Compare commits

..
1672 changed files with 1420 additions and 435528 deletions

No files matched your search

-159
View File
@@ -5303,14 +5303,6 @@ Before: managed project/thread verbs had no Console conversation area. After: fi
### 2026-10-22 | Gander | row278 gate run3
Fresh gate on3e4c77ac6 under sage-2648: bus793/0, WebUI345/0/1 (esbuild version skip), all ten shell files425/0, touched files15/0, M1-M6 killed6/6. No timeout; sweep0 run-created leftovers. Runs1/2 void. Seven-path manifest8fa859a0 goes to Webby for final review. No landing or live change.
2026-10-22 11:29:09 UTC | Rocko | V502 carry/rerun on980cec88c: source407c8d7be and packet04a86cf33 match approved8e3c6a79b/9bf4683c6 patch-ids, no conflicts. Dewey0834 carry conditioned on rerun, satisfied under sage2616: stop-run13,processingHTTP6,bustasks9 allgreen (Node28/28),Python4/4,0skips/timeouts. Manifest5758d699,source5/5restored,cwdsweep[]. Doc rerun packet6af85df4b explicitly pushed to rocko/vikunja502-980c-20261022; no live action.
2026-10-22 11:30:17 UTC | Sage | Vikunja 502 (row 191 follow-up, no queue row) LANDED 6af85df4b, a fast-forward from 980cec88c. Before: the processing failure diagnostics and cleanup in stop-run, processing HTTP and bus tasks tests were Dewey-approved on the pre-194 base only (8e3c6a79b/9bf4683c6). After: Rocko's picks 407c8d7be/04a86cf33 carry the same patch-ids (37135ebe/0dbcda54), plus a doc-only rerun record 6af85df4b. The rerun on the new base was green: stop-run 13/13, processing HTTP 6/6, bus tasks 9/9, Python 4/4, 0 skips. Dewey carried the approve (dewey-0836). mosaic-task.mjs is unchanged, so N7 (runs suite) didn't trigger. Overlap with in-review rows 13 and 257 was clean. LIVE is still 86f95bb27.
2026-10-22 13:10 UTC | Sage | Rows 278 and 281 LANDED. Before: refactor at 6af85df4b (V502). Row 278 (#1783, Gander, Webby): the Console Agents view shows thread claims in their own section. It landed as 385a7194c at 12:39Z, ff, 9 commits, manifest 8fa859a0. Run 3 was green: bus 793, webui 345/0/1, ten shells 425/0 under the 3x limits (mos-1275), M1-M6 killed. Runs 1 and 2 were void, on fixture fixes 964b6b184 (placed by Sage) and 9696d1fcb (ruled by Mos, mos-1275). Webby approved (c30588, rev 3200). Done rev 3202, #1783 closed c30589. Row 281 (#1786, Megavolt, Dewey): a fire or a delete revokes the instance's host and Gitea grants. It landed as e479521d3 at 13:06Z, ff, 17 commits, manifest b73d4c81. Slot on 7979fb41e: bus 819, business 231, cli 837, dewey-bus 76 with the Docker gitea-grant test, shells green, M1-M22 killed. The M1 hang was fixed at its cause in b4a (mos-1273). Dewey approved (c30614, rev 3207). Done rev 3209, #1786 closed c30621. Skips on both: test-task's row 244 live-provider pair and test-queue's canonical-root check, plus webui's esbuild rebuild test on 278. After: refactor at e479521d3. DEFERRED moves the grant gap to Done and opens Dewey's N1/N2 text gaps. LIVE is still 86f95bb27.
2026-10-22 14:18:23 UTC | Sage | Row 264a LANDED (#1769, Gizmoduck, Duckworth): sessions per thread, schema 3k-3l. Before: refactor at e479521d3 (row 281). It landed as 84f53540d, ff, 21 commits, manifest 257408e9 (Duckworth approve rev 3214, comment 30640). Gate r13 on 2cc34aef8: 20 touched files, bus 827, cli 837, webui 345/1 named skip, ten shells under 3x limits, mutants M1-M4 killed on assertions. Corrections on the way: the kit stopped on first red, so four reds surfaced one at a time. r10 later3l missed a trigger (mos-1276). T2 had failed since r2 because refusals log action.refused (mos-1277, my sage-2257 wording). threads.test:341 kept the old trigger text (mos-1278). M2 was caught by the store trigger before any assertion, so it now drops the trigger too (mos-1279, four files with the SCHEMA_SHA256 pin). Deferred: actor_run pin binds row 269, esbuild skip to a later gate, session-scoped user reply binds row 272. No live change; LIVE is still 86f95bb27.
2026-10-21 21:24:47 UTC | Gander row253 #1758 design r1 | Investigation began21:12Z under sage-2162; recorded now. Before: case2 installer still renders tester TCP and case1 acceptance requires it. After: proposed design covers socket marker migration, actual configured dataRoot within unchanged hardening, target-uid metadata queries, kernel-peer acceptance observation and explicit same-uid residual. Initial inventory saved; no passing final static-check claim, product edit, test, host or live action. Duckworth design review precedes code.
### 2026-10-21 row253 implementation prepared, gate pending
@@ -5318,154 +5310,3 @@ Fresh gate on3e4c77ac6 under sage-2648: bus793/0, WebUI345/0/1 (esbuild version
Gander: after Duckworth-0100 design approval with C1-C5, prepared the two host-script socket migrations, fake fixtures, updated retirement docs and 33 unique change checks. Static syntax/diff and source inventory checks pass; behavioral tests have not run. Sage-2191 queues the requested full scope and will send CLEAR. No host, unit or live config changed.
2026-10-22 02:13:30 UTC | Gander row253 C4 committed candidate, gate pending | Sage-2335 explicitly directs committing runnable source and tests before the whole gate. The repair implements the approved after-uid supervisor with separate inner/outer bounds; the static packet is b64aa316a. Current repaired bytes have run no syntax check, test, probe or host experiment. Earlier static syntax results apply only to the old build. Results from 8a8df4171 are historical and do not carry. Duckworth static verdict and Sage CLEAR precede all gate execution. F5 is row276 / #1781 in DEFERRED.md.
2026-10-22 14:45 UTC | Gander row253 focused27 on finalaca16404c base | Fresh0604d91fc / manifest573c51cf:27 whole files604/0/0, no timeout/retry, case134/0 in99.281s, case243/0 in66.418s, stack-release includingT46221/0 in583.453s. N9 sandbox bind ran and passed, no focused skips. Seven source blobs unchanged; sweep0 run-created leftovers, pre-existing infrastructure receipts retained. Whole gate and M1-M40 await separate Sage CLEAR after Duckworth rebase check. No live action.
2026-10-22 14:46 UTC | Gander correction to the row253 focused27 entry immediately above | stack-release whole was218/0/0, not221/0. The27-file sum604/0/0 and duration583.453s are unchanged; raw files/results.json and SUMMARY.json give the exact per-file totals.
2026-10-21T16:04:23Z | Q195/Q196 writing editor design, #1752 / Vikunja #448 | Before: row 154 edits Markdown in a separate Docs view, with no selected-word thesaurus or document pins. After: design draft on gyro/editor-design compares three editor approaches, records WordNet source/license/size, folds the pane/pin model and specifies guarded context/proposal APIs, DesignCraft handoff and seven proposed briefs. Q196 changes the basis to a Word-like interface. Verification so far: editor/provenance checks 10 pass, 1 explicit rebuild skip (pinned esbuild absent); brief fields, unique headings and 11-line checklist checked. Product, queue and live state unchanged. WordCraft scratch evaluation is being incorporated before publication. Review and Jason choices remain open.
2026-10-21T16:22:36Z | Q195/Q196 design verification, #1752 / Vikunja #448 | Folded Fenton 7caf8008b and Louie 880ef19e0. Recommend bounded O3: Word-like DOM editor plus isolated headless DOCX export, with explicit feature cut and semantic loss checks. WordCraft web 44,179,239 bytes, identical twice; measured comment/footnote conversion limits recorded. Seven briefs and 12-line checklist validated. Fresh editor/provenance: 10 pass, 0 fail, 1 explicit rebuild skip (esbuild 0.28.2 absent). CI queue guard identity gyro/purpose push returned documented degraded-pass (exit 0), CANNOT_ASSERT credential-unresolvable, scratch audit gyro-q195-ci-queue-audit.jsonl; no fallback or CI-green claim. Documentation-only candidate for Mos/Fenton review, no source, queue or live changes.
2026-10-22T16:06:34Z | Q195/Q196 design review fixes, #1752 / Vikunja #448, mos-1300 / fenton-0004 | Before: draft 105811400 had owner-only thread wording, stale source positions, two mismatched seat/model assignments, an assumed library save boundary and 12 owner questions. After: grant-aware pin validation and stale/revoked access redaction; references refreshed against aca16404c, including public/bus.js and README offsets; Sage assigns model-only seats; unimplemented library.file.save/C2-11b brief blocks book editing; tabs explicitly cover 62-76rem; J7 stricter context choice recorded; pronouns removed; six owner questions. Static docs/source-anchor checks only, no builds, product suites, MVP gate slot or live action. Fenton re-check pending; O3 and both companion folds retained.
2026-10-22T16:09:56Z | Della mos-1303 / Vikunja 460 Q217/Q222 revision | Before: Q1/Q2 open and Q3-Q7 phrased as Jason questions. After: Jason-created InMotion/woltje.com ingress recorded; per-source mailboxScope defaults none with human-only CLI then Console writer and named default/change/agent-refusal tests. Q3-Q7 settings/defaults/owners documented; no new external decision required for default development, conditional provider/spend/exposure list retained. PRD/grant/data.delete/live gates preserved. Docs only, no product suite or live operation. Earlier uncommitted append-only PRD review session receipts are preserved in this docs commit. Ludwig reviews before Sage landing.
2026-10-22T16:12:26Z | Della ludwig-0035 / mos-1303 / Vikunja 460 focused corrections | Verified REQ-WAIT-2/3 at db1e7732a: Jason approval is required to route mail.access out of hard waits. Restored explicit Jason-approved PRD gate; no Q211 waiver inferred. Named tunable parser/attachment settings, defaults and schema/test review ownership of resource bounds; E04 checks changed values and bound refusals. Clarified Q8 extraction stays Jason choice. Docs-only checks, no product/live action; focused review before Sage handoff.
2026-10-22 13:06 UTC | Megavolt | Row 281 (#1786) build. Before: a fire or delete left host_grants/gitea_grants rows, the host line and the Gitea token live. After: step G in broker.mjs revokes them in a detached job per agent (the host line first, then Gitea local-first with an admin preflight); a refusal is grant.revoke.refused plus a human message; open grant decisions are in the set; a raise for a fired agent refuses instance-fired. Tests T1-T14 (bus fire-revokes-grants, lifecycle-revoke, grant-executor, gitea-grant; cli lifecycle). Gate on 7979fb41e: base 121/121 + 24/24, 29 anchors, M1 exit check rc1/17, M1-M22 22/22 killed, dewey-0840 files 76+14+23, bus 819, business 231, cli 837, ten shells rc 0 under the mos-1275 limits; skips: test-task row 244 live-provider pair, test-queue canonical-root check. Corrections: the first base run on c174f37ac went red on five first-run test defects (b3, test only); the first mutant run on 06ee5ed6b hung on M1 because T6c's held loop never ended (b4a fixed the teardown, and the runner now has timeout -k 10 180 and an exit check without --test-force-exit).
2026-10-22T16:36:30Z | Della row224 C2-05b #1725 preparation | Before: C2-05a queries exist at 4f3fbc25a but no broker lookup verbs or typed tools. Scope: broker/tools plus Sage-authorized runtime/bundle integration, tests and docs. Existing human-only library reads retained; five agent queries require a live holder and trusted configured source. Code/docs only under row253 gate; no Node/test/push/claim. Runtime ownership coordinated with Rocko219/Huey272.
2026-10-22T16:52:55Z | Rocko | Row219 prepared under sage2793/2807; explicit creative thread/default-session selection, narrow metadata route/picker U1–U5,22 static mutant sites; unrun while253 holds.
2026-10-22T17:42:16Z | Sage | Row 253 (#1758, Gander, Duckworth) LANDED 48e450ce8. Before: refactor at aca16404c; case-sudo calls had no supervised session check and the M21 survivor hid behind a fast-exit fixture (mos-1297). After: a fast-forward of 22 commits; manifest 591020a1 rechecked with 0 mismatches; run 5 whole gate green with M1-M40 killed, the M38 PID equals SID assertion added under mos-1298; Duckworth APPROVE rev 3252, note rev 3253, done rev 3254; #1758 comment 30701 and closed; P19 416 comment 719. N1 (fast child reported as exit 85) is DEFERRED as Vikunja 532.
2026-10-22T18:11:57Z | Sage | Row 275 (#1780, Morgana, Duckworth) LANDED 3410df7c3. Before: refactor at 48e450ce8; viewers had no verb list of their own and board reads were not refused to users. After: a fast-forward of 3 commits; manifest 39847b15 (4 paths) blobs match; gate 17:52:12Z-18:05:00Z green (whole files 7/22/6, bus 834, cli 861, harness 151, business 231, seat 167, 10 scripts with 3 named skips), M6 and M10 killed; Duckworth APPROVE rev 3260 (comment 30717); note and done by sage-2897; #1780 comment 30728 and closed. N1 (board refusal test as a loop over BOARD_VERBS) is non-blocking.
2026-10-22 18:11:58 UTC | Gander row276 #1781 prepared, gate pending | Before: row253 left5legacy Case1 AS_USER calls unsupervised across sudo pty sessions. After: candidate uses its unchanged supervisor with per-call inner/outer budgets, separate streams, strict display-only failure trailer, fake-only paired process-model cases and15unique mutants. Duckworth0182 B1 corrected the plan before product code;0183 cleared build. Parse-only Bash checks pass; no Node, behavioral test, host, unit or config action. Runtime gate and publication await Sage.
2026-10-22T22:51:32Z | Megavolt | Row 207 (193c, #1705): rebased onto 01983cd3f as 712f79c0a; gate green under sage-3041 (access.test 31/31, M1-M8 killed on named tests, cli 894/894, ten scripts under mos-1275 limits). Correction: the first run's kill check grepped TAP "not ok" against node's spec output and was stopped and rerun. Runs note in 9bb406c6c.
2026-10-22T22:51:32Z | Sage | Row 207 (#1705, Megavolt, Duckworth) LANDED c4f77373f. Before: refactor at f0e3dcdf4; mosaic access had no user verbs. After: fast-forward of 4 commits, a cherry-pick of the gated 01983cd3f..9bb406c6c (range-diff 4/4 equal, patch-ids equal, the 4 manifest blobs equal; the base moved only by the #1797 brief, which no test reads; no open branch touches the manifest). Duckworth APPROVE c30849 rev 3356; done rev after the note. N1 (any-business refusal untested) DEFERRED. No live change. Correction: my first 207 review request ran under timeout 120, which killed it while it wrote the outcome; the comment (c30841) had posted, so I removed the dead lock and resolved it at rev 3350.
2026-10-22T23:03:39Z | Gyro Q195 O2 rewrite, #1752 / Vikunja #448, mos-1356 | Before: landed O3 design 95e3f7166/blob 4cb59999. After: Q231/Q233 full WordCraft O2 design on gyro/editor-o2 from refactor c4f77373f; canonical git DOCX, original Markdown/wiki preservation, human cadence default 0 with instant accepted-save commits, full rich-feature first slice. Ten briefs include independent source/dependency security clearance before any build queue entry, exact editor-only CSP approval gate, restricted source/build/bridge, separate reviewed DOCX citation gate and flags-only agent access. Existing Case 2 semantics unchanged; any integration requirement change goes through Mos to Jason. Static checks: ten briefs/seven fields, independent reviewers, unique anchors, current source/base/blob pins, docs scope and append-only logs pass. No builds, browser/worker runs, code, queue or live changes. Fenton review pending; CSP and implementation gates remain closed.
2026-10-22T23:03:53Z | Gyro Q195 O2 push guard | CI queue guard identity gyro / purpose push returned exit 0, documented degraded-pass: CANNOT_ASSERT credential-unresolvable. Audit: /mnt/storage/scratch/gyro-q195-ci-queue-audit.jsonl. No credential fallback or CI-green claim.
2026-10-22T23:09:38Z | Gyro Q195 O2 fenton-0006 fixes | Before: e012bab0b left stale-source ambiguity, incomplete migration/shipping ownership, undefined typing transactions and an unmeasured CSP gate. After: D12 explicitly routes superseded-source/C2 reply notices to Mos/Jason and refuses adoption before W4b/notice path; Q2 remains open. F2-F6 add schema-edge placeholders and restore-accounting files, shipped runtime data/writing closure with no sandbox store mount, per-chapter DOCX and 2s-pause/15s-span save groups, volume/latency/growth gates, split-run clickable wikilinks and historical Obsidian graph warning, and S0 isolated existing-artifact CSP measurement before exact-header approval. Static ten-brief/ownership/settings/checklist checks pass. No build/browser run, product/queue/live change. Independent re-check pending.
2026-10-22T23:09:50Z | Gyro fenton-0006 push guard | identity gyro, purpose push, exit 0 documented degraded-pass CANNOT_ASSERT credential-unresolvable; audit gyro-q195-ci-queue-audit.jsonl. No fallback credentials or CI-green claim.
2026-10-22T23:10:14Z | Gyro mos-1358 ruling recorded | Q36 / Vikunja 562 keeps C2 superseded notices OPEN with Jason. Markdown adoption refusal until W4b PASS is now a separate settled Mos build-order ruling, not a Jason question. D12 and Q2 distinguish them; no notice build authorized.
2026-10-22T23:13:27Z | Gyro Q195 O2 fenton-0007 F7/F8 | Named human-only editor.saveGroupPauseMs=2000 and editor.saveGroupMaxMs=15000 with integer/range/cross-field validation and W3a UI/CLI refusal tests. W3b owns production adoption refusal until W4b; isolated fixture conversion remains testable without request-flag bypass. W4b owns adoption module/API tests and reviewed lifting only with committed-reader/citation readiness and, if Q36 approves, the separate notice row PASS. Q36 unresolved stays closed. Static ten-brief, setting-key/bounds, refusal/lift ownership and two-question checks pass. Docs only; no build, browser/worker run, product/queue/live change. Fenton checks F7/F8 on next push.
2026-10-22T23:13:48Z | Gyro mos-1359 / r3 push guard | D13 records save-group timing as Mos's accepted reading of Q226 F41, not Jason's ruling; both defaults remain human-only settings. Push guard identity gyro/purpose push: exit 0 documented degraded-pass, CANNOT_ASSERT credential-unresolvable; audit gyro-q195-ci-queue-audit.jsonl, no credential fallback or CI-green claim.
2026-10-22T23:23:42Z | Rocko, W4 #1799 | Before, D24-D26 had no separate exact DOCX citation/access contract. After, 15e91538f proposed a versioned schema, parser/story/view/refusal rules, live authorization/sharing and generic/git/session bypass closure, compatibility gates and 22 acceptance rows. Two JSON examples parse, diff check clean; no code or implementation acceptance. Megavolt review pending.
2026-10-22T23:55:11Z | Sage, W4 #1799 docs landing | Megavolt reviewed four rounds (CHANGES 15e91538f, 019a0ea5b, 54246cb32; APPROVE 994c3f7fb, #1799 c30868/c30870/c30876/c30884). Landed here as cherry-picks: docs/plans/2026-10-22_q195-docx-citations.md blob 2af460ab7 and docs/reviews/2026-10-22_q195-docx-citations.md blob bedde1716, both new files. 32 acceptance rows go to W4b; R4-N1 (re-migration after a pre-W4b restore keeps the rotated fence and needs owner confirmation) goes into W4b's brief and A32. W4 is design-approved only: its gate still needs Sage's W4b implementation brief, which waits for S0 (#1798) PASS. Q36 open, adoption closed. Docs only, no test reads these files.
2026-10-23T00:52:58Z | Gyro Q235-Q237 policy rewrite started, Vikunja 571, mos-1366/1367 | Before: approved O2 e36bce352 keeps Markdown originals at their paths and Q36 notices open; landed W4 2af460ab7 has the same boundary. Imported that byte-identical W4 baseline as 1ac76a417, from refactor 062646487, to make the policy-only revision diff explicit. Prepared P1-P6/B1-B4: human one-way per-story import, human-set source-repo archive, DOCX current reader, scoped format map/archived non-canon reads, W7 conversion publication after W4b/approved PRD/10-27 and Jason first-real-book go. Q234 exact CSP, mos-1363 and S0 M1-M14 retained. W4 locator/extractor, shares and restore-fence blocks compare byte-identical to the approved baseline. Scope/source review ongoing; Mos impact map must be folded before Fenton handoff. No build/browser/worker run, code, queue, private-book or live action.
2026-10-23T01:37:07Z | Gyro Vikunja571 final impact-map / mos-1372/1375 fold | Prepared parent/W4 rewrite against brain-redux d183246 impact map at stack 062646487. P1-P6/B1-B4 and engineering Q1-Q16 are mapped to eleven briefs. D9 replaces the earlier private O2-only context/per-document/share model: normal Case 2 access in any authorized thread/room, supporting writes intact, changed policy awaits PRD 1.17 approval. New DOCX story creation has the same opening gate as human per-story import. Host-only push to human-set off-host remote replaces the no-remote ban; remoteURL defaults unset and same-host bare is disallowed. W7 gates on Hermes #423 step5, W4b, PRD approval, post-10-27 and first-real-book go; owns conversion events COUNTED/--events/pre-conversion restore reconciliation, manifest order/next_chapter, creative role cite wording, archive/old-path edits and format/link/citation routing. Store+off-host acknowledgment precedes archive commit/push, then catalogue publication; post-push failures remain resumable pending with pinned source. Current checks pass: complete brief fields, policy/map coverage, exact Q234 CSP, locator/projection mechanics byte-equivalent except explicit authority wording, A01-A35 IDs, immutable map pin, four-doc scope and append-only logs. W4 authority/remote/recovery sections reopened for Fenton; older APPROVE not reused. No product/build/browser/worker/private-book/queue/live action. Earlier entry describing preserved shares/fence applies only to the pre-D9 intermediate draft; D9 now withdraws those unimplemented structures.
2026-10-23T01:37:55Z | Gyro 571 push guard | identity gyro/purpose push: exit 0 documented degraded-pass CANNOT_ASSERT credential-unresolvable, scratch audit gyro-q195-ci-queue-audit.jsonl; no credential fallback or CI-green claim.
2026-10-23T01:41:59Z | Gyro sage-3121 A1-A3 PRD alignment | Before: 8d209016b adds a current Connections graph, excludes new Markdown stories in converted books and defaults archiveFolder. After: parent/W4 align with PRD1.17 d6 sha256 886b93c571f87bfbb2f27ee3113b6800a32d8f89196d95ace33566031bee380a: clickable editor links only; graph/tests later pending J-b; new different-path Markdown in a converted book remains canon until import, only recreated converted old paths are unmapped; archive folder is human-set in library mapping with no default, missing folder refuses conversion. Static A1-A3/11-brief checks pass; W4 locator/extractor/access/remote/recovery blocks unchanged. Local commit only, push held for Sage's named gap while Gizmoduck holds 270+271 run5. No product/build/browser/worker/queue/live action. Fenton gets local SHA through shared object store.
2026-10-23T01:49:08Z | Gyro fenton-0012 B1/B2 and N1-N6, mos-1379 | B1: off-host remote must deny the real shared jason.woltje seat-helper credential as well as seat identities until #431; private visibility/dummy-token denial is insufficient; W3b/A16/A26 require that future fixture proof. B2 follows mos-1379: human-only editor.agentReadComments and editor.agentReadTrackedDeletions both default false, comment/original/markup reads/resolves/index/context refuse when off; final access remains D9 and no role allowlist/per-document grant. N1 staging-ref allowlist and retained private refused/published audit refs; N2 URLs literal with fidelity-report loss and confirmation; N3 future paths marked new or predecessor row; N4 rename/sharing wording fixed; N5 historical thread text not refreshed; N6 protected VM1012 backup cited in P5. Static checks pass, locator JSON/package/projection mechanics retained. Local commit only; HTTPS push still held for Sage's named gap. No credentials tested/read/printed, no product/build/browser/worker/queue/live action. Fenton gets exact local SHA/blobs.
2026-10-23T01:53:25Z | Gyro fenton-0013 N7 mixed-format chapter order | Fenton approved local 0f4fa4f93. D10 now explicitly orders every chapter ID regardless of Markdown/DOCX format, inserts new canon Markdown by row216 or human committed order, and preserves ID/position at import. W7 tests cover mixed traversal/insertion/import stability. Static diff/append-only checks and docs hook pass. Local commit only, narrow re-check requested, HTTPS push still held for Sage gap. No runtime, queue or live change.
2026-10-23T02:21:06Z | Sage, rows 270+271 landing, 571 landing, MVP rows | Before: 270 (#1775) and 271 (#1776) were approved on gizmoduck/row270-271-r4 49cee846e and 2b964a082 after combined gate C2 run 5 GREEN on 53406f3e4 (bus 873, seat 202, cli 905, ten scripts, 38/38 mutants). After: 33 commits cherry-picked onto 767bb62c7 as 7328da8ca, range-diff all "=", 40 paths identical to the candidate; 270 manifest f4174458 matches, 271 manifest 3ab1f5c8 matches on 29 paths, the other 4 moved under 270 and match its manifest. Done revs 3396/3398, #1775 c30962 and #1776 c30964 closed, P19 463 c861. 571 (Gyro, Fenton APPROVE) picked as ee5f7b9ef, 6345aae3d, 767bb62c7 (blobs 9382f85b, 7ec0897b), 1ac76a417 left out; N7 911dad2aa (Fenton-0014) picked after. Rows 293-299 added (574, FED R6, R4, R7, GitHub grant, Q228, 573), queue commit 253346e3c. Correction: the push sync step checked out O..S paths over the canonical worktree without testing for uncommitted edits, so any pending SESSIONS or BUILD-LOG line in the canonical checkout at 02:06Z would have been overwritten; the sync now skips edited paths. Schema 3n is not live (LIVE 0cbe2e9b3 at 3m).
2026-10-23T03:59:52Z | Sage, row 293 (Vikunja 574) landing and 3m-3n live window | Before: live 0cbe2e9b3 at schema 3m; 574 approved by Filbert (c30982, cdda41f5) on gander/v574-r2 a9cae2bd6 after run 2 GREEN on 6bfab273b (four files 153/0, seat 202/0, cli 905/0, 312 flagged commits with 0 maintenance children). After: Darkwing's window put live on 464010fbe at 3n (activation 20261023T034557Z-464010fbe4c6, 26/97/5/28, Console 7332 200, W9b pm ra38826f3c6e2 left live, STATE darkwing/window-migrate-3n 8708927e5); 574's six commits cherry-picked onto 464010fbe as e51d11640, range-diff all =, patch-ids equal, only docs differ from a9cae2bd6. #1805 closed c31013, P19 386 c887 and 574 c888. Residual: queue store.mjs, discord git.mjs, harness tools.mjs commit without the maintenance flags; no whole-root test covers them yet.
2026-10-23T05:47:17Z | Sage, row 292 (#1797) landing, idle-stop race row 302, rows 300/301, row 294 rounds 2-3 | Before: refactor 4a9c536e8; 292's gate on 0d0021454 hit one red at compactions-launch.test.mjs:229, ['session-invalid',22,null] where ['stopped',0,null] was expected, product and test unchanged. Gizmoduck read it as a race: threadIdle releases the claim, then the launcher sends SIGTERM, and a runner call in between gets not-holder and exits 22. Mos (mos-1411) rejected loosening :229, let 292 count one whole unedited green cli rerun, and allowed one rerun for that exact signature on other gates until the race row lands (hits logged on Vikunja 588). The 10-run diagnostic passed 10/10, but one runner log (r846b8d083502) showed not-holder then exit 22. After: the cli rerun was 910/910. 292 LANDED 6aab979e6 05:18Z (7 cherry-picks, range-diff all =, patch-ids equal), done rev 3447, #1797 closed c31038, Vikunja 588 c891. Briefs 86d5ac69b (R6-N1 #1807, R6-N4 #1808, rows 300/301) and e3ef1eaf6/fdedc56e2 (race, #1809, row 302). Row 302 design d1/d2 approved by Dewey with D1 (role.claim refuses a released run), c31044. Mos ruled landRelease folded in, code launcher-released, and four old-test lines moved to exact values (mos-1414/1415/1416): threads.test:394, runner.test:771-772, land.test:464. Row 294 round 2 stopped at webui G5 granted-user.test:269: max(seq) over an empty events table is NULL. Round 3 is one line, coalesce(max(seq),0) (mos-1417), Duckworth APPROVE c31045 rev 3462, gate pending. Queue commit 756284e8e (revs 3448-3456). Correction: two review-request attempts this window ran without MOSAIC_GITEA_CREDENTIAL_FILE exported and failed (3450 Launchpad, 3451/3452 Sage); the posted request was 3453/3454.
2026-10-23T07:11:43Z | Sage, row 294 (#1800) rounds 3-4 and landing, row 219 edits 2-3, R9 transient and row 303 | Before: refactor 09d0d6faf; 294 run 3 on cb1648f3 stopped with 20 cli reds from two causes. A: the stack-release rehearsal fixture copies lacked cli access.mjs and transport.mjs, which 294's config.mjs now imports. B: the B1-B3 boot tests read warnings that now carry the fixture tracker line. Mos ruled A as two copy-list entries and B as a full pin, no filter: a TRACKER const and deepEqual (mos-1419). After: round 4 8616b9a4f, manifest a1ff5d67, Duckworth APPROVE c31053 rev 3469 with C1/C2. Run 4 from npm ci green: webui 365, cli 909, bus 873, 10 scripts, M1-M11 killed. Merged tree d3059c2c3 (11 cherry-picks, range-diff all =, patch-id 8371405a equal): stack-release-external 25/25, stack-upgrade 21/21. stack-release 223/224 on the first run, R9 at :2178: TypeError on join(r.dir) with r.dir null, so rehearse stopped before its directory and the output was lost. R9 passed 6/6 run alone on d3059c2c3, 09d0d6faf and 24b745447. Mos (mos-1422) allowed one unedited whole rerun: 224/224. 294 LANDED d3059c2c3 07:04Z, done rev 3471, #1800 closed c31068, P19 269 c895. Row 303 (#1810, Vikunja 589, brief ad6ca7930) adds an r.dir guard in R9 only. Queue commit 80793d824 (revs 3464-3473). Row 219: Rocko's second edit 7cbd839d0 (mos-1418, Dewey dewey-0883) restarted and went red at thread-launch C2-09a :489 on a legacy history path. The third edit 5f2ef92e5 (mos-1420, Dewey dewey-0885) reads the native session path. 219 now rebases onto 80793d824, because 294 overlaps its webui files. Correction: the first merged-tree check counted on the 292 drift and found an unrelated transient, and my P19 placeholder sed also rewrote the script's own guard line; the guard refused to post, and I restored the line before posting.
Row 299 (573, #1806, Gander, Filbert): before, the P10 band test timed a fault run minus a separate baseline run, and a loaded whole-suite run went red. Mos approved direct timing from host /proc/uptime stamps with ambient load only (mos-1409). After: rebased onto 80793d824 as ffa93b054 (range-diff 3/3 =, manifest 277ace0b unchanged). Gate 07:26Z-07:50Z: case1 whole 3x 53/0/0, cli whole 917/0/0 (59 files, load 1.54-7.17), P10 inner 2.27 s, outer 4.01 s, M1-M6 killed. M4's planned guard return then exact outer-reason failure counts as its kill (sage-3271, mos-1426). Filbert APPROVE c31084 rev 3485, N1 M1 margin 0.02 s. 299 LANDED ffb2fedfb 08:03Z, done rev 3487, #1806 closed c31087; queue commit 8a35ffadb (revs 3474-3487). Row 303: Duckworth APPROVE c31079 rev 3480 with C1, the whole-file gate. Rows 219 (bfa421b6c) and 295 r2 (b16cef1d0) rebases: Dewey static clean. Corrections: Launchpad and Gander have no token, and the CLI refuses another seat's token file, so I posted both requests as sage (c31082, c31083). My sage-3265 wording led Duckworth to poll queue show into Gander's slot (07:20Z-07:26Z); I ruled it ambient load (sage-3274).
2026-10-23T10:48:40Z | Sage, rows 302, 295 and 219 landings, the Docker pool diagnostic, rows for Vikunja 590 and 591 | Before: refactor 1ac655005. 302 (#1809, Gizmoduck, Dewey) LANDED 3ed9fd754 08:49Z: 7 commits onto 1ac655005, range-diff all =, tree = gated merge 783602e06; queue commit 07802dc57 (revs 3488-3494). Row 219's gate went 11/3 in test-release.sh: release activate's health check failed because Docker could not create sage-diag1437_default, since all predefined address pools were used up. Under mos-1437 I reproduced it on clean 07802dc57 (11/3, the same stderr). I then removed 18 unused gate _default networks, and the rerun went 14/0 with the run-task marker ok. Mos accepted the removal and ruled that a probe that can create something waits for the go and a removal waits for the report (mos-1438). 295 (#1801, Morgana, Dewey) round 2 gate on d68b4300d (manifest e94c9aeb) was green. It LANDED 2efd127ce 10:10Z: 9 commits onto 07802dc57, HEAD~1 tree = gated a86592ffc. Done rev 3502, #1801 c31105, P19 414 c911. 219 (#1720, Rocko, Dewey): the restart on the post-295 merge 054da642f (manifest 4a2271dd, my mos-1439 call) passed node 2523/0/2 and shells 449/0, with 24 mutants killed. It LANDED 5fdfd7275 10:40Z (8 row commits plus packet-only evidence, tree e86a84a85 = gated). Done rev 3509, #1720 c31110, P19 416 c913. Queue commit 90633c864 (revs 3495-3510). Brief docs/plans/2026-10-23_gate-env-rows.md names rows for 590 (claude-session slug) and 591 (compose network cleanup), and DEFERRED.md gets 219 N1 (U6). Row 272 (Huey) conflicts with 5fdfd7275 in code, so it moves back to in-progress for a rebase. Its new fallback is bounded to a session.list access-refused on an omitted-session route (sage-3357). Corrections: my network create probe ran before Mos's go, and the removal ran before the report. My first slot-order line put the diag start at 09:44Z; it was about 09:41Z. My 219 push piped its output through grep, but the after-fetch confirmed origin. Queue commit 90633c864 also carries Huey's rev 3510 (272 back to in-progress), and its message names only 3495-3509.
2026-10-23T11:03:46Z | Gyro Vikunja571 mos-1444 PRD d8 follow-on | Branch gyro/editor-571-d8 from origin/refactor c16e943b9. Both designs now keep library.convert outside ACTIONS/ROUTED and broker processing, retain REQ-WAIT-1/hard-wait test unchanged, constrain unmarked story eligibility to mapped book/playground scope, and add whole-host pre-import restore recovery from remote import manifests plus the Gitea archive commit. Lookups refuse until one current version is proven; VM1012 restore needs Jason present under Q185. W7 no longer owns hard-waits.test.mjs. Canonical queue next gyro returned nothing; direct Mos assignment governs. Static diff, exact replacement and append-only checks pass. No code, tests, build, browser, private-file or live action. Fenton re-check requested after authorized branch push.
2026-10-22 | Huey | Row 272 / 264e (#1777) preparation on huey/row272, base 2d0d407ba. Before: bus session metadata and launcher isolation exist, CLI/Console expose only the saved thread default. Draft: session CLI, Console chooser with isolated drafts/cursors/receipts, metadata counts and safe-clear operation receipts against Gizmoduck's 0260 contracts; narrow deferred B6 reply fence. Tests authored, not run: Gander row 253 holds Sage's slot; no Node, claim, HTTPS git, push or live changes. This entry records preparation after the first draft, not a green acceptance result.
2026-10-22 | Huey | Row 272 draft, 264d additive contract gizmoduck-0272 (78e14352f). Added confirmed cancellation through the human channel, cancelled receipt retirement distinction, named refusals and routed-message cancellation output. Before: cancelled was not recognized as terminal; after: draft CLI stops polling and Console shows the before/after retirement outcome. Acceptance remains unverified: no Node/tests/claim/commit/push under Sage's gate. No runtime/lifecycle authority expanded.
2026-10-23 | Huey | Row 272 / 264e sage-3141 local rebase. Before: uncommitted draft on 2d0d407ba. After: same draft on new huey/row272-b23783f39 at b23783f39, with 270/271 landed (7328da8ca) and schema 3n. Product changes auto-merged; both append-only logs retain the full new base and original Huey additions. Checked landed session.list and clear/cancel/operation envelopes against the wired draft: no incompatible contract change. Historical unavailable-dependency cases stay as stand-ins; actual base supplies counters and lifecycle state. No tests/Node/claim/commit/push while Gander holds row 574 run 2. Existing-test fixture/assertion delta is named in the packet for Mos's ruling via Sage before execution.
2026-10-23 | Huey | Row 272 sage-3145 preservation correction. refs/stash is shared, so it was unsafe as sole draft storage. Pinned exact stash commit 07dc9d2f7944b4781b5e80dfa18425f4749f7a45 to local huey/row272-stash-keep and left the entry untouched. Sage explicitly directed committing the rebased draft before testing to preserve it: an untested local checkpoint, no acceptance claim. No Node/test/queue/network/live action. Separate claims and test CLEARs remain pending; old-test delta is with Mos via sage-3144.
2026-10-23 | Huey | Row 272 early static review follow-up, scrooge-272-early-read-huey-1. Before: a bad-session 404 erased sibling draft/recovery caches, malformed clear/cancel write receipts omitted the audit line, and another session's op key produced an ambiguous error. Draft after: purge only on named thread-level refusals, write one redacted malformed-receipt audit line, and identify key reuse without a write. New browser/HTTP/CLI tests authored, unrun under test hold; approved old-test hunks unchanged. Published 850b22680/round-1 manifest unchanged; follow-up is uncommitted, no acceptance claim.
