gosalyn: Case 2 C2-13a precheck refuses a port floor at or below the Console port, and a bwrap bind test shows EACCES below 1024 (mos-1100)

gosalyn: Case 2 design r11, Console unit without [Install], render rules, hardening list, 9.3 forgery facts with a privileged Console port, C2-13 split into 13a and 13b, C2-04 to Herb (webby-0036, mos-1097, sage-1480, sage-1482)
gosalyn: Case 2 design r10, two system units (bus and Console) from the existing templates, copy id the only re-pin value (darkwing row 195)
2026-10-20 16:14:35 -05:00 · 2026-10-20 16:11:06 -05:00 · 2026-10-20 15:59:03 -05:00 · 2026-10-20 15:56:38 -05:00 · 2026-10-20 15:56:16 -05:00 · 2026-10-20 15:56:09 -05:00
4 changed files with 2423 additions and 0 deletions
@@ -0,0 +1,11 @@
+# Gosalyn
+
+Worker seat for Mosaic Stack, MVP track T2 (Case 2, the creative writing hub, Vikunja #416).
+
+- T3 thread: 7604438a-0ded-41c8-bd3f-26f57fdb5cd2
+- Model: Opus 5.5 (Claude Code, T3)
+- Launched by Mos (Jason's main agent, T3 38bc4c81-6270-4021-b00c-6a15c43b9b0e), who briefs the seat
+- Repository lead and queue: Sage (T3 1ef1e4f8-3ead-4208-beca-38f9f1add079)
+- Branch: gosalyn/case2-design, pushed only by this seat, landed on refactor by Sage
+
+Work lives in `work/`. The Case 2 design is `work/case2/DESIGN.md`.
@@ -1357,3 +1357,5 @@ are never rewritten or removed; corrections are new entries.
 2026-10-20T15:26:33Z | Sage (Opus 5.5, 1ef1e4f8) | row 163 (#1660) r2 for Filbert's r1 changes (F1-F3, N1) | in-review r2, Filbert reviewer: candidate 2c090eefd on code 2a5f3a3a0, base 4f02486d5, manifest c6f4f4c12596; tests R14 R15 + R4/R9/R11 cases, read-only Registry #write() returns; gate passed, K34-K41 killed; Mos checked manifest (mos-0967); revs 2230 (Filbert) and 2231-2233 committed 92cc6011c c539995cf; request comment 29446; P19 337 comment 367; packet 7af166574; lands after B7
 2026-10-20T15:40:36Z | Filbert (Opus 5.5, 048f3c63) | row 163 r2 review (D2 rehearse, candidate 2c090eefd, manifest c6f4f4c12596) | approve, comment 29447 rev 2234: 249/249 singles pass; my M1-M6 and N1 mutants all killed (R14, R9, R11, R4, R15, session test)
 2026-10-20T15:42:00Z | Sage (Opus 5.5, 1ef1e4f8) | row 163 (#1660) r2 verdict intake | approved by Filbert (comment 29447, rev 2234 committed cd2b377bb); P19 337 comment 367 -> 368; candidate 2c090eefd manifest c6f4f4c12596 waits to land after B7, fresh gate if the base moves
+2026-10-20T18:48:55Z | Gosalyn (Opus 5.5, 7604438a) | T2 Case 2 design (#416), agents/gosalyn/work/case2/DESIGN.md on gosalyn/case2-design, static read at 5d019d876 | design r1 committed, review requested from Dewey, rows C2-01..C2-17 proposed, briefs follow approval
+2026-10-20T20:05:27Z | Gosalyn (Opus 5.5, 7604438a) | T2 Case 2 design (#416) r2-r8 and slice row briefs, gosalyn/case2-design | design r8 eab6e1a3a approved by Webby (webby-0026), step 1 hold lifted (mos-1074), 16 briefs in docs/plans/2026-10-20_case2-rows.md sent to Sage for queue add, webby-0026 N1 folded into the C2-13 brief
Author	SHA1	Message	Date
jason.woltje	eac92d9565	gosalyn: Case 2 C2-13a precheck refuses a port floor at or below the Console port, and a bwrap bind test shows EACCES below 1024 (mos-1100)	2026-10-20 16:14:35 -05:00
jason.woltje	fb20a61b4e	gosalyn: Case 2 design r11, Console unit without [Install], render rules, hardening list, 9.3 forgery facts with a privileged Console port, C2-13 split into 13a and 13b, C2-04 to Herb (webby-0036, mos-1097, sage-1480, sage-1482)	2026-10-20 16:11:06 -05:00
jason.woltje	4281b0064c	gosalyn: Case 2 design r10, two system units (bus and Console) from the existing templates, copy id the only re-pin value (darkwing row 195)	2026-10-20 15:59:03 -05:00
jason.woltje	51006710ac	gosalyn: Case 2 C2-13 README :713 line says the precheck prints only names (webby-0035)	2026-10-20 15:56:38 -05:00
jason.woltje	8d170d7a6e	gosalyn: Case 2 C2-13 brief states the README :713 replacement	2026-10-20 15:56:16 -05:00
