Rerun on 48f044ccc, slot grant sage-1932, 10:18:09Z to 10:30:14Z, after a busy check. All 18 files ran
|
||||
whole, one `node --test` each, every rc 0: 419 pass, 0 fail, 0 cancelled, summed by awk. That's two more
|
||||
than the 417 above, both from the base. stack-release went from 195 to 196 and stack-upgrade from 20 to 21,
|
||||
and rows 238 and 240 changed those test files. Every other file has the count in the table above. The dry
|
||||
run printed the same three lines, rc 0.
|
||||
@@ -1,96 +0,0 @@
|
||||
# Row 231 build notes, C2-01b survey escapes, list item lines and attachment embeds (#1733)
|
||||
|
||||
Brief: docs/plans/2026-10-20_case2-rows.md "C2-01b survey escapes, list item lines and attachment embeds",
|
||||
blob 16847e94ae17. These are Webby's row 212 notes N1 to N3 (webby-0041), split out by sage-1517.
|
||||
|
||||
## Base
|
||||
|
||||
First built as 777f7358a on 212's first round bdf18272a. 212 landed as ee7b2f137 (sage-1886), so the
|
||||
commit was cherry-picked onto refactor fefd54e13 under the new branch gosalyn/c2-01b-r2 as 3647a5a93.
|
||||
`git patch-id --stable` is 45911915a9ee before and after. packages/library is the same in bdf18272a
|
||||
and in 212's landed round a2c72ac95, so nothing the commit touches moved under it.
|
||||
|
||||
## What changed
|
||||
|
||||
- N1, `packages/library/src/survey.mjs`: JSON strings escape C0 controls but leave DEL, C1 and bidi
|
||||
controls raw. The new `quote()` escapes those too, and folder names print through it.
|
||||
- N2, `packages/library/src/reader.mjs`: front matter parsing records each block list item's line, and
|
||||
a link in a block list carries its item's line instead of its key's.
|
||||
- N3, `links.mjs` exports `isAttachment` through `index.mjs`. A wikilink or embed whose target's last
|
||||
segment ends in an extension other than `.md` is an attachment. The reader neither resolves nor
|
||||
indexes it, and it raises no problem. The survey prints a count of body links to attachments.
|
||||
- `packages/library/README.md` describes all three, and the links, reader and survey tests cover them.
|
||||
|
||||
## Outside readers
|
||||
|
||||
`packages/cli/tests/stack-copy.test.mjs:38` checks only that `packages/library/src/index.mjs` exists, and
|
||||
`scripts/mosaic:41` execs `survey.mjs`. No test pins a hash of a library file.
|
||||
|
||||
## Tests
|
||||
|
||||
On 3647a5a93, slot grant sage-1889, 09:20:01Z to 09:20:14Z, after a busy check. One `node --test` per
|
||||
file, every rc 0.
|
||||
|
||||
| File | pass | fail |
|
||||
|---|---|---|
|
||||
| packages/library/tests/links.test.mjs | 7 | 0 |
|
||||
| packages/library/tests/mapping.test.mjs | 7 | 0 |
|
||||
| packages/library/tests/reader.test.mjs | 13 | 0 |
|
||||
| packages/library/tests/render.test.mjs | 11 | 0 |
|
||||
| packages/library/tests/survey.test.mjs | 6 | 0 |
|
||||
| packages/cli/tests/stack-copy.test.mjs | 16 | 0 |
|
||||
|
||||
Total: 60 pass, 0 fail, 0 cancelled, summed by awk.
|
||||
|
||||
## Round 2, after webby-0070 (CHANGES) and sage-1900
|
||||
|
||||
Webby's round 1 review is agents/webby/work/queue-231/REVIEW-r1.md at 387f04dfd, rev 2774.
|
||||
|
||||
Ruling sage-1900, recorded here as asked. B2: the brief stays as approved (sage-1517, case2-rows.md
|
||||
C2-01b N3). Only a `![[x.ext]]` embed can be an attachment. Plain wikilinks and front matter values keep
|
||||
resolving, and an unresolved one is R4. README's line "A link to a `.canvas` file or an attachment is
|
||||
R4" is back as it was at fefd54e13. B1: resolve first. An embed is an attachment only when it resolves
|
||||
to nothing and its target has an extension other than `.md`. So `![[Dr.Quinn]]` with Dr.Quinn.md
|
||||
indexed resolves, `![[cover.png]]` gives no problem, `![[missing-note]]` is R4 and `![[note.md]]`
|
||||
resolves. My own design ruling after r11 (28213ac27) also made plain links attachments. The brief
|
||||
narrowed that, and the brief governs this row.
|
||||
|
||||
Changes:
|
||||
|
||||
- `links.mjs`: `isAttachment` is true only for a body embed, `link.embed === true && !link.field`,
|
||||
with the extension test as before. Its comment says it goes by name, so the reader asks it only
|
||||
after resolving.
|
||||
- `reader.mjs`: every link resolves first. An unresolved one is R4 unless `isAttachment` holds.
|
||||
- `survey.mjs`: `quote()` also escapes U+061C (Webby N1). The attachment count now covers body embeds
|
||||
only, since it uses `isAttachment`.
|
||||
- Webby N2, my choice of Sage's two options: the survey keeps a count by name and the README says so,
|
||||
"the count of body embeds whose target has an extension other than `.md`", and that `![[Dr.Quinn]]`
|
||||
counts there even when Dr.Quinn.md exists. Checking against the survey's path list would mean a second
|
||||
resolver in the survey, for a count that only guides the mapping.
|
||||
- Tests. links: embeds only, with `[[cover.png]]`, `[[Board.canvas]]`, `[[Dr.Quinn]]`, a front matter
|
||||
value and a markdown link all false, and `![[Dr.Quinn]]` true by name. reader: the Shore case now
|
||||
gives R4 for the front matter `"![[portrait.JPG]]"` (line 3), for `[[Board.canvas]]` (line 5) and for
|
||||
`![[missing-note]]` (line 6). The new Dr.Quinn case has Dr.Quinn.md indexed and resolves `[[Dr.Quinn]]` in
|
||||
a block list and in the body, plus `![[Dr.Quinn]]`, with no problem. survey: a U+061C folder name
|
||||
prints escaped, and the attachment count is 1, since `[[map.PDF]]` is a plain link.
|
||||
|
||||
Round 2 tests, one `node --test` per file, each run after a busy check.
|
||||
|
||||
Run 1, slot grant sage-1903, 09:39:32Z to 09:39:46Z: 60 pass, 1 fail. The new Dr.Quinn reader test failed
|
||||
on order alone. All three links resolved to Dr.Quinn.md with the right field, line and embed values, and
|
||||
there was no problem. The reader lists body links before front matter links, and my expected array put
|
||||
the `relationships` link first. I stopped and reported it (gosalyn-0098).
|
||||
|
||||
Run 2, after the test-only fix sage-1907 approved, which moves that entry to the end of the expected array,
|
||||
09:43:42Z to 09:43:56Z. Every rc 0.
|
||||
|
||||
| File | pass | fail |
|
||||
|---|---|---|
|
||||
| packages/library/tests/links.test.mjs | 7 | 0 |
|
||||
| packages/library/tests/mapping.test.mjs | 7 | 0 |
|
||||
| packages/library/tests/reader.test.mjs | 14 | 0 |
|
||||
| packages/library/tests/render.test.mjs | 11 | 0 |
|
||||
| packages/library/tests/survey.test.mjs | 6 | 0 |
|
||||
| packages/cli/tests/stack-copy.test.mjs | 16 | 0 |
|
||||
|
||||
Total: 61 pass, 0 fail, 0 cancelled, summed by awk.
|
||||
@@ -1,87 +0,0 @@
|
||||
# Row 247 build notes, C2-20b persona import follow-up (#1749)
|
||||
|
||||
Brief: docs/plans/2026-10-20_case2-rows.md "C2-20b persona import follow-up: printed keys, the dry run
|
||||
fence check and the mkdir race", landed in 335bb3e30. These are Webby's row 221 notes N1, N2 and N4
|
||||
(webby-0073, REVIEW-r1 a0a00630e on webby/reviews). N3 is in DEFERRED (sage-1941).
|
||||
|
||||
## Base
|
||||
|
||||
Branch gosalyn/c2-20b from 335bb3e30, which is row 221's landing 300766450 plus the brief.
|
||||
|
||||
## What changed
|
||||
|
||||
- N1, `scripts/case2-persona-import.mjs`: the per-channel prompt line prints the platform key, with its
|
||||
fixed `platforms.` or `gateway.platforms.` prefix, and the channel key through `JSON.stringify`. A key
|
||||
holding a newline prints as `\n` inside one quoted line. The profile name on that line is not config
|
||||
text: `pairing` already holds it to `PROFILE_ID`.
|
||||
- N2: the dry run calls `personaTextFault` on each persona after its count line. A fault prints as
|
||||
`profile P: persona <reason>, so C2-08's fence would refuse it`, where the reason is the fixed string
|
||||
`personaTextFault` returns, never persona text or a line number. With any fault the run refuses, exit
|
||||
1, and writes nothing, as stage would. The header comment no longer says a fault is counted, not
|
||||
refused, and now says a SOUL.md over four times the fence in bytes refuses before any count, which is
|
||||
what `soul()` already did (Webby's second point under N2).
|
||||
- N4: `privateDir` catches an EEXIST from its mkdir and refuses with `<path> was made by something else
|
||||
between the check and mkdir`. Any other mkdir error is thrown as before, since the brief names only
|
||||
EEXIST.
|
||||
- Tests, `packages/cli/tests/case2-persona-import.test.mjs`:
|
||||
- The per-channel prompt test expects the quoted keys.
|
||||
- New: a chet config.yaml with a newline in the platform key and in the channel key prints one quoted
|
||||
line, and no output line starts with the forged text.
|
||||
- The dry run heading test now expects the fence fault line, exit 1 and the refusal, still with
|
||||
nothing written. Its persona has two heading lines, which the fence refuses.
|
||||
- New: a persona of 8001 two-byte characters, 16002 bytes and under the 32000 byte cap, makes the dry
|
||||
run print the over 8000 characters fault, write nothing and exit 1. At exactly 8000 it exits 0.
|
||||
- New: the mkdir race refuses by name at stage, for the staging directory, and at install, for
|
||||
`personas/<business>`. Each refused directory is left empty.
|
||||
- New fixture `packages/cli/tests/fixtures/case2-persona-import/mkdir-race.mjs`, an `--import` preload
|
||||
like `trace.mjs`. It makes the directory named by `$PERSONA_MKDIR_RACE` just before the script's own
|
||||
`mkdirSync` of that path, so the script meets a real EEXIST from the kernel, not a thrown stub.
|
||||
|
||||
## Known limit of N1
|
||||
|
||||
`JSON.stringify` escapes C0 controls, `"` and `\`, but leaves DEL, C1, U+2028, U+2029 and the bidi
|
||||
controls raw. None of those ends a line on a terminal, so the forged line N1 names can't happen. A bidi
|
||||
control could still reorder how the rest of that one line displays. The brief asks for `JSON.stringify`,
|
||||
and Sage kept it in sage-1964 because the keys come from Jason's own Hermes config. Note for Webby: row
|
||||
231's `quote()` in packages/library covers the wider set, and this row doesn't import it. If you want it,
|
||||
ask for it in review.
|
||||
|
||||
## Mutants
|
||||
|
||||
One per fix, plus a second for N1 so each of its two keys has its own. Each replaces one exact string
|
||||
in the script, runs the test file, then restores the script from a copy and checks its sha256.
|
||||
|
||||
| Mutant | Fix | Change |
|
||||
|---|---|---|
|
||||
| M1 | N1 | the channel key prints raw |
|
||||
| M2 | N1 | the platform key prints raw |
|
||||
| M3 | N2 | the dry run's refusal after a fault is skipped |
|
||||
| M4 | N4 | privateDir's EEXIST branch never matches, so EEXIST is thrown raw |
|
||||
|
||||
## Outside readers
|
||||
|
||||
`git grep` over packages/*/tests/* and scripts/test-*.sh finds `case2-persona-import` only in its own
|
||||
test file and in two files of its fixture tree, README.md and trace.mjs, which name the test file in a
|
||||
comment. No test pins a hash of the script.
|
||||
|
||||
## Tests
|
||||
|
||||
Two slot runs, `busy.sh && run.sh` in /mnt/storage/scratch/gosalyn-r247, on the test file alone.
|
||||
|
||||
Run 1, grant sage-1969, 11:47:45Z to 11:48:00Z, was red: 14 tests, 12 pass, 2 fail. The fault was in the
|
||||
script. Adding `JSON.stringify` to the per-channel line dropped the space after the comma, so it printed
|
||||
`"-1001",29 bytes`. The two per-channel tests caught it. run.sh also went on to the mutants with a red
|
||||
base, so their counts meant nothing. Sage approved both fixes in sage-1971: the space goes back, and run.sh
|
||||
now exits 3 before the mutants unless the base is rc=0 with fail 0.
|
||||
|
||||
Run 2, grant sage-1971, 11:49:04Z to 11:49:22Z, was green: 14 tests, 14 pass, 0 fail, rc=0.
|
||||
|
||||
| Mutant | Line | rc | Failed | Killed by |
|
||||
|---|---|---|---|---|
|
||||
| M1 | 237 | 1 | 2 | the per-channel prompt test and the newline key test |
|
||||
| M2 | 237 | 1 | 2 | the same two |
|
||||
| M3 | 238 | 1 | 2 | the dry run fence test and the dry run heading test |
|
||||
| M4 | 192 | 1 | 1 | the mkdir race test |
|
||||
|
||||
After the run the script's sha256 was 7031d2c0dc9bd22bc748b364a35b461fc01cb98b795032a2e0ec436f3188d4e4, the
|
||||
same as the copy taken before it. The /proc scan found no process in the worktree or the scratch dir.
|
||||
@@ -1,432 +0,0 @@
|
||||
# Row 197 execution ledger
|
||||
|
||||
Plan: MANIFEST.md r2, approved by Webby ca6b32d66.
|
||||
Build grant: sage-1390. Suites, image builds and paired proof are not granted.
|
||||
Rebased five documentation commits onto origin/refactor aa1bd209e before code.
|
||||
Existing worktree herb/row197 and plain node_modules symlink retained.
|
||||
|
||||
- T1 preflight/steps: in progress.
|
||||
- T2 locks/status/recovery: pending.
|
||||
- T3 image/Docker: pending.
|
||||
- T4 fixtures/timing: pending.
|
||||
- T5 evidence/acceptance: historical timing done; implementation pending.
|
||||
|
||||
Preflight interfaces: T1 RunPaths supplies T2 ownership and T3 image checks.
|
||||
T2 run receipt supplies T4 lane/port state and T5 attribution. T3 image identity
|
||||
is checked before Docker-bearing steps. T4 timings supply T5 pair summaries.
|
||||
No interface conflict found. No product API or assertion changes are authorized.
|
||||
|
||||
Ruling: use this approved BUILD.md as the execution ledger, rather than adding
|
||||
skill workspace paths outside the manifest. This preserves the reviewed path
|
||||
boundary. Missing ledger detail would cost recovery time, not product behavior.
|
||||
|
||||
## Implementation checkpoint 2026-10-20T20:11:58Z
|
||||
|
||||
T1-T5 source is present within the approved manifest. Full acceptance is pending.
|
||||
Fresh single-file checks: preflight/supervisor 6/6; state/recovery 11/11; image and
|
||||
Docker guard 4/4; port leases/attribution/proof summary 3/3. No skips or failures.
|
||||
Existing files checked singly: board serve; WebUI serve, preview, proof-cli,
|
||||
tester-cli and service; harness pi and Claude. Stack-release R1 selected single
|
||||
passed 1/1. WebUI service also passed 31/31 with lane-a leases and a 30-byte root.
|
||||
All existing assert lines are unchanged. Shell syntax and diff checks pass.
|
||||
|
||||
Observed defects fixed during the single-file cycles: cancellation incorrectly
|
||||
returned zero when a TERM handler exited zero; recovery did not supersede an
|
||||
unclean terminal; status omitted the lock-before-receipt window. Evidence logs
|
||||
retain the failing and passing observations. Source still has no commit because
|
||||
applicable suites have not run. No image build, proof, push or live operation.
|
||||
|
||||
Ruling: use an instrumented single-lane author gate on a frozen dirty-source
|
||||
clone before committing source. The new wrapper requires a clean candidate and
|
||||
proven image receipt, while repository rules require green suites before source
|
||||
commits. The author gate retains every suite and assertion, caps concurrency at
|
||||
two, uses own port/state/temp/project roots, and guards Docker against builds.
|
||||
Cost if wrong: the author gate fails; clean-candidate wrapper baselines and the
|
||||
paired proof remain mandatory after source is verified and committed.
|
||||
|
||||
Ruling: publish the initial run directory atomically after the start receipt is
|
||||
complete. This avoids a second lane observing a partially written start. A
|
||||
crash before publication has started no test or mutable Docker operation.
|
||||
Cost if wrong: a lane refuses or quarantines; no protected state is bypassed.
|
||||
|
||||
## Implementation review corrections, 2026-10-20T20:33Z
|
||||
|
||||
Webby-0029 reviewed the first implementation packet at f942bd7d4.
|
||||
B1 identified missing manifest tests. B2 identified a test that leased both real
|
||||
bands through a private lock namespace. The old author-gate clear was withdrawn
|
||||
in herb-0019. SOURCE.json, BUILD.patch and gate.sh still describe the old frozen
|
||||
clone. They are not a clear for the edited working tree. No author gate ran.
|
||||
|
||||
B2 correction: the helper test uses only the active lane and MOSAIC_GATE_STATE.
|
||||
It compares the other band arithmetically and has no unasserted listener. The
|
||||
occupied-port probe first obtains its own real lease, binds that port, and
|
||||
asserts that its sentinel listener survives refusal. No test reserves another
|
||||
lane's band. Exhaustion narrows only the test process's band to one owned port.
|
||||
|
||||
B1 coverage added within the existing approved paths. No case is dropped:
|
||||
|
||||
| Manifest case | Added check |
|
||||
| --- | --- |
|
||||
| T1 canonical and builder checkout, existing output | gate-lane.test: direct validateRun refusals |
|
||||
| T1 92-byte socket and over-107-byte socket | exact design example with a distinct gt- test root; 108-byte refusal |
|
||||
| T1 both candidates carry tooling | validateTooling compares each launcher file, including missing and changed cases |
|
||||
| T1 duplicates and NODE_TEST_CONTEXT | repeated package/script fixture is retained; sanitized environment is exercised by both supervised children |
|
||||
| T2 one-winner race and inherited FDs | two actual shell wrappers race; a controlled supervisor verifies held FDs, and its child checks that no FD points to either lock file |
|
||||
| T2 same checkout and legacy claim refusal | activeConflicts uses synthetic process observations with a live lane and a sibling landing gate |
|
||||
| T2 surviving child and interrupted recovery | locked recovery kills a child proven by the private root, preserves a foreign child, is killed during fake Docker cleanup, leaves quarantine, and resumes under a new fixture grant |
|
||||
| T3 missing receipt and missing image | verifyImage refuses absent provenance and failing inspection |
|
||||
| T3 tag changed mid-gate and at gate end | runGate now uses the same executePinnedSteps boundary exercised by the tests; the next step never runs after a changed ID |
|
||||
| T3 mutable-tag rebuild | fake preparation returns a new image ID with identical input digest; the old receipt refuses it |
|
||||
| T3 cold and warm counters | preparation records one build and its time; warm execution records zero builds; repeated verification never builds |
|
||||
| T4 parallel test-file leases | two generated Node test files hold ports in the same lane/state; locks are checked during child execution and shutdown |
|
||||
| T4 exhausted band, occupied port and foreign listener | a one-port process-local band refuses both a held lease and an existing sentinel listener; the listener survives |
|
||||
| T4 owner death | a killed allocator releases only its own holder; a foreign lease remains held |
|
||||
| T4 lease through child shutdown | parent probes the lock while the fixture test runs and after its child has stopped |
|
||||
| T4 fixtureCacheEnv | replacement child environment writes only under separate tmp, jiti and cache directories |
|
||||
| T5 unrelated session append | a separate process waits for a running-step barrier, appends under a fixture HOME, and remains unrelated in the resulting metadata attribution |
|
||||
|
||||
N1 removes the unused closed binding. All leases reserve an unbound endpoint;
|
||||
existing closed options need no call-site change. N2 makes child TMPDIR a tmp
|
||||
subdirectory. N3 normalizes ss interface scopes before checking port 9. N4 uses
|
||||
gt- for unit run roots. N5 documents the canonical node_modules dependency.
|
||||
N6 is recorded: row 200 also edits stack-release.test.mjs; the second landing
|
||||
must rebase and rerun that file singly. Sage was told in herb-0019.
|
||||
|
||||
Before Sage's hold, expanded preflight tests passed 11/11, state tests 14/14,
|
||||
image tests 7/7, and the pi/Claude singles passed 8/8 each with separate tmp
|
||||
subdirectories. Later source/test edits still need verification. In particular,
|
||||
the new parallel test-file probe had a cleanup-order defect and is unverified.
|
||||
Its root cleanup ran before child shutdown. Cleanup now stops children before
|
||||
removing their root. Output is retained for a useful failure report. The initial
|
||||
FD probe also assumed Node did not reopen FD numbers; it now checks the actual
|
||||
lock targets. The early passing fixture file covered child allocators, before
|
||||
they were changed to actual generated test files. It is not acceptance of the
|
||||
latest file.
|
||||
|
||||
Sage-1448 stopped all node --test runs at 20:30Z for Rocko's browser slot.
|
||||
The remaining owned process tree was stopped at 20:30:32Z. Inspection found no
|
||||
remaining owned test processes afterward. Edits and static inspection continue.
|
||||
20 module syntax checks, shell syntax and git diff checks pass. Existing-file
|
||||
assertion lines remain identical to HEAD. No test is run during the hold.
|
||||
|
||||
Next: after Sage passes Rocko's clear, verify the corrected files singly,
|
||||
including a lane-env helper-file check. Then refresh the frozen clone and all
|
||||
three packet artifacts, send their hashes, and request a new author-gate clear.
|
||||
Suites, image builds and paired proofs still need their own grants. No source
|
||||
commit, push, suite, real Docker build or paired proof has run in this phase.
|
||||
|
||||
## Refrozen review packet, 2026-10-20T20:41Z
|
||||
|
||||
Sage-1454 lifted the single-file hold. Fresh runs passed without failures or
|
||||
skips: review-t1-resume.log 11/11, review-t2-resume.log 14/14,
|
||||
review-t3-resume.log 8/8, review-t4-resume.log 8/8. The helper file also passed
|
||||
8/8 with lane-a environment in review-t4-lane-a.log. Its retained state had only
|
||||
an a port-lock namespace, no b directory, and every lock was released. Generated
|
||||
fixture Node test entries explicitly use --test-concurrency=2. The child-test
|
||||
probe now finishes and cleans up before removing its root. All 41 new tests pass.
|
||||
|
||||
B1 and B2 fixes are ready for Webby's review. No manifest case was dropped.
|
||||
All 25 source paths were copied to a new frozen clone and compared by mode and
|
||||
SHA-256. This supersedes the earlier withdrawn source packet:
|
||||
|
||||
- SOURCE.json: 91ba149f2fc039a8bed0e6d1ad5da44b80fb8cbec84d0fa4e38616040138596b
|
||||
- gate.sh: 48e06e23e45d3484755f8cd79ad5b6dfde5ef4f960081e7c455a2540e707fed1
|
||||
- BUILD.patch: 0b3871bd9848ca223c7cda50266debc04643e5d986eb7f0fece096aaf25ff43e
|
||||
- Frozen checkout: /mnt/storage/scratch/mg197-a-d22dacd92735/wt
|
||||
- Output: /mnt/storage/scratch/mg197-a-d22dacd92735/out
|
||||
- Temporary root: /mnt/storage/scratch/ga-VPXhG7 (30 bytes)
|
||||
- Compose project: mg197-a-d22dacd92735
|
||||
|
||||
After an explicit author-gate grant, run this command with Sage's actual ID:
|
||||
|
||||
```sh
|
||||
env MOSAIC_GATE_GRANT=ACTUAL_SAGE_GRANT_ID bash /home/jwoltje/.t3/worktrees/mosaic-stack/herb-row197/agents/herb/work/queue-197/gate.sh > /mnt/storage/scratch/mg197-a-d22dacd92735/out/gate.log 2>&1
|
||||
```
|
||||
|
||||
No gate or suite has started. Queue order from sage-1454 is 192, 201, 204,
|
||||
200, Gander, then 197. No branch deletion is authorized or attempted. Any later
|
||||
rebase uses a new branch name, and pr-merge.sh -d stays off under #426(a).
|
||||
Whichever of rows 197 and 200 lands second must rerun stack-release singly.
|
||||
Clean-candidate wrapper baselines, image preparation and paired proofs remain
|
||||
separately gated acceptance work. There is still no source commit or push.
|
||||
|
||||
## Implementation approval and final notes, 2026-10-20T20:47Z
|
||||
|
||||
Webby-0031 approved r2 in REVIEW-impl-r2.md at 1f404c973. Their static review
|
||||
verified every source hash/mode and patch result, and all B1/B2 cases. No queue
|
||||
review request comment exists yet; Sage owns creating it if needed.
|
||||
|
||||
Folded all three optional notes into the same approved paths. The helper file's
|
||||
standalone fallback now shares /mnt/storage/scratch/mosaic-gate-lanes with real
|
||||
lane-a leases and leaves its stable lock files in place. Band assertions use the
|
||||
imported BANDS. Both T5 polling children fail after five seconds if their barrier
|
||||
is missed. README records the shared standalone namespace and deadlines.
|
||||
|
||||
Fresh single-file logs review-r3-fixtures.log and review-r3-lane-a.log both pass
|
||||
8/8 with zero skips. The lane-a run has no b lock directory, and every lock was
|
||||
released. Syntax and diff checks pass. No existing test assertions or timeouts
|
||||
changed. Remaining source matches the 11/14/8-file checks from r2.
|
||||
|
||||
Refreshed all 25 source rows in the existing frozen checkout. New digests replace
|
||||
the preceding r2 packet. gate.sh and its command are unchanged:
|
||||
|
||||
- SOURCE.json: 3584763642506e81a532c839bdd07b111d25daa87e35dbe441d8e8c01a2c2aab
|
||||
- gate.sh: 48e06e23e45d3484755f8cd79ad5b6dfde5ef4f960081e7c455a2540e707fed1
|
||||
- BUILD.patch: 55fe390da17ab926a0593d39e79561abe52756a1b1a2c756ec57f45d90f10fde
|
||||
|
||||
Author gate remains unstarted and queued for Sage's explicit grant. No source
|
||||
commit, suite, image build, paired proof, push or branch deletion ran.
|
||||
|
||||
## R3 approval receipt
|
||||
|
||||
Webby-0033 approved r3 in REVIEW-impl-r3.md at a5643f9bd. Static review verified
|
||||
the three packet hashes, all 25 source rows, and the patch result. Their review
|
||||
accepts N1-N3; no additional hang-guard test is requested. No queue review request
|
||||
comment exists yet, so Webby has not recorded a queue review.
|
||||
|
||||
Read-only verification after receipt confirms that the approved packet hashes
|
||||
and all 25 worktree/frozen source hashes and modes still match. Source and gate
|
||||
script stay frozen. The author gate has not started and still needs Sage's grant.
|
||||
|
||||
## Queue review round 1
|
||||
|
||||
Sage-1476 authorized moving row 197 to in-review before the author gate.
|
||||
Created CANDIDATE.sha256 from the same 25 reviewed SOURCE.json rows. Its digest
|
||||
is 6318f0d0bba9ee90ccaa3503cac8c2e04c6397f2ef6c3564f687fbc2092989e3.
|
||||
Ran the queue move from the canonical checkout with op herb-197-review-r3.
|
||||
The move succeeded at revision 2395, opening round 1 on #1695. The request post
|
||||
failed before send because MOSAIC_GITEA_CREDENTIAL_FILE is not set; revision 2396
|
||||
records the failed outcome. Exit code 1 describes the failed post, not a failed
|
||||
row transition. Read-back confirms state in-review and the correct candidate.
|
||||
Sage will post as jarvis and give Webby the request comment number. No credential
|
||||
lookup, alternate post or retry was attempted here.
|
||||
|
||||
SOURCE.json, BUILD.patch, gate.sh and all 25 frozen source rows remain unchanged.
|
||||
Latest slot order is row 190 r2, 201, 204, 200, Gander, then Herb. No gate starts
|
||||
before Sage sends an explicit grant ID.
|
||||
|
||||
## Follow-on assignment
|
||||
|
||||
Sage-1503 assigns row 215, Case 2 C2-04, to Herb after row 197 (queue rev 2455,
|
||||
Gosalyn design r11). Read docs/plans/2026-10-20_case2-rows.md, C2-04 section,
|
||||
at 5b8def2f1 when starting that row. Its required base is origin/refactor
|
||||
305857c8f. This assignment does not replace row 197 or authorize its gate.
|
||||
Keep row 197's approved source frozen while awaiting Sage's grant. Start row
|
||||
215 only after row 197, using a new branch name under the existing fleet rule.
|
||||
|
||||
## Round 2 merge preparation on row 233
|
||||
|
||||
Sage-1757 replaces history replay with one candidate commit on 57f59e0c3.
|
||||
The attempted history replay on herb/row197-r2-233 had already finished when
|
||||
that instruction arrived. Its only conflict was the append-only BUILD-LOG tail.
|
||||
That branch remains for history; none of its replayed commits is in this round.
|
||||
The current branch is herb/row197-r3-233, directly from
|
||||
57f59e0c399ce29b1bb85ca6af686fdc10eb195d.
|
||||
|
||||
Stash correction: shared refs/stash was used incorrectly. The exact entry
|
||||
2767b88549dfd8c7e810908b5416876fa50cb571 is now kept on
|
||||
herb/row197-r3-wip. After verifying stash@{0} still named it, only that entry was
|
||||
dropped. The two other entries remain. No further stash creation, force push,
|
||||
branch deletion or refs/stash mutation is planned. A separate working-copy
|
||||
backup is /mnt/storage/scratch/herb197-merge-W4oiLg.
|
||||
|
||||
Sage-1760 requires preserving every landed hunk on every changed manifest path.
|
||||
Checked each of the 25 r1 paths with git diff aa1bd209e 57f59e0c3 -- PATH.
|
||||
Exactly three changed upstream. Their r2 diff against 57f59e0c3 is captured in
|
||||
r2-merge-only.patch:
|
||||
|
||||
| Merged path | Only row 197 changes against landed base | Landed content retained |
|
||||
| --- | --- | --- |
|
||||
| packages/cli/tests/stack-release.test.mjs | leasePort and laneAfter imports; freePort now calls the lease helper | All landed tests, including row 233's tests after R15 and BACKUP_STORE checks |
|
||||
| packages/webui/tests/service.test.mjs | leasePort and laneAfter imports; closedPort now calls the lease helper | SEND_REFUSAL permits --sso; default unit rendering removes the @CONFIG_ENV@ line |
|
||||
| scripts/test-discord.sh | fixture PI_CODING_AGENT_DIR setup; optional two-worker nested Node cap | Row 190's absent scratch MOSAIC_CONFIG selection and caller-config restoration |
|
||||
|
||||
The other 22 paths equal the r1 reviewed source bytes and modes. r2-MERGE.json
|
||||
lists every path, its r1/r2 digest, mode, upstream-change flag and equality result.
|
||||
Source copies came from the hash-verified r1 frozen checkout. Original r1 digest:
|
||||
6318f0d0bba9ee90ccaa3503cac8c2e04c6397f2ef6c3564f687fbc2092989e3.
|
||||
No existing assertion or timeout line differs from the landed base. Static
|
||||
checks only: 20 module syntax checks, four shell syntax checks and git diff check
|
||||
pass. BUILD-LOG.md equals 57f59e0c3 byte for byte and is outside this commit.
|
||||
|
||||
Sage explicitly requested the local candidate SHA before granting tests. This
|
||||
commit is an untested preparation checkpoint, not gate evidence. No tests or
|
||||
push are authorized yet. r2-TEST-FILES.txt lists the requested grant scope:
|
||||
16 Node test files singly and scripts/test-discord.sh, test-foundation.sh and
|
||||
test-queue.sh. The four stack-release consumers are stack-release.test.mjs,
|
||||
stack-release-external.test.mjs, stack-upgrade.test.mjs and stack-instances.test.mjs.
|
||||
The shared stack-release-fixture.mjs is exercised by its importing test files,
|
||||
not run as a standalone test. This covers all 13 touched Node test files plus
|
||||
three additional stack-release consumers and all three touched shell suites.
|
||||
|
||||
Current slot order from sage-1760: Gizmoduck, Launchpad, Darkwing, then Herb,
|
||||
around 06:30Z. Wait for an explicit grant. After granted checks and authorized
|
||||
push, build the new candidate manifest from that pushed tip and open the
|
||||
merge-scoped round 2. Old SOURCE.json, CANDIDATE.sha256 and gate.sh remain r1
|
||||
historical artifacts and are not a clear to run the merged candidate.
|
||||
|
||||
## Round 2 rebuilt on row 234
|
||||
|
||||
Sage-1776 names landing c771a36f4bd0b6c359282425c668996a90072f93.
|
||||
Built a new branch, herb/row197-r4-234, directly from that landing. No history
|
||||
replay, stash, force push, branch deletion, test run or push is involved.
|
||||
The prior candidate a3b7cbde8 remains untested and is not the queued candidate.
|
||||
|
||||
Checked git diff --name-only 57f59e0c3 c771a36f4 against all 25 source paths.
|
||||
Only packages/cli/tests/stack-release.test.mjs overlaps; the other 24 do not.
|
||||
The full comparison is in r2-on234-OVERLAP.txt. The stack-release file starts
|
||||
from the landing and keeps both T46 untimed entries, host_grants and hosts.
|
||||
Its only changes against the landing are the leasePort and laneAfter imports
|
||||
and freePort's call to the lease helper. r2-on234-merge-only.patch records those
|
||||
hunks. Existing assertions and timeouts match the landing exactly.
|
||||
|
||||
Every other source path equals a3b7cbde8 byte for byte and retains its mode.
|
||||
This includes the previously merged service and test-discord files, preserving
|
||||
all landed --sso, CONFIG_ENV and scratch-config handling. The earlier evidence
|
||||
r2-MERGE.json still records those three pre-234 merge cases. The new
|
||||
r2-on234-MERGE.json records each current digest, prior digest, mode and equality
|
||||
result. BUILD-LOG.md equals the new landing byte for byte and is excluded.
|
||||
|
||||
Static check of the changed Node file and the candidate diff pass. No tests
|
||||
were run. The scope stays r2-TEST-FILES.txt: 16 Node files singly plus the three
|
||||
shell suites. No manifest or queue round is rebuilt until granted checks and
|
||||
authorized push. Old SOURCE.json, CANDIDATE.sha256 and gate.sh remain historical
|
||||
r1 evidence. The test slot follows Darkwing 240 and needs Sage's explicit grant.
|
||||
|
||||
|
||||
## Round 6 preparation (sage-1883, mos-1162)
|
||||
|
||||
New branch herb/row197-r6 starts at fefd54e13, after the standalone row
|
||||
212 landing ee7b2f137. No r5 manifest path changed between e7078e6a8 and
|
||||
this base; all 32 r5 blobs and modes were copied intact before the two
|
||||
umask changes. No history replay, stash, force push or branch deletion.
|
||||
|
||||
executeSteps now launches each argv through /bin/bash with umask 022
|
||||
and exec, preserving the process group and argv boundaries. The supervisor
|
||||
and gate-lane.sh retain 077, including state, locks, private logs and roots.
|
||||
New gate-lane tests assert the actual child umask and created file mode,
|
||||
the unchanged parent mask, private log mode, and actual wrapper-created
|
||||
state/lock modes. No shell, image preparation, credentials test or other
|
||||
existing assertions changed. process.test.mjs equals the landed base;
|
||||
lane-image.mjs equals r5. N7 remains DEFERRED at fefd54e13; rows 243 and
|
||||
244 own the explicit chmod and PI_AUTH_FILE fixtures respectively.
|
||||
|
||||
Read Sage's permitted failed pkg-bus log: process.test startup token refusal
|
||||
saw ready.ok true, consistent with inherited 077 narrowing its fixture mode.
|
||||
No further diagnostic read of the retained ga-8I3iZc root is needed.
|
||||
No r6 tests or probes have run. Source commit, push and new manifest await
|
||||
the explicit granted checks. r6-OVERLAP.json records the empty overlap.
|
||||
|
||||
|
||||
Sage-1892 focused grant: gate-lane.test whole 13/0, process.test whole
|
||||
through executeSteps 8/0, zero skips/cancellations. Syntax checks passed.
|
||||
All new umask/mode assertions passed. No Docker, image, lane or proof run.
|
||||
Empty /proc cwd/argv scan and removal recorded in r6-granted/cleanup.json;
|
||||
clear herb-0068 at 09:21Z. The source matches r5 on 29 of its 32 paths,
|
||||
including modes. Only BUILD.md, gate-lane.test.mjs and gate-lane.mjs differ.
|
||||
The new r6-OVERLAP.json records the base comparison. No process test edit.
|
||||
Sage-1895 authorizes one source commit and seat-only push after range check.
|
||||
|
||||
|
||||
## Round 7 preparation (sage-1951, sage-1955)
|
||||
|
||||
The r6 proof passed all package suites with the original process.test,
|
||||
then failed script-release. The guard injected --no-build into compose run;
|
||||
Compose 5.5.1 rejects it before container creation. The old unit test only
|
||||
asserted the same invalid argv, so it could not detect this compatibility
|
||||
error. This supersedes no-build-flag claims in the historical packet.
|
||||
|
||||
herb/row197-r7 starts at b1fece6f0. No r6 manifest path changed between
|
||||
fefd54e13 and this base; all 33 r6 blobs/modes were copied intact before
|
||||
r7 tests were authored. No history replay, stash, force push or deletion.
|
||||
Sage-1955 accepts the private tempRoot/compose-no-build.yaml override,
|
||||
mode0600, with build: !reset null and image pinned to the receipt's imageId.
|
||||
The guard owns the -f arguments and forces run --pull never --no-deps.
|
||||
Caller-supplied Compose config/build/pull options remain refused.
|
||||
The existing proof removes successful temp roots and retains failed roots;
|
||||
the override stays within that same cleanup ownership.
|
||||
|
||||
Tests first: installed-binary run --help before SERVICE checks parser
|
||||
acceptance without starting a container. A separate compose config --format
|
||||
json check uses the actual candidate compose.yaml, made-up env/auth paths,
|
||||
and an empty Docker config directory, asserting no build key and the exact
|
||||
pinned image. The no-build-restoration mutant must fail that parser test.
|
||||
No test, probe or Docker command has run on r7; waiting for Sage's grant.
|
||||
|
||||
Primary references: Docker's merge reference documents !reset null:
|
||||
https://docs.docker.com/reference/compose-file/merge/#reset-value
|
||||
Docker's run reference documents --pull and --no-deps, with no --no-build:
|
||||
https://docs.docker.com/reference/cli/docker/compose/run/
|
||||
Installed 5.5.1 acceptance and merged configuration are still unverified.
|
||||
|
||||
|
||||
Sage-1956 focused grant, 2026-10-21 11:19-11:21Z: busy check CLEAR.
|
||||
Whole gate-lane-image.test on the r6 guard: 9 pass, 2 fail. The installed
|
||||
Compose parser emitted unknown flag: --no-build; the other expected failure
|
||||
was the missing override helper. No cancellation or skip. After the fix,
|
||||
whole file 11/0. The committed r7-no-build.mutant.patch restores the invalid
|
||||
flag. Applied only for the installed parser regression: 0/1 with the same
|
||||
unknown-flag error, killed. Restored source and whole file passed 11/0 again.
|
||||
Both approved node --check commands passed. Empty /proc cwd/argv scan;
|
||||
clear herb-0073 at 11:21:04Z. No container start, image build, lane, proof or
|
||||
full suite ran. Logs/counts/scan are in r7-granted/ (local run evidence).