2026-10-23 | Huey | Row 272 round 2 on row 219 landing 5fdfd7275, after 295. Replayed round 1 and B1/N1/N2; seven conflicts resolved retaining both log histories, both test sets, 219 instance chooser and 295 owner-settings-only transport. Static comparison confirms old tests differ only by mos-1388 approved hunks. Sage3357/Mos1442 authorize bounded granted-user legacy fallback: only session.list access-refused and omitted-session route; no new session grants or owner routing. RED first under3358 on new file only: 1 expected legacy assertion failure, 3 guards pass, 3.504s, TMPDIR mktemp/no underscore, no compose network; slot returned as huey0035. Then implemented fallback and added timeout/bus/malformed guards plus isolated-copy mutant runner, all unrun afterward. Candidate commit/push precedes Sage's full gate by3354; no green claim.
2026-10-23 | Huey | Row 272 round 3 per mos-1455 / sage-3435. Gate run 1 on b44332a93 RED: bus 891/0, business 231/0, CLI 940/1, plugins 110/1, webui 372/20; no mutants. Fixed only new CLI fixture role authority and three null-old render guards. Catching browser tests unchanged. manifest.r3 freezes the same 17 paths. Authorized pre-gate follow-up commit/push; no local tests, Node or queue writes; separate compactions dependency and Sage gate remain pending.
2026-10-23 | Sage (1ef1e4f8) | Row 272 landing (#1777, 264e) | Gate r4 on bea0c8e1c over 1e629c892: bus 891/0, cli 941/0, webui 392/0, business 231/0; plugins 110/1, the single red being row 65 harness.test.mjs:192 naming compactions.mjs, which row 307 owned and fixed. M1-M6 and F1-F4 killed, restore clean. Landed d33989230, queue commit 8dc132bec.
2026-10-23 | Sage (1ef1e4f8) | Row 307 landing (#1814, Vikunja 598) | Six first-parent commits replayed onto 8dc132bec with matching patch-ids, 16 paths equal to 6fdfe3790, manifest digest 17c9f8d9 rebuilt from git. Gate green 14:37:21Z: bus 891/0, cli 941/0, plugins 119/0, webui 392/0, business 231/0, every other package 0 failed 0 skipped, every scripts/test-*.sh passed (skips: test-queue canonical root, test-task live provider x2). M1-M4 killed, restore clean. Landed d243f6b25, DEFERRED 307 N1 0621c439e, queue commit fe4ee8c7b. Correction: my first note said Vikunja 598 done when I had only commented (951); Mos closed it (952).
2026-10-23T17:29:46Z | Gyro Vikunja571 sage-3542 Connections amendment | Branch gyro/editor-connections-design cut exactly from landed PRD1.17 30e6bb680; read REQ-LIB-5 in that PRD. Replaced stale J-b waits in parent and W4. Proposed W8 owns current authorized Markdown/DOCX links/backlinks list, labels, versioned refresh, leakage refusals and fixture tests. Build order under mos-1470/comment961 is W7 closed routing candidate, W8 landing, then W7 human first-real-import opening. No REQ-LIB-8 condition or acceptance change. Q234/mos-1363/S0 M1-M14 and post-10-27/MVP priority fixed. Static diff, twelve brief sections and append-only checks pass. No repo Node, tests, build, browser, queue mutation or live action. Fenton reviews after authorized docs branch push; Sage lands on approval.
2026-10-23T17:32:37Z | Gyro sage-3544 fenton-0016 N1/N2 delta | Before: W7 Gate/final real-conversion list omit the W8 build-order cross-reference and W8 human-view filtering cites agent settings. After: both locations explicitly put W8 landing before human opening as mos-1470 build order, not acceptance; comment/tracked-deletion links are not current story links and never appear in the human Connections view regardless of agent settings. New commit atop approved 5af060fb5, no amend. Static diff and append-only checks pass. Docs only, no repo Node/tests/live action. Fenton checks only this delta.
2026-10-23 | Gladstone | Gitea #1816 / Vikunja 614 hostcheck item 5 and bundle verification | Before: dpkg's correct 750 form falsely fails item 5, and two run-sheet bundle verifies require a missing repository. Draft after: exact root/mosaic/path with octal 0750 equivalence; stat/output unchanged; both verifies use cleaned-up bare scratch repos. Three additive-only test blocks, two planned mutants. Untested under Sage-3738; Sage-3740 authorizes untested branch push for static review. Queue row pending; Sage owns gate and landing.
2026-10-23 | Gladstone | #1816 / Vikunja 614 scope amendment mos-1534, sage-3741 | F1 narrowed to exact 750/0750 and single spaces; F3 allows @ in absolute unit paths with unsafe-character refusals retained; F4 moves copy_tree to / after path resolution. AS_USER audit found git -C and stack-release's existing checkout cd cover the other steps. Added new unit and unreadable-cwd copy tests only. Untested under Sage's no-Node hold; no live action.
2026-10-23 | Gladstone | #1816 / Vikunja 614 F5 draft (mos-1536) | Before: the run sheet omits the explicit notify decision and precheck misses a bus-start refusal. After: section 9a creates a private null-binding decision as mosaic; precheck directly reuses readNotifyConfig and private_dir, and new tests cover accepted and refused decisions. Existing fixture setup additions await Mos approval through Sage; installer unchanged. Untested under no-Node hold.
2026-10-23 | Gladstone | #1816 / Vikunja 614 fixture ruling mos-1537 | Added only three setup lines each to host(t)/world(t) for the explicit null notifier decision. Existing assertions/fakes/lines intact. New install test checks decision bytes/mode preserved and missing decision remains absent. F5 missing-file fault removes the setup file. Untested under Sage's hold; separate follow-up atop 33950cf9b.
2026-10-23 | Gladstone | #1816 / Vikunja 614 F6 and notify parent (mos-1537) | Before: the run sheet's copy check lacks its required CLI wrapper; mkdir -p -m does not guarantee the notify parent mode. After: a separately Mos-gated wrapper --create step follows install and precedes check, as mosaic from cwd /; section 9a explicitly creates both notify directories at 0700. Docs only, no live action; Node/tests still held.
2026-10-23 | Gladstone | Row320 / #1816 first review CHANGES (morgana-0217) | Reviewer run: hostcheck19/19, unit47/47, install24/24, copy17/18; seven of eight mutants killed, M4 survived because both base/mutant failed only cleanup. Fixed this row's F4 test to enter cwd then chmod000, assert no read/search, pass an absolute outside bundle, and restore0700 in finally. Existing tests/setup and production scripts unchanged. Correction untested locally pending Morgana's focused rerun; no acceptance claim.
2026-10-23 | Boyd | Row 298 (#1804, Q228), before implementation completion | Took over Megavolt 7a141269c on boyd/row298 at 45dca69f6 under mos-1496/1502. Approved D1-D6 govern human-only grants.scope.set, empty fallback, in-scope close/evidence and spend recheck. All inherited code UNTESTED; no Node/tests until Sage CLEAR. Plan and static gaps recorded in agents/boyd/work/queue-298/BUILD.md; no live grant or credential access.
2026-10-23 | Boyd | Row 298 (#1804, Q228), targeted verification | On sage-3642 T1 lane B, five whole files serial: business scope 7/0, bus scope 14/0, scope runtime 1/0, CLI scope 4/0, project runtime 3/0 (29/0, no skips). Initial bus fixture typo recorded and corrected. M1-M10 killed by named assertions, source restored and final files green. Dewey dewey-0933 positive control and notes addressed; manifest and evidence in agents/boyd/work/queue-298/BUILD.md. Full package/script gate remains Sage's. No live scope set.
2026-10-23T22:41:07Z | Boyd | Row 298 (#1804), rebase after row 239 | Rebased onto 833ec1cc8d7c11842efb82e57c1a0b256c8d22d7 on boyd/row298-r2 without altering published boyd/row298. Only append-log conflicts; upstream bytes preserved and Boyd suffixes appended. Product merges automatic; row 239 writer-lock revoke and post-revoke error handling preserved, organization.mjs unchanged from new base. Static checks only; UNTESTED on new base pending Sage CLEAR. Details in Boyd BUILD.md.
2026-10-23 | Goldie | Row 322 / #1818 F8/F9 before | The library installer runs the clone importer, whose yaml dependency is absent on fresh clones, and tail -n 1 hides uncaught errors behind Node's version banner. Plan: run the same-commit copy importer, include it in COPY_PATHS, keep the first error line with last-line fallback, append isolated regression coverage. Mos-1550 approves setup-only world(t) additions and the one-path copy-file pin addition. No tests run yet; Sage slot required.
2026-10-23 | Goldie | Row 322 / #1818 F8/F9 after | Importer now runs from the same-commit dependency-equipped copy; COPY_PATHS includes it. One-line refusal selects an actual Error/ERR_ line, avoiding Node's source excerpt/banner, with last-line fallback. Mos-1550-approved fixture setup and one-file pin changes; two append-only regression tests. Under sage-3808 CLEAR, serialized timeout -k 10 runs in /mnt/storage/scratch/tmp/goldieuQ2664: install26/26, copy18/18, pinned-copy10/10; new tests2/2 first run and restored; N installer expected-red2/2, F8 and F9 mutants killed, installer SHA256 restored each time. No unexpected red. Evidence and exact old-test changes in agents/goldie/work/queue-322/BUILD.md; full gate and Morgana review belong to Sage.
2026-10-23 | Goldie | Row 324 / #1820 before (Q247, mos-1555) | New branch goldie/row324 at row298 approved860afc2b6. Design/readers audit in agents/goldie/work/queue-324/BUILD.md: normalize omitted tracker to null, preserve present validation, guard sync readers/adapter config; runtime/instance-settings/broker checks already optional. Existing business.test.mjs98 explicitly requires tracker, so implementation held for Mos approval of removing that one list entry; no old test or product edit, no tests run.
2026-10-23 | Goldie | Row 324 / #1820 draft built (sage-3836, mos-1556) | Claim rev3759. Omitted tracker normalizes null; present including null/malformed stays validated. Loader, business validate, bootConfig trackerFor and Console sync reader handle absence. Row298's guarded runtime/instance-settings/broker paths preserved. Two new test files (9 planned tests); sole old-test edit drops tracker from required-key list under mos-1556. node --check6/6 and diff check pass. No tests run: untested branch push expressly ordered before CLEAR; Duckworth review and Sage gate pending.
2026-10-23 | Goldie | Row 324 / #1820 rebased verification (sage-3850) | Rebased onto3569bf54f as7e59ba8b3; only append-log conflicts, eight manifest files byte-equal. Serialized timeout-k10 scratch TMPDIR goldieOdgIjr: new business5/5, new CLI4/4 (includes Console absent read), existing business21/21; presence mutant killed, bytes restored, new files rerun5/5 and4/4. No unexpected red. Published rebased branch goldie/row324-r2 preserves original remote draft without force-push. Evidence/mutant diff/reader list in BUILD.md; review/full gate pending.
2026-10-23 | Goldie | Row 323 / #1819 before | Case 1 lacks a committed business file. Brief requires actual .53 values and refuses guessing. New branch goldie/row323 from local refactor da537e7d1; source review shows project root, literal human id, tracker sync identity/reference metadata and launch model values absent from DESIGN, plus nonempty launch.instances requires another role. Asked Sage (goldie-0008); no config or test written, no test run. Details agents/goldie/work/queue-323/BUILD.md.
2026-10-23 | Goldie | Row 323 / #1819 static blocker (sage-3823) | Mos-1554 requires no bot and an absent, never-created tracker token path. Static tracing confirms this refuses install validation (business cli84-97, credentials78-83) and bus boot (runtime131/157, bus credentials225-228), even without tracker.baseUrl; unset env also refuses at bus credentials278. Reported Sage goldie-0009; no JSON/test/credential written, no tests. Accepted source values/role and refusal-test rulings are recorded in BUILD.md; waiting for product-boundary resolution.
2026-10-24 | Goldie | Row 323 / #1819 resumed draft (sage-3859) | Rebasing prior notes onto Q247 landing dd6cb5872 resolved only append logs. Added trackerless .53 factory JSON: jason, approved project root, chief+assistant for required nonempty launch.instances, claude-code/Opus5.5/high, tester on. No credentials or token placeholder. Seven new tests prepare exact-doc loading plus scratch real validate/install/boot and three refusal paths; one restoring tester-switch mutant prepared. No old test edits; no tests before Sage CLEAR. Source choices/rulings in BUILD.md.
2026-10-24 | Goldie | Row 323 / #1819 pre-test commit (sage-3861 CLEAR) | Sage explicitly requests commit before runs; JSON/new7-case test/restoring mutant and field provenance committed untested before slot work. Exact sources distinguish mos-1554 human/no-bot intent, sage-3820 roles, sage-3822 project/model, and Q247 tracker omission. No old test edits. Next runs: new file, business whole, CLI whole, mutant/restored file, serialized scratch TMPDIR timeout-k10.
2026-10-24 | Goldie | Row 323 / #1819 first slot STOP (sage-3861) | On committed571376c30: new file7/7 and business261/261 green; whole CLI hit unchanged revoke-window.test.mjs170 (test579, row306 R4), no RESULT after20.1s at ask167/Promise.all194. Stopped suite on observing red, cleaned only positively identified own scratch fixture. Partial631 pass/1 fail before termination, not full-suite green. No mutant/restored run, no old-test edit/rerun. Manifest unchanged; Sage notified goldie-0016 and slot returned. Evidence local under queue-323, awaits ruling.
2026-10-24 | Goldie | Row 323 / #1819 second red STOP (mos-1560, sage-3864) | Isolated revoke-window whole-file run1 on unchanged571376c30 failed0/1 after20.126s, same no RESULT at ask167/test194. Start00:24:22Z, load1.46/1.68/2.70, busyhelperCLEAR, fresh scratch goldieBObDQ9. No run2/3/CLI retry/mutant/restored run; no source/old-test edit. Sage goldie-0018 has log/load/error; slot returned, awaits base-dd6cb5872 root cause. Remote remains unverified571.
2026-10-24 | Goldie | Row 323 / #1819 accepted evidence (mos-1561, sage-3869) | Sage traced revoke-window reds to37-byte TMPDIR making109-byte tools.sock >107 limit (session.mjs278), not Codex. Fresh31-byte /scratch/tmp/XXXXXX confirmation passes1/1 in0.84s. On unchanged571376c30 serialized timeout-k10: business261/261, new7/7, tester-switch mutant killed/restored SHA85e6b9ac, restored new7/7. Every log starts UTC/load/helperCLEAR; all positive runs0 fail/skip/cancel. CLI whole acceptance comes from Sage gate under mos-1561; no local CLI rerun. Evidence-only notes/log commit follows, no old test/source changes.
2026-10-24 | Goldie | Row325 / #1821 before (mos-1563/1564) | Real .mosaic/project.json idstack disagrees with Case1 project's mosaic-stack key; row323 scratch fixture omitted project file and only warned. New goldie/row325 at99930362e changes only that JSON key and expressly authorized old assertion key; new real-byte project-copy validation tests require valid and reject old key. Mutant prepared; no tests before Sage CLEAR, no queue writes/host actions.
2026-10-24 | Goldie | Row325 / #1821 after (sage-3882 CLEAR) | Only Case1 projects key becomesstack; only old test70 expected key updated under mos-1564. New3-case test copies real .mosaic/project.json bytes, requires CLI project valid, rejects old key. Serialized shortTMP timeout-k10: new3/3, business264/264, old-key mutant killed/restored SHA9e43bfef, restored new3/3; all positive0 fail/skip/cancel. Manifest4/4 verifies including unchanged project document. Logs/load lines and mutant diff in BUILD.md; no queue writes/host action, Gladstone review/Sage gate pending.
2026-10-24 — Poe, row 208 / 193d (#1706), before: building Console shared list,
share controls and per-grant viewer read-only against approved design e2d161e2e.
Base ec86f2c84. Isolated tests and UI-guard mutants pending Sage CLEAR; no live action.
2026-10-24 — Poe, row 208 / 193d (#1706), after: Console shared list, share/unshare
controls and live per-grant viewer UI implemented. Webui 418/418 and plugins
119/119 green under sage-3925 CLEAR; four UI guard mutants killed with viewer
bus bypass refusals. Prior old-test draft regression fixed under sage-3918;
missing root oauth4webapi corrected by pinned npm ci under sage-3924. Evidence:
agents/poe/work/queue-208/BUILD.md. Independent reviews and Sage's global gate
remain; no live state, schema or bus policy change.
-13
View File
@@ -27,11 +27,6 @@ not fleet seats. Keep changes in `/mnt/storage/src/mosaic-stack`; do not modify
| Gizmoduck | Federation design (#414) and builder of FED R1 | T3 session (Claude, Opus 5.5, thread 9312a896) | none, T3 only |
| Webby | Reviewer: Case 2 designs, rows 192 and 194 | T3 session (Claude, Opus 5.5, thread 03086006), started by Mos (mos-0981) | none, T3 only |
| Duckworth | Reviewer: federation designs, row 193 | T3 session (Claude, Opus 5.5, thread ffceafec), started by Mos (mos-0977) | none, T3 only |
| Della | Builder, email plan (Vikunja 460) and row 224 (C2-05b) | T3 session (Codex, gpt-6.1-sol, thread 66735a7f), started by Mos | none, T3 only |
| Scrooge | Builder of row 252 and reviewer of row 272 | T3 session (Claude, Opus 5.5, thread 629b6cd3), started by Mos | none, T3 only |
| Huey | Builder, row 272 (T1 sessions) | T3 session (Codex, gpt-6.1-sol, thread cabd45ca), started by Mos | none, T3 only |
| Louie | Builder and research, editor evaluation and row 174 | T3 session (Codex, gpt-6-luna, thread bfd13d49), started by Mos | none, T3 only |
| Ludwig | Builder and reviewer, post-v1 email PRD and row 258 (E01) | T3 session (Claude, Opus 5.5, thread 8615b2a6), started by Mos | none, T3 only |
| Sage | Project lead: coordination, review, integration; earlier DYOR strategy records retained | T3 session (Claude Code); Pi launcher `zai/glm-5.3:high` retained | `agents/sage/launch.sh` |
Each script supports `--check` and `--fresh`. Normal launches resume the agent's
@@ -47,14 +42,6 @@ its launch configuration remains fixed, including on resume. Use Filbert's
wrapper to select that configuration; a direct shared-helper invocation uses
its own supplied flags or the system defaults.
Any run that includes the webui suite, whether a seat's slot run or a landing
gate, sets `MOSAIC_REQUIRE_EDITOR_BUILD=1`, so a missing editor toolchain fails
the run instead of skipping the rebuild test. A worktree that links the
canonical `node_modules` also runs `npm ci --ignore-scripts --no-audit --no-fund`
in its own `packages/webui` first. The root install carries esbuild 0.28.1
through pi-coding-agent, and the rebuild needs the 0.28.2 that
`packages/webui/package-lock.json` pins (Vikunja 597, mos-1453).
All agents follow repository governance and current user direction. Team
leadership does not add deployment or push authority. Coordinate overlapping
work with Sage and preserve other sessions' changes.
-8
View File
@@ -1,8 +0,0 @@
# Beakley
Builder seat, Codex gpt-6.1-sol, started by Mos under Q245 (mos-1506). Owns row 217 (C2-06, handed over from Launchpad).
No launcher in this directory. The seat runs as a T3 thread (thread 88b97f65) and works in its own worktree. It has no
credentials of its own; it pushes only its own `beakley/*` branches through the repository credential helper (mos-0981),
never `refactor`, `main` or another seat's branch. Claude seats orchestrate and review (Q245). Registered by Sage on
2026-10-23 so the queue can name the seat as row owner (store.mjs isSeatDir).
-10
View File
@@ -1,10 +0,0 @@
# Bentina
Builder seat, Codex gpt-6.1-sol, started by Sage under Q246 and mos-1566. Owns row 157, I2: the install images, the
install config key, the endpoint helper and the egress proxy (docs/plans/2026-10-18_containerized-install-rows.md),
reassigned from Researcher so the coding runs on Codex.
No launcher in this directory. The seat runs as a T3 thread and works in its own worktree. It has no credentials of its
own; it pushes only its own `bentina/*` branches through the repository credential helper (mos-0981), never `refactor`,
`main` or another seat's branch. Claude seats orchestrate and review the install path (mos-1542 rule 4). Registered by
Sage on 2026-10-24 so the queue can name the seat as row owner (store.mjs isSeatDir).
-8
View File
@@ -1,8 +0,0 @@
# Boyd
Builder seat, Codex gpt-6.1-sol, started by Mos under Q245 (mos-1506). Owns row 298 (the chief-of-staff grant scope, handed over from Megavolt).
No launcher in this directory. The seat runs as a T3 thread (thread 48a3ae38) and works in its own worktree. It has no
credentials of its own; it pushes only its own `boyd/*` branches through the repository credential helper (mos-0981),
never `refactor`, `main` or another seat's branch. Claude seats orchestrate and review (Q245). Registered by Sage on
2026-10-23 so the queue can name the seat as row owner (store.mjs isSeatDir).
-272
View File
@@ -1,272 +0,0 @@
# Row 298 (#1804, Q228): chief-of-staff grant scope
Owner Boyd (48a3ae38), reviewer Dewey. Branch `boyd/row298`, base `45dca69f6`.
Assignment: mos-1496/Q245. Handoff: Megavolt megavolt-0203, local `7a141269c`;
cherry-picked as `4de3cec27` (design) and `7cea739de` (UNTESTED code).
Brief: `docs/plans/2026-10-23_mvp-readiness-rows.md`, chief-of-staff grant scope.
Megavolt's original design remains in `agents/megavolt/work/queue-298/BUILD.md`.
## Authority and accepted design
Sage sage-3594, restated in sage-3612: launch.grantScope, lenient read with empty
fallback, strict human-only write. No general organization setter may write it.
Per-method agents/projects or agents/hosts/commands; host-enroll never in scope.
Host command arrays match whole tokens and exact lengths. `grants.scope.set`
from the human CLI is Approve; no Console page or chief-raised scope change.
Mos mos-1496/1502 requires the same human-shell guard as `mosaic access`.
The broker closes an in-scope request via scope and writes grant.scope.used;
missing evidence must refuse execution. Narrowing before spend fails
scope-changed. Empty scope ships; only Jason sets the live value (Q188).
No credential files read, no live grants, no deployment, no queue writes. Push
only boyd/*, additive commits, no amend/force-push or attribution trailers.
Sage owns queue, shared test slot and landing. No Node/tests before CLEAR.
## Implementation plan and ledger
Using writing-plans and executing-plans inline; the approved brief and D1-D6
are the spec. This packet is the requested plan/tracking location.
- [x] Read brief, roster, implementation and handoff; register session.
- [x] Bring Megavolt's two commits onto Boyd's branch without changing history.
- [x] Add independent CLI tests in `packages/cli/tests/grants-scope.test.mjs`:
scope read/set requests; agent-marker rejection before stdin/transport;
--tester rejection; missing revision, malformed/empty/oversize input.
- [x] Strengthen new business/bus grant-scope tests for exact commands,
scope evidence binding, host-enroll exclusion and spent scope-changed.
- [ ] On Sage CLEAR, observe targeted failures before fixes; fix inherited
implementation using the existing human proof and grant executors.
- [ ] Update bus/CLI docs, append BUILD-LOG before/after evidence, manifest.
- [ ] On Sage CLEAR run touched suites; record exact results and mutants.
- [ ] Commit UNTESTED until verified; push boyd/row298 only when slot permits;
report to Sage and Dewey, cc Mos for pushes/blockers. Dewey reviews manifest.
Pre-flight interfaces: business checkGrantScope/grantScopeOf/grantInScope feed
the instance writer and broker. Runtime supplies a fresh scope from the org
file and routes the human setter to the same organization writer. CLI callFor
supplies refuseInsideAgent and humanTransport. The grant executors consume the
broker's immutable close/evidence. Tests use scratch files/fake Gitea only.
Review focus: exact argv length, stale scope before spend, forged/missing scope
evidence, malformed fallback, and CLI agent ancestry. Tests must cover each.
Static findings before any Boyd Node/test run:
- Handoff introduced commandPrefixes beyond the accepted D2 shape, allowing
trailing args. Remove it; only exact command arrays are authorized.
- scope.used carries a digest without validating it, and no org revision.
Bind evidence to the canonical scope snapshot and grant/close sequence;
preserve historical grants when scope is later changed, recheck at spend.
- Gitea recheck throws inside the spend transaction and rolls back spend on
scope-changed. Preserve spend and log failure for that case (D6).
- The optional giteaStart?. assertion always passes when the API is absent;
use the real runGiteaGrant entry point. Fake Gitea tokens() does exist.
## Existing test changes (mos-1272)
Approved by Mos mos-1510 via Sage sage-3624; edited exactly as approved:
| File | Actual numstat | Reason |
| --- | --- | --- |
| packages/bus/tests/project-runtime.test.mjs | +1 / -1 | Vocabulary import pin adds grantScopeOf and grantInScope. |
Other test work is confined to row 298's new files. No pre-existing CLI tests
will change. Record final numstat here before review.
## Human proof and organization ownership
CLI: `packages/cli/src/cli.mjs` callFor runs refuseInsideAgent before constructing
humanTransport, as `accessCommand` does. The setter takes no --tester flag.
`packages/bus/src/human.mjs` verifyHuman checks the nonce, CLI path and every
ancestor's markers/argv; `bindHuman` and #human in broker.mjs require the
business human, via cli, outsideAgent true. Tests will pin this chain's caller
refusal. The scope receipt records by/via/outsideAgent and old/new sha256.
Org file: `packages/business/src/organization.mjs` regular() requires a regular,
non-symlink file owned by the process uid and not writable by group/other;
write() uses revision checks, locked durable receipts and atomic rename.
The OS owner uid can edit it directly; the agent sandbox does not mount the
user's config (`packages/seat/src/sandbox.mjs`). This is the existing cooperative
human/process boundary, not a hostile same-uid isolation claim.
Chief enrollment: broker instances.set calls #human and #mayHuman before
add/change; credential issue/delete use #requestCredential's human gate.
launch.by is an organization-file setting, excluded from general setters;
only that chief may auto-approve within scope. Additional chief instances
remain on the per-grant human approval path.
## Validation
UNTESTED. No Boyd Node/test run yet; waiting for Sage CLEAR.
M1: bypass in-scope check. M2: bypass invalid-value fallback. M3: remove human
setter guard. M4: drop grant.scope.used. All need named failing tests on gate.
## Session correction
The initial SESSIONS entry labels startup 19:13Z; startup was approximately
19:08Z. Message header timestamps in boyd-0001 through 0004 were estimates;
use T3's receipt timestamps as authoritative. Subsequent reports use date -u.
## Departures from Megavolt 7a141269c (Sage sage-3624)
1. Removed commandPrefixes; host scope commands match exact token arrays only.
2. grantScope callback now supplies one organization read `{value,revision}`.
grant.scope.used includes that revision, canonical scope snapshot and digest;
#approvedGrant validates the digest, shape, method, agent and close sequence.
It uses the immutable snapshot so later narrowing doesn't revoke issued grants.
3. Gitea scope-changed is caught inside the spend transaction and logs a terminal
failure without rolling back its spend. Other recheck failures keep their
existing behavior. Host already catches recheck failures after spending.
Additional handoff corrections: replaced optional nonexistent giteaStart with
runGiteaGrant; added successful host executor/revoke and enrollment-exclusion
coverage; added real runtime writer coverage and independent CLI guard tests.
Sage scheduled push at 19:41Z with MOSAIC_GITEA_CREDENTIAL_FILE unset, then T1
lane B around 19:47Z (after explicit CLEAR), four new files whole and serial,
hard stop 20:00Z. Fethry lane A is disjoint. No test was run early. Production
corrections are marked UNTESTED under that slot mandate; baseline regression
checks against the inherited implementation will run only on CLEAR.
## Candidate preparation (before T1)
The three static corrections, CLI/runtime coverage and docs are prepared but
UNTESTED. `git diff --check` is clean. The approved import-pin edit is exactly
1 addition / 1 deletion. M1-M4 are encoded in mutants.py (not run). No Node,
https git, full suite or webui build has run in Boyd's worktree.
Review package: product/test/documentation files in MANIFEST.sha256, excluding
append-only project logs and the preserved predecessor packet. The manifest
identifies exact bytes for Dewey; each later product change regenerates it and
requires a review delta. Existing tests changed: only project-runtime, 1/1.
## Dewey static review dewey-0933
N1: Added a positive control to the malformed-evidence fixture. A valid event
must pass scope authorization and reach decision-mismatch on the deliberately
absent definition binding; invalid events remain not-authorized. No spend.
N2: Additional named mutants cover spend recheck, exact argv length, Gitea spend
rollback, launch.by eligibility and accepting any evidence row (results below).
N3: At spend only grant scope membership is rechecked, not whether the raising
chief is still launch.by. This implements sage-3594 Q5; changing the launcher
later does not by itself invalidate a pending scope-approved request.
N4: The scope shortcut returns the closed decision view to the chief without
sending a separate close message; documented in the bus verb table.
N5: grant.scope is logged after the organization file commit in a separate bus
transaction. A crash between them leaves durable changes.jsonl as the receipt,
as with other organization writers. The setter does not claim cross-store
atomicity.
## T1 lane B results (sage-3642, 2026-10-23 19:23Z–19:29Z)
TMPDIR: `/mnt/storage/scratch/tmp/boyd298-4bzr6fn7`. Each whole file ran serially
as `timeout -k 10 180 node --test --test-concurrency=1 FILE`, TMPDIR set to that
scratch directory. Final restored candidate results:
| Whole file | Pass | Fail | Skip |
| --- | ---: | ---: | ---: |
| business/tests/grant-scope.test.mjs | 7 | 0 | 0 |
| bus/tests/grant-scope.test.mjs | 14 | 0 | 0 |
| bus/tests/grant-scope-runtime.test.mjs | 1 | 0 | 0 |
| cli/tests/grants-scope.test.mjs | 4 | 0 | 0 |
| bus/tests/project-runtime.test.mjs | 3 | 0 | 0 |
29/0/0 total. `final-1.log` through `final-5.log` hold the final output. The
runtime's reload-needs-restart notice is expected: the fixture's boot document
has fewer credential references than its organization document, as in the
existing instances runtime tests. No credential contents are loaded from the
real user config.
Initial run: business 7/0; bus 13/1 due to Boyd's test typo, an out-of-scope
`opts` reference in the missing-scope assertion. Corrected only that new-test
line, then bus 14/0 and the remaining files green. Dewey N1 positive control
was added and the whole bus file passed again; final rerun above followed all
mutants. No production code changed during this test window.
Mutants: all whole files, serial, with timeout -k 10 and the same TMPDIR.
`mutants.py --sage-clear sage-3642 --logs SCRATCH/review-mutants --deadline
2026-10-23T19:38:00+00:00` restores exact original source after each run.
M1/M2/M3/M4 are brief/Sage mutants; M5–M10 cover review focus and dewey-0933.
Each exited 1 with named assertion failures, no loader/syntax kill.
| Mutant | Change | Pass/fail | Named killer |
| --- | --- | --- | --- |
| M1 | skip raise scope check | 11/3 | bus out-of-scope Gitea waits; empty/bad scope waits; host argv exclusion |
| M2 | skip invalid-value fallback | 5/2 | business missing/bad scope fallback; bad file scope fallback |
| M3 | remove #human from scope verb | 13/1 | bus Q3 caller refusals |
| M4 | drop grant.scope.used write | 9/5 | bus Q4 protected evidence assertion; four executor waits also fail |
| M5 | skip scope digest check | 13/1 | bus Q4 bad evidence: decision-mismatch instead of not-authorized |
| M6 | rethrow narrowing, rolling spend back | 13/1 | bus Q5 Gitea spent assertion |
| M7 | same without length check | 6/1 | business Q2 shorter command prefix exclusion |
| M8 | no-op #scopeRecheck | 12/2 | bus Q5 Gitea and host scope-changed outcomes |
| M9 | remove launch.by check | 13/1 | bus Q6 second chief stays open |
| M10 | accept any matched scope evidence row | 13/1 | bus Q4 bad evidence, with positive control |
Mutation log sha256 (under scratch/review-mutants):
```text
55e9973af5fca0088963e2ca11fd81b2fb46dfead813a577c0e0aad2d6269b68 M1.log
abd1b784eff5ae1333a7b47085d3e199cad6d27a00e2584edf0b62417ad4c888 M2.log
1a56085e548d1e244f0f88fe12a45f77c162375880794f9ef88b241ed3a1704d M3.log
9c120f3f7128488edaf8bfd6d41bae712e69e76da4195a0d4dc0e8336b02038f M4.log
1bba88a3752823454acdaa51abde6aad66fdd5488801b4aceda02a3b42c8123d M5.log
a4ce3cacca9f7ea56b8cdfd503c76173a8e4ff1d8a7ec07032c93f0b51aa60d8 M6.log
acecd5afc93d68d96d713f8a9a2dc08351831a0b7360a13b4e30a572ad4167bf M7.log
fce7fa505ccf4f2d4190bd03c209fd19f1cf2770d3ae1246a3bd03697594019e M8.log
a830a7964890dd04a2dcc7a932a1502f1dea06419a1eae6b91a85f7878dc5681 M9.log
38ce3e7f69f6c6ffe10133397465d52538a930a830f76256a8b9280f8df78e4b M10.log
```
Full touched-package suites and every scripts/test-*.sh remain for Sage's full gate; this CLEAR authorized only the five whole files. Candidate remains
marked Untested for the full gate. No queue row has been changed by Boyd.
## Dewey final delta review (dewey-0935, 2026-10-23 19:31:55Z)
Dewey reviewed 574ece13c..bcd93dc08 with local git only, no Node: CLEAN,
nothing blocks. Verified all 13 manifest entries, exact package-file coverage,
project-runtime 1/1, M5-M10 mutation sites, all ten mutation log hashes and
counts, named assertion kills without loader/syntax errors, final five logs
29/0/0, and N1-N5 coverage. No production code delta in this review range.
Formal Gitea APPROVE on #1804 and queue record wait on the row 291 hold release
and Sage's go. Sage's touched-package and every scripts/test-*.sh gate remains
required. Boyd has released lane B and has no running test processes.
## Rebase after row 239 (sage-3794)
Current branch: `boyd/row298-r2`, rebased from published row 298 tip
`2fc27bce6bfac2debe9703782bf308132c26b393` onto
`833ec1cc8d7c11842efb82e57c1a0b256c8d22d7`, which includes row 239 through
`e0cb1db2c`. Original `boyd/row298` remains intact locally and remotely. A new
Boyd branch carries the rebased candidate so no published history is amended
or force-pushed. This section supersedes the original base/branch header for
current candidate work.
Conflicts: only the first Boyd log append in `BUILD-LOG.md` and
`docs/SESSIONS.md` conflicted while replaying 574ece13c. For each, verified the
old commit's log started with the merge base bytes, then retained the new
base's complete log bytes and appended only Boyd's suffix (434 and 281 bytes
respectively). Later Boyd appends replayed automatically. No prior entries
were removed or rewritten. Five commits replayed; the third/fourth range-diff
entries differ only in append-log context; package-only range-diff is all `=`.
The overlapping product files merged automatically: broker.mjs, runtime.mjs
and instance-settings.mjs had no textual conflicts. Inspected their diff
against the new base: only the existing row 298 scope additions remain.
Preserved row 239's injected writer, fire/delete beforeWrite callback, and
commit() passing beforeWrite into writer.write. There is no pre-lock revoke
call in commit(). `packages/business/src/organization.mjs` is byte-identical
to the new base: beforeWrite still runs inside withLock, after revision and
validation checks; post-revoke errors still carry revoked true. Broker's
row-239 error handling and runtime's lock/revoke wiring remain intact.
Static checks only: package patch range-diff all equal, organization writer
unchanged, diff whitespace clean, refreshed 13-file package manifest verifies.
The only pre-existing row-298 test change remains project-runtime.test.mjs
exactly 1/1 under mos-1510. No test files were changed for this rebase.
UNTESTED on the new base: no Node, tests, mutants, builds or queue writes run.
Earlier 29/0 and M1-M10 results apply to the old base only. Await Sage CLEAR
for whole touched-file reruns; Dewey reviews the new candidate.
Row 321 (#1817) review assignment acknowledged; waiting for Sage's request
and Gladstone's pushed docs-only F7/F10 run-sheet candidate.
@@ -1,13 +0,0 @@
612488b705853e75e6f8952e41552526f4d07dd297d7619d608d434ed75121d6 packages/bus/README.md
63fdf6c048f0994af3551510119eeb294c71f8116702772844214930b827cc56 packages/bus/src/broker.mjs
65425ead353017c99e04f1e0bcc3f85c4ba60054da293badaa0360e681e418dc packages/bus/src/runtime.mjs
e7065db949cacfd4679a1031eebf5cde09ed196ce85612e8400ae563f02a0f18 packages/bus/tests/grant-scope-runtime.test.mjs
4030cf584481a1db12d9e6f744015c48fdebd468335d065ead3e90180858d366 packages/bus/tests/grant-scope.test.mjs
bc432d8d430433b9d84c00883584dc53d4b27afb5e93f739fe3ca28e80f01efa packages/bus/tests/project-runtime.test.mjs
84d6dd15d5ca2926d8f7a34548c70c3e7a3c58e692f0b009414f1af35cb096cc packages/business/src/business.mjs
e3b425f9ad2a0d4e6e0b55bd48827e144015662d95ace4163fe6474e5f98da81 packages/business/src/instance-settings.mjs
fed4177325f65a2b9823a40a9c35c01d60c0520e3ff40b4574c3cf2c29cc096b packages/business/src/vocabulary.mjs
b7f96e45b9ffca2a7ebc18dc446f0adcaac72d3900f098c60157cf6cbf1bfc13 packages/business/tests/grant-scope.test.mjs
60fc267b7f8f9e83eeb0d0207c8abdef68d554f32b08d508e98dbf59b442a366 packages/cli/README.md
b586907ca8f351f60dc19ec2683df75d2d70ddb12955d09fb14560c9d3bed3dc packages/cli/src/grants.mjs
fb7c30b31facd887b03ff02dd6734d48a815978481b33bb21ec48604a51c5ff5 packages/cli/tests/grants-scope.test.mjs
-105
View File
@@ -1,105 +0,0 @@
#!/usr/bin/env python3
"""Row 298 mutants. Run only with Sage's explicit CLEAR in Boyd's slot.