jason.woltje	120c616ea5	gosalyn: Case 2 row A brief replaces the README one-line wording, C2-13 owns README :713 (webby-0034)	2026-10-20 15:56:09 -05:00
jason.woltje	a2d94b2c2a	gosalyn: Case 2 r9 takes webby-0032 notes: zai.json path, XDG_DATA_HOME precheck, last-assignment key parse, row A README line	2026-10-20 15:49:31 -05:00
jason.woltje	29e85196b2	gosalyn: Case 2 design r9, the O4 model path (Q186): pi on zai glm-5.3 for both, hub key step 2d, Chet's Codex login to #428 , C2-20 Hermes name count; C2-13 brief follows	2026-10-20 15:43:25 -05:00
jason.woltje	f325657c7a	gosalyn: Case 2 row A brief (ZAI_API_KEY in ENV_ALLOW) and row B brief (#428 , held to after 10-27) (sage-1457, sage-1469)	2026-10-20 15:41:07 -05:00
jason.woltje	29404f9964	gosalyn: Case 2 C2-13 brief cites stack-copy.sh's copy id rule	2026-10-20 15:38:44 -05:00
jason.woltje	13a98bfd08	gosalyn: Case 2 C2-13 brief takes row 195's asks: --profile factory\|library, node 24 and bwrap precheck lines, copy id as the one varying ExecStart part (darkwing)	2026-10-20 15:38:32 -05:00
jason.woltje	3e25a829d7	gosalyn: Case 2 C2-20 brief build note, the dry run counts lines naming a Hermes tool or channel, counts only (gosalyn-0030, mos-1087)	2026-10-20 15:34:07 -05:00
jason.woltje	a0f6afc508	gosalyn: Case 2 C2-13 brief checks the whole Exec prefix run for + or ! (webby-0027)	2026-10-20 15:06:00 -05:00
jason.woltje	366a4c6d5d	gosalyn: Case 2 C2-13 brief refuses root-run Exec prefixes and PermissionsStartOnly (webby-0026 N1), session line	2026-10-20 15:05:27 -05:00
jason.woltje	eab6e1a3a8	gosalyn: Case 2 design r8 for #416 (T2): root renders and checks the unit from a root-owned checkout in 2c, mosaic writes no unit, 2b via sudo -u mosaic from localadmin, step 1 hold lifted, C2-13 brief to match (webby-0025, mos-1074)	2026-10-20 15:04:15 -05:00
jason.woltje	8645cb4560	gosalyn: Case 2 design r7 for #416 (T2): root steps 2a and 2c owned by ops-01 via localadmin (#423 step 1), no supplementary groups with an id -G check, Hermes sudo as Mos's residual until #423 step 5, C2-13 brief to match (webby-0023, mos-1064)	2026-10-20 15:02:03 -05:00
jason.woltje	a0ce2ffb84	gosalyn: Case 2 slice row briefs for #416 (T2): C2-01 to C2-20 slice rows plus C2-11a per BRIEF-TEMPLATE, owners from design 8, reviewers proposed, Sage gates (sage-1329)	2026-10-20 14:58:46 -05:00
jason.woltje	1508fd175f	gosalyn: Case 2 design r6 for #416 (T2): section 10 step 1 after Q183, mosaic user without sudo at install, FED R8 records Jason's acceptance, in-VM tightening is #423 and doesn't gate the install (mos-1057)	2026-10-20 14:58:28 -05:00
jason.woltje	e1635308be	gosalyn: Case 2 design r5 for #416 (T2): limits.set named as the human's path to launch.models with an actor-not-verb test, pi missing-file fallback covered by [ -r ], marker run of --system-prompt-file at C2-13 (webby-0020)	2026-10-20 14:53:29 -05:00
jason.woltje	5fc296e708	gosalyn: Case 2 design r4 for #416 (T2): one human-actor rule on all five creative write paths incl. routes.set, chief's launch.models change on a creative key refuses, C2-20 count-only dry run, prompt passed by file not argv (webby-0017, mos-1038, mos-1051)	2026-10-20 14:48:00 -05:00
jason.woltje	2958acb81e	gosalyn: Case 2 design r3 for #416 (T2): playground inside a book folder, persona in a 0600 file with a digest var, creative instances human-only, fenced persona block, host 10.1.1.54 as mosaic (webby-0009, mos-1031, mos-1033, Q181)	2026-10-20 14:35:20 -05:00
jason.woltje	c1913fb07a	gosalyn: Case 2 design r2 for #416 (T2): her books repo as the library, Console slice, Bean and Chet personas, host as a variable (webby-0001, mos-0992, mos-1000, Q180)	2026-10-20 14:17:14 -05:00
jason.woltje	88222f3f3f	gosalyn: Case 2 design r1 for #416 (T2), seat README and session line Library record repo with canon/playground scope by path, human-only library verbs, cited-reply guard, five creative roles, rooms with @tags without a schema change, Obsidian through a Gitea remote, and rows C2-01..C2-17.	2026-10-20 13:51:02 -05:00