|
||||
|
||||
The guard supplies both absolute -f paths, suppressing automatic override
|
||||
selection, pins receipt imageId, removes build via !reset null and adds
|
||||
--pull never --no-deps. Its main entry publishes the override before Docker
|
||||
runs. A unique private staging file plus hard-link publication prevents
|
||||
partial writes or replacement under concurrent guard calls; existing bytes,
|
||||
mode0600, file type and ownership must match, with O_NOFOLLOW on reads.
|
||||
The file stays under the run's short private tempRoot for existing proof
|
||||
cleanup. Caller Compose options remain allowlisted and config/build/pull
|
||||
options refuse. The actual installed Compose config test reports no build
|
||||
key and the exact image ID; parser help is before SERVICE, so no container
|
||||
operation can run. Fixtures supply made-up env/auth paths and empty Docker
|
||||
configuration. Existing image provenance, cleanup and umask behavior remain.
|
||||
|
||||
Range check: one source commit on b1fece6f0, same 33 r6 paths plus the
|
||||
mutant patch and r7 overlap receipt (35 paths). Thirty r6 paths retain the
|
||||
same blob/mode. Only lane-docker.mjs, gate-lane-image.test.mjs and BUILD.md
|
||||
differ from r6. process.test and BUILD-LOG equal the landing. No force push,
|
||||
branch deletion, history replay or other source edits. Sage-1956 authorizes
|
||||
the source commit and seat-only push; fresh proof remains Sage's action.
|
||||
|
||||
|
||||
## Round 8 preparation (sage-1979)
|
||||
|
||||
The r7 D5 proof passed business and bus, then failed the two installed
|
||||
Compose probes in pkg-cli. Their subprocess fixture retained the lane's
|
||||
shim-leading PATH but omitted MOSAIC_GATE_DOCKER_RECORD, so the shim read
|
||||
an undefined path. This is a test context error; the production guard stays
|
||||
byte-identical to r7.
|
||||
|
||||
New herb/row197-r8 starts at 5c6f73ed7. None of r7's 35 manifest paths
|
||||
changed from b1fece6f0 to this base. Tests choose the record's real absolute
|
||||
Docker path when a lane record is set; outside lanes they keep using docker.
|
||||
Only the two read-only help/config probes use this helper. The subprocess
|
||||
env still holds fixture-only configuration; the record need not propagate
|
||||
to it. No run or policy allowlist is widened.
|
||||
|
||||
Sage-1979 grants 215's 16 singles first, then r8's normal and lane-shaped
|
||||
shim-leading PATH whole-file checks and the record-lookup-removal mutant.
|
||||
The shim fixture invokes the actual unchanged guard, with a private made-up
|
||||
record naming the real Docker binary. No image build, container start, lane
|
||||
or proof is part of r8 checks. No r8 checks have started yet.
|
||||
|
||||
|
||||
Sage-1979 r8 checks followed 215's early singles, then clear herb-0078 at
|
||||
2026-10-21 12:09:28Z. Whole gate-lane-image.test normal PATH11/0; whole
|
||||
actual guard-shim-leading PATH plus private record11/0. The committed
|
||||
r8-record-lookup.mutant.patch removes the lookup: installed-Compose argv
|
||||
regression0/1, killed with the original Received undefined path error.
|
||||
Restored code, repeated whole shim-PATH file11/0. All zero skips/cancellations.
|
||||
Logs/counts/fixture metadata/empty /proc cwd+argv scan are in r8-granted/.
|
||||
Both 215 and r8 private roots were removed after an empty process scan.
|
||||
No image build, container start, suite, lane or proof ran for r8.
|
||||
|
||||
Range: one commit on5c6f73ed7. Of r7's35 paths,33 keep the same blob/mode;
|
||||
only gate-lane-image.test and this BUILD.md change. The r8 mutant and overlap
|
||||
receipt are added. The production guard and all other tooling match r7.
|
||||
BUILD-LOG and process.test equal the landing. No history replay, force push,
|
||||
branch deletion, live state change or policy widening. Fresh proof remains
|
||||
Sage's action after Webby's merge review.
|
||||
@@ -1,207 +0,0 @@
|
||||
{
|
||||
"r1Base": "aa1bd209e",
|
||||
"r1Candidate": "6318f0d0bba9ee90ccaa3503cac8c2e04c6397f2ef6c3564f687fbc2092989e3",
|
||||
"r2Base": "57f59e0c399ce29b1bb85ca6af686fdc10eb195d",
|
||||
"rows": [
|
||||
{
|
||||
"path": "packages/cli/tests/fixtures/gate-lane-child.mjs",
|
||||
"r1Sha256": "209682b968e929da4b46dc97c64fcd7aa68c490f3c6be44595f5d85f8d2e1483",
|
||||
"r2Sha256": "209682b968e929da4b46dc97c64fcd7aa68c490f3c6be44595f5d85f8d2e1483",
|
||||
"mode": "0o644",
|
||||
"landedPathChanged": false,
|
||||
"r1BlobEqual": true
|
||||
},
|
||||
{
|
||||
"path": "packages/cli/tests/gate-lane-fixtures.test.mjs",
|
||||
"r1Sha256": "29afa181804a724c695678eb9459c156e00f1084647c704e814c5bee156c0c25",
|
||||
"r2Sha256": "29afa181804a724c695678eb9459c156e00f1084647c704e814c5bee156c0c25",
|
||||
"mode": "0o644",
|
||||
"landedPathChanged": false,
|
||||
"r1BlobEqual": true
|
||||
},
|
||||
{
|
||||
"path": "packages/cli/tests/gate-lane-image.test.mjs",
|
||||
"r1Sha256": "0253621a49c2e77ffcdbf32beee7e1f773ec2c52c8487dcc5aa254e61807af7c",
|
||||
"r2Sha256": "0253621a49c2e77ffcdbf32beee7e1f773ec2c52c8487dcc5aa254e61807af7c",
|
||||
"mode": "0o644",
|
||||
"landedPathChanged": false,
|
||||
"r1BlobEqual": true
|
||||
},
|
||||
{
|
||||
"path": "packages/cli/tests/gate-lane-state.test.mjs",
|
||||
"r1Sha256": "948d62c76447d8269f03518562a261564c202ec9207461fb21d2b1c11c9bb9fc",
|
||||
"r2Sha256": "948d62c76447d8269f03518562a261564c202ec9207461fb21d2b1c11c9bb9fc",
|
||||
"mode": "0o644",
|
||||
"landedPathChanged": false,
|
||||
"r1BlobEqual": true
|
||||
},
|
||||
{
|
||||
"path": "packages/cli/tests/gate-lane.test.mjs",
|
||||
"r1Sha256": "240bf0c15025ad6f88b251917a3c8d72bd21c2e5df6771e1ceb83a1d90b24a51",
|
||||
"r2Sha256": "240bf0c15025ad6f88b251917a3c8d72bd21c2e5df6771e1ceb83a1d90b24a51",
|
||||
"mode": "0o644",
|
||||
"landedPathChanged": false,
|
||||
"r1BlobEqual": true
|
||||
},
|
||||
{
|
||||
"path": "packages/cli/tests/stack-release.test.mjs",
|
||||
"r1Sha256": "8ca733a600d5f5534d7e14d8533e1b16d710ebd43080ef8421238b5dd145fade",
|
||||
"r2Sha256": "b95c0c125b6a283961e24adc07d43150bcbd05d2f11005180b836043015c52a6",
|
||||
"mode": "0o644",
|
||||
"landedPathChanged": true,
|
||||
"r1BlobEqual": false
|
||||
},
|
||||
{
|
||||
"path": "packages/control-board/tests/serve.test.mjs",
|
||||
"r1Sha256": "4838cb4609da28fc921370c5542a82402fbc9ceb469692a36f0eafc713bb56c8",
|
||||
"r2Sha256": "4838cb4609da28fc921370c5542a82402fbc9ceb469692a36f0eafc713bb56c8",
|
||||
"mode": "0o644",
|
||||
"landedPathChanged": false,
|
||||
"r1BlobEqual": true
|
||||
},
|
||||
{
|
||||
"path": "packages/harness/tests/claude-session.test.mjs",
|
||||
"r1Sha256": "0a09b0255e9144a039428eb8e9f56181f94ccb2d187e474ea13392b485fdd008",
|
||||
"r2Sha256": "0a09b0255e9144a039428eb8e9f56181f94ccb2d187e474ea13392b485fdd008",
|
||||
"mode": "0o644",
|
||||
"landedPathChanged": false,
|
||||
"r1BlobEqual": true
|
||||
},
|
||||
{
|
||||
"path": "packages/harness/tests/pi-session.test.mjs",
|
||||
"r1Sha256": "6db5c3b7063baf933061e91e8bdf66740717dbb3066be3b70ac779fb17022094",
|
||||
"r2Sha256": "6db5c3b7063baf933061e91e8bdf66740717dbb3066be3b70ac779fb17022094",
|
||||
"mode": "0o644",
|
||||
"landedPathChanged": false,
|
||||
"r1BlobEqual": true
|
||||
},
|
||||
{
|
||||
"path": "packages/webui/tests/preview.test.mjs",
|
||||
"r1Sha256": "ada49ec100d75b3e739263593164b2798c378f3df0f38d73d80cf011ef16e234",
|
||||
"r2Sha256": "ada49ec100d75b3e739263593164b2798c378f3df0f38d73d80cf011ef16e234",
|
||||
"mode": "0o644",
|
||||
"landedPathChanged": false,
|
||||
"r1BlobEqual": true
|
||||
},
|
||||
{
|
||||
"path": "packages/webui/tests/proof-cli.test.mjs",
|
||||
"r1Sha256": "d3cec62f6eb8e2c1e0747f2a1bf1fc3f1a2122e45870d5a416d1830d3b6182cb",
|
||||
"r2Sha256": "d3cec62f6eb8e2c1e0747f2a1bf1fc3f1a2122e45870d5a416d1830d3b6182cb",
|
||||
"mode": "0o644",
|
||||
"landedPathChanged": false,
|
||||
"r1BlobEqual": true
|
||||
},
|
||||
{
|
||||
"path": "packages/webui/tests/serve.test.mjs",
|
||||
"r1Sha256": "36ecdfcb3d0d9a2411eec751421f770b5bb41ec2fbf9236c5794fb241fd3196b",
|
||||
"r2Sha256": "36ecdfcb3d0d9a2411eec751421f770b5bb41ec2fbf9236c5794fb241fd3196b",
|
||||
"mode": "0o644",
|
||||
"landedPathChanged": false,
|
||||
"r1BlobEqual": true
|
||||
},
|
||||
{
|
||||
"path": "packages/webui/tests/service.test.mjs",
|
||||
"r1Sha256": "c915239f0c223209baf84c96ec9f5ae2845fce7dd98ad46b073a96033aa7d6df",
|
||||
"r2Sha256": "845313239547ddbc478090b29f96385f0b8853e5087c572393be328e7075f578",
|
||||
"mode": "0o644",
|
||||
"landedPathChanged": true,
|
||||
"r1BlobEqual": false
|
||||
},
|
||||
{
|
||||
"path": "packages/webui/tests/tester-cli.test.mjs",
|
||||
"r1Sha256": "8bf4491f7982399b4162cfbe36d0b68888e99ceb2cbaefefc2361732dd95e0c8",
|
||||
"r2Sha256": "8bf4491f7982399b4162cfbe36d0b68888e99ceb2cbaefefc2361732dd95e0c8",
|
||||
"mode": "0o644",
|
||||
"landedPathChanged": false,
|
||||
"r1BlobEqual": true
|
||||
},
|
||||
{
|
||||
"path": "scripts/test-discord.sh",
|
||||
"r1Sha256": "c10af53b0717344026cb22462964f253c7401c5082ac6ef3722a89d9dfa5c661",
|
||||
"r2Sha256": "a5dcf783c51a5d5d184a357f91ebf9fa1c4e054f0cb84a3d1d7668f6156e025e",
|
||||
"mode": "0o755",
|
||||
"landedPathChanged": true,
|
||||
"r1BlobEqual": false
|
||||
},
|
||||
{
|
||||
"path": "scripts/test-foundation.sh",
|
||||
"r1Sha256": "2e11038e7f784ec4f539eb768f63bab0fab9c9940334388a1fe2d47ab9e2b008",
|
||||
"r2Sha256": "2e11038e7f784ec4f539eb768f63bab0fab9c9940334388a1fe2d47ab9e2b008",
|
||||
"mode": "0o755",
|
||||
"landedPathChanged": false,
|
||||
"r1BlobEqual": true
|
||||
},
|
||||
{
|
||||
"path": "scripts/test-queue.sh",
|
||||
"r1Sha256": "c270f181d1fa8b6d42ff4131c339beba786a8fd620bb66f8afdcec05e8b10868",
|
||||
"r2Sha256": "c270f181d1fa8b6d42ff4131c339beba786a8fd620bb66f8afdcec05e8b10868",
|
||||
"mode": "0o755",
|
||||
"landedPathChanged": false,
|
||||
"r1BlobEqual": true
|
||||
},
|
||||
{
|
||||
"path": "scripts/testing/README.md",
|
||||
"r1Sha256": "845db994e648f29f10efb5e6a4ddcf4be4e28798fc27f1eddf9d150f0e8b5319",
|
||||
"r2Sha256": "845db994e648f29f10efb5e6a4ddcf4be4e28798fc27f1eddf9d150f0e8b5319",
|
||||
"mode": "0o644",
|
||||
"landedPathChanged": false,
|
||||
"r1BlobEqual": true
|
||||
},
|
||||
{
|
||||
"path": "scripts/testing/gate-lane.mjs",
|
||||
"r1Sha256": "2e5decf42a546b1441c199337c9a3162693051f2299878f617dd039d6231f226",
|
||||
"r2Sha256": "2e5decf42a546b1441c199337c9a3162693051f2299878f617dd039d6231f226",
|
||||
"mode": "0o644",
|
||||
"landedPathChanged": false,
|
||||
"r1BlobEqual": true
|
||||
},
|
||||
{
|
||||
"path": "scripts/testing/gate-lane.sh",
|
||||
"r1Sha256": "41804d964c55dd07b6224855aae9dc44037f4e80c515c10f98fe04d6d3fa0084",
|
||||
"r2Sha256": "41804d964c55dd07b6224855aae9dc44037f4e80c515c10f98fe04d6d3fa0084",
|
||||
"mode": "0o755",
|
||||
"landedPathChanged": false,
|
||||
"r1BlobEqual": true
|
||||
},
|
||||
{
|
||||
"path": "scripts/testing/lane-docker.mjs",
|
||||
"r1Sha256": "fbe54165439923a852f64d69a6188ef29d237755289e9e21ddbfdab00e9ef933",
|
||||
"r2Sha256": "fbe54165439923a852f64d69a6188ef29d237755289e9e21ddbfdab00e9ef933",
|
||||
"mode": "0o644",
|
||||
"landedPathChanged": false,
|
||||
"r1BlobEqual": true
|
||||
},
|
||||
{
|
||||
"path": "scripts/testing/lane-evidence.mjs",
|
||||
"r1Sha256": "51d4dcff4ab01730b923e0a59c218f9a3d33e6ba729be1def03703bc457fb37e",
|
||||
"r2Sha256": "51d4dcff4ab01730b923e0a59c218f9a3d33e6ba729be1def03703bc457fb37e",
|
||||
"mode": "0o644",
|
||||
"landedPathChanged": false,
|
||||
"r1BlobEqual": true
|
||||
},
|
||||
{
|
||||
"path": "scripts/testing/lane-fixtures.mjs",
|
||||
"r1Sha256": "8634070d68bca694c8a58911eda9576991ed0eca1eb055a2c1bbf10261305939",
|
||||
"r2Sha256": "8634070d68bca694c8a58911eda9576991ed0eca1eb055a2c1bbf10261305939",
|
||||
"mode": "0o644",
|
||||
"landedPathChanged": false,
|
||||
"r1BlobEqual": true
|
||||
},
|
||||
{
|
||||
"path": "scripts/testing/lane-image.mjs",
|
||||
"r1Sha256": "2259045913b4e3042b7afd3ff6a0fb9c2cc9b4cf359f943e4dce9b8658b91982",
|
||||
"r2Sha256": "2259045913b4e3042b7afd3ff6a0fb9c2cc9b4cf359f943e4dce9b8658b91982",
|
||||
"mode": "0o644",
|
||||
"landedPathChanged": false,
|
||||
"r1BlobEqual": true
|
||||
},
|
||||
{
|
||||
"path": "scripts/testing/lane-state.mjs",
|
||||
"r1Sha256": "c37b3d5ec3025948dd8150d18d4ccc4eeb3539739ca37e4d86edede5bcafd1a8",
|
||||
"r2Sha256": "c37b3d5ec3025948dd8150d18d4ccc4eeb3539739ca37e4d86edede5bcafd1a8",
|
||||
"mode": "0o644",
|
||||
"landedPathChanged": false,
|
||||
"r1BlobEqual": true
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -1,19 +0,0 @@
|
||||
packages/cli/tests/gate-lane-fixtures.test.mjs
|
||||
packages/cli/tests/gate-lane-image.test.mjs
|
||||
packages/cli/tests/gate-lane-state.test.mjs
|
||||
packages/cli/tests/gate-lane.test.mjs
|
||||
packages/cli/tests/stack-instances.test.mjs
|
||||
packages/cli/tests/stack-release-external.test.mjs
|
||||
packages/cli/tests/stack-release.test.mjs
|
||||
packages/cli/tests/stack-upgrade.test.mjs
|
||||
packages/control-board/tests/serve.test.mjs
|
||||
packages/harness/tests/claude-session.test.mjs
|
||||
packages/harness/tests/pi-session.test.mjs
|
||||
packages/webui/tests/preview.test.mjs
|
||||
packages/webui/tests/proof-cli.test.mjs
|
||||
packages/webui/tests/serve.test.mjs
|
||||
packages/webui/tests/service.test.mjs
|
||||
packages/webui/tests/tester-cli.test.mjs
|
||||
scripts/test-discord.sh
|
||||
scripts/test-foundation.sh
|
||||
scripts/test-queue.sh
|
||||
@@ -1,45 +0,0 @@
|
||||
diff --git a/packages/cli/tests/stack-release.test.mjs b/packages/cli/tests/stack-release.test.mjs
|
||||
index 8788158c3..a78f52062 100644
|
||||
--- a/packages/cli/tests/stack-release.test.mjs
|
||||
+++ b/packages/cli/tests/stack-release.test.mjs
|
||||
@@ -0,0 +1,2 @@
|
||||
+import { leasePort } from '../../../scripts/testing/lane-fixtures.mjs';
|
||||
+import { after as laneAfter } from 'node:test';
|
||||
@@ -1777 +1779 @@ const TESTER='7499';
|
||||
-const freePort=async()=>{const s=createServer();s.listen(0,'127.0.0.1');await once(s,'listening');const p=String(s.address().port);await new Promise((r)=>s.close(r));return p};
|
||||
+const freePort=async()=>String(await leasePort({after:laneAfter},{closed:true}));
|
||||
diff --git a/packages/webui/tests/service.test.mjs b/packages/webui/tests/service.test.mjs
|
||||
index a6e66608a..adb460d07 100644
|
||||
--- a/packages/webui/tests/service.test.mjs
|
||||
+++ b/packages/webui/tests/service.test.mjs
|
||||
@@ -0,0 +1,2 @@
|
||||
+import { leasePort } from '../../../scripts/testing/lane-fixtures.mjs';
|
||||
+import { after as laneAfter } from 'node:test';
|
||||
@@ -48,9 +50 @@ function filled(flags, root = REPO) {
|
||||
-async function closedPort() {
|
||||
- const server = createServer();
|
||||
- server.listen(0, '127.0.0.1');
|
||||
- await once(server, 'listening');
|
||||
- const { port } = server.address();
|
||||
- server.close();
|
||||
- await once(server, 'close');
|
||||
- return port;
|
||||
-}
|
||||
+async function closedPort() { return leasePort({after:laneAfter}, {closed:true}); }
|
||||
diff --git a/scripts/test-discord.sh b/scripts/test-discord.sh
|
||||
index 114994936..4daf0d143 100755
|
||||
--- a/scripts/test-discord.sh
|
||||
+++ b/scripts/test-discord.sh
|
||||
@@ -73,0 +74,2 @@ TOOLS_JSON="{\"roots\":[{\"name\":\"docs\",\"path\":\"$SANDBOX/toolroot\"}],\"ma
|
||||
+export PI_CODING_AGENT_DIR="$SANDBOX/pi-agent"
|
||||
+mkdir -p "$PI_CODING_AGENT_DIR"
|
||||
@@ -145 +147,8 @@ fi
|
||||
-node_tests() { env -u NODE_TEST_CONTEXT node --test "$@"; }
|
||||
+node_tests() {
|
||||
+ local lane_concurrency=()
|
||||
+ if [ -n "${MOSAIC_TEST_CONCURRENCY:-}" ]; then
|
||||
+ [ "$MOSAIC_TEST_CONCURRENCY" = 2 ] || return 2
|
||||
+ lane_concurrency=(--test-concurrency=2)
|
||||
+ fi
|
||||
+ env -u NODE_TEST_CONTEXT node --test "${lane_concurrency[@]}" "$@"
|
||||
+}
|
||||
@@ -1,235 +0,0 @@
|
||||
{
|
||||
"base": "c771a36f4bd0b6c359282425c668996a90072f93",
|
||||
"priorCandidate": "a3b7cbde8ef51c206a83769a7c272e4f9a1de5bc",
|
||||
"originalCandidate": "6318f0d0bba9ee90ccaa3503cac8c2e04c6397f2ef6c3564f687fbc2092989e3",
|
||||
"overlap": [
|
||||
"packages/cli/tests/stack-release.test.mjs"
|
||||
],
|
||||
"rows": [
|
||||
{
|
||||
"path": "packages/cli/tests/fixtures/gate-lane-child.mjs",
|
||||
"r1Sha256": "209682b968e929da4b46dc97c64fcd7aa68c490f3c6be44595f5d85f8d2e1483",
|
||||
"priorCandidateSha256": "209682b968e929da4b46dc97c64fcd7aa68c490f3c6be44595f5d85f8d2e1483",
|
||||
"newSha256": "209682b968e929da4b46dc97c64fcd7aa68c490f3c6be44595f5d85f8d2e1483",
|
||||
"unchangedFromPrior": true,
|
||||
"overlaps234": false,
|
||||
"mode": "0o644"
|
||||
},
|
||||
{
|
||||
"path": "packages/cli/tests/gate-lane-fixtures.test.mjs",
|
||||
"r1Sha256": "29afa181804a724c695678eb9459c156e00f1084647c704e814c5bee156c0c25",
|
||||
"priorCandidateSha256": "29afa181804a724c695678eb9459c156e00f1084647c704e814c5bee156c0c25",
|
||||
"newSha256": "29afa181804a724c695678eb9459c156e00f1084647c704e814c5bee156c0c25",
|
||||
"unchangedFromPrior": true,
|
||||
"overlaps234": false,
|
||||
"mode": "0o644"
|
||||
},
|
||||
{
|
||||
"path": "packages/cli/tests/gate-lane-image.test.mjs",
|
||||
"r1Sha256": "0253621a49c2e77ffcdbf32beee7e1f773ec2c52c8487dcc5aa254e61807af7c",
|
||||
"priorCandidateSha256": "0253621a49c2e77ffcdbf32beee7e1f773ec2c52c8487dcc5aa254e61807af7c",
|
||||
"newSha256": "0253621a49c2e77ffcdbf32beee7e1f773ec2c52c8487dcc5aa254e61807af7c",
|
||||
"unchangedFromPrior": true,
|
||||
"overlaps234": false,
|
||||
"mode": "0o644"
|
||||
},
|
||||
{
|
||||
"path": "packages/cli/tests/gate-lane-state.test.mjs",
|
||||
"r1Sha256": "948d62c76447d8269f03518562a261564c202ec9207461fb21d2b1c11c9bb9fc",
|
||||
"priorCandidateSha256": "948d62c76447d8269f03518562a261564c202ec9207461fb21d2b1c11c9bb9fc",
|
||||
"newSha256": "948d62c76447d8269f03518562a261564c202ec9207461fb21d2b1c11c9bb9fc",
|
||||
"unchangedFromPrior": true,
|
||||
"overlaps234": false,
|
||||
"mode": "0o644"
|
||||
},
|
||||
{
|
||||
"path": "packages/cli/tests/gate-lane.test.mjs",
|
||||
"r1Sha256": "240bf0c15025ad6f88b251917a3c8d72bd21c2e5df6771e1ceb83a1d90b24a51",
|
||||
"priorCandidateSha256": "240bf0c15025ad6f88b251917a3c8d72bd21c2e5df6771e1ceb83a1d90b24a51",
|
||||
"newSha256": "240bf0c15025ad6f88b251917a3c8d72bd21c2e5df6771e1ceb83a1d90b24a51",
|
||||
"unchangedFromPrior": true,
|
||||
"overlaps234": false,
|
||||
"mode": "0o644"
|
||||
},
|
||||
{
|
||||
"path": "packages/cli/tests/stack-release.test.mjs",
|
||||
"r1Sha256": "8ca733a600d5f5534d7e14d8533e1b16d710ebd43080ef8421238b5dd145fade",
|
||||
"priorCandidateSha256": "b95c0c125b6a283961e24adc07d43150bcbd05d2f11005180b836043015c52a6",
|
||||
"newSha256": "071ea2803b8c7e0450bb4c86ac9b49ae7c180af1599dca52bfce6d0274ca205b",
|
||||
"unchangedFromPrior": false,
|
||||
"overlaps234": true,
|
||||
"mode": "0o644"
|
||||
},
|
||||
{
|
||||
"path": "packages/control-board/tests/serve.test.mjs",
|
||||
"r1Sha256": "4838cb4609da28fc921370c5542a82402fbc9ceb469692a36f0eafc713bb56c8",
|
||||
"priorCandidateSha256": "4838cb4609da28fc921370c5542a82402fbc9ceb469692a36f0eafc713bb56c8",
|
||||
"newSha256": "4838cb4609da28fc921370c5542a82402fbc9ceb469692a36f0eafc713bb56c8",
|
||||
"unchangedFromPrior": true,
|
||||
"overlaps234": false,
|
||||
"mode": "0o644"
|
||||
},
|
||||
{
|
||||
"path": "packages/harness/tests/claude-session.test.mjs",
|
||||
"r1Sha256": "0a09b0255e9144a039428eb8e9f56181f94ccb2d187e474ea13392b485fdd008",
|
||||
"priorCandidateSha256": "0a09b0255e9144a039428eb8e9f56181f94ccb2d187e474ea13392b485fdd008",
|
||||
"newSha256": "0a09b0255e9144a039428eb8e9f56181f94ccb2d187e474ea13392b485fdd008",
|
||||
"unchangedFromPrior": true,
|
||||
"overlaps234": false,
|
||||
"mode": "0o644"
|
||||
},
|
||||
{
|
||||
"path": "packages/harness/tests/pi-session.test.mjs",
|
||||
"r1Sha256": "6db5c3b7063baf933061e91e8bdf66740717dbb3066be3b70ac779fb17022094",
|
||||
"priorCandidateSha256": "6db5c3b7063baf933061e91e8bdf66740717dbb3066be3b70ac779fb17022094",
|
||||
"newSha256": "6db5c3b7063baf933061e91e8bdf66740717dbb3066be3b70ac779fb17022094",
|
||||
"unchangedFromPrior": true,
|
||||
"overlaps234": false,
|
||||
"mode": "0o644"
|
||||
},
|
||||
{
|
||||
"path": "packages/webui/tests/preview.test.mjs",
|
||||
"r1Sha256": "ada49ec100d75b3e739263593164b2798c378f3df0f38d73d80cf011ef16e234",
|
||||
"priorCandidateSha256": "ada49ec100d75b3e739263593164b2798c378f3df0f38d73d80cf011ef16e234",
|
||||
"newSha256": "ada49ec100d75b3e739263593164b2798c378f3df0f38d73d80cf011ef16e234",
|
||||
"unchangedFromPrior": true,
|
||||
"overlaps234": false,
|
||||
"mode": "0o644"
|
||||
},
|
||||
{
|
||||
"path": "packages/webui/tests/proof-cli.test.mjs",
|
||||
"r1Sha256": "d3cec62f6eb8e2c1e0747f2a1bf1fc3f1a2122e45870d5a416d1830d3b6182cb",
|
||||
"priorCandidateSha256": "d3cec62f6eb8e2c1e0747f2a1bf1fc3f1a2122e45870d5a416d1830d3b6182cb",
|
||||
"newSha256": "d3cec62f6eb8e2c1e0747f2a1bf1fc3f1a2122e45870d5a416d1830d3b6182cb",
|
||||
"unchangedFromPrior": true,
|
||||
"overlaps234": false,
|
||||
"mode": "0o644"
|
||||
},
|
||||
{
|
||||
"path": "packages/webui/tests/serve.test.mjs",
|
||||
"r1Sha256": "36ecdfcb3d0d9a2411eec751421f770b5bb41ec2fbf9236c5794fb241fd3196b",
|
||||
"priorCandidateSha256": "36ecdfcb3d0d9a2411eec751421f770b5bb41ec2fbf9236c5794fb241fd3196b",
|
||||
"newSha256": "36ecdfcb3d0d9a2411eec751421f770b5bb41ec2fbf9236c5794fb241fd3196b",
|
||||
"unchangedFromPrior": true,
|
||||
"overlaps234": false,
|
||||
"mode": "0o644"
|
||||
},
|
||||
{
|
||||
"path": "packages/webui/tests/service.test.mjs",
|
||||
"r1Sha256": "c915239f0c223209baf84c96ec9f5ae2845fce7dd98ad46b073a96033aa7d6df",
|
||||
"priorCandidateSha256": "845313239547ddbc478090b29f96385f0b8853e5087c572393be328e7075f578",
|
||||
"newSha256": "845313239547ddbc478090b29f96385f0b8853e5087c572393be328e7075f578",
|
||||
"unchangedFromPrior": true,
|
||||
"overlaps234": false,
|
||||
"mode": "0o644"
|
||||
},
|
||||
{
|
||||
"path": "packages/webui/tests/tester-cli.test.mjs",
|
||||
"r1Sha256": "8bf4491f7982399b4162cfbe36d0b68888e99ceb2cbaefefc2361732dd95e0c8",
|
||||
"priorCandidateSha256": "8bf4491f7982399b4162cfbe36d0b68888e99ceb2cbaefefc2361732dd95e0c8",
|
||||
"newSha256": "8bf4491f7982399b4162cfbe36d0b68888e99ceb2cbaefefc2361732dd95e0c8",
|
||||
"unchangedFromPrior": true,
|
||||
"overlaps234": false,
|
||||
"mode": "0o644"
|
||||
},
|
||||
{
|
||||
"path": "scripts/test-discord.sh",
|
||||
"r1Sha256": "c10af53b0717344026cb22462964f253c7401c5082ac6ef3722a89d9dfa5c661",
|
||||
"priorCandidateSha256": "a5dcf783c51a5d5d184a357f91ebf9fa1c4e054f0cb84a3d1d7668f6156e025e",
|
||||
"newSha256": "a5dcf783c51a5d5d184a357f91ebf9fa1c4e054f0cb84a3d1d7668f6156e025e",
|
||||
"unchangedFromPrior": true,
|
||||
"overlaps234": false,
|
||||
"mode": "0o755"
|
||||
},
|
||||
{
|
||||
"path": "scripts/test-foundation.sh",
|
||||
"r1Sha256": "2e11038e7f784ec4f539eb768f63bab0fab9c9940334388a1fe2d47ab9e2b008",
|
||||
"priorCandidateSha256": "2e11038e7f784ec4f539eb768f63bab0fab9c9940334388a1fe2d47ab9e2b008",
|
||||
"newSha256": "2e11038e7f784ec4f539eb768f63bab0fab9c9940334388a1fe2d47ab9e2b008",
|
||||
"unchangedFromPrior": true,
|
||||
"overlaps234": false,
|
||||
"mode": "0o755"
|
||||
},
|
||||
{
|
||||
"path": "scripts/test-queue.sh",
|
||||
"r1Sha256": "c270f181d1fa8b6d42ff4131c339beba786a8fd620bb66f8afdcec05e8b10868",
|
||||
"priorCandidateSha256": "c270f181d1fa8b6d42ff4131c339beba786a8fd620bb66f8afdcec05e8b10868",
|
||||
"newSha256": "c270f181d1fa8b6d42ff4131c339beba786a8fd620bb66f8afdcec05e8b10868",
|
||||
"unchangedFromPrior": true,
|
||||
"overlaps234": false,
|
||||
"mode": "0o755"
|
||||
},
|
||||
{
|
||||
"path": "scripts/testing/README.md",
|
||||
"r1Sha256": "845db994e648f29f10efb5e6a4ddcf4be4e28798fc27f1eddf9d150f0e8b5319",
|
||||
"priorCandidateSha256": "845db994e648f29f10efb5e6a4ddcf4be4e28798fc27f1eddf9d150f0e8b5319",
|
||||
"newSha256": "845db994e648f29f10efb5e6a4ddcf4be4e28798fc27f1eddf9d150f0e8b5319",
|
||||
"unchangedFromPrior": true,
|
||||
"overlaps234": false,
|
||||
"mode": "0o644"
|
||||
},
|
||||
{
|
||||
"path": "scripts/testing/gate-lane.mjs",
|
||||
"r1Sha256": "2e5decf42a546b1441c199337c9a3162693051f2299878f617dd039d6231f226",
|
||||
"priorCandidateSha256": "2e5decf42a546b1441c199337c9a3162693051f2299878f617dd039d6231f226",
|
||||
"newSha256": "2e5decf42a546b1441c199337c9a3162693051f2299878f617dd039d6231f226",
|
||||
"unchangedFromPrior": true,
|
||||
"overlaps234": false,
|
||||
"mode": "0o644"
|
||||
},
|
||||
{
|
||||
"path": "scripts/testing/gate-lane.sh",
|
||||
"r1Sha256": "41804d964c55dd07b6224855aae9dc44037f4e80c515c10f98fe04d6d3fa0084",
|
||||
"priorCandidateSha256": "41804d964c55dd07b6224855aae9dc44037f4e80c515c10f98fe04d6d3fa0084",
|
||||
"newSha256": "41804d964c55dd07b6224855aae9dc44037f4e80c515c10f98fe04d6d3fa0084",
|
||||
"unchangedFromPrior": true,
|
||||
"overlaps234": false,
|
||||
"mode": "0o755"
|
||||
},
|
||||
{
|
||||
"path": "scripts/testing/lane-docker.mjs",
|
||||
"r1Sha256": "fbe54165439923a852f64d69a6188ef29d237755289e9e21ddbfdab00e9ef933",
|
||||
"priorCandidateSha256": "fbe54165439923a852f64d69a6188ef29d237755289e9e21ddbfdab00e9ef933",
|
||||
"newSha256": "fbe54165439923a852f64d69a6188ef29d237755289e9e21ddbfdab00e9ef933",
|
||||
"unchangedFromPrior": true,
|
||||
"overlaps234": false,
|
||||
"mode": "0o644"
|
||||
},
|
||||
{
|
||||
"path": "scripts/testing/lane-evidence.mjs",
|
||||
"r1Sha256": "51d4dcff4ab01730b923e0a59c218f9a3d33e6ba729be1def03703bc457fb37e",
|
||||
"priorCandidateSha256": "51d4dcff4ab01730b923e0a59c218f9a3d33e6ba729be1def03703bc457fb37e",
|
||||
"newSha256": "51d4dcff4ab01730b923e0a59c218f9a3d33e6ba729be1def03703bc457fb37e",
|
||||
"unchangedFromPrior": true,
|
||||
"overlaps234": false,
|
||||
"mode": "0o644"
|
||||
},
|
||||
{
|
||||
"path": "scripts/testing/lane-fixtures.mjs",
|
||||
"r1Sha256": "8634070d68bca694c8a58911eda9576991ed0eca1eb055a2c1bbf10261305939",
|
||||
"priorCandidateSha256": "8634070d68bca694c8a58911eda9576991ed0eca1eb055a2c1bbf10261305939",
|
||||
"newSha256": "8634070d68bca694c8a58911eda9576991ed0eca1eb055a2c1bbf10261305939",
|
||||
"unchangedFromPrior": true,
|
||||
"overlaps234": false,
|
||||
"mode": "0o644"
|
||||
},
|
||||
{
|
||||
"path": "scripts/testing/lane-image.mjs",
|
||||
"r1Sha256": "2259045913b4e3042b7afd3ff6a0fb9c2cc9b4cf359f943e4dce9b8658b91982",
|
||||
"priorCandidateSha256": "2259045913b4e3042b7afd3ff6a0fb9c2cc9b4cf359f943e4dce9b8658b91982",
|
||||
"newSha256": "2259045913b4e3042b7afd3ff6a0fb9c2cc9b4cf359f943e4dce9b8658b91982",
|
||||
"unchangedFromPrior": true,
|
||||
"overlaps234": false,
|
||||
"mode": "0o644"
|
||||
},
|
||||
{
|
||||
"path": "scripts/testing/lane-state.mjs",
|
||||
"r1Sha256": "c37b3d5ec3025948dd8150d18d4ccc4eeb3539739ca37e4d86edede5bcafd1a8",
|
||||
"priorCandidateSha256": "c37b3d5ec3025948dd8150d18d4ccc4eeb3539739ca37e4d86edede5bcafd1a8",
|
||||
"newSha256": "c37b3d5ec3025948dd8150d18d4ccc4eeb3539739ca37e4d86edede5bcafd1a8",
|
||||
"unchangedFromPrior": true,
|
||||
"overlaps234": false,
|
||||
"mode": "0o644"
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -1,47 +0,0 @@
|
||||
Compared 57f59e0c3 to c771a36f4bd0b6c359282425c668996a90072f93
|
||||
agents/gizmoduck/work/queue-234/BUILD.md
|
||||
docs/SESSIONS.md
|
||||
packages/bus/README.md
|
||||
packages/bus/schema.sql
|
||||
packages/bus/src/broker.mjs
|
||||
packages/bus/src/credentials.mjs
|
||||
packages/bus/src/host-grant.mjs
|
||||
packages/bus/src/host-run.mjs
|
||||
packages/bus/src/migrations/3i-3j.sql
|
||||
packages/bus/src/runtime.mjs
|
||||
packages/bus/src/server.mjs
|
||||
packages/bus/src/store.mjs
|
||||
packages/bus/tests/account-migration.test.mjs
|
||||
packages/bus/tests/chief-of-staff.test.mjs
|
||||
packages/bus/tests/comment-migration.test.mjs
|
||||
packages/bus/tests/fixtures/schema-3i.sql
|
||||
packages/bus/tests/grant-enroll.test.mjs
|
||||
packages/bus/tests/grant-migration.test.mjs
|
||||
packages/bus/tests/hard-waits.test.mjs
|
||||
packages/bus/tests/host-fixtures.mjs
|
||||
packages/bus/tests/host-run.test.mjs
|
||||
packages/bus/tests/host-tools.test.mjs
|
||||
packages/bus/tests/name-migration.test.mjs
|
||||
packages/bus/tests/project-runtime.test.mjs
|
||||
packages/bus/tests/schema.test.mjs
|
||||
packages/bus/tests/spec-fixtures.mjs
|
||||
packages/bus/tests/spec-migration.test.mjs
|
||||
packages/bus/tests/thread-migration.test.mjs
|
||||
packages/bus/tests/usage-migration.test.mjs
|
||||
packages/business/src/business.mjs
|
||||
packages/business/src/hosts.mjs
|
||||
packages/business/tests/hosts.test.mjs
|
||||
packages/cli/README.md
|
||||
packages/cli/src/cli.mjs
|
||||
packages/cli/src/hosts.mjs
|
||||
packages/cli/tests/hosts.test.mjs
|
||||
packages/cli/tests/stack-release.test.mjs
|
||||
scripts/mosaic
|
||||
tools/host/mosaic-keys
|
||||
tools/host/mosaic-keys-write
|
||||
tools/host/mosaic-keys.sshd.conf
|
||||
tools/host/mosaic-keys.sudoers
|
||||
|
||||
Overlap with row 197 source manifest:
|
||||
packages/cli/tests/stack-release.test.mjs
|
||||
Other 24 source paths: no overlap.