Each mutation is applied to this worktree, runs one whole new test file,
then restores the exact original bytes, including after an interruption.
Logs go to a caller-supplied scratch directory, never the repository root.
"""
import argparse
import datetime
import pathlib
import subprocess
ROOT = pathlib.Path(__file__).resolve().parents[4]
BROKER = ROOT / 'packages/bus/src/broker.mjs'
VOCABULARY = ROOT / 'packages/business/src/vocabulary.mjs'
BUS_TEST = 'packages/bus/tests/grant-scope.test.mjs'
BUSINESS_TEST = 'packages/business/tests/grant-scope.test.mjs'
def replace_once(source, old, new):
if source.count(old) != 1:
raise RuntimeError(f'expected exactly one mutant site, found {source.count(old)}')
return source.replace(old, new, 1)
def mutate(name, source):
if name == 'M1':
return replace_once(source,
'if (!raise?.grant || !grantInScope(scope, raise.grant)) return view;',
'if (!raise?.grant) return view;')
if name == 'M2':
return replace_once(source,
'return scope === null ? { scope: GRANT_SCOPE_EMPTY, fallback: true } : { scope, fallback: false };',
'return { scope: scope ?? value, fallback: false };')
if name == 'M3':
return replace_once(source,
' #grantScopeVerb(s, verb, a) {\n this.#human(s);',
' #grantScopeVerb(s, verb, a) {')
if name == 'M4':
old = """ this.#grantEvent(s.business, {
action: 'grant.scope.used', grantDecision: d.id, decisionSeq: seq, method: raise.grant.method,
agent: raise.grant.agent, scope, revision, scopeSha256: sha256(JSON.stringify(scope)),
}, d.id);"""
return replace_once(source, old, ' // MUTANT: scope evidence omitted.')
if name == 'M5':
return replace_once(source,
"evidence.agent === grant.agent && evidence.scopeSha256 === sha256(JSON.stringify(checked.scope)) &&",
"evidence.agent === grant.agent &&")
if name == 'M6':
start = source.index(" checked = this.#store.transaction(() => {\n const consumed = this.#consumeGrant")
end = source.index('\n } catch (e) {', start)
return source[:start] + " checked = this.#store.transaction(() => this.#giteaRecheck(business, decision, this.#consumeGrant(business, decision, 'gitea')));" + source[end:]
if name == 'M7':
return replace_once(source,
'const same = (a, b) => a.length === b.length && a.every((x, i) => x === b[i]);',
'const same = (a, b) => a.every((x, i) => x === b[i]);')
if name == 'M8':
return replace_once(source,
" if (this.#closed(decision)?.via === 'scope' && !grantInScope(this.#scopeNow(business).scope, g)) fail('scope-changed');",
" // MUTANT: no spend-time scope recheck.")
if name == 'M9':
return replace_once(source,
' if (s.role !== this.#business(s.business).launch?.by) return view;',
' // MUTANT: any chief instance can use scope.')
if name == 'M10':
start = source.index(' const evidence = JSON.parse(row.body);', source.index(' #scopeUsed('))
end = source.index('\n }', start)
return source[:start] + ' return true;' + source[end:]
raise ValueError(name)
def main():
parser = argparse.ArgumentParser(description=__doc__)
parser.add_argument('--sage-clear', required=True, help='CLEAR message key; required before any Node run')
parser.add_argument('--logs', type=pathlib.Path, required=True)
parser.add_argument('--mutant', choices=['M1', 'M2', 'M3', 'M4', 'M5', 'M6', 'M7', 'M8', 'M9', 'M10', 'all'], default='all')
parser.add_argument('--deadline', default='2026-10-23T19:38:00+00:00')
args = parser.parse_args()
deadline = datetime.datetime.fromisoformat(args.deadline)
args.logs.mkdir(parents=True, exist_ok=True)
names = ['M1', 'M2', 'M3', 'M4', 'M5', 'M6', 'M7', 'M8', 'M9', 'M10'] if args.mutant == 'all' else [args.mutant]
for name in names:
remaining = (deadline - datetime.datetime.now(datetime.timezone.utc)).total_seconds()
if remaining <= 15:
raise RuntimeError('Sage slot deadline reached; no new test run')
path, test = (VOCABULARY, BUSINESS_TEST) if name in ['M2', 'M7'] else (BROKER, BUS_TEST)
original = path.read_bytes()
mutated = mutate(name, original.decode())
log = args.logs / f'{name}.log'
try:
path.write_text(mutated)
with log.open('w') as output:
result = subprocess.run(['timeout', '-k', '10', str(int(min(180, remaining - 13))), 'node', '--test', '--test-concurrency=1', test],
cwd=ROOT, stdout=output, stderr=subprocess.STDOUT,
timeout=min(195, remaining - 1), check=False)
print(f'{name}: exit={result.returncode} log={log}', flush=True)
finally:
path.write_bytes(original)
# Exit 1 needs human inspection of the failing test names; errors are not kills.
if result.returncode == 0:
raise RuntimeError(f'{name} survived')
if __name__ == '__main__':
main()
-8
View File
@@ -1,8 +0,0 @@
# Bubba
Builder seat, Codex gpt-6.1-sol, started by Mos under Q245 (mos-1506). Owns row 288 (agent write notices and library revert, handed over from Honker).
No launcher in this directory. The seat runs as a T3 thread (thread 3d6672b5) and works in its own worktree. It has no
credentials of its own; it pushes only its own `bubba/*` branches through the repository credential helper (mos-0981),
never `refactor`, `main` or another seat's branch. Claude seats orchestrate and review (Q245). Registered by Sage on
2026-10-23 so the queue can name the seat as row owner (store.mjs isSeatDir).
-8
View File
@@ -1,8 +0,0 @@
# Della
Builder seat, Codex gpt-6.1-sol, started by Mos for the email plan (Vikunja 460). Owns row 224 (C2-05b) under Q220.
No launcher in this directory. The seat runs as a T3 thread (thread 66735a7f) and works in its own worktree. It has no
credentials of its own; it pushes only its own `della/*` branches through the repository credential helper (mos-0981),
never `refactor`, `main` or another seat's branch. Registered by Sage on 2026-10-22 so the queue can name the seat as
row owner under Q220 (mos-1301).
@@ -1,30 +0,0 @@
# Row 239 round 1 verdict: honker/row239-r4 e0cb1db2c (duckworth-0295)
Request: honker-0206 (in-review round 1, rev 3719). Candidate: e0cb1db2c on refactor 546366f4a.
Method: git reads of local objects only. No node, no tests, no fetch, no queue reads.
## Verdict: APPROVE
- **The replay is exact.** `git range-diff 93694c518..5b8492b0f 546366f4a..0cae2dad5` gives four `=`
lines. None of the 16 manifest paths changed between 93694c518 and 546366f4a, and
`git diff 5b8492b0f 0cae2dad5` over those 16 paths is empty. My r3 read (REBASE-r3-5b8492b0f.md,
duckworth-0292) applies unchanged, and so do the 0165 design approval and the 0168 code approval with
C1 and C2 met.
- **e0cb1db2c is doc only.** It appends 26 lines to agents/honker/work/queue-239/BUILD.md. No test reads
that file.
- **Pins at e0cb1db2c.** All four 64-hex pins in channel-proof.test.mjs match the files' sha256:
human.mjs, human-cli.mjs, transport.mjs and webui bus.mjs (e3f52172…). Upstream changed library
src/index.mjs and business src/index.mjs, and no test or script pins them. The only hit in my grep
is a basename collision (`cli.mjs` matched `human-cli.mjs`).
- **The run, as Honker reported it (sage-3773 CLEAR, on 0cae2dad5. I didn't rerun it):**
- The six touched test files ran whole: 65/65, 0 skipped, no first-run red.
- Mutants M1-M3g: 9/9 killed as assertion failures in their named tests.
- M3f killed T6, which matches my static trace in 0292.
- Every restore matched by sha256, and the tree was clean afterwards.
Running on the replay rather than r3's base was right, because bus runtime.mjs imports library
src/index.mjs and the cli imports business src/index.mjs, and both changed upstream.
- **What remains is Sage's.** The full gate runs on the replay at landing (sage-3730). Sage's call.
## Notes
- None new. 0168 N1 (endsWith access-revoked) stands as recorded.
@@ -1,74 +0,0 @@
# Row 323 round 1 verdict: goldie/row323 6a0f0f4f8 (duckworth-0300)
Request: sage-3865 (early look at draft 571376c30) and sage-3870 (candidate 6a0f0f4f8, base dd6cb5872,
manifest 903ef0225f2f…cda79f). Brief: docs/plans/2026-10-23_case1-business-file-brief.md, section "Brief:
the Case 1 factory business file".
Method: static. Git reads of local objects only. No node, no tests, no fetch, no queue reads.
## Verdict: APPROVE (static), with one condition
- **The manifest matches.** MANIFEST.sha256 hashes to 903ef0225f2f…cda79f, and both of its blobs match at
6a0f0f4f8: the JSON 85e6b9ac… and the test aecd1c0f…. Neither file changed between 571376c30 and
6a0f0f4f8. The rest of that range is BUILD.md, logs, BUILD-LOG and SESSIONS. dd6cb5872 is an ancestor.
No existing test or source file changed.
- **Fields against the brief and the cited rulings:**
- id `mosaic-stack` (DESIGN section 7). `vars.bus.tester` true. There is no `library` key and no
library project.
- human `jason`. I can't read mos-1554 myself, so this rests on Sage's relay in sage-3823. BUILD.md is
explicit that this is the only literal value that comes from mos-1554.
- The project root /srv/mosaic/src/mosaic-stack is under the DESIGN home /srv/mosaic, and the value
comes from sage-3822. It passes the normalized-absolute check at business.mjs:274. A missing project
file there only gives a warning in validate (cli.mjs:73-77), so the path doesn't need to exist at
install.
- Roles are chief (chief-of-staff) and assistant. The assistant is needed because checkLaunch requires
`launch.instances` to be nonempty and to exclude the launcher (business.mjs:186-190). BUILD.md names
that check, as the brief asks. Both arbiters are chief, under sage-3820. launch.by is chief, which
F7 (case1-accept.sh:545-559) reads.
- Claude only. `plugins.harness` is [claude-code] and both roles use harness claude-code. There is no
pi.
- No tracker, no credentials, no library, and no credential value or reference anywhere in the file.
Q247 covers the tracker by omission.
- **The model, provider and effort have sources.**
- The model claude-opus-5-5 is Sage's ruling in sage-3822.
- The provider mapping anthropic/claude-opus-5-5 matches packages/business/README.md:185.
- `thinking: high` is one of the claude-code LEVELS (index.mjs:28) and matches the chief convention at
session-launch.test.mjs:83.
- With no `launch.limits`, there is no ceiling: limitHit (launch.mjs:137-155) checks only the limits
that are defined. That is a valid choice, and N1 records it.
- **The tests read the shipped bytes.**
- DOCUMENT is `REPO/docs/guides/case1-business.mosaic-stack.json`. Case 1 writes those exact bytes,
loads them through loadBusiness, checks the bytes didn't change, and then asserts every field.
- The validate, install, boot and refusal cases copy the document and change only the project root,
under sage-3820. Since an absent root only warns, the copy differs from the shipped file only in a
way validate doesn't refuse.
- The brief's three tests are all there:
- (1) The loader case.
- (2) The real case2-install.sh factory profile with `--business-file`, with only stack-copy stubbed.
- (3) `bus-tester-off`, the literal library key through the final validate (sage-3820), and the
library project through `profile-library-business`.
- The boot case also covers the 324 boundary: bootConfig gives no trackers, credentials.status() is
[], and the reader's credentials are [].
- **The tester-switch mutant is a real kill target.**
- mutant.py asserts that the needle `"bus.tester": true` occurs exactly once, flips only that value,
and restores in a finally block with a byte-equality check.
- The value is asserted at test :66. mutant.log shows `not ok 1`, `false !== true`, `# fail 1`, and the
restored sha256 85e6b9ac… equals the manifest.
- The flip would also make the install case at :95 fail, because the install refuses with
bus-tester-off.
- **The run, as Goldie reported it (sage-3869 CLEAR, 31-byte TMPDIRs, on 571376c30). I didn't rerun it.**
- The new file passed 7/7, the business suite 261/261, and the restored file 7/7 again.
- The mutant was killed.
- The earlier revoke-window red is the tools.sock length limit (session.mjs:278, dda2d07b4). It fails
the same way on the bare base dd6cb5872, so it isn't this row's.
## Condition
- C1. Under mos-1561, the cli suite counts only from Sage's full gate on 6a0f0f4f8. This approval
depends on that gate passing with no new failures.
## Notes
- N1 (doc). `launch` has no `limits`, so the business has no session ceiling. If Mos wants a cap on .53,
it's a later launch-settings edit and doesn't need a new file.
- N2 (doc). An install on .53 with no project file at /srv/mosaic/src/mosaic-stack still passes. It
warns "no project variables" (cli.mjs:76), which the run sheet could mention.
@@ -1,56 +0,0 @@
# Row 324 round 1 verdict: goldie/row324-r2 dbdfcfd52 (duckworth-0298)
Request: sage-3853 (#1820, comment 31469, round 1, rev 3768/3769). Candidate: dbdfcfd52 on refactor
3569bf54f, code commit 7e59ba8b3. Brief: docs/plans/2026-10-23_optional-tracker-brief.md.
Method: static. Git reads of local objects only. No node, no tests, no fetch, no queue reads.
## Verdict: APPROVE (static)
- **The manifest matches.** agents/goldie/work/queue-324/MANIFEST.sha256 hashes to 52874356…2b473d,
the digest Sage gave. All 8 listed blobs match the files at dbdfcfd52.
- **The loader change is narrow.**
- business.mjs:239 drops "tracker" from the required-key loop.
- business.mjs:296 is `Object.hasOwn(document, "tracker") ? checkTracker(document.tracker, file) : null`.
Omission gives `tracker: null`. A present key always goes through checkTracker.
- business.mjs:298 guards the role tracker comparison on `tracker &&`. An absent business tracker
doesn't waive the role pm tracker check, and the new test covers that.
- **A present null still refuses.** checkTracker (business.mjs:85) calls requireObject first, so a
present null, false, [] or a non-object refuses. {} and {sync:{}} refuse further in. The new
refusal test covers each of them.
- **Every business.tracker reader handles absence.** I read each hit in Goldie's reader-audit.txt and
the two outside it in scripts:
- bus runtime.mjs:131 registers `<business>/@sync` only under `b.tracker?.sync?.credentials`. An
absent tracker registers nothing.
- bus runtime.mjs:247 hashes `b.tracker?.sync ?? null`.
- broker.mjs:6242 reads `b.tracker?.sync?.bot`. Broker 3969 and 4497 read the role-level tracker
only.
- cli.mjs:85 and webui reads.mjs:166 use `tracker?.sync?.credentials ?? {}`. The
`b.tracker.sync.bot` inside the reads.mjs loop runs only when there are entries.
- cli config.mjs:58 trackerFor returns null on an absent tracker before the vars check. bootConfig
(config.mjs:138-139) sets config.trackers only for a non-null result.
- tasks/adapter.mjs loads only for configured trackers (process.mjs:136), and its settings refuse
with tracker-config at :25 before the :35 and :81 reads.
- instance-settings.mjs:127 reads `old.tracker?.sync`.
- stack-release.sh:2074 and :2120 use `b.tracker?.sync?.credentials`.
- launch-settings, resolve, instances.mjs and public/bus.js:785 read role-level trackers only.
conversation/controller exec.tracker is a different object.
- **Writers don't serialize the loader's null.** The setters build `next` from the raw file bytes
(organization.mjs:88-93), not from the loaded object, and validate before writing
(organization.mjs:201, :208). A business file without a tracker stays without one.
- **The brief's tests are there.**
- business/tests/optional-tracker.test.mjs has 5 tests: omission loads null, CLI validate with the
sync file gone, a present tracker preserved and frozen, the refusal set, and the role pm check.
- cli/tests/optional-tracker.test.mjs has 4 tests: no trackers from bootConfig with tracker vars
set, startBroker with no @sync credential, businessView with no credentials, and a present
tracker with a missing token refusing credential-file.
- The existing-tracker case runs through business.test.mjs unchanged apart from :98.
- **The one old-test edit is in bounds.** business.test.mjs:98 drops "tracker" from the
required-key loop, as mos-1556 allows.
- **The run, as Goldie reported it (sage-3850 CLEAR, I didn't rerun it):** 5/5, 4/4 and
business.test 21/21. The presence mutant at business.mjs:296 is killed, and the restore matched
sha256 e76db421.
## Notes
- N1 (doc). The 'undefined' refusal case only exists in memory. A JSON file can't carry undefined,
so on disk it is the same as omission. The test is still correct.
-8
View File
@@ -1,8 +0,0 @@
# Fethry
Builder seat, Codex gpt-6.1-sol, started by Mos under Q245 (mos-1506). Owns row 225 (C2-10b, handed over from Morgana).
No launcher in this directory. The seat runs as a T3 thread (thread 14f80e3c) and works in its own worktree. It has no
credentials of its own; it pushes only its own `fethry/*` branches through the repository credential helper (mos-0981),
never `refactor`, `main` or another seat's branch. Claude seats orchestrate and review (Q245). Registered by Sage on
2026-10-23 so the queue can name the seat as row owner (store.mjs isSeatDir).
@@ -1,7 +0,0 @@
{
"base": "01983cd3f",
"test": "packages/cli/tests/stack-release.test.mjs",
"base_is_byte_exact_prefix": true,
"old_assertions_changed": 0,
"old_console_refusal_text_unchanged": true
}
@@ -1,48 +0,0 @@
# Target config validation for every key implementation plan
Goal: #1797, mos-1353, brief f0e3dcdf4:docs/plans/2026-10-22_config-checks-any-key-brief.md. Base01983cd3f, branchgander/config-checks-any-key. Reviewer Duckworth. Queue number pending Sage; packet moves to queue-N when assigned. No Node, test or push before Sage gap/CLEAR. Rows270/271/203 land first; rebase under a new branch name before the gate.
Architecture: config_checks classifies missing/parseable/unreadable config independently of console presence. With a loader, every existing parseable config goes through the target's own validate. Missing config passes. Malformed JSON refuses. With no loader, allow only the oldest four top-level keys: configVersion, environment, dataRoot, execution. Evidence: c3d29e796:scripts/mosaic-config.mjs:114, the first loader commit, rejectUnknownKeys; row200 fixture's LOADER_OLD has the same list. A missing loader plus a later key refuses and names that key, without inventing validation support. The legacy public refusal code config-console-key and existing console-specific message stay byte-identical; new non-console refusals name the loader's first diagnostic and preserve restore-config-backup instruction. The target loader's resolved stdout is discarded. Its first stderr diagnostic is reported and may echo an invalid value.
Files: scripts/stack-release.sh config_checks/comment only; packages/cli/tests/stack-release.test.mjs appended regression coverage only; docs/TOOLS.md broadens the current console-only release-check description. Existing row200 tests and assertions stay unchanged. No fixture-module edit, flags, pointers, migration, schema, data, live unit or host change.
Tests to write before implementation, unrun until CLEAR:
- A target loader rejecting a non-console key refuses activate and rollback before any unit stop/start, pointer/unit/store mutation; one refused log entry; --plan preserves state and lists refusal. Reuse refused() and planOnly(). Use execution, already known to the current loader, to prove console-free dispatch before row270 integration; add compactionReadBytes/compactionStreams cases on final post270 base if needed.
- An accepting target loader is actually called with validate and the selected MOSAIC_CONFIG, succeeds activate/rollback without console, and resolved stdout is not leaked.
- Missing-loader target permits oldest-key config but rejects a later key with backup instruction. A stand-in rejecting the existing execution key exercises the generic target-validation branch; missing-loader later-key test may use console until final post270 base supplies non-console new keys.
- Missing file passes the isolated real config_checks function; malformed JSON refuses there, since load_config otherwise exits before this function. Tests extract only that function and provide copies/path/check_refuse stand-ins, never live state.
- Existing console-key row200 tests and malformed-load test run whole unchanged.
Mutants, each unique target, syntax preflight and byte-identical restore:
M1 restores the console-only skip, killed by the named non-console activate/rollback refusal test.
M2 ignores failed target validation, killed by the same refusal assertions.
M3 allows a missing-loader target with a later key, killed by the explicit missing-loader regression.
M4 treats malformed JSON as absence, killed by isolated parse guard test.
M5 skips the loader for an oldest-key config, killed by accepting-loader invocation witness.
Gate after static review and required rebases: intended RED/GREEN; touched stack-release.test.mjs whole, CLI suite whole and every scripts/test-*.sh whole; M1-M5 with fresh passing controls, no timeout counted as kill, restored bytes/status before next. TMPDIR mktemp-d /mnt/storage/scratch/tmp/gXXX; pipefail/tee and busy check before each start. Node timeout-k10 uses at least3x measured duration plus margin; stack-release prior full receipt around584s implies at least1871s, to be recorded from actual receipts before CLEAR. Shell3x table retained with receipts. No test ran and no behavior passes claimed.
Review focus: parser races after load_config; target stderr naming only the refused key, stdout never persisted; current versus target loader selection; unknown key with no console; missing loader compatibility set from immutable history; upcoming row270 loader-list fixture drift. Final integration audits every test dependency and hash pin against the named base. Session registration remains Sage's.
Implementation ready, unrun. Four appended tests cover full activate/rollback refusal and plan; actual accepting validate witness/configpath and stdout nonleak; oldest-only missing loader with both compaction keys; missing/invalid JSON isolated realfunction. Stand-in loaders are ESM, matching .mjs. Every old test byte is preserved as a prefix. Existing console refusal text including missing-loader diagnostic is unchanged. Missing-loader compatibility is top-level key compatibility only; current load_config still validates the whole config before normal release operations. Three-path manifest, no fixture-module changes. Static target uniqueness M1-M5 passes. No Node parse, Bash execution or behavior run. Exact full compaction activate/rollback cases must be added against post270 loader, before final gate.
Execution state:
- [x] Read brief, config_checks and row200 assertions.
- [x] Pin oldest key set from immutable loader history.
- [x] Write regression tests, implement bounded scope, prepare unique mutants.
- [ ] Duckworth static review.
- [ ] Move packet to queue-N on assignment, rebase after270/271/203 and add full compaction-key cases.
- [ ] On CLEAR run intendedRED/GREEN, touched whole file, CLI whole, M1-M5, ten shells; commit/push records only when authorized.
## Duckworth0229 static approval, gate conditions
Source0585b3213, packet e7371025f, manifestd6226d28 approved by static read, note a5a717391:agents/duckworth/work/row1797/ROUND1-0585b3213.md. No runtime proof yet.
C1: after270/271/203 land, rebase under a new branch name and open a new static round. Add exact compactionReadBytes and compactionStreams full activate/rollback refusals. The existing LOADER_OLD uses the current loader plus concat after270, so it is not a pre270 witness; the new test requires its own pre270 stand-in. Reviewer checks the integrated manifest/test before CLEAR. N3 joins that delta: compactionStreams fixture value1024, matching the real type, instead of ['messages'].
C2: every existing B/C1/C release now validates its copied real loader, including external/upgrade suites. Any old CLI red is a change-related suspect and goes to Mos/Sage under mos-1272; no automatic placement as an unrelated fixture.
N1 console plus another refused key retains the old console text by design. N2 missing-loader wording is retained pending final integration review. N4 corrected above: only resolved stdout is suppressed; first stderr may echo a value, so no blanket secrecy claim. No runtime/Node/queue/push authorization is inferred from static approval.
@@ -1,3 +0,0 @@
eea06caad07c746d194f793603052b210e437b7184009f8b1617c88db49a5517 docs/TOOLS.md
a35c49c5703e02f35073450e4a98e1b90cffcda581490f97a70cbdc6d2afee59 packages/cli/tests/stack-release.test.mjs
f8fe1348796d40a096362fb0c6d5072c15ca68ff8fe10384a3eaa708eb92c150 scripts/stack-release.sh
@@ -1,9 +0,0 @@
{
"reviewer": "duckworth",
"verdict": "static approve, conditions C1-C2",
"message": "duckworth-0229",
"source": "0585b3213",
"manifest": "d6226d28",
"note": "a5a717391:agents/duckworth/work/row1797/ROUND1-0585b3213.md",
"next": "wait for row number and post270/271/203 base, new integration static round before gate"
}
@@ -1,5 +0,0 @@
{
"docs/TOOLS.md": "eea06caad07c746d194f793603052b210e437b7184009f8b1617c88db49a5517",
"packages/cli/tests/stack-release.test.mjs": "a35c49c5703e02f35073450e4a98e1b90cffcda581490f97a70cbdc6d2afee59",
"scripts/stack-release.sh": "f8fe1348796d40a096362fb0c6d5072c15ca68ff8fe10384a3eaa708eb92c150"
}
@@ -1,14 +0,0 @@
{
"issue": 1797,
"row": "pending Sage assignment",
"branch": "gander/config-checks-any-key",
"base": "01983cd3f",
"source": "0585b321309e4d8a199afb1a1024cf6091f56770",
"manifest": "d6226d281c778677a45e90993bbd9c985de89ba0f870d4a3ca12b6923a497e4a",
"runtime": "NOT RUN; no Node, tests or push authorized",
"after": [
270,
271,
203
]
}
@@ -1,32 +0,0 @@
[
{
"id": "M1",
"occurrences": 1,
"before": "f8fe1348796d40a096362fb0c6d5072c15ca68ff8fe10384a3eaa708eb92c150",
"after": "804a86442527f2728f633f485eaeca02552df66a34350eac5101127046415188"
},
{
"id": "M2",
"occurrences": 1,
"before": "f8fe1348796d40a096362fb0c6d5072c15ca68ff8fe10384a3eaa708eb92c150",
"after": "1c2acb6397e29ab898d8a89bc5bc691a294be749ca7d7f7897c83ec1b3e9f9ef"
},
{
"id": "M3",
"occurrences": 1,
"before": "f8fe1348796d40a096362fb0c6d5072c15ca68ff8fe10384a3eaa708eb92c150",
"after": "954c9a9735904e1c566d844001b2e85c13cd16eb16e7b4b91b752974bb6dc754"
},
{
"id": "M4",
"occurrences": 1,
"before": "f8fe1348796d40a096362fb0c6d5072c15ca68ff8fe10384a3eaa708eb92c150",
"after": "953d91bf28073b11e4bc5a6da516a0db1b8dfff892083cd3e6fcebe9c47b6bbf"
},
{
"id": "M5",
"occurrences": 1,
"before": "f8fe1348796d40a096362fb0c6d5072c15ca68ff8fe10384a3eaa708eb92c150",
"after": "310c32b16f0fc554d5a7ffeeb0742ea7dd9fc84e1ddafabb25d7ca3f449865ef"
}
]
@@ -1,37 +0,0 @@
[
{
"id": "M1",
"file": "scripts/stack-release.sh",
"old": " [ \"$key\" != 1 ] || return 0\n if [ \"$key\" != 0 ]; then",
"new": " [ \"$key\" != 1 ] || return 0\n [ \"$extra\" = '\"console\"' ] || return 0\n if [ \"$key\" != 0 ]; then",
"killer": "config-any-key: a non-console target refusal"
},
{
"id": "M2",
"file": "scripts/stack-release.sh",
"old": "elif out=\"$(MOSAIC_CONFIG=\"$cfg\" node \"$loader\" validate 2>&1 >/dev/null)\"; then return 0",
"new": "elif out=\"$(MOSAIC_CONFIG=\"$cfg\" node \"$loader\" validate 2>&1 >/dev/null)\" || true; then return 0",
"killer": "config-any-key: a non-console target refusal"
},
{
"id": "M3",
"file": "scripts/stack-release.sh",
"old": " [ -n \"$extra\" ] || return 0",
"new": " return 0 # drop missing-loader later-key refusal",
"killer": "config-any-key: missing-loader copies"
},
{
"id": "M4",
"file": "scripts/stack-release.sh",
"old": " if [ \"$key\" != 0 ]; then\n check_refuse config-console-key",
"new": " if [ \"$key\" = 99 ]; then\n check_refuse config-console-key",
"killer": "config-any-key: missing config passes but malformed JSON refuses"
},
{
"id": "M5",
"file": "scripts/stack-release.sh",
"old": " if [ ! -f \"$loader\" ]; then",
"new": " [ -n \"$extra\" ] || return 0\n if [ ! -f \"$loader\" ]; then",
"killer": "config-any-key: accepting loaders run validate"
}
]
-93
View File
@@ -218,96 +218,3 @@ SHELL-LIMITS.json now includes fresh278 run3 receipts. Same ceil(3*longest)+120
| scripts/test-queue.sh | 23.443742 | 191 |
| scripts/test-release.sh | 12.168674 | 157 |
| scripts/test-task.sh | 36.783798 | 231 |
## Post264a integration, sage-2698, no runs
New gander/row253-264a rebases eleven commits onto84f53540d without conflicts; every pair and patch-id equals the385a branch. Rebased sourceb9d3d4c75c78aa6b06aefd734da781bef9b7f1da. Only DEFERRED absorbs upstream changes; seven-path manifest735fa2d7405d01ace8eb7aab366753fa5b1877cf8044b0151cb2113a0502bc1f. All runnable253 blobs unchanged. Store now loads schema3l and3k-3l migration from the landed base. integration-264a/ records the exact upstream drift and27 whole runnable test-file union (upstream-changed tests plus own focused files). Shared fixture is covered by importers. No carried result. Ask Sage for focused CLEAR, then publish after those whole files pass, then Duckworth rebase read, then whole gate on another CLEAR. N9 exact sandbox skip reason must be copied from the case2 log. No execution or push ran during integration.
## Corrected docs base, sage-2700/2702, no runs
New gander/row253-b789 rebases ontob78918850. Sourcec75c9bbd3339cb2343467715a14455044c2e4aea. Only append conflicts in BUILD-LOG and DEFERRED: current base remains exact byte prefix,253 entries appended. No old entry edited or removed. Manifest573c51cf72f2398532a6ea768536f04e3c1681997cb8b9a6f14a8aef884870ae. Five runnable blobs and README match preceding candidate; only DEFERRED hash changes.27-file whole union unchanged, no result carries. Hold branch local: final Gizmoduck docs tip must land first, then rebase/publish and focused CLEAR. No tests/Node/push. integration-b789/ records the resolution and hashes.
## Final base aca16404c, sage-2705, before execution
New gander/row253-aca1 rebases13 commits ontoaca16404c without conflicts; all13 final-hop pairs equal. Sourceed3bb376cdd5128dc58b3aa193282e1c2bfcf57d. Seven blobs unchanged, manifest573c51cf72f2398532a6ea768536f04e3c1681997cb8b9a6f14a8aef884870ae. Both append paths retain the full base prefix. Final upstream docs/queue changes touch no focused read.27-file union remains unchanged.
Step2 file bounds: every file listed in integration-aca1/FILE-LIMITS.json runs whole as timeout -k10 300 node --test --test-reporter=tap FILE, outer harness330s. Own case1/case2 first, then25 others. Busy check before each start, pipefail and tee, TMPDIR from mktemp-d /mnt/storage/scratch/tmp/gXXXXXX. First unexpected failure or timeout stops to Sage/Mos unplaced; no retry. Print HEAD and manifest digest first. No test has run. Expect10-15min; status at15min. Whole-suite limits are separate and will be written before whole-gate CLEAR.
Whole-shell limits remain as in the earlier table and SHELL-LIMITS.json:auth126,conductor145,config130,discord147,extension130,foundation240,land-work158,queue191,release157,task231. Each is at least3x its longest recorded successful whole run. No script changed.
## Focused27 green under sage-2709
Fresh candidate0604d91fc onaca16404c, manifest573c51cf. HEAD and digest are the first controller-log line, followed by the full900s CLI/300s bus-WebUI limit header before any test. Actual run14:30:03Z to2026-10-22T14:44:57Z, 894.0 wall seconds. All27 files whole604/0/0, timeout0, no retry or busy refusal. Commands use timeout-k10 per file, pipefail/tee and scratch gXXXXXX TMPDIR. No product/test/assertion changed. Entire seven-path manifest verifies after the run.
N9 did not skip. Verbatim case2 result: `ok 43 - inside a session's sandbox a bind below 1024 fails with EACCES, and a bind on a free high port succeeds`. There are no skip lines in any focused file. Later wholeWebUI and shell skips are not measured by this focused scope.
Every measured file duration and its later3x basis follows. The last column is ceil(3*measured whole-file wall)+120, not a completed whole-gate result. Historical C4 gates carry nothing. The whole gate still awaits separate CLEAR and Duckworth rebase review.
# Focused27 whole-file results
| Whole file | Pass/fail/skip | Wall seconds | Command limit seconds | Next3x plus120 basis |
|---|---:|---:|---:|---:|
| packages/cli/tests/case1-accept.test.mjs | 34/0/0 | 99.281 | 900 | 418 |
| packages/cli/tests/case2-unit.test.mjs | 43/0/0 | 66.418 | 900 | 320 |
| packages/bus/tests/account-migration.test.mjs | 3/0/0 | 0.415 | 300 | 122 |
| packages/bus/tests/chief-of-staff.test.mjs | 42/0/0 | 2.168 | 300 | 127 |
| packages/bus/tests/comment-migration.test.mjs | 5/0/0 | 0.565 | 300 | 122 |
| packages/bus/tests/end-launch.test.mjs | 7/0/0 | 0.415 | 300 | 122 |
| packages/bus/tests/fire-revokes-grants.test.mjs | 22/0/0 | 3.271 | 300 | 130 |
| packages/bus/tests/gitea-grant.test.mjs | 49/0/0 | 8.634 | 300 | 146 |
| packages/bus/tests/gitea-migration.test.mjs | 5/0/0 | 0.415 | 300 | 122 |
| packages/bus/tests/grant-executor.test.mjs | 42/0/0 | 21.562 | 300 | 185 |
| packages/bus/tests/grant-migration.test.mjs | 6/0/0 | 0.465 | 300 | 122 |
| packages/bus/tests/lifecycle-revoke.test.mjs | 8/0/0 | 0.665 | 300 | 122 |
| packages/bus/tests/message-filter.test.mjs | 6/0/0 | 0.515 | 300 | 122 |
| packages/bus/tests/name-migration.test.mjs | 1/0/0 | 0.214 | 300 | 121 |
| packages/bus/tests/schema.test.mjs | 1/0/0 | 0.214 | 300 | 121 |
| packages/bus/tests/sessions.test.mjs | 7/0/0 | 0.615 | 300 | 122 |
| packages/bus/tests/spec-migration.test.mjs | 1/0/0 | 0.214 | 300 | 121 |
| packages/bus/tests/tester-writes.test.mjs | 8/0/0 | 0.565 | 300 | 122 |
| packages/bus/tests/thread-claims.test.mjs | 6/0/0 | 0.264 | 300 | 121 |
| packages/bus/tests/thread-migration.test.mjs | 3/0/0 | 0.365 | 300 | 122 |
| packages/bus/tests/threads.test.mjs | 17/0/0 | 1.216 | 300 | 124 |
| packages/bus/tests/usage-migration.test.mjs | 1/0/0 | 0.214 | 300 | 121 |
| packages/cli/tests/lifecycle.test.mjs | 24/0/0 | 13.296 | 900 | 160 |
| packages/cli/tests/stack-release.test.mjs | 218/0/0 | 583.453 | 900 | 1871 |
| packages/cli/tests/thread-cli.test.mjs | 11/0/0 | 1.876 | 900 | 126 |
| packages/cli/tests/thread-launch.test.mjs | 11/0/0 | 16.603 | 900 | 170 |
| packages/webui/tests/chat.test.mjs | 23/0/0 | 0.515 | 300 | 122 |
N9 verbatim: ok 43 - inside a session's sandbox a bind below 1024 fails with EACCES, and a bind on a free high port succeeds
Sweep0 run-created leftovers. Initial broad sweep found nine current MCP/npm/code-mode infrastructure processes, all started14:20:57-14:21:07Z before this run14:30:03Z. UTC ps and /proc start ticks are retained; initial output saved, no signalling. Deleted cwd under run TMPDIR is included. No old-PID assumption replaces the receipt check.
Sage2711/2714 reported unrelated queue reads/write and Python reads by other seats. First and subsequent busy checks passed; no retry was needed and no effect is attributed to those processes. No live data was read by this seat. Raw command/log paths and all27 totals live in run3-focused/files/results.json and SUMMARY.json. Return slot after the record publication; no whole suite or M1-M40 batch starts here.
## Whole gate2737/2739, before execution
HEAD34401e7c9, product0604d91fc, manifest573c51cf. Outside agents/gander the record-tip diff is only BUILD-LOG.md, skipped by gate-lane-auth SKIP_COPY per Sage2739. Full lists/counts are printed in run3-gate/HEADER.json before first test. Serial CLI whole55 files,WebUI whole58 files, plus the20 bus files in the rebase union (subset coverage, not a bus-whole claim). Every Node call including RED/controls/changes is timeout-k10 with its killer/whole file measured bound, or900 for an unmeasured file, outerwait+30. WHOLE-GATE-LIMITS.json pins this. The two touched case files also run whole after intended REDs. M1-M40 then serial package/union files and10 shells; every mutation restores exact bytes/status before next. Shell table unchanged. First unexpected pre-existing red/product suspect/loosened assertion/timeout/second red stops unplaced. First-run own new-test red may be placed under2737, but no automatic loosening. No whole-gate test run yet.
## Whole gate2737 stopped unplaced atM21
Run started14:59:22Z. Two intendedREDs observed, exact restoration. Touched whole case243/0/0 in66.112s; case134/0/0 in93.721s. N9 ran and passed. M1-M20 killed;M21survived1/0 in8.581s against8.532s base.9controls passed,0timeouts. M22-M40 and all full-package/union/shell stages NOTRUN. Driver restored bytes/status; all7manifest checks pass, packages/scripts diff empty. Sweep0run-created leftovers. Stopped and returned slot as0106 before any retry/edit.
M21 drops only the peer regex end anchor. peer-malformed already writes a valid three-number prefix plus extra text, but the aggregate passingTAP does not expose the returnedreason. No loggedP10line can be quoted fromM21 orM17-base. Static trace shows onlyP10peerprobe executes PYTHON_STUB; configandearlierchecks useNode/shell, while tester_python reads metadata/ELF only. See run3-gate/STATIC-TRACE.md.
Mos1293requires a scratch-base diagnostic onSagegap, all17P10lines, then exactdesignreasonassertions. peer-malformed expectsprobe. Unexpecteddesignreason or anyproductchange goes toMosbeforeedits. No diagnostic or repair yet. Newcandidate/manifest/review and entiregatefromstart, no carry. Stop packet committed locally; helperpushwaitsforgap.
## Fixture-only M21 repair, mos1297, not run
Diagnostic(a) on0604 observed probe-inner-session for peer-malformed andpeer-error, not their designed probe/probe-inner-command. Mos confirmed instant shell output exits before session verification; product fails closed. Authorized option1 uses the same system Python exec for peer-output bytes/status; no delay and no product change. Sourcecommit362ec674c9e7aa8cef0c26f4d7448f459171dbd4 names1297 andquotesoldline100.
All17faults now assert exact reason with following space and anchoredP10prefix, from the accepted draft. Every old assertion retained. C4overflow andpeer-hang test bodies are byte-identical; overflow must remain probe-output-limit. Peer-hang looseprefixoutofscope unchanged. STATIC-PRESERVATION.json andREPAIR.diff in repair-1297/.
Seven-path manifesta2ac57342d9c59ddaebddade0fa475a9568719fed50c132bd7bb141167c7e72e; onlycase1testhashchanges. No repaired-source test/syntax/Node execution. Whole gate from start, no carry, after Duckworth review and SageCLEAR. M21survival orwrongmalformed/errorreason goes toMosbeforeanychange. Product fast-exit issue isVikunja532post10-27; SageownsDEFERREDentry.
### mos-1297 fresh gate under sage-2768, stopped
Ran on pushed e1bc766d8, manifest a2ac5734, no carry. Both intendedREDs observed; touched whole43/0/0 and34/0/0,17fresh controls passed. M1-M37 killed including M21 by named P10 assertion; M38 survived (drop setsid, signals killer). M39-M40 and full package/union/shell stages NOTRUN. Wall404.837s,0timeouts,0skips,N9passed. Exact restoration and all7manifest checks pass; sweep0run-created leftovers. Stopped unplaced to Sage/Mos/Duckworth as gander-0116 and returned slot; no repair or rerun. run4-gate/ preserves raw logs,commands,counts and timing.
### mos-1298: pin the direct query session
M38 drops setsid but a blocking signals query can still fail closed with inner-timeout; the old kill rule was wrong. The named killer stays row253 C4 signals query. Every sleep/signals/member case in both exec/hop modes now reads the first query-pids line and asserts exact equality of its numeric PID and kernel SID. M38 must fail this new assertion, never a timeout or a cleanup-only assertion. Every old line of the C4 query test is preserved byte for byte. Product scripts remain byte-identical. No test or Node preflight run; fresh whole gate from start follows new candidate review and Sage CLEAR, with nothing carried. Base assertion failure, another survivor or any mismatch goes to Mos before a further change.
@@ -1,8 +1,8 @@
{
"docs/plans/DEFERRED.md": "f8ad28aa8dc0f12b2c6dddb3b5dc805da05a97c7723e0525905456c064d0cfa3",
"docs/plans/DEFERRED.md": "8a050b494f6678030aabb7a7c92116c58ad6306ab0a27f31b368cff53c9b5d7c",
"packages/cli/tests/case-sudo-fixture.mjs": "b259b8c7926e49829c8a956674021cb0cc85ddd65aebdc786d05cc08d7790008",
"packages/cli/tests/case1-accept.test.mjs": "27378eb1297dc6115b4b1ce849de6ffdb3adccf5249783106fa0570c9d696e8a",
"packages/cli/tests/case2-unit.test.mjs": "9ca67403d8614266061624ab5fbf4ea8e8a54cbd08f5b569c95592ab5ed40472",
"packages/cli/tests/case1-accept.test.mjs": "6cfd2963303315aa6911c4d4f6d75d3ab87d9fcba8e128b056216e7f85fd8901",
"packages/cli/tests/case2-unit.test.mjs": "1e0696eb196e83a0766b433ef71f27df0a3f8fcb6399787ab8c1c0f05c54dc44",
"packages/webui/README.md": "ce9054060867120798c6b26737ac7d910d8cfbc7aa4ad614f4295619c7605e46",
"scripts/case1-accept.sh": "c02bef6b3495e5a4548d7b4e89675ed52be26a0c9ccce4d9d5cfc5fe2ce437bd",
"scripts/case2-unit.sh": "d7670bdb049ae41ba3774fc83de633636859b6723be858cfb31ea106b0e8812b"
-15
View File
@@ -9,18 +9,3 @@ Sage-2335 authorizes the runnable commit before the whole gate. No repaired-sour
Superseding integration under sage-2463: gander/row253-0fa7 on 0fa7bf421. See integration-0fa7/. Only README changed among the seven landing entries, retaining row191 processing-control documentation; the refreshed manifest digest is 24b6a01b2ede6f025ec898fa4ec830bb9585ce6151d6298e713e31c7430a502b. No gate has run.
Superseding integration under sage-2659: gander/row253-385a on385a7194c, source141b79c29, digest72a70e99ba0416ceb1f63ed737132ebbeb212332d1441c362b3dfa6c8b00209c. Only README and DEFERRED hashes change. See integration-385a/ for drift, patch-ids and dependency reads. No gate run;264a schema dependency must be re-checked before CLEAR.
Post264a supersedes the385a preview: gander/row253-264a on84f53540d, rebased sourceb9d3d4c75c78aa6b06aefd734da781bef9b7f1da, manifest735fa2d7405d01ace8eb7aab366753fa5b1877cf8044b0151cb2113a0502bc1f. Only DEFERRED differs from the preview. See integration-264a/ for all11 equal pairs, patch-ids and whole-file union. Focused whole-file runs, publication, rebase review and full gate are pending Sage CLEAR.
Corrected interim integration2700/2702: gander/row253-b789 onb78918850, sourcec75c9bbd3339cb2343467715a14455044c2e4aea, digest573c51cf72f2398532a6ea768536f04e3c1681997cb8b9a6f14a8aef884870ae.27-file scope unchanged. Pending final docs tip, rebase and CLEAR; no gate run.
Final base under sage-2705: gander/row253-aca1 onaca16404c, sourceed3bb376cdd5128dc58b3aa193282e1c2bfcf57d, digest573c51cf unchanged. integration-aca1/ is the final-hop packet. No runs yet.
Focused27 under sage-2709 now passed on0604d91fc:604/0/0, no timeouts, no retries, N9 executed and passed (exact line in run3-focused/SUMMARY.json). All7 blobs unchanged;573c51cf remains the review digest. run3-focused/ contains every raw whole-file log/command, HEAD/digest/limits preamble, timings and3x basis. No full gate or mutation-batch result is claimed.
Whole gate2737 stopped atM21 survivor after20kills. No final acceptance. run3-gate/STOP-SUMMARY.json andSTATIC-TRACE.md preserve the stop. Mos1293requires diagnostic thennewcandidate/review/fullgatefromstart. Current7sourceblobs remain573c51cf; no test/product repair made.
Mos1297 supersedes573c51cf after one fixture-only repair and17exactreasonassertions: source362ec674c9e7aa8cef0c26f4d7448f459171dbd4, digesta2ac57342d9c59ddaebddade0fa475a9568719fed50c132bd7bb141167c7e72e. Onlycase1testchanges. repair-1297/ is the new review packet. Tests unrun; Duckworthreview and fullfreshgatepending.
mos-1298 candidate source 14e46006171ef700a72f971fda5cb3a0b8dcc4f2, seven-path manifest 591020a1096a1606c11f2ee34b37243acddf83d91c69922ccc5cfe22d6180d3a. Only case2-unit.test.mjs changes among manifest paths from e1bc766d8. Pending review and fresh full gate; no carry.
+3 -3
View File
@@ -1,7 +1,7 @@
f8ad28aa8dc0f12b2c6dddb3b5dc805da05a97c7723e0525905456c064d0cfa3 docs/plans/DEFERRED.md
8a050b494f6678030aabb7a7c92116c58ad6306ab0a27f31b368cff53c9b5d7c docs/plans/DEFERRED.md
b259b8c7926e49829c8a956674021cb0cc85ddd65aebdc786d05cc08d7790008 packages/cli/tests/case-sudo-fixture.mjs
27378eb1297dc6115b4b1ce849de6ffdb3adccf5249783106fa0570c9d696e8a packages/cli/tests/case1-accept.test.mjs
9ca67403d8614266061624ab5fbf4ea8e8a54cbd08f5b569c95592ab5ed40472 packages/cli/tests/case2-unit.test.mjs
6cfd2963303315aa6911c4d4f6d75d3ab87d9fcba8e128b056216e7f85fd8901 packages/cli/tests/case1-accept.test.mjs
1e0696eb196e83a0766b433ef71f27df0a3f8fcb6399787ab8c1c0f05c54dc44 packages/cli/tests/case2-unit.test.mjs
ce9054060867120798c6b26737ac7d910d8cfbc7aa4ad614f4295619c7605e46 packages/webui/README.md
c02bef6b3495e5a4548d7b4e89675ed52be26a0c9ccce4d9d5cfc5fe2ce437bd scripts/case1-accept.sh
d7670bdb049ae41ba3774fc83de633636859b6723be858cfb31ea106b0e8812b scripts/case2-unit.sh
@@ -1,142 +0,0 @@
{
"authority": "sage-2737/sage-2739",
"files": {
"packages/cli/tests/access.test.mjs": 900,
"packages/cli/tests/app.test.mjs": 900,
"packages/cli/tests/boot-status.test.mjs": 900,
"packages/cli/tests/case1-accept.test.mjs": 418,
"packages/cli/tests/case1-hostcheck.test.mjs": 900,
"packages/cli/tests/case2-persona-import.test.mjs": 900,
"packages/cli/tests/case2-unit.test.mjs": 320,
"packages/cli/tests/channel-cli.test.mjs": 900,
"packages/cli/tests/channel-recovery.test.mjs": 900,
"packages/cli/tests/cli.test.mjs": 900,
"packages/cli/tests/config.test.mjs": 900,
"packages/cli/tests/credentials.test.mjs": 900,
"packages/cli/tests/follow.test.mjs": 900,
"packages/cli/tests/format.test.mjs": 900,
"packages/cli/tests/gate-lane-auth.test.mjs": 900,
"packages/cli/tests/gate-lane-fixtures.test.mjs": 900,
"packages/cli/tests/gate-lane-image.test.mjs": 900,
"packages/cli/tests/gate-lane-state.test.mjs": 900,
"packages/cli/tests/gate-lane.test.mjs": 900,
"packages/cli/tests/git-socket.test.mjs": 900,
"packages/cli/tests/grants.test.mjs": 900,
"packages/cli/tests/host.test.mjs": 900,
"packages/cli/tests/hosts.test.mjs": 900,
"packages/cli/tests/instances.test.mjs": 900,
"packages/cli/tests/launch-account.test.mjs": 900,
"packages/cli/tests/launch-limit-checks.test.mjs": 900,
"packages/cli/tests/launch-limits.test.mjs": 900,
"packages/cli/tests/launch-routes.test.mjs": 900,
"packages/cli/tests/launcher.test.mjs": 900,
"packages/cli/tests/lifecycle.test.mjs": 160,
"packages/cli/tests/limits-tokens.test.mjs": 900,
"packages/cli/tests/limits.test.mjs": 900,
"packages/cli/tests/mark-read.test.mjs": 900,
"packages/cli/tests/names.test.mjs": 900,
"packages/cli/tests/notifier.test.mjs": 900,
"packages/cli/tests/other-tree.test.mjs": 900,
"packages/cli/tests/processing-cli.test.mjs": 900,
"packages/cli/tests/project-name-repo.test.mjs": 900,
"packages/cli/tests/project.test.mjs": 900,
"packages/cli/tests/publish-socket.test.mjs": 900,
"packages/cli/tests/stack-copy.test.mjs": 900,
"packages/cli/tests/stack-instances.test.mjs": 900,
"packages/cli/tests/stack-release-external.test.mjs": 900,
"packages/cli/tests/stack-release.test.mjs": 1871,
"packages/cli/tests/stack-upgrade.test.mjs": 900,
"packages/cli/tests/tester-http.test.mjs": 900,
"packages/cli/tests/tester-reads.test.mjs": 900,
"packages/cli/tests/tester-threads.test.mjs": 900,
"packages/cli/tests/tester.test.mjs": 900,
"packages/cli/tests/thread-cli.test.mjs": 126,
"packages/cli/tests/thread-launch.test.mjs": 170,
"packages/cli/tests/trackers-boot.test.mjs": 900,
"packages/cli/tests/transport.test.mjs": 900,
"packages/cli/tests/usage.test.mjs": 900,
"packages/cli/tests/verbs.test.mjs": 900,
"packages/webui/tests/agents-browser.test.mjs": 900,
"packages/webui/tests/agents.test.mjs": 900,
"packages/webui/tests/assistant.test.mjs": 900,
"packages/webui/tests/board-held.test.mjs": 900,
"packages/webui/tests/browser-edge.test.mjs": 900,
"packages/webui/tests/browser.test.mjs": 900,
"packages/webui/tests/bus-browser.test.mjs": 900,
"packages/webui/tests/bus.test.mjs": 900,
"packages/webui/tests/channel-chat.test.mjs": 900,
"packages/webui/tests/chat-browser.test.mjs": 900,
"packages/webui/tests/chat.test.mjs": 122,
"packages/webui/tests/conversation.test.mjs": 900,
"packages/webui/tests/discord.test.mjs": 900,
"packages/webui/tests/docs-browser.test.mjs": 900,
"packages/webui/tests/editor-browser.test.mjs": 900,
"packages/webui/tests/editor-provenance.test.mjs": 900,
"packages/webui/tests/editor.test.mjs": 900,
"packages/webui/tests/history-return-flow.test.mjs": 900,
"packages/webui/tests/instances-browser.test.mjs": 900,
"packages/webui/tests/instances.test.mjs": 900,
"packages/webui/tests/library-cli.test.mjs": 900,
"packages/webui/tests/library-status.test.mjs": 900,
"packages/webui/tests/limits-browser.test.mjs": 900,
"packages/webui/tests/limits-route.test.mjs": 900,
"packages/webui/tests/markdown-preview.test.mjs": 900,
"packages/webui/tests/messages.test.mjs": 900,
"packages/webui/tests/pinned-copy.test.mjs": 900,
"packages/webui/tests/preview.test.mjs": 900,
"packages/webui/tests/processing-browser.test.mjs": 900,
"packages/webui/tests/processing-ui.test.mjs": 900,
"packages/webui/tests/processing.test.mjs": 900,
"packages/webui/tests/project-file.test.mjs": 900,
"packages/webui/tests/project-name-repo.test.mjs": 900,
"packages/webui/tests/proof-cli.test.mjs": 900,
"packages/webui/tests/proof.test.mjs": 900,
"packages/webui/tests/reads.test.mjs": 900,
"packages/webui/tests/relaunch.test.mjs": 900,
"packages/webui/tests/return-flow.test.mjs": 900,
"packages/webui/tests/routes-browser.test.mjs": 900,
"packages/webui/tests/routes.test.mjs": 900,
"packages/webui/tests/send-browser.test.mjs": 900,
"packages/webui/tests/send.test.mjs": 900,
"packages/webui/tests/serve.test.mjs": 900,
"packages/webui/tests/service.test.mjs": 900,
"packages/webui/tests/settings-form.test.mjs": 900,
"packages/webui/tests/settings-write.test.mjs": 900,
"packages/webui/tests/shell.test.mjs": 900,
"packages/webui/tests/sso-browser.test.mjs": 900,
"packages/webui/tests/sso.test.mjs": 900,
"packages/webui/tests/tester-browser.test.mjs": 900,
"packages/webui/tests/tester-cli.test.mjs": 900,
"packages/webui/tests/tester-listener.test.mjs": 900,
"packages/webui/tests/tester-socket.test.mjs": 900,
"packages/webui/tests/thread-claims-browser.test.mjs": 900,
"packages/webui/tests/thread-claims.test.mjs": 900,
"packages/webui/tests/usage-browser.test.mjs": 900,
"packages/webui/tests/usage.test.mjs": 900,
"packages/webui/tests/views.test.mjs": 900,
"packages/bus/tests/account-migration.test.mjs": 122,
"packages/bus/tests/chief-of-staff.test.mjs": 127,
"packages/bus/tests/comment-migration.test.mjs": 122,
"packages/bus/tests/end-launch.test.mjs": 122,
"packages/bus/tests/fire-revokes-grants.test.mjs": 130,
"packages/bus/tests/gitea-grant.test.mjs": 146,
"packages/bus/tests/gitea-migration.test.mjs": 122,
"packages/bus/tests/grant-executor.test.mjs": 185,
"packages/bus/tests/grant-migration.test.mjs": 122,
"packages/bus/tests/lifecycle-revoke.test.mjs": 122,
"packages/bus/tests/message-filter.test.mjs": 122,
"packages/bus/tests/name-migration.test.mjs": 121,
"packages/bus/tests/schema.test.mjs": 121,
"packages/bus/tests/sessions.test.mjs": 122,
"packages/bus/tests/spec-migration.test.mjs": 121,
"packages/bus/tests/tester-writes.test.mjs": 122,
"packages/bus/tests/thread-claims.test.mjs": 121,
"packages/bus/tests/thread-migration.test.mjs": 122,
"packages/bus/tests/threads.test.mjs": 124,
"packages/bus/tests/usage-migration.test.mjs": 121
},
"fallback_seconds": 900,
"kill_after_seconds": 10,
"outer_wait_slack_seconds": 30,
"source": "run3-focused/MEASURED-FILE-LIMITS.json"
}
@@ -6,7 +6,7 @@ REPAIR.diff compares the repaired scripts against their original frozen source,
## Conditions mapped to the diff
C1: fixed setsid without -f/-w; confirm the direct child's kernel SID equals its PID. M38 drops setsid; the named row253 C4 signals query killer must fail the exact numeric PID/SID equality assertion on the first query-pids line, in each kind and both sudo modes, without a timeout. A blocking child can still reach inner-timeout without setsid, so the refusal reason alone does not prove session creation (mos-1298).
C1: fixed setsid without -f/-w; confirm the direct child's kernel SID equals its PID. M38 drops setsid; exact inner-timeout tests must kill it by observing inner-session instead.
C2: exact inner/outer/output-limit refusals in both fake modes, query 5/7 s and probe 2/4 s. Outer cases require at least the outer duration and less than outer + 2 s. Root discards the valid-looking stdout of a stalled supervisor. A trusted notice plus status 137 identifies the outer timer.
@@ -1,168 +0,0 @@
{
"count": 17,
"matches": 15,
"mismatches": [
{
"fault": "peer-malformed",
"expected": "probe",
"observed": "probe-inner-session",
"p10": [
"P10 tester-socket-squat unnamed boundary=failed reason=probe-inner-session path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"
]
},
{
"fault": "peer-error",
"expected": "probe-inner-command",
"observed": "probe-inner-session",
"p10": [
"P10 tester-socket-squat unnamed boundary=failed reason=probe-inner-session path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"
]
}
],
"peer_malformed": {
"fault": "peer-malformed",
"p10": [
"P10 tester-socket-squat unnamed boundary=failed reason=probe-inner-session path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"
],
"reason": "probe-inner-session",
"status": 0
},
"rows": [
{
"fault": "parent-mode",
"p10": [
"P10 tester-socket-squat unnamed boundary=failed reason=metadata path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"
],
"reason": "metadata",
"status": 0
},
{
"fault": "parent-owner",
"p10": [
"P10 tester-socket-squat unnamed boundary=failed reason=metadata path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"
],
"reason": "metadata",
"status": 0
},
{
"fault": "socket-mode",
"p10": [
"P10 tester-socket-squat unnamed boundary=failed reason=metadata path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"
],
"reason": "metadata",
"status": 0
},
{
"fault": "socket-owner",
"p10": [
"P10 tester-socket-squat unnamed boundary=failed reason=metadata path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"
],
"reason": "metadata",
"status": 0
},
{
"fault": "socket-type",
"p10": [
"P10 tester-socket-squat unnamed boundary=failed reason=metadata path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"
],
"reason": "metadata",
"status": 0
},
{
"fault": "symlink",
"p10": [
"P10 tester-socket-squat unnamed boundary=failed reason=metadata path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"
],
"reason": "metadata",
"status": 0
},
{
"fault": "peer",
"p10": [
"P10 tester-socket-squat unnamed boundary=failed reason=peer path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"
],
"reason": "peer",
"status": 0
},
{
"fault": "peer-pid",
"p10": [
"P10 tester-socket-squat unnamed boundary=failed reason=peer path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"
],
"reason": "peer",
"status": 0
},
{
"fault": "python-mode",
"p10": [
"P10 tester-socket-squat unnamed boundary=failed reason=interpreter path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"
],
"reason": "interpreter",
"status": 0
},
{
"fault": "python-missing",
"p10": [
"P10 tester-socket-squat unnamed boundary=failed reason=interpreter path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"
],
"reason": "interpreter",
"status": 0
},
{
"fault": "python-not-elf",
"p10": [
"P10 tester-socket-squat unnamed boundary=failed reason=interpreter path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"
],
"reason": "interpreter",
"status": 0
},
{
"fault": "peer-malformed",
"p10": [
"P10 tester-socket-squat unnamed boundary=failed reason=probe-inner-session path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"
],
"reason": "probe-inner-session",
"status": 0
},
{
"fault": "peer-error",
"p10": [
"P10 tester-socket-squat unnamed boundary=failed reason=probe-inner-session path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"
],
"reason": "probe-inner-session",
"status": 0
},
{
"fault": "peer-uid-fields",
"p10": [
"P10 tester-socket-squat unnamed boundary=failed reason=metadata path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"
],
"reason": "metadata",
"status": 1
},
{
"fault": "changed-inode",
"p10": [
"P10 tester-socket-squat unnamed boundary=failed reason=changed path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"
],
"reason": "changed",
"status": 0
},
{
"fault": "changed-pid",
"p10": [
"P10 tester-socket-squat unnamed boundary=failed reason=changed path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"
],
"reason": "changed",
"status": 0
},
{
"fault": "floor",
"p10": [
"P10 tester-socket-squat unnamed boundary=failed reason=floor path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"
],
"reason": "floor",
"status": 0
}
]
}
@@ -1 +0,0 @@
/mnt/storage/scratch/tmp/gBHA
@@ -1,121 +0,0 @@
{
"parent-mode": {
"reason": "metadata",
"meaning": "Private parent mode is exact0700",
"semantic_source": "DESIGN.md:119; BUILD.md:17",
"code_label_location": "scripts/case1-accept.sh:659",
"exact_reason_token": "reason=metadata "
},
"parent-owner": {
"reason": "metadata",
"meaning": "Parent owner is stack uid",
"semantic_source": "DESIGN.md:119; BUILD.md:17",
"code_label_location": "scripts/case1-accept.sh:659",
"exact_reason_token": "reason=metadata "
},
"socket-mode": {
"reason": "metadata",
"meaning": "Socket mode is exact0600",
"semantic_source": "DESIGN.md:120; BUILD.md:17",
"code_label_location": "scripts/case1-accept.sh:659",
"exact_reason_token": "reason=metadata "
},
"socket-owner": {
"reason": "metadata",
"meaning": "Socket owner is stack uid",
"semantic_source": "DESIGN.md:120; BUILD.md:17",
"code_label_location": "scripts/case1-accept.sh:659",
"exact_reason_token": "reason=metadata "
},
"socket-type": {
"reason": "metadata",
"meaning": "Final entry is socket",
"semantic_source": "DESIGN.md:119; BUILD.md:17",
"code_label_location": "scripts/case1-accept.sh:659",
"exact_reason_token": "reason=metadata "
},
"symlink": {
"reason": "metadata",
"meaning": "Final entry is not symlink",
"semantic_source": "DESIGN.md:119; BUILD.md:17",
"code_label_location": "scripts/case1-accept.sh:659",
"exact_reason_token": "reason=metadata "
},
"peer": {
"reason": "peer",
"meaning": "Connected uid equals stack uid",
"semantic_source": "DESIGN.md:136; BUILD.md:17",
"code_label_location": "scripts/case1-accept.sh:665",
"exact_reason_token": "reason=peer "
},
"peer-pid": {
"reason": "peer",
"meaning": "Connected pid equals MainPID",
"semantic_source": "DESIGN.md:136; BUILD.md:17",
"code_label_location": "scripts/case1-accept.sh:665",
"exact_reason_token": "reason=peer "
},
"python-mode": {
"reason": "interpreter",
"meaning": "Fixed system interpreter safely owned and protected",
"semantic_source": "DESIGN.md:126; BUILD.md:17",
"code_label_location": "scripts/case1-accept.sh:660",
"exact_reason_token": "reason=interpreter "
},
"python-missing": {
"reason": "interpreter",
"meaning": "Missing system Python is failed observation",
"semantic_source": "DESIGN.md:129; BUILD.md:17",
"code_label_location": "scripts/case1-accept.sh:660",
"exact_reason_token": "reason=interpreter "
},
"python-not-elf": {
"reason": "interpreter",
"meaning": "System entry target is ELF",
"semantic_source": "DESIGN.md:126; BUILD.md:17",
"code_label_location": "scripts/case1-accept.sh:660",
"exact_reason_token": "reason=interpreter "
},
"peer-malformed": {
"reason": "probe",
"meaning": "Probe returns only exactly pid uid gid",
"semantic_source": "DESIGN.md:135; DESIGN.md:163; BUILD.md:17; mos-1293 item2 explicitly reason=probe",
"code_label_location": "scripts/case1-accept.sh:666",
"exact_reason_token": "reason=probe "
},
"peer-error": {
"reason": "probe-inner-command",
"meaning": "Nonzero child output discarded, distinct child failure",
"semantic_source": "DESIGN-C4.md:84-85; BUILD.md:175; BUILD.md:177",
"code_label_location": "scripts/case1-accept.sh:662; tester_capture_reason",
"exact_reason_token": "reason=probe-inner-command "
},
"peer-uid-fields": {
"reason": "metadata",
"meaning": "MainPID four proc uid fields equal stack uid",
"semantic_source": "DESIGN.md:118; BUILD.md:17",
"code_label_location": "scripts/case1-accept.sh:659",
"exact_reason_token": "reason=metadata "
},
"changed-inode": {
"reason": "changed",
"meaning": "Snapshot replacement fails observation",
"semantic_source": "DESIGN.md:120; DESIGN.md:121; BUILD.md:17",
"code_label_location": "scripts/case1-accept.sh:668",
"exact_reason_token": "reason=changed "
},
"changed-pid": {
"reason": "changed",
"meaning": "MainPID change fails observation",
"semantic_source": "DESIGN.md:121; BUILD.md:17",
"code_label_location": "scripts/case1-accept.sh:668",
"exact_reason_token": "reason=changed "
},
"floor": {
"reason": "floor",
"meaning": "Numeric floor above privileged Console port",
"semantic_source": "DESIGN.md:122; DESIGN.md:123",
"code_label_location": "scripts/case1-accept.sh:658",
"exact_reason_token": "reason=floor "
}
}
@@ -1,37 +0,0 @@
# Draft(b): expected P10 reasons before diagnostic(a)
Not derived from diagnostic output. No test edit is prepared or committed. The brief delegates P10 checks/outcome wording to DESIGN (docs/plans/2026-10-21_tester-socket-scripts.md:31). DESIGN.md:163-170 requires the failed reason to identify the failing observation, rather than accepting any unnamed line. BUILD.md:17 records the separate parent/socket/process/snapshot and peer checks. C4 refined failure classes in DESIGN-C4.md:84 and:91-95, with BUILD.md:175-177 recording distinct refusals.
The approved prose names semantic classes, not a literal exhaustive code-name table. The expected bounded labels below name those classes using existing source labels, cited separately for transparency. They are not selected from (a). peer-malformed=probe is additionally explicit in mos1293. If the diagnostic reports a different class/code, send it to Mos before any edit, even if it would make an existing broad assertion pass.
| Fault | Expected reason= | Designed observation | Design/build authority | Existing label locator, not output oracle |
|---|---|---|---|---|
| parent-mode | metadata | Private parent mode is exact0700 | DESIGN.md:119; BUILD.md:17 | scripts/case1-accept.sh:659 |
| parent-owner | metadata | Parent owner is stack uid | DESIGN.md:119; BUILD.md:17 | scripts/case1-accept.sh:659 |
| socket-mode | metadata | Socket mode is exact0600 | DESIGN.md:120; BUILD.md:17 | scripts/case1-accept.sh:659 |
| socket-owner | metadata | Socket owner is stack uid | DESIGN.md:120; BUILD.md:17 | scripts/case1-accept.sh:659 |
| socket-type | metadata | Final entry is socket | DESIGN.md:119; BUILD.md:17 | scripts/case1-accept.sh:659 |
| symlink | metadata | Final entry is not symlink | DESIGN.md:119; BUILD.md:17 | scripts/case1-accept.sh:659 |
| peer | peer | Connected uid equals stack uid | DESIGN.md:136; BUILD.md:17 | scripts/case1-accept.sh:665 |
| peer-pid | peer | Connected pid equals MainPID | DESIGN.md:136; BUILD.md:17 | scripts/case1-accept.sh:665 |
| python-mode | interpreter | Fixed system interpreter safely owned and protected | DESIGN.md:126; BUILD.md:17 | scripts/case1-accept.sh:660 |
| python-missing | interpreter | Missing system Python is failed observation | DESIGN.md:129; BUILD.md:17 | scripts/case1-accept.sh:660 |
| python-not-elf | interpreter | System entry target is ELF | DESIGN.md:126; BUILD.md:17 | scripts/case1-accept.sh:660 |
| peer-malformed | probe | Probe returns only exactly pid uid gid | DESIGN.md:135; DESIGN.md:163; BUILD.md:17; mos-1293 item2 explicitly reason=probe | scripts/case1-accept.sh:666 |
| peer-error | probe-inner-command | Nonzero child output discarded, distinct child failure | DESIGN-C4.md:84-85; BUILD.md:175; BUILD.md:177 | scripts/case1-accept.sh:662; tester_capture_reason |
| peer-uid-fields | metadata | MainPID four proc uid fields equal stack uid | DESIGN.md:118; BUILD.md:17 | scripts/case1-accept.sh:659 |
| changed-inode | changed | Snapshot replacement fails observation | DESIGN.md:120; DESIGN.md:121; BUILD.md:17 | scripts/case1-accept.sh:668 |
| changed-pid | changed | MainPID change fails observation | DESIGN.md:121; BUILD.md:17 | scripts/case1-accept.sh:668 |
| floor | floor | Numeric floor above privileged Console port | DESIGN.md:122; DESIGN.md:123 | scripts/case1-accept.sh:658 |
All existing status assertions and the boundary=failed/no-boundary=observed assertions remain. The draft adds exact reasons; it never weakens a status or changes a failure to fit observation. The special peer-uid-fields functional failure remains exit1. Product changes require Mos. A fixture-only repair can be considered only when the stub is shown to mask the intended fault, under mos1293.
One scratch archive of0604d91fc is prepared at the path in PREPARE.json. Its only change logs every P10 line, reason and status immediately before the same existing assertions in the named loop. Both product scripts and shared fixture are exact base blobs. The COPY-PATH is not a commit/worktree. No source or test in the seat checkout is changed.
On Sage CLEAR: create TMPDIR via mktemp-d /mnt/storage/scratch/tmp/gXXX, export it, invoke diagnostic-a/run.py with that grant. It gates with the busy check, uses timeout-k10 418 and outer448, pipefail/tee, records command/header/results and writes P10.jsonl. It refuses a second run if output exists. No diagnostic/syntax/Node execution has run while preparing this.
## Duckworth0160 expected-set review
All17 expected reasons accepted by source-only review. C1: assert the exact reason token, including its following space, for example `reason=probe `, or match the full P10 line. A prefix expression `/reason=probe/` is forbidden because it also accepts probe-inner-command and other probe-* reasons. C2: keep every existing status, boundary=failed and no-boundary=observed assertion. A fixture repair is limited to a mask shown by diagnostic(a), and an unexpected reason goes to Mos before any edit.
N1 citation corrected: peer-error child failure is DESIGN-C4.md:84-85. N2: the existing peer-hang test at case1-accept.test.mjs:291 has a separate loose probe prefix; Duckworth says it is outside mos1292/1293 scope and does not bind this repair. No change to it is prepared.
@@ -1,11 +0,0 @@
--- 0604d91fc/packages/cli/tests/case1-accept.test.mjs
+++ scratch/packages/cli/tests/case1-accept.test.mjs
@@ -262,6 +262,8 @@
};
for(const [name,fault] of Object.entries(faults)){
const h=host(t);fault(h);const r=run(h);
+ const diagnosticP10 = r.lines.filter(line => line.startsWith('P10 '));
+ writeFileSync(process.env.ROW253_P10_DIAG, JSON.stringify({fault:name, p10:diagnosticP10, reason:/\breason=([^ ]+)/.exec(diagnosticP10.join('\n'))?.[1] ?? null, status:r.status})+'\n', {flag:'a'});
assert.equal(r.status,name==='peer-uid-fields'?1:0,`${name}: ${r.out}${r.err}`);
assert.match(r.out,/P10 tester-socket-squat unnamed boundary=failed/,name);
assert.doesNotMatch(r.out,/boundary=observed/,name);
@@ -1,17 +0,0 @@
{"fault":"parent-mode","p10":["P10 tester-socket-squat unnamed boundary=failed reason=metadata path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"],"reason":"metadata","status":0}
{"fault":"parent-owner","p10":["P10 tester-socket-squat unnamed boundary=failed reason=metadata path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"],"reason":"metadata","status":0}
{"fault":"socket-mode","p10":["P10 tester-socket-squat unnamed boundary=failed reason=metadata path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"],"reason":"metadata","status":0}
{"fault":"socket-owner","p10":["P10 tester-socket-squat unnamed boundary=failed reason=metadata path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"],"reason":"metadata","status":0}
{"fault":"socket-type","p10":["P10 tester-socket-squat unnamed boundary=failed reason=metadata path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"],"reason":"metadata","status":0}
{"fault":"symlink","p10":["P10 tester-socket-squat unnamed boundary=failed reason=metadata path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"],"reason":"metadata","status":0}
{"fault":"peer","p10":["P10 tester-socket-squat unnamed boundary=failed reason=peer path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"],"reason":"peer","status":0}
{"fault":"peer-pid","p10":["P10 tester-socket-squat unnamed boundary=failed reason=peer path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"],"reason":"peer","status":0}
{"fault":"python-mode","p10":["P10 tester-socket-squat unnamed boundary=failed reason=interpreter path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"],"reason":"interpreter","status":0}
{"fault":"python-missing","p10":["P10 tester-socket-squat unnamed boundary=failed reason=interpreter path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"],"reason":"interpreter","status":0}
{"fault":"python-not-elf","p10":["P10 tester-socket-squat unnamed boundary=failed reason=interpreter path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"],"reason":"interpreter","status":0}
{"fault":"peer-malformed","p10":["P10 tester-socket-squat unnamed boundary=failed reason=probe-inner-session path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"],"reason":"probe-inner-session","status":0}
{"fault":"peer-error","p10":["P10 tester-socket-squat unnamed boundary=failed reason=probe-inner-session path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"],"reason":"probe-inner-session","status":0}
{"fault":"peer-uid-fields","p10":["P10 tester-socket-squat unnamed boundary=failed reason=metadata path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"],"reason":"metadata","status":1}
{"fault":"changed-inode","p10":["P10 tester-socket-squat unnamed boundary=failed reason=changed path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"],"reason":"changed","status":0}
{"fault":"changed-pid","p10":["P10 tester-socket-squat unnamed boundary=failed reason=changed path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"],"reason":"changed","status":0}
{"fault":"floor","p10":["P10 tester-socket-squat unnamed boundary=failed reason=floor path=/srv/mosaic/.mosaic-dev/console/tester.sock MainPID=200; hostile same-uid substitution remains"],"reason":"floor","status":0}
@@ -1,18 +0,0 @@
{
"base": "0604d91fcfc1949810cd5321aea6ec43e9b74b4b",
"scratch_copy": "/mnt/storage/scratch/tmp/gBHA",
"source": "git archive base, all tracked files, no commit and no .git",
"test": "packages/cli/tests/case1-accept.test.mjs",
"original_test_sha256": "6cfd2963303315aa6911c4d4f6d75d3ab87d9fcba8e128b056216e7f85fd8901",
"instrumented_test_sha256": "0e029047fa7d8cd94a17e0caabc383432ef31068c4ea781e880664d7c7650d3d",
"unchanged_product_and_fixture": {
"scripts/case1-accept.sh": "c02bef6b3495e5a4548d7b4e89675ed52be26a0c9ccce4d9d5cfc5fe2ce437bd",
"scripts/case2-unit.sh": "d7670bdb049ae41ba3774fc83de633636859b6723be858cfb31ea106b0e8812b",
"packages/cli/tests/case-sudo-fixture.mjs": "b259b8c7926e49829c8a956674021cb0cc85ddd65aebdc786d05cc08d7790008"
},
"change": "Output-only JSONL before unchanged existing assertions, scoped to named P10 loop. Records all P10 lines and reason for each fault.",
"tests_run": false,
"node_modules": "plain symlink to canonical node_modules",
"planned_timeout_seconds": 418,
"planned_outer_wait_seconds": 448
}
@@ -1,19 +0,0 @@
{
"grant": "sage-2752",
"base": "0604d91fcfc1949810cd5321aea6ec43e9b74b4b",
"scratch_copy": "/mnt/storage/scratch/tmp/gBHA",
"tmpdir": "/mnt/storage/scratch/tmp/grCq",
"command": [
"timeout",
"-k",
"10",
"418",
"node",
"--test",
"--test-reporter=tap",
"--test-name-pattern",
"row253 P10 refuses unsafe metadata",
"packages/cli/tests/case1-accept.test.mjs"
],
"reason_oracle": "EXPECTED-REASONS.md drafted before diagnostic; output does not define expected reasons"
}
@@ -1,26 +0,0 @@
{
"code": 0,
"timeout": false,
"seconds": 8.632,
"header": {
"grant": "sage-2752",
"base": "0604d91fcfc1949810cd5321aea6ec43e9b74b4b",
"scratch_copy": "/mnt/storage/scratch/tmp/gBHA",
"tmpdir": "/mnt/storage/scratch/tmp/grCq",
"command": [
"timeout",
"-k",
"10",
"418",
"node",
"--test",
"--test-reporter=tap",
"--test-name-pattern",
"row253 P10 refuses unsafe metadata",
"packages/cli/tests/case1-accept.test.mjs"
],
"reason_oracle": "EXPECTED-REASONS.md drafted before diagnostic; output does not define expected reasons"
},
"log": "/home/jwoltje/.t3/worktrees/mosaic-stack/gander-row196/agents/gander/work/queue-253/diagnostic-a/diagnostic.log",
"p10_file": "/home/jwoltje/.t3/worktrees/mosaic-stack/gander-row196/agents/gander/work/queue-253/diagnostic-a/P10.jsonl"
}
@@ -1,61 +0,0 @@
{
"count": 0,
"remaining": [],
"excluded_preexisting_infrastructure": [
{
"pid": 2469277,
"comm": "node-MainThread",
"cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/gander-row196",
"started_utc": "2026-10-22T14:20:57.360000+00:00"
},
{
"pid": 2469278,
"comm": "npm exec @model",
"cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/gander-row196",
"started_utc": "2026-10-22T14:20:57.370000+00:00"
},
{
"pid": 2469279,
"comm": "npm exec chrome",
"cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/gander-row196",
"started_utc": "2026-10-22T14:20:57.370000+00:00"
},
{
"pid": 2469292,
"comm": "npm exec @playw",
"cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/gander-row196",
"started_utc": "2026-10-22T14:20:57.380000+00:00"
},
{
"pid": 2469478,
"comm": "node-MainThread",
"cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/gander-row196",
"started_utc": "2026-10-22T14:20:58.770000+00:00"
},
{
"pid": 2469485,
"comm": "node-MainThread",
"cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/gander-row196",
"started_utc": "2026-10-22T14:20:58.800000+00:00"
},
{
"pid": 2469518,
"comm": "chrome-devtools",
"cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/gander-row196",
"started_utc": "2026-10-22T14:20:59.100000+00:00"
},
{
"pid": 2469601,
"comm": "node-MainThread",
"cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/gander-row196",
"started_utc": "2026-10-22T14:20:59.440000+00:00"
},
{
"pid": 2470486,
"comm": "codex-code-mode",
"cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/gander-row196",
"started_utc": "2026-10-22T14:21:07.580000+00:00"
}
],
"note": "Read-only cwd sweep over own repo, scratch archive and diagnostic TMPDIR, including deleted cwd. No signalling."