|
||||
@@ -1,10 +0,0 @@
|
||||
diff --git a/packages/cli/tests/stack-release.test.mjs b/packages/cli/tests/stack-release.test.mjs
|
||||
index daae6efb7..910785bc4 100644
|
||||
--- a/packages/cli/tests/stack-release.test.mjs
|
||||
+++ b/packages/cli/tests/stack-release.test.mjs
|
||||
@@ -0,0 +1,2 @@
|
||||
+import { leasePort } from '../../../scripts/testing/lane-fixtures.mjs';
|
||||
+import { after as laneAfter } from 'node:test';
|
||||
@@ -1779 +1781 @@ const TESTER='7499';
|
||||
-const freePort=async()=>{const s=createServer();s.listen(0,'127.0.0.1');await once(s,'listening');const p=String(s.address().port);await new Promise((r)=>s.close(r));return p};
|
||||
+const freePort=async()=>String(await leasePort({after:laneAfter},{closed:true}));
|
||||
@@ -1,5 +0,0 @@
|
||||
{
|
||||
"base": "fefd54e13",
|
||||
"prior": "9aa6d52d9",
|
||||
"overlaps": []
|
||||
}
|
||||
@@ -1,6 +0,0 @@
|
||||
{
|
||||
"base": "b1fece6f0",
|
||||
"r6": "df0c59608",
|
||||
"r6Base": "fefd54e13",
|
||||
"overlaps": []
|
||||
}
|
||||
@@ -1,11 +0,0 @@
|
||||
--- a/scripts/testing/lane-docker.mjs
|
||||
+++ b/scripts/testing/lane-docker.mjs
|
||||
@@ -34,7 +34,7 @@
|
||||
const service=argv.indexOf('mosaic-agent',2);
|
||||
if(service<0||argv.slice(2,service).some(a=>!['--rm','-T','--no-deps','--interactive','-i'].includes(a)))refuse('Docker Compose run options not allowed');
|
||||
const [base,override]=composeFiles(run);
|
||||
- return ['compose','-f',base,'-f',override,'run','--pull','never','--no-deps',...argv.slice(2)];
|
||||
+ return ['compose','-f',base,'-f',override,'run','--no-build','--pull','never','--no-deps',...argv.slice(2)];
|
||||
}
|
||||
refuse('Docker mutation or unowned command');
|
||||
}
|
||||
@@ -1,6 +0,0 @@
|
||||
{
|
||||
"base": "5c6f73ed7",
|
||||
"r7": "9c3166915",
|
||||
"r7Base": "b1fece6f0",
|
||||
"overlaps": []
|
||||
}
|
||||
@@ -1,11 +0,0 @@
|
||||
--- a/packages/cli/tests/gate-lane-image.test.mjs
|
||||
+++ b/packages/cli/tests/gate-lane-image.test.mjs
|
||||
@@ -85,7 +85,7 @@
|
||||
// including when the lane's guard is first on PATH. Child fixture env stays
|
||||
// isolated; passing the real absolute path avoids re-entering that guard.
|
||||
function installedDocker(){
|
||||
- const file=process.env.MOSAIC_GATE_DOCKER_RECORD;
|
||||
+ const file=undefined; // mutant: lose the lane's real-binary lookup
|
||||
if(!file)return 'docker';
|
||||
const binary=JSON.parse(readFileSync(file,'utf8')).docker;
|
||||
assert.ok(typeof binary==='string'&&isAbsolute(binary),'lane record must name the real absolute Docker binary');
|
||||
@@ -1,399 +0,0 @@
|
||||
# Row 215 build record
|
||||
|
||||
Owner: Herb. Reviewer: Filbert. Claim: herb-215-start, rev 2753.
|
||||
Brief: docs/plans/2026-10-20_case2-rows.md, C2-04, pin
|
||||
16847e94ae1768881711318fe81cbb5e6c66b971. Design: Gosalyn r11,
|
||||
sections 1.1, 1.3, 2.1, M4, M9 and 7.2.
|
||||
|
||||
Base: a2c72ac952df94ecab7e391d5042f49b7f88b816, row 212's reviewed
|
||||
candidate, under Q177. Branch: herb/row215. Rebuild on the combined 212+197
|
||||
landing when Sage names it. Do not replay or revert landed changes.
|
||||
|
||||
## Scope rulings (sage-1848)
|
||||
|
||||
1. Add packages/bus/src/runtime.mjs for library adapter injection and the
|
||||
library skip in protectedRoots. The skip has its own consumer test. Change
|
||||
nothing else there.
|
||||
2. Add packages/library/src/mirror.mjs, named mirror rather than store. It
|
||||
creates a bare mirror without a remote, reads at the served commit and
|
||||
reads sync state. Export one state filename constant, and export this
|
||||
module through packages/library/src/index.mjs. Row 222 imports the constant.
|
||||
3. Add packages/bus/src/server.mjs only to await library.file and
|
||||
library.status, with socket tests proving their replies are results, not {}.
|
||||
4. HTTP exposure is deferred. Row 225 owns the library.status route;
|
||||
C2-11b owns library pages. Leave serve.mjs alone. webui/src/cli.mjs gets
|
||||
only callback wiring next to the project-file callbacks on both listeners.
|
||||
5. Reuse existing refusal codes where possible.
|
||||
6. Build on a2c72ac95 until Sage supplies the 212 landing SHA.
|
||||
|
||||
Additional ruling, sage-1852: library-state-invalid is approved for malformed,
|
||||
unsafe or mismatched state, including a missing file while the served ref
|
||||
exists. The version-1 shared contract below is approved. Row 222 also owns
|
||||
runtime.mjs for its sync and timer wiring, recorded in that row's manifest.
|
||||
|
||||
Additional rulings, sage-1860, after Filbert's CHANGES on 6a508804f:
|
||||
|
||||
- B1 adds packages/cli/src/config.mjs and cli/tests/trackers-boot.test.mjs.
|
||||
trackerFor skips library entries. A real bus boot with tracker.baseUrl and
|
||||
a library entry succeeds and gets no tracker from that entry.
|
||||
- B2 refuses a role publish grant naming a library project in the loader.
|
||||
- B3 readers use the sync lock. mirror.mjs exports withLibraryLock, with a
|
||||
5000 ms wait bound and library-sync-busy on timeout. Sync locks only the
|
||||
served-ref move and state publication, never the fetch.
|
||||
- N3, git-socket doPush/recordPush accepting a library ID, is a later row.
|
||||
Sage records it in DEFERRED.md when 215 lands. No fix here.
|
||||
|
||||
## Shared contract with row 222
|
||||
|
||||
Agreed in herb-0048, megavolt-0081/0082 and sage-1852. This section is the
|
||||
contract Filbert reviews and Megavolt cites for Dewey. It is not a sync writer.
|
||||
|
||||
Module: packages/library/src/mirror.mjs. Export
|
||||
`SYNC_STATE_FILE = 'mosaic-library-sync.json'`. The full path is
|
||||
`join(mirror, SYNC_STATE_FILE)`, inside the bare repository. Only sync.mjs
|
||||
writes it, using a sibling temp file, fsync, rename, and directory fsync.
|
||||
|
||||
Version 1 has exactly these keys:
|
||||
|
||||
```json
|
||||
{
|
||||
"version": 1,
|
||||
"branch": "main",
|
||||
"served": null,
|
||||
"lastFetch": null,
|
||||
"lastError": null,
|
||||
"diverged": null,
|
||||
"problems": []
|
||||
}
|
||||
```
|
||||
|
||||
- branch is the configured mapping branch and must match the reader's branch.
|
||||
- served is null or a full lowercase 40-hex commit ID. refs/heads/served is
|
||||
authority. The state value must equal that ref, which must name a commit.
|
||||
- lastFetch is null or a canonical ISO UTC timestamp.
|
||||
- lastError is null or exactly {code, at}. code matches [a-z-]{1,64}; at is
|
||||
canonical ISO UTC. It never holds stderr, prose or a credential value.
|
||||
- diverged is null or exactly {commit, at}, with the same commit/time rules.
|
||||
- problems uses C2-01's exact {code, path, message, line?}. code is R1-R7,
|
||||
message is that code's fixed RULES text, line is a positive safe integer
|
||||
when present. No file body or arbitrary message is accepted.
|
||||
- An absent file and absent served ref return the empty object above with
|
||||
the configured branch. An absent file with an existing served ref refuses.
|
||||
- Unknown keys, bad types, unsafe filesystem metadata, invalid JSON and a
|
||||
mismatch refuse library-state-invalid. Reads use a bounded regular owned
|
||||
private file without following links. The read never repairs state.
|
||||
- refs/remotes/library/<branch> is not duplicated in this file. Row 222 may
|
||||
read it when it needs the fetched tip.
|
||||
|
||||
Exports consumed by row 222:
|
||||
|
||||
| Export | Contract |
|
||||
| --- | --- |
|
||||
| mirrorPath({business, project, dataRoot}) | Require a library entry; return projectRepo's checked path |
|
||||
| ensureMirror(context) | Promise of the mirror path; race-safe idempotent bare init; no remote or fetch |
|
||||
| servedCommit(mirror) | Promise of full commit ID or null; refs/heads/served only |
|
||||
| readSyncState(mirror, {branch}) | Promise of checked version-1 state; compare with served ref |
|
||||
| withLibraryLock(mirror, operation) | Await the same exclusive lock as readers, then await operation({readSyncState}); always release |
|
||||
|
||||
The lock is a stable private regular file, mosaic-library-sync.lock inside
|
||||
the mirror. It is never unlinked. A kernel flock is held by the caller's
|
||||
file descriptor. Acquisition waits at most 5000 ms and refuses
|
||||
library-sync-busy on timeout. Unsafe lock metadata refuses library-state-invalid.
|
||||
|
||||
There is no fs.flock API. The exact protocol is: open the stable file with
|
||||
O_NOFOLLOW, check regular/private/owned/single-link metadata, pass its fd as
|
||||
child FD 3 to `flock --exclusive --wait 5 --conflict-exit-code 75 3` using
|
||||
asynchronous spawn, await
|
||||
that child's exit 0, then run the callback while the parent still holds its
|
||||
original descriptor. Both descriptors share the open file description, so
|
||||
the lock survives acquisition-child exit. Finally close the parent's fd.
|
||||
Process death also closes it. No holder child stays alive in the callback,
|
||||
no stale file is deleted, and unrelated operation children inherit only 0-2.
|
||||
Acquisition never uses spawnSync: the bus must serve other calls while a
|
||||
library reader waits (megavolt-0087).
|
||||
|
||||
A scratch-only probe on node v26.8.1 at 2026-10-21T08:34:00Z confirmed this:
|
||||
acquisition child exited 0; a second flock -n returned 1 while the parent fd
|
||||
stayed open; after closeSync it returned 0. The probe removed its own root.
|
||||
This was a design probe, not a package test, suite, Docker command or proof.
|
||||
|
||||
readSyncState takes that lock around reading the served ref and state file.
|
||||
The callback-scoped readSyncState({branch}) supplied by withLibraryLock reads
|
||||
under the already-held lock and does not reacquire it. The helper awaits
|
||||
asynchronous callbacks and releases in finally. A callback-scoped reader
|
||||
used after its callback ends refuses; it cannot escape its lock lifetime.
|
||||
|
||||
Row 222 fetches without this lock, then calls withLibraryLock across the
|
||||
served-ref move and atomic state write. Its tests hold publication between
|
||||
those steps and prove a concurrent reader waits, then sees the new consistent
|
||||
pair, including first sync. Row 215 tests that publication shape and timeout.
|
||||
A file read releases the lock after snapshotting a consistent served SHA,
|
||||
then reads that immutable commit. Row 222's separate outer sync lock spans
|
||||
fetch to prevent two sync operations interleaving (megavolt-0086).
|
||||
|
||||
Host adapter exports for this row:
|
||||
|
||||
- libraryStatus(context): return {project, ...state}, with no repository path
|
||||
or content. Do not fetch or rebuild on this read.
|
||||
- readLibraryFile({...context, path}): read a mapped, readable file at the
|
||||
served commit, returning {project, path, commit, content}. No caller-picked
|
||||
commit, working-tree fallback, fetch or write. C2-01's R1/R2/R7 exclusions
|
||||
apply. A never-synced mirror refuses library-commit for a file read.
|
||||
|
||||
Row 222 owns syncCommand, sync, writeSyncState, its outer sync lock, the timer
|
||||
and state publication. Row 215 owns the shared publication/read lock per
|
||||
sage-1860. Sync rebuilds problems with existing readLibrary({repo, commit,
|
||||
mapping}). It does not need a second rebuild function from this row.
|
||||
|
||||
## Root consumer audit and reviewer notes
|
||||
|
||||
On a2c72ac95, ran exactly the sage-1860 audit:
|
||||
`git grep -n 'entry\.root\|\.root)' -- 'packages/*/src/*.mjs'`.
|
||||
It has 14 hits. runtime.mjs:95, business/cli.mjs:61,72,78,118,
|
||||
instance-settings.mjs:142-143, resolve.mjs:44, cli/config.mjs:62-63 and
|
||||
project/paths.mjs:42 all get the library guard in this row. business.mjs:233
|
||||
and :242 are code-project validation after the library dispatch, not an
|
||||
unguarded consumer. queue.mjs:1144 compares queue genesis roots and never
|
||||
iterates business.projects; it is safe and unchanged. A second search for
|
||||
projectFilePath/business.projects/b.projects found no additional root reader.
|
||||
ensureCheckouts destructures root rather than spelling .root; its guard and
|
||||
the launcher's filter remain in T1. Bare projectFilePath/loadProject remain
|
||||
strict and unchanged.
|
||||
|
||||
Filbert N1 is handled at the existing owned paths.mjs boundary: projectRepo
|
||||
defaults to record-project use and refuses a library entry with project-invalid.
|
||||
Only mirrorPath's internal call opts into allowLibrary. Thus ordinary human
|
||||
and tester project init cannot occupy an uninitialized library mirror path.
|
||||
No record API or bus argument exposes that internal option.
|
||||
|
||||
Filbert N2: ensureMirror failure refuses bus boot. No socket becomes ready.
|
||||
The runtime closes resources it opened, following its existing failure path.
|
||||
A T4 test uses an unsafe/pre-existing mirror and proves the refusal, rather
|
||||
than serving a half-configured library adapter.
|
||||
|
||||
## Verification record
|
||||
|
||||
Planning stage. No product code, package test, suite, image build, live operation
|
||||
or push for row 215 has happened. Product implementation awaits Filbert's
|
||||
manifest approval. Sage owns suite and full-gate grants. Row 197's proof
|
||||
commit is separate and is not part of this row's changes.
|
||||
|
||||
## Implementation ledger
|
||||
|
||||
Plan: agents/herb/work/queue-215/MANIFEST.md at 2522025af, approved by
|
||||
Filbert in the reply to herb-0056. Execution is inline by Herb under the
|
||||
executing-plans and test-driven-development skills. No agent delegation.
|
||||
|
||||
Pre-flight: T1's validated mapping feeds T2's protected document and T3's
|
||||
mirror context; T3's lock/state helpers feed T4's injected host adapter.
|
||||
The shared contract is pinned above, with no interface conflict found.
|
||||
|
||||
Sage-1867 overrides COMMON's singles allowance: every test and executable
|
||||
probe needs an explicit slot grant. No further probe/test has run since
|
||||
that reminder. Read-only inspection and test authoring continue while the
|
||||
slot is held. The first red execution is pending; product code is unchanged.
|
||||
|
||||
Filbert's approved-manifest build notes: ensureMirror creates the lock in
|
||||
its staged directory before publication; a missing lock in an existing
|
||||
mirror refuses library-state-invalid. The top-level metadata allowlist
|
||||
permits only normal bare Git entries plus the state and stable lock files.
|
||||
Tests cover an unknown entry. The host needs /usr/bin/flock; ENOENT yields
|
||||
a handled library-state-invalid refusal, never an unhandled child error.
|
||||
Lock acquisition uses /usr/bin/flock directly and asynchronous spawn.
|
||||
|
||||
T1: consumer and loader regression tests authored, not run. T2: direct M9
|
||||
write and serialization regression tests authored, not run. No completion
|
||||
or passing claim is made for either task.
|
||||
|
||||
Update, sage-1869 focused slot, 2026-10-21T08:47:48Z to 08:51:07Z:
|
||||
the busy check was CLEAR before the first test. T1's mapping regression
|
||||
failed 0/1 on unsupported kind as expected, then passed 2/0 with the publish
|
||||
refusal included. Other focused greens: business CLI 1/0, resolver 1/0,
|
||||
instance settings 1/0, seat checkout 1/0, project paths 1/0, sandboxed launcher
|
||||
1/0, and trackers-boot whole 2/0. T2's direct writer case failed 0/1 on the
|
||||
missing refusal, then its whole new file passed 4/0. Green total 14/0 with
|
||||
no skips or cancellations. Logs and counts: granted-t1/. The final /proc
|
||||
scan found no test process or fixture cwd/argv reference; its private root
|
||||
was removed. Clear sent as herb-0062. Existing files' other cases have not
|
||||
been run yet, so T1/T2's full-file acceptance is still pending.
|
||||
|
||||
Sage-1874 directs continued authoring and implementation while the landing
|
||||
gate/proof holds the slot. T3/T4 tests were written first. Their initial
|
||||
red runs cannot execute during that hold; implementation proceeds under
|
||||
that owner direction, with no claim of a witnessed red or green for T3/T4.
|
||||
Their baseline red and candidate checks need a later explicit grant.
|
||||
|
||||
Implementation ruling: initialization uses GNU /usr/bin/mv --no-clobber
|
||||
--no-target-directory for its bounded staging rename, rather than Node's
|
||||
renameSync, which could replace an empty directory made by a competing
|
||||
actor. This preserves pre-existing directories and needs no new package on
|
||||
the Linux/coreutils bus host. The host also needs /usr/bin/flock. Neither
|
||||
command has been executed for T3/T4 yet. Publication errors fail closed.
|
||||
Sync-state reads are capped at 8 MiB, including a checked extra byte; an
|
||||
oversized or concurrently changed file refuses library-state-invalid.
|
||||
|
||||
T5 static dependency audit found two partial pinned-copy fixtures that copy
|
||||
business/src but not its newly imported library mapping validator:
|
||||
cli/tests/stack-release.test.mjs:1772 and stack-release-fixture.mjs:309 on
|
||||
the base. Each now includes packages/library/src in the existing copy list.
|
||||
This changes fixture closure only, no assertion or timeout. The complete
|
||||
stack-release file and each test file importing that shared fixture require
|
||||
a later granted single-file run. They are outside the four-file T3/T4 slot.
|
||||
|
||||
Sage-1879 places the four-file T3/T4 focused run after their 212+197 proof,
|
||||
before Gizmoduck, and requires their explicit clear before starting. No run
|
||||
has occurred after herb-0062. Row 197's N7 base-image-tag finding is left to
|
||||
Sage's DEFERRED entry; no row 197 source change is made here.
|
||||
|
||||
|
||||
Focused T3/T4 grant sage-1882, 2026-10-21 09:13-09:18Z: busy check
|
||||
CLEAR. Final whole-file results: mirror 16/0, bus library 6/0, WebUI
|
||||
library-cli 1/0, project-runtime 3/0, all with zero skips/cancellations.
|
||||
Syntax checks passed for the four files and five changed host modules.
|
||||
Logs, all intermediate failures, counts and empty /proc cleanup scan are
|
||||
in granted-t34/. Baseline a2c72ac95: three focused bus cases 0/3
|
||||
(unknown-verb), CLI 0/1 (missing callbacks). Mirror baseline 0/1 is an
|
||||
import refusal for the new module, not a witnessed behavioral red.
|
||||
An initial whole baseline bus attempt left a runtime after its expected
|
||||
failure; its exact runner was stopped, no process remained, and the
|
||||
baseline was narrowed to the three bounded broker/socket cases.
|
||||
Candidate fixture setup errors and a mock-child timeout were corrected
|
||||
before the final whole-file passes. No suite or Docker/image/proof ran.
|
||||
|
||||
Filbert's 09:09 publication note: no dependence on mv -n's skipped-rename
|
||||
exit status across coreutils versions. Save staging dev/ino before mv;
|
||||
only its disappearance plus the same dev/ino at the mirror proves a win.
|
||||
A remaining original staging inode means a loss, requiring a valid winner.
|
||||
Only that owned original staging inode is removed. Numeric no-clobber
|
||||
statuses 0 and 1, including a diagnostic, are tested with a competing
|
||||
winner. Spawn errors, signals/timeouts and inconsistent outcomes refuse.
|
||||
Coreutils must provide atomic --no-clobber --no-target-directory semantics;
|
||||
it need not use any particular skipped-rename status convention.
|
||||
|
||||
|
||||
Landing update: prepared herb/row215-on212 on fefd54e13 (includes row 212
|
||||
landing ee7b2f137), without history replay or stash. Only BUILD-LOG.md and
|
||||
cli/tests/stack-release.test.mjs overlap the a2c72ac95-to-landing change
|
||||
set. BUILD-LOG preserves all landed entries and appends the existing Herb
|
||||
entry. stack-release preserves the landing plus only the library/src copy
|
||||
list addition. No test has run on this landing yet. All further execution
|
||||
requires a Sage grant (supersedes the original COMMON singles rule).
|
||||
|
||||
|
||||
Sage-1979 early singles on fefd54e13, stopped after file10 per sage-1983:
|
||||
- packages/bus/tests/library.test.mjs: 6/0
|
||||
- packages/bus/tests/project-runtime.test.mjs: 3/0
|
||||
- packages/business/tests/business.test.mjs: 18/0
|
||||
- packages/business/tests/cli.test.mjs: 10/0
|
||||
- packages/business/tests/instance-settings.test.mjs: 12/0
|
||||
- packages/business/tests/library-projects-protected.test.mjs: 4/0
|
||||
- packages/business/tests/resolve.test.mjs: 11/0
|
||||
- packages/cli/tests/launcher.test.mjs: 30/0
|
||||
- packages/cli/tests/stack-release-external.test.mjs: 25/0
|
||||
- packages/cli/tests/stack-release.test.mjs: 196/0
|
||||
|
||||
Total315/0, zero skips/cancellations. This is an early read only, not gate
|
||||
evidence for a merged candidate. The sequential driver was paused during
|
||||
file10 so it could not start file11, then terminated after file10 exited0.
|
||||
No file11 log exists. Results/logs are in granted-singles/. Later landed
|
||||
overlaps require a new branch and all16 singles again after their merge.
|
||||
|
||||
|
||||
Current merge preparation per sage-1983/1987: new branch
|
||||
herb/row215-on-f827 on f8276c5eb3ecb0aad353ee65e3dd8f7faac5dd87.
|
||||
Nine landed overlaps are recorded in current-MERGE.json and the exact
|
||||
candidate deltas against the landing are in current-merge-only.patch.
|
||||
Two textual conflicts were resolved manually: Broker keeps hostKeys and
|
||||
adds library; business.mjs keeps CREATIVE_DEFINITIONS and adds checkMapping.
|
||||
The other seven merges preserve the landing plus the original C2-04 edits.
|
||||
All other product/test paths match the early215 tree byte for byte. The
|
||||
landing's BUILD-LOG is preserved and the existing Herb entry is appended.
|
||||
No history replay, stash, force push, branch deletion or source commit.
|
||||
No test/probe/syntax check ran on the merged tree after the slot was cleared.
|
||||
All16 whole singles need a new Sage grant before candidate commit/review.
|
||||
The10 old-base315/0 results are early reads only, never merged gate evidence.
|
||||
|
||||
|
||||
## Source candidate and sage-2008 receipts
|
||||
|
||||
Source commit: e333af4dc7af3a9d3789c8c0db26a0df8bdddfee, on
|
||||
f8276c5eb3ecb0aad353ee65e3dd8f7faac5dd87. SOURCE.json records all30
|
||||
changed source/phase-log paths with blob SHA256 and Git mode. The next
|
||||
commit contains only this packet. No product change follows the tests.
|
||||
|
||||
Sage-2008: start13:15:15.548943Z; end13:27:27.279728Z, 2026-10-21.
|
||||
Each of the16 TEST-FILES.txt files ran whole, sequentially. All451 passed,
|
||||
with0 failed/skipped/cancelled. Per-file outputs are in granted-2008/;
|
||||
EVIDENCE.json records their counts, Node durations and log hashes.
|
||||
|
||||
| File | Pass/fail |
|
||||
| --- | ---: |
|
||||
| packages/bus/tests/library.test.mjs | 6/0 |
|
||||
| packages/bus/tests/project-runtime.test.mjs | 3/0 |
|
||||
| packages/business/tests/business.test.mjs | 19/0 |
|
||||
| packages/business/tests/cli.test.mjs | 10/0 |
|
||||
| packages/business/tests/instance-settings.test.mjs | 13/0 |
|
||||
| packages/business/tests/library-projects-protected.test.mjs | 4/0 |
|
||||
| packages/business/tests/resolve.test.mjs | 11/0 |
|
||||
| packages/cli/tests/launcher.test.mjs | 31/0 |
|
||||
| packages/cli/tests/stack-release-external.test.mjs | 25/0 |
|
||||
| packages/cli/tests/stack-release.test.mjs | 196/0 |
|
||||
| packages/cli/tests/stack-upgrade.test.mjs | 21/0 |
|
||||
| packages/cli/tests/trackers-boot.test.mjs | 2/0 |
|
||||
| packages/library/tests/mirror.test.mjs | 16/0 |
|
||||
| packages/project/tests/project.test.mjs | 15/0 |
|
||||
| packages/seat/tests/checkout.test.mjs | 78/0 |
|
||||
| packages/webui/tests/library-cli.test.mjs | 1/0 |
|
||||
|
||||
All29 product/test hashes equal their pre-run values. The final /proc cwd
|
||||
and argv scan was empty; the private test root was removed. Clear sent
|
||||
as herb-0082 at13:28:38Z. No further runs occurred. No image, Docker,
|
||||
lane, proof or full suite was part of this grant.
|
||||
|
||||
Before commit, checked f8276c5eb..8a04f4aa4 on every215 source path and
|
||||
all16 test paths: no overlap. Row248's grant-executor test is outside them.
|
||||
The current root-consumer grep still returns14 sites, all classified by
|
||||
the earlier audit: business code roots after dispatch, guarded library
|
||||
skips at consumers, and queue's unrelated genesis-root invariant.
|
||||
|
||||
Sage-2016 authorizes the source commit, packet receipts and seat-only push,
|
||||
then Filbert's candidate review. The landing gate stays with Sage. Earlier
|
||||
focused and old-base receipts are archived in granted-t1/, granted-t34/
|
||||
and granted-singles/, with their limits kept above. Full package/shell
|
||||
landing checks and implementation approval remain pending. No HTTP route,
|
||||
remote fetch, sync writer, timer or live operation was added.
|
||||
|
||||
Raw Node error logs retain their original space-only lines. Packet whitespace
|
||||
checks exclude *.log so the recorded output bytes stay unchanged; source and
|
||||
other packet files pass the ordinary diff check.
|
||||
|
||||
## Merge-scoped round 2 after rows 249 and 197 (sage-2054)
|
||||
|
||||
Row197 landed as a36523713 after proof6 passed 8/8 gates. Row249's
|
||||
broker fix is also in this base. Source a6101e21c596e2972ab5a7e3087736075899505e, single parent a3652371338e60187d4e95cee4a0f30f3c8a8f06,
|
||||
is on the new herb/row215-on197 branch. The old branch stays untouched.
|
||||
No force push, branch deletion or stash was used. The merge was clean.
|
||||
|
||||
Only broker.mjs and stack-release.test.mjs changed upstream among the30
|
||||
source/phase-log paths. Both retain every landed hunk. The broker keeps
|
||||
row249's installed flag and hostLineLeft handling. The stack-release test
|
||||
keeps row197's leasePort import, after hook and closed-port lease helper;
|
||||
215 adds only its library fixture copy. The other28 blobs and all modes
|
||||
match the prior source. All30 paths have exactly the same -U0 added and
|
||||
removed lines as f8276c5eb..e333af4dc. BUILD-LOG.md is append-only.
|
||||
|
||||
Stable patch-id, old and new: d191e7e9586cd3b7c18310daacdf0c1fdbc8be01.
|
||||
r2-range-diff.txt reports only the commit message changed (!); its patch
|
||||
is unchanged.
|
||||
r2-MERGE.json records every path; r2-merge-only.patch contains both merged
|
||||
source diffs against the new base. SOURCE.json names the new source.
|
||||
|
||||
Filbert approved round1 in comment30071, rev2897. This round requests
|
||||
merge-only review. The earlier451/0 receipts belong to the prior base;
|
||||
no test, probe, syntax check, Docker command or lane ran in this round.
|
||||
Merged-tree evidence remains pending Sage's explicit clear.
|
||||
r2-TEST-FILES.txt proposes all16 original whole singles plus all66
|
||||
bus test files whose local import closure reaches broker.mjs, deduplicated
|
||||
to80 whole files. This includes shared fixture and runtime imports.
|
||||
Sage's slot and row196 landing gate come first. The full landing gate
|
||||
remains Sage's. No library behavior, assertion or timeout changed.
|
||||
@@ -1,261 +0,0 @@
|
||||
{
|
||||
"grant": "sage-2008",
|
||||
"sourceCommit": "e333af4dc7af3a9d3789c8c0db26a0df8bdddfee",
|
||||
"base": "f8276c5eb3ecb0aad353ee65e3dd8f7faac5dd87",
|
||||
"start": "2026-10-21T13:15:15.548778+00:00",
|
||||
"end": "2026-10-21T13:27:27.279728+00:00",
|
||||
"summary": {
|
||||
"tests": 451,
|
||||
"pass": 451,
|
||||
"fail": 0,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
},
|
||||
"results": [
|
||||
{
|
||||
"file": "packages/bus/tests/library.test.mjs",
|
||||
"rc": 0,
|
||||
"counts": {
|
||||
"tests": 6,
|
||||
"pass": 6,
|
||||
"fail": 0,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
},
|
||||
"log": "01-packages_bus_tests_library.test.mjs.log",
|
||||
"sha256": "c19016583abc936534f41bde26eb39e095496eda944622142b1d18ffd5018bc0",
|
||||
"nodeDurationMs": 359.869493
|
||||
},
|
||||
{
|
||||
"file": "packages/bus/tests/project-runtime.test.mjs",
|
||||
"rc": 0,
|
||||
"counts": {
|
||||
"tests": 3,
|
||||
"pass": 3,
|
||||
"fail": 0,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
},
|
||||
"log": "02-packages_bus_tests_project-runtime.test.mjs.log",
|
||||
"sha256": "f123231042d1562fee6dad3d885ac587967e0287f63603c861d04c1907363530",
|
||||
"nodeDurationMs": 312.717335
|
||||
},
|
||||
{
|
||||
"file": "packages/business/tests/business.test.mjs",
|
||||
"rc": 0,
|
||||
"counts": {
|
||||
"tests": 19,
|
||||
"pass": 19,
|
||||
"fail": 0,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
},
|
||||
"log": "03-packages_business_tests_business.test.mjs.log",
|
||||
"sha256": "ae990ebccf7f21b9b32fd9c25fdd637873251c078e17dd95471b82b548322980",
|
||||
"nodeDurationMs": 199.91256
|
||||
},
|
||||
{
|
||||
"file": "packages/business/tests/cli.test.mjs",
|
||||
"rc": 0,
|
||||
"counts": {
|
||||
"tests": 10,
|
||||
"pass": 10,
|
||||
"fail": 0,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
},
|
||||
"log": "04-packages_business_tests_cli.test.mjs.log",
|
||||
"sha256": "28512dc38e2bce04294048a2f1c7dc7cf0c322028f874d1d35aa83b87570ea54",
|
||||
"nodeDurationMs": 2381.258516
|
||||
},
|
||||
{
|
||||
"file": "packages/business/tests/instance-settings.test.mjs",
|
||||
"rc": 0,
|
||||
"counts": {
|
||||
"tests": 13,
|
||||
"pass": 13,
|
||||
"fail": 0,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
},
|
||||
"log": "05-packages_business_tests_instance-settings.test.mjs.log",
|
||||
"sha256": "146623624012da1399fb4ee3de4c0e13df1af28caae81f4870315a67ac368f8f",
|
||||
"nodeDurationMs": 608.08011
|
||||
},
|
||||
{
|
||||
"file": "packages/business/tests/library-projects-protected.test.mjs",
|
||||
"rc": 0,
|
||||
"counts": {
|
||||
"tests": 4,
|
||||
"pass": 4,
|
||||
"fail": 0,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
},
|
||||
"log": "06-packages_business_tests_library-projects-protected.test.mjs.log",
|
||||
"sha256": "675ae18523218ab70a4addee039f41df6ae08ee414f20527f975a2004dde65b2",
|
||||
"nodeDurationMs": 118.54831
|
||||
},
|
||||
{
|
||||
"file": "packages/business/tests/resolve.test.mjs",
|
||||
"rc": 0,
|
||||
"counts": {
|
||||
"tests": 11,
|
||||
"pass": 11,
|
||||
"fail": 0,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
},
|
||||
"log": "07-packages_business_tests_resolve.test.mjs.log",
|
||||
"sha256": "6557938cb8e6d79617c0ea911a6e0ad7303cf5a4f9dd5a5631c70d093e6b06fe",
|
||||
"nodeDurationMs": 94.022587
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/launcher.test.mjs",
|
||||
"rc": 0,
|
||||
"counts": {
|
||||
"tests": 31,
|
||||
"pass": 31,
|
||||
"fail": 0,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
},
|
||||
"log": "08-packages_cli_tests_launcher.test.mjs.log",
|
||||
"sha256": "c3404f1931595914d469cb00a951a5e1648f7792733c86bddbfa099552e5791c",
|
||||
"nodeDurationMs": 24989.261794
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release-external.test.mjs",
|
||||
"rc": 0,
|
||||
"counts": {
|
||||
"tests": 25,
|
||||
"pass": 25,
|
||||
"fail": 0,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
},
|
||||
"log": "09-packages_cli_tests_stack-release-external.test.mjs.log",
|
||||
"sha256": "55224b6204d4d05a4cb669fb2845aa4168ab868223c3f341ab026032c47458b4",
|
||||
"nodeDurationMs": 96332.465778
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"rc": 0,
|
||||
"counts": {
|
||||
"tests": 196,
|
||||
"pass": 196,
|
||||
"fail": 0,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
},
|
||||
"log": "10-packages_cli_tests_stack-release.test.mjs.log",
|
||||
"sha256": "3f7430ce1f28482a5b66fc0e7db76969298f0dd32c3793e242bc10110dc44e6e",
|
||||
"nodeDurationMs": 533493.817869
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-upgrade.test.mjs",
|
||||
"rc": 0,
|
||||
"counts": {
|
||||
"tests": 21,
|
||||
"pass": 21,
|
||||
"fail": 0,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
},
|
||||
"log": "11-packages_cli_tests_stack-upgrade.test.mjs.log",
|
||||
"sha256": "d18a3eff64b39a5128ab7e842721748b214dc3037ecc9d2c93c58f023859d695",
|
||||
"nodeDurationMs": 60456.446459
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/trackers-boot.test.mjs",
|
||||
"rc": 0,
|
||||
"counts": {
|
||||
"tests": 2,
|
||||
"pass": 2,
|
||||
"fail": 0,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
},
|
||||
"log": "12-packages_cli_tests_trackers-boot.test.mjs.log",
|
||||
"sha256": "22e56455a6a56c98b02f942ed3d38504e4f8486343235c4035c88b967625bce5",
|
||||
"nodeDurationMs": 502.723687
|
||||
},
|
||||
{
|
||||
"file": "packages/library/tests/mirror.test.mjs",
|
||||
"rc": 0,
|
||||
"counts": {
|
||||
"tests": 16,
|
||||
"pass": 16,
|
||||
"fail": 0,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
},
|
||||
"log": "13-packages_library_tests_mirror.test.mjs.log",
|
||||
"sha256": "def30105a3d561118e360535d9d3129226361f2e7902f316e47c74f65f1c0e47",
|
||||
"nodeDurationMs": 5963.543966
|
||||
},
|
||||
{
|
||||
"file": "packages/project/tests/project.test.mjs",
|
||||
"rc": 0,
|
||||
"counts": {
|
||||
"tests": 15,
|
||||
"pass": 15,
|
||||
"fail": 0,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
},
|
||||
"log": "14-packages_project_tests_project.test.mjs.log",
|
||||
"sha256": "e63ab0d23ab24aa1f1f2c1ea8017e8541f415dcb20dff697a37bb7a6368e174d",
|
||||
"nodeDurationMs": 355.86586
|
||||
},
|
||||
{
|
||||
"file": "packages/seat/tests/checkout.test.mjs",
|
||||
"rc": 0,
|
||||
"counts": {
|
||||
"tests": 78,
|
||||
"pass": 78,
|
||||
"fail": 0,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
},
|
||||
"log": "15-packages_seat_tests_checkout.test.mjs.log",
|
||||
"sha256": "c9e7168f589047b8176ec4ee8d2f03adb9fb68f692b363ba6d0036f670811ede",
|
||||
"nodeDurationMs": 4880.907448
|
||||
},
|
||||
{
|
||||
"file": "packages/webui/tests/library-cli.test.mjs",
|
||||
"rc": 0,
|
||||
"counts": {
|
||||
"tests": 1,
|
||||
"pass": 1,
|
||||
"fail": 0,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
},
|
||||
"log": "16-packages_webui_tests_library-cli.test.mjs.log",
|
||||
"sha256": "1ca5b92bc4f2de9ef6aa7156cdea62742fb9ddf054ebfb56a9548431e0cfec0d",
|
||||
"nodeDurationMs": 191.536271
|
||||
}
|
||||
],
|
||||
"cleanup": {
|
||||
"processes": [],
|
||||
"removed": "/mnt/storage/scratch/gt-j5nm6iqn",
|
||||
"sourceHashesUnchanged": 29
|
||||
},
|
||||
"drift": {
|
||||
"base": "f8276c5eb",
|
||||
"tip": "8a04f4aa4aba493eb89e92aa9e0c34084be7058e",
|
||||
"overlap": []
|
||||
},
|
||||
"earlierRuns": {
|
||||
"granted-t1": "focused T1/T2 red/green on a2c72ac95",
|
||||
"granted-t34": "focused T3/T4 with baseline import refusal and corrected fixture errors recorded",
|
||||
"granted-singles": "old fefd54e13 early315/0, not merged gate evidence"
|
||||
},
|
||||
"mergeRound": {
|
||||
"sourceCommit": "a6101e21c596e2972ab5a7e3087736075899505e",
|
||||
"base": "a3652371338e60187d4e95cee4a0f30f3c8a8f06",
|
||||
"status": "not-run; awaiting Sage clear",
|
||||
"priorReceipts": "sage-2008 receipts apply to e333af4dc on f8276c5eb only"
|
||||
}
|
||||
}
|
||||
@@ -1,246 +0,0 @@
|
||||
# C2-04 library business entry implementation plan
|
||||
|
||||
> Execution: Herb implements in this session using the executing-plans skill.
|
||||
> Filbert approves this manifest before any product implementation.
|
||||
|
||||
**Goal:** Load a library mapping without giving an agent a checkout, protect
|
||||
all project mappings from organization writes, and expose human-only bus
|
||||
reads of the bare mirror's served commit and sync status.
|
||||
|
||||
**Architecture:** C2-01 checks mappings and reads commits. Business consumers
|
||||
skip library entries. A host-only mirror module owns local mirror reads and
|
||||
initialization. runtime.mjs injects that module into the broker, preserving
|
||||
the broker's sandbox import closure. Sync and HTTP routes belong to later rows.
|
||||
|
||||
**Tech stack:** Existing Node ESM, node:test and bounded local Git helpers.
|
||||
No dependencies. node_modules remains the plain canonical symlink.
|
||||
|
||||
**Spec:** Pinned C2-04 brief; Gosalyn's approved design 1.1, 1.3, 2.1,
|
||||
M4/M9 and 7.2; BUILD.md's sage-1848/1852/1860 scope and shared-state contract.
|
||||
|
||||
## Constraints and review focus
|
||||
|
||||
- Base a2c72ac95; rebase only onto Sage's named 212 landing on a new branch.
|
||||
- Existing code-project entries retain root/repo/remote behavior. Library
|
||||
entries have no root or repo override and use C2-01 checkMapping.
|
||||
- Preserve the broker's pinned imports. No library import in broker.mjs and
|
||||
no new runner mount. Do not edit serve.mjs or add an HTTP route.
|
||||
- No fetch, remote config, credential read, timer, sync writer, bus write or
|
||||
live operation. All tests use made-up content and local repositories.
|
||||
- All test/probe runs require Sage's grant (sage-1867), including singles.
|
||||
Stop and report two failures in one gate. Do not push without authorization.
|
||||
|
||||
Review focus, with owning tasks below: library-first iteration must not
|
||||
break a later code project (T1); serialized documents cannot bypass M9
|
||||
(T2); racing initialization must not replace another mirror (T3); stale or
|
||||
unsafe state must not leak content (T3); async socket replies must preserve
|
||||
the result and human-only admission (T4).
|
||||
|
||||
## Paths and evidence from the base
|
||||
|
||||
| Product path | Allowed change |
|
||||
| --- | --- |
|
||||
| packages/business/src/business.mjs | Dispatch kind:library to checkMapping before code-root validation (:228-244) |
|
||||
| packages/business/src/organization.mjs | Compare canonical projects in write before publication (:177 onward) |
|
||||
| packages/business/src/cli.mjs | Skip library roots in validate, resolve --project and credential exclusion roots (:60-61, :71-79, :118) |
|
||||
| packages/business/src/resolve.mjs | Skip library entries while matching a project file (:44) |
|
||||
| packages/business/src/instance-settings.mjs | Skip library before projectFilePath (:142), nothing else |
|
||||
| packages/seat/src/checkout.mjs | Skip library entries in ensureCheckouts (:315-327) |
|
||||
| packages/cli/src/launcher.mjs | Pass only code entries to ensureCheckouts (:354) |
|
||||
| packages/cli/src/config.mjs | Skip library entries in trackerFor's root loop (:61-63), per sage-1860 |
|
||||
| packages/project/src/paths.mjs | Skip library entries in overlap loop (:41-44); default record use refuses library, mirrorPath internally opts into allowLibrary |
|
||||
| packages/library/src/mirror.mjs | New bare init, checked state and served-commit file read module |
|
||||
| packages/library/src/index.mjs | Export mirror module interface and SYNC_STATE_FILE |
|
||||
| packages/bus/src/broker.mjs | New injected library adapter, human-only admission and two async verbs |
|
||||
| packages/bus/src/runtime.mjs | Library adapter wiring, mirror initialization and protectedRoots skip only |
|
||||
| packages/bus/src/server.mjs | Await the two library verbs only |
|
||||
| packages/webui/src/cli.mjs | Two library read callbacks beside project callbacks on main and tester listener; no routes |
|
||||
|
||||
packages/business/src/project.mjs need not change: callers skip a library
|
||||
before projectFilePath or loadProject. Do not weaken their code-root checks.
|
||||
scripts/stack-copy.sh already copies packages/library/src and needs no edit.
|
||||
|
||||
Test paths to modify: business/tests/business.test.mjs, cli.test.mjs,
|
||||
resolve.test.mjs, instance-settings.test.mjs; seat/tests/checkout.test.mjs;
|
||||
cli/tests/launcher.test.mjs, trackers-boot.test.mjs; project/tests/project.test.mjs;
|
||||
bus/tests/project-runtime.test.mjs. All paths are under packages/.
|
||||
|
||||
T5 dependency-audit addition: cli/tests/stack-release.test.mjs and its
|
||||
stack-release-fixture.mjs helper copy packages/library/src alongside
|
||||
business/src, whose validator now imports the mapping checker. No assertions
|
||||
or timeouts change. Whole-file dependent singles require a later Sage slot.
|
||||
|
||||
New tests: packages/business/tests/library-projects-protected.test.mjs;
|
||||
packages/library/tests/mirror.test.mjs; packages/bus/tests/library.test.mjs;
|
||||
packages/webui/tests/library-cli.test.mjs. Reuse existing made-up fixtures.
|
||||
If a new fixture is needed, define it within the corresponding new test file.
|
||||
No unrelated test assertion or timeout changes.
|
||||
|
||||
Record paths: agents/herb/work/queue-215/{MANIFEST.md,BUILD.md}, later source
|
||||
manifest and test receipts there; one append-only BUILD-LOG.md phase for this
|
||||
row when implementation begins. Sage owns docs/SESSIONS.md.
|
||||
|
||||
## T1. Mapping and consumer skips
|
||||
|
||||
- [ ] Add failing business tests: accept a frozen library mapping without a
|
||||
root, retain mixed/only-library documents, and propagate C2-01's mapping
|
||||
and playground refusal codes. A role publish naming a library project
|
||||
refuses at load, even with an otherwise valid fork identity and remote.
|
||||
Existing code validation remains unchanged.
|
||||
- [ ] Add a separate regression for each consumer: CLI validate and its
|
||||
credential exclusion roots; CLI resolve --project books has no project
|
||||
layer; resolveInstance finds a later real project; instance settings still
|
||||
writes an unrelated setting; ensureCheckouts returns no library checkout;
|
||||
launcher creates no books workspace clone; projectRepo skips a library
|
||||
while still rejecting overlap with a real code root. Put books first.
|
||||
- [ ] Add the real bus boot regression in cli/tests/trackers-boot.test.mjs:
|
||||
tracker.baseUrl is set and books is a library entry; boot succeeds, books
|
||||
produces no tracker, and a later real tracker project still works.
|
||||
- [ ] projectRepo(context, {allowLibrary = false} = {}) refuses a library
|
||||
entry by default with project-invalid. Only mirrorPath opts in. Test that
|
||||
ordinary human and tester record initialization leave no directory at the
|
||||
future mirror path; no public verb can supply allowLibrary.
|
||||
- [ ] Add runtime's protectedRoots consumer regression in T4's real runtime
|
||||
fixture. A valid credential outside code/data roots still loads with a
|
||||
library entry, and existing credential protections still refuse unsafe files.
|
||||
- [ ] Run each changed test singly, confirm the new cases fail for the
|
||||
intended root assumption, then implement only the table's guards and
|
||||
checkMapping dispatch. Re-run the same files singly.
|
||||
|
||||
CLI validate reports a library entry as library, without an absent-project
|
||||
warning. CLI resolve --project books resolves without loading a project file,
|
||||
as the design's skip requires. It does not fabricate project vars or a root.
|
||||
|
||||
## T2. M9 at the organization writer
|
||||
|
||||
- [ ] In the new business test file, call organizationWriter.write directly
|
||||
with a changed playground prefix and, separately, a changed hybrid entry.
|
||||
Both refuse organization-projects-protected. Snapshot business bytes and
|
||||
changes.jsonl before each call; assert both remain identical afterward.
|
||||
- [ ] Cover addition, deletion and changes to code projects too, since M9
|
||||
protects all projects. Reordered object keys are allowed; array changes
|
||||
are changes. An ordinary non-project write still succeeds and logs.
|
||||
- [ ] Add a serialization regression so a proposed object's serialized
|
||||
projects cannot differ from those checked before publication.
|
||||
- [ ] Run the file singly to see the missing refusal, compare canonical
|
||||
projects against old disk JSON and the document that actually lands,
|
||||
before any publication/receipt, then re-run it singly.
|
||||
|
||||
## T3. Bare mirror, served file and read-only state
|
||||
|
||||
- [ ] Add failing tests for mirrorPath and ensureMirror: exact projectRepo
|
||||
default, no checkout/remote, retained no-links/overlap protections,
|
||||
idempotence, simultaneous creators and preservation of a pre-existing
|
||||
non-mirror directory or unsafe Git metadata.
|
||||
- [ ] Add failing state tests for BUILD.md's full version-1 contract: missing
|
||||
state/ref, valid state, malformed JSON, unknown keys/types, branch mismatch,
|
||||
invalid times/IDs/problem shape, symlink/hardlink/non-private file and
|
||||
missing or mismatched served ref. Assert reads change no bytes.
|
||||
- [ ] Add shared-lock tests: withLibraryLock(mirror, operation) waits at most
|
||||
5000 ms, refuses library-sync-busy on timeout and releases after a throw.
|
||||
A reader arriving between the publisher's served move and state write
|
||||
waits, then reads the consistent pair. Cover first sync and fast-forward
|
||||
in independent processes, same-process independent acquisitions and
|
||||
release after owner death. A callback-scoped reader expires on release.
|
||||
- [ ] Implement the lock by async spawn of flock on the parent's inherited
|
||||
fd 3, as pinned in BUILD.md. Await acquisition-child exit before calling
|
||||
operation. Never spawnSync during acquisition, which could freeze the bus
|
||||
for 5 s. A parallel ordinary bus read remains responsive while a library
|
||||
read waits. Only the publication/read lock is shared; fetch is outside it.
|
||||
- [ ] Add served-read tests against local fixtures containing spaces,
|
||||
capitals, a .canvas and unmapped top-level note. Seed a served ref and state
|
||||
without fetching. A newer unrelated HEAD does not change the returned
|
||||
file. R1/R2/R7 exclusions, traversal, a missing path, a caller commit and a
|
||||
never-synced mirror refuse. Status contains no fixture body marker.
|
||||
- [ ] Implement mirror.mjs and index exports using the shared contract.
|
||||
Initialization stages into an owned private sibling directory and renames
|
||||
atomically; a losing creator validates the winner and removes only its own
|
||||
staging directory. Git uses existing bounded safe helpers, no remote.
|
||||
- [ ] Run mirror.test.mjs singly, red then green. Re-run C2-01 reader.test.mjs
|
||||
singly if a reader assumption changes. Do not change C2-01 reader rules.
|
||||
|
||||
mirror.mjs validates a bare mirror's metadata before Git reads it, including
|
||||
no remote/include/indirection. It does not apply inspectGit's working-tree
|
||||
.git assumption to a bare repository. Failures reuse library-git or the
|
||||
approved library-state-invalid code. State reads are bounded and private.
|
||||
|
||||
## T4. Human-only bus reads and deferred Console callbacks
|
||||
|
||||
- [ ] Add broker tests for library.file and library.status using injected
|
||||
adapters. Each agent session refuses human-required before adapter access,
|
||||
including bad arguments and an absent adapter. A reader or tester does not
|
||||
gain a human capability. Human calls validate keys, then use checked
|
||||
library context. Secret checking and bounded refusal evidence remain.
|
||||
- [ ] Add real startBroker/socket tests for both verbs. Seed only local
|
||||
fixture mirror data. Assert result shape/content and an actual status
|
||||
field, not merely successful transport or {}. Cover never-synced status
|
||||
and runtime's protectedRoots skip. Keep the pinned import-closure test.
|
||||
- [ ] Inject a separate library adapter via runtime, initialize only library
|
||||
mirrors, add the two async request paths, and include them in server's
|
||||
awaited list. Do not import library or fs into broker.
|
||||
- [ ] Unsafe or pre-existing non-mirror initialization refuses bus boot,
|
||||
closes opened resources and never publishes a ready socket. Add that
|
||||
runtime regression in library.test.mjs.
|
||||
- [ ] Wire main and tester Console callbacks beside project-file callbacks.
|
||||
No HTTP route is shipped. The new CLI test captures the startServer
|
||||
options with a test-only module loader and calls the supplied callbacks
|
||||
against a fixture bus, checking the verb and transport identity. No
|
||||
product test seam, UI page, endpoint or serve.mjs change is needed.
|
||||
- [ ] Run library.test.mjs, project-runtime.test.mjs and library-cli.test.mjs
|
||||
individually, red then green. Human admission may use the existing
|
||||
fixture authentication seam; do not forge or bypass a live identity.
|
||||
|
||||
## T5. Review packet and Sage's gate
|
||||
|
||||
- [ ] Search packages/*/tests and scripts/test-*.sh for each changed source
|
||||
path, imports and 64-hex pins. Record the resulting test-file list and run
|
||||
each changed/touched test singly. Stop and report a scope error.
|
||||
- [ ] Self-review the diff against this manifest and all acceptance cases.
|
||||
Record results, commands, skips, source hashes and remaining limits in
|
||||
BUILD.md. Request Sage's slot for the required business, seat, cli, project,
|
||||
bus and webui suites and every scripts/test-*.sh. Do not run them ungranted.
|
||||
- [ ] After applicable tests are green, make the source commit, build the
|
||||
candidate manifest from the authorized pushed tip, and move the row with
|
||||
scripts/mosaic. Sage posts token-requiring requests; Filbert reviews the
|
||||
candidate. Push only when authorized. No merge or live change by Herb.
|
||||
|
||||
## Self-review
|
||||
|
||||
Every brief acceptance item is in T1-T4. Added host support paths match
|
||||
sage-1848/1860. BUILD.md records the complete 14-hit root audit. State shape
|
||||
and authority match sage-1852; the shared read/publication lock follows
|
||||
sage-1860 and Megavolt's agreement. Fetch, timers, outer sync serialization
|
||||
and HTTP stay with their later rows.
|
||||
This is a plan only; no product edits or test execution precede approval.
|
||||
|
||||
|
||||
Landing update: prepared herb/row215-on212 on fefd54e13 (includes row 212
|
||||
landing ee7b2f137), without history replay or stash. Only BUILD-LOG.md and
|
||||
cli/tests/stack-release.test.mjs overlap the a2c72ac95-to-landing change
|
||||
set. BUILD-LOG preserves all landed entries and appends the existing Herb
|
||||
entry. stack-release preserves the landing plus only the library/src copy
|
||||
list addition. No test has run on this landing yet. All further execution
|
||||
requires a Sage grant (supersedes the original COMMON singles rule).
|
||||
|
||||
|
||||
Current merge preparation per sage-1983/1987: new branch
|
||||
herb/row215-on-f827 on f8276c5eb3ecb0aad353ee65e3dd8f7faac5dd87.
|
||||
Nine landed overlaps are recorded in current-MERGE.json and the exact
|
||||
candidate deltas against the landing are in current-merge-only.patch.
|
||||
Two textual conflicts were resolved manually: Broker keeps hostKeys and
|
||||
adds library; business.mjs keeps CREATIVE_DEFINITIONS and adds checkMapping.
|
||||
The other seven merges preserve the landing plus the original C2-04 edits.
|
||||
All other product/test paths match the early215 tree byte for byte. The
|
||||
landing's BUILD-LOG is preserved and the existing Herb entry is appended.
|
||||
No history replay, stash, force push, branch deletion or source commit.
|
||||
No test/probe/syntax check ran on the merged tree after the slot was cleared.
|
||||
All16 whole singles need a new Sage grant before candidate commit/review.
|
||||
The10 old-base315/0 results are early reads only, never merged gate evidence.
|
||||
|
||||
|
||||
Candidate status: source commit e333af4dc7af3a9d3789c8c0db26a0df8bdddfee. The16 whole
|
||||
singles passed451/0 under sage-2008 with zero skips/cancellations; raw
|
||||
outputs and merge receipts are in this packet, indexed by EVIDENCE.json
|
||||
and SOURCE.json. Sage keeps the landing gate. Filbert's implementation
|
||||
review and that gate remain pending. Prior315/0 on fefd54e13 is early
|
||||
read evidence only. Sage-2016 authorizes the seat-only source/packet push.
|
||||
@@ -1,157 +0,0 @@
|
||||
{
|
||||
"sourceCommit": "a6101e21c596e2972ab5a7e3087736075899505e",
|
||||
"base": "a3652371338e60187d4e95cee4a0f30f3c8a8f06",
|
||||
"paths": [
|
||||
{
|
||||
"path": "BUILD-LOG.md",
|
||||
"sha256": "b7c8f906f2db095dfe02d29b4064836af83ae877a87b38c09466b8c9a327e019",
|
||||
"mode": "100644"
|
||||
},
|
||||
{
|
||||
"path": "packages/bus/src/broker.mjs",
|
||||
"sha256": "762234259d72db87aff510751fe14003099759ae37bc8eaf14f1ea1de61d2005",
|
||||
"mode": "100644"
|
||||
},
|
||||
{
|
||||
"path": "packages/bus/src/runtime.mjs",
|
||||
"sha256": "c759e665514a5bcad40536bc9f979837187fe6523462b3c0a0687182885c3ac6",
|
||||
"mode": "100644"
|
||||
},
|
||||
{
|
||||
"path": "packages/bus/src/server.mjs",
|
||||
"sha256": "207c7a76752c753ef7380f18f9ce1a4f23e8fa35142973b6358aaf0c45f44899",
|
||||
"mode": "100644"
|
||||
},
|
||||
{
|
||||
"path": "packages/bus/tests/library.test.mjs",
|
||||
"sha256": "58d839709e005571b398a11abda5a50f542bab0e37bd97b72f43cde926434301",
|
||||
"mode": "100644"
|
||||
},
|
||||
{
|
||||
"path": "packages/business/src/business.mjs",
|
||||
"sha256": "5fd3fee664d3e70153d988b4c1a42406f888a31b3927fa52375e66619d8cec59",
|
||||
"mode": "100644"
|
||||
},
|
||||
{
|
||||
"path": "packages/business/src/cli.mjs",
|
||||
"sha256": "31cfe9090900169416e1207dc6db865b046439273917e9de442add4159c89eb3",
|
||||
"mode": "100644"
|
||||
},
|
||||
{
|
||||
"path": "packages/business/src/instance-settings.mjs",
|
||||
"sha256": "3873411688d927336a909d0299acddeba92a653102c660d276471f5a0f6eebd3",
|
||||
"mode": "100644"
|
||||
},
|
||||
{
|
||||
"path": "packages/business/src/organization.mjs",
|
||||
"sha256": "eaa650499d2d078552a2c0e5b13a6126e0aca02f73160032a7325b3f5aa90964",
|
||||
"mode": "100644"
|
||||
},
|
||||
{
|
||||
"path": "packages/business/src/resolve.mjs",
|
||||
"sha256": "712183465fee099606223d84423afc54e3386a0c8e468c68d5ac39c1e676d109",
|
||||
"mode": "100644"
|
||||
},
|
||||
{
|
||||
"path": "packages/business/tests/business.test.mjs",
|
||||
"sha256": "910f924d90b6f9b18c1f36d97cebd0b7a0a15a080b73530c4fb847bfd435fb3f",
|
||||
"mode": "100644"
|
||||
},
|
||||
{
|
||||
"path": "packages/business/tests/cli.test.mjs",
|
||||
"sha256": "d54ba2338bcdfec22764030cf3ec9e3464ab275b15321d6d1b039169ea37fd85",
|
||||
"mode": "100644"
|
||||
},
|
||||
{
|
||||
"path": "packages/business/tests/instance-settings.test.mjs",
|
||||
"sha256": "072e25c5237e1be4294c7a4a95daa2ab593832786013e1283b19725c330647c1",
|
||||
"mode": "100644"
|
||||
},
|
||||
{
|
||||
"path": "packages/business/tests/library-projects-protected.test.mjs",
|
||||
"sha256": "cfc726ec7bf73c1dc9fc6395cba85e374b7a006bac45bd8c47c969550557147f",
|
||||
"mode": "100644"
|
||||
},
|
||||
{
|
||||
"path": "packages/business/tests/resolve.test.mjs",
|
||||
"sha256": "c74af44a83ee918196e2c1016b62786e757c0ae774c9b1613280d3fbbf3ffb22",
|
||||
"mode": "100644"
|
||||
},
|
||||
{
|
||||
"path": "packages/cli/src/config.mjs",
|
||||
"sha256": "ab7b9f452123b6f7e98f4f59cbb3cc4483fd296e4af5522412410ee53d1b20e0",
|
||||
"mode": "100644"
|
||||
},
|
||||
{
|
||||
"path": "packages/cli/src/launcher.mjs",
|
||||
"sha256": "d8a870d8eb8254adfd576688696705359fefbf517b40e5d7482500bf27941022",
|
||||
"mode": "100644"
|
||||
},
|
||||
{
|
||||
"path": "packages/cli/tests/launcher.test.mjs",
|
||||
"sha256": "99234f247e8414120d2fd214efd590e9d573eca86180d7b775cb506ac1c12c78",
|
||||
"mode": "100644"
|
||||
},
|
||||
{
|
||||
"path": "packages/cli/tests/stack-release-fixture.mjs",
|
||||
"sha256": "86a3c15446d4c119206097c754cd15f5bef7b7e93c9f16e9d8696ec8c475eea9",
|
||||
"mode": "100644"
|
||||
},
|
||||
{
|
||||
"path": "packages/cli/tests/stack-release.test.mjs",
|
||||
"sha256": "46cc95a6e75a89b907cdd5e9bd03853e1d1f75f1ced81084d968c5476466822e",
|
||||
"mode": "100644"
|
||||
},
|
||||
{
|
||||
"path": "packages/cli/tests/trackers-boot.test.mjs",
|
||||
"sha256": "c90493e45bfa09bf0b01600aaf04d6ecd79d939357beacc1a9cd65f958bb7c22",
|
||||
"mode": "100644"
|
||||
},
|
||||
{
|
||||
"path": "packages/library/src/index.mjs",
|
||||
"sha256": "ecda99dea46390b81fffa6f414d56a13737233e01d883b82cd186e0e21b6c4d1",
|
||||
"mode": "100644"
|
||||
},
|
||||
{
|
||||
"path": "packages/library/src/mirror.mjs",
|
||||
"sha256": "75ce08fba0956c846f2ca9ab1b565974657925f94ac952c720e7308783946480",
|
||||
"mode": "100644"
|
||||
},
|
||||
{
|
||||
"path": "packages/library/tests/mirror.test.mjs",
|
||||
"sha256": "e96473be70ece8c8232ce5325822244b593f273371b74b4126920654cde9d72c",
|
||||
"mode": "100644"
|
||||
},
|
||||
{
|
||||
"path": "packages/project/src/paths.mjs",
|
||||
"sha256": "bd9debcf3f9bb92560e74f220a0b108dfe24154bc6d1fb03c5ec414356d451f9",
|
||||
"mode": "100644"
|
||||
},
|
||||
{
|
||||
"path": "packages/project/tests/project.test.mjs",
|
||||
"sha256": "0ebe1862ce70f26c4a6a44304182327f9a6944d16cc87f674fbb1d32e08ac602",
|
||||
"mode": "100644"
|
||||
},
|
||||
{
|
||||
"path": "packages/seat/src/checkout.mjs",
|
||||
"sha256": "859201bd192522e51c33b86ef45f73487b27cdfc48ea7e4e09870e26d056048a",
|
||||
"mode": "100644"
|
||||
},
|
||||
{
|
||||
"path": "packages/seat/tests/checkout.test.mjs",
|
||||
"sha256": "663040d7c737aba6403e6397bacf1325b558cc14df3e5677f0a28f9499c45127",
|
||||
"mode": "100644"
|
||||
},
|
||||
{
|
||||
"path": "packages/webui/src/cli.mjs",
|
||||
"sha256": "e98fd2fe4e621d5b4fa1ed95c4d4585469e7ab7a11dd379dc541dddb1b1a1f02",
|
||||
"mode": "100644"
|
||||
},
|
||||
{
|
||||
"path": "packages/webui/tests/library-cli.test.mjs",
|
||||
"sha256": "1983912b76f01f8e6d0c564e3bbcd763c0b2c44044988b192ef827446f98556c",
|
||||
"mode": "100644"
|
||||
}
|
||||
],
|
||||
"priorSourceCommit": "e333af4dc7af3a9d3789c8c0db26a0df8bdddfee"
|
||||
}
|
||||
@@ -1,16 +0,0 @@
|
||||
packages/bus/tests/library.test.mjs
|
||||
packages/bus/tests/project-runtime.test.mjs
|
||||
packages/business/tests/business.test.mjs
|
||||
packages/business/tests/cli.test.mjs
|
||||
packages/business/tests/instance-settings.test.mjs
|
||||
packages/business/tests/library-projects-protected.test.mjs
|
||||
packages/business/tests/resolve.test.mjs
|
||||
packages/cli/tests/launcher.test.mjs
|
||||
packages/cli/tests/stack-release-external.test.mjs
|
||||
packages/cli/tests/stack-release.test.mjs
|
||||
packages/cli/tests/stack-upgrade.test.mjs
|
||||
packages/cli/tests/trackers-boot.test.mjs
|
||||
packages/library/tests/mirror.test.mjs
|
||||
packages/project/tests/project.test.mjs
|
||||
packages/seat/tests/checkout.test.mjs
|
||||
packages/webui/tests/library-cli.test.mjs
|
||||
@@ -1,229 +0,0 @@
|
||||
{
|
||||
"base": "fefd54e13",
|
||||
"landing": "f8276c5eb3ecb0aad353ee65e3dd8f7faac5dd87",
|
||||
"overlaps": [
|
||||
"packages/bus/src/broker.mjs",
|
||||
"packages/bus/src/runtime.mjs",
|
||||
"packages/business/src/business.mjs",
|
||||
"packages/business/src/instance-settings.mjs",
|
||||
"packages/business/tests/business.test.mjs",
|
||||
"packages/business/tests/instance-settings.test.mjs",
|
||||
"packages/cli/src/launcher.mjs",
|
||||
"packages/cli/tests/launcher.test.mjs",
|
||||
"packages/library/src/index.mjs"
|
||||
],
|
||||
"initialConflicts": [
|
||||
"packages/bus/src/broker.mjs",
|
||||
"packages/business/src/business.mjs"
|
||||
],
|
||||
"remainingConflicts": [],
|
||||
"resolutions": {
|
||||
"packages/bus/src/broker.mjs": "retain landed hostKeys constructor parameter and add library parameter",
|
||||
"packages/business/src/business.mjs": "retain landed CREATIVE_DEFINITIONS import and add checkMapping import"
|
||||
},
|
||||
"sourcePaths": [
|
||||
{
|
||||
"path": "packages/bus/src/broker.mjs",
|
||||
"merged": true,
|
||||
"sameAsEarlyTree": false,
|
||||
"earlySha256": "dca11dd58561bf3f399d18d7521aefa93f43e0ee3de9c532c1da073ce5a17466",
|
||||
"sha256": "925b3dd6744565349ec421a58b3374ce3d21181e6c2d3d32ffb99c79271b9450"
|
||||
},
|
||||
{
|
||||
"path": "packages/bus/src/runtime.mjs",
|
||||
"merged": true,
|
||||
"sameAsEarlyTree": false,
|
||||
"earlySha256": "6f69e9fb838cf1d8ee60d1b7090395193d3dbfdc6492a401a4b72c356c371ca9",
|
||||
"sha256": "c759e665514a5bcad40536bc9f979837187fe6523462b3c0a0687182885c3ac6"
|
||||
},
|
||||
{
|
||||
"path": "packages/bus/src/server.mjs",
|
||||
"merged": false,
|
||||
"sameAsEarlyTree": true,
|
||||
"earlySha256": "207c7a76752c753ef7380f18f9ce1a4f23e8fa35142973b6358aaf0c45f44899",
|
||||
"sha256": "207c7a76752c753ef7380f18f9ce1a4f23e8fa35142973b6358aaf0c45f44899"
|
||||
},
|
||||
{
|
||||
"path": "packages/bus/tests/library.test.mjs",
|
||||
"merged": false,
|
||||
"sameAsEarlyTree": true,
|
||||
"earlySha256": "58d839709e005571b398a11abda5a50f542bab0e37bd97b72f43cde926434301",
|
||||
"sha256": "58d839709e005571b398a11abda5a50f542bab0e37bd97b72f43cde926434301"
|
||||
},
|
||||
{
|
||||
"path": "packages/business/src/business.mjs",
|
||||
"merged": true,
|
||||
"sameAsEarlyTree": false,
|
||||
"earlySha256": "e132f92211cd35f951e85ff5e90471a2316755cb35ad7eabf516e780ce6c13ad",
|
||||
"sha256": "5fd3fee664d3e70153d988b4c1a42406f888a31b3927fa52375e66619d8cec59"
|
||||
},
|
||||
{
|
||||
"path": "packages/business/src/cli.mjs",
|
||||
"merged": false,
|
||||
"sameAsEarlyTree": true,
|
||||
"earlySha256": "31cfe9090900169416e1207dc6db865b046439273917e9de442add4159c89eb3",
|
||||
"sha256": "31cfe9090900169416e1207dc6db865b046439273917e9de442add4159c89eb3"
|
||||
},
|
||||
{
|
||||
"path": "packages/business/src/instance-settings.mjs",
|
||||
"merged": true,
|
||||
"sameAsEarlyTree": false,
|
||||
"earlySha256": "04d61c1ec89a5d67da75aede46c3a8e2197aadd63b11bef8e4fc37d90e8862cf",
|
||||
"sha256": "3873411688d927336a909d0299acddeba92a653102c660d276471f5a0f6eebd3"
|
||||
},
|
||||
{
|
||||
"path": "packages/business/src/organization.mjs",
|
||||
"merged": false,
|
||||
"sameAsEarlyTree": true,
|
||||
"earlySha256": "eaa650499d2d078552a2c0e5b13a6126e0aca02f73160032a7325b3f5aa90964",
|
||||
"sha256": "eaa650499d2d078552a2c0e5b13a6126e0aca02f73160032a7325b3f5aa90964"
|
||||
},
|
||||
{
|
||||
"path": "packages/business/src/resolve.mjs",
|
||||
"merged": false,
|
||||
"sameAsEarlyTree": true,
|
||||
"earlySha256": "712183465fee099606223d84423afc54e3386a0c8e468c68d5ac39c1e676d109",
|
||||
"sha256": "712183465fee099606223d84423afc54e3386a0c8e468c68d5ac39c1e676d109"
|
||||
},
|
||||
{
|
||||
"path": "packages/business/tests/business.test.mjs",
|
||||
"merged": true,
|
||||
"sameAsEarlyTree": false,
|
||||
"earlySha256": "55aafd3f0eea816d5f42283b7b74323dd32a698d7b95dd9cc54529dbf7b16058",
|
||||
"sha256": "910f924d90b6f9b18c1f36d97cebd0b7a0a15a080b73530c4fb847bfd435fb3f"
|
||||
},
|
||||
{
|
||||
"path": "packages/business/tests/cli.test.mjs",
|
||||
"merged": false,
|
||||
"sameAsEarlyTree": true,
|
||||
"earlySha256": "d54ba2338bcdfec22764030cf3ec9e3464ab275b15321d6d1b039169ea37fd85",
|
||||
"sha256": "d54ba2338bcdfec22764030cf3ec9e3464ab275b15321d6d1b039169ea37fd85"
|
||||
},
|
||||
{
|
||||
"path": "packages/business/tests/instance-settings.test.mjs",
|
||||
"merged": true,
|
||||
"sameAsEarlyTree": false,
|
||||
"earlySha256": "c0959f3af3df653bbf469471d3bbe3f28bc4478cba8ba57910af7f09498c4c3f",
|
||||
"sha256": "072e25c5237e1be4294c7a4a95daa2ab593832786013e1283b19725c330647c1"
|
||||
},
|
||||
{
|
||||
"path": "packages/business/tests/library-projects-protected.test.mjs",
|
||||
"merged": false,
|
||||
"sameAsEarlyTree": true,
|
||||
"earlySha256": "cfc726ec7bf73c1dc9fc6395cba85e374b7a006bac45bd8c47c969550557147f",
|
||||
"sha256": "cfc726ec7bf73c1dc9fc6395cba85e374b7a006bac45bd8c47c969550557147f"
|
||||
},
|
||||
{
|
||||
"path": "packages/business/tests/resolve.test.mjs",
|
||||
"merged": false,
|
||||
"sameAsEarlyTree": true,
|
||||
"earlySha256": "c74af44a83ee918196e2c1016b62786e757c0ae774c9b1613280d3fbbf3ffb22",
|
||||
"sha256": "c74af44a83ee918196e2c1016b62786e757c0ae774c9b1613280d3fbbf3ffb22"
|
||||
},
|
||||
{
|
||||
"path": "packages/cli/src/config.mjs",
|
||||
"merged": false,
|
||||
"sameAsEarlyTree": true,
|
||||
"earlySha256": "ab7b9f452123b6f7e98f4f59cbb3cc4483fd296e4af5522412410ee53d1b20e0",
|
||||
"sha256": "ab7b9f452123b6f7e98f4f59cbb3cc4483fd296e4af5522412410ee53d1b20e0"
|
||||
},
|
||||
{
|
||||
"path": "packages/cli/src/launcher.mjs",
|
||||
"merged": true,
|
||||
"sameAsEarlyTree": false,
|
||||
"earlySha256": "2272232dbe6c362eddb23ad903987fd4b8e0ca1eb94dbe93b66b3e785e7d0712",
|
||||
"sha256": "d8a870d8eb8254adfd576688696705359fefbf517b40e5d7482500bf27941022"
|
||||
},
|
||||
{
|
||||
"path": "packages/cli/tests/launcher.test.mjs",
|
||||
"merged": true,
|
||||
"sameAsEarlyTree": false,
|
||||
"earlySha256": "38fb51c15764333642d75db7fb358d611e448049cf894b24686ea6cf2cf169c4",
|
||||
"sha256": "99234f247e8414120d2fd214efd590e9d573eca86180d7b775cb506ac1c12c78"
|
||||
},
|
||||
{
|
||||
"path": "packages/cli/tests/stack-release-fixture.mjs",
|
||||
"merged": false,
|
||||
"sameAsEarlyTree": true,
|
||||
"earlySha256": "86a3c15446d4c119206097c754cd15f5bef7b7e93c9f16e9d8696ec8c475eea9",
|
||||
"sha256": "86a3c15446d4c119206097c754cd15f5bef7b7e93c9f16e9d8696ec8c475eea9"
|
||||
},
|
||||
{
|
||||
"path": "packages/cli/tests/stack-release.test.mjs",
|
||||
"merged": false,
|
||||
"sameAsEarlyTree": true,
|
||||
"earlySha256": "aa63fadca8b3a51e7af1ff7560fd2645f3ef56bf4e5625b2d5a5f6946db40996",
|
||||
"sha256": "aa63fadca8b3a51e7af1ff7560fd2645f3ef56bf4e5625b2d5a5f6946db40996"
|
||||
},
|
||||
{
|
||||
"path": "packages/cli/tests/trackers-boot.test.mjs",
|
||||
"merged": false,
|
||||
"sameAsEarlyTree": true,
|
||||
"earlySha256": "c90493e45bfa09bf0b01600aaf04d6ecd79d939357beacc1a9cd65f958bb7c22",
|
||||
"sha256": "c90493e45bfa09bf0b01600aaf04d6ecd79d939357beacc1a9cd65f958bb7c22"
|
||||
},
|
||||
{
|
||||
"path": "packages/library/src/index.mjs",
|
||||
"merged": true,
|
||||
"sameAsEarlyTree": false,
|
||||
"earlySha256": "b80e6c27daf908a0e71fcc1e5e8c91d05e857790bd77d92e06ff086ab3623306",
|
||||
"sha256": "ecda99dea46390b81fffa6f414d56a13737233e01d883b82cd186e0e21b6c4d1"
|
||||
},
|
||||
{
|
||||
"path": "packages/library/src/mirror.mjs",
|
||||
"merged": false,
|
||||
"sameAsEarlyTree": true,
|
||||
"earlySha256": "75ce08fba0956c846f2ca9ab1b565974657925f94ac952c720e7308783946480",
|
||||
"sha256": "75ce08fba0956c846f2ca9ab1b565974657925f94ac952c720e7308783946480"
|
||||
},
|
||||
{
|
||||
"path": "packages/library/tests/mirror.test.mjs",
|
||||
"merged": false,
|
||||
"sameAsEarlyTree": true,
|
||||
"earlySha256": "e96473be70ece8c8232ce5325822244b593f273371b74b4126920654cde9d72c",
|
||||
"sha256": "e96473be70ece8c8232ce5325822244b593f273371b74b4126920654cde9d72c"
|
||||
},
|
||||
{
|
||||
"path": "packages/project/src/paths.mjs",
|
||||
"merged": false,
|
||||
"sameAsEarlyTree": true,
|
||||
"earlySha256": "bd9debcf3f9bb92560e74f220a0b108dfe24154bc6d1fb03c5ec414356d451f9",
|
||||
"sha256": "bd9debcf3f9bb92560e74f220a0b108dfe24154bc6d1fb03c5ec414356d451f9"
|
||||
},
|
||||
{
|
||||
"path": "packages/project/tests/project.test.mjs",
|
||||
"merged": false,
|
||||
"sameAsEarlyTree": true,
|
||||
"earlySha256": "0ebe1862ce70f26c4a6a44304182327f9a6944d16cc87f674fbb1d32e08ac602",
|
||||
"sha256": "0ebe1862ce70f26c4a6a44304182327f9a6944d16cc87f674fbb1d32e08ac602"
|
||||
},
|
||||
{
|
||||
"path": "packages/seat/src/checkout.mjs",
|
||||
"merged": false,
|
||||
"sameAsEarlyTree": true,
|
||||
"earlySha256": "859201bd192522e51c33b86ef45f73487b27cdfc48ea7e4e09870e26d056048a",
|
||||
"sha256": "859201bd192522e51c33b86ef45f73487b27cdfc48ea7e4e09870e26d056048a"
|
||||
},
|
||||
{
|
||||
"path": "packages/seat/tests/checkout.test.mjs",
|
||||
"merged": false,
|
||||
"sameAsEarlyTree": true,
|
||||
"earlySha256": "663040d7c737aba6403e6397bacf1325b558cc14df3e5677f0a28f9499c45127",
|
||||
"sha256": "663040d7c737aba6403e6397bacf1325b558cc14df3e5677f0a28f9499c45127"
|
||||
},
|
||||
{
|
||||
"path": "packages/webui/src/cli.mjs",
|
||||
"merged": false,
|
||||
"sameAsEarlyTree": true,
|
||||
"earlySha256": "e98fd2fe4e621d5b4fa1ed95c4d4585469e7ab7a11dd379dc541dddb1b1a1f02",
|
||||
"sha256": "e98fd2fe4e621d5b4fa1ed95c4d4585469e7ab7a11dd379dc541dddb1b1a1f02"
|
||||
},
|
||||
{
|
||||
"path": "packages/webui/tests/library-cli.test.mjs",
|
||||
"merged": false,
|
||||
"sameAsEarlyTree": true,
|
||||
"earlySha256": "1983912b76f01f8e6d0c564e3bbcd763c0b2c44044988b192ef827446f98556c",
|
||||
"sha256": "1983912b76f01f8e6d0c564e3bbcd763c0b2c44044988b192ef827446f98556c"
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -1,155 +0,0 @@
|
||||
diff --git a/packages/bus/src/broker.mjs b/packages/bus/src/broker.mjs
|
||||
index 3baa709f9..512d57519 100644
|
||||
--- a/packages/bus/src/broker.mjs
|
||||
+++ b/packages/bus/src/broker.mjs
|
||||
@@ -90,0 +91 @@ export const PROJECT_FILE_VERBS = Object.freeze(['project.files', 'project.file'
|
||||
+export const LIBRARY_VERBS = Object.freeze(['library.file', 'library.status']);
|
||||
@@ -281,0 +283 @@ export class Broker {
|
||||
+ #library;
|
||||
@@ -297 +299 @@ export class Broker {
|
||||
- constructor({ store, businesses, secretCheck = () => {}, credentialStatus = () => [], organization = null, project = null, usage = null, limits = null, harnessOn = null, credentialVerbs = null, hostGrant = null, hostKeys = null }) {
|
||||
+ constructor({ store, businesses, secretCheck = () => {}, credentialStatus = () => [], organization = null, project = null, library = null, usage = null, limits = null, harnessOn = null, credentialVerbs = null, hostGrant = null, hostKeys = null }) {
|
||||
@@ -308,0 +311 @@ export class Broker {
|
||||
+ this.#library = library;
|
||||
@@ -2189,0 +2193,2 @@ export class Broker {
|
||||
+ if (LIBRARY_VERBS.includes(request.verb))
|
||||
+ return this.#requestLibrary(s, { verb: request.verb, args: structuredClone(args) });
|
||||
@@ -2438,0 +2444,20 @@ export class Broker {
|
||||
+ // C2-04 M4: only a verified human reads library text or status. Host Git
|
||||
+ // functions stay injected, preserving this module's sandbox import closure.