}
@@ -1 +0,0 @@
/mnt/storage/scratch/tmp/grCq
@@ -1 +0,0 @@
["timeout", "-k", "10", "418", "node", "--test", "--test-reporter=tap", "--test-name-pattern", "row253 P10 refuses unsafe metadata", "packages/cli/tests/case1-accept.test.mjs"]
@@ -1,18 +0,0 @@
{"grant": "sage-2752", "base": "0604d91fcfc1949810cd5321aea6ec43e9b74b4b", "scratch_copy": "/mnt/storage/scratch/tmp/gBHA", "tmpdir": "/mnt/storage/scratch/tmp/grCq", "command": ["timeout", "-k", "10", "418", "node", "--test", "--test-reporter=tap", "--test-name-pattern", "row253 P10 refuses unsafe metadata", "packages/cli/tests/case1-accept.test.mjs"], "reason_oracle": "EXPECTED-REASONS.md drafted before diagnostic; output does not define expected reasons"}
TAP version 13
# Subtest: row253 P10 refuses unsafe metadata, wrong peers and an unsafe Python without claiming closure
ok 1 - row253 P10 refuses unsafe metadata, wrong peers and an unsafe Python without claiming closure
---
duration_ms: 8459.11348
type: 'test'
...
1..1
# tests 1
# suites 0
# pass 1
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 8556.217902
{"code": 0, "timeout": false, "seconds": 8.632, "header": {"grant": "sage-2752", "base": "0604d91fcfc1949810cd5321aea6ec43e9b74b4b", "scratch_copy": "/mnt/storage/scratch/tmp/gBHA", "tmpdir": "/mnt/storage/scratch/tmp/grCq", "command": ["timeout", "-k", "10", "418", "node", "--test", "--test-reporter=tap", "--test-name-pattern", "row253 P10 refuses unsafe metadata", "packages/cli/tests/case1-accept.test.mjs"], "reason_oracle": "EXPECTED-REASONS.md drafted before diagnostic; output does not define expected reasons"}, "log": "/home/jwoltje/.t3/worktrees/mosaic-stack/gander-row196/agents/gander/work/queue-253/diagnostic-a/diagnostic.log", "p10_file": "/home/jwoltje/.t3/worktrees/mosaic-stack/gander-row196/agents/gander/work/queue-253/diagnostic-a/P10.jsonl"}
@@ -1,16 +0,0 @@
TAP version 13
# Subtest: row253 P10 refuses unsafe metadata, wrong peers and an unsafe Python without claiming closure
ok 1 - row253 P10 refuses unsafe metadata, wrong peers and an unsafe Python without claiming closure
---
duration_ms: 8459.11348
type: 'test'
...
1..1
# tests 1
# suites 0
# pass 1
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 8556.217902
@@ -1 +0,0 @@
2026-10-22T15:25:48.412740+00:00
@@ -1,35 +0,0 @@
#!/usr/bin/env python3
"""One scratch diagnostic, executable only after Sage grants its gap."""
import argparse,json,os,signal,subprocess,time
from pathlib import Path
HERE=Path(__file__).resolve().parent
def main():
ap=argparse.ArgumentParser();ap.add_argument('--grant',required=True);args=ap.parse_args()
if not os.environ.get('TMPDIR','').startswith('/mnt/storage/scratch/tmp/g'):
raise RuntimeError('create the granted gXXX TMPDIR first')
prep=json.loads((HERE/'PREPARE.json').read_text());copy=Path(prep['scratch_copy'])
busy=subprocess.run(['bash','/mnt/storage/scratch/sage-busy-now.sh'],capture_output=True,text=True)
if busy.returncode or busy.stdout.splitlines()[-1:]!=['CLEAR']:
raise RuntimeError('busy refusal: '+busy.stdout+busy.stderr)
env=os.environ.copy();env['ROW253_P10_DIAG']=str(HERE/'P10.jsonl')
if (HERE/'RUN-RESULT.json').exists() or (HERE/'P10.jsonl').exists():
raise RuntimeError('one diagnostic only; existing output refuses automatic rerun')
command=['timeout','-k','10','418','node','--test','--test-reporter=tap','--test-name-pattern','row253 P10 refuses unsafe metadata','packages/cli/tests/case1-accept.test.mjs']
command_file=HERE/'command.json';command_file.write_text(json.dumps(command)+'\n')
header=dict(grant=args.grant,base=prep['base'],scratch_copy=str(copy),tmpdir=env['TMPDIR'],command=command,reason_oracle='EXPECTED-REASONS.md drafted before diagnostic; output does not define expected reasons')
(HERE/'RUN-HEADER.json').write_text(json.dumps(header,indent=2)+'\n');print(json.dumps(header),flush=True)
started=time.monotonic()
p=subprocess.Popen(['bash','-o','pipefail','-c','python3 "$1" "$2" 2>&1 | tee "$3"','--',str(HERE.parent/'launch.py'),str(command_file),str(HERE/'diagnostic.log')],cwd=copy,env=env,start_new_session=True)
timeout=False
try:
code=p.wait(timeout=448);timeout=code in (124,137)
except subprocess.TimeoutExpired:
timeout=True;os.killpg(p.pid,signal.SIGKILL);code=p.wait()
finally:
try:os.killpg(p.pid,signal.SIGKILL)
except ProcessLookupError:pass
result=dict(code=code,timeout=timeout,seconds=round(time.monotonic()-started,3),header=header,log=str(HERE/'diagnostic.log'),p10_file=str(HERE/'P10.jsonl'))
(HERE/'RUN-RESULT.json').write_text(json.dumps(result,indent=2)+'\n');print(json.dumps(result),flush=True)
if timeout or code:raise RuntimeError('diagnostic stopped; no retry or repair before ruling')
if __name__=='__main__':main()
@@ -1 +0,0 @@
2026-10-22T15:25:29Z
-5
View File
@@ -21,11 +21,6 @@ def busy():
raise RuntimeError('busy refusal: ' + p.stdout + p.stderr)
def run(command, path, seconds=60):
if command[:2] == ['node', '--test']:
limits = json.loads((HERE/'WHOLE-GATE-LIMITS.json').read_text())['files']
limit = limits.get(command[-1], 900)
command = ['timeout','-k','10',str(limit),*command]
seconds = limit + 30
busy()
started = time.monotonic()
command_file = path.with_suffix('.command.json')
@@ -1,36 +0,0 @@
#!/usr/bin/env python3
"""Summarize completed focused evidence without executing tests."""
import datetime
import hashlib
import json
import math
from pathlib import Path
HERE=Path(__file__).resolve().parent
RUN=HERE/'run3-focused'
def main():
results=json.loads((RUN/'files/results.json').read_text())
assert len(results['steps'])==27
assert all(s['code']==0 and not s['timeout'] and s['counts'].get('fail')==0 for s in results['steps'])
header=(RUN/'controller.log').read_text().splitlines()
assert json.loads(header[0])=={k:results[k] for k in ['grant','head','manifest']}
assert json.loads(header[1])['authority']=='sage-2709'
named=[]
basis={}
lines=['# Focused27 whole-file results','','| Whole file | Pass/fail/skip | Wall seconds | Command limit seconds | Next3x plus120 basis |','|---|---:|---:|---:|---:|']
for s in results['steps']:
command=json.loads(Path(s['log']).with_suffix('.command.json').read_text())
expected=900 if s['file'].startswith('packages/cli/') else 300
assert command==['timeout','-k','10',str(expected),'node','--test','--test-reporter=tap',s['file']]
c=s['counts'];limit=math.ceil(3*s['seconds'])+120
basis[s['file']]=dict(recorded_seconds=s['seconds'],receipt=s['log'],next_limit_seconds=limit,derivation='ceil(3*measured whole-file seconds)+120')
lines.append(f"| {s['file']} | {c['pass']}/{c['fail']}/{c['skipped']} | {s['seconds']} | {expected} | {limit} |")
named += [dict(file=s['file'],line=line) for line in s['named_skips']]
case2=next(s for s in results['steps'] if s['file'].endswith('/case2-unit.test.mjs'))
n9=[line for line in Path(case2['log']).read_text().splitlines() if 'inside a session' in line and 'ok ' in line]
assert len(n9)==1
result=dict(status='GREEN',grant=results['grant'],candidate=results['head'],manifest=results['manifest'],counts={k:sum(s['counts'].get(k,0) for s in results['steps']) for k in ['pass','fail','skipped']},steps=results['steps'],named_skips=named,n9_exact_line=n9[0],file_seconds_sum=round(sum(s['seconds'] for s in results['steps']),3),next_file_limits=basis,timeout_count=0,source_manifest_verified=True)
(RUN/'SUMMARY.json').write_text(json.dumps(result,indent=2)+'\n')
(RUN/'RESULTS.md').write_text('\n'.join(lines)+'\n\nN9 verbatim: '+n9[0]+'\n\nEvery skip:\n\n'+'\n'.join('- '+s['line'] for s in named)+'\n')
(RUN/'MEASURED-FILE-LIMITS.json').write_text(json.dumps(basis,indent=2)+'\n')
print(json.dumps({k:result[k] for k in ['counts','named_skips','n9_exact_line','file_seconds_sum']},indent=2))
if __name__=='__main__':main()
@@ -1,34 +0,0 @@
#!/usr/bin/env python3
"""Read-only sweep of this worktree and focused TMPDIR, including deleted cwd."""
import datetime
import json
import os
from pathlib import Path
HERE=Path(__file__).resolve().parent
REPO=HERE.parents[3]
RUN=HERE/'run3-focused'
def main():
tmp=Path((RUN/'TMPDIR').read_text().strip())
started=datetime.datetime.fromisoformat((RUN/'start.txt').read_text().strip().replace('Z','+00:00')).timestamp()
boot=int(next(s.split()[1] for s in Path('/proc/stat').read_text().splitlines() if s.startswith('btime ')))
ancestors=set();pid=os.getpid()
while pid and pid not in ancestors:
ancestors.add(pid)
try:pid=int(next(s.split(':')[1] for s in Path(f'/proc/{pid}/status').read_text().splitlines() if s.startswith('PPid:')))
except (OSError,StopIteration):break
known={2880281,2880282,2880283,2880284,2880445,2880487,2880537,2883251,2880439,2469277,2469278,2469279,2469292,2469478,2469485,2469518,2469601,2470486}
remaining=[];excluded=[]
for proc in Path('/proc').iterdir():
if not proc.name.isdigit() or int(proc.name) in ancestors:continue
try:
rawcwd=os.readlink(proc/'cwd');cwd=Path(rawcwd.removesuffix(' (deleted)'))
if not(cwd==REPO or REPO in cwd.parents or cwd==tmp or tmp in cwd.parents):continue
stat=(proc/'stat').read_text().rsplit(') ',1)[1].split()
stamp=boot+int(stat[19])/os.sysconf('SC_CLK_TCK')
item=dict(pid=int(proc.name),comm=(proc/'comm').read_text().strip(),cwd=rawcwd,started_utc=datetime.datetime.fromtimestamp(stamp,datetime.timezone.utc).isoformat())
if int(proc.name) in known and stamp<started:excluded.append(item)
else:remaining.append(item)
except (OSError,ValueError,IndexError):continue
result=dict(timestamp=datetime.datetime.now(datetime.timezone.utc).isoformat(),count=len(remaining),remaining=remaining,excluded_preexisting_infrastructure=excluded,note='Read-only /proc cwd sweep, including deleted cwd under this run TMPDIR. Own ancestry excluded. Only known MCP/npm/code-mode infrastructure PIDs with pre-run start ticks are excluded. No signalling.')
(RUN/'sweep.json').write_text(json.dumps(result,indent=2)+'\n');print(json.dumps(result,indent=2))
if __name__=='__main__':main()
@@ -1,54 +0,0 @@
#!/usr/bin/env python3
"""Assemble complete whole-gate evidence from retained logs only."""
import hashlib,json,re
from pathlib import Path
HERE=Path(__file__).resolve().parent
RUN=HERE/'run3-gate'
def main():
sections={n:json.loads((RUN/n/'results.json').read_text()) for n in ['focused','changes','whole']}
header=json.loads((RUN/'HEADER.json').read_text());lists=json.loads((RUN/'FILE-LISTS.json').read_text())
whole=sections['whole']['steps'];expected=sum(map(len,lists.values()))+10
assert len(whole)==expected
assert all(s['code']==0 and not s['timeout'] for s in whole)
focused=sections['focused']['steps']
assert len(focused)==4 and all(not s['timeout'] and (s['code']!=0 if s['expected_red'] else s['code']==0) for s in focused)
changes=sections['changes']['changes'];assert len(changes)==40 and all(s['outcome']=='killed' and not s['timeout'] for s in changes)
limits=json.loads((HERE/'WHOLE-GATE-LIMITS.json').read_text())['files'];shell_limits=json.loads((HERE/'SHELL-LIMITS.json').read_text())['scripts']
counts={};skips=[];rows=[];shells=[];n9=[]
for package,files in lists.items():
steps=[s for s in whole if s['name'].startswith(package+'-')]
commands=[json.loads(Path(s['log']).with_suffix('.command.json').read_text()) for s in steps]
assert [c[-1] for c in commands]==files
counts[package]={k:sum(s['counts'].get(k,0) for s in steps) for k in ['pass','fail','skipped']}
for s,c,file in zip(steps,commands,files):
assert c==['timeout','-k','10',str(limits[file]),'node','--test','--test-reporter=tap',file]
text=Path(s['log']).read_text(errors='replace')
skips += [dict(file=file,line=line) for line in text.splitlines() if '# SKIP' in line]
if file.endswith('/case2-unit.test.mjs'):n9 += [line for line in text.splitlines() if line.startswith('ok ') and "inside a session's sandbox" in line]
rows.append(dict(file=file,counts=s['counts'],seconds=s['seconds'],limit_seconds=limits[file],log=s['log']))
for s in whole[-10:]:
command=json.loads(Path(s['log']).with_suffix('.command.json').read_text());file=command[-1]
assert command==['timeout','-k','10',str(shell_limits[file]['limit_seconds']),'bash',file]
text=Path(s['log']).read_text(errors='replace');found=re.findall(r'([^\n]*?: (\d+) passed, (\d+) failed)',text);assert found,file
line,passed,failed=found[-1];assert int(failed)==0
skips += [dict(file=file,line=line) for line in text.splitlines() if re.match(r'^\s*skip\b',line,re.I) or '# SKIP' in line]
shells.append(dict(file=file,pass_count=int(passed),fail_count=int(failed),seconds=s['seconds'],limit_seconds=shell_limits[file]['limit_seconds'],summary_line=line,log=s['log']))
assert len(n9)==1
counts['shell_self_assertions']=dict(pass_count=sum(s['pass_count'] for s in shells),fail_count=0)
result=dict(status='GREEN',header=header,sections=sections,counts=counts,files=rows,shells=shells,named_skips=skips,n9_exact_line=n9[0],killed=40,survived=0,timeouts=0,head_diff_outside_gander=(RUN/'HEAD-DIFF-OUTSIDE-GANDER.txt').read_text().splitlines())
repo=HERE.parents[3]
expected_hashes=json.loads((HERE/'CANDIDATE-SHAS.json').read_text())
assert all(hashlib.sha256((repo/n).read_bytes()).hexdigest()==v for n,v in expected_hashes.items())
assert all(hashlib.sha256((repo/n).read_bytes()).hexdigest()==v['script_sha256'] for n,v in shell_limits.items())
(RUN/'SUMMARY.json').write_text(json.dumps(result,indent=2)+'\n')
lines=['# Row253 whole gate RESULTS','','HEAD '+header['head']+', product '+header['product']+', manifest '+header['manifest']+'.','','0604..344 name-only outside agents/gander/:','','```text',*result['head_diff_outside_gander'],'```','','All listed whole files ran, with no unlisted-file coverage claim. Intended REDs and focused repeats are separate from package totals. Bus coverage is the20-file rebase union, not a bus-whole claim.','','| Whole file | Pass/fail/skip | Wall seconds | Limit seconds |','|---|---:|---:|---:|']
lines += [f"| {r['file']} | {r['counts']['pass']}/{r['counts']['fail']}/{r['counts']['skipped']} | {r['seconds']} | {r['limit_seconds']} |" for r in rows]
lines += [f"| {r['file']} | {r['pass_count']}/{r['fail_count']}/0 | {r['seconds']} | {r['limit_seconds']} |" for r in shells]
lines += ['','N9 verbatim: '+n9[0],'','Every named skip:','']+[f"- {s['file']}: {s['line']}" for s in skips]
(RUN/'RESULTS.md').write_text('\n'.join(lines)+'\n')
defs={d['id']:d for d in json.loads((HERE/'changes.json').read_text())}
table=['# M1-M40 kill table','','Every base passes; each change restored exact bytes and tracked status before the next. No timeout counts as kill.','','| Check | Named killer | Base seconds | Changed seconds | Outcome |','|---|---|---:|---:|---|']
table += [f"| {s['id']} | {defs[s['id']]['pattern']} | {s['base_seconds']} | {s['seconds']} | {s['outcome']} |" for s in changes]
(RUN/'KILL-TABLE.md').write_text('\n'.join(table)+'\n')
print(json.dumps(dict(counts=counts,named_skips=skips,n9=n9,killed=40),indent=2))
if __name__=='__main__':main()
@@ -1,34 +0,0 @@
#!/usr/bin/env python3
"""Read-only sweep of this worktree and focused TMPDIR, including deleted cwd."""
import datetime
import json
import os
from pathlib import Path
HERE=Path(__file__).resolve().parent
REPO=HERE.parents[3]
RUN=HERE/'run3-gate'
def main():
tmp=Path((RUN/'TMPDIR').read_text().strip())
started=datetime.datetime.fromisoformat((RUN/'start.txt').read_text().strip().replace('Z','+00:00')).timestamp()
boot=int(next(s.split()[1] for s in Path('/proc/stat').read_text().splitlines() if s.startswith('btime ')))
ancestors=set();pid=os.getpid()
while pid and pid not in ancestors:
ancestors.add(pid)
try:pid=int(next(s.split(':')[1] for s in Path(f'/proc/{pid}/status').read_text().splitlines() if s.startswith('PPid:')))
except (OSError,StopIteration):break
known={2880281,2880282,2880283,2880284,2880445,2880487,2880537,2883251,2880439,2469277,2469278,2469279,2469292,2469478,2469485,2469518,2469601,2470486}
remaining=[];excluded=[]
for proc in Path('/proc').iterdir():
if not proc.name.isdigit() or int(proc.name) in ancestors:continue
try:
rawcwd=os.readlink(proc/'cwd');cwd=Path(rawcwd.removesuffix(' (deleted)'))
if not(cwd==REPO or REPO in cwd.parents or cwd==tmp or tmp in cwd.parents):continue
stat=(proc/'stat').read_text().rsplit(') ',1)[1].split()
stamp=boot+int(stat[19])/os.sysconf('SC_CLK_TCK')
item=dict(pid=int(proc.name),comm=(proc/'comm').read_text().strip(),cwd=rawcwd,started_utc=datetime.datetime.fromtimestamp(stamp,datetime.timezone.utc).isoformat())
if int(proc.name) in known and stamp<started:excluded.append(item)
else:remaining.append(item)
except (OSError,ValueError,IndexError):continue
result=dict(timestamp=datetime.datetime.now(datetime.timezone.utc).isoformat(),count=len(remaining),remaining=remaining,excluded_preexisting_infrastructure=excluded,note='Read-only /proc cwd sweep, including deleted cwd under this run TMPDIR. Own ancestry excluded. Only known MCP/npm/code-mode infrastructure PIDs with pre-run start ticks are excluded. No signalling.')
(RUN/'sweep.json').write_text(json.dumps(result,indent=2)+'\n');print(json.dumps(result,indent=2))
if __name__=='__main__':main()
@@ -1,43 +0,0 @@
# Row253 final integration after264a
Authority sage-2698. New gander/row253-264a on84f53540d; previous branch retained. Eleven commits replayed with no conflict. All eleven range-diff pairs and full patch-ids equal. Rebased tip before this record b9d3d4c75c78aa6b06aefd734da781bef9b7f1da.
Only DEFERRED changes among the seven manifest blobs, preserving the new base as an exact byte prefix. Six other blobs remain unchanged, including both host scripts, both focused tests and shared sudo fixture. New manifest 735fa2d7405d01ace8eb7aab366753fa5b1877cf8044b0151cb2113a0502bc1f. BUILD-LOG remains an append outside the landing manifest.
264a reaches the focused tests through Store loaded by CLI helpers. The new base includes schema3l, migrations/3k-3l.sql and matching store hash. The focused tests pin neither3k/3l nor schema bytes. No product/test/assertion repair. Duckworth0132 already checked this dependency statically against264a r9. This packet also lists actual landing changes. T46 stack-release.test.mjs reads actual schema and will run whole.
The required whole-file union conservatively includes every .test.mjs changed upstream from385a to84f plus both own focused test files. Shared case-sudo fixture is exercised by its two importers; schema-3k.sql is a migration fixture, not a standalone test. Whole-test-union.json has 27 runnable files. No result carries. These runs await a focused CLEAR before publication and Duckworth rebase check; the whole gate needs a later CLEAR.
N9 remains the exact case2 test: inside a session's sandbox a bind below1024 fails with EACCES, and a bind on a free high port succeeds. Its skip reason comes from sandboxProblem() at gate time and will be copied verbatim. Other environment/provider/canonical-root skips will be named too.
SHELL-LIMITS.json stays as prepared under sage-2659. Every scripts/test-*.sh blob matches the previous base; the only changed script upstream is stack-release.sh. Current limits retain their receipts and3x rule. No tests, Node, syntax commands, browser, host probe, queue command or push ran.
Required whole files:
- packages/bus/tests/account-migration.test.mjs
- packages/bus/tests/chief-of-staff.test.mjs
- packages/bus/tests/comment-migration.test.mjs
- packages/bus/tests/end-launch.test.mjs
- packages/bus/tests/fire-revokes-grants.test.mjs
- packages/bus/tests/gitea-grant.test.mjs
- packages/bus/tests/gitea-migration.test.mjs
- packages/bus/tests/grant-executor.test.mjs
- packages/bus/tests/grant-migration.test.mjs
- packages/bus/tests/lifecycle-revoke.test.mjs
- packages/bus/tests/message-filter.test.mjs
- packages/bus/tests/name-migration.test.mjs
- packages/bus/tests/schema.test.mjs
- packages/bus/tests/sessions.test.mjs
- packages/bus/tests/spec-migration.test.mjs
- packages/bus/tests/tester-writes.test.mjs
- packages/bus/tests/thread-claims.test.mjs
- packages/bus/tests/thread-migration.test.mjs
- packages/bus/tests/threads.test.mjs
- packages/bus/tests/usage-migration.test.mjs
- packages/cli/tests/case1-accept.test.mjs
- packages/cli/tests/case2-unit.test.mjs
- packages/cli/tests/lifecycle.test.mjs
- packages/cli/tests/stack-release.test.mjs
- packages/cli/tests/thread-cli.test.mjs
- packages/cli/tests/thread-launch.test.mjs
- packages/webui/tests/chat.test.mjs
@@ -1,90 +0,0 @@
{
"old_base": "385a7194c",
"old_tip": "d213ef651",
"new_base": "84f53540d",
"rebased_tip": "b9d3d4c75c78aa6b06aefd734da781bef9b7f1da",
"manifest": "735fa2d7405d01ace8eb7aab366753fa5b1877cf8044b0151cb2113a0502bc1f",
"manifest_blobs_changed": [
"docs/plans/DEFERRED.md"
],
"upstream_paths": [
"agents/gizmoduck/work/queue-264/BUILD.md",
"agents/megavolt/work/queue-281/BUILD.md",
"docs/plans/DEFERRED.md",
"packages/bus/README.md",
"packages/bus/schema.sql",
"packages/bus/src/broker.mjs",
"packages/bus/src/migrations/3k-3l.sql",
"packages/bus/src/store.mjs",
"packages/bus/tests/account-migration.test.mjs",
"packages/bus/tests/chief-of-staff.test.mjs",
"packages/bus/tests/comment-migration.test.mjs",
"packages/bus/tests/end-launch.test.mjs",
"packages/bus/tests/fire-revokes-grants.test.mjs",
"packages/bus/tests/fixtures/schema-3k.sql",
"packages/bus/tests/gitea-grant.test.mjs",
"packages/bus/tests/gitea-migration.test.mjs",
"packages/bus/tests/grant-executor.test.mjs",
"packages/bus/tests/grant-migration.test.mjs",
"packages/bus/tests/lifecycle-revoke.test.mjs",
"packages/bus/tests/message-filter.test.mjs",
"packages/bus/tests/name-migration.test.mjs",
"packages/bus/tests/schema.test.mjs",
"packages/bus/tests/sessions.test.mjs",
"packages/bus/tests/spec-migration.test.mjs",
"packages/bus/tests/tester-writes.test.mjs",
"packages/bus/tests/thread-claims.test.mjs",
"packages/bus/tests/thread-migration.test.mjs",
"packages/bus/tests/threads.test.mjs",
"packages/bus/tests/usage-migration.test.mjs",
"packages/cli/tests/lifecycle.test.mjs",
"packages/cli/tests/stack-release.test.mjs",
"packages/cli/tests/thread-cli.test.mjs",
"packages/cli/tests/thread-launch.test.mjs",
"packages/webui/tests/chat.test.mjs",
"scripts/stack-release.sh"
],
"whole_test_union": [
"packages/bus/tests/account-migration.test.mjs",
"packages/bus/tests/chief-of-staff.test.mjs",
"packages/bus/tests/comment-migration.test.mjs",
"packages/bus/tests/end-launch.test.mjs",
"packages/bus/tests/fire-revokes-grants.test.mjs",
"packages/bus/tests/gitea-grant.test.mjs",
"packages/bus/tests/gitea-migration.test.mjs",
"packages/bus/tests/grant-executor.test.mjs",
"packages/bus/tests/grant-migration.test.mjs",
"packages/bus/tests/lifecycle-revoke.test.mjs",
"packages/bus/tests/message-filter.test.mjs",
"packages/bus/tests/name-migration.test.mjs",
"packages/bus/tests/schema.test.mjs",
"packages/bus/tests/sessions.test.mjs",
"packages/bus/tests/spec-migration.test.mjs",
"packages/bus/tests/tester-writes.test.mjs",
"packages/bus/tests/thread-claims.test.mjs",
"packages/bus/tests/thread-migration.test.mjs",
"packages/bus/tests/threads.test.mjs",
"packages/bus/tests/usage-migration.test.mjs",
"packages/cli/tests/case1-accept.test.mjs",
"packages/cli/tests/case2-unit.test.mjs",
"packages/cli/tests/lifecycle.test.mjs",
"packages/cli/tests/stack-release.test.mjs",
"packages/cli/tests/thread-cli.test.mjs",
"packages/cli/tests/thread-launch.test.mjs",
"packages/webui/tests/chat.test.mjs"
],
"shared_test_helpers": [
"packages/cli/tests/case-sudo-fixture.mjs"
],
"shared_fixture_artifacts": [
"packages/bus/tests/fixtures/schema-3k.sql"
],
"unchanged_runnable_blobs": [
"packages/cli/tests/case-sudo-fixture.mjs",
"packages/cli/tests/case1-accept.test.mjs",
"packages/cli/tests/case2-unit.test.mjs",
"packages/webui/README.md",
"scripts/case1-accept.sh",
"scripts/case2-unit.sh"
]
}
@@ -1,20 +0,0 @@
diff --git a/docs/plans/DEFERRED.md b/docs/plans/DEFERRED.md
index 4c0c736f1..020fd5b57 100644
--- a/docs/plans/DEFERRED.md
+++ b/docs/plans/DEFERRED.md
@@ -460,6 +460,15 @@ at every gate. Started 2026-09-12 during the control board MVP.
changes `packages/cli/tests/tester.test.mjs`: add the resolve pin so M8
dies on an assertion. (2026-10-22)
+- **Row 274's user reply check is scoped to the thread, not the session.**
+ (Row 264a r6, sage-2591.) In `packages/bus/src/broker.mjs`, the check that
+ a run answers a user only in reply to that user's message in its thread
+ joins `message_threads` by thread. That holds while a user's thread has
+ only its default session: a user can't call `session.create`, and
+ `#thread` refuses anyone but the owner. Binds row 272 (264e, #1777), or
+ any row that lets a user add sessions: make the check session-scoped and
+ test it with two sessions. (2026-10-22)
+
## Queue
Moved to `docs/plans/QUEUE.md` on 2026-09-13. This file holds only gaps.
@@ -1,68 +0,0 @@
[
{
"old": "a9c094d0657a52c22ba51b35e690868358cf2bd0",
"new": "0c44ba7c46103d4cb74de2a5393ce677a5010378",
"old_patch_id": "2b17f1d6773aa17909fc959081eec3f3821c3dee",
"new_patch_id": "2b17f1d6773aa17909fc959081eec3f3821c3dee"
},
{
"old": "2e81f78722ccd43d7524bb6a7d27d7ac26d0cea8",
"new": "a1f3b4f31b861e19b9a05189fb16692515819f5f",
"old_patch_id": "d597cc7402b568d845a87c1f142bde74ce6ae9da",
"new_patch_id": "d597cc7402b568d845a87c1f142bde74ce6ae9da"
},
{
"old": "3c8edc358c1f30ea7b5cc9a79d30282e59092715",
"new": "1ecc23eb1f0b68e8a940169a71b6d37f754a034c",
"old_patch_id": "899327761a9bde7e7b4fefd790c1a523488e8029",
"new_patch_id": "899327761a9bde7e7b4fefd790c1a523488e8029"
},
{
"old": "3114087efe655f1d38c5e30f8327f65980854043",
"new": "18523ce92db9b02fdc72d00999e04d4de8550d6a",
"old_patch_id": "38dcf7f0ec2a39bad2696d971a684a729b154747",
"new_patch_id": "38dcf7f0ec2a39bad2696d971a684a729b154747"
},
{
"old": "911e470b76d78e6a1ddd73c8e3e88a3ce821e43c",
"new": "7450fb71218e3736878d52bd7ce6a3a60ed531ba",
"old_patch_id": "1cf1916dab2a8552fadd07ce81246fce5f105b3d",
"new_patch_id": "1cf1916dab2a8552fadd07ce81246fce5f105b3d"
},
{
"old": "4a8b5c3ff98bfd9c31d6bfeb5356570df240e98c",
"new": "d202f6d631ccfe413621b6ef99d1c20f82578a0a",
"old_patch_id": "c93ea22b2651163be712ebb7ce96c8230ee41da8",
"new_patch_id": "c93ea22b2651163be712ebb7ce96c8230ee41da8"
},
{
"old": "e18b90e95dd928743c53d63449a82ffaffe360e8",
"new": "37c97b41d58b487f994591310383b48eec3383a9",
"old_patch_id": "aee9e5492bf07ee71687fd899c4e632bb36bc1e3",
"new_patch_id": "aee9e5492bf07ee71687fd899c4e632bb36bc1e3"
},
{
"old": "67776714515b562dd29a15d6a0a3bea9d642e6f2",
"new": "7bca9b042f245ff519ce58f57fbd57ce60359fbd",
"old_patch_id": "d2aecebf222474b0e06c5109b5f22caf768176ce",
"new_patch_id": "d2aecebf222474b0e06c5109b5f22caf768176ce"
},
{
"old": "c733371c5c297291b9d06c2dd2772e22670fe653",
"new": "3a2022038fa9fce043f7cf0e34b564ba3625e409",
"old_patch_id": "efb06f08af899d8f03390ab24ab65f6558cbae58",
"new_patch_id": "efb06f08af899d8f03390ab24ab65f6558cbae58"
},
{
"old": "141b79c293d78e78b9ce05bcf0fcaa18ba4d6963",
"new": "614bdc8e9b2692856972a252e4452c91990bc18b",
"old_patch_id": "e29f40a61cc88532701f0b063154a0cbe8d7ba7b",
"new_patch_id": "e29f40a61cc88532701f0b063154a0cbe8d7ba7b"
},
{
"old": "d213ef6514eb696df5c3e44eaa36d2385e2900ab",
"new": "b9d3d4c75c78aa6b06aefd734da781bef9b7f1da",
"old_patch_id": "afdf42b5115e72fb0aaaded10aed6617a1d68cd2",
"new_patch_id": "afdf42b5115e72fb0aaaded10aed6617a1d68cd2"
}
]
@@ -1,11 +0,0 @@
1: a9c094d06 = 1: 0c44ba7c4 gander: design tester socket migration for host scripts
2: 2e81f7872 = 2: a1f3b4f31 test: prepare row253 socket fixtures and fix gate collisions
3: 3c8edc358 = 3: 1ecc23eb1 docs: propose row253 C4 session supervisor and draft hop fake
4: 3114087ef = 4: 18523ce92 docs(row253): freeze C4 repair for static review
5: 911e470b7 = 5: 7450fb712 docs(row253): store repair patch without context whitespace
6: 4a8b5c3ff = 6: d202f6d63 fix(row253): supervise socket queries across sudo sessions
7: e18b90e95 = 7: 37c97b41d fix(row253): bound cleanup retries after initial inventory
8: 677767145 = 8: 7bca9b042 docs(row253): record static approval and pre-confirmation residual
9: c733371c5 = 9: 3a2022038 docs(row253): record integration onto refactor 378a76b85
10: 141b79c29 = 10: 614bdc8e9 docs(row253): integrate row191 base and refresh manifest
11: d213ef651 = 11: b9d3d4c75 docs(row253): integrate 385a base and record dependency drift and bounds
@@ -1,29 +0,0 @@
[
"packages/bus/tests/account-migration.test.mjs",
"packages/bus/tests/chief-of-staff.test.mjs",
"packages/bus/tests/comment-migration.test.mjs",
"packages/bus/tests/end-launch.test.mjs",
"packages/bus/tests/fire-revokes-grants.test.mjs",
"packages/bus/tests/gitea-grant.test.mjs",
"packages/bus/tests/gitea-migration.test.mjs",
"packages/bus/tests/grant-executor.test.mjs",
"packages/bus/tests/grant-migration.test.mjs",
"packages/bus/tests/lifecycle-revoke.test.mjs",
"packages/bus/tests/message-filter.test.mjs",
"packages/bus/tests/name-migration.test.mjs",
"packages/bus/tests/schema.test.mjs",
"packages/bus/tests/sessions.test.mjs",
"packages/bus/tests/spec-migration.test.mjs",
"packages/bus/tests/tester-writes.test.mjs",
"packages/bus/tests/thread-claims.test.mjs",
"packages/bus/tests/thread-migration.test.mjs",
"packages/bus/tests/threads.test.mjs",
"packages/bus/tests/usage-migration.test.mjs",
"packages/cli/tests/case1-accept.test.mjs",
"packages/cli/tests/case2-unit.test.mjs",
"packages/cli/tests/lifecycle.test.mjs",
"packages/cli/tests/stack-release.test.mjs",
"packages/cli/tests/thread-cli.test.mjs",
"packages/cli/tests/thread-launch.test.mjs",
"packages/webui/tests/chat.test.mjs"
]
@@ -1,164 +0,0 @@
{
"packages/cli/tests/case1-accept.test.mjs": {
"timeout_seconds": 900,
"kill_after_seconds": 10,
"outer_harness_seconds": 930,
"reason": "sage-2709: six CLI whole files use900s; measured durations establish later3x basis."