|
||||
+ async #requestLibrary(s, request) {
|
||||
+ const { verb, args } = request;
|
||||
+ try {
|
||||
+ this.#human(s);
|
||||
+ const fields = verb === 'library.file' ? ['project', 'path'] : ['project'];
|
||||
+ keys(args, fields, fields);
|
||||
+ if (!this.#library?.readFile || !this.#library?.status) fail('project-not-configured');
|
||||
+ const context = { business: this.#business(s.business), project: args.project };
|
||||
+ const result = verb === 'library.file'
|
||||
+ ? await this.#library.readFile({ ...context, path: args.path })
|
||||
+ : await this.#library.status(context);
|
||||
+ this.#secretCheck(result);
|
||||
+ return result;
|
||||
+ } catch (error) {
|
||||
+ const Failure = this.#library?.LibraryError;
|
||||
+ throw this.#refused(s, Failure && error instanceof Failure ? new BusError(error.code) : error, request);
|
||||
+ }
|
||||
+ }
|
||||
diff --git a/packages/bus/src/runtime.mjs b/packages/bus/src/runtime.mjs
|
||||
index f81f956f2..e265ff5d1 100644
|
||||
--- a/packages/bus/src/runtime.mjs
|
||||
+++ b/packages/bus/src/runtime.mjs
|
||||
@@ -5,0 +6 @@ import * as projectModule from '../../project/src/index.mjs';
|
||||
+import * as libraryModule from '../../library/src/index.mjs';
|
||||
@@ -95 +96 @@ export async function startBroker({
|
||||
- ...Object.values(businesses).flatMap((b) => Object.values(b.projects ?? {}).map((p) => p.root)),
|
||||
+ ...Object.values(businesses).flatMap((b) => Object.values(b.projects ?? {}).filter(p => p.kind !== 'library').map((p) => p.root)),
|
||||
@@ -130,0 +132,5 @@ export async function startBroker({
|
||||
+ // C2-04: mirrors are host state, never session checkouts. An unsafe
|
||||
+ // existing mirror refuses startup before a socket can become ready.
|
||||
+ for (const business of Object.values(businesses))
|
||||
+ for (const [project, entry] of Object.entries(business.projects ?? {}))
|
||||
+ if (entry.kind === 'library') await libraryModule.ensureMirror({ business, project, dataRoot });
|
||||
@@ -138,0 +145,5 @@ export async function startBroker({
|
||||
+ library: {
|
||||
+ readFile: context => libraryModule.readLibraryFile({ ...context, dataRoot }),
|
||||
+ status: context => libraryModule.libraryStatus({ ...context, dataRoot }),
|
||||
+ LibraryError: libraryModule.LibraryError,
|
||||
+ },
|
||||
diff --git a/packages/business/src/business.mjs b/packages/business/src/business.mjs
|
||||
index d08a4f52e..e8337ea2b 100644
|
||||
--- a/packages/business/src/business.mjs
|
||||
+++ b/packages/business/src/business.mjs
|
||||
@@ -12,0 +13 @@ import { checkPlugins } from "../../plugins/src/kinds.mjs";
|
||||
+import { checkMapping } from "../../library/src/mapping.mjs";
|
||||
@@ -241,0 +243,4 @@ export function validateBusinessDocument(document, file, { rolesDir }) {
|
||||
+ if (entry.kind === 'library') {
|
||||
+ projects[id] = checkMapping(entry, `${file} projects.${id}`, { fail: (code, message) => refuse(`${code}: ${message}`) });
|
||||
+ continue;
|
||||
+ }
|
||||
@@ -257,0 +263 @@ export function validateBusinessDocument(document, file, { rolesDir }) {
|
||||
+ if (projects[project].kind === 'library') refuse(`${file} roles.${instance}.publish names library project ${project}; library repositories cannot be published by agents`);
|
||||
diff --git a/packages/business/src/instance-settings.mjs b/packages/business/src/instance-settings.mjs
|
||||
index ff3a6d9d3..50cc36edc 100644
|
||||
--- a/packages/business/src/instance-settings.mjs
|
||||
+++ b/packages/business/src/instance-settings.mjs
|
||||
@@ -149,0 +150 @@ export function instanceSettings({ dir, rolesDir, system, levels = () => null })
|
||||
+ if (entry.kind === 'library') continue;
|
||||
diff --git a/packages/business/tests/business.test.mjs b/packages/business/tests/business.test.mjs
|
||||
index b64659fa1..0f214a005 100644
|
||||
--- a/packages/business/tests/business.test.mjs
|
||||
+++ b/packages/business/tests/business.test.mjs
|
||||
@@ -10,0 +11,30 @@ import { launchDoc, businessDoc, REPO, REPO_ROLES, rolesCopy, tmp, writeJson } f
|
||||
+test('C2-04: library mappings load without roots, remain frozen, and retain mapping refusals', async t => {
|
||||
+ const { mappingEntry } = await import('../../library/tests/helpers.mjs');
|
||||
+ const { rmSync } = await import('node:fs');
|
||||
+ const root = tmp(); t.after(() => rmSync(root, { recursive: true, force: true }));
|
||||
+ const doc = businessDoc(root), file = join(root, 'businesses/acme.json');
|
||||
+ doc.projects = { books: mappingEntry(), ...doc.projects };
|
||||
+ const loaded = validateBusinessDocument(doc, file, { rolesDir: REPO_ROLES });
|
||||
+ const { checkMapping } = await import('../../library/src/mapping.mjs');
|
||||
+ assert.deepEqual(loaded.projects.books, checkMapping(mappingEntry()));
|
||||
+ assert.equal(loaded.projects.books.root, undefined);
|
||||
+ assert.ok(Object.isFrozen(loaded.projects.books.universes.harbor.books));
|
||||
+ const only = structuredClone(doc); delete only.projects.stack;
|
||||
+ assert.deepEqual(Object.keys(validateBusinessDocument(only, file, { rolesDir: REPO_ROLES }).projects), ['books']);
|
||||
+ doc.projects.books.universes.harbor.playground = ['Elsewhere/Playground/'];
|
||||
+ refuses(() => validateBusinessDocument(doc, file, { rolesDir: REPO_ROLES }), /library-playground-outside-book/);
|
||||
+ doc.projects.books = { ...mappingEntry(), root: '/forbidden' };
|
||||
+ refuses(() => validateBusinessDocument(doc, file, { rolesDir: REPO_ROLES }), /library-mapping-invalid/);
|
||||
+});
|
||||
+
|
||||
+test('C2-04: an otherwise valid publish grant cannot name a library repo', async t => {
|
||||
+ const { mappingEntry } = await import('../../library/tests/helpers.mjs');
|
||||
+ const { rmSync } = await import('node:fs');
|
||||
+ const root = tmp(); t.after(() => rmSync(root, { recursive: true, force: true }));
|
||||
+ const doc = businessDoc(root);
|
||||
+ doc.projects.books = { ...mappingEntry(), remote: 'https://git.example/writer/books' };
|
||||
+ doc.roles.coder.identity = { name: 'Coder', email: '[email protected]', gitea: { url: 'https://git.example', user: 'acme-coder' } };
|
||||
+ doc.roles.coder.publish = ['books'];
|
||||
+ refuses(() => validateBusinessDocument(doc, join(root, 'businesses/acme.json'), { rolesDir: REPO_ROLES }), /publish.*library/);
|
||||
+});
|
||||
+
|
||||
diff --git a/packages/business/tests/instance-settings.test.mjs b/packages/business/tests/instance-settings.test.mjs
|
||||
index 6b19f9e89..a6c8fe665 100644
|
||||
--- a/packages/business/tests/instance-settings.test.mjs
|
||||
+++ b/packages/business/tests/instance-settings.test.mjs
|
||||
@@ -22,0 +23,10 @@ const LEVELS = { pi: ["off", "minimal", "low", "medium", "high", "xhigh", "max"]
|
||||
+test('C2-04: instance settings skip a library while checking a later code project', async () => {
|
||||
+ const { mappingEntry } = await import('../../library/tests/helpers.mjs');
|
||||
+ const f = fixture(doc => { doc.projects = { books: mappingEntry(), ...doc.projects }; });
|
||||
+ writeJson(projectFilePath(f.doc.projects.stack.root), { projectVersion: 1, id: 'stack', vars: { 'tracker.project': 3 } });
|
||||
+ const before = f.settings.read('acme');
|
||||
+ f.settings.set('acme', { revision: before.revision, instance: 'gate-215', op: 'add', definition: 'merge-gate' }, 'jason');
|
||||
+ assert.deepEqual(JSON.parse(readFileSync(f.file, 'utf8')).projects.books, mappingEntry());
|
||||
+ assert.ok(f.settings.read('acme').instances['gate-215']);
|
||||
+});
|
||||
+
|
||||
diff --git a/packages/cli/src/launcher.mjs b/packages/cli/src/launcher.mjs
|
||||
index 604cef203..c721ee9e8 100644
|
||||
--- a/packages/cli/src/launcher.mjs
|
||||
+++ b/packages/cli/src/launcher.mjs
|
||||
@@ -354 +354 @@ export function createLauncher({
|
||||
- checkouts = await ensureCheckouts({ workspace, projects: b.projects, env });
|
||||
+ checkouts = await ensureCheckouts({ workspace, projects: Object.fromEntries(Object.entries(b.projects).filter(([, entry]) => entry.kind !== 'library')), env });
|
||||
diff --git a/packages/cli/tests/launcher.test.mjs b/packages/cli/tests/launcher.test.mjs
|
||||
index 3b663ba94..4636df3de 100644
|
||||
--- a/packages/cli/tests/launcher.test.mjs
|
||||
+++ b/packages/cli/tests/launcher.test.mjs
|
||||
@@ -32,0 +33,10 @@ const skip = sandboxProblem() ?? false;
|
||||
+test('C2-04: launcher workspace clones code but never the library', { skip, timeout: 30000 }, async t => {
|
||||
+ const { mappingEntry } = await import('../../library/tests/helpers.mjs');
|
||||
+ const f = await setup(t, doc => { doc.projects = { books: mappingEntry(), ...doc.projects }; return doc; });
|
||||
+ await f.launcher.launchPm();
|
||||
+ const workspace = workspaceDir(f.f.dataRoot, 'acme', 'chief');
|
||||
+ assert.equal(existsSync(join(workspace, 'stack', '.git')), true);
|
||||
+ assert.equal(existsSync(join(workspace, 'books')), false);
|
||||
+ assert.equal(await f.close(), 0);
|
||||
+});
|
||||
+
|
||||
diff --git a/packages/library/src/index.mjs b/packages/library/src/index.mjs
|
||||
index f64d77860..53ce5cb43 100644
|
||||
--- a/packages/library/src/index.mjs
|
||||
+++ b/packages/library/src/index.mjs
|
||||
@@ -8,0 +9 @@ export { survey, formatSurvey, surveyMain } from './survey.mjs';
|
||||
+export { SYNC_STATE_FILE, mirrorPath, ensureMirror, withLibraryLock, servedCommit, readSyncState, libraryStatus, readLibraryFile } from './mirror.mjs';
|
||||
@@ -1,14 +0,0 @@
|
||||
✔ C2-04 M4: both verbs reject every agent before arguments or adapter access (30.144386ms)
|
||||
✔ C2-04 bus: human reads validate keys and return adapter results without path leakage (11.434614ms)
|
||||
✔ C2-04 socket: each async library verb resolves its result rather than serializing {} (17.684117ms)
|
||||
✔ C2-04 runtime: protectedRoots skips library but retains real code-root credential protection (45.253455ms)
|
||||
✔ C2-04 runtime: unsafe existing mirror refuses boot and never publishes a socket (23.246812ms)
|
||||
✔ C2-04 runtime: real library adapters reach the socket and lock waits leave other bus reads responsive (107.052077ms)
|
||||
ℹ tests 6
|
||||
ℹ suites 0
|
||||
ℹ pass 6
|
||||
ℹ fail 0
|
||||
ℹ cancelled 0
|
||||
ℹ skipped 0
|
||||
ℹ todo 0
|
||||
ℹ duration_ms 359.869493
|
||||
-11
@@ -1,11 +0,0 @@
|
||||
✔ Broker keeps the sandbox client import closure: only the listed imports, no lazy project import (2.265255ms)
|
||||
✔ without a trusted project adapter all three async paths refuse project-not-configured (57.448982ms)
|
||||
✔ real startBroker injects the project adapter for socket reads and bound-author record writes (102.784823ms)
|
||||
ℹ tests 3
|
||||
ℹ suites 0
|
||||
ℹ pass 3
|
||||
ℹ fail 0
|
||||
ℹ cancelled 0
|
||||
ℹ skipped 0
|
||||
ℹ todo 0
|
||||
ℹ duration_ms 312.717335
|
||||
-27
@@ -1,27 +0,0 @@
|
||||
✔ C2-04: library mappings load without roots, remain frozen, and retain mapping refusals (12.852402ms)
|
||||
✔ C2-04: an otherwise valid publish grant cannot name a library repo (2.693014ms)
|
||||
✔ config directory and file path follow MOSAIC_CONFIG (0.229245ms)
|
||||
✔ the fixture business validates and comes back frozen (1.006969ms)
|
||||
✔ two instances may share a definition (0.94271ms)
|
||||
✔ top-level refusals (3.474817ms)
|
||||
✔ arbiters and projects (5.543282ms)
|
||||
✔ role instances (2.7386ms)
|
||||
✔ Vikunja bots (6.181044ms)
|
||||
✔ a role without Vikunja takes no tracker block (5.900981ms)
|
||||
✔ credential references match the definition's services (3.012597ms)
|
||||
✔ launch (8.561546ms)
|
||||
✔ REQ-THREAD-2 REQ-LAUNCH-1 launch.threadIdleSeconds: absent is the default, a positive integer is used, anything else refuses (6.420869ms)
|
||||
✔ loadBusiness: file checks (2.241353ms)
|
||||
✔ loadBusiness: not a regular file (46.573969ms)
|
||||
✔ loading writes nothing (2.802338ms)
|
||||
✔ names that are Object.prototype properties don't count as declared (3.291238ms)
|
||||
✔ the shipped example refuses as written and validates once filled in (1.195924ms)
|
||||
✔ persona vars: agent layer, creative definition only, both or neither (9.0736ms)
|
||||
ℹ tests 19
|
||||
ℹ suites 0
|
||||
ℹ pass 19
|
||||
ℹ fail 0
|
||||
ℹ cancelled 0
|
||||
ℹ skipped 0
|
||||
ℹ todo 0
|
||||
ℹ duration_ms 199.91256
|
||||
@@ -1,18 +0,0 @@
|
||||
✔ C2-04: business validate and resolve skip a library before code projects and credential checks (235.663956ms)
|
||||
✔ usage errors exit 4 (325.805811ms)
|
||||
✔ validate: a good business exits 0 and prints instance digests (69.331646ms)
|
||||
✔ validate: project files (344.919464ms)
|
||||
✔ validate: missing files and a broken system config (252.779029ms)
|
||||
✔ validate: credential reference problems exit 2 and name each one (66.663076ms)
|
||||
✔ validate: a token file inside the repository is refused (78.714732ms)
|
||||
✔ validate: role definitions come from MOSAIC_ROLES_DIR (201.487424ms)
|
||||
✔ resolve: prints one instance's record (281.684478ms)
|
||||
✔ resolve: refusals (454.610462ms)
|
||||
ℹ tests 10
|
||||
ℹ suites 0
|
||||
ℹ pass 10
|
||||
ℹ fail 0
|
||||
ℹ cancelled 0
|
||||
ℹ skipped 0
|
||||
ℹ todo 0
|
||||
ℹ duration_ms 2381.258516
|
||||
-21
@@ -1,21 +0,0 @@
|
||||
✔ C2-04: instance settings skip a library while checking a later code project (32.527878ms)
|
||||
✔ row 165 read lists each instance and the definitions add accepts (3.218296ms)
|
||||
✔ row 165 add: two instances join, validate exits 0, the log names the human, and the bus restart is reported (93.702292ms)
|
||||
✔ row 165 change: definition, vars and launch membership log before and after; only a definition change asks for a restart (99.793939ms)
|
||||
✔ row 165 refuses each validation failure and leaves the file's bytes alone (33.820979ms)
|
||||
✔ row 165 refuses an added instance whose definition declares credentials, and says why (5.999086ms)
|
||||
✔ row 165 refuses a definition change to or from one that declares credentials (6.767714ms)
|
||||
✔ row 165 a vars or launch change on an instance with its binding succeeds and keeps the binding (89.83786ms)
|
||||
✔ row 165 refuses an END_PROTECTED definition and every change to a protected instance (9.793219ms)
|
||||
✔ row 165 refuses while a project file doesn't resolve, as validate would (15.487298ms)
|
||||
✔ row 165 refuses a stale revision and leaves the file's bytes alone (10.871014ms)
|
||||
✔ row 65 an instance write refuses harness-off, thinking-unsupported, an unknown model and a partial fallback (38.02395ms)
|
||||
✔ row 213 a creative instance is the human's: add, vars and definition changes, persona digest only (90.045141ms)
|
||||
ℹ tests 13
|
||||
ℹ suites 0
|
||||
ℹ pass 13
|
||||
ℹ fail 0
|
||||
ℹ cancelled 0
|
||||
ℹ skipped 0
|
||||
ℹ todo 0
|
||||
ℹ duration_ms 608.08011
|
||||
-12
@@ -1,12 +0,0 @@
|
||||
✔ C2-04 M9: changed playground and hybrid entries leave business and changes.jsonl byte-identical (23.242034ms)
|
||||
✔ C2-04 M9: code projects, additions, deletions and array changes are protected too (15.756145ms)
|
||||
✔ C2-04 M9: canonical key order is allowed and a non-project setter still records its change (17.060499ms)
|
||||
✔ C2-04 M9: a serialization hook cannot change projects after the canonical comparison (9.833495ms)
|
||||
ℹ tests 4
|
||||
ℹ suites 0
|
||||
ℹ pass 4
|
||||
ℹ fail 0
|
||||
ℹ cancelled 0
|
||||
ℹ skipped 0
|
||||
ℹ todo 0
|
||||
ℹ duration_ms 118.54831
|
||||
-19
@@ -1,19 +0,0 @@
|
||||
✔ C2-04: a library first in projects does not hide a later project layer (9.584516ms)
|
||||
✔ systemVars flattens the validated config (1.063324ms)
|
||||
✔ precedence: system, business, project, project role, agent (2.001802ms)
|
||||
✔ limits narrow the definition and never widen it (2.563505ms)
|
||||
✔ role.launch stays within-role only for the instance the launch block names (5.04696ms)
|
||||
✔ limits.authority without role.launch leaves the launcher with no launch block (2.106162ms)
|
||||
✔ limits.authority narrows cross-role actions too (1.098761ms)
|
||||
✔ classify (1.065895ms)
|
||||
✔ the record carries what the broker and launcher need (0.966677ms)
|
||||
✔ digest: key order doesn't matter, any value change does (7.43546ms)
|
||||
✔ refusals (2.150825ms)
|
||||
ℹ tests 11
|
||||
ℹ suites 0
|
||||
ℹ pass 11
|
||||
ℹ fail 0
|
||||
ℹ cancelled 0
|
||||
ℹ skipped 0
|
||||
ℹ todo 0
|
||||
ℹ duration_ms 94.022587
|
||||
@@ -1,54 +0,0 @@
|
||||
✔ C2-04: launcher workspace clones code but never the library (1298.398732ms)
|
||||
✔ bus start --pm: the launcher instance (the chief of staff) runs under its own PID namespace, registered, with a manifest (1264.618734ms)
|
||||
usage: {"event":"usage-unknown","business":"acme","run":"r4accc4841d41","instance":"chief","turn":"81814ac7-9330-484a-95f8-cc2f80a9aeef","source":"@none","code":"baseline-unknown"}
|
||||
usage: {"event":"usage-unknown","business":"acme","run":"r0719029c31b1","instance":"coder","turn":"fd2dfc33-9ab6-4d4d-9eef-ba46b6d7a510","source":"@none","code":"baseline-unknown"}
|
||||
✔ the chief of staff launches a coder through its launch tool; the coder answers; refusals name their code (657.713119ms)
|
||||
usage: {"event":"usage-unknown","business":"acme","run":"r4b37f983290f","instance":"chief","turn":"6c8768d3-4742-4ae2-87c6-4653182c8520","source":"@none","code":"baseline-unknown"}
|
||||
usage: {"event":"usage-unknown","business":"acme","run":"r7bc8dc8db66c","instance":"pm","turn":"4b196787-1bf9-4702-82d2-397c84ab1e3c","source":"@none","code":"baseline-unknown"}
|
||||
usage: {"event":"usage-unknown","business":"acme","run":"r4b37f983290f","instance":"chief","turn":"1c6ec26d-97da-43b6-8cd8-91994e6c7c7b","source":"@none","code":"baseline-unknown"}
|
||||
usage: {"event":"usage-unknown","business":"acme","run":"r7bc8dc8db66c","instance":"pm","turn":"a12fdeb9-e25d-45a4-bd25-e048621a3557","source":"@none","code":"baseline-unknown"}
|
||||
usage: {"event":"usage-unknown","business":"acme","run":"r7bc8dc8db66c","instance":"pm","turn":"ad419687-0675-48a8-9932-90b2da5333ef","source":"@none","code":"baseline-unknown"}
|
||||
usage: {"event":"usage-unknown","business":"acme","run":"r4b37f983290f","instance":"chief","turn":"0d54926f-f5b8-4dbb-b38a-8ea23fdd5cb5","source":"@none","code":"baseline-unknown"}
|
||||
usage: {"event":"usage-unknown","business":"acme","run":"r7bc8dc8db66c","instance":"pm","turn":"6891e20c-472e-4e67-815e-88728024acf4","source":"@none","code":"baseline-unknown"}
|
||||
usage: {"event":"usage-unknown","business":"acme","run":"r4b37f983290f","instance":"chief","turn":"9ac6fe37-9044-4f54-bae0-826a6c84c15b","source":"@none","code":"baseline-unknown"}
|
||||
✔ a launched pm's request_staff reaches the chief of staff; no other session has the tool and the launch limits still hold (1202.248105ms)
|
||||
✔ each launch makes sure the workspace has a clone of the project: cloned, fast-forwarded, or fetched and logged (3926.301471ms)
|
||||
✔ a role the broker says holds a merge decision gets land_work, its prompt line, its landing and the git socket; without it, none (593.731622ms)
|
||||
✔ REQ-LAUNCH-1 the tick starts a listed merge decision holder once, with land_work, the Landing line and its landing turn; an unlisted holder starts nothing (755.589469ms)
|
||||
usage: {"event":"usage-unknown","business":"acme","run":"rf7ecf1ef2b65","instance":"coder","turn":"744cb116-e163-4b18-831e-556df7e7bfd9","source":"@none","code":"baseline-unknown"}
|
||||
✔ a holder running since before the resolution is stopped once the broker releases it, land-relaunch, and the next tick starts it: landing turn first, then the message that waited (739.551352ms)
|
||||
✔ a landing run that ended isn't started again for its decision, a spent decision starts nothing, and a new decision starts the holder (564.790867ms)
|
||||
✔ after a restart, the new host's first tick starts a holder whose decision is still held (883.94802ms)
|
||||
✔ a refused landing start is logged once per code with its decision, isn't a start, and the next tick with room starts the holder (595.491854ms)
|
||||
✔ a project clone that can't be made refuses checkout-failed, from --chief and from a session, with no run and no clone left (250.651304ms)
|
||||
✔ a runner that stops at once ends its launch with the runner's reason (336.620423ms)
|
||||
✔ a Claude Code launch with no session credential refuses before it starts (172.971844ms)
|
||||
✔ a pi launch needs no session credential: pi logs in through its own ENV_ALLOW variables (287.021469ms)
|
||||
usage: {"event":"plugin-refused","kind":"harness","name":"down","code":"missing","message":"/home/jwoltje/.t3/worktrees/mosaic-stack/herb-row215-on-f827/packages/plugins/harness/down is missing","kept":[]}
|
||||
plugins: {"event":"plugin-refused","kind":"harness","name":"down","code":"missing","message":"/home/jwoltje/.t3/worktrees/mosaic-stack/herb-row215-on-f827/packages/plugins/harness/down is missing","kept":[]}
|
||||
✔ row 65 a failed primary preflight launches the fallback on a fixture harness module, recording the route and the reason (327.373038ms)
|
||||
✔ a runner killed from the host ends its launch as killed, not failed (381.927989ms)
|
||||
✔ a missing or failing bwrap refuses sandbox-unavailable before anything starts; there is no unconfined fallback (198.778768ms)
|
||||
✔ row 64 a role skill that isn't enabled refuses skill-not-enabled, and one that isn't a plain directory skill-refused, before anything starts (184.44803ms)
|
||||
✔ row 213 a creative instance's persona is read from <configDir>/personas: off its digest the launch fails with the mismatch as its reason (239.197527ms)
|
||||
✔ row 64 on Claude Code a role skill that isn't enabled refuses the same way, before anything starts (230.64829ms)
|
||||
usage: {"event":"usage-unknown","business":"acme","run":"r800039251a09","instance":"chief","turn":"f2e6a1ad-767e-4316-be90-6194b840e2ef","source":"@none","code":"baseline-unknown"}
|
||||
usage: {"event":"usage-unknown","business":"acme","run":"rfeeb081c2983","instance":"coder","turn":"1abdb906-521d-4100-897b-f5eba12663cf","source":"@none","code":"baseline-unknown"}
|
||||
✔ a real Claude Code coder's shell can't read a stand-in secret or anything else its sandbox doesn't hold (1612.164523ms)
|
||||
✔ a host that died hard leaves its sessions to the next host, which kills them and ends their runs so the role can be launched again (909.716449ms)
|
||||
✔ a host that died hard leaves its sessions to the next host, which finds one already exited (23) and ends their runs so the role can be launched again (3844.434582ms)
|
||||
✔ bus start --no-launch leaves an earlier host's live session alone: no signal, no end, sessions.json as it was (224.265713ms)
|
||||
✔ bus start --no-launch refuses every launch: the PM launch and a session's request, each logged, nothing spawned (193.925449ms)
|
||||
✔ bus start --no-launch starts no thread tick; the same host with launches runs it (1181.783938ms)
|
||||
✔ a malformed sessions.json refuses the host start with exit 3 and stays as it was (166.842635ms)
|
||||
✔ an over-long launch request is refused at once, not at the 10 s idle timeout (171.101521ms)
|
||||
✔ a launch client that never closes its side doesn't hold the host's close (170.266667ms)
|
||||
✔ a runner that ignores SIGTERM is killed when the host closes (1305.753454ms)
|
||||
ℹ tests 31
|
||||
ℹ suites 0
|
||||
ℹ pass 31
|
||||
ℹ fail 0
|
||||
ℹ cancelled 0
|
||||
ℹ skipped 0
|
||||
ℹ todo 0
|
||||
ℹ duration_ms 24989.261794
|
||||
-33
@@ -1,33 +0,0 @@
|
||||
✔ row 232: confirm, revert, gate, --to and --expect-from need --units external; the user-only flags are usage under it (1129.148785ms)
|
||||
✔ row 232: pm-on and activate --pm-after-harness refuse external-pm (1112.631619ms)
|
||||
✔ row 232: units-running (N4) refuses while a unit is active and leaves the store, the log and TAKEN; failed counts as down (2301.278572ms)
|
||||
✔ row 232: activate stages: the pointer stays, AWAITING-UNITS names TO, a backup of the stopped store, no directory in the set, no --user, no journal (2229.906955ms)
|
||||
✔ row 232: A3 order: capture-failed and marker-failed refuse with exit 3 and leave no marker or FAILED (1913.7476ms)
|
||||
✔ row 232: confirm and revert refuse open-activation with no marker, two, the wrong copy, or one the log holds closed; refusals name no activation (3892.845676ms)
|
||||
✔ row 232: confirm polls: bus status good after 3 s fails with --timeout 1, writes FAILED and leaves the rest; FAILED then refuses activation-failed (3703.021367ms)
|
||||
✔ row 232: confirm polls to a pass with --timeout 10: the pointer, an ok line that reads as the started run, no marker (6350.955178ms)
|
||||
✔ row 232: stale-start: @1792540799 fails a start floor of 1792540800 with stale-start (3365.187863ms)
|
||||
✔ row 232: stale-start is a gate code: an enter time that turns to @1792540800 after 2 s passes with --timeout 10 (4713.287991ms)
|
||||
✔ row 232: gate (N2, A2f): --since 1792540800 passes @1792540800 and fails @1792540799; it writes nothing (3014.18649ms)
|
||||
✔ row 232: the external PM check reads launches list: one live run of launch.by since the start passes (7715.019003ms)
|
||||
✔ row 232: revert puts the wrapper back and leaves the store when nothing migrated (1540.240269ms)
|
||||
✔ row 232: confirm --rollback refuses rollback-mismatch, and logs rollback-failed with exit 2 when OLD fails its gate (3838.859298ms)
|
||||
✔ row 232: confirm --rollback after a --restore swap logs rollbackCode not-attempted; rollback --restore finds an external backup (4385.316411ms)
|
||||
✔ row 232: sequence 1: activate, confirm times out, revert, confirm --rollback --cause A5: gate-failed rollback ok (5668.17255ms)
|
||||
✔ row 232: sequence 2: activate --migrate, the wrapper install fails, revert restores TAKEN, confirm --rollback --cause A3 (3356.512703ms)
|
||||
✔ row 232: sequence 3: activate, root's A4 fails, revert, confirm --rollback --cause A4: failed code units-start (3090.998502ms)
|
||||
✔ row 232: sequence 4: a capture failure leaves nothing open, then A2f's gate OLD writes nothing (2006.820211ms)
|
||||
✔ row 232: sequence 5: a confirm of the wrong copy is refused, and revert and confirm --rollback still close the activation (3716.790879ms)
|
||||
✔ row 232: sequence 6: a revert that fails leaves the activation open, and the next --plan refuses interrupted-run (2084.865556ms)
|
||||
✔ row 232: sequence 7: adopt, two confirmed activates, rollback --to the previous copy, confirmed, logs op rollback (8859.407093ms)
|
||||
✔ row 232: sequence 8: a migration that writes and fails: revert restores the backup byte for byte, confirm --rollback --cause A3 (4066.89509ms)
|
||||
✔ row 232: user mode: every systemctl call carries --user, and activate, rollback and check make the base's calls (8472.325246ms)
|
||||
✔ row 232: user mode: a default activate --plan prints the base's bytes (2725.266801ms)
|
||||
ℹ tests 25
|
||||
ℹ suites 0
|
||||
ℹ pass 25
|
||||
ℹ fail 0
|
||||
ℹ cancelled 0
|
||||
ℹ skipped 0
|
||||
ℹ todo 0
|
||||
ℹ duration_ms 96332.465778
|
||||
-227
@@ -1,227 +0,0 @@
|
||||
✔ T1 adopt writes the pointer from the units once; a failing check refuses check-failed (1604.406515ms)
|
||||
✔ T2 activate installs exactly the pointer's pm, claude and Console flags (2285.234425ms)
|
||||
▶ T3 a hand-edited unit refuses unit-flags-drift, names the difference and changes nothing
|
||||
✔ pm (1074.84155ms)
|
||||
✔ claude (1048.597035ms)
|
||||
✔ console (1069.472197ms)
|
||||
✔ T3 a hand-edited unit refuses unit-flags-drift, names the difference and changes nothing (3193.872973ms)
|
||||
▶ T4 each item 3 refusal changes nothing and logs one line with its code
|
||||
✔ copy-missing (970.101799ms)
|
||||
✔ copy-unreachable (976.867501ms)
|
||||
✔ copy-schema-unknown (942.411453ms)
|
||||
✔ already-active (966.01391ms)
|
||||
✔ instance-busy (another business active) (1033.865857ms)
|
||||
✔ instance-busy (this business activating) (989.106934ms)
|
||||
✔ drop-in-override (1051.252734ms)
|
||||
✔ no-pointer (535.256184ms)
|
||||
✔ T4 each item 3 refusal changes nothing and logs one line with its code (7466.71817ms)
|
||||
✔ T5 an activate with no migration stops the Console then the bus, installs, starts the bus then the Console (2298.616234ms)
|
||||
✔ T6 a migration without --migrate rolls back with migration-needs-flag (2085.91559ms)
|
||||
✔ T7 --migrate takes the backup before the migration runs (2415.592569ms)
|
||||
✔ T8 a failed migration restores the backup and keeps the store it replaced (2571.261148ms)
|
||||
✔ T9 a store outside the target's chain rolls back with store-newer (2405.058696ms)
|
||||
▶ T10 each gate check failing alone rolls back and puts every file back
|
||||
✔ units-inactive (5907.690999ms)
|
||||
✔ bus-status (6093.058453ms)
|
||||
✔ healthz (6393.330472ms)
|
||||
✔ copy-check (5442.480521ms)
|
||||
✔ pm-launch-unconfirmed (5607.705975ms)
|
||||
✔ T10 each gate check failing alone rolls back and puts every file back (29445.44482ms)
|
||||
▶ T10b the PM check needs exactly one launched line for a live run of this start
|
||||
✔ no launched line (5534.978468ms)
|
||||
✔ two lines (5372.975087ms)
|
||||
✔ a changed word (5420.826895ms)
|
||||
✔ run not in launches list (5601.520776ms)
|
||||
✔ run started before the start (5448.208485ms)
|
||||
✔ a human launch with no journal line (5346.70067ms)
|
||||
✔ run for another business (5684.948726ms)
|
||||
✔ run not live (5860.307931ms)
|
||||
✔ one well-formed line and a live run pass (2078.4402ms)
|
||||
✔ T10b the PM check needs exactly one launched line for a live run of this start (46350.52861ms)
|
||||
✔ T11 a rollback whose gate fails too: rollback-failed, exit 2, both units stopped, no retry (7145.208417ms)
|
||||
✔ T12 rollback takes the previous copy from the log (3164.021139ms)
|
||||
✔ T13 a rollback across a migration needs --restore, then restores and goes live (3796.056873ms)
|
||||
✔ T14 events written after the backup need --events N with the right N (4384.802883ms)
|
||||
✔ T14b a rollback --restore whose gate fails stops both units and skips item 6 (5813.087127ms)
|
||||
✔ T14c a rollback without --restore whose gate fails runs item 6 (6237.609182ms)
|
||||
✔ T15 --plan names the migration and the restore and changes nothing (2849.139286ms)
|
||||
✔ T26 --plan lists the commits an activate adds, after the migration lines (1481.868533ms)
|
||||
✔ T27 --plan names each migration step, or says the steps cannot be read (1173.748951ms)
|
||||
✔ T25 --plan refuses copies-unrelated when neither copy is an ancestor of the other (569.344968ms)
|
||||
▶ T23 --plan reads the store without changing a file, stopped or held
|
||||
✔ stopped store (721.626407ms)
|
||||
✔ held store (690.820461ms)
|
||||
✔ T23 --plan reads the store without changing a file, stopped or held (1413.175682ms)
|
||||
✔ T24 business-mismatch and capture-failed refuse with exit 3; a short id is a usage error (1463.46361ms)
|
||||
✔ T16 status prints the pointer, the log, the check, bus status and drift, and writes nothing (910.07629ms)
|
||||
✔ T19 a started line with no final line: status shows it and every changing verb refuses (1271.59212ms)
|
||||
✔ T20 a held run lock refuses run-locked without a log line; status and --plan still run (1515.929929ms)
|
||||
✔ T21 a bus unit with no MOSAIC_CLAUDE_BIN: adopt and activate refuse no-claude-pin (1789.2511ms)
|
||||
▶ T22 the stopped store read: a -wal or -shm refuses store-unclean and is left alone; a clean read adds no file
|
||||
✔ bus.sqlite-wal (1954.988144ms)
|
||||
✔ bus.sqlite-shm (2042.456191ms)
|
||||
✔ clean (2209.768749ms)
|
||||
✔ T22 the stopped store read: a -wal or -shm refuses store-unclean and is left alone; a clean read adds no file (6208.13226ms)
|
||||
▶ T28 a unit path, drop-in directory or drop-in file that cannot be read, or a relative unit path, refuses drop-in-override before any stop
|
||||
✔ unit path (938.058563ms)
|
||||
✔ drop-in directory (934.896589ms)
|
||||
✔ drop-in file (958.129787ms)
|
||||
✔ relative unit path (943.563721ms)
|
||||
✔ T28 a unit path, drop-in directory or drop-in file that cannot be read, or a relative unit path, refuses drop-in-override before any stop (3775.662901ms)
|
||||
▶ T29 a bus that stops during the held-store read: --plan says so, rollback --restore refuses restore-mismatch
|
||||
✔ --plan (932.393863ms)
|
||||
✔ rollback --restore (2879.958858ms)
|
||||
✔ T29 a bus that stops during the held-store read: --plan says so, rollback --restore refuses restore-mismatch (3812.923223ms)
|
||||
✔ T30 a copy check that agrees on another copy fails the gate with copy-check and rolls back (6646.085499ms)
|
||||
▶ T31 a quoted or escaped Environment= or ExecStart= is unreadable: refusals by name, nothing read from /a
|
||||
✔ Environment double quotes (1976.227811ms)
|
||||
✔ Environment single quotes (2063.211816ms)
|
||||
✔ Environment backslash (2038.183771ms)
|
||||
✔ ExecStart quotes (1984.451614ms)
|
||||
✔ Console ExecStart quotes (1980.466835ms)
|
||||
✔ T31 a quoted or escaped Environment= or ExecStart= is unreadable: refusals by name, nothing read from /a (10043.710809ms)
|
||||
▶ T32 item 1: --pm-after-harness refuses a target without harness or a file that sets it, and passes without the PM
|
||||
✔ usage: not with --pm, and only for activate (721.955423ms)
|
||||
✔ pm-after-harness-target (1015.757752ms)
|
||||
✔ pm-after-harness-set (1371.242025ms)
|
||||
✔ a pointer without pm (841.537689ms)
|
||||
✔ phase 1 installs without --pm, skips pm_launched and writes the pending pointer (1915.010297ms)
|
||||
✔ T32 item 1: --pm-after-harness refuses a target without harness or a file that sets it, and passes without the PM (5866.555622ms)
|
||||
▶ T33 item 2: read_pointer takes pmPending only as true beside pm false; a pending pointer refuses activate and shows in status
|
||||
✔ read_pointer (1570.154285ms)
|
||||
✔ pm-pending, already-adopted and the status line (3037.065347ms)
|
||||
✔ T33 item 2: read_pointer takes pmPending only as true beside pm false; a pending pointer refuses activate and shows in status (4607.778248ms)
|
||||
▶ T34 item 3: pm-on refuses before any stop, passes with the PM, or puts the phase-1 bus back
|
||||
✔ not-pending (719.010856ms)
|
||||
✔ harness-unset (2272.485716ms)
|
||||
✔ a launched line passes: the bus alone restarts with --pm (3276.598137ms)
|
||||
✔ a failed pm_launched puts the phase-1 unit back: exit 1, still pending (6693.543553ms)
|
||||
✔ a failed phase-1 gate too: pm-on-down, exit 2, both units stopped (8141.636634ms)
|
||||
✔ T34 item 3: pm-on refuses before any stop, passes with the PM, or puts the phase-1 bus back (21104.286659ms)
|
||||
▶ T35 item 4: rollback from pending installs --pm; a plug-in kind the target lacks refuses by name
|
||||
✔ rollback from pending gates pm_launched on the old copy (3372.092831ms)
|
||||
✔ after the harness set, rollback refuses until harness is gone (5046.857905ms)
|
||||
✔ activate names every kind the target lacks (1244.308621ms)
|
||||
✔ T35 item 4: rollback from pending installs --pm; a plug-in kind the target lacks refuses by name (9663.997607ms)
|
||||
✔ T36 --plan shows the pending state and lists the row 169 refusals it can see (3695.067003ms)
|
||||
✔ T37 tester-port activate writes pointer and unit, replaces the port, and supported re-pin and rollback keep it (6897.072525ms)
|
||||
✔ T38 tester-port rollback to unsupported target drops flag in plan, steps, unit and pointer (3812.546819ms)
|
||||
✔ T39 tester-port explicit unsupported target reads target copy and refuses before stopping either unit (904.276249ms)
|
||||
✔ T40 tester-port invalid values refuse exit 4 before stopping, including tunnel and main ports (819.160889ms)
|
||||
✔ T41 tester-port inherited activate to unsupported target drops it and retains drift refusal and failed-run recovery (8462.827367ms)
|
||||
✔ T42 tester-port pm-on preserves pointer Console flags (3200.83272ms)
|
||||
▶ T43 row 180 item 1: runs in one second get distinct activation ids, rollback sets and post-attempt stores
|
||||
✔ activate then pm-on on the same copy (3520.417628ms)
|
||||
✔ two restores: an old-form id and a suffixed one, each with its own post-attempt store (6507.524064ms)
|
||||
✔ adopt takes the next free id too (703.050442ms)
|
||||
✔ all ten names taken: capture-failed before anything stops, and the log line names no activation (956.29941ms)
|
||||
✔ --restore takes an id with or without -1 to -9 and nothing else (971.565868ms)
|
||||
✔ T43 row 180 item 1: runs in one second get distinct activation ids, rollback sets and post-attempt stores (12659.952034ms)
|
||||
▶ T44 row 180 item 2: --plan lists tester-port-invalid and tester-port-target with its other refusals
|
||||
✔ a bad tester port (1970.260005ms)
|
||||
✔ without --plan a bad port is usage before any pointer read (650.605696ms)
|
||||
✔ a target Console without --tester-port (1005.8136ms)
|
||||
✔ T44 row 180 item 2: --plan lists tester-port-invalid and tester-port-target with its other refusals (3627.354723ms)
|
||||
▶ T45 row 181 items 2 and 3: the restore guard counts events and every COUNTED table
|
||||
✔ both modes count events and each listed table, and a table the store lacks counts 0 (817.850391ms)
|
||||
✔ one instance_names row and no event refuses before any stop; --events 1 restores (4258.491111ms)
|
||||
✔ one usage_records row and no event refuses before any stop; --events 1 restores (4200.77682ms)
|
||||
✔ a listed table that cannot be read refuses restore-mismatch before any stop (2308.610496ms)
|
||||
✔ the in-run recount counts the listed tables too (3113.596786ms)
|
||||
✔ T45 row 181 items 2 and 3: the restore guard counts events and every COUNTED table (14700.29833ms)
|
||||
✔ T46 row 181 item 4: every table in the bus schema is in exactly one of four lists (3.037176ms)
|
||||
✔ T47 row 185 test 1: a same-schema activate leaves a whole backup and the log line names it (1868.973993ms)
|
||||
✔ T48 row 185 test 2: a gate failure on a same-schema activate rolls back without a restore (5804.760552ms)
|
||||
▶ T49 row 185 test 3: a same-schema rollback --restore restores, or refuses rows written after STAMP
|
||||
✔ no rows after STAMP: restores and goes live (3320.288695ms)
|
||||
✔ one instance_names row after STAMP refuses post-backup-events; --events 1 restores (3651.108762ms)
|
||||
✔ T49 row 185 test 3: a same-schema rollback --restore restores, or refuses rows written after STAMP (6972.06843ms)
|
||||
✔ T50 row 185 test 4: activate --plan prints the backup line and writes nothing (2352.202566ms)
|
||||
✔ T51 row 185 test 5: an activate with no store file takes no backup (2180.71818ms)
|
||||
▶ T52 row 186: the activate plan's backup line says what the run will do
|
||||
✔ same schema (2482.119077ms)
|
||||
✔ same schema with --migrate (2194.383877ms)
|
||||
✔ in chain with --migrate (2161.378827ms)
|
||||
✔ in chain without --migrate (1945.096692ms)
|
||||
✔ outside the chain (1933.991036ms)
|
||||
✔ outside the chain with --migrate (1982.219098ms)
|
||||
✔ T52 row 186: the activate plan's backup line says what the run will do (12700.35568ms)
|
||||
✔ T178 proxy proof header and path survive re-pin and rollback unchanged in the pointer and unit (3084.56264ms)
|
||||
✔ T178 proxy proof pair survives a tester-port replacement as well (1871.352274ms)
|
||||
▶ T53 row 187: activate sets, carries and drops the proof pair
|
||||
✔ tests 1 and 9: the pair goes after the preview flags, before --send and the kept --tester-port, as the unit renders it; a new pair replaces it (5957.458612ms)
|
||||
✔ tests 2 and 3: an activate of the live copy writes the pair; a later activate and a rollback carry it (4748.919152ms)
|
||||
✔ test 2: only a pair change may name the live copy; the log keeps from and to, and rollback still goes to the earlier copy (6348.550383ms)
|
||||
✔ test 2: a live-copy activate says only the Console flags change, and backs up the stopped store before it installs (3766.45236ms)
|
||||
✔ test 3: pm-on keeps the pair (2959.180793ms)
|
||||
✔ test 4: --no-proof drops the pair from the pointer and the unit and says so; with no pair it says so and passes (5233.036939ms)
|
||||
✔ test 5: each refusal exits 3 before anything stops (3649.68534ms)
|
||||
✔ tests 5 and 9: --plan lists every proof refusal with the others and writes nothing (836.025341ms)
|
||||
✔ test 6: usage errors (773.25631ms)
|
||||
✔ test 7: a rollback to a copy without proof support drops the pair and says so (3311.183201ms)
|
||||
✔ test 7: an activate to a copy without proof support refuses proof-target without --no-proof and passes with it (3616.1202ms)
|
||||
✔ T53 row 187: activate sets, carries and drops the proof pair (41201.876404ms)
|
||||
▶ T54 row 188: a carried pair gets the proof file checks, and a proof file inside the repository refuses
|
||||
✔ test 1: an activate that carries the pair refuses after chmod 644, in the plan and the run, before anything stops (2194.421439ms)
|
||||
✔ test 1: an activate that carries the pair refuses after a symlink to a mode-600 file, in the plan and the run, before anything stops (2189.529552ms)
|
||||
✔ test 1: an activate that carries the pair refuses after removal, in the plan and the run, before anything stops (2243.035352ms)
|
||||
✔ test 2: a rollback that carries the pair refuses after chmod 644, in the plan and the run, before anything stops (2336.000835ms)
|
||||
✔ test 3: a proof file inside the repository refuses, in the plan and the run, before anything stops (1105.046097ms)
|
||||
✔ test 4: a path outside the repository through a directory symlink into it refuses on its realpath (1150.666433ms)
|
||||
✔ T54 row 188: a carried pair gets the proof file checks, and a proof file inside the repository refuses (11219.876632ms)
|
||||
▶ T55 row 189: activate --no-send drops --send, and rollback and pm-on carry it off
|
||||
✔ test 1: a live-copy --no-send drops --send from the pointer and the unit, keeps the rest in order, logs the step and backs up the stopped store (2274.3857ms)
|
||||
✔ test 2: a plain live-copy activate still refuses already-active, and so does --no-send once --send is gone (3110.763383ms)
|
||||
✔ test 3: --plan prints one send: line in each case, with the live-copy note on a same-copy run (4485.563548ms)
|
||||
✔ test 4: after --no-send, a rollback to the earlier copy leaves --send out of the pointer and the unit (3260.741012ms)
|
||||
✔ test 4: pm-on after --no-send keeps --send off (3151.996202ms)
|
||||
✔ test 5: --no-send on rollback, pm-on, status, adopt or rehearse is a usage error (654.253174ms)
|
||||
✔ test 6: with both a pair and --send in the pointer, --no-send and --no-proof each drop what they name and keep the rest (9881.189087ms)
|
||||
✔ T55 row 189: activate --no-send drops --send, and rollback and pm-on carry it off (26820.278319ms)
|
||||
▶ T57 row 200: activate --sso, its refusals before any stop, and the rollback to a Console without --sso
|
||||
✔ item 1: --sso drops the preview set and the pair, puts --sso before --send and the tester port, and the plan names what it drops and carries (3703.052075ms)
|
||||
✔ item 1: --sso may re-pin the live copy once; later activates carry it; --no-send still drops --send (8819.731338ms)
|
||||
✔ item 1: --sso with a pair or --no-proof, or on any verb but activate, is a usage error (692.195455ms)
|
||||
✔ item 2: a target without --sso, a missing or bad console.sso, and each slot problem refuse before any stop (5662.393194ms)
|
||||
✔ item 3: a config whose console key the target loader refuses stops an activate or a rollback before any stop, naming the first step (4284.150525ms)
|
||||
✔ item 3: a rollback from --sso to a Console without it takes the flags from the set of the activation onto the copy, past a same-copy re-pin (sage-1389) (11448.283647ms)
|
||||
✔ item 3: a rollback set that is missing, fails its sums, holds no argv or already ran --sso refuses sso-rollback-flags (4548.577973ms)
|
||||
✔ round 2 (webby-0028 N1): run through a symlinked repository path, a slot or a proof file inside the repository still refuses (2401.295904ms)
|
||||
✔ round 2 (webby-0028 N2): a config.json that does not parse stops the run before anything is read or stopped (2172.272961ms)
|
||||
✔ round 3 (sage-1556): a named instance turns --sso on with its own config, slot and Console unit, and rolls back from its own set (4291.803296ms)
|
||||
✔ row 238 (#1744): on a named instance the sso-config first step names --instance NAME in both commands (1134.427878ms)
|
||||
✔ T57 row 200: activate --sso, its refusals before any stop, and the rollback to a Console without --sso (49160.357454ms)
|
||||
✔ R1 rehearse passes on the same schema; the scratch root holds its files and the live files stay byte-identical (3480.635997ms)
|
||||
✔ R2 rehearse runs the migration checks when the schema differs; the live store stays at 3g (3538.664935ms)
|
||||
✔ R3 a failing migration gives REHEARSAL_FAIL migrate and starts nothing (352.394887ms)
|
||||
✔ R4 a host that does not start, does not answer status, reports another pid, launches anyway, makes a launches directory or keeps its lock each fails by name (22497.071985ms)
|
||||
✔ R5 a host that ignores SIGTERM gets SIGKILL and FAIL host-stopped (4425.852712ms)
|
||||
✔ R6 a Console that does not answer /healthz gives REHEARSAL_FAIL healthz (5628.652507ms)
|
||||
✔ R7 a host on another copy fails copy-match (5626.942239ms)
|
||||
✔ R8 a scratch port in use or reserved refuses, and the rehearsal takes no other port (483.876429ms)
|
||||
✔ R9 mos-0963: a role reference left outside placeholders/, or left on an env variable, fails credential-ref-live before the host starts (737.183647ms)
|
||||
✔ R10 mos-0962: a scratch business that still sets a tracker fails tracker-configured (336.641991ms)
|
||||
✔ R11 mos-0961: a scratch config on the live data root or on any root but the scratch one, or a sessions.json naming a running pid, refuses by name (1329.146892ms)
|
||||
✔ R12 mos-0962: a notifier config with a binding fails notify-off (322.530573ms)
|
||||
✔ R13 the pre-checks: an old copy, a backup that fails its sums, a missing backup or pointer, and usage (467.892209ms)
|
||||
✔ R14 a host that writes the live config, the live business file or the backup fails the end check by name (9332.612807ms)
|
||||
✔ R15 a rehearsal stopped by TERM, INT or HUP fails signal and still stops the host and Console and runs the end checks (9980.867141ms)
|
||||
✔ row 233: --backup last takes the newest backup the log records; a later line with backup null does not hide it, and the store line names it (3438.884089ms)
|
||||
✔ row 233: --backup last with no backup in the log, or no log, exits 3 with no-backup and makes no rehearsal directory (190.873827ms)
|
||||
✔ row 233: --backup last refuses a newest backup that is not an activation id, with exit 1 (117.903969ms)
|
||||
▶ T56 row 190: named instances side by side on one unit directory, $BIN and set of stand-ins
|
||||
✔ T-I3 each instance renders its own config, session env and Description, and nothing of another (1497.847969ms)
|
||||
✔ T-I4 a Console port another installed Console takes refuses port-claimed, and a named instance keeps off the default ports (1995.198242ms)
|
||||
✔ T-I6 alpha's activate and rollback reach nothing of beta's (3765.448219ms)
|
||||
✔ T-I6 swapped: beta's reach nothing of alpha's (3738.069466ms)
|
||||
✔ T-I7 MOSAIC_CONFIG naming alpha's config with no flag refuses instance-root-mismatch and changes nothing (672.561735ms)
|
||||
✔ T-I9 another instance's bus active refuses nothing; one of this instance's does (5819.537565ms)
|
||||
✔ T56 row 190: named instances side by side on one unit directory, $BIN and set of stand-ins (17490.000329ms)
|
||||
ℹ tests 196
|
||||
ℹ suites 0
|
||||
ℹ pass 196
|
||||
ℹ fail 0
|
||||
ℹ cancelled 0
|
||||
ℹ skipped 0
|
||||
ℹ todo 0
|
||||
ℹ duration_ms 533493.817869
|
||||
-29
@@ -1,29 +0,0 @@
|
||||
✔ row 233: sequence 1: confirm fails healthz, the driver reverts, renders the old copy and confirm --rollback --cause A5 passes: exit 1 (6210.373434ms)
|
||||
✔ row 233: sequence 2: activate --migrate fails at the wrapper, revert restores the store, confirm --rollback --cause A3: exit 1 (3236.556603ms)
|
||||
✔ row 233: sequence 3: root's render of the new copy fails, the driver rolls back with --cause A4, and holds the lock to the end: exit 1 (3088.506825ms)
|
||||
✔ row 233: sequence 4: a capture failure is exit 3 from the stage, and A2f restarts the old units and gates them: exit 1 (2296.722984ms)
|
||||
✔ row 233: N1: a bus that outlives A2's timeout keeps its old start, so A2f's gate fails stale-start: exit 2, both units stopped (7977.855045ms)
|
||||
✔ row 233: sequence 5: confirm of the wrong copy is refused, and the driver rolls back with --cause A5: exit 1 (3484.271196ms)
|
||||
✔ row 233: sequence 6: a revert that fails stops both units at exit 2, and the next run refuses at its --plan with nothing stopped (2709.834241ms)
|
||||
✔ row 233: sequence 7: two upgrades and a rollback --to the previous copy with --restore, the args file following each confirm (7481.097653ms)
|
||||
✔ row 240: I3 N1: a failed args move after A5 exits 5 args-failed, the new copy live and confirmed and both args files kept (2791.714439ms)
|
||||
✔ row 233: sequence 8: a migration that writes and fails: the driver reverts to the backup byte for byte, --cause A3: exit 1 (3155.287145ms)
|
||||
✔ row 233: a second run while the lock is held refuses upgrade-running with one log line and no call (659.849042ms)
|
||||
✔ row 233: A1 refuses open-activation on any AWAITING-UNITS file, through the stack's user's --plan, with nothing stopped (1064.03698ms)
|
||||
✔ row 233: a target that migrates refuses migrate-required without --migrate, with nothing stopped (1067.011634ms)
|
||||
✔ row 233: the rehearsal runs after the plan and before A2; a failed one refuses rehearsal-failed with nothing stopped (1099.022074ms)
|
||||
✔ row 233: the rehearsal's BACKUP_STORE line goes to the step log after a match, a malformed one as none, the rest of its output never (2918.095196ms)
|
||||
✔ row 233: a real rehearsal with no backup in the log refuses no-backup, and goes on only with --no-rehearsal, which logs the skip (3400.448853ms)
|
||||
✔ row 233: a real rehearsal after an upgrade names the log's newest backup; --no-rehearsal with a backup refuses rehearsal-required (3795.598553ms)
|
||||
✔ row 233: the args file must be the running user's, with no group or other write, one --copy, and the copy the units run (839.804685ms)
|
||||
✔ row 233: hostcheck (row 240): a nonzero --check or a missing file refuses profile-drift before the plan (962.315692ms)
|
||||
✔ row 233: the checkout must be at --sha (head-mismatch), and a commit the clone can't fast-forward to refuses fetch-failed (936.914531ms)
|
||||
✔ row 233: usage exits 4 before any log or lock (685.887579ms)
|
||||
ℹ tests 21
|
||||
ℹ suites 0
|
||||
ℹ pass 21
|
||||
ℹ fail 0
|
||||
ℹ cancelled 0
|
||||
ℹ skipped 0
|
||||
ℹ todo 0
|
||||
ℹ duration_ms 60456.446459
|
||||
-12
@@ -1,12 +0,0 @@
|
||||
✔ C2-04: a library-only business with tracker.baseUrl boots without a project tracker (143.257728ms)
|
||||
task.close {} answered: invalid-request; fake saw 18 requests, first GET /info 200, GET /projects/1 200, GET /projects/1/views 200
|
||||
task.close on a missing task answered: task-not-found; it made GET /tasks/999 404
|
||||
✔ bootConfig trackers reach the S3 adapter in the real broker child, which goes ready against a fake Vikunja (274.054339ms)
|
||||
ℹ tests 2
|
||||
ℹ suites 0
|
||||
ℹ pass 2
|
||||
ℹ fail 0
|
||||
ℹ cancelled 0
|
||||
ℹ skipped 0
|
||||
ℹ todo 0
|
||||
ℹ duration_ms 502.723687
|
||||
@@ -1,24 +0,0 @@
|
||||
✔ C2-04 mirror: exact default path, bare without checkout or remote, and idempotent initialization (35.180686ms)
|
||||
✔ C2-04 mirror: simultaneous creators publish one intact mirror and leave no staging paths (28.575775ms)
|
||||
✔ C2-04 mirror: skipped publication accepts both coreutils statuses without removing the winner (100.935123ms)
|
||||
✔ C2-04 mirror: preserve occupied directories and reject symlink ancestors and code overlaps (11.206477ms)
|
||||
✔ C2-04 mirror: existing metadata accepts only bare Git plus state and the precreated lock (20.077192ms)
|
||||
✔ C2-04 state: missing state is empty only while the served ref is absent (32.816347ms)
|
||||
✔ C2-04 state: valid problems and sync metadata return no content and change no state bytes (34.864084ms)
|
||||
✔ C2-04 state: strict keys, types, times, branch, commit and fixed R messages fail closed (97.291867ms)
|
||||
✔ C2-04 state: symlink, hardlink, non-private state and missing lock refuse without replacement (29.030379ms)
|
||||
✔ C2-04 file: served commit, not HEAD or a caller commit, owns the exact returned text (71.409306ms)
|
||||
✔ C2-04 file: R1, R2 and R7 exclusions and never-synced mirrors cannot return file bodies (78.061049ms)
|
||||
✔ C2-04 lock: a first-sync and fast-forward reader wait for a consistent pair across processes (230.30816ms)
|
||||
✔ C2-04 lock: same-process waits, timeout code, callback expiry and throw release (5027.25259ms)
|
||||
✔ C2-04 lock: owner death releases the kernel lock without replacing its file (52.471475ms)
|
||||
✔ C2-04 lock: a missing flock binary becomes a handled refusal (44.850141ms)
|
||||
✔ C2-04 lock: an unawaited scoped read drains before the lock is released (19.645975ms)
|
||||
ℹ tests 16
|
||||
ℹ suites 0
|
||||
ℹ pass 16
|
||||
ℹ fail 0
|
||||
ℹ cancelled 0
|
||||
ℹ skipped 0
|
||||
ℹ todo 0
|
||||
ℹ duration_ms 5963.543966
|
||||
-23
@@ -1,23 +0,0 @@
|
||||
✔ C2-04: record APIs refuse a library before creating a repository (2.136303ms)
|
||||
✔ init creates a checked versioned layout, valid templates and human-authored local history (25.282114ms)
|
||||
✔ init honors repo, refuses a non-empty directory and an undeclared project without touching files (13.067957ms)
|
||||
✔ check reports every bad record, filename mismatch and unknown top-level path (11.851979ms)
|
||||
✔ one writer commits validated docs, requirements and decisions with the bound agent author (66.653ms)
|
||||
✔ writer refuses spec paths, bad schemas, mismatched IDs and invalid actor metadata before changing history (14.848593ms)
|
||||
✔ writer refuses human pending edits and remotes instead of absorbing or contacting them (18.544136ms)
|
||||
✔ links, repo/code overlap, identity mismatch and a busy writer refuse safely (17.705717ms)
|
||||
✔ schemas remain package-owned and reject invalid nested data and dates (0.249795ms)
|
||||
✔ git commit failure restores only the attempted record and leaves human history unchanged (36.217826ms)
|
||||
✔ git hooks and ambient git identity cannot alter the record writer or execute outside actions (25.483658ms)
|
||||
✔ project-local schemas cannot weaken checks; invalid UTF-8 and linked git directories refuse (14.206204ms)
|
||||
✔ schema constraints and layout omissions are reported independently (12.868115ms)
|
||||
✔ unsupported schema keywords, malformed contexts, ignored local config and nonempty markers refuse (18.523225ms)
|
||||
✔ a linked git directory is refused before a writer lock can touch its target (30.574055ms)
|
||||
ℹ tests 15
|
||||
ℹ suites 0
|
||||
ℹ pass 15
|
||||
ℹ fail 0
|
||||
ℹ cancelled 0
|
||||
ℹ skipped 0
|
||||
ℹ todo 0
|
||||
ℹ duration_ms 355.86586
|
||||
@@ -1,91 +0,0 @@
|
||||
✔ C2-04: ensureCheckouts skips a library before a real clone and leaves no books path (22.355495ms)
|
||||
✔ a first launch clones the root at its branch, with the root's path as origin (23.522928ms)
|
||||
✔ the clone is not at its place until git clone has finished (19.304369ms)
|
||||
✔ a later launch fast-forwards a clean clone after a commit to the root, then finds it current (56.365259ms)
|
||||
✔ a clone ahead of the root keeps its commits and counts as current (35.573942ms)
|
||||
▶ a dirty clone and one on another branch are fetched, and nothing but refs/remotes moves
|
||||
✔ a modified file (41.519272ms)
|
||||
✔ an untracked file (42.31579ms)
|
||||
✔ a staged file (42.328417ms)
|
||||
✔ another branch (40.470049ms)
|
||||
✔ a detached HEAD (40.702516ms)
|
||||
✔ a dirty clone and one on another branch are fetched, and nothing but refs/remotes moves (208.344457ms)
|
||||
✔ a diverged clone gets the fetch into refs/remotes and is kept, not-fast-forward (42.026437ms)
|
||||
▶ a clone kept before the branch check, or for a failed status, gets no fetch
|
||||
✔ not-a-clone (22.404264ms)
|
||||
✔ hooks-present (23.073574ms)
|
||||
✔ submodule (30.027272ms)
|
||||
✔ config-changed (26.84014ms)
|
||||
✔ root-unreadable (27.464656ms)
|
||||
✔ root-detached (32.242501ms)
|
||||
✔ status-failed, on the root's branch and clean (35.760734ms)
|
||||
✔ status-failed, dirty (35.340017ms)
|
||||
✔ a clone kept before the branch check, or for a failed status, gets no fetch (234.251087ms)
|
||||
✔ a dirty clone whose fetch fails is kept, fetch-failed, exactly as it was (37.035833ms)
|
||||
✔ every git call the host makes, for a new clone and an existing one, carries maintenance.auto=false and gc.auto=0 (44.392371ms)
|
||||
✔ a clone with loose objects enough for gc --auto gets no maintenance or gc from the fetch and the merge (71.033894ms)
|
||||
▶ a clone with user.name or user.email in its config is kept, and git runs nothing in it
|
||||
✔ user.name (25.544784ms)
|
||||
✔ user.email (25.14754ms)
|
||||
✔ a clone with user.name or user.email in its config is kept, and git runs nothing in it (51.146879ms)
|
||||
✔ a commit git can't read after the fast-forward is null (45.746486ms)
|
||||
✔ a new clone whose commit can't be read refuses the launch and leaves nothing behind (18.576825ms)
|
||||
▶ a clone the session rigged is kept, and git runs nothing and writes nothing outside it
|
||||
✔ core.fsmonitor (33.120199ms)
|
||||
✔ core.hooksPath (33.027016ms)
|
||||
✔ a hook file (30.549575ms)
|
||||
✔ include.path (33.355749ms)
|
||||
✔ includeIf (33.915275ms)
|
||||
✔ a filter driver (34.236367ms)
|
||||
✔ origin moved (34.552998ms)
|
||||
✔ a second origin url (33.217597ms)
|
||||
✔ the origin url twice, both the root (34.870837ms)
|
||||
✔ an ext:: origin (33.6526ms)
|
||||
✔ a branch tracking another remote (33.582081ms)
|
||||
✔ a branch merging a tag (33.08648ms)
|
||||
✔ a fetch line onto local branches (34.366694ms)
|
||||
✔ no origin (33.938644ms)
|
||||
✔ a config file over the size cap (31.285987ms)
|
||||
✔ config a symlink to /dev/zero (31.094858ms)
|
||||
✔ the clone a symlink to the bait (32.754738ms)
|
||||
✔ the clone a file (31.24085ms)
|
||||
✔ the clone a plain directory (30.973366ms)
|
||||
✔ .git a gitdir: file (31.404094ms)
|
||||
✔ .git a symlink (30.769522ms)
|
||||
✔ .git/logs a symlink (30.883317ms)
|
||||
✔ .git/refs/heads a symlink (31.770074ms)
|
||||
✔ .git/objects a symlink (30.840803ms)
|
||||
✔ a reflog hard-linked to a file outside (30.322982ms)
|
||||
✔ HEAD a fifo (31.496048ms)
|
||||
✔ a commondir file (30.352537ms)
|
||||
✔ an alternates file (30.782307ms)
|
||||
✔ a gitlink staged, no .gitmodules (43.468245ms)
|
||||
✔ a gitlink and .gitmodules staged (44.893483ms)
|
||||
✔ a gitlink to a repository with its own gitlink (51.849481ms)
|
||||
✔ a gitlink and .gitmodules committed (47.718755ms)
|
||||
✔ a gitlink and submodule.active in config (44.861481ms)
|
||||
✔ a .git/modules with no gitlink (33.279554ms)
|
||||
✔ a clone the session rigged is kept, and git runs nothing and writes nothing outside it (1175.645437ms)
|
||||
▶ a root that can't be cloned refuses with the project id and leaves nothing behind
|
||||
✔ missing (10.161685ms)
|
||||
✔ not a repository (9.929001ms)
|
||||
✔ a plain directory inside another repository (14.613067ms)
|
||||
✔ unreadable (9.85915ms)
|
||||
✔ on no branch (11.8808ms)
|
||||
✔ missing an object (15.129485ms)
|
||||
✔ a root that can't be cloned refuses with the project id and leaves nothing behind (72.336456ms)
|
||||
✔ a clone whose root is on no branch, or gone, is kept and named (28.236024ms)
|
||||
✔ no credential or forge remote of the root reaches a clone (47.533999ms)
|
||||
✔ every project in the business file gets its own clone at its own branch (36.497038ms)
|
||||
✔ a clone past its time gets SIGTERM and refuses the launch, with nothing left in the workspace (513.397369ms)
|
||||
✔ a clone that ignores SIGTERM gets SIGKILL once the grace period is over (1018.126958ms)
|
||||
✔ a timeout signals git's process group, so a process git started dies with it (515.579592ms)
|
||||
✔ once a signalled git has closed, its group gets SIGKILL, so a process that ignored SIGTERM dies too (515.62296ms)
|
||||
ℹ tests 78
|
||||
ℹ suites 0
|
||||
ℹ pass 78
|
||||
ℹ fail 0
|
||||
ℹ cancelled 0
|
||||
ℹ skipped 0
|
||||
ℹ todo 0
|
||||
ℹ duration_ms 4880.907448
|
||||
-9
@@ -1,9 +0,0 @@
|
||||
✔ C2-04 CLI: both listener callback pairs dispatch library verbs with their own transport (109.519835ms)
|
||||
ℹ tests 1
|
||||
ℹ suites 0
|
||||
ℹ pass 1
|
||||
ℹ fail 0
|
||||
ℹ cancelled 0
|
||||
ℹ skipped 0
|
||||
ℹ todo 0
|
||||
ℹ duration_ms 191.536271
|
||||
@@ -1 +0,0 @@
|
||||
{"processes": [], "removed": "/mnt/storage/scratch/gt-j5nm6iqn", "sourceHashesUnchanged": 29}
|
||||
@@ -1,5 +0,0 @@
|
||||
{
|
||||
"base": "f8276c5eb",
|
||||
"tip": "8a04f4aa4aba493eb89e92aa9e0c34084be7058e",
|
||||
"overlap": []
|
||||
}
|
||||
@@ -1 +0,0 @@
|
||||
2026-10-21T13:27:27.279728+00:00
|
||||
@@ -1,194 +0,0 @@
|
||||
[
|
||||
{
|
||||
"file": "packages/bus/tests/library.test.mjs",
|
||||
"rc": 0,
|
||||
"counts": {
|
||||
"tests": 6,
|
||||
"pass": 6,
|
||||
"fail": 0,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
},
|
||||
"log": "01-packages_bus_tests_library.test.mjs.log"
|
||||
},
|
||||
{
|
||||
"file": "packages/bus/tests/project-runtime.test.mjs",
|
||||
"rc": 0,
|
||||
"counts": {
|
||||
"tests": 3,
|
||||
"pass": 3,
|
||||
"fail": 0,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
},
|
||||
"log": "02-packages_bus_tests_project-runtime.test.mjs.log"
|
||||
},
|
||||
{
|
||||
"file": "packages/business/tests/business.test.mjs",
|
||||
"rc": 0,
|
||||
"counts": {
|
||||
"tests": 19,
|
||||
"pass": 19,
|
||||
"fail": 0,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
},
|
||||
"log": "03-packages_business_tests_business.test.mjs.log"
|
||||
},
|
||||
{
|
||||
"file": "packages/business/tests/cli.test.mjs",
|
||||
"rc": 0,
|
||||
"counts": {
|
||||
"tests": 10,
|
||||
"pass": 10,
|
||||
"fail": 0,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
},
|
||||
"log": "04-packages_business_tests_cli.test.mjs.log"
|
||||
},
|
||||
{
|
||||
"file": "packages/business/tests/instance-settings.test.mjs",
|
||||
"rc": 0,
|
||||
"counts": {
|
||||
"tests": 13,
|
||||
"pass": 13,
|
||||
"fail": 0,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
},
|
||||
"log": "05-packages_business_tests_instance-settings.test.mjs.log"
|
||||
},
|
||||
{
|
||||
"file": "packages/business/tests/library-projects-protected.test.mjs",
|
||||
"rc": 0,
|
||||
"counts": {
|
||||
"tests": 4,
|
||||
"pass": 4,
|
||||
"fail": 0,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
},
|
||||
"log": "06-packages_business_tests_library-projects-protected.test.mjs.log"
|
||||
},
|
||||
{
|
||||
"file": "packages/business/tests/resolve.test.mjs",
|
||||
"rc": 0,
|
||||
"counts": {
|
||||
"tests": 11,
|
||||
"pass": 11,
|
||||
"fail": 0,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
},
|
||||
"log": "07-packages_business_tests_resolve.test.mjs.log"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/launcher.test.mjs",
|
||||
"rc": 0,
|
||||
"counts": {
|
||||
"tests": 31,
|
||||
"pass": 31,
|
||||
"fail": 0,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
},
|
||||
"log": "08-packages_cli_tests_launcher.test.mjs.log"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release-external.test.mjs",
|
||||
"rc": 0,
|
||||
"counts": {
|
||||
"tests": 25,
|
||||
"pass": 25,
|
||||
"fail": 0,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
},
|
||||
"log": "09-packages_cli_tests_stack-release-external.test.mjs.log"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"rc": 0,
|
||||
"counts": {
|
||||
"tests": 196,
|
||||
"pass": 196,
|
||||
"fail": 0,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
},
|
||||
"log": "10-packages_cli_tests_stack-release.test.mjs.log"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-upgrade.test.mjs",
|
||||
"rc": 0,
|
||||
"counts": {
|
||||
"tests": 21,
|
||||
"pass": 21,
|
||||
"fail": 0,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
},
|
||||
"log": "11-packages_cli_tests_stack-upgrade.test.mjs.log"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/trackers-boot.test.mjs",
|
||||
"rc": 0,
|
||||
"counts": {
|
||||
"tests": 2,
|
||||
"pass": 2,
|
||||
"fail": 0,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
},
|
||||
"log": "12-packages_cli_tests_trackers-boot.test.mjs.log"
|
||||
},
|
||||
{
|
||||
"file": "packages/library/tests/mirror.test.mjs",
|
||||
"rc": 0,
|
||||
"counts": {
|
||||
"tests": 16,
|
||||
"pass": 16,
|
||||
"fail": 0,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
},
|
||||
"log": "13-packages_library_tests_mirror.test.mjs.log"
|
||||
},
|
||||
{
|
||||
"file": "packages/project/tests/project.test.mjs",
|
||||
"rc": 0,
|
||||
"counts": {
|
||||
"tests": 15,
|
||||
"pass": 15,
|
||||
"fail": 0,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
},
|
||||
"log": "14-packages_project_tests_project.test.mjs.log"
|
||||
},
|
||||
{
|
||||
"file": "packages/seat/tests/checkout.test.mjs",
|
||||
"rc": 0,
|
||||
"counts": {
|
||||
"tests": 78,
|
||||
"pass": 78,
|
||||
"fail": 0,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
},
|
||||
"log": "15-packages_seat_tests_checkout.test.mjs.log"
|
||||
},
|
||||
{
|
||||
"file": "packages/webui/tests/library-cli.test.mjs",
|
||||
"rc": 0,
|
||||
"counts": {
|
||||
"tests": 1,
|
||||
"pass": 1,
|
||||
"fail": 0,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
},
|
||||
"log": "16-packages_webui_tests_library-cli.test.mjs.log"
|
||||
}
|
||||
]
|
||||
@@ -1 +0,0 @@
|
||||
/mnt/storage/scratch/gt-j5nm6iqn
|
||||
@@ -1 +0,0 @@
|
||||
2026-10-21T13:15:15.548778+00:00
|
||||
@@ -1 +0,0 @@
|
||||
{"tests": 451, "pass": 451, "fail": 0, "cancelled": 0, "skipped": 0}
|
||||
@@ -1,14 +0,0 @@
|
||||
✔ C2-04 M4: both verbs reject every agent before arguments or adapter access (31.111616ms)
|
||||
✔ C2-04 bus: human reads validate keys and return adapter results without path leakage (12.907709ms)
|
||||
✔ C2-04 socket: each async library verb resolves its result rather than serializing {} (14.631614ms)
|
||||
✔ C2-04 runtime: protectedRoots skips library but retains real code-root credential protection (42.32493ms)
|
||||
✔ C2-04 runtime: unsafe existing mirror refuses boot and never publishes a socket (20.701022ms)
|
||||
✔ C2-04 runtime: real library adapters reach the socket and lock waits leave other bus reads responsive (82.322654ms)
|
||||
ℹ tests 6
|
||||
ℹ suites 0
|
||||
ℹ pass 6
|
||||
ℹ fail 0
|
||||
ℹ cancelled 0
|
||||
ℹ skipped 0
|
||||
ℹ todo 0
|
||||
ℹ duration_ms 342.882774
|
||||
-11
@@ -1,11 +0,0 @@
|
||||
✔ Broker keeps the sandbox client import closure: only the listed imports, no lazy project import (1.629219ms)
|
||||
✔ without a trusted project adapter all three async paths refuse project-not-configured (43.976856ms)
|
||||
✔ real startBroker injects the project adapter for socket reads and bound-author record writes (68.038516ms)
|
||||
ℹ tests 3
|
||||
ℹ suites 0
|
||||
ℹ pass 3
|
||||
ℹ fail 0
|
||||
ℹ cancelled 0
|
||||
ℹ skipped 0
|
||||
ℹ todo 0
|
||||
ℹ duration_ms 209.393305
|
||||
-26
@@ -1,26 +0,0 @@
|
||||
✔ C2-04: library mappings load without roots, remain frozen, and retain mapping refusals (9.717487ms)
|
||||
✔ C2-04: an otherwise valid publish grant cannot name a library repo (1.932435ms)
|
||||
✔ config directory and file path follow MOSAIC_CONFIG (0.219374ms)
|
||||
✔ the fixture business validates and comes back frozen (0.988926ms)
|
||||
✔ two instances may share a definition (0.940973ms)
|
||||
✔ top-level refusals (3.202519ms)
|
||||
✔ arbiters and projects (4.893652ms)
|
||||
✔ role instances (2.749701ms)
|
||||
✔ Vikunja bots (5.88131ms)
|
||||
✔ a role without Vikunja takes no tracker block (4.097438ms)
|
||||
✔ credential references match the definition's services (2.14689ms)
|
||||
✔ launch (7.492201ms)
|
||||
✔ REQ-THREAD-2 REQ-LAUNCH-1 launch.threadIdleSeconds: absent is the default, a positive integer is used, anything else refuses (4.633228ms)
|
||||
✔ loadBusiness: file checks (1.761847ms)
|
||||
✔ loadBusiness: not a regular file (36.320112ms)
|
||||
✔ loading writes nothing (1.117059ms)
|
||||
✔ names that are Object.prototype properties don't count as declared (2.898886ms)
|
||||
✔ the shipped example refuses as written and validates once filled in (0.943369ms)
|
||||
ℹ tests 18
|
||||
ℹ suites 0
|
||||
ℹ pass 18
|
||||
ℹ fail 0
|
||||
ℹ cancelled 0
|
||||
ℹ skipped 0
|
||||
ℹ todo 0
|
||||
ℹ duration_ms 152.091247
|
||||
-18
@@ -1,18 +0,0 @@
|
||||
✔ C2-04: business validate and resolve skip a library before code projects and credential checks (219.31729ms)
|
||||
✔ usage errors exit 4 (321.939555ms)
|
||||
✔ validate: a good business exits 0 and prints instance digests (76.14497ms)
|
||||
✔ validate: project files (353.409636ms)
|
||||
✔ validate: missing files and a broken system config (238.885921ms)
|
||||
✔ validate: credential reference problems exit 2 and name each one (72.187146ms)
|
||||
✔ validate: a token file inside the repository is refused (66.603163ms)
|
||||
✔ validate: role definitions come from MOSAIC_ROLES_DIR (212.341091ms)
|
||||
✔ resolve: prints one instance's record (340.865306ms)
|
||||
✔ resolve: refusals (526.732262ms)
|
||||
ℹ tests 10
|
||||
ℹ suites 0
|
||||
ℹ pass 10
|
||||
ℹ fail 0
|
||||
ℹ cancelled 0
|
||||
ℹ skipped 0
|
||||
ℹ todo 0
|
||||
ℹ duration_ms 2493.367293
|
||||
-20
@@ -1,20 +0,0 @@
|
||||
✔ C2-04: instance settings skip a library while checking a later code project (33.384562ms)
|
||||
✔ row 165 read lists each instance and the definitions add accepts (2.667885ms)
|
||||
✔ row 165 add: two instances join, validate exits 0, the log names the human, and the bus restart is reported (87.186598ms)
|
||||
✔ row 165 change: definition, vars and launch membership log before and after; only a definition change asks for a restart (92.493768ms)
|
||||
✔ row 165 refuses each validation failure and leaves the file's bytes alone (29.566007ms)
|
||||
✔ row 165 refuses an added instance whose definition declares credentials, and says why (3.207564ms)
|
||||
✔ row 165 refuses a definition change to or from one that declares credentials (4.215516ms)
|
||||
✔ row 165 a vars or launch change on an instance with its binding succeeds and keeps the binding (72.107052ms)
|
||||
✔ row 165 refuses an END_PROTECTED definition and every change to a protected instance (7.281711ms)
|
||||
✔ row 165 refuses while a project file doesn't resolve, as validate would (13.645202ms)
|
||||
✔ row 165 refuses a stale revision and leaves the file's bytes alone (10.119096ms)
|
||||
✔ row 65 an instance write refuses harness-off, thinking-unsupported, an unknown model and a partial fallback (29.171515ms)
|
||||
ℹ tests 12
|
||||
ℹ suites 0
|
||||
ℹ pass 12
|
||||
ℹ fail 0
|
||||
ℹ cancelled 0
|
||||
ℹ skipped 0
|
||||
ℹ todo 0
|
||||
ℹ duration_ms 450.444507
|
||||
-12
@@ -1,12 +0,0 @@
|
||||
✔ C2-04 M9: changed playground and hybrid entries leave business and changes.jsonl byte-identical (20.276877ms)
|
||||
✔ C2-04 M9: code projects, additions, deletions and array changes are protected too (16.209877ms)
|
||||
✔ C2-04 M9: canonical key order is allowed and a non-project setter still records its change (13.103686ms)
|
||||
✔ C2-04 M9: a serialization hook cannot change projects after the canonical comparison (12.598611ms)
|
||||
ℹ tests 4
|
||||
ℹ suites 0
|
||||
ℹ pass 4
|
||||
ℹ fail 0
|
||||
ℹ cancelled 0
|
||||
ℹ skipped 0
|
||||
ℹ todo 0
|
||||
ℹ duration_ms 112.92317
|
||||
-19
@@ -1,19 +0,0 @@
|
||||
✔ C2-04: a library first in projects does not hide a later project layer (6.304379ms)
|
||||
✔ systemVars flattens the validated config (0.828852ms)
|
||||
✔ precedence: system, business, project, project role, agent (1.532829ms)
|
||||
✔ limits narrow the definition and never widen it (2.353655ms)
|
||||
✔ role.launch stays within-role only for the instance the launch block names (4.439921ms)
|
||||
✔ limits.authority without role.launch leaves the launcher with no launch block (1.815884ms)
|
||||
✔ limits.authority narrows cross-role actions too (0.827532ms)
|
||||
✔ classify (0.829892ms)
|
||||
✔ the record carries what the broker and launcher need (0.755977ms)
|
||||
✔ digest: key order doesn't matter, any value change does (5.452ms)
|
||||
✔ refusals (1.724971ms)
|
||||
ℹ tests 11
|
||||
ℹ suites 0
|
||||
ℹ pass 11
|
||||
ℹ fail 0
|
||||
ℹ cancelled 0
|
||||
ℹ skipped 0
|
||||
ℹ todo 0
|
||||
ℹ duration_ms 79.941483
|
||||
-53
@@ -1,53 +0,0 @@
|
||||
✔ C2-04: launcher workspace clones code but never the library (1262.341325ms)
|
||||
✔ bus start --pm: the launcher instance (the chief of staff) runs under its own PID namespace, registered, with a manifest (1237.473965ms)
|
||||
usage: {"event":"usage-unknown","business":"acme","run":"r4414332d2ef5","instance":"chief","turn":"382a782c-719a-48e8-a249-ec24caf5ad1e","source":"@none","code":"baseline-unknown"}
|
||||
usage: {"event":"usage-unknown","business":"acme","run":"reaca93954ae7","instance":"coder","turn":"70bcac05-fbc1-41b2-85cb-725c15884a94","source":"@none","code":"baseline-unknown"}
|
||||
✔ the chief of staff launches a coder through its launch tool; the coder answers; refusals name their code (579.516254ms)
|
||||
usage: {"event":"usage-unknown","business":"acme","run":"rb21267233555","instance":"chief","turn":"c228faeb-6e3c-4453-ba9b-b9a27b9790af","source":"@none","code":"baseline-unknown"}
|
||||
usage: {"event":"usage-unknown","business":"acme","run":"r1fc01260daa7","instance":"pm","turn":"a5d09ce0-4208-4eb4-8178-6e06a1792ab9","source":"@none","code":"baseline-unknown"}
|
||||
usage: {"event":"usage-unknown","business":"acme","run":"rb21267233555","instance":"chief","turn":"25722023-5270-4c50-a8a0-7c3645d08bd7","source":"@none","code":"baseline-unknown"}
|
||||
usage: {"event":"usage-unknown","business":"acme","run":"r1fc01260daa7","instance":"pm","turn":"f4a76756-4300-4cdf-a64b-542fc075c137","source":"@none","code":"baseline-unknown"}
|
||||
usage: {"event":"usage-unknown","business":"acme","run":"r1fc01260daa7","instance":"pm","turn":"99ea9441-ce4e-4aab-a56c-614a30c9f0da","source":"@none","code":"baseline-unknown"}
|
||||