},
"packages/cli/tests/case2-unit.test.mjs": {
"timeout_seconds": 900,
"kill_after_seconds": 10,
"outer_harness_seconds": 930,
"reason": "sage-2709: six CLI whole files use900s; measured durations establish later3x basis."
},
"packages/bus/tests/account-migration.test.mjs": {
"timeout_seconds": 300,
"kill_after_seconds": 10,
"outer_harness_seconds": 330,
"reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
},
"packages/bus/tests/chief-of-staff.test.mjs": {
"timeout_seconds": 300,
"kill_after_seconds": 10,
"outer_harness_seconds": 330,
"reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
},
"packages/bus/tests/comment-migration.test.mjs": {
"timeout_seconds": 300,
"kill_after_seconds": 10,
"outer_harness_seconds": 330,
"reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
},
"packages/bus/tests/end-launch.test.mjs": {
"timeout_seconds": 300,
"kill_after_seconds": 10,
"outer_harness_seconds": 330,
"reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
},
"packages/bus/tests/fire-revokes-grants.test.mjs": {
"timeout_seconds": 300,
"kill_after_seconds": 10,
"outer_harness_seconds": 330,
"reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
},
"packages/bus/tests/gitea-grant.test.mjs": {
"timeout_seconds": 300,
"kill_after_seconds": 10,
"outer_harness_seconds": 330,
"reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
},
"packages/bus/tests/gitea-migration.test.mjs": {
"timeout_seconds": 300,
"kill_after_seconds": 10,
"outer_harness_seconds": 330,
"reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
},
"packages/bus/tests/grant-executor.test.mjs": {
"timeout_seconds": 300,
"kill_after_seconds": 10,
"outer_harness_seconds": 330,
"reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
},
"packages/bus/tests/grant-migration.test.mjs": {
"timeout_seconds": 300,
"kill_after_seconds": 10,
"outer_harness_seconds": 330,
"reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
},
"packages/bus/tests/lifecycle-revoke.test.mjs": {
"timeout_seconds": 300,
"kill_after_seconds": 10,
"outer_harness_seconds": 330,
"reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
},
"packages/bus/tests/message-filter.test.mjs": {
"timeout_seconds": 300,
"kill_after_seconds": 10,
"outer_harness_seconds": 330,
"reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
},
"packages/bus/tests/name-migration.test.mjs": {
"timeout_seconds": 300,
"kill_after_seconds": 10,
"outer_harness_seconds": 330,
"reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
},
"packages/bus/tests/schema.test.mjs": {
"timeout_seconds": 300,
"kill_after_seconds": 10,
"outer_harness_seconds": 330,
"reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
},
"packages/bus/tests/sessions.test.mjs": {
"timeout_seconds": 300,
"kill_after_seconds": 10,
"outer_harness_seconds": 330,
"reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
},
"packages/bus/tests/spec-migration.test.mjs": {
"timeout_seconds": 300,
"kill_after_seconds": 10,
"outer_harness_seconds": 330,
"reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
},
"packages/bus/tests/tester-writes.test.mjs": {
"timeout_seconds": 300,
"kill_after_seconds": 10,
"outer_harness_seconds": 330,
"reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
},
"packages/bus/tests/thread-claims.test.mjs": {
"timeout_seconds": 300,
"kill_after_seconds": 10,
"outer_harness_seconds": 330,
"reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
},
"packages/bus/tests/thread-migration.test.mjs": {
"timeout_seconds": 300,
"kill_after_seconds": 10,
"outer_harness_seconds": 330,
"reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
},
"packages/bus/tests/threads.test.mjs": {
"timeout_seconds": 300,
"kill_after_seconds": 10,
"outer_harness_seconds": 330,
"reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
},
"packages/bus/tests/usage-migration.test.mjs": {
"timeout_seconds": 300,
"kill_after_seconds": 10,
"outer_harness_seconds": 330,
"reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
},
"packages/cli/tests/lifecycle.test.mjs": {
"timeout_seconds": 900,
"kill_after_seconds": 10,
"outer_harness_seconds": 930,
"reason": "sage-2709: six CLI whole files use900s; measured durations establish later3x basis."
},
"packages/cli/tests/stack-release.test.mjs": {
"timeout_seconds": 900,
"kill_after_seconds": 10,
"outer_harness_seconds": 930,
"reason": "sage-2709: six CLI whole files use900s; measured durations establish later3x basis."
},
"packages/cli/tests/thread-cli.test.mjs": {
"timeout_seconds": 900,
"kill_after_seconds": 10,
"outer_harness_seconds": 930,
"reason": "sage-2709: six CLI whole files use900s; measured durations establish later3x basis."
},
"packages/cli/tests/thread-launch.test.mjs": {
"timeout_seconds": 900,
"kill_after_seconds": 10,
"outer_harness_seconds": 930,
"reason": "sage-2709: six CLI whole files use900s; measured durations establish later3x basis."
},
"packages/webui/tests/chat.test.mjs": {
"timeout_seconds": 300,
"kill_after_seconds": 10,
"outer_harness_seconds": 330,
"reason": "Whole-file bound under sage-2705; no prior repaired-C4 whole-file timing claimed."
}
}
@@ -1,15 +0,0 @@
# Row253 final base and pre-gate scope
Authority sage-2705. New branch gander/row253-aca1 on aca16404cf522b03f39acaf140e4f6185a507b88. Rebased source tip ed3bb376cdd5128dc58b3aa193282e1c2bfcf57d. Thirteen commits replayed from b78918850..288cdecf6; all thirteen final-hop range-diff pairs equal, no conflict. Earlier branches remain. The requested comparison from d213ef651 is range-diff-from-d213.txt; the two extra interim packet commits have no old counterpart, and the original BUILD-LOG context changes are documented in integration-b789/.
Seven manifest blobs are byte-identical to288cdecf6. Digest573c51cf72f2398532a6ea768536f04e3c1681997cb8b9a6f14a8aef884870ae. All seven sha256sum checks pass. Both append-only paths keep the entire final base as exact byte prefix. Final-hop upstream changes only Gizmoduck BUILD and queue JSON/rendering; none is a253 focused read or pinned asset. The earlier264a Store/schema dependency is present on the base and is covered by whole-file scope.
Duckworth's requested prefix-resolution material remains in integration-b789/NOTES.md, manifest-drift.diff and whole-test-union.json. This folder's drift is385a7194c..finalbase on the manifest paths and its whole union was independently recomputed:27 runnable files, unchanged from interim. Fixtures are exercised through importers, not represented as standalone tests. N9 is the exact sandbox bind case in case2; report its runtime skip reason verbatim.
## Bounds written before any run
Step2 runs all27 files whole, own case1/case2 first, then remaining sorted paths. Every call is timeout -k10 300 node --test --test-reporter=tap FILE; Python harness outer wait330s is a fallback. FILE-LIMITS.json records every file. Busy check gates each start, pipefail and tee capture raw logs and structured command JSONs. Any timeout is a stop, never a kill/pass; any unexpected red stops with no retry. Print HEAD and manifest digest first. No run starts before focused CLEAR. Expected duration10-15min; status every15min and immediate stop report.
The later whole gate remains separately gated. Every whole shell uses SHELL-LIMITS.json (ceil3xmax+120), recorded in BUILD.md. Script bytes unchanged; no no-record case, so900 fallback unused. Whole CLI needs a separately stated bound in its whole-gate plan because the historical whole result took597s; a300s file limit is not a claim about full-suite runtime. No carried results. No product/test/assertion changed during final integration.
No tests, Node, syntax commands, browser, probe, queue write or push have run while writing this packet. Publishing is authorized by sage-2705 after this record is committed. The next action is request focused CLEAR, then27 whole files, Duckworth rebase check and later whole-gate CLEAR.
@@ -1,18 +0,0 @@
{
"authority": "sage-2705",
"base": "aca16404cf522b03f39acaf140e4f6185a507b88",
"source_tip": "ed3bb376cdd5128dc58b3aa193282e1c2bfcf57d",
"branch": "gander/row253-aca1",
"manifest": "573c51cf72f2398532a6ea768536f04e3c1681997cb8b9a6f14a8aef884870ae",
"final_hop_paths": [
"agents/gizmoduck/work/queue-264/BUILD.md",
"docs/plans/QUEUE.md",
"docs/plans/queue.json"
],
"final_hop_conflicts": [],
"manifest_unchanged": true,
"all_7_blobs_equal_b789": true,
"append_prefix_checks": true,
"test_union_count": 27,
"tests_run": false
}
@@ -1,78 +0,0 @@
diff --git a/docs/plans/DEFERRED.md b/docs/plans/DEFERRED.md
index 4c0c736f1..f990eb3a9 100644
--- a/docs/plans/DEFERRED.md
+++ b/docs/plans/DEFERRED.md
@@ -431,17 +431,6 @@ at every gate. Started 2026-09-12 during the control board MVP.
comes near 64 runs. The follow-up row either raises the cap or splits
the done. Its test: a fire's done over the cap refuses, and the runs it
left alive still get the alive flag. (2026-10-22)
-- **A fired or deleted instance keeps its grants.** (Dewey on the row 236
- rebase look, dewey-0815; Mos mos-1271; Sage sage-2558.) Row 194's
- `instance.fire` and row 256's delete revoke only the roles entry's
- credential services through `revoke()` in `runtime.mjs`. The agent's
- host grants (row 235) and its Gitea user and token (row 236) stay live
- until a human runs `mosaic hosts revoke` or `mosaic grants revoke`. The
- Console has no revoke route and doesn't say a grant is left. Row 281
- (#1786) closes it: a fire or a delete revokes every host and Gitea grant
- the instance holds, fail closed, with a test for each kind. It lands
- before the .53 Case 1 install hires an instance with a grant.
- (2026-10-22)
- **The runs suite doesn't gate a change to `scripts/mosaic-task.mjs`.**
(Dewey N7 on row 191, repeated on the Vikunja 502 review.)
@@ -460,6 +449,44 @@ at every gate. Started 2026-09-12 during the control board MVP.
changes `packages/cli/tests/tester.test.mjs`: add the resolve pin so M8
dies on an assertion. (2026-10-22)
+- **Row 274's user reply check is scoped to the thread, not the session.**
+ (Row 264a r6, sage-2591.) In `packages/bus/src/broker.mjs`, the check that
+ a run answers a user only in reply to that user's message in its thread
+ joins `message_threads` by thread. That holds while a user's thread has
+ only its default session: a user can't call `session.create`, and
+ `#thread` refuses anyone but the owner. Binds row 272 (264e, #1777), or
+ any row that lets a user add sessions: make the check session-scoped and
+ test it with two sessions. (2026-10-22)
+
+- **Row 281's refusal texts point the wrong way.** (Dewey N1 and N2 on
+ the row 281 manifest round, dewey-0842/0843 and dewey-0846; Sage
+ sage-2653.) N1: when a host decision is still open and the host is
+ removed, step G's fire or delete job refuses `host-unknown`, and the
+ inbox hint names a verb that can't help. The way out is to decline or
+ withdraw the decision (`packages/bus/src/broker.mjs`, the closed check
+ near :1684 and `decision.withdraw` near :5015). T14 now pins that path.
+ N2: the chief's fire tool text in `packages/harness/src/tools.mjs`
+ (near :186) doesn't say the fire's job can come back for an answer.
+ Neither changes behaviour. Binds the next row that changes the step G
+ hint text in `broker.mjs` or the fire tool text in `tools.mjs`: fix
+ both wording gaps and pin the hint in a test. (2026-10-22)
+
+- **Row 264a's refusal check in sessions.test doesn't pin the actor.**
+ (Duckworth N1 on the row 264a r12 delta, duckworth-0138; Sage sage-2695.)
+ `refusedOnce` in `packages/bus/tests/sessions.test.mjs` checks that each
+ refused call adds one `action.refused` event with code `not-holder`, but
+ not that the event's `actor_run` is the refused run. Binds row 269 (264b,
+ #1774), or the next row that changes `sessions.test.mjs`: pin `actor_run`
+ in `refusedOnce`. (2026-10-22)
+
+- **editor-provenance skips its rebuild check on esbuild 0.28.1.** (Duckworth
+ N2 on the row 264a manifest round, duckworth-0146.) The webui test
+ "rebuilding from the source gives the same bytes" needs esbuild 0.28.2,
+ the checkout has 0.28.1, and the gate logs a skip (webui.log:99). The file
+ is at base and was not in 264a's manifest. Binds the next gate that
+ touches the webui build: install the pinned esbuild in the gate checkout
+ so the check runs, or record why it can't. (2026-10-22)
+
## Queue
Moved to `docs/plans/QUEUE.md` on 2026-09-13. This file holds only gaps.
@@ -531,3 +558,10 @@ Moved to `docs/plans/QUEUE.md` on 2026-09-13. This file holds only gaps.
`packages/cli/tests/gate-lane-auth.test.mjs` proves no gate step mounts
the host default. The real-model cases this moved off the gate are open
above.
+- A fired or deleted instance kept its grants (2026-10-22, Dewey on the
+ row 236 rebase look, mos-1271): closed by row 281 (#1786), landing
+ e479521d3. A fire or a delete now runs a step G job that revokes every
+ host and Gitea grant the instance holds, fail closed, and tells the
+ human in the inbox when it can't. Megavolt built it; Dewey approved the
+ design (d6) and the manifest (c30614). The text gaps it left are open
+ above.
@@ -1,13 +0,0 @@
1: e8b096948 = 1: 730a78aa9 gander: design tester socket migration for host scripts
2: 0d7f9da11 = 2: 643d16528 test: prepare row253 socket fixtures and fix gate collisions
3: 7c1fcbd96 = 3: 6f320b4b0 docs: propose row253 C4 session supervisor and draft hop fake
4: 565302e71 = 4: 62de84882 docs(row253): freeze C4 repair for static review
5: bcf4e2501 = 5: c8cca3a68 docs(row253): store repair patch without context whitespace
6: f2c594d7b = 6: cca936716 fix(row253): supervise socket queries across sudo sessions
7: 29d5f0d5e = 7: 950cf47f3 fix(row253): bound cleanup retries after initial inventory
8: e24d7b559 = 8: 3b142c9c6 docs(row253): record static approval and pre-confirmation residual
9: 94c2b76b8 = 9: ad67d9595 docs(row253): record integration onto refactor 378a76b85
10: 049088866 = 10: 72b17562d docs(row253): integrate row191 base and refresh manifest
11: 7916f0ee6 = 11: e75ef1b19 docs(row253): integrate 385a base and record dependency drift and bounds
12: c75c9bbd3 = 12: cd269e733 docs(row253): record schema3l integration before final base correction
13: 288cdecf6 = 13: ed3bb376c docs(row253): preserve doc sweep appends on corrected interim base
@@ -1,50 +0,0 @@
1: a9c094d06 ! 1: 730a78aa9 gander: design tester socket migration for host scripts
@@ Commit message
gander: design tester socket migration for host scripts
## BUILD-LOG.md ##
-@@ BUILD-LOG.md: Before: managed project/thread verbs had no Console conversation area. After: fi
- ### 2026-10-22 | Gander | row278 gate run3
+@@ BUILD-LOG.md: Fresh gate on3e4c77ac6 under sage-2648: bus793/0, WebUI345/0/1 (esbuild version
+ 2026-10-22 13:10 UTC | Sage | Rows 278 and 281 LANDED. Before: refactor at 6af85df4b (V502). Row 278 (#1783, Gander, Webby): the Console Agents view shows thread claims in their own section. It landed as 385a7194c at 12:39Z, ff, 9 commits, manifest 8fa859a0. Run 3 was green: bus 793, webui 345/0/1, ten shells 425/0 under the 3x limits (mos-1275), M1-M6 killed. Runs 1 and 2 were void, on fixture fixes 964b6b184 (placed by Sage) and 9696d1fcb (ruled by Mos, mos-1275). Webby approved (c30588, rev 3200). Done rev 3202, #1783 closed c30589. Row 281 (#1786, Megavolt, Dewey): a fire or a delete revokes the instance's host and Gitea grants. It landed as e479521d3 at 13:06Z, ff, 17 commits, manifest b73d4c81. Slot on 7979fb41e: bus 819, business 231, cli 837, dewey-bus 76 with the Docker gitea-grant test, shells green, M1-M22 killed. The M1 hang was fixed at its cause in b4a (mos-1273). Dewey approved (c30614, rev 3207). Done rev 3209, #1786 closed c30621. Skips on both: test-task's row 244 live-provider pair and test-queue's canonical-root check, plus webui's esbuild rebuild test on 278. After: refactor at e479521d3. DEFERRED moves the grant gap to Done and opens Dewey's N1/N2 text gaps. LIVE is still 86f95bb27.
- Fresh gate on3e4c77ac6 under sage-2648: bus793/0, WebUI345/0/1 (esbuild version skip), all ten shell files425/0, touched files15/0, M1-M6 killed6/6. No timeout; sweep0 run-created leftovers. Runs1/2 void. Seven-path manifest8fa859a0 goes to Webby for final review. No landing or live change.
+ 2026-10-22 14:18:23 UTC | Sage | Row 264a LANDED (#1769, Gizmoduck, Duckworth): sessions per thread, schema 3k-3l. Before: refactor at e479521d3 (row 281). It landed as 84f53540d, ff, 21 commits, manifest 257408e9 (Duckworth approve rev 3214, comment 30640). Gate r13 on 2cc34aef8: 20 touched files, bus 827, cli 837, webui 345/1 named skip, ten shells under 3x limits, mutants M1-M4 killed on assertions. Corrections on the way: the kit stopped on first red, so four reds surfaced one at a time. r10 later3l missed a trigger (mos-1276). T2 had failed since r2 because refusals log action.refused (mos-1277, my sage-2257 wording). threads.test:341 kept the old trigger text (mos-1278). M2 was caught by the store trigger before any assertion, so it now drops the trigger too (mos-1279, four files with the SCHEMA_SHA256 pin). Deferred: actor_run pin binds row 269, esbuild skip to a later gate, session-scoped user reply binds row 272. No live change; LIVE is still 86f95bb27.
+2026-10-21 21:24:47 UTC | Gander row253 #1758 design r1 | Investigation began21:12Z under sage-2162; recorded now. Before: case2 installer still renders tester TCP and case1 acceptance requires it. After: proposed design covers socket marker migration, actual configured dataRoot within unchanged hardening, target-uid metadata queries, kernel-peer acceptance observation and explicit same-uid residual. Initial inventory saved; no passing final static-check claim, product edit, test, host or live action. Duckworth design review precedes code.
## agents/gander/work/queue-253/BASE-PORT-INVENTORY.json (new) ##
2: 2e81f7872 = 2: 643d16528 test: prepare row253 socket fixtures and fix gate collisions
3: 3c8edc358 = 3: 6f320b4b0 docs: propose row253 C4 session supervisor and draft hop fake
4: 3114087ef = 4: 62de84882 docs(row253): freeze C4 repair for static review
5: 911e470b7 = 5: c8cca3a68 docs(row253): store repair patch without context whitespace
6: 4a8b5c3ff ! 6: cca936716 fix(row253): supervise socket queries across sudo sessions
@@ Commit message
fix(row253): supervise socket queries across sudo sessions
## BUILD-LOG.md ##
-@@ BUILD-LOG.md: Before: managed project/thread verbs had no Console conversation area. After: fi
+@@ BUILD-LOG.md: Fresh gate on3e4c77ac6 under sage-2648: bus793/0, WebUI345/0/1 (esbuild version
- Fresh gate on3e4c77ac6 under sage-2648: bus793/0, WebUI345/0/1 (esbuild version skip), all ten shell files425/0, touched files15/0, M1-M6 killed6/6. No timeout; sweep0 run-created leftovers. Runs1/2 void. Seven-path manifest8fa859a0 goes to Webby for final review. No landing or live change.
+ 2026-10-22 14:18:23 UTC | Sage | Row 264a LANDED (#1769, Gizmoduck, Duckworth): sessions per thread, schema 3k-3l. Before: refactor at e479521d3 (row 281). It landed as 84f53540d, ff, 21 commits, manifest 257408e9 (Duckworth approve rev 3214, comment 30640). Gate r13 on 2cc34aef8: 20 touched files, bus 827, cli 837, webui 345/1 named skip, ten shells under 3x limits, mutants M1-M4 killed on assertions. Corrections on the way: the kit stopped on first red, so four reds surfaced one at a time. r10 later3l missed a trigger (mos-1276). T2 had failed since r2 because refusals log action.refused (mos-1277, my sage-2257 wording). threads.test:341 kept the old trigger text (mos-1278). M2 was caught by the store trigger before any assertion, so it now drops the trigger too (mos-1279, four files with the SCHEMA_SHA256 pin). Deferred: actor_run pin binds row 269, esbuild skip to a later gate, session-scoped user reply binds row 272. No live change; LIVE is still 86f95bb27.
2026-10-21 21:24:47 UTC | Gander row253 #1758 design r1 | Investigation began21:12Z under sage-2162; recorded now. Before: case2 installer still renders tester TCP and case1 acceptance requires it. After: proposed design covers socket marker migration, actual configured dataRoot within unchanged hardening, target-uid metadata queries, kernel-peer acceptance observation and explicit same-uid residual. Initial inventory saved; no passing final static-check claim, product edit, test, host or live action. Duckworth design review precedes code.
+
+### 2026-10-21 row253 implementation prepared, gate pending
@@ agents/gander/work/queue-253/MANIFEST.sha256 (new)
## docs/plans/DEFERRED.md ##
@@ docs/plans/DEFERRED.md: Moved to `docs/plans/QUEUE.md` on 2026-09-13. This file holds only gaps.
- `packages/cli/tests/gate-lane-auth.test.mjs` proves no gate step mounts
- the host default. The real-model cases this moved off the gate are open
+ human in the inbox when it can't. Megavolt built it; Dewey approved the
+ design (d6) and the manifest (c30614). The text gaps it left are open
above.
+
+## Row253 F5: legacy Case AS_USER supervision
7: e18b90e95 = 7: 950cf47f3 fix(row253): bound cleanup retries after initial inventory
8: 677767145 = 8: 3b142c9c6 docs(row253): record static approval and pre-confirmation residual
9: c733371c5 = 9: ad67d9595 docs(row253): record integration onto refactor 378a76b85
10: 141b79c29 = 10: 72b17562d docs(row253): integrate row191 base and refresh manifest
11: d213ef651 = 11: e75ef1b19 docs(row253): integrate 385a base and record dependency drift and bounds
-: --------- > 12: cd269e733 docs(row253): record schema3l integration before final base correction
-: --------- > 13: ed3bb376c docs(row253): preserve doc sweep appends on corrected interim base
@@ -1,29 +0,0 @@
[
"packages/cli/tests/case1-accept.test.mjs",
"packages/cli/tests/case2-unit.test.mjs",
"packages/bus/tests/account-migration.test.mjs",
"packages/bus/tests/chief-of-staff.test.mjs",
"packages/bus/tests/comment-migration.test.mjs",
"packages/bus/tests/end-launch.test.mjs",
"packages/bus/tests/fire-revokes-grants.test.mjs",
"packages/bus/tests/gitea-grant.test.mjs",
"packages/bus/tests/gitea-migration.test.mjs",
"packages/bus/tests/grant-executor.test.mjs",
"packages/bus/tests/grant-migration.test.mjs",
"packages/bus/tests/lifecycle-revoke.test.mjs",
"packages/bus/tests/message-filter.test.mjs",
"packages/bus/tests/name-migration.test.mjs",
"packages/bus/tests/schema.test.mjs",
"packages/bus/tests/sessions.test.mjs",
"packages/bus/tests/spec-migration.test.mjs",
"packages/bus/tests/tester-writes.test.mjs",
"packages/bus/tests/thread-claims.test.mjs",
"packages/bus/tests/thread-migration.test.mjs",
"packages/bus/tests/threads.test.mjs",
"packages/bus/tests/usage-migration.test.mjs",
"packages/cli/tests/lifecycle.test.mjs",
"packages/cli/tests/stack-release.test.mjs",
"packages/cli/tests/thread-cli.test.mjs",
"packages/cli/tests/thread-launch.test.mjs",
"packages/webui/tests/chat.test.mjs"
]
@@ -1,5 +0,0 @@
# Row253 corrected base, pending final docs tip
Sage2700 moves the base tob78918850;2702 says one docs-only Gizmoduck BUILD commit still lands. Rebased on new branch gander/row253-b789, preserving gander/row253-264a. Resolved only BUILD-LOG and DEFERRED append conflicts, keeping every upstream entry first, then253. Both current files retain the full base blobs as exact byte prefixes. No source/test/assertion change.
Source tipc75c9bbd3339cb2343467715a14455044c2e4aea, manifest573c51cf72f2398532a6ea768536f04e3c1681997cb8b9a6f14a8aef884870ae. Six manifest blobs remain identical to the prior integration; DEFERRED absorbs the doc sweep. Runnable blobs match Duckworth-approved preview. The27-file union is unchanged. SHELL-LIMITS and script bytes are unchanged. No tests, Node, syntax execution, queue command, helper push or host action. Hold locally until Sage names final tip; then another rebase, no force-push, and focused CLEAR before any test.
@@ -1,53 +0,0 @@
{
"authority": [
"sage-2700",
"sage-2702"
],
"base": "b78918850",
"tip": "c75c9bbd3339cb2343467715a14455044c2e4aea",
"manifest": "573c51cf72f2398532a6ea768536f04e3c1681997cb8b9a6f14a8aef884870ae",
"conflicts": [
"BUILD-LOG.md first design append",
"docs/plans/DEFERRED.md first F5 append"
],
"resolution": "Kept upstream exact byte prefix then appended253; later253 appends replayed. No existing entry edited/dropped.",
"unchanged_runnable_paths": [
"packages/cli/tests/case-sudo-fixture.mjs",
"packages/cli/tests/case1-accept.test.mjs",
"packages/cli/tests/case2-unit.test.mjs",
"scripts/case1-accept.sh",
"scripts/case2-unit.sh"
],
"whole_test_files": [
"packages/bus/tests/account-migration.test.mjs",
"packages/bus/tests/chief-of-staff.test.mjs",
"packages/bus/tests/comment-migration.test.mjs",
"packages/bus/tests/end-launch.test.mjs",
"packages/bus/tests/fire-revokes-grants.test.mjs",
"packages/bus/tests/gitea-grant.test.mjs",
"packages/bus/tests/gitea-migration.test.mjs",
"packages/bus/tests/grant-executor.test.mjs",
"packages/bus/tests/grant-migration.test.mjs",
"packages/bus/tests/lifecycle-revoke.test.mjs",
"packages/bus/tests/message-filter.test.mjs",
"packages/bus/tests/name-migration.test.mjs",
"packages/bus/tests/schema.test.mjs",
"packages/bus/tests/sessions.test.mjs",
"packages/bus/tests/spec-migration.test.mjs",
"packages/bus/tests/tester-writes.test.mjs",
"packages/bus/tests/thread-claims.test.mjs",
"packages/bus/tests/thread-migration.test.mjs",
"packages/bus/tests/threads.test.mjs",
"packages/bus/tests/usage-migration.test.mjs",
"packages/cli/tests/case1-accept.test.mjs",
"packages/cli/tests/case2-unit.test.mjs",
"packages/cli/tests/lifecycle.test.mjs",
"packages/cli/tests/stack-release.test.mjs",
"packages/cli/tests/thread-cli.test.mjs",
"packages/cli/tests/thread-launch.test.mjs",
"packages/webui/tests/chat.test.mjs"
],
"tests_run": false,
"published": false,
"next": "Wait final docs-only tip, rebase on a new name, publish when authorized, ask focused CLEAR. No test before CLEAR."
}
@@ -1,78 +0,0 @@
diff --git a/docs/plans/DEFERRED.md b/docs/plans/DEFERRED.md
index 4c0c736f1..f990eb3a9 100644
--- a/docs/plans/DEFERRED.md
+++ b/docs/plans/DEFERRED.md
@@ -431,17 +431,6 @@ at every gate. Started 2026-09-12 during the control board MVP.
comes near 64 runs. The follow-up row either raises the cap or splits
the done. Its test: a fire's done over the cap refuses, and the runs it
left alive still get the alive flag. (2026-10-22)
-- **A fired or deleted instance keeps its grants.** (Dewey on the row 236
- rebase look, dewey-0815; Mos mos-1271; Sage sage-2558.) Row 194's
- `instance.fire` and row 256's delete revoke only the roles entry's
- credential services through `revoke()` in `runtime.mjs`. The agent's
- host grants (row 235) and its Gitea user and token (row 236) stay live
- until a human runs `mosaic hosts revoke` or `mosaic grants revoke`. The
- Console has no revoke route and doesn't say a grant is left. Row 281
- (#1786) closes it: a fire or a delete revokes every host and Gitea grant
- the instance holds, fail closed, with a test for each kind. It lands
- before the .53 Case 1 install hires an instance with a grant.
- (2026-10-22)
- **The runs suite doesn't gate a change to `scripts/mosaic-task.mjs`.**
(Dewey N7 on row 191, repeated on the Vikunja 502 review.)
@@ -460,6 +449,44 @@ at every gate. Started 2026-09-12 during the control board MVP.
changes `packages/cli/tests/tester.test.mjs`: add the resolve pin so M8
dies on an assertion. (2026-10-22)
+- **Row 274's user reply check is scoped to the thread, not the session.**
+ (Row 264a r6, sage-2591.) In `packages/bus/src/broker.mjs`, the check that
+ a run answers a user only in reply to that user's message in its thread
+ joins `message_threads` by thread. That holds while a user's thread has
+ only its default session: a user can't call `session.create`, and
+ `#thread` refuses anyone but the owner. Binds row 272 (264e, #1777), or
+ any row that lets a user add sessions: make the check session-scoped and
+ test it with two sessions. (2026-10-22)
+
+- **Row 281's refusal texts point the wrong way.** (Dewey N1 and N2 on
+ the row 281 manifest round, dewey-0842/0843 and dewey-0846; Sage
+ sage-2653.) N1: when a host decision is still open and the host is
+ removed, step G's fire or delete job refuses `host-unknown`, and the
+ inbox hint names a verb that can't help. The way out is to decline or
+ withdraw the decision (`packages/bus/src/broker.mjs`, the closed check
+ near :1684 and `decision.withdraw` near :5015). T14 now pins that path.
+ N2: the chief's fire tool text in `packages/harness/src/tools.mjs`
+ (near :186) doesn't say the fire's job can come back for an answer.
+ Neither changes behaviour. Binds the next row that changes the step G
+ hint text in `broker.mjs` or the fire tool text in `tools.mjs`: fix
+ both wording gaps and pin the hint in a test. (2026-10-22)
+
+- **Row 264a's refusal check in sessions.test doesn't pin the actor.**
+ (Duckworth N1 on the row 264a r12 delta, duckworth-0138; Sage sage-2695.)
+ `refusedOnce` in `packages/bus/tests/sessions.test.mjs` checks that each
+ refused call adds one `action.refused` event with code `not-holder`, but
+ not that the event's `actor_run` is the refused run. Binds row 269 (264b,
+ #1774), or the next row that changes `sessions.test.mjs`: pin `actor_run`
+ in `refusedOnce`. (2026-10-22)
+
+- **editor-provenance skips its rebuild check on esbuild 0.28.1.** (Duckworth
+ N2 on the row 264a manifest round, duckworth-0146.) The webui test
+ "rebuilding from the source gives the same bytes" needs esbuild 0.28.2,
+ the checkout has 0.28.1, and the gate logs a skip (webui.log:99). The file
+ is at base and was not in 264a's manifest. Binds the next gate that
+ touches the webui build: install the pinned esbuild in the gate checkout
+ so the check runs, or record why it can't. (2026-10-22)
+
## Queue
Moved to `docs/plans/QUEUE.md` on 2026-09-13. This file holds only gaps.
@@ -531,3 +558,10 @@ Moved to `docs/plans/QUEUE.md` on 2026-09-13. This file holds only gaps.
`packages/cli/tests/gate-lane-auth.test.mjs` proves no gate step mounts
the host default. The real-model cases this moved off the gate are open
above.
+- A fired or deleted instance kept its grants (2026-10-22, Dewey on the
+ row 236 rebase look, mos-1271): closed by row 281 (#1786), landing
+ e479521d3. A fire or a delete now runs a step G job that revokes every
+ host and Gitea grant the instance holds, fail closed, and tells the
+ human in the inbox when it can't. Megavolt built it; Dewey approved the
+ design (d6) and the manifest (c30614). The text gaps it left are open
+ above.
@@ -1,49 +0,0 @@
1: 0c44ba7c4 ! 1: e8b096948 gander: design tester socket migration for host scripts
@@ Commit message
gander: design tester socket migration for host scripts
## BUILD-LOG.md ##
-@@ BUILD-LOG.md: Before: managed project/thread verbs had no Console conversation area. After: fi
- ### 2026-10-22 | Gander | row278 gate run3
+@@ BUILD-LOG.md: Fresh gate on3e4c77ac6 under sage-2648: bus793/0, WebUI345/0/1 (esbuild version
+ 2026-10-22 13:10 UTC | Sage | Rows 278 and 281 LANDED. Before: refactor at 6af85df4b (V502). Row 278 (#1783, Gander, Webby): the Console Agents view shows thread claims in their own section. It landed as 385a7194c at 12:39Z, ff, 9 commits, manifest 8fa859a0. Run 3 was green: bus 793, webui 345/0/1, ten shells 425/0 under the 3x limits (mos-1275), M1-M6 killed. Runs 1 and 2 were void, on fixture fixes 964b6b184 (placed by Sage) and 9696d1fcb (ruled by Mos, mos-1275). Webby approved (c30588, rev 3200). Done rev 3202, #1783 closed c30589. Row 281 (#1786, Megavolt, Dewey): a fire or a delete revokes the instance's host and Gitea grants. It landed as e479521d3 at 13:06Z, ff, 17 commits, manifest b73d4c81. Slot on 7979fb41e: bus 819, business 231, cli 837, dewey-bus 76 with the Docker gitea-grant test, shells green, M1-M22 killed. The M1 hang was fixed at its cause in b4a (mos-1273). Dewey approved (c30614, rev 3207). Done rev 3209, #1786 closed c30621. Skips on both: test-task's row 244 live-provider pair and test-queue's canonical-root check, plus webui's esbuild rebuild test on 278. After: refactor at e479521d3. DEFERRED moves the grant gap to Done and opens Dewey's N1/N2 text gaps. LIVE is still 86f95bb27.
- Fresh gate on3e4c77ac6 under sage-2648: bus793/0, WebUI345/0/1 (esbuild version skip), all ten shell files425/0, touched files15/0, M1-M6 killed6/6. No timeout; sweep0 run-created leftovers. Runs1/2 void. Seven-path manifest8fa859a0 goes to Webby for final review. No landing or live change.
+ 2026-10-22 14:18:23 UTC | Sage | Row 264a LANDED (#1769, Gizmoduck, Duckworth): sessions per thread, schema 3k-3l. Before: refactor at e479521d3 (row 281). It landed as 84f53540d, ff, 21 commits, manifest 257408e9 (Duckworth approve rev 3214, comment 30640). Gate r13 on 2cc34aef8: 20 touched files, bus 827, cli 837, webui 345/1 named skip, ten shells under 3x limits, mutants M1-M4 killed on assertions. Corrections on the way: the kit stopped on first red, so four reds surfaced one at a time. r10 later3l missed a trigger (mos-1276). T2 had failed since r2 because refusals log action.refused (mos-1277, my sage-2257 wording). threads.test:341 kept the old trigger text (mos-1278). M2 was caught by the store trigger before any assertion, so it now drops the trigger too (mos-1279, four files with the SCHEMA_SHA256 pin). Deferred: actor_run pin binds row 269, esbuild skip to a later gate, session-scoped user reply binds row 272. No live change; LIVE is still 86f95bb27.
+2026-10-21 21:24:47 UTC | Gander row253 #1758 design r1 | Investigation began21:12Z under sage-2162; recorded now. Before: case2 installer still renders tester TCP and case1 acceptance requires it. After: proposed design covers socket marker migration, actual configured dataRoot within unchanged hardening, target-uid metadata queries, kernel-peer acceptance observation and explicit same-uid residual. Initial inventory saved; no passing final static-check claim, product edit, test, host or live action. Duckworth design review precedes code.