usage: {"event":"usage-unknown","business":"acme","run":"rb21267233555","instance":"chief","turn":"d85fa6e4-7557-4adf-b1f6-5e76455a1e51","source":"@none","code":"baseline-unknown"}
|
||||
usage: {"event":"usage-unknown","business":"acme","run":"r1fc01260daa7","instance":"pm","turn":"87f4bf91-2ef2-4fe7-8e99-09fc8b14887e","source":"@none","code":"baseline-unknown"}
|
||||
usage: {"event":"usage-unknown","business":"acme","run":"rb21267233555","instance":"chief","turn":"6db9d009-2cb9-41ba-a07e-da13d92b8182","source":"@none","code":"baseline-unknown"}
|
||||
✔ a launched pm's request_staff reaches the chief of staff; no other session has the tool and the launch limits still hold (917.244851ms)
|
||||
✔ each launch makes sure the workspace has a clone of the project: cloned, fast-forwarded, or fetched and logged (3692.977114ms)
|
||||
✔ a role the broker says holds a merge decision gets land_work, its prompt line, its landing and the git socket; without it, none (439.559581ms)
|
||||
✔ REQ-LAUNCH-1 the tick starts a listed merge decision holder once, with land_work, the Landing line and its landing turn; an unlisted holder starts nothing (324.77099ms)
|
||||
usage: {"event":"usage-unknown","business":"acme","run":"rd33ea739f0c8","instance":"coder","turn":"434622cc-98ff-44b4-99c9-58a8c92f32af","source":"@none","code":"baseline-unknown"}
|
||||
✔ a holder running since before the resolution is stopped once the broker releases it, land-relaunch, and the next tick starts it: landing turn first, then the message that waited (502.385034ms)
|
||||
✔ a landing run that ended isn't started again for its decision, a spent decision starts nothing, and a new decision starts the holder (453.667705ms)
|
||||
✔ after a restart, the new host's first tick starts a holder whose decision is still held (654.880099ms)
|
||||
✔ a refused landing start is logged once per code with its decision, isn't a start, and the next tick with room starts the holder (498.662638ms)
|
||||
✔ a project clone that can't be made refuses checkout-failed, from --chief and from a session, with no run and no clone left (208.782448ms)
|
||||
✔ a runner that stops at once ends its launch with the runner's reason (261.153743ms)
|
||||
✔ a Claude Code launch with no session credential refuses before it starts (143.737058ms)
|
||||
✔ a pi launch needs no session credential: pi logs in through its own ENV_ALLOW variables (239.874115ms)
|
||||
usage: {"event":"plugin-refused","kind":"harness","name":"down","code":"missing","message":"/home/jwoltje/.t3/worktrees/mosaic-stack/herb-row215-on212/packages/plugins/harness/down is missing","kept":[]}
|
||||
plugins: {"event":"plugin-refused","kind":"harness","name":"down","code":"missing","message":"/home/jwoltje/.t3/worktrees/mosaic-stack/herb-row215-on212/packages/plugins/harness/down is missing","kept":[]}
|
||||
✔ row 65 a failed primary preflight launches the fallback on a fixture harness module, recording the route and the reason (281.577833ms)
|
||||
✔ a runner killed from the host ends its launch as killed, not failed (297.263791ms)
|
||||
✔ a missing or failing bwrap refuses sandbox-unavailable before anything starts; there is no unconfined fallback (151.327191ms)
|
||||
✔ row 64 a role skill that isn't enabled refuses skill-not-enabled, and one that isn't a plain directory skill-refused, before anything starts (151.537445ms)
|
||||
✔ row 64 on Claude Code a role skill that isn't enabled refuses the same way, before anything starts (166.552674ms)
|
||||
usage: {"event":"usage-unknown","business":"acme","run":"rc42c73baf400","instance":"chief","turn":"e62acc78-0ddd-4cd3-bb90-c828cf5dc76e","source":"@none","code":"baseline-unknown"}
|
||||
usage: {"event":"usage-unknown","business":"acme","run":"r9fac1139247f","instance":"coder","turn":"e634dd74-b64a-4c8d-8e8d-90244a1070d4","source":"@none","code":"baseline-unknown"}
|
||||
✔ a real Claude Code coder's shell can't read a stand-in secret or anything else its sandbox doesn't hold (1685.572916ms)
|
||||
✔ a host that died hard leaves its sessions to the next host, which kills them and ends their runs so the role can be launched again (791.200293ms)
|
||||
✔ a host that died hard leaves its sessions to the next host, which finds one already exited (23) and ends their runs so the role can be launched again (3731.707174ms)
|
||||
✔ bus start --no-launch leaves an earlier host's live session alone: no signal, no end, sessions.json as it was (196.993732ms)
|
||||
✔ bus start --no-launch refuses every launch: the PM launch and a session's request, each logged, nothing spawned (159.584006ms)
|
||||
✔ bus start --no-launch starts no thread tick; the same host with launches runs it (1086.093241ms)
|
||||
✔ a malformed sessions.json refuses the host start with exit 3 and stays as it was (132.916552ms)
|
||||
✔ an over-long launch request is refused at once, not at the 10 s idle timeout (143.651083ms)
|
||||
✔ a launch client that never closes its side doesn't hold the host's close (144.715063ms)
|
||||
✔ a runner that ignores SIGTERM is killed when the host closes (1275.914847ms)
|
||||
ℹ tests 30
|
||||
ℹ suites 0
|
||||
ℹ pass 30
|
||||
ℹ fail 0
|
||||
ℹ cancelled 0
|
||||
ℹ skipped 0
|
||||
ℹ todo 0
|
||||
ℹ duration_ms 21918.233853
|
||||
-33
@@ -1,33 +0,0 @@
|
||||
✔ row 232: confirm, revert, gate, --to and --expect-from need --units external; the user-only flags are usage under it (832.842347ms)
|
||||
✔ row 232: pm-on and activate --pm-after-harness refuse external-pm (934.889182ms)
|
||||
✔ row 232: units-running (N4) refuses while a unit is active and leaves the store, the log and TAKEN; failed counts as down (2121.604528ms)
|
||||
✔ row 232: activate stages: the pointer stays, AWAITING-UNITS names TO, a backup of the stopped store, no directory in the set, no --user, no journal (1777.227274ms)
|
||||
✔ row 232: A3 order: capture-failed and marker-failed refuse with exit 3 and leave no marker or FAILED (1712.692045ms)
|
||||
✔ row 232: confirm and revert refuse open-activation with no marker, two, the wrong copy, or one the log holds closed; refusals name no activation (3642.165244ms)
|
||||
✔ row 232: confirm polls: bus status good after 3 s fails with --timeout 1, writes FAILED and leaves the rest; FAILED then refuses activation-failed (3522.196896ms)
|
||||
✔ row 232: confirm polls to a pass with --timeout 10: the pointer, an ok line that reads as the started run, no marker (5641.501857ms)
|
||||
✔ row 232: stale-start: @1792540799 fails a start floor of 1792540800 with stale-start (3076.294408ms)
|
||||
✔ row 232: stale-start is a gate code: an enter time that turns to @1792540800 after 2 s passes with --timeout 10 (4471.752137ms)
|
||||
✔ row 232: gate (N2, A2f): --since 1792540800 passes @1792540800 and fails @1792540799; it writes nothing (2692.190142ms)
|
||||
✔ row 232: the external PM check reads launches list: one live run of launch.by since the start passes (9781.807961ms)
|
||||
✔ row 232: revert puts the wrapper back and leaves the store when nothing migrated (1409.775029ms)
|
||||
✔ row 232: confirm --rollback refuses rollback-mismatch, and logs rollback-failed with exit 2 when OLD fails its gate (3556.739549ms)
|
||||
✔ row 232: confirm --rollback after a --restore swap logs rollbackCode not-attempted; rollback --restore finds an external backup (3258.873111ms)
|
||||
✔ row 232: sequence 1: activate, confirm times out, revert, confirm --rollback --cause A5: gate-failed rollback ok (4878.560819ms)
|
||||
✔ row 232: sequence 2: activate --migrate, the wrapper install fails, revert restores TAKEN, confirm --rollback --cause A3 (3203.155908ms)
|
||||
✔ row 232: sequence 3: activate, root's A4 fails, revert, confirm --rollback --cause A4: failed code units-start (2844.170694ms)
|
||||
✔ row 232: sequence 4: a capture failure leaves nothing open, then A2f's gate OLD writes nothing (1940.493148ms)
|
||||
✔ row 232: sequence 5: a confirm of the wrong copy is refused, and revert and confirm --rollback still close the activation (3423.561744ms)
|
||||
✔ row 232: sequence 6: a revert that fails leaves the activation open, and the next --plan refuses interrupted-run (1732.106092ms)
|
||||
✔ row 232: sequence 7: adopt, two confirmed activates, rollback --to the previous copy, confirmed, logs op rollback (8298.40004ms)
|
||||
✔ row 232: sequence 8: a migration that writes and fails: revert restores the backup byte for byte, confirm --rollback --cause A3 (3658.849346ms)
|
||||
✔ row 232: user mode: every systemctl call carries --user, and activate, rollback and check make the base's calls (7450.661653ms)
|
||||
✔ row 232: user mode: a default activate --plan prints the base's bytes (2572.062595ms)
|
||||
ℹ tests 25
|
||||
ℹ suites 0
|
||||
ℹ pass 25
|
||||
ℹ fail 0
|
||||
ℹ cancelled 0
|
||||
ℹ skipped 0
|
||||
ℹ todo 0
|
||||
ℹ duration_ms 89317.249955
|
||||
-227
@@ -1,227 +0,0 @@
|
||||
✔ T1 adopt writes the pointer from the units once; a failing check refuses check-failed (1372.806902ms)
|
||||
✔ T2 activate installs exactly the pointer's pm, claude and Console flags (2175.278069ms)
|
||||
▶ T3 a hand-edited unit refuses unit-flags-drift, names the difference and changes nothing
|
||||
✔ pm (940.434448ms)
|
||||
✔ claude (905.331444ms)
|
||||
✔ console (953.801488ms)
|
||||
✔ T3 a hand-edited unit refuses unit-flags-drift, names the difference and changes nothing (2800.414725ms)
|
||||
▶ T4 each item 3 refusal changes nothing and logs one line with its code
|
||||
✔ copy-missing (828.258816ms)
|
||||
✔ copy-unreachable (750.040135ms)
|
||||
✔ copy-schema-unknown (804.784952ms)
|
||||
✔ already-active (767.83377ms)
|
||||
✔ instance-busy (another business active) (836.742584ms)
|
||||
✔ instance-busy (this business activating) (824.181046ms)
|
||||
✔ drop-in-override (819.802212ms)
|
||||
✔ no-pointer (432.597537ms)
|
||||
✔ T4 each item 3 refusal changes nothing and logs one line with its code (6065.707472ms)
|
||||
✔ T5 an activate with no migration stops the Console then the bus, installs, starts the bus then the Console (1974.205406ms)
|
||||
✔ T6 a migration without --migrate rolls back with migration-needs-flag (1689.71261ms)
|
||||
✔ T7 --migrate takes the backup before the migration runs (1874.080499ms)
|
||||
✔ T8 a failed migration restores the backup and keeps the store it replaced (1879.088438ms)
|
||||
✔ T9 a store outside the target's chain rolls back with store-newer (1695.743767ms)
|
||||
▶ T10 each gate check failing alone rolls back and puts every file back
|
||||
✔ units-inactive (5145.320966ms)
|
||||
✔ bus-status (5504.739824ms)
|
||||
✔ healthz (4630.494167ms)
|
||||
✔ copy-check (4953.814776ms)
|
||||
✔ pm-launch-unconfirmed (5175.714883ms)
|
||||
✔ T10 each gate check failing alone rolls back and puts every file back (25411.164743ms)
|
||||
▶ T10b the PM check needs exactly one launched line for a live run of this start
|
||||
✔ no launched line (5309.620588ms)
|
||||
✔ two lines (5271.450965ms)
|
||||
✔ a changed word (5207.189363ms)
|
||||
✔ run not in launches list (5249.94294ms)
|
||||
✔ run started before the start (5297.104798ms)
|
||||
✔ a human launch with no journal line (5012.384828ms)
|
||||
✔ run for another business (5255.258408ms)
|
||||
✔ run not live (5155.194619ms)
|
||||
✔ one well-formed line and a live run pass (1936.667118ms)
|
||||
✔ T10b the PM check needs exactly one launched line for a live run of this start (43696.539474ms)
|
||||
✔ T11 a rollback whose gate fails too: rollback-failed, exit 2, both units stopped, no retry (9445.48752ms)
|
||||
✔ T12 rollback takes the previous copy from the log (3164.86878ms)
|
||||
✔ T13 a rollback across a migration needs --restore, then restores and goes live (3832.433037ms)
|
||||
✔ T14 events written after the backup need --events N with the right N (4300.182861ms)
|
||||
✔ T14b a rollback --restore whose gate fails stops both units and skips item 6 (5706.078353ms)
|
||||
✔ T14c a rollback without --restore whose gate fails runs item 6 (7364.684709ms)
|
||||
✔ T15 --plan names the migration and the restore and changes nothing (2976.558ms)
|
||||
✔ T26 --plan lists the commits an activate adds, after the migration lines (1448.921448ms)
|
||||
✔ T27 --plan names each migration step, or says the steps cannot be read (1074.961775ms)
|
||||
✔ T25 --plan refuses copies-unrelated when neither copy is an ancestor of the other (504.611631ms)
|
||||
▶ T23 --plan reads the store without changing a file, stopped or held
|
||||
✔ stopped store (612.654192ms)
|
||||
✔ held store (615.45405ms)
|
||||
✔ T23 --plan reads the store without changing a file, stopped or held (1228.613968ms)
|
||||
✔ T24 business-mismatch and capture-failed refuse with exit 3; a short id is a usage error (1504.453363ms)
|
||||
✔ T16 status prints the pointer, the log, the check, bus status and drift, and writes nothing (969.540282ms)
|
||||
✔ T19 a started line with no final line: status shows it and every changing verb refuses (1272.112268ms)
|
||||
✔ T20 a held run lock refuses run-locked without a log line; status and --plan still run (1363.537596ms)
|
||||
✔ T21 a bus unit with no MOSAIC_CLAUDE_BIN: adopt and activate refuse no-claude-pin (1516.277233ms)
|
||||
▶ T22 the stopped store read: a -wal or -shm refuses store-unclean and is left alone; a clean read adds no file
|
||||
✔ bus.sqlite-wal (1776.498328ms)
|
||||
✔ bus.sqlite-shm (1805.948894ms)
|
||||
✔ clean (1860.970301ms)
|
||||
✔ T22 the stopped store read: a -wal or -shm refuses store-unclean and is left alone; a clean read adds no file (5444.145497ms)
|
||||
▶ T28 a unit path, drop-in directory or drop-in file that cannot be read, or a relative unit path, refuses drop-in-override before any stop
|
||||
✔ unit path (838.2428ms)
|
||||
✔ drop-in directory (770.669306ms)
|
||||
✔ drop-in file (787.861386ms)
|
||||
✔ relative unit path (799.918614ms)
|
||||
✔ T28 a unit path, drop-in directory or drop-in file that cannot be read, or a relative unit path, refuses drop-in-override before any stop (3197.49908ms)
|
||||
▶ T29 a bus that stops during the held-store read: --plan says so, rollback --restore refuses restore-mismatch
|
||||
✔ --plan (842.842612ms)
|
||||
✔ rollback --restore (2383.664939ms)
|
||||
✔ T29 a bus that stops during the held-store read: --plan says so, rollback --restore refuses restore-mismatch (3227.016275ms)
|
||||
✔ T30 a copy check that agrees on another copy fails the gate with copy-check and rolls back (4822.028878ms)
|
||||
▶ T31 a quoted or escaped Environment= or ExecStart= is unreadable: refusals by name, nothing read from /a
|
||||
✔ Environment double quotes (1747.115914ms)
|
||||
✔ Environment single quotes (1747.871141ms)
|
||||
✔ Environment backslash (1718.42505ms)
|
||||
✔ ExecStart quotes (1733.916441ms)
|
||||
✔ Console ExecStart quotes (1805.192313ms)
|
||||
✔ T31 a quoted or escaped Environment= or ExecStart= is unreadable: refusals by name, nothing read from /a (8753.514814ms)
|
||||
▶ T32 item 1: --pm-after-harness refuses a target without harness or a file that sets it, and passes without the PM
|
||||
✔ usage: not with --pm, and only for activate (630.81989ms)
|
||||
✔ pm-after-harness-target (949.989597ms)
|
||||
✔ pm-after-harness-set (1400.026643ms)
|
||||
✔ a pointer without pm (849.389257ms)
|
||||
✔ phase 1 installs without --pm, skips pm_launched and writes the pending pointer (2037.948918ms)
|
||||
✔ T32 item 1: --pm-after-harness refuses a target without harness or a file that sets it, and passes without the PM (5869.092521ms)
|
||||
▶ T33 item 2: read_pointer takes pmPending only as true beside pm false; a pending pointer refuses activate and shows in status
|
||||
✔ read_pointer (1646.25297ms)
|
||||
✔ pm-pending, already-adopted and the status line (2899.447167ms)
|
||||
✔ T33 item 2: read_pointer takes pmPending only as true beside pm false; a pending pointer refuses activate and shows in status (4546.229216ms)
|
||||
▶ T34 item 3: pm-on refuses before any stop, passes with the PM, or puts the phase-1 bus back
|
||||
✔ not-pending (781.816005ms)
|
||||
✔ harness-unset (2528.770078ms)
|
||||
✔ a launched line passes: the bus alone restarts with --pm (3635.97518ms)
|
||||
✔ a failed pm_launched puts the phase-1 unit back: exit 1, still pending (6129.763508ms)
|
||||
✔ a failed phase-1 gate too: pm-on-down, exit 2, both units stopped (10681.440065ms)
|
||||
✔ T34 item 3: pm-on refuses before any stop, passes with the PM, or puts the phase-1 bus back (23758.959718ms)
|
||||
▶ T35 item 4: rollback from pending installs --pm; a plug-in kind the target lacks refuses by name
|
||||
✔ rollback from pending gates pm_launched on the old copy (3432.493856ms)
|
||||
✔ after the harness set, rollback refuses until harness is gone (4814.40527ms)
|
||||
✔ activate names every kind the target lacks (1278.267995ms)
|
||||
✔ T35 item 4: rollback from pending installs --pm; a plug-in kind the target lacks refuses by name (9525.935986ms)
|
||||
✔ T36 --plan shows the pending state and lists the row 169 refusals it can see (3442.637109ms)
|
||||
✔ T37 tester-port activate writes pointer and unit, replaces the port, and supported re-pin and rollback keep it (6713.755862ms)
|
||||
✔ T38 tester-port rollback to unsupported target drops flag in plan, steps, unit and pointer (3556.909655ms)
|
||||
✔ T39 tester-port explicit unsupported target reads target copy and refuses before stopping either unit (816.518752ms)
|
||||
✔ T40 tester-port invalid values refuse exit 4 before stopping, including tunnel and main ports (798.151327ms)
|
||||
✔ T41 tester-port inherited activate to unsupported target drops it and retains drift refusal and failed-run recovery (8335.191178ms)
|
||||
✔ T42 tester-port pm-on preserves pointer Console flags (3045.995877ms)
|
||||
▶ T43 row 180 item 1: runs in one second get distinct activation ids, rollback sets and post-attempt stores
|
||||
✔ activate then pm-on on the same copy (3077.866023ms)
|
||||
✔ two restores: an old-form id and a suffixed one, each with its own post-attempt store (6478.022663ms)
|
||||
✔ adopt takes the next free id too (676.463788ms)
|
||||
✔ all ten names taken: capture-failed before anything stops, and the log line names no activation (927.509173ms)
|
||||
✔ --restore takes an id with or without -1 to -9 and nothing else (1026.017549ms)
|
||||
✔ T43 row 180 item 1: runs in one second get distinct activation ids, rollback sets and post-attempt stores (12186.978758ms)
|
||||
▶ T44 row 180 item 2: --plan lists tester-port-invalid and tester-port-target with its other refusals
|
||||
✔ a bad tester port (2101.036117ms)
|
||||
✔ without --plan a bad port is usage before any pointer read (417.577025ms)
|
||||
✔ a target Console without --tester-port (1050.997021ms)
|
||||
✔ T44 row 180 item 2: --plan lists tester-port-invalid and tester-port-target with its other refusals (3570.568101ms)
|
||||
▶ T45 row 181 items 2 and 3: the restore guard counts events and every COUNTED table
|
||||
✔ both modes count events and each listed table, and a table the store lacks counts 0 (819.811738ms)
|
||||
✔ one instance_names row and no event refuses before any stop; --events 1 restores (4281.220981ms)
|
||||
✔ one usage_records row and no event refuses before any stop; --events 1 restores (4339.553222ms)
|
||||
✔ a listed table that cannot be read refuses restore-mismatch before any stop (3011.194623ms)
|
||||
✔ the in-run recount counts the listed tables too (3456.814799ms)
|
||||
✔ T45 row 181 items 2 and 3: the restore guard counts events and every COUNTED table (15910.111456ms)
|
||||
✔ T46 row 181 item 4: every table in the bus schema is in exactly one of four lists (2.96277ms)
|
||||
✔ T47 row 185 test 1: a same-schema activate leaves a whole backup and the log line names it (1839.922479ms)
|
||||
✔ T48 row 185 test 2: a gate failure on a same-schema activate rolls back without a restore (5782.007105ms)
|
||||
▶ T49 row 185 test 3: a same-schema rollback --restore restores, or refuses rows written after STAMP
|
||||
✔ no rows after STAMP: restores and goes live (3276.614244ms)
|
||||
✔ one instance_names row after STAMP refuses post-backup-events; --events 1 restores (3603.193575ms)
|
||||
✔ T49 row 185 test 3: a same-schema rollback --restore restores, or refuses rows written after STAMP (6880.328466ms)
|
||||
✔ T50 row 185 test 4: activate --plan prints the backup line and writes nothing (2392.362463ms)
|
||||
✔ T51 row 185 test 5: an activate with no store file takes no backup (2055.74343ms)
|
||||
▶ T52 row 186: the activate plan's backup line says what the run will do
|
||||
✔ same schema (2076.652498ms)
|
||||
✔ same schema with --migrate (2103.728264ms)
|
||||
✔ in chain with --migrate (2343.740358ms)
|
||||
✔ in chain without --migrate (2172.44891ms)
|
||||
✔ outside the chain (2018.610199ms)
|
||||
✔ outside the chain with --migrate (2286.782735ms)
|
||||
✔ T52 row 186: the activate plan's backup line says what the run will do (13003.221353ms)
|
||||
✔ T178 proxy proof header and path survive re-pin and rollback unchanged in the pointer and unit (3428.609169ms)
|
||||
✔ T178 proxy proof pair survives a tester-port replacement as well (2005.665148ms)
|
||||
▶ T53 row 187: activate sets, carries and drops the proof pair
|
||||
✔ tests 1 and 9: the pair goes after the preview flags, before --send and the kept --tester-port, as the unit renders it; a new pair replaces it (5369.617405ms)
|
||||
✔ tests 2 and 3: an activate of the live copy writes the pair; a later activate and a rollback carry it (4877.926077ms)
|
||||
✔ test 2: only a pair change may name the live copy; the log keeps from and to, and rollback still goes to the earlier copy (6411.791056ms)
|
||||
✔ test 2: a live-copy activate says only the Console flags change, and backs up the stopped store before it installs (3823.440479ms)
|
||||
✔ test 3: pm-on keeps the pair (2929.528358ms)
|
||||
✔ test 4: --no-proof drops the pair from the pointer and the unit and says so; with no pair it says so and passes (6134.571168ms)
|
||||
✔ test 5: each refusal exits 3 before anything stops (4080.818538ms)
|
||||
✔ tests 5 and 9: --plan lists every proof refusal with the others and writes nothing (921.495619ms)
|
||||
✔ test 6: usage errors (791.940368ms)
|
||||
✔ test 7: a rollback to a copy without proof support drops the pair and says so (3569.742095ms)
|
||||
✔ test 7: an activate to a copy without proof support refuses proof-target without --no-proof and passes with it (4102.029003ms)
|
||||
✔ T53 row 187: activate sets, carries and drops the proof pair (43015.196531ms)
|
||||
▶ T54 row 188: a carried pair gets the proof file checks, and a proof file inside the repository refuses
|
||||
✔ test 1: an activate that carries the pair refuses after chmod 644, in the plan and the run, before anything stops (2443.927487ms)
|
||||
✔ test 1: an activate that carries the pair refuses after a symlink to a mode-600 file, in the plan and the run, before anything stops (2451.543098ms)
|
||||
✔ test 1: an activate that carries the pair refuses after removal, in the plan and the run, before anything stops (2371.886229ms)
|
||||
✔ test 2: a rollback that carries the pair refuses after chmod 644, in the plan and the run, before anything stops (2440.808004ms)
|
||||
✔ test 3: a proof file inside the repository refuses, in the plan and the run, before anything stops (1028.022624ms)
|
||||
✔ test 4: a path outside the repository through a directory symlink into it refuses on its realpath (1092.396277ms)
|
||||
✔ T54 row 188: a carried pair gets the proof file checks, and a proof file inside the repository refuses (11829.775747ms)
|
||||
▶ T55 row 189: activate --no-send drops --send, and rollback and pm-on carry it off
|
||||
✔ test 1: a live-copy --no-send drops --send from the pointer and the unit, keeps the rest in order, logs the step and backs up the stopped store (2297.315751ms)
|
||||
✔ test 2: a plain live-copy activate still refuses already-active, and so does --no-send once --send is gone (3372.219555ms)
|
||||
✔ test 3: --plan prints one send: line in each case, with the live-copy note on a same-copy run (4822.032599ms)
|
||||
✔ test 4: after --no-send, a rollback to the earlier copy leaves --send out of the pointer and the unit (3681.502406ms)
|
||||
✔ test 4: pm-on after --no-send keeps --send off (3384.224907ms)
|
||||
✔ test 5: --no-send on rollback, pm-on, status, adopt or rehearse is a usage error (646.332677ms)
|
||||
✔ test 6: with both a pair and --send in the pointer, --no-send and --no-proof each drop what they name and keep the rest (10576.556687ms)
|
||||
✔ T55 row 189: activate --no-send drops --send, and rollback and pm-on carry it off (28781.800109ms)
|
||||
▶ T57 row 200: activate --sso, its refusals before any stop, and the rollback to a Console without --sso
|
||||
✔ item 1: --sso drops the preview set and the pair, puts --sso before --send and the tester port, and the plan names what it drops and carries (3731.038851ms)
|
||||
✔ item 1: --sso may re-pin the live copy once; later activates carry it; --no-send still drops --send (9441.965146ms)
|
||||
✔ item 1: --sso with a pair or --no-proof, or on any verb but activate, is a usage error (804.681755ms)
|
||||
✔ item 2: a target without --sso, a missing or bad console.sso, and each slot problem refuse before any stop (6340.571003ms)
|
||||
✔ item 3: a config whose console key the target loader refuses stops an activate or a rollback before any stop, naming the first step (4474.330517ms)
|
||||
✔ item 3: a rollback from --sso to a Console without it takes the flags from the set of the activation onto the copy, past a same-copy re-pin (sage-1389) (11258.382547ms)
|
||||
✔ item 3: a rollback set that is missing, fails its sums, holds no argv or already ran --sso refuses sso-rollback-flags (4811.481384ms)
|
||||
✔ round 2 (webby-0028 N1): run through a symlinked repository path, a slot or a proof file inside the repository still refuses (2548.588058ms)
|
||||
✔ round 2 (webby-0028 N2): a config.json that does not parse stops the run before anything is read or stopped (2148.082108ms)
|
||||
✔ round 3 (sage-1556): a named instance turns --sso on with its own config, slot and Console unit, and rolls back from its own set (4427.346674ms)
|
||||
✔ row 238 (#1744): on a named instance the sso-config first step names --instance NAME in both commands (1072.216503ms)
|
||||
✔ T57 row 200: activate --sso, its refusals before any stop, and the rollback to a Console without --sso (51060.894572ms)
|
||||
✔ R1 rehearse passes on the same schema; the scratch root holds its files and the live files stay byte-identical (3501.665564ms)
|
||||
✔ R2 rehearse runs the migration checks when the schema differs; the live store stays at 3g (2615.765886ms)
|
||||
✔ R3 a failing migration gives REHEARSAL_FAIL migrate and starts nothing (406.432761ms)
|
||||
✔ R4 a host that does not start, does not answer status, reports another pid, launches anyway, makes a launches directory or keeps its lock each fails by name (23643.921414ms)
|
||||
✔ R5 a host that ignores SIGTERM gets SIGKILL and FAIL host-stopped (4522.753011ms)
|
||||
✔ R6 a Console that does not answer /healthz gives REHEARSAL_FAIL healthz (5695.642056ms)
|
||||
✔ R7 a host on another copy fails copy-match (5707.109175ms)
|
||||
✔ R8 a scratch port in use or reserved refuses, and the rehearsal takes no other port (564.078959ms)
|
||||
✔ R9 mos-0963: a role reference left outside placeholders/, or left on an env variable, fails credential-ref-live before the host starts (739.463019ms)
|
||||
✔ R10 mos-0962: a scratch business that still sets a tracker fails tracker-configured (356.527698ms)
|
||||
✔ R11 mos-0961: a scratch config on the live data root or on any root but the scratch one, or a sessions.json naming a running pid, refuses by name (1415.617777ms)
|
||||
✔ R12 mos-0962: a notifier config with a binding fails notify-off (346.615997ms)
|
||||
✔ R13 the pre-checks: an old copy, a backup that fails its sums, a missing backup or pointer, and usage (495.179039ms)
|
||||
✔ R14 a host that writes the live config, the live business file or the backup fails the end check by name (10325.286968ms)
|
||||
✔ R15 a rehearsal stopped by TERM, INT or HUP fails signal and still stops the host and Console and runs the end checks (9991.220342ms)
|
||||
✔ row 233: --backup last takes the newest backup the log records; a later line with backup null does not hide it, and the store line names it (3454.052038ms)
|
||||
✔ row 233: --backup last with no backup in the log, or no log, exits 3 with no-backup and makes no rehearsal directory (203.934243ms)
|
||||
✔ row 233: --backup last refuses a newest backup that is not an activation id, with exit 1 (127.433768ms)
|
||||
▶ T56 row 190: named instances side by side on one unit directory, $BIN and set of stand-ins
|
||||
✔ T-I3 each instance renders its own config, session env and Description, and nothing of another (1595.173571ms)
|
||||
✔ T-I4 a Console port another installed Console takes refuses port-claimed, and a named instance keeps off the default ports (1992.011586ms)
|
||||
✔ T-I6 alpha's activate and rollback reach nothing of beta's (3927.69359ms)
|
||||
✔ T-I6 swapped: beta's reach nothing of alpha's (4046.222781ms)
|
||||
✔ T-I7 MOSAIC_CONFIG naming alpha's config with no flag refuses instance-root-mismatch and changes nothing (707.673985ms)
|
||||
✔ T-I9 another instance's bus active refuses nothing; one of this instance's does (6093.674502ms)
|
||||
✔ T56 row 190: named instances side by side on one unit directory, $BIN and set of stand-ins (18364.096442ms)
|
||||
ℹ tests 196
|
||||
ℹ suites 0
|
||||
ℹ pass 196
|
||||
ℹ fail 0
|
||||
ℹ cancelled 0
|
||||
ℹ skipped 0
|
||||
ℹ todo 0
|
||||
ℹ duration_ms 530980.947325
|
||||
@@ -1 +0,0 @@
|
||||
{"processes": [], "removed": "/mnt/storage/scratch/gt-t2e8hpyu", "trees": ["/home/jwoltje/.t3/worktrees/mosaic-stack/herb-row215-on212", "/home/jwoltje/.t3/worktrees/mosaic-stack/herb-row197-r8"]}
|
||||
@@ -1 +0,0 @@
|
||||
{"pid": 765123, "reason": "sage-1983 stop after file10; do not start file11"}
|
||||
@@ -1,122 +0,0 @@
|
||||
[
|
||||
{
|
||||
"file": "packages/bus/tests/library.test.mjs",
|
||||
"rc": 0,
|
||||
"counts": {
|
||||
"tests": 6,
|
||||
"pass": 6,
|
||||
"fail": 0,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
},
|
||||
"log": "01-packages_bus_tests_library.test.mjs.log"
|
||||
},
|
||||
{
|
||||
"file": "packages/bus/tests/project-runtime.test.mjs",
|
||||
"rc": 0,
|
||||
"counts": {
|
||||
"tests": 3,
|
||||
"pass": 3,
|
||||
"fail": 0,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
},
|
||||
"log": "02-packages_bus_tests_project-runtime.test.mjs.log"
|
||||
},
|
||||
{
|
||||
"file": "packages/business/tests/business.test.mjs",
|
||||
"rc": 0,
|
||||
"counts": {
|
||||
"tests": 18,
|
||||
"pass": 18,
|
||||
"fail": 0,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
},
|
||||
"log": "03-packages_business_tests_business.test.mjs.log"
|
||||
},
|
||||
{
|
||||
"file": "packages/business/tests/cli.test.mjs",
|
||||
"rc": 0,
|
||||
"counts": {
|
||||
"tests": 10,
|
||||
"pass": 10,
|
||||
"fail": 0,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
},
|
||||
"log": "04-packages_business_tests_cli.test.mjs.log"
|
||||
},
|
||||
{
|
||||
"file": "packages/business/tests/instance-settings.test.mjs",
|
||||
"rc": 0,
|
||||
"counts": {
|
||||
"tests": 12,
|
||||
"pass": 12,
|
||||
"fail": 0,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
},
|
||||
"log": "05-packages_business_tests_instance-settings.test.mjs.log"
|
||||
},
|
||||
{
|
||||
"file": "packages/business/tests/library-projects-protected.test.mjs",
|
||||
"rc": 0,
|
||||
"counts": {
|
||||
"tests": 4,
|
||||
"pass": 4,
|
||||
"fail": 0,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
},
|
||||
"log": "06-packages_business_tests_library-projects-protected.test.mjs.log"
|
||||
},
|
||||
{
|
||||
"file": "packages/business/tests/resolve.test.mjs",
|
||||
"rc": 0,
|
||||
"counts": {
|
||||
"tests": 11,
|
||||
"pass": 11,
|
||||
"fail": 0,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
},
|
||||
"log": "07-packages_business_tests_resolve.test.mjs.log"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/launcher.test.mjs",
|
||||
"rc": 0,
|
||||
"counts": {
|
||||
"tests": 30,
|
||||
"pass": 30,
|
||||
"fail": 0,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
},
|
||||
"log": "08-packages_cli_tests_launcher.test.mjs.log"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release-external.test.mjs",
|
||||
"rc": 0,
|
||||
"counts": {
|
||||
"tests": 25,
|
||||
"pass": 25,
|
||||
"fail": 0,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
},
|
||||
"log": "09-packages_cli_tests_stack-release-external.test.mjs.log"
|
||||
},
|
||||
{
|
||||
"file": "packages/cli/tests/stack-release.test.mjs",
|
||||
"rc": 0,
|
||||
"counts": {
|
||||
"tests": 196,
|
||||
"pass": 196,
|
||||
"fail": 0,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
},
|
||||
"log": "10-packages_cli_tests_stack-release.test.mjs.log"
|
||||
}
|
||||
]
|
||||
@@ -1 +0,0 @@
|
||||
/mnt/storage/scratch/gt-t2e8hpyu
|
||||
@@ -1 +0,0 @@
|
||||
2026-10-21T11:56:56.177608+00:00
|
||||
@@ -1,10 +0,0 @@
|
||||
✔ C2-04: library mappings load without roots, remain frozen, and retain mapping refusals (9.004507ms)
|
||||
✔ C2-04: an otherwise valid publish grant cannot name a library repo (1.807264ms)
|
||||
ℹ tests 2
|
||||
ℹ suites 0
|
||||
ℹ pass 2
|
||||
ℹ fail 0
|
||||
ℹ cancelled 0
|
||||
ℹ skipped 0
|
||||
ℹ todo 0
|
||||
ℹ duration_ms 67.488189
|
||||
@@ -1,23 +0,0 @@
|
||||
✖ C2-04: library mappings load without roots, remain frozen, and retain mapping refusals (5.192384ms)
|
||||
ℹ tests 1
|
||||
ℹ suites 0
|
||||
ℹ pass 0
|
||||
ℹ fail 1
|
||||
ℹ cancelled 0
|
||||
ℹ skipped 0
|
||||
ℹ todo 0
|
||||
ℹ duration_ms 54.487487
|
||||
|
||||
✖ failing tests:
|
||||
|
||||
test at packages/business/tests/business.test.mjs:11:1
|
||||
✖ C2-04: library mappings load without roots, remain frozen, and retain mapping refusals (5.192384ms)
|
||||
Error [BusinessError]: unsupported /mnt/storage/scratch/gt-PvGtsQ/mosaic-business-4vAhxB/businesses/acme.json projects.books key: "kind"
|
||||
at refuse (file:///home/jwoltje/.t3/worktrees/mosaic-stack/herb-row197/packages/business/src/errors.mjs:12:9)
|
||||
at rejectUnknownKeys (file:///home/jwoltje/.t3/worktrees/mosaic-stack/herb-row197/packages/business/src/util.mjs:17:33)
|
||||
at validateBusinessDocument (file:///home/jwoltje/.t3/worktrees/mosaic-stack/herb-row197/packages/business/src/business.mjs:232:5)
|
||||
at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/herb-row197/packages/business/tests/business.test.mjs:17:18)
|
||||
at async Test.run (node:internal/test_runner/test:1409:7)
|
||||
at async startSubtestAfterBootstrap (node:internal/test_runner/harness:387:3) {
|
||||
exitCode: 2
|
||||
}
|
||||
@@ -1,9 +0,0 @@
|
||||
✔ C2-04: ensureCheckouts skips a library before a real clone and leaves no books path (24.411494ms)
|
||||
ℹ tests 1
|
||||
ℹ suites 0
|
||||
ℹ pass 1
|
||||
ℹ fail 0
|
||||
ℹ cancelled 0
|
||||
ℹ skipped 0
|
||||
ℹ todo 0
|
||||
ℹ duration_ms 72.211367
|
||||
@@ -1,8 +0,0 @@
|
||||
{
|
||||
"at": "2026-10-21T08:51:07Z",
|
||||
"tempRoot": "/mnt/storage/scratch/gt-PvGtsQ",
|
||||
"fixtureCwdOrArgv": [],
|
||||
"testProcesses": [],
|
||||
"excluded": "current scan process and its ancestors",
|
||||
"tempRootRemoved": true
|
||||
}
|
||||
@@ -1,9 +0,0 @@
|
||||
✔ C2-04: business validate and resolve skip a library before code projects and credential checks (206.597157ms)
|
||||
ℹ tests 1
|
||||
ℹ suites 0
|
||||
ℹ pass 1
|
||||
ℹ fail 0
|
||||
ℹ cancelled 0
|
||||
ℹ skipped 0
|
||||
ℹ todo 0
|
||||
ℹ duration_ms 260.97412
|
||||
@@ -1,9 +0,0 @@
|
||||
✔ C2-04: instance settings skip a library while checking a later code project (22.656666ms)
|
||||
ℹ tests 1
|
||||
ℹ suites 0
|
||||
ℹ pass 1
|
||||
ℹ fail 0
|
||||
ℹ cancelled 0
|
||||
ℹ skipped 0
|
||||
ℹ todo 0
|
||||
ℹ duration_ms 79.494698
|
||||
@@ -1,9 +0,0 @@
|
||||
✔ C2-04: launcher workspace clones code but never the library (1241.43402ms)
|
||||
ℹ tests 1
|
||||
ℹ suites 0
|
||||
ℹ pass 1
|
||||
ℹ fail 0
|
||||
ℹ cancelled 0
|
||||
ℹ skipped 0
|
||||
ℹ todo 0
|
||||
ℹ duration_ms 1338.915726
|
||||
@@ -1,12 +0,0 @@
|
||||
✔ C2-04 M9: changed playground and hybrid entries leave business and changes.jsonl byte-identical (21.916712ms)
|
||||
✔ C2-04 M9: code projects, additions, deletions and array changes are protected too (17.081275ms)
|
||||
✔ C2-04 M9: canonical key order is allowed and a non-project setter still records its change (14.304068ms)
|
||||
✔ C2-04 M9: a serialization hook cannot change projects after the canonical comparison (9.595281ms)
|
||||
ℹ tests 4
|
||||
ℹ suites 0
|
||||
ℹ pass 4
|
||||
ℹ fail 0
|
||||
ℹ cancelled 0
|
||||
ℹ skipped 0
|
||||
ℹ todo 0
|
||||
ℹ duration_ms 116.250811
|
||||
@@ -1,28 +0,0 @@
|
||||
✖ C2-04 M9: changed playground and hybrid entries leave business and changes.jsonl byte-identical (21.728048ms)
|
||||
ℹ tests 1
|
||||
ℹ suites 0
|
||||
ℹ pass 0
|
||||
ℹ fail 1
|
||||
ℹ cancelled 0
|
||||
ℹ skipped 0
|
||||
ℹ todo 0
|
||||
ℹ duration_ms 71.097427
|
||||
|
||||
✖ failing tests:
|
||||
|
||||
test at packages/business/tests/library-projects-protected.test.mjs:35:1
|
||||
✖ C2-04 M9: changed playground and hybrid entries leave business and changes.jsonl byte-identical (21.728048ms)
|
||||
AssertionError [ERR_ASSERTION]: Missing expected exception.