## agents/gander/work/queue-253/BASE-PORT-INVENTORY.json (new) ##
2: a1f3b4f31 = 2: 0d7f9da11 test: prepare row253 socket fixtures and fix gate collisions
3: 1ecc23eb1 = 3: 7c1fcbd96 docs: propose row253 C4 session supervisor and draft hop fake
4: 18523ce92 = 4: 565302e71 docs(row253): freeze C4 repair for static review
5: 7450fb712 = 5: bcf4e2501 docs(row253): store repair patch without context whitespace
6: d202f6d63 ! 6: f2c594d7b fix(row253): supervise socket queries across sudo sessions
@@ Commit message
fix(row253): supervise socket queries across sudo sessions
## BUILD-LOG.md ##
-@@ BUILD-LOG.md: Before: managed project/thread verbs had no Console conversation area. After: fi
+@@ BUILD-LOG.md: Fresh gate on3e4c77ac6 under sage-2648: bus793/0, WebUI345/0/1 (esbuild version
- Fresh gate on3e4c77ac6 under sage-2648: bus793/0, WebUI345/0/1 (esbuild version skip), all ten shell files425/0, touched files15/0, M1-M6 killed6/6. No timeout; sweep0 run-created leftovers. Runs1/2 void. Seven-path manifest8fa859a0 goes to Webby for final review. No landing or live change.
+ 2026-10-22 14:18:23 UTC | Sage | Row 264a LANDED (#1769, Gizmoduck, Duckworth): sessions per thread, schema 3k-3l. Before: refactor at e479521d3 (row 281). It landed as 84f53540d, ff, 21 commits, manifest 257408e9 (Duckworth approve rev 3214, comment 30640). Gate r13 on 2cc34aef8: 20 touched files, bus 827, cli 837, webui 345/1 named skip, ten shells under 3x limits, mutants M1-M4 killed on assertions. Corrections on the way: the kit stopped on first red, so four reds surfaced one at a time. r10 later3l missed a trigger (mos-1276). T2 had failed since r2 because refusals log action.refused (mos-1277, my sage-2257 wording). threads.test:341 kept the old trigger text (mos-1278). M2 was caught by the store trigger before any assertion, so it now drops the trigger too (mos-1279, four files with the SCHEMA_SHA256 pin). Deferred: actor_run pin binds row 269, esbuild skip to a later gate, session-scoped user reply binds row 272. No live change; LIVE is still 86f95bb27.
2026-10-21 21:24:47 UTC | Gander row253 #1758 design r1 | Investigation began21:12Z under sage-2162; recorded now. Before: case2 installer still renders tester TCP and case1 acceptance requires it. After: proposed design covers socket marker migration, actual configured dataRoot within unchanged hardening, target-uid metadata queries, kernel-peer acceptance observation and explicit same-uid residual. Initial inventory saved; no passing final static-check claim, product edit, test, host or live action. Duckworth design review precedes code.
+
+### 2026-10-21 row253 implementation prepared, gate pending
@@ agents/gander/work/queue-253/MANIFEST.sha256 (new)
## docs/plans/DEFERRED.md ##
@@ docs/plans/DEFERRED.md: Moved to `docs/plans/QUEUE.md` on 2026-09-13. This file holds only gaps.
- `packages/cli/tests/gate-lane-auth.test.mjs` proves no gate step mounts
- the host default. The real-model cases this moved off the gate are open
+ human in the inbox when it can't. Megavolt built it; Dewey approved the
+ design (d6) and the manifest (c30614). The text gaps it left are open
above.
+
+## Row253 F5: legacy Case AS_USER supervision
7: 37c97b41d = 7: 29d5f0d5e fix(row253): bound cleanup retries after initial inventory
8: 7bca9b042 = 8: e24d7b559 docs(row253): record static approval and pre-confirmation residual
9: 3a2022038 = 9: 94c2b76b8 docs(row253): record integration onto refactor 378a76b85
10: 614bdc8e9 = 10: 049088866 docs(row253): integrate row191 base and refresh manifest
11: b9d3d4c75 = 11: 7916f0ee6 docs(row253): integrate 385a base and record dependency drift and bounds
12: 2c383ef65 = 12: c75c9bbd3 docs(row253): record schema3l integration before final base correction
@@ -1,49 +0,0 @@
1: a9c094d06 ! 1: e8b096948 gander: design tester socket migration for host scripts
@@ Commit message
gander: design tester socket migration for host scripts
## BUILD-LOG.md ##
-@@ BUILD-LOG.md: Before: managed project/thread verbs had no Console conversation area. After: fi
- ### 2026-10-22 | Gander | row278 gate run3
+@@ BUILD-LOG.md: Fresh gate on3e4c77ac6 under sage-2648: bus793/0, WebUI345/0/1 (esbuild version
+ 2026-10-22 13:10 UTC | Sage | Rows 278 and 281 LANDED. Before: refactor at 6af85df4b (V502). Row 278 (#1783, Gander, Webby): the Console Agents view shows thread claims in their own section. It landed as 385a7194c at 12:39Z, ff, 9 commits, manifest 8fa859a0. Run 3 was green: bus 793, webui 345/0/1, ten shells 425/0 under the 3x limits (mos-1275), M1-M6 killed. Runs 1 and 2 were void, on fixture fixes 964b6b184 (placed by Sage) and 9696d1fcb (ruled by Mos, mos-1275). Webby approved (c30588, rev 3200). Done rev 3202, #1783 closed c30589. Row 281 (#1786, Megavolt, Dewey): a fire or a delete revokes the instance's host and Gitea grants. It landed as e479521d3 at 13:06Z, ff, 17 commits, manifest b73d4c81. Slot on 7979fb41e: bus 819, business 231, cli 837, dewey-bus 76 with the Docker gitea-grant test, shells green, M1-M22 killed. The M1 hang was fixed at its cause in b4a (mos-1273). Dewey approved (c30614, rev 3207). Done rev 3209, #1786 closed c30621. Skips on both: test-task's row 244 live-provider pair and test-queue's canonical-root check, plus webui's esbuild rebuild test on 278. After: refactor at e479521d3. DEFERRED moves the grant gap to Done and opens Dewey's N1/N2 text gaps. LIVE is still 86f95bb27.
- Fresh gate on3e4c77ac6 under sage-2648: bus793/0, WebUI345/0/1 (esbuild version skip), all ten shell files425/0, touched files15/0, M1-M6 killed6/6. No timeout; sweep0 run-created leftovers. Runs1/2 void. Seven-path manifest8fa859a0 goes to Webby for final review. No landing or live change.
+ 2026-10-22 14:18:23 UTC | Sage | Row 264a LANDED (#1769, Gizmoduck, Duckworth): sessions per thread, schema 3k-3l. Before: refactor at e479521d3 (row 281). It landed as 84f53540d, ff, 21 commits, manifest 257408e9 (Duckworth approve rev 3214, comment 30640). Gate r13 on 2cc34aef8: 20 touched files, bus 827, cli 837, webui 345/1 named skip, ten shells under 3x limits, mutants M1-M4 killed on assertions. Corrections on the way: the kit stopped on first red, so four reds surfaced one at a time. r10 later3l missed a trigger (mos-1276). T2 had failed since r2 because refusals log action.refused (mos-1277, my sage-2257 wording). threads.test:341 kept the old trigger text (mos-1278). M2 was caught by the store trigger before any assertion, so it now drops the trigger too (mos-1279, four files with the SCHEMA_SHA256 pin). Deferred: actor_run pin binds row 269, esbuild skip to a later gate, session-scoped user reply binds row 272. No live change; LIVE is still 86f95bb27.
+2026-10-21 21:24:47 UTC | Gander row253 #1758 design r1 | Investigation began21:12Z under sage-2162; recorded now. Before: case2 installer still renders tester TCP and case1 acceptance requires it. After: proposed design covers socket marker migration, actual configured dataRoot within unchanged hardening, target-uid metadata queries, kernel-peer acceptance observation and explicit same-uid residual. Initial inventory saved; no passing final static-check claim, product edit, test, host or live action. Duckworth design review precedes code.
## agents/gander/work/queue-253/BASE-PORT-INVENTORY.json (new) ##
2: 2e81f7872 = 2: 0d7f9da11 test: prepare row253 socket fixtures and fix gate collisions
3: 3c8edc358 = 3: 7c1fcbd96 docs: propose row253 C4 session supervisor and draft hop fake
4: 3114087ef = 4: 565302e71 docs(row253): freeze C4 repair for static review
5: 911e470b7 = 5: bcf4e2501 docs(row253): store repair patch without context whitespace
6: 4a8b5c3ff ! 6: f2c594d7b fix(row253): supervise socket queries across sudo sessions
@@ Commit message
fix(row253): supervise socket queries across sudo sessions
## BUILD-LOG.md ##
-@@ BUILD-LOG.md: Before: managed project/thread verbs had no Console conversation area. After: fi
+@@ BUILD-LOG.md: Fresh gate on3e4c77ac6 under sage-2648: bus793/0, WebUI345/0/1 (esbuild version
- Fresh gate on3e4c77ac6 under sage-2648: bus793/0, WebUI345/0/1 (esbuild version skip), all ten shell files425/0, touched files15/0, M1-M6 killed6/6. No timeout; sweep0 run-created leftovers. Runs1/2 void. Seven-path manifest8fa859a0 goes to Webby for final review. No landing or live change.
+ 2026-10-22 14:18:23 UTC | Sage | Row 264a LANDED (#1769, Gizmoduck, Duckworth): sessions per thread, schema 3k-3l. Before: refactor at e479521d3 (row 281). It landed as 84f53540d, ff, 21 commits, manifest 257408e9 (Duckworth approve rev 3214, comment 30640). Gate r13 on 2cc34aef8: 20 touched files, bus 827, cli 837, webui 345/1 named skip, ten shells under 3x limits, mutants M1-M4 killed on assertions. Corrections on the way: the kit stopped on first red, so four reds surfaced one at a time. r10 later3l missed a trigger (mos-1276). T2 had failed since r2 because refusals log action.refused (mos-1277, my sage-2257 wording). threads.test:341 kept the old trigger text (mos-1278). M2 was caught by the store trigger before any assertion, so it now drops the trigger too (mos-1279, four files with the SCHEMA_SHA256 pin). Deferred: actor_run pin binds row 269, esbuild skip to a later gate, session-scoped user reply binds row 272. No live change; LIVE is still 86f95bb27.
2026-10-21 21:24:47 UTC | Gander row253 #1758 design r1 | Investigation began21:12Z under sage-2162; recorded now. Before: case2 installer still renders tester TCP and case1 acceptance requires it. After: proposed design covers socket marker migration, actual configured dataRoot within unchanged hardening, target-uid metadata queries, kernel-peer acceptance observation and explicit same-uid residual. Initial inventory saved; no passing final static-check claim, product edit, test, host or live action. Duckworth design review precedes code.
+
+### 2026-10-21 row253 implementation prepared, gate pending
@@ agents/gander/work/queue-253/MANIFEST.sha256 (new)
## docs/plans/DEFERRED.md ##
@@ docs/plans/DEFERRED.md: Moved to `docs/plans/QUEUE.md` on 2026-09-13. This file holds only gaps.
- `packages/cli/tests/gate-lane-auth.test.mjs` proves no gate step mounts
- the host default. The real-model cases this moved off the gate are open
+ human in the inbox when it can't. Megavolt built it; Dewey approved the
+ design (d6) and the manifest (c30614). The text gaps it left are open
above.
+
+## Row253 F5: legacy Case AS_USER supervision
7: e18b90e95 = 7: 29d5f0d5e fix(row253): bound cleanup retries after initial inventory
8: 677767145 = 8: e24d7b559 docs(row253): record static approval and pre-confirmation residual
9: c733371c5 = 9: 94c2b76b8 docs(row253): record integration onto refactor 378a76b85
10: 141b79c29 = 10: 049088866 docs(row253): integrate row191 base and refresh manifest
11: d213ef651 = 11: 7916f0ee6 docs(row253): integrate 385a base and record dependency drift and bounds
-: --------- > 12: c75c9bbd3 docs(row253): record schema3l integration before final base correction
@@ -1,29 +0,0 @@
[
"packages/bus/tests/account-migration.test.mjs",
"packages/bus/tests/chief-of-staff.test.mjs",
"packages/bus/tests/comment-migration.test.mjs",
"packages/bus/tests/end-launch.test.mjs",
"packages/bus/tests/fire-revokes-grants.test.mjs",
"packages/bus/tests/gitea-grant.test.mjs",
"packages/bus/tests/gitea-migration.test.mjs",
"packages/bus/tests/grant-executor.test.mjs",
"packages/bus/tests/grant-migration.test.mjs",
"packages/bus/tests/lifecycle-revoke.test.mjs",
"packages/bus/tests/message-filter.test.mjs",
"packages/bus/tests/name-migration.test.mjs",
"packages/bus/tests/schema.test.mjs",
"packages/bus/tests/sessions.test.mjs",
"packages/bus/tests/spec-migration.test.mjs",
"packages/bus/tests/tester-writes.test.mjs",
"packages/bus/tests/thread-claims.test.mjs",
"packages/bus/tests/thread-migration.test.mjs",
"packages/bus/tests/threads.test.mjs",
"packages/bus/tests/usage-migration.test.mjs",
"packages/cli/tests/case1-accept.test.mjs",
"packages/cli/tests/case2-unit.test.mjs",
"packages/cli/tests/lifecycle.test.mjs",
"packages/cli/tests/stack-release.test.mjs",
"packages/cli/tests/thread-cli.test.mjs",
"packages/cli/tests/thread-launch.test.mjs",
"packages/webui/tests/chat.test.mjs"
]
@@ -1,13 +0,0 @@
test(row253): expose peer failures and pin reasons (mos-1297)
The peer-output fixture execs isolated system Python to write its exact bytes
and exit with peer-status. This avoids masking parser/status faults behind the
supervisor session check. All17 faults assert an exact reason with a delimiter;
every existing assertion remains. No product change or timing delay.
Old packages/cli/tests/case1-accept.test.mjs:100:
const PYTHON_STUB = `[ -f "$HC/peer-output" ] && { cat "$HC/peer-output"; exit "$(cat "$HC/peer-status")"; }
Diagnostic under sage-2752 found probe-inner-session for malformed output and
nonzero exit. Mos confirmed the fixture mask and authorized this repair.
No tests ran after the repair; Duckworth review and fresh whole gate follow.
@@ -1,11 +0,0 @@
# Row253 mos1297 repair candidate
Source 362ec674c9e7aa8cef0c26f4d7448f459171dbd4, baseaca16404c. Manifest a2ac57342d9c59ddaebddade0fa475a9568719fed50c132bd7bb141167c7e72e. Only case1-accept.test.mjs changes among the seven entries. No product script, shared fixture, other test or policy change. Source commit names mos1297 and quotes the exact old first line of PYTHON_STUB at0604:100.
One stub-line change only: when peer-output exists, exec /usr/bin/python3 -I -S, write that file's exact bytes to stdout and exit with peer-status. No fixed delay. All other stub lines remain byte-identical. The healthy Python path remains unchanged. This removes the confirmed instant-shell-exit mask while retaining the fixture's intended output/status fault.
Add a17-entry expected-reason map, taken from the accepted diagnostic-a/EXPECTED-REASONS draft, and one exact reason assertion per iteration. The new regex anchors the P10 line and requires the following space, so reason=probe does not accept probe-* codes. Every original status, boundary=failed and no-boundary=observed assertion line remains. peer-malformed=probe; peer-error=probe-inner-command. STATIC-PRESERVATION.json checks all old assertion lines remain and that the overflow/peer-hang bodies are byte-identical. No change to the peer-hang loose prefix. No result is claimed for the new code.
The original single diagnostic remains in diagnostic-a/. It observed15matches and2probe-inner-session mismatches on0604. Mos confirmed the source of that mask with their own no-Node supervisor controls, and authorized this fixture-only repair. Real fast-exit product behavior is post10-27 Vikunja532, with Sage owning its DEFERRED entry; no product repair or DEFERRED edit here.
Next: new manifest to Duckworth, then a complete whole gate from the start under Sage CLEAR, no carry from any old run. Both17-fault reasons must match the drafted oracle. The C4 overflow test must still give reason=probe-output-limit. The named P10 test must killM21 on assertions. If M21 survives or either reason differs, stop to Mos before anything else changes. All other existing gates/limits and exact restores stand. No Node, syntax test, payload experiment or repaired test run occurred after the change.
@@ -1,45 +0,0 @@
diff --git a/packages/cli/tests/case1-accept.test.mjs b/packages/cli/tests/case1-accept.test.mjs
index 5baddb646..b2673c325 100644
--- a/packages/cli/tests/case1-accept.test.mjs
+++ b/packages/cli/tests/case1-accept.test.mjs
@@ -97,7 +97,7 @@ const NODE_STUB = `[ "$HOME" = "$ROOT_DIR/srv/mosaic" ] || touch "$HC/node-as-ro
[ "\${1:-}" = --version ] && { cat "$HC/node-version"; exit 0; }
exec "$REAL_NODE" "$@"`;
// The real Python payload runs against a mock socket object, never an OS listener.
-const PYTHON_STUB = `[ -f "$HC/peer-output" ] && { cat "$HC/peer-output"; exit "$(cat "$HC/peer-status")"; }
+const PYTHON_STUB = `[ -f "$HC/peer-output" ] && exec /usr/bin/python3 -I -S -c 'import os,sys; root=os.environ["HC"]; sys.stdout.buffer.write(open(root+"/peer-output","rb").read()); sys.exit(int(open(root+"/peer-status").read()))'
[ -f "$HC/peer-hang" ] && {
here="$BASHPID"; read -r sid < <(/bin/ps -o sid= -p "$here")
echo "$here" > "$HC/peer-pid"; printf '%s %s\\n' "$here" "$sid" >> "$HC/query-pids"
@@ -260,11 +260,31 @@ test('row253 P10 refuses unsafe metadata, wrong peers and an unsafe Python witho
'changed-pid':h=>put(join(h.hc,'peer-pid-change'),'ActiveState=active\nUser=mosaic\nMainPID=201\n'),
floor:h=>put(join(h.root,'proc/sys/net/ipv4/ip_unprivileged_port_start'),'700\n'),
};
+ const reasons = {
+ "parent-mode": "metadata",
+ "parent-owner": "metadata",
+ "socket-mode": "metadata",
+ "socket-owner": "metadata",
+ "socket-type": "metadata",
+ "symlink": "metadata",
+ "peer": "peer",
+ "peer-pid": "peer",
+ "python-mode": "interpreter",
+ "python-missing": "interpreter",
+ "python-not-elf": "interpreter",
+ "peer-malformed": "probe",
+ "peer-error": "probe-inner-command",
+ "peer-uid-fields": "metadata",
+ "changed-inode": "changed",
+ "changed-pid": "changed",
+ "floor": "floor",
+ };
for(const [name,fault] of Object.entries(faults)){
const h=host(t);fault(h);const r=run(h);
assert.equal(r.status,name==='peer-uid-fields'?1:0,`${name}: ${r.out}${r.err}`);
assert.match(r.out,/P10 tester-socket-squat unnamed boundary=failed/,name);
assert.doesNotMatch(r.out,/boundary=observed/,name);
+ assert.match(r.out,new RegExp('^P10 tester-socket-squat unnamed boundary=failed reason='+reasons[name]+' ', 'm'),name);
}
});
@@ -1,22 +0,0 @@
{
"authority": "mos-1297",
"source_commit": "362ec674c9e7aa8cef0c26f4d7448f459171dbd4",
"base": "aca16404cf522b03f39acaf140e4f6185a507b88",
"previous_product": "0604d91fcfc1949810cd5321aea6ec43e9b74b4b",
"previous_manifest": "573c51cf72f2398532a6ea768536f04e3c1681997cb8b9a6f14a8aef884870ae",
"manifest": "a2ac57342d9c59ddaebddade0fa475a9568719fed50c132bd7bb141167c7e72e",
"changed_manifest_paths": [
"packages/cli/tests/case1-accept.test.mjs"
],
"hashes": {
"docs/plans/DEFERRED.md": "f8ad28aa8dc0f12b2c6dddb3b5dc805da05a97c7723e0525905456c064d0cfa3",
"packages/cli/tests/case-sudo-fixture.mjs": "b259b8c7926e49829c8a956674021cb0cc85ddd65aebdc786d05cc08d7790008",
"packages/cli/tests/case1-accept.test.mjs": "27378eb1297dc6115b4b1ce849de6ffdb3adccf5249783106fa0570c9d696e8a",
"packages/cli/tests/case2-unit.test.mjs": "1e0696eb196e83a0766b433ef71f27df0a3f8fcb6399787ab8c1c0f05c54dc44",
"packages/webui/README.md": "ce9054060867120798c6b26737ac7d910d8cfbc7aa4ad614f4295619c7605e46",
"scripts/case1-accept.sh": "c02bef6b3495e5a4548d7b4e89675ed52be26a0c9ccce4d9d5cfc5fe2ce437bd",
"scripts/case2-unit.sh": "d7670bdb049ae41ba3774fc83de633636859b6723be858cfb31ea106b0e8812b"
},
"tests_run": false,
"gate": "Entire whole gate from start, no carry. M21 must be assertion-killed by named P10 test; malformed/error reasons must match draft or stop to Mos before any further change."
}
@@ -1,14 +0,0 @@
{
"authority": "mos-1297",
"changed_test": "packages/cli/tests/case1-accept.test.mjs",
"old_assertion_lines": 121,
"all_old_assertions_preserved": true,
"new_assertions": [
" assert.match(r.out,new RegExp('^P10 tester-socket-squat unnamed boundary=failed reason='+reasons[name]+' ', 'm'),name);"
],
"stub_first_line_only": true,
"overflow_tests_byte_identical": true,
"peer_hang_test_byte_identical": true,
"expected_reason_count": 17,
"tests_run": false
}
@@ -1,3 +0,0 @@
# mos-1298 candidate
Source 14e46006171ef700a72f971fda5cb3a0b8dcc4f2; manifest 591020a1096a1606c11f2ee34b37243acddf83d91c69922ccc5cfe22d6180d3a. Two inserted lines read the first query-pids record as numbers and assert PID equals SID, inside the existing per-kind/per-mode loop. All prior test bytes remain. Both product scripts match e1bc766d8 exactly. BUILD.md and c4/REPAIR-README.md correct the M38 kill rule. No execution since the stop; fresh whole gate after review and CLEAR, no carry.
@@ -1,13 +0,0 @@
diff --git a/packages/cli/tests/case2-unit.test.mjs b/packages/cli/tests/case2-unit.test.mjs
index 834f8d848..78dd77721 100644
--- a/packages/cli/tests/case2-unit.test.mjs
+++ b/packages/cli/tests/case2-unit.test.mjs
@@ -199,6 +199,8 @@ for(const kind of ['sleep','signals','member']) test(`row253 C4 ${kind} query ha
const capture=cleanupFixture(t,files);const stopGuard=fixtureGuard(t,files);
const start=performance.now(),r=unit(h,{profile:'factory'}),seconds=(performance.now()-start)/1000;capture();
refuses(r,/^case2-unit: tester config query inner-timeout\n$/);
+ const [queryPid,querySid]=read(queries).trim().split('\n')[0].trim().split(/\s+/).map(Number);
+ assert.equal(queryPid,querySid,`${kind}/${mode}: direct query PID must equal its kernel SID`);
assert.ok(seconds<7,`${kind}/${mode}: ${seconds}s exceeds outer bound`);
assert.deepEqual(await pollFixtureGone(files),[],mode);
if(kind==='member')assert.ok(read(proof).includes('('+member.split('/').at(-1)+') '),'member comm with newline and closing parenthesis was observed');
@@ -1,20 +0,0 @@
{
"source": "14e46006171ef700a72f971fda5cb3a0b8dcc4f2",
"previous": "e1bc766d87a0c6b8894aff93a221315a044cb36a",
"manifest": "591020a1096a1606c11f2ee34b37243acddf83d91c69922ccc5cfe22d6180d3a",
"paths": {
"docs/plans/DEFERRED.md": "f8ad28aa8dc0f12b2c6dddb3b5dc805da05a97c7723e0525905456c064d0cfa3",
"packages/cli/tests/case-sudo-fixture.mjs": "b259b8c7926e49829c8a956674021cb0cc85ddd65aebdc786d05cc08d7790008",
"packages/cli/tests/case1-accept.test.mjs": "27378eb1297dc6115b4b1ce849de6ffdb3adccf5249783106fa0570c9d696e8a",
"packages/cli/tests/case2-unit.test.mjs": "9ca67403d8614266061624ab5fbf4ea8e8a54cbd08f5b569c95592ab5ed40472",
"packages/webui/README.md": "ce9054060867120798c6b26737ac7d910d8cfbc7aa4ad614f4295619c7605e46",
"scripts/case1-accept.sh": "c02bef6b3495e5a4548d7b4e89675ed52be26a0c9ccce4d9d5cfc5fe2ce437bd",
"scripts/case2-unit.sh": "d7670bdb049ae41ba3774fc83de633636859b6723be858cfb31ea106b0e8812b"
},
"existing_test_lines_byte_identical": true,
"scripts_unchanged": {
"scripts/case1-accept.sh": "c02bef6b3495e5a4548d7b4e89675ed52be26a0c9ccce4d9d5cfc5fe2ce437bd",
"scripts/case2-unit.sh": "d7670bdb049ae41ba3774fc83de633636859b6723be858cfb31ea106b0e8812b"
},
"execution": "No test, Node preflight or experiment run; pending Duckworth review and Sage CLEAR"
}
@@ -1,164 +0,0 @@
{
"packages/cli/tests/case1-accept.test.mjs": {
"recorded_seconds": 99.281,
"receipt": "agents/gander/work/queue-253/run3-focused/files/01.log",
"next_limit_seconds": 418,
"derivation": "ceil(3*measured whole-file seconds)+120"
},
"packages/cli/tests/case2-unit.test.mjs": {
"recorded_seconds": 66.418,
"receipt": "agents/gander/work/queue-253/run3-focused/files/02.log",
"next_limit_seconds": 320,
"derivation": "ceil(3*measured whole-file seconds)+120"
},
"packages/bus/tests/account-migration.test.mjs": {
"recorded_seconds": 0.415,
"receipt": "agents/gander/work/queue-253/run3-focused/files/03.log",
"next_limit_seconds": 122,
"derivation": "ceil(3*measured whole-file seconds)+120"
},
"packages/bus/tests/chief-of-staff.test.mjs": {
"recorded_seconds": 2.168,
"receipt": "agents/gander/work/queue-253/run3-focused/files/04.log",
"next_limit_seconds": 127,
"derivation": "ceil(3*measured whole-file seconds)+120"
},
"packages/bus/tests/comment-migration.test.mjs": {
"recorded_seconds": 0.565,
"receipt": "agents/gander/work/queue-253/run3-focused/files/05.log",
"next_limit_seconds": 122,
"derivation": "ceil(3*measured whole-file seconds)+120"
},
"packages/bus/tests/end-launch.test.mjs": {
"recorded_seconds": 0.415,
"receipt": "agents/gander/work/queue-253/run3-focused/files/06.log",
"next_limit_seconds": 122,
"derivation": "ceil(3*measured whole-file seconds)+120"
},
"packages/bus/tests/fire-revokes-grants.test.mjs": {
"recorded_seconds": 3.271,
"receipt": "agents/gander/work/queue-253/run3-focused/files/07.log",
"next_limit_seconds": 130,
"derivation": "ceil(3*measured whole-file seconds)+120"
},
"packages/bus/tests/gitea-grant.test.mjs": {
"recorded_seconds": 8.634,
"receipt": "agents/gander/work/queue-253/run3-focused/files/08.log",
"next_limit_seconds": 146,
"derivation": "ceil(3*measured whole-file seconds)+120"
},
"packages/bus/tests/gitea-migration.test.mjs": {
"recorded_seconds": 0.415,
"receipt": "agents/gander/work/queue-253/run3-focused/files/09.log",
"next_limit_seconds": 122,
"derivation": "ceil(3*measured whole-file seconds)+120"
},
"packages/bus/tests/grant-executor.test.mjs": {
"recorded_seconds": 21.562,
"receipt": "agents/gander/work/queue-253/run3-focused/files/10.log",
"next_limit_seconds": 185,
"derivation": "ceil(3*measured whole-file seconds)+120"
},
"packages/bus/tests/grant-migration.test.mjs": {
"recorded_seconds": 0.465,
"receipt": "agents/gander/work/queue-253/run3-focused/files/11.log",
"next_limit_seconds": 122,
"derivation": "ceil(3*measured whole-file seconds)+120"
},
"packages/bus/tests/lifecycle-revoke.test.mjs": {
"recorded_seconds": 0.665,
"receipt": "agents/gander/work/queue-253/run3-focused/files/12.log",
"next_limit_seconds": 122,
"derivation": "ceil(3*measured whole-file seconds)+120"
},
"packages/bus/tests/message-filter.test.mjs": {
"recorded_seconds": 0.515,
"receipt": "agents/gander/work/queue-253/run3-focused/files/13.log",
"next_limit_seconds": 122,
"derivation": "ceil(3*measured whole-file seconds)+120"
},
"packages/bus/tests/name-migration.test.mjs": {
"recorded_seconds": 0.214,
"receipt": "agents/gander/work/queue-253/run3-focused/files/14.log",
"next_limit_seconds": 121,
"derivation": "ceil(3*measured whole-file seconds)+120"
},
"packages/bus/tests/schema.test.mjs": {
"recorded_seconds": 0.214,
"receipt": "agents/gander/work/queue-253/run3-focused/files/15.log",
"next_limit_seconds": 121,
"derivation": "ceil(3*measured whole-file seconds)+120"
},
"packages/bus/tests/sessions.test.mjs": {
"recorded_seconds": 0.615,
"receipt": "agents/gander/work/queue-253/run3-focused/files/16.log",
"next_limit_seconds": 122,
"derivation": "ceil(3*measured whole-file seconds)+120"
},
"packages/bus/tests/spec-migration.test.mjs": {
"recorded_seconds": 0.214,
"receipt": "agents/gander/work/queue-253/run3-focused/files/17.log",
"next_limit_seconds": 121,
"derivation": "ceil(3*measured whole-file seconds)+120"
},
"packages/bus/tests/tester-writes.test.mjs": {
"recorded_seconds": 0.565,
"receipt": "agents/gander/work/queue-253/run3-focused/files/18.log",
"next_limit_seconds": 122,
"derivation": "ceil(3*measured whole-file seconds)+120"
},
"packages/bus/tests/thread-claims.test.mjs": {
"recorded_seconds": 0.264,
"receipt": "agents/gander/work/queue-253/run3-focused/files/19.log",
"next_limit_seconds": 121,
"derivation": "ceil(3*measured whole-file seconds)+120"
},
"packages/bus/tests/thread-migration.test.mjs": {
"recorded_seconds": 0.365,
"receipt": "agents/gander/work/queue-253/run3-focused/files/20.log",
"next_limit_seconds": 122,
"derivation": "ceil(3*measured whole-file seconds)+120"
},
"packages/bus/tests/threads.test.mjs": {
"recorded_seconds": 1.216,
"receipt": "agents/gander/work/queue-253/run3-focused/files/21.log",
"next_limit_seconds": 124,
"derivation": "ceil(3*measured whole-file seconds)+120"
},
"packages/bus/tests/usage-migration.test.mjs": {
"recorded_seconds": 0.214,
"receipt": "agents/gander/work/queue-253/run3-focused/files/22.log",
"next_limit_seconds": 121,
"derivation": "ceil(3*measured whole-file seconds)+120"
},
"packages/cli/tests/lifecycle.test.mjs": {
"recorded_seconds": 13.296,
"receipt": "agents/gander/work/queue-253/run3-focused/files/23.log",
"next_limit_seconds": 160,
"derivation": "ceil(3*measured whole-file seconds)+120"
},
"packages/cli/tests/stack-release.test.mjs": {
"recorded_seconds": 583.453,
"receipt": "agents/gander/work/queue-253/run3-focused/files/24.log",
"next_limit_seconds": 1871,
"derivation": "ceil(3*measured whole-file seconds)+120"
},
"packages/cli/tests/thread-cli.test.mjs": {
"recorded_seconds": 1.876,
"receipt": "agents/gander/work/queue-253/run3-focused/files/25.log",
"next_limit_seconds": 126,
"derivation": "ceil(3*measured whole-file seconds)+120"
},
"packages/cli/tests/thread-launch.test.mjs": {
"recorded_seconds": 16.603,
"receipt": "agents/gander/work/queue-253/run3-focused/files/26.log",
"next_limit_seconds": 170,
"derivation": "ceil(3*measured whole-file seconds)+120"
},
"packages/webui/tests/chat.test.mjs": {
"recorded_seconds": 0.515,
"receipt": "agents/gander/work/queue-253/run3-focused/files/27.log",
"next_limit_seconds": 122,
"derivation": "ceil(3*measured whole-file seconds)+120"
}
}
@@ -1,7 +0,0 @@
# Focused window notes
Grant sage-2709 at14:29:21Z, test run start14:30:03Z. First busy check passed; no busy refusal occurred. Sage2711 reports one unrelated canonical queue write by Gizmoduck at14:29:42Z, row269 rev3217, and authorizes rechecking if it trips a busy guard. No recheck or test retry was needed. No test path was changed by that write. Later file results determine the gate outcome; no timing explanation is assumed.
Duckworth0149 static integration check has no blockers on0604d91fc /573c51cf. Focused logs will supply HEAD/digest,27 file totals and every skip, including exact N9 case2 skip.
Sage2714 reports Darkwing queue-show reads around14:31Z and two Python read operations at14:32Z, outside this worktree/TMPDIR. No own busy refusal or retry occurred. No test impact observed; no causal claim made about timings. This seat did not access the live data named in that notice.