|
||||
at protectedWrite (file:///home/jwoltje/.t3/worktrees/mosaic-stack/herb-row197/packages/business/tests/library-projects-protected.test.mjs:29:10)
|
||||
at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/herb-row197/packages/business/tests/library-projects-protected.test.mjs:37:3)
|
||||
at Test.runInAsyncScope (node:async_hooks:226:14)
|
||||
at Test.run (node:internal/test_runner/test:1402:25)
|
||||
at Test.start (node:internal/test_runner/test:1262:17)
|
||||
at startSubtestAfterBootstrap (node:internal/test_runner/harness:387:17) {
|
||||
generatedMessage: false,
|
||||
code: 'ERR_ASSERTION',
|
||||
actual: undefined,
|
||||
expected: { code: 'organization-projects-protected' },
|
||||
operator: 'throws',
|
||||
diff: 'simple'
|
||||
}
|
||||
@@ -1,9 +0,0 @@
|
||||
✔ C2-04: record APIs refuse a library before creating a repository (3.426617ms)
|
||||
ℹ tests 1
|
||||
ℹ suites 0
|
||||
ℹ pass 1
|
||||
ℹ fail 0
|
||||
ℹ cancelled 0
|
||||
ℹ skipped 0
|
||||
ℹ todo 0
|
||||
ℹ duration_ms 61.266328
|
||||
@@ -1,9 +0,0 @@
|
||||
✔ C2-04: a library first in projects does not hide a later project layer (6.517821ms)
|
||||
ℹ tests 1
|
||||
ℹ suites 0
|
||||
ℹ pass 1
|
||||
ℹ fail 0
|
||||
ℹ cancelled 0
|
||||
ℹ skipped 0
|
||||
ℹ todo 0
|
||||
ℹ duration_ms 62.270511
|
||||
@@ -1,90 +0,0 @@
|
||||
[
|
||||
{
|
||||
"file": "business-green.log",
|
||||
"tests": 2,
|
||||
"pass": 2,
|
||||
"fail": 0,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
},
|
||||
{
|
||||
"file": "business-red.log",
|
||||
"tests": 1,
|
||||
"pass": 0,
|
||||
"fail": 1,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
},
|
||||
{
|
||||
"file": "checkout-green.log",
|
||||
"tests": 1,
|
||||
"pass": 1,
|
||||
"fail": 0,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
},
|
||||
{
|
||||
"file": "cli-green.log",
|
||||
"tests": 1,
|
||||
"pass": 1,
|
||||
"fail": 0,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
},
|
||||
{
|
||||
"file": "instance-settings-green.log",
|
||||
"tests": 1,
|
||||
"pass": 1,
|
||||
"fail": 0,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
},
|
||||
{
|
||||
"file": "launcher-green.log",
|
||||
"tests": 1,
|
||||
"pass": 1,
|
||||
"fail": 0,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
},
|
||||
{
|
||||
"file": "m9-green.log",
|
||||
"tests": 4,
|
||||
"pass": 4,
|
||||
"fail": 0,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
},
|
||||
{
|
||||
"file": "m9-red.log",
|
||||
"tests": 1,
|
||||
"pass": 0,
|
||||
"fail": 1,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
},
|
||||
{
|
||||
"file": "project-green.log",
|
||||
"tests": 1,
|
||||
"pass": 1,
|
||||
"fail": 0,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
},
|
||||
{
|
||||
"file": "resolve-green.log",
|
||||
"tests": 1,
|
||||
"pass": 1,
|
||||
"fail": 0,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
},
|
||||
{
|
||||
"file": "trackers-boot-green.log",
|
||||
"tests": 2,
|
||||
"pass": 2,
|
||||
"fail": 0,
|
||||
"cancelled": 0,
|
||||
"skipped": 0
|
||||
}
|
||||
]
|
||||
@@ -1 +0,0 @@
|
||||
2026-10-21T08:48:14Z
|
||||
@@ -1 +0,0 @@
|
||||
/mnt/storage/scratch/gt-PvGtsQ
|
||||
@@ -1,12 +0,0 @@
|
||||
✔ C2-04: a library-only business with tracker.baseUrl boots without a project tracker (132.133246ms)
|
||||
task.close {} answered: invalid-request; fake saw 18 requests, first GET /info 200, GET /projects/1 200, GET /projects/1/views 200
|
||||
task.close on a missing task answered: task-not-found; it made GET /tasks/999 404
|
||||
✔ bootConfig trackers reach the S3 adapter in the real broker child, which goes ready against a fake Vikunja (261.808635ms)
|
||||
ℹ tests 2
|
||||
ℹ suites 0
|
||||
ℹ pass 2
|
||||
ℹ fail 0
|
||||
ℹ cancelled 0
|
||||
ℹ skipped 0
|
||||
ℹ todo 0
|
||||
ℹ duration_ms 480.083569
|
||||
@@ -1 +0,0 @@
|
||||
{"processes": [], "removed": "/mnt/storage/scratch/gt-iwfcrf5s"}
|
||||
@@ -1 +0,0 @@
|
||||
["packages/library/tests/mirror.test.mjs", "packages/bus/tests/library.test.mjs", "packages/webui/tests/library-cli.test.mjs", "packages/bus/tests/project-runtime.test.mjs"]
|
||||
@@ -1,31 +0,0 @@
|
||||
✖ C2-04 CLI: both listener callback pairs dispatch library verbs with their own transport (140.263767ms)
|
||||
ℹ tests 1
|
||||
ℹ suites 0
|
||||
ℹ pass 0
|
||||
ℹ fail 1
|
||||
ℹ cancelled 0
|
||||
ℹ skipped 0
|
||||
ℹ todo 0
|
||||
ℹ duration_ms 244.49705
|
||||
|
||||
✖ failing tests:
|
||||
|
||||
test at packages/webui/tests/library-cli.test.mjs:10:1
|
||||
✖ C2-04 CLI: both listener callback pairs dispatch library verbs with their own transport (140.263767ms)
|
||||
AssertionError [ERR_ASSERTION]: refused: missing library callbacks
|
||||
|
||||
|
||||
2 !== 0
|
||||
|
||||
at TestContext.<anonymous> (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/webui/tests/library-cli.test.mjs:27:10)
|
||||
at Test.runInAsyncScope (node:async_hooks:226:14)
|
||||
at Test.run (node:internal/test_runner/test:1402:25)
|
||||
at Test.start (node:internal/test_runner/test:1262:17)
|
||||
at startSubtestAfterBootstrap (node:internal/test_runner/harness:387:17) {
|
||||
generatedMessage: false,
|
||||
code: 'ERR_ASSERTION',
|
||||
actual: 2,
|
||||
expected: 0,
|
||||
operator: 'strictEqual',
|
||||
diff: 'simple'
|
||||
}
|
||||
@@ -1,47 +0,0 @@
|
||||
✖ C2-04 CLI: both listener callback pairs dispatch library verbs with their own transport (31.496523ms)
|
||||
ℹ tests 1
|
||||
ℹ suites 0
|
||||
ℹ pass 0
|
||||
ℹ fail 1
|
||||
ℹ cancelled 0
|
||||
ℹ skipped 0
|
||||
ℹ todo 0
|
||||
ℹ duration_ms 122.065824
|
||||
|
||||
✖ failing tests:
|
||||
|
||||
test at packages/webui/tests/library-cli.test.mjs:10:1
|
||||
✖ C2-04 CLI: both listener callback pairs dispatch library verbs with their own transport (31.496523ms)
|
||||
AssertionError [ERR_ASSERTION]: file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/webui/src/bus.mjs:1
|
||||
import {appendFileSync} from 'node:fs';export class BusReadError extends Error{};export const busCaller=o=>async(verb,args)=>{appendFileSync("/mnt/storage/scratch/gt-iwfcrf5s/library-cli-1eUPUX/calls.jsonl",JSON.stringify({verb,args,cli:o.cli??"/mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/human-cli.mjs"})+'
|
||||
^
|
||||
|
||||
SyntaxError: Invalid or unexpected token
|
||||
at compileSourceTextModule (node:internal/modules/esm/utils:355:16)
|
||||
at ModuleLoader.moduleStrategy (node:internal/modules/esm/translators:93:18)
|
||||
at #translate (node:internal/modules/esm/loader:441:20)
|
||||
at afterLoad (node:internal/modules/esm/loader:509:29)
|
||||
at ModuleLoader.loadAndTranslate (node:internal/modules/esm/loader:514:12)
|
||||
at #getOrCreateModuleJobAfterResolve (node:internal/modules/esm/loader:567:36)
|
||||
at afterResolve (node:internal/modules/esm/loader:614:52)
|
||||
at ModuleLoader.getOrCreateModuleJob (node:internal/modules/esm/loader:620:12)
|
||||
at ModuleJob.syncLink (node:internal/modules/esm/module_job:277:33)
|
||||
at ModuleJob.link (node:internal/modules/esm/module_job:389:17)
|
||||
|
||||
Node.js v26.8.1
|
||||
|
||||
|
||||
1 !== 0
|
||||
|
||||
at TestContext.<anonymous> (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/webui/tests/library-cli.test.mjs:27:10)
|
||||
at Test.runInAsyncScope (node:async_hooks:226:14)
|
||||
at Test.run (node:internal/test_runner/test:1402:25)
|
||||
at Test.start (node:internal/test_runner/test:1262:17)
|
||||
at startSubtestAfterBootstrap (node:internal/test_runner/harness:387:17) {
|
||||
generatedMessage: false,
|
||||
code: 'ERR_ASSERTION',
|
||||
actual: 1,
|
||||
expected: 0,
|
||||
operator: 'strictEqual',
|
||||
diff: 'simple'
|
||||
}
|
||||
@@ -1,9 +0,0 @@
|
||||
✔ C2-04 CLI: both listener callback pairs dispatch library verbs with their own transport (110.620217ms)
|
||||
ℹ tests 1
|
||||
ℹ suites 0
|
||||
ℹ pass 1
|
||||
ℹ fail 0
|
||||
ℹ cancelled 0
|
||||
ℹ skipped 0
|
||||
ℹ todo 0
|
||||
ℹ duration_ms 194.067409
|
||||
@@ -1,9 +0,0 @@
|
||||
✔ C2-04 CLI: both listener callback pairs dispatch library verbs with their own transport (107.138425ms)
|
||||
ℹ tests 1
|
||||
ℹ suites 0
|
||||
ℹ pass 1
|
||||
ℹ fail 0
|
||||
ℹ cancelled 0
|
||||
ℹ skipped 0
|
||||
ℹ todo 0
|
||||
ℹ duration_ms 193.527058
|
||||
@@ -1,71 +0,0 @@
|
||||
✖ C2-04 M4: both verbs reject every agent before arguments or adapter access (14.387463ms)
|
||||
✖ C2-04 bus: human reads validate keys and return adapter results without path leakage (8.808227ms)
|
||||
✖ C2-04 socket: each async library verb resolves its result rather than serializing {} (15.107055ms)
|
||||
ℹ tests 3
|
||||
ℹ suites 0
|
||||
ℹ pass 0
|
||||
ℹ fail 3
|
||||
ℹ cancelled 0
|
||||
ℹ skipped 0
|
||||
ℹ todo 0
|
||||
ℹ duration_ms 125.805576
|
||||
|
||||
✖ failing tests:
|
||||
|
||||
test at packages/bus/tests/library.test.mjs:28:1
|
||||
✖ C2-04 M4: both verbs reject every agent before arguments or adapter access (14.387463ms)
|
||||
AssertionError [ERR_ASSERTION]: Expected values to be strictly deep-equal:
|
||||
+ actual - expected
|
||||
|
||||
Comparison {
|
||||
+ code: 'unknown-verb'
|
||||
- code: 'human-required'
|
||||
}
|
||||
|
||||
at async TestContext.<anonymous> (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/tests/library.test.mjs:32:5)
|
||||
at async Test.run (node:internal/test_runner/test:1409:7)
|
||||
at async startSubtestAfterBootstrap (node:internal/test_runner/harness:387:3) {
|
||||
generatedMessage: true,
|
||||
code: 'ERR_ASSERTION',
|
||||
actual: Error: unknown-verb
|
||||
at fail (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/broker.mjs:145:9)
|
||||
at #dispatch (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/broker.mjs:3098:9)
|
||||
at file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/broker.mjs:1810:38
|
||||
at Store.transaction (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/store.mjs:263:22)
|
||||
at Broker.request (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/broker.mjs:1801:26)
|
||||
at file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/tests/library.test.mjs:24:78
|
||||
at async waitForActual (node:assert:615:5)
|
||||
at async strict.rejects (node:assert:738:25)
|
||||
at async TestContext.<anonymous> (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/tests/library.test.mjs:32:5)
|
||||
at async Test.run (node:internal/test_runner/test:1409:7),
|
||||
expected: { code: 'human-required' },
|
||||
operator: 'rejects',
|
||||
diff: 'simple'
|
||||
}
|
||||
|
||||
test at packages/bus/tests/library.test.mjs:45:1
|
||||
✖ C2-04 bus: human reads validate keys and return adapter results without path leakage (8.808227ms)
|
||||
Error: unknown-verb
|
||||
at fail (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/broker.mjs:145:9)
|
||||
at #dispatch (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/broker.mjs:3098:9)
|
||||
at file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/broker.mjs:1810:38
|
||||
at Store.transaction (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/store.mjs:263:22)
|
||||
at Broker.request (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/broker.mjs:1801:26)
|
||||
at file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/tests/library.test.mjs:24:78
|
||||
at async TestContext.<anonymous> (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/tests/library.test.mjs:49:17)
|
||||
at async Test.run (node:internal/test_runner/test:1409:7)
|
||||
at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) {
|
||||
code: 'unknown-verb'
|
||||
}
|
||||
|
||||
test at packages/bus/tests/library.test.mjs:56:1
|
||||
✖ C2-04 socket: each async library verb resolves its result rather than serializing {} (15.107055ms)
|
||||
Error: unknown-verb
|
||||
at Socket.<anonymous> (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/client.mjs:42:17)
|
||||
at Socket.emit (node:events:514:20)
|
||||
at addChunk (node:internal/streams/readable:575:12)
|
||||
at readableAddChunkPushByteMode (node:internal/streams/readable:526:3)
|
||||
at Readable.push (node:internal/streams/readable:406:5)
|
||||
at Pipe.onStreamRead (node:internal/stream_base_commons:189:23) {
|
||||
code: 'unknown-verb'
|
||||
}
|
||||
@@ -1,118 +0,0 @@
|
||||
✖ C2-04 M4: both verbs reject every agent before arguments or adapter access (16.66162ms)
|
||||
✖ C2-04 bus: human reads validate keys and return adapter results without path leakage (9.880605ms)
|
||||
✖ C2-04 socket: each async library verb resolves its result rather than serializing {} (17.417761ms)
|
||||
✖ C2-04 runtime: protectedRoots skips library but retains real code-root credential protection (27.11473ms)
|
||||
✖ C2-04 runtime: unsafe existing mirror refuses boot and never publishes a socket (21.990752ms)
|
||||
✖ C2-04 runtime: real library adapters reach the socket and lock waits leave other bus reads responsive (21.295513ms)
|
||||
|
||||
Interrupted while running:
|
||||
|
||||
⚠ packages/bus/tests/library.test.mjs (packages/bus/tests/library.test.mjs:1:1)
|
||||
✖ packages/bus/tests/library.test.mjs (34335.85978ms)
|
||||
ℹ tests 7
|
||||
ℹ suites 0
|
||||
ℹ pass 0
|
||||
ℹ fail 6
|
||||
ℹ cancelled 1
|
||||
ℹ skipped 0
|
||||
ℹ todo 0
|
||||
ℹ duration_ms 34341.308382
|
||||
|
||||
✖ failing tests:
|
||||
|
||||
test at packages/bus/tests/library.test.mjs:28:1
|
||||
✖ C2-04 M4: both verbs reject every agent before arguments or adapter access (16.66162ms)
|
||||
AssertionError [ERR_ASSERTION]: Expected values to be strictly deep-equal:
|
||||
+ actual - expected
|
||||
|
||||
Comparison {
|
||||
+ code: 'unknown-verb'
|
||||
- code: 'human-required'
|
||||
}
|
||||
|
||||
at async TestContext.<anonymous> (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/tests/library.test.mjs:32:5)
|
||||
at async Test.run (node:internal/test_runner/test:1409:7)
|
||||
at async startSubtestAfterBootstrap (node:internal/test_runner/harness:387:3) {
|
||||
generatedMessage: true,
|
||||
code: 'ERR_ASSERTION',
|
||||
actual: Error: unknown-verb
|
||||
at fail (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/broker.mjs:145:9)
|
||||
at #dispatch (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/broker.mjs:3098:9)
|
||||
at file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/broker.mjs:1810:38
|
||||
at Store.transaction (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/store.mjs:263:22)
|
||||
at Broker.request (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/broker.mjs:1801:26)
|
||||
at file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/tests/library.test.mjs:24:78
|
||||
at async waitForActual (node:assert:615:5)
|
||||
at async strict.rejects (node:assert:738:25)
|
||||
at async TestContext.<anonymous> (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/tests/library.test.mjs:32:5)
|
||||
at async Test.run (node:internal/test_runner/test:1409:7),
|
||||
expected: { code: 'human-required' },
|
||||
operator: 'rejects',
|
||||
diff: 'simple'
|
||||
}
|
||||
|
||||
test at packages/bus/tests/library.test.mjs:45:1
|
||||
✖ C2-04 bus: human reads validate keys and return adapter results without path leakage (9.880605ms)
|
||||
Error: unknown-verb
|
||||
at fail (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/broker.mjs:145:9)
|
||||
at #dispatch (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/broker.mjs:3098:9)
|
||||
at file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/broker.mjs:1810:38
|
||||
at Store.transaction (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/store.mjs:263:22)
|
||||
at Broker.request (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/broker.mjs:1801:26)
|
||||
at file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/tests/library.test.mjs:24:78
|
||||
at async TestContext.<anonymous> (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/tests/library.test.mjs:49:17)
|
||||
at async Test.run (node:internal/test_runner/test:1409:7)
|
||||
at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) {
|
||||
code: 'unknown-verb'
|
||||
}
|
||||
|
||||
test at packages/bus/tests/library.test.mjs:56:1
|
||||
✖ C2-04 socket: each async library verb resolves its result rather than serializing {} (17.417761ms)
|
||||
Error: unknown-verb
|
||||
at Socket.<anonymous> (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/client.mjs:42:17)
|
||||
at Socket.emit (node:events:514:20)
|
||||
at addChunk (node:internal/streams/readable:575:12)
|
||||
at readableAddChunkPushByteMode (node:internal/streams/readable:526:3)
|
||||
at Readable.push (node:internal/streams/readable:406:5)
|
||||
at Pipe.onStreamRead (node:internal/stream_base_commons:189:23) {
|
||||
code: 'unknown-verb'
|
||||
}
|
||||
|
||||
test at packages/bus/tests/library.test.mjs:67:1
|
||||
✖ C2-04 runtime: protectedRoots skips library but retains real code-root credential protection (27.11473ms)
|
||||
TypeError: library.mirrorPath is not a function
|
||||
at TestContext.<anonymous> (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/tests/library.test.mjs:74:26)
|
||||
at process.processTicksAndRejections (node:internal/process/task_queues:104:5)
|
||||
at async Test.run (node:internal/test_runner/test:1409:7)
|
||||
at async Test.processPendingSubtests (node:internal/test_runner/test:974:7)
|
||||
|
||||
test at packages/bus/tests/library.test.mjs:81:1
|
||||
✖ C2-04 runtime: unsafe existing mirror refuses boot and never publishes a socket (21.990752ms)
|
||||
AssertionError [ERR_ASSERTION]: Missing expected rejection.
|
||||
at process.processTicksAndRejections (node:internal/process/task_queues:104:5)
|
||||
at async TestContext.<anonymous> (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/tests/library.test.mjs:87:3)
|
||||
at async Test.run (node:internal/test_runner/test:1409:7)
|
||||
at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) {
|
||||
generatedMessage: false,
|
||||
code: 'ERR_ASSERTION',
|
||||
actual: undefined,
|
||||
expected: { code: 'library-git' },
|
||||
operator: 'rejects',
|
||||
diff: 'simple'
|
||||
}
|
||||
|
||||
test at packages/bus/tests/library.test.mjs:92:1
|
||||
✖ C2-04 runtime: real library adapters reach the socket and lock waits leave other bus reads responsive (21.295513ms)
|
||||
Error: unknown-verb
|
||||
at Socket.<anonymous> (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/client.mjs:42:17)
|
||||
at Socket.emit (node:events:514:20)
|
||||
at addChunk (node:internal/streams/readable:575:12)
|
||||
at readableAddChunkPushByteMode (node:internal/streams/readable:526:3)
|
||||
at Readable.push (node:internal/streams/readable:406:5)
|
||||
at Pipe.onStreamRead (node:internal/stream_base_commons:189:23) {
|
||||
code: 'unknown-verb'
|
||||
}
|
||||
|
||||
test at packages/bus/tests/library.test.mjs:1:1
|
||||
✖ packages/bus/tests/library.test.mjs (34335.85978ms)
|
||||
'Promise resolution is still pending but the event loop has already resolved'
|
||||
@@ -1,126 +0,0 @@
|
||||
✖ C2-04 M4: both verbs reject every agent before arguments or adapter access (24.976387ms)
|
||||
✖ C2-04 bus: human reads validate keys and return adapter results without path leakage (7.097425ms)
|
||||
✖ C2-04 socket: each async library verb resolves its result rather than serializing {} (6.894431ms)
|
||||
✖ C2-04 runtime: protectedRoots skips library but retains real code-root credential protection (34.318499ms)
|
||||
✖ C2-04 runtime: unsafe existing mirror refuses boot and never publishes a socket (21.188728ms)
|
||||
✖ C2-04 runtime: real library adapters reach the socket and lock waits leave other bus reads responsive (11.406264ms)
|
||||
ℹ tests 6
|
||||
ℹ suites 0
|
||||
ℹ pass 0
|
||||
ℹ fail 6
|
||||
ℹ cancelled 0
|
||||
ℹ skipped 0
|
||||
ℹ todo 0
|
||||
ℹ duration_ms 197.495962
|
||||
|
||||
✖ failing tests:
|
||||
|
||||
test at packages/bus/tests/library.test.mjs:28:1
|
||||
✖ C2-04 M4: both verbs reject every agent before arguments or adapter access (24.976387ms)
|
||||
Error: invalid-business
|
||||
at fail (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/broker.mjs:145:9)
|
||||
at new Broker (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/broker.mjs:322:9)
|
||||
at world (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/tests/library.test.mjs:20:18)
|
||||
at TestContext.<anonymous> (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/tests/library.test.mjs:30:13)
|
||||
at Test.runInAsyncScope (node:async_hooks:226:14)
|
||||
at Test.run (node:internal/test_runner/test:1402:25)
|
||||
at Test.start (node:internal/test_runner/test:1262:17)
|
||||
at startSubtestAfterBootstrap (node:internal/test_runner/harness:387:17) {
|
||||
code: 'invalid-business'
|
||||
}
|
||||
|
||||
test at packages/bus/tests/library.test.mjs:45:1
|
||||
✖ C2-04 bus: human reads validate keys and return adapter results without path leakage (7.097425ms)
|
||||
Error: invalid-business
|
||||
at fail (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/broker.mjs:145:9)
|
||||
at new Broker (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/broker.mjs:322:9)
|
||||
at world (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/tests/library.test.mjs:20:18)
|
||||
at TestContext.<anonymous> (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/tests/library.test.mjs:47:13)
|
||||
at Test.runInAsyncScope (node:async_hooks:226:14)
|
||||
at Test.run (node:internal/test_runner/test:1402:25)
|
||||
at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
|
||||
at Test.postRun (node:internal/test_runner/test:1542:19)
|
||||
at Test.run (node:internal/test_runner/test:1467:12)
|
||||
at async startSubtestAfterBootstrap (node:internal/test_runner/harness:387:3) {
|
||||
code: 'invalid-business'
|
||||
}
|
||||
|
||||
test at packages/bus/tests/library.test.mjs:56:1
|
||||
✖ C2-04 socket: each async library verb resolves its result rather than serializing {} (6.894431ms)
|
||||
Error: invalid-business
|
||||
at fail (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/broker.mjs:145:9)
|
||||
at new Broker (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/broker.mjs:322:9)
|
||||
at world (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/tests/library.test.mjs:20:18)
|
||||
at TestContext.<anonymous> (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/tests/library.test.mjs:57:13)
|
||||
at Test.runInAsyncScope (node:async_hooks:226:14)
|
||||
at Test.run (node:internal/test_runner/test:1402:25)
|
||||
at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
|
||||
at Test.postRun (node:internal/test_runner/test:1542:19)
|
||||
at Test.run (node:internal/test_runner/test:1467:12)
|
||||
at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) {
|
||||
code: 'invalid-business'
|
||||
}
|
||||
|
||||
test at packages/bus/tests/library.test.mjs:67:1
|
||||
✖ C2-04 runtime: protectedRoots skips library but retains real code-root credential protection (34.318499ms)
|
||||
Error: credential-format
|
||||
at deny (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/credentials.mjs:10:9)
|
||||
at #format (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/credentials.mjs:232:28)
|
||||
at #read (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/credentials.mjs:222:37)
|
||||
at new Credentials (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/credentials.mjs:145:35)
|
||||
at startBroker (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/runtime.mjs:108:19)
|
||||
at TestContext.<anonymous> (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/tests/library.test.mjs:72:25)
|
||||
at Test.runInAsyncScope (node:async_hooks:226:14)
|
||||
at Test.run (node:internal/test_runner/test:1402:25)
|
||||
at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
|
||||
at Test.postRun (node:internal/test_runner/test:1542:19) {
|
||||
code: 'credential-format'
|
||||
}
|
||||
|
||||
test at packages/bus/tests/library.test.mjs:81:1
|
||||
✖ C2-04 runtime: unsafe existing mirror refuses boot and never publishes a socket (21.188728ms)
|
||||
AssertionError [ERR_ASSERTION]: Expected values to be strictly deep-equal:
|
||||
+ actual - expected
|
||||
|
||||
Comparison {
|
||||
+ code: 'invalid-business'
|
||||
- code: 'library-git'
|
||||
}
|
||||
|
||||
at async TestContext.<anonymous> (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/tests/library.test.mjs:86:3)
|
||||
at async Test.run (node:internal/test_runner/test:1409:7)
|
||||
at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) {
|
||||
generatedMessage: true,
|
||||
code: 'ERR_ASSERTION',
|
||||
actual: Error: invalid-business
|
||||
at fail (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/broker.mjs:145:9)
|
||||
at new Broker (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/broker.mjs:322:9)
|
||||
at startBroker (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/runtime.mjs:126:20)
|
||||
at async waitForActual (node:assert:615:5)
|
||||
at async strict.rejects (node:assert:738:25)
|
||||
at async TestContext.<anonymous> (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/tests/library.test.mjs:86:3)
|
||||
at async Test.run (node:internal/test_runner/test:1409:7)
|
||||
at async Test.processPendingSubtests (node:internal/test_runner/test:974:7),
|
||||
expected: { code: 'library-git' },
|
||||
operator: 'rejects',
|
||||
diff: 'simple'
|
||||
}
|
||||
|
||||
test at packages/bus/tests/library.test.mjs:91:1
|
||||
✖ C2-04 runtime: real library adapters reach the socket and lock waits leave other bus reads responsive (11.406264ms)
|
||||
Error: ENOENT: no such file or directory, lstat '/mnt/storage/scratch/gt-iwfcrf5s/library-m65UFF/data'
|
||||
at lstatSync (node:fs:2138:25)
|
||||
at new Store (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/store.mjs:137:22)
|
||||
at startBroker (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/src/runtime.mjs:99:13)
|
||||
at TestContext.<anonymous> (file:///mnt/storage/scratch/gt-iwfcrf5s/base/packages/bus/tests/library.test.mjs:94:25)
|
||||
at Test.runInAsyncScope (node:async_hooks:226:14)
|
||||
at Test.run (node:internal/test_runner/test:1402:25)
|
||||
at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
|
||||
at Test.postRun (node:internal/test_runner/test:1542:19)
|
||||
at Test.run (node:internal/test_runner/test:1467:12)
|
||||
at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) {
|
||||
errno: -2,
|
||||
code: 'ENOENT',
|
||||
syscall: 'lstat',
|
||||
path: '/mnt/storage/scratch/gt-iwfcrf5s/library-m65UFF/data'
|
||||
}
|
||||
@@ -1,14 +0,0 @@
|
||||
✔ C2-04 M4: both verbs reject every agent before arguments or adapter access (28.309128ms)
|
||||
✔ C2-04 bus: human reads validate keys and return adapter results without path leakage (11.198339ms)
|
||||
✔ C2-04 socket: each async library verb resolves its result rather than serializing {} (14.717312ms)
|
||||
✔ C2-04 runtime: protectedRoots skips library but retains real code-root credential protection (42.066656ms)
|
||||
✔ C2-04 runtime: unsafe existing mirror refuses boot and never publishes a socket (23.773967ms)
|
||||
✔ C2-04 runtime: real library adapters reach the socket and lock waits leave other bus reads responsive (89.925539ms)
|
||||
ℹ tests 6
|
||||
ℹ suites 0
|
||||
ℹ pass 6
|
||||
ℹ fail 0
|
||||
ℹ cancelled 0
|
||||
ℹ skipped 0
|
||||
ℹ todo 0
|
||||
ℹ duration_ms 301.460553
|
||||
@@ -1,63 +0,0 @@
|
||||
✔ C2-04 M4: both verbs reject every agent before arguments or adapter access (27.706148ms)
|
||||
✔ C2-04 bus: human reads validate keys and return adapter results without path leakage (10.128912ms)
|
||||
✖ C2-04 socket: each async library verb resolves its result rather than serializing {} (14.255977ms)
|
||||
✖ C2-04 runtime: protectedRoots skips library but retains real code-root credential protection (20.969978ms)
|
||||
✔ C2-04 runtime: unsafe existing mirror refuses boot and never publishes a socket (19.148653ms)
|
||||
✖ C2-04 runtime: real library adapters reach the socket and lock waits leave other bus reads responsive (10.834076ms)
|
||||
ℹ tests 6
|
||||
ℹ suites 0
|
||||
ℹ pass 3
|
||||
ℹ fail 3
|
||||
ℹ cancelled 0
|
||||
ℹ skipped 0
|
||||
ℹ todo 0
|
||||
ℹ duration_ms 192.486443
|
||||
|
||||
✖ failing tests:
|
||||
|
||||
test at packages/bus/tests/library.test.mjs:56:1
|
||||
✖ C2-04 socket: each async library verb resolves its result rather than serializing {} (14.255977ms)
|
||||
Error: unauthenticated
|
||||
at Socket.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/herb-row197/packages/bus/src/client.mjs:42:17)
|
||||
at Socket.emit (node:events:514:20)
|
||||
at addChunk (node:internal/streams/readable:575:12)
|
||||
at readableAddChunkPushByteMode (node:internal/streams/readable:526:3)
|
||||
at Readable.push (node:internal/streams/readable:406:5)
|
||||
at Pipe.onStreamRead (node:internal/stream_base_commons:189:23) {
|
||||
code: 'unauthenticated'
|
||||
}
|
||||
|
||||
test at packages/bus/tests/library.test.mjs:67:1
|
||||
✖ C2-04 runtime: protectedRoots skips library but retains real code-root credential protection (20.969978ms)
|
||||
Error: credential-format
|
||||
at deny (file:///home/jwoltje/.t3/worktrees/mosaic-stack/herb-row197/packages/bus/src/credentials.mjs:10:9)
|
||||
at #format (file:///home/jwoltje/.t3/worktrees/mosaic-stack/herb-row197/packages/bus/src/credentials.mjs:232:28)
|
||||
at #read (file:///home/jwoltje/.t3/worktrees/mosaic-stack/herb-row197/packages/bus/src/credentials.mjs:222:37)
|
||||
at new Credentials (file:///home/jwoltje/.t3/worktrees/mosaic-stack/herb-row197/packages/bus/src/credentials.mjs:145:35)
|
||||
at startBroker (file:///home/jwoltje/.t3/worktrees/mosaic-stack/herb-row197/packages/bus/src/runtime.mjs:109:19)
|
||||
at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/herb-row197/packages/bus/tests/library.test.mjs:72:25)
|
||||
at Test.runInAsyncScope (node:async_hooks:226:14)
|
||||
at Test.run (node:internal/test_runner/test:1402:25)
|
||||
at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
|
||||
at Test.postRun (node:internal/test_runner/test:1542:19) {
|
||||
code: 'credential-format'
|
||||
}
|
||||
|
||||
test at packages/bus/tests/library.test.mjs:91:1
|
||||
✖ C2-04 runtime: real library adapters reach the socket and lock waits leave other bus reads responsive (10.834076ms)
|
||||
Error: ENOENT: no such file or directory, lstat '/mnt/storage/scratch/gt-iwfcrf5s/library-rRi0EP/data'
|
||||
at lstatSync (node:fs:2138:25)
|
||||
at new Store (file:///home/jwoltje/.t3/worktrees/mosaic-stack/herb-row197/packages/bus/src/store.mjs:137:22)
|
||||
at startBroker (file:///home/jwoltje/.t3/worktrees/mosaic-stack/herb-row197/packages/bus/src/runtime.mjs:100:13)
|
||||
at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/herb-row197/packages/bus/tests/library.test.mjs:94:25)
|
||||
at Test.runInAsyncScope (node:async_hooks:226:14)
|
||||
at Test.run (node:internal/test_runner/test:1402:25)
|
||||
at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
|
||||
at Test.postRun (node:internal/test_runner/test:1542:19)
|
||||
at Test.run (node:internal/test_runner/test:1467:12)
|
||||
at process.processTicksAndRejections (node:internal/process/task_queues:104:5) {
|
||||
errno: -2,
|
||||
code: 'ENOENT',
|
||||
syscall: 'lstat',
|
||||
path: '/mnt/storage/scratch/gt-iwfcrf5s/library-rRi0EP/data'
|
||||
}
|
||||
@@ -1,14 +0,0 @@
|
||||
✔ C2-04 M4: both verbs reject every agent before arguments or adapter access (29.476748ms)
|
||||
✔ C2-04 bus: human reads validate keys and return adapter results without path leakage (11.765761ms)
|
||||
✔ C2-04 socket: each async library verb resolves its result rather than serializing {} (15.523467ms)
|
||||
✔ C2-04 runtime: protectedRoots skips library but retains real code-root credential protection (41.028545ms)
|
||||
✔ C2-04 runtime: unsafe existing mirror refuses boot and never publishes a socket (20.174444ms)
|
||||
✔ C2-04 runtime: real library adapters reach the socket and lock waits leave other bus reads responsive (89.276012ms)
|
||||
ℹ tests 6
|
||||
ℹ suites 0
|
||||
ℹ pass 6
|
||||
ℹ fail 0
|
||||
ℹ cancelled 0
|
||||
ℹ skipped 0
|
||||
ℹ todo 0
|
||||
ℹ duration_ms 314.116154
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user