@@ -1,37 +0,0 @@
# Focused27 whole-file results
| Whole file | Pass/fail/skip | Wall seconds | Command limit seconds | Next3x plus120 basis |
|---|---:|---:|---:|---:|
| packages/cli/tests/case1-accept.test.mjs | 34/0/0 | 99.281 | 900 | 418 |
| packages/cli/tests/case2-unit.test.mjs | 43/0/0 | 66.418 | 900 | 320 |
| packages/bus/tests/account-migration.test.mjs | 3/0/0 | 0.415 | 300 | 122 |
| packages/bus/tests/chief-of-staff.test.mjs | 42/0/0 | 2.168 | 300 | 127 |
| packages/bus/tests/comment-migration.test.mjs | 5/0/0 | 0.565 | 300 | 122 |
| packages/bus/tests/end-launch.test.mjs | 7/0/0 | 0.415 | 300 | 122 |
| packages/bus/tests/fire-revokes-grants.test.mjs | 22/0/0 | 3.271 | 300 | 130 |
| packages/bus/tests/gitea-grant.test.mjs | 49/0/0 | 8.634 | 300 | 146 |
| packages/bus/tests/gitea-migration.test.mjs | 5/0/0 | 0.415 | 300 | 122 |
| packages/bus/tests/grant-executor.test.mjs | 42/0/0 | 21.562 | 300 | 185 |
| packages/bus/tests/grant-migration.test.mjs | 6/0/0 | 0.465 | 300 | 122 |
| packages/bus/tests/lifecycle-revoke.test.mjs | 8/0/0 | 0.665 | 300 | 122 |
| packages/bus/tests/message-filter.test.mjs | 6/0/0 | 0.515 | 300 | 122 |
| packages/bus/tests/name-migration.test.mjs | 1/0/0 | 0.214 | 300 | 121 |
| packages/bus/tests/schema.test.mjs | 1/0/0 | 0.214 | 300 | 121 |
| packages/bus/tests/sessions.test.mjs | 7/0/0 | 0.615 | 300 | 122 |
| packages/bus/tests/spec-migration.test.mjs | 1/0/0 | 0.214 | 300 | 121 |
| packages/bus/tests/tester-writes.test.mjs | 8/0/0 | 0.565 | 300 | 122 |
| packages/bus/tests/thread-claims.test.mjs | 6/0/0 | 0.264 | 300 | 121 |
| packages/bus/tests/thread-migration.test.mjs | 3/0/0 | 0.365 | 300 | 122 |
| packages/bus/tests/threads.test.mjs | 17/0/0 | 1.216 | 300 | 124 |
| packages/bus/tests/usage-migration.test.mjs | 1/0/0 | 0.214 | 300 | 121 |
| packages/cli/tests/lifecycle.test.mjs | 24/0/0 | 13.296 | 900 | 160 |
| packages/cli/tests/stack-release.test.mjs | 218/0/0 | 583.453 | 900 | 1871 |
| packages/cli/tests/thread-cli.test.mjs | 11/0/0 | 1.876 | 900 | 126 |
| packages/cli/tests/thread-launch.test.mjs | 11/0/0 | 16.603 | 900 | 170 |
| packages/webui/tests/chat.test.mjs | 23/0/0 | 0.515 | 300 | 122 |
N9 verbatim: ok 43 - inside a session's sandbox a bind below 1024 fails with EACCES, and a bind on a free high port succeeds
Every skip:
@@ -1,625 +0,0 @@
{
"status": "GREEN",
"grant": "sage-2709",
"candidate": "0604d91fcfc1949810cd5321aea6ec43e9b74b4b",
"manifest": "573c51cf72f2398532a6ea768536f04e3c1681997cb8b9a6f14a8aef884870ae",
"counts": {
"pass": 604,
"fail": 0,
"skipped": 0
},
"steps": [
{
"code": 0,
"timeout": false,
"seconds": 99.281,
"log": "agents/gander/work/queue-253/run3-focused/files/01.log",
"file": "packages/cli/tests/case1-accept.test.mjs",
"counts": {
"tests": 34,
"pass": 34,
"fail": 0,
"skipped": 0
},
"named_skips": []
},
{
"code": 0,
"timeout": false,
"seconds": 66.418,
"log": "agents/gander/work/queue-253/run3-focused/files/02.log",
"file": "packages/cli/tests/case2-unit.test.mjs",
"counts": {
"tests": 43,
"pass": 43,
"fail": 0,
"skipped": 0
},
"named_skips": []
},
{
"code": 0,
"timeout": false,
"seconds": 0.415,
"log": "agents/gander/work/queue-253/run3-focused/files/03.log",
"file": "packages/bus/tests/account-migration.test.mjs",
"counts": {
"tests": 3,
"pass": 3,
"fail": 0,
"skipped": 0
},
"named_skips": []
},
{
"code": 0,
"timeout": false,
"seconds": 2.168,
"log": "agents/gander/work/queue-253/run3-focused/files/04.log",
"file": "packages/bus/tests/chief-of-staff.test.mjs",
"counts": {
"tests": 42,
"pass": 42,
"fail": 0,
"skipped": 0
},
"named_skips": []
},
{
"code": 0,
"timeout": false,
"seconds": 0.565,
"log": "agents/gander/work/queue-253/run3-focused/files/05.log",
"file": "packages/bus/tests/comment-migration.test.mjs",
"counts": {
"tests": 5,
"pass": 5,
"fail": 0,
"skipped": 0
},
"named_skips": []
},
{
"code": 0,
"timeout": false,
"seconds": 0.415,
"log": "agents/gander/work/queue-253/run3-focused/files/06.log",
"file": "packages/bus/tests/end-launch.test.mjs",
"counts": {
"tests": 7,
"pass": 7,
"fail": 0,
"skipped": 0
},
"named_skips": []
},
{
"code": 0,
"timeout": false,
"seconds": 3.271,
"log": "agents/gander/work/queue-253/run3-focused/files/07.log",
"file": "packages/bus/tests/fire-revokes-grants.test.mjs",
"counts": {
"tests": 22,
"pass": 22,
"fail": 0,
"skipped": 0
},
"named_skips": []
},
{
"code": 0,
"timeout": false,
"seconds": 8.634,
"log": "agents/gander/work/queue-253/run3-focused/files/08.log",
"file": "packages/bus/tests/gitea-grant.test.mjs",
"counts": {
"tests": 49,
"pass": 49,
"fail": 0,
"skipped": 0
},
"named_skips": []
},
{
"code": 0,
"timeout": false,
"seconds": 0.415,
"log": "agents/gander/work/queue-253/run3-focused/files/09.log",
"file": "packages/bus/tests/gitea-migration.test.mjs",
"counts": {
"tests": 5,
"pass": 5,
"fail": 0,
"skipped": 0
},
"named_skips": []
},
{
"code": 0,
"timeout": false,
"seconds": 21.562,
"log": "agents/gander/work/queue-253/run3-focused/files/10.log",
"file": "packages/bus/tests/grant-executor.test.mjs",
"counts": {
"tests": 42,
"pass": 42,
"fail": 0,
"skipped": 0
},
"named_skips": []
},
{
"code": 0,
"timeout": false,
"seconds": 0.465,
"log": "agents/gander/work/queue-253/run3-focused/files/11.log",
"file": "packages/bus/tests/grant-migration.test.mjs",
"counts": {
"tests": 6,
"pass": 6,
"fail": 0,
"skipped": 0
},
"named_skips": []
},
{
"code": 0,
"timeout": false,
"seconds": 0.665,
"log": "agents/gander/work/queue-253/run3-focused/files/12.log",
"file": "packages/bus/tests/lifecycle-revoke.test.mjs",
"counts": {
"tests": 8,
"pass": 8,
"fail": 0,
"skipped": 0
},
"named_skips": []
},
{
"code": 0,
"timeout": false,
"seconds": 0.515,
"log": "agents/gander/work/queue-253/run3-focused/files/13.log",
"file": "packages/bus/tests/message-filter.test.mjs",
"counts": {
"tests": 6,
"pass": 6,
"fail": 0,
"skipped": 0
},
"named_skips": []
},
{
"code": 0,
"timeout": false,
"seconds": 0.214,
"log": "agents/gander/work/queue-253/run3-focused/files/14.log",
"file": "packages/bus/tests/name-migration.test.mjs",
"counts": {
"tests": 1,
"pass": 1,
"fail": 0,
"skipped": 0
},
"named_skips": []
},
{
"code": 0,
"timeout": false,
"seconds": 0.214,
"log": "agents/gander/work/queue-253/run3-focused/files/15.log",
"file": "packages/bus/tests/schema.test.mjs",
"counts": {
"tests": 1,
"pass": 1,
"fail": 0,
"skipped": 0
},
"named_skips": []
},
{
"code": 0,
"timeout": false,
"seconds": 0.615,
"log": "agents/gander/work/queue-253/run3-focused/files/16.log",
"file": "packages/bus/tests/sessions.test.mjs",
"counts": {
"tests": 7,
"pass": 7,
"fail": 0,
"skipped": 0
},
"named_skips": []
},
{
"code": 0,
"timeout": false,
"seconds": 0.214,
"log": "agents/gander/work/queue-253/run3-focused/files/17.log",
"file": "packages/bus/tests/spec-migration.test.mjs",
"counts": {
"tests": 1,
"pass": 1,
"fail": 0,
"skipped": 0
},
"named_skips": []
},
{
"code": 0,
"timeout": false,
"seconds": 0.565,
"log": "agents/gander/work/queue-253/run3-focused/files/18.log",
"file": "packages/bus/tests/tester-writes.test.mjs",
"counts": {
"tests": 8,
"pass": 8,
"fail": 0,
"skipped": 0
},
"named_skips": []
},
{
"code": 0,
"timeout": false,
"seconds": 0.264,
"log": "agents/gander/work/queue-253/run3-focused/files/19.log",
"file": "packages/bus/tests/thread-claims.test.mjs",
"counts": {
"tests": 6,
"pass": 6,
"fail": 0,
"skipped": 0
},
"named_skips": []
},
{
"code": 0,
"timeout": false,
"seconds": 0.365,
"log": "agents/gander/work/queue-253/run3-focused/files/20.log",
"file": "packages/bus/tests/thread-migration.test.mjs",
"counts": {
"tests": 3,
"pass": 3,
"fail": 0,
"skipped": 0
},
"named_skips": []
},
{
"code": 0,
"timeout": false,
"seconds": 1.216,
"log": "agents/gander/work/queue-253/run3-focused/files/21.log",
"file": "packages/bus/tests/threads.test.mjs",
"counts": {
"tests": 17,
"pass": 17,
"fail": 0,
"skipped": 0
},
"named_skips": []
},
{
"code": 0,
"timeout": false,
"seconds": 0.214,
"log": "agents/gander/work/queue-253/run3-focused/files/22.log",
"file": "packages/bus/tests/usage-migration.test.mjs",
"counts": {
"tests": 1,
"pass": 1,
"fail": 0,
"skipped": 0
},
"named_skips": []
},
{
"code": 0,
"timeout": false,
"seconds": 13.296,
"log": "agents/gander/work/queue-253/run3-focused/files/23.log",
"file": "packages/cli/tests/lifecycle.test.mjs",
"counts": {
"tests": 24,
"pass": 24,
"fail": 0,
"skipped": 0
},
"named_skips": []
},
{
"code": 0,
"timeout": false,
"seconds": 583.453,
"log": "agents/gander/work/queue-253/run3-focused/files/24.log",
"file": "packages/cli/tests/stack-release.test.mjs",
"counts": {
"tests": 218,
"pass": 218,
"fail": 0,
"skipped": 0
},
"named_skips": []
},
{
"code": 0,
"timeout": false,
"seconds": 1.876,
"log": "agents/gander/work/queue-253/run3-focused/files/25.log",
"file": "packages/cli/tests/thread-cli.test.mjs",
"counts": {
"tests": 11,
"pass": 11,
"fail": 0,
"skipped": 0
},
"named_skips": []
},
{
"code": 0,
"timeout": false,
"seconds": 16.603,
"log": "agents/gander/work/queue-253/run3-focused/files/26.log",
"file": "packages/cli/tests/thread-launch.test.mjs",
"counts": {
"tests": 11,
"pass": 11,
"fail": 0,
"skipped": 0
},
"named_skips": []
},
{
"code": 0,
"timeout": false,
"seconds": 0.515,
"log": "agents/gander/work/queue-253/run3-focused/files/27.log",
"file": "packages/webui/tests/chat.test.mjs",
"counts": {
"tests": 23,
"pass": 23,
"fail": 0,
"skipped": 0
},
"named_skips": []
}
],
"named_skips": [],
"n9_exact_line": "ok 43 - inside a session's sandbox a bind below 1024 fails with EACCES, and a bind on a free high port succeeds",
"file_seconds_sum": 824.413,
"next_file_limits": {
"packages/cli/tests/case1-accept.test.mjs": {
"recorded_seconds": 99.281,
"receipt": "agents/gander/work/queue-253/run3-focused/files/01.log",
"next_limit_seconds": 418,
"derivation": "ceil(3*measured whole-file seconds)+120"
},
"packages/cli/tests/case2-unit.test.mjs": {
"recorded_seconds": 66.418,
"receipt": "agents/gander/work/queue-253/run3-focused/files/02.log",
"next_limit_seconds": 320,
"derivation": "ceil(3*measured whole-file seconds)+120"
},
"packages/bus/tests/account-migration.test.mjs": {
"recorded_seconds": 0.415,
"receipt": "agents/gander/work/queue-253/run3-focused/files/03.log",
"next_limit_seconds": 122,
"derivation": "ceil(3*measured whole-file seconds)+120"
},
"packages/bus/tests/chief-of-staff.test.mjs": {
"recorded_seconds": 2.168,
"receipt": "agents/gander/work/queue-253/run3-focused/files/04.log",
"next_limit_seconds": 127,
"derivation": "ceil(3*measured whole-file seconds)+120"
},
"packages/bus/tests/comment-migration.test.mjs": {
"recorded_seconds": 0.565,
"receipt": "agents/gander/work/queue-253/run3-focused/files/05.log",
"next_limit_seconds": 122,
"derivation": "ceil(3*measured whole-file seconds)+120"
},
"packages/bus/tests/end-launch.test.mjs": {
"recorded_seconds": 0.415,
"receipt": "agents/gander/work/queue-253/run3-focused/files/06.log",
"next_limit_seconds": 122,
"derivation": "ceil(3*measured whole-file seconds)+120"
},
"packages/bus/tests/fire-revokes-grants.test.mjs": {
"recorded_seconds": 3.271,
"receipt": "agents/gander/work/queue-253/run3-focused/files/07.log",
"next_limit_seconds": 130,
"derivation": "ceil(3*measured whole-file seconds)+120"
},
"packages/bus/tests/gitea-grant.test.mjs": {
"recorded_seconds": 8.634,
"receipt": "agents/gander/work/queue-253/run3-focused/files/08.log",
"next_limit_seconds": 146,
"derivation": "ceil(3*measured whole-file seconds)+120"
},
"packages/bus/tests/gitea-migration.test.mjs": {
"recorded_seconds": 0.415,
"receipt": "agents/gander/work/queue-253/run3-focused/files/09.log",
"next_limit_seconds": 122,
"derivation": "ceil(3*measured whole-file seconds)+120"
},
"packages/bus/tests/grant-executor.test.mjs": {
"recorded_seconds": 21.562,
"receipt": "agents/gander/work/queue-253/run3-focused/files/10.log",
"next_limit_seconds": 185,
"derivation": "ceil(3*measured whole-file seconds)+120"
},
"packages/bus/tests/grant-migration.test.mjs": {
"recorded_seconds": 0.465,
"receipt": "agents/gander/work/queue-253/run3-focused/files/11.log",
"next_limit_seconds": 122,
"derivation": "ceil(3*measured whole-file seconds)+120"
},
"packages/bus/tests/lifecycle-revoke.test.mjs": {
"recorded_seconds": 0.665,
"receipt": "agents/gander/work/queue-253/run3-focused/files/12.log",
"next_limit_seconds": 122,
"derivation": "ceil(3*measured whole-file seconds)+120"
},
"packages/bus/tests/message-filter.test.mjs": {
"recorded_seconds": 0.515,
"receipt": "agents/gander/work/queue-253/run3-focused/files/13.log",
"next_limit_seconds": 122,
"derivation": "ceil(3*measured whole-file seconds)+120"
},
"packages/bus/tests/name-migration.test.mjs": {
"recorded_seconds": 0.214,
"receipt": "agents/gander/work/queue-253/run3-focused/files/14.log",
"next_limit_seconds": 121,
"derivation": "ceil(3*measured whole-file seconds)+120"
},
"packages/bus/tests/schema.test.mjs": {
"recorded_seconds": 0.214,
"receipt": "agents/gander/work/queue-253/run3-focused/files/15.log",
"next_limit_seconds": 121,
"derivation": "ceil(3*measured whole-file seconds)+120"
},
"packages/bus/tests/sessions.test.mjs": {
"recorded_seconds": 0.615,
"receipt": "agents/gander/work/queue-253/run3-focused/files/16.log",
"next_limit_seconds": 122,
"derivation": "ceil(3*measured whole-file seconds)+120"
},
"packages/bus/tests/spec-migration.test.mjs": {
"recorded_seconds": 0.214,
"receipt": "agents/gander/work/queue-253/run3-focused/files/17.log",
"next_limit_seconds": 121,
"derivation": "ceil(3*measured whole-file seconds)+120"
},
"packages/bus/tests/tester-writes.test.mjs": {
"recorded_seconds": 0.565,
"receipt": "agents/gander/work/queue-253/run3-focused/files/18.log",
"next_limit_seconds": 122,
"derivation": "ceil(3*measured whole-file seconds)+120"
},
"packages/bus/tests/thread-claims.test.mjs": {
"recorded_seconds": 0.264,
"receipt": "agents/gander/work/queue-253/run3-focused/files/19.log",
"next_limit_seconds": 121,
"derivation": "ceil(3*measured whole-file seconds)+120"
},
"packages/bus/tests/thread-migration.test.mjs": {
"recorded_seconds": 0.365,
"receipt": "agents/gander/work/queue-253/run3-focused/files/20.log",
"next_limit_seconds": 122,
"derivation": "ceil(3*measured whole-file seconds)+120"
},
"packages/bus/tests/threads.test.mjs": {
"recorded_seconds": 1.216,
"receipt": "agents/gander/work/queue-253/run3-focused/files/21.log",
"next_limit_seconds": 124,
"derivation": "ceil(3*measured whole-file seconds)+120"
},
"packages/bus/tests/usage-migration.test.mjs": {
"recorded_seconds": 0.214,
"receipt": "agents/gander/work/queue-253/run3-focused/files/22.log",
"next_limit_seconds": 121,
"derivation": "ceil(3*measured whole-file seconds)+120"
},
"packages/cli/tests/lifecycle.test.mjs": {
"recorded_seconds": 13.296,
"receipt": "agents/gander/work/queue-253/run3-focused/files/23.log",
"next_limit_seconds": 160,
"derivation": "ceil(3*measured whole-file seconds)+120"
},
"packages/cli/tests/stack-release.test.mjs": {
"recorded_seconds": 583.453,
"receipt": "agents/gander/work/queue-253/run3-focused/files/24.log",
"next_limit_seconds": 1871,
"derivation": "ceil(3*measured whole-file seconds)+120"
},
"packages/cli/tests/thread-cli.test.mjs": {
"recorded_seconds": 1.876,
"receipt": "agents/gander/work/queue-253/run3-focused/files/25.log",
"next_limit_seconds": 126,
"derivation": "ceil(3*measured whole-file seconds)+120"
},
"packages/cli/tests/thread-launch.test.mjs": {
"recorded_seconds": 16.603,
"receipt": "agents/gander/work/queue-253/run3-focused/files/26.log",
"next_limit_seconds": 170,
"derivation": "ceil(3*measured whole-file seconds)+120"
},
"packages/webui/tests/chat.test.mjs": {
"recorded_seconds": 0.515,
"receipt": "agents/gander/work/queue-253/run3-focused/files/27.log",
"next_limit_seconds": 122,
"derivation": "ceil(3*measured whole-file seconds)+120"
}
},
"timeout_count": 0,
"source_manifest_verified": true,
"sweep": {
"timestamp": "2026-10-22T14:45:17.148081+00:00",
"count": 0,
"remaining": [],
"excluded_preexisting_infrastructure": [
{
"pid": 2469277,
"comm": "node-MainThread",
"cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/gander-row196",
"started_utc": "2026-10-22T14:20:57.360000+00:00"
},
{
"pid": 2469278,
"comm": "npm exec @model",
"cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/gander-row196",
"started_utc": "2026-10-22T14:20:57.370000+00:00"
},
{
"pid": 2469279,
"comm": "npm exec chrome",
"cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/gander-row196",
"started_utc": "2026-10-22T14:20:57.370000+00:00"
},
{
"pid": 2469292,
"comm": "npm exec @playw",
"cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/gander-row196",
"started_utc": "2026-10-22T14:20:57.380000+00:00"
},
{
"pid": 2469478,
"comm": "node-MainThread",
"cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/gander-row196",
"started_utc": "2026-10-22T14:20:58.770000+00:00"
},
{
"pid": 2469485,
"comm": "node-MainThread",
"cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/gander-row196",
"started_utc": "2026-10-22T14:20:58.800000+00:00"
},
{
"pid": 2469518,
"comm": "chrome-devtools",
"cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/gander-row196",
"started_utc": "2026-10-22T14:20:59.100000+00:00"
},
{
"pid": 2469601,
"comm": "node-MainThread",
"cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/gander-row196",
"started_utc": "2026-10-22T14:20:59.440000+00:00"
},
{
"pid": 2470486,
"comm": "codex-code-mode",
"cwd": "/home/jwoltje/.t3/worktrees/mosaic-stack/gander-row196",
"started_utc": "2026-10-22T14:21:07.580000+00:00"
}
],
"note": "Read-only /proc cwd sweep, including deleted cwd under this run TMPDIR. Own ancestry excluded. Only known MCP/npm/code-mode infrastructure PIDs with pre-run start ticks are excluded. No signalling."
},
"start": "2026-10-22T14:30:03Z",
"end": "2026-10-22T14:44:57Z",
"wall_seconds": 894.0
}
@@ -1 +0,0 @@
/mnt/storage/scratch/tmp/gMJyGKC
File diff suppressed because it is too large. Load diff
@@ -1 +0,0 @@
2026-10-22T14:44:57Z
@@ -1 +0,0 @@
["timeout", "-k", "10", "900", "node", "--test", "--test-reporter=tap", "packages/cli/tests/case1-accept.test.mjs"]
@@ -1,214 +0,0 @@
TAP version 13
# Subtest: row253 socket observation uses configured root, metadata and the Console peer without sending bytes
ok 1 - row253 socket observation uses configured root, metadata and the Console peer without sending bytes
---
duration_ms: 635.08322
type: 'test'
...
# Subtest: row253 P10 refuses unsafe metadata, wrong peers and an unsafe Python without claiming closure
ok 2 - row253 P10 refuses unsafe metadata, wrong peers and an unsafe Python without claiming closure
---
duration_ms: 8910.768359
type: 'test'
...
# Subtest: row253 acceptance rejects bad config and unsupported copies before talk
ok 3 - row253 acceptance rejects bad config and unsupported copies before talk
---
duration_ms: 1287.210524
type: 'test'
...
# Subtest: row253 stalled peer observation ends within its bound without leaving a reader
ok 4 - row253 stalled peer observation ends within its bound without leaving a reader
---
duration_ms: 2759.173042
type: 'test'
...
# Subtest: row253 P8 refuses both retired TCP and board listeners
ok 5 - row253 P8 refuses both retired TCP and board listeners
---
duration_ms: 1495.993888
type: 'test'
...
# Subtest: row253 C4 acceptance query inner reason holds under both sudo models
ok 6 - row253 C4 acceptance query inner reason holds under both sudo models
---
duration_ms: 10714.050013
type: 'test'
...
# Subtest: row253 C4 acceptance query outer reason discards stdout and names residual cleanup
ok 7 - row253 C4 acceptance query outer reason discards stdout and names residual cleanup
---
duration_ms: 14202.380117
type: 'test'
...
# Subtest: row253 C4 acceptance query overflow is output-limit in both models
ok 8 - row253 C4 acceptance query overflow is output-limit in both models
---
duration_ms: 533.74284
type: 'test'
...
# Subtest: row253 C4 P10 inner reason holds under both sudo models
ok 9 - row253 C4 P10 inner reason holds under both sudo models
---
duration_ms: 5977.183052
type: 'test'
...
# Subtest: row253 C4 P10 outer reason holds under both sudo models
ok 10 - row253 C4 P10 outer reason holds under both sudo models
---
duration_ms: 9158.961886
type: 'test'
...
# Subtest: row253 C4 P10 overflow reason holds under both sudo models
ok 11 - row253 C4 P10 overflow reason holds under both sudo models
---
duration_ms: 1068.808446
type: 'test'
...
# Subtest: row 195 accept: every check passing exits 0, with each P mark and counts that match the lines
ok 12 - row 195 accept: every check passing exits 0, with each P mark and counts that match the lines
---
duration_ms: 657.788738
type: 'test'
...
# Subtest: row 195 accept: exits 1 with each F check failing alone, and its line names it
ok 13 - row 195 accept: exits 1 with each F check failing alone, and its line names it
---
duration_ms: 7275.151025
type: 'test'
...
# Subtest: row 195 accept: F3 fails on exit 0 with no reply line, and its evidence takes talk's error
ok 14 - row 195 accept: F3 fails on exit 0 with no reply line, and its evidence takes talk's error
---
duration_ms: 1359.251446
type: 'test'
...
# Subtest: row 195 accept: F1 fails on a unit that isn't active or isn't User=mosaic
ok 15 - row 195 accept: F1 fails on a unit that isn't active or isn't User=mosaic
---
duration_ms: 1214.848264
type: 'test'
...
# Subtest: row 195 accept: F2 fails when healthz doesn't answer and when another pid holds the port
ok 16 - row 195 accept: F2 fails when healthz doesn't answer and when another pid holds the port
---
duration_ms: 1318.107134
type: 'test'
...
# Subtest: row 195 accept: F5 fails on unpriv_bwrap (enforce), on complain and on a trailing space
ok 17 - row 195 accept: F5 fails on unpriv_bwrap (enforce), on complain and on a trailing space
---
duration_ms: 2891.844673
type: 'test'
...
# Subtest: row 195 accept: F5 fails with no bwrap of mosaic's, and passes on comm alone
ok 18 - row 195 accept: F5 fails with no bwrap of mosaic's, and passes on comm alone
---
duration_ms: 1370.822639
type: 'test'
...
# Subtest: row 195 accept: F6 fails on a stub that prints nothing, on a path outside claude-<pin> and on a .. segment
ok 19 - row 195 accept: F6 fails on a stub that prints nothing, on a path outside claude-<pin> and on a .. segment
---
duration_ms: 2098.024276
type: 'test'
...
# Subtest: row 195 accept: F7 fails on two live PM launches, one for another business, and no launch.by
ok 20 - row 195 accept: F7 fails on two live PM launches, one for another business, and no launch.by
---
duration_ms: 2106.445728
type: 'test'
...
# Subtest: row 195 accept: F8 fails on 0640, on another owner and on a symlink, and never prints the credential
ok 21 - row 195 accept: F8 fails on 0640, on another owner and on a symlink, and never prints the credential
---
duration_ms: 2002.61524
type: 'test'
...
# Subtest: row 195 accept: F9 fails on another owner, a group-writable mode and a number for the flag
ok 22 - row 195 accept: F9 fails on another owner, a group-writable mode and a number for the flag
---
duration_ms: 1861.992457
type: 'test'
...
# Subtest: row 195 accept: F9 won't run --node as root off the pin path or with a writable directory above it
ok 23 - row 195 accept: F9 won't run --node as root off the pin path or with a writable directory above it
---
duration_ms: 1901.812772
type: 'test'
...
# Subtest: row 195 accept: F11 fails on one *.json under discord/ and passes on an empty directory
ok 24 - row 195 accept: F11 fails on one *.json under discord/ and passes on an empty directory
---
duration_ms: 1431.808863
type: 'test'
...
# Subtest: row 195 accept: each P check reports unnamed on its fault, and the exit stays 0
ok 25 - row 195 accept: each P check reports unnamed on its fault, and the exit stays 0
---
duration_ms: 5915.695807
type: 'test'
...
# Subtest: row 195 accept: P2 is unnamed with a supplementary group, and P5 names docker
ok 26 - row 195 accept: P2 is unnamed with a supplementary group, and P5 names docker
---
duration_ms: 1423.353014
type: 'test'
...
# Subtest: row 195 accept: P5 is closed with no jarvis account, and P2 with an empty authorized_keys
ok 27 - row 195 accept: P5 is closed with no jarvis account, and P2 with an empty authorized_keys
---
duration_ms: 616.405224
type: 'test'
...
# Subtest: row 195 accept: P9 is unnamed once for each item missing
ok 28 - row 195 accept: P9 is unnamed once for each item missing
---
duration_ms: 3502.799413
type: 'test'
...
# Subtest: row253 accept: P10 fails its observation with another peer; P11 with the unit disabled
ok 29 - row253 accept: P10 fails its observation with another peer; P11 with the unit disabled
---
duration_ms: 1268.612039
type: 'test'
...
# Subtest: row 195 accept: every P check unnamed together still exits 0
ok 30 - row 195 accept: every P check unnamed together still exits 0
---
duration_ms: 517.656059
type: 'test'
...
# Subtest: row 195 accept: a bad args file refuses with exit 2 before any check, each for its own reason
ok 31 - row 195 accept: a bad args file refuses with exit 2 before any check, each for its own reason
---
duration_ms: 114.130545
type: 'test'
...
# Subtest: row 195 accept: usage errors and a run without --root as a user exit 2
ok 32 - row 195 accept: usage errors and a run without --root as a user exit 2
---
duration_ms: 12.783137
type: 'test'
...
# Subtest: row 195 accept: every in-instance call goes through sudo -u mosaic -H env PATH=<node dir>:...
ok 33 - row 195 accept: every in-instance call goes through sudo -u mosaic -H env PATH=<node dir>:...
---
duration_ms: 719.568395
type: 'test'
...
# Subtest: row 195 accept: the host check runs with --check and never --enforce
ok 34 - row 195 accept: the host check runs with --check and never --enforce
---
duration_ms: 753.65801
type: 'test'
...
1..34
# tests 34
# suites 0
# pass 34
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 99207.214655
@@ -1 +0,0 @@
["timeout", "-k", "10", "900", "node", "--test", "--test-reporter=tap", "packages/cli/tests/case2-unit.test.mjs"]
@@ -1,268 +0,0 @@
TAP version 13
# Subtest: row253 factory socket uses actual config and target-uid query without widening hardening
ok 1 - row253 factory socket uses actual config and target-uid query without widening hardening
---
duration_ms: 262.277524
type: 'test'
...
# Subtest: row253 installer refuses unsafe location and query facts before unit writes
ok 2 - row253 installer refuses unsafe location and query facts before unit writes
---
duration_ms: 2888.737963
type: 'test'
...
# Subtest: row253 query timeout kills its process group and leaves no running child
ok 3 - row253 query timeout kills its process group and leaves no running child
---
duration_ms: 7063.145938
type: 'test'
...
# Subtest: row253 protected homes refuse before any filesystem access
ok 4 - row253 protected homes refuse before any filesystem access
---
duration_ms: 9.095629
type: 'test'
...
# Subtest: row253 C4 sleep query has exact inner reason and cleans all members
ok 5 - row253 C4 sleep query has exact inner reason and cleans all members
---
duration_ms: 10654.435358
type: 'test'
...
# Subtest: row253 C4 signals query has exact inner reason and cleans all members
ok 6 - row253 C4 signals query has exact inner reason and cleans all members
---
duration_ms: 10558.851516
type: 'test'
...
# Subtest: row253 C4 member query has exact inner reason and cleans all members
ok 7 - row253 C4 member query has exact inner reason and cleans all members
---
duration_ms: 10575.034076
type: 'test'
...
# Subtest: row253 C4 overflow is output-limit in both sudo modes
ok 8 - row253 C4 overflow is output-limit in both sudo modes
---
duration_ms: 356.84676
type: 'test'
...
# Subtest: row253 C4 stalled supervisor uses the outer reason and explicit residual cleanup
ok 9 - row253 C4 stalled supervisor uses the outer reason and explicit residual cleanup
---
duration_ms: 14132.115825
type: 'test'
...
# Subtest: row253 C4 inline supervisor is byte-identical in both host scripts
ok 10 - row253 C4 inline supervisor is byte-identical in both host scripts
---
duration_ms: 0.332222
type: 'test'
...
# Subtest: row253 C4 cleanup budget starts after inventory pass one
ok 11 - row253 C4 cleanup budget starts after inventory pass one
---
duration_ms: 27.312099
type: 'test'
...
# Subtest: row253 query reaps its group even when a child closes stdout before the query returns
ok 12 - row253 query reaps its group even when a child closes stdout before the query returns
---
duration_ms: 125.14664
type: 'test'
...
# Subtest: row253 config parser is strict
ok 13 - row253 config parser is strict
---
duration_ms: 8.171201
type: 'test'
...
# Subtest: a clean library render writes both units 0644 with the fixed lines, and enables both then starts the bus then the Console
ok 14 - a clean library render writes both units 0644 with the fixed lines, and enables both then starts the bus then the Console
---
duration_ms: 94.172642
type: 'test'
...
# Subtest: PATH starts with the --node directory, for a node outside the default list and for /usr/bin/node
ok 15 - PATH starts with the --node directory, for a node outside the default list and for /usr/bin/node
---
duration_ms: 93.781364
type: 'test'
...
# Subtest: a failed bus start refuses with the Console not started
ok 16 - a failed bus start refuses with the Console not started
---
duration_ms: 91.475307
type: 'test'
...
# Subtest: the script never links a unit file
ok 17 - the script never links a unit file
---
duration_ms: 0.17219
type: 'test'
...
# Subtest: factory renders --pm once and one MOSAIC_CLAUDE_BIN line, and without them both tokens render empty
ok 18 - factory renders --pm once and one MOSAIC_CLAUDE_BIN line, and without them both tokens render empty
---
duration_ms: 533.168317
type: 'test'
...
# Subtest: a re-install over running units says they are still on the old copy and must restart together, never that it started them
ok 19 - a re-install over running units says they are still on the old copy and must restart together, never that it started them
---
duration_ms: 410.859392
type: 'test'
...
# Subtest: a re-install to another copy re-renders both units, and an edited installed unit refuses
ok 20 - a re-install to another copy re-renders both units, and an edited installed unit refuses
---
duration_ms: 978.008405
type: 'test'
...
# Subtest: a template with a namespace, user or system call restriction refuses
ok 21 - a template with a namespace, user or system call restriction refuses
---
duration_ms: 262.771603
type: 'test'
...
# Subtest: the bus template's EnvironmentFile line must be there and point at the session env, and the Console template must have none
ok 22 - the bus template's EnvironmentFile line must be there and point at the session env, and the Console template must have none
---
duration_ms: 178.505576
type: 'test'
...
# Subtest: a template holding an unknown token, PermissionsStartOnly or a privileged Exec prefix refuses
ok 23 - a template holding an unknown token, PermissionsStartOnly or a privileged Exec prefix refuses
---
duration_ms: 135.131551
type: 'test'
...
# Subtest: a symlink at either unit path refuses
ok 24 - a symlink at either unit path refuses
---
duration_ms: 164.772609
type: 'test'
...
# Subtest: a --node that is relative, not root-owned or under <home> refuses
ok 25 - a --node that is relative, not root-owned or under <home> refuses
---
duration_ms: 18.273626
type: 'test'
...
# Subtest: a re-install with a different --node or different serve flags refuses
ok 26 - a re-install with a different --node or different serve flags refuses
---
duration_ms: 454.1624
type: 'test'
...
# Subtest: an installed pair whose units name different copies refuses
ok 27 - an installed pair whose units name different copies refuses
---
duration_ms: 238.147366
type: 'test'
...
# Subtest: a copy id that is short, uppercase, holds / or .., or names no directory refuses
ok 28 - a copy id that is short, uppercase, holds / or .., or names no directory refuses
---
duration_ms: 26.564149
type: 'test'
...
# Subtest: library refuses a privileged-floor miss, a bad proof pair and every flag outside its set
ok 29 - library refuses a privileged-floor miss, a bad proof pair and every flag outside its set
---
duration_ms: 267.048019
type: 'test'
...
# Subtest: library refuses a proof file not owned by <user>'s uid
ok 30 - library refuses a proof file not owned by <user>'s uid
---
duration_ms: 17.16447
type: 'test'
...
# Subtest: factory refuses duplicate socket, a missing --port or --business, and each proxy flag
ok 31 - factory refuses duplicate socket, a missing --port or --business, and each proxy flag
---
duration_ms: 179.834197
type: 'test'
...
# Subtest: row253 factory refuses retired TCP and a value after the socket marker
ok 32 - row253 factory refuses retired TCP and a value after the socket marker
---
duration_ms: 27.35353
type: 'test'
...
# Subtest: factory refuses a --claude that is relative, not root-owned or under <home>, and a re-install with another --pm or --claude
ok 33 - factory refuses a --claude that is relative, not root-owned or under <home>, and a re-install with another --pm or --claude
---
duration_ms: 1109.424536
type: 'test'
...
# Subtest: the precheck passes on a good host and prints free memory, without the key
ok 34 - the precheck passes on a good host and prints free memory, without the key
---
duration_ms: 105.001864
type: 'test'
...
# Subtest: the precheck refuses each failed host check
ok 35 - the precheck refuses each failed host check
---
duration_ms: 912.086148
type: 'test'
...
# Subtest: the precheck refuses a user missing from passwd, a business file that does not load, and a symlinked run root
ok 36 - the precheck refuses a user missing from passwd, a business file that does not load, and a symlinked run root
---
duration_ms: 468.71868
type: 'test'
...
# Subtest: a bwrap that fails refuses and prints the sysctl and where bwrap is
ok 37 - a bwrap that fails refuses and prints the sysctl and where bwrap is
---
duration_ms: 103.211063
type: 'test'
...
# Subtest: an unprivileged port floor at or below the Console's port refuses, and so does a missing Console unit
ok 38 - an unprivileged port floor at or below the Console's port refuses, and so does a missing Console unit
---
duration_ms: 483.098555
type: 'test'
...
# Subtest: bus.tester: library refuses it on, factory needs it on, and factory refuses a library business
ok 39 - bus.tester: library refuses it on, factory needs it on, and factory refuses a library business
---
duration_ms: 397.641457
type: 'test'
...
# Subtest: the claude check runs only for a claude-code instance, and refuses a claude that appends or answers wrong
ok 40 - the claude check runs only for a claude-code instance, and refuses a claude that appends or answers wrong
---
duration_ms: 856.874242
type: 'test'
...
# Subtest: the claude check runs the bus unit's MOSAIC_CLAUDE_BIN over claude on PATH
ok 41 - the claude check runs the bus unit's MOSAIC_CLAUDE_BIN over claude on PATH
---
duration_ms: 262.683595
type: 'test'
...
# Subtest: the session env file refuses when missing, open to others, a symlink, empty, or emptied by a later line
ok 42 - the session env file refuses when missing, open to others, a symlink, empty, or emptied by a later line
---
duration_ms: 591.944048
type: 'test'
...
# Subtest: inside a session's sandbox a bind below 1024 fails with EACCES, and a bind on a free high port succeeds
ok 43 - inside a session's sandbox a bind below 1024 fails with EACCES, and a bind on a free high port succeeds
---
duration_ms: 82.554846
type: 'test'
...
1..43
# tests 43
# suites 0
# pass 43
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 66326.521088
@@ -1 +0,0 @@
["timeout", "-k", "10", "300", "node", "--test", "--test-reporter=tap", "packages/bus/tests/account-migration.test.mjs"]
@@ -1,28 +0,0 @@
TAP version 13
# Subtest: REQ-LIMIT-4 3h copy migrates to 3i: every row keeps its seq, the sequence carries over, and only the account CHECK changes
ok 1 - REQ-LIMIT-4 3h copy migrates to 3i: every row keeps its seq, the sequence carries over, and only the account CHECK changes
---
duration_ms: 82.597902
type: 'test'
...
# Subtest: REQ-LIMIT-4 a 3h→3i step that fails partway leaves the store at 3h with every row, the sequence and the schema intact
ok 2 - REQ-LIMIT-4 a 3h→3i step that fails partway leaves the store at 3h with every row, the sequence and the schema intact
---
duration_ms: 92.53462
type: 'test'
...
# Subtest: REQ-LIMIT-4 the 3h engine refuses a migrated store, migrating or not, and leaves it as it was
ok 3 - REQ-LIMIT-4 the 3h engine refuses a migrated store, migrating or not, and leaves it as it was
---
duration_ms: 81.102574
type: 'test'
...
1..3
# tests 3
# suites 0
# pass 3
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 340.975929
@@ -1 +0,0 @@
["timeout", "-k", "10", "300", "node", "--test", "--test-reporter=tap", "packages/bus/tests/chief-of-staff.test.mjs"]
@@ -1,271 +0,0 @@
TAP version 13
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# Subtest: REQ-COS-1, REQ-ROLE-2: the chief of staff ends a run with a reason and no decision, and the reason is logged
ok 1 - REQ-COS-1, REQ-ROLE-2: the chief of staff ends a run with a reason and no decision, and the reason is logged
---
duration_ms: 28.331746
type: 'test'
...
# Subtest: REQ-ROLE-2: a role without role.end still needs a resolved decision to revoke
ok 2 - REQ-ROLE-2: a role without role.end still needs a resolved decision to revoke
---
duration_ms: 26.434808
type: 'test'
...
# Subtest: REQ-ROLE-2: storage accepts a revoke with a reason or a decision and aborts one with neither
ok 3 - REQ-ROLE-2: storage accepts a revoke with a reason or a decision and aborts one with neither
---
duration_ms: 17.938787
type: 'test'
...
# Subtest: REQ-ROLE-2: the chief of staff may still cite a decision, and a decision alone is the old path
ok 4 - REQ-ROLE-2: the chief of staff may still cite a decision, and a decision alone is the old path
---
duration_ms: 18.620206
type: 'test'
...
# Subtest: REQ-ROLE-2: a role without role.end still ends a run through a resolved decision, which is recorded and has no reason
ok 5 - REQ-ROLE-2: a role without role.end still ends a run through a resolved decision, which is recorded and has no reason
---
duration_ms: 21.128166
type: 'test'
...
# Subtest: REQ-ROLE-2: a reason is required, bounded, and never sent with a decision
ok 6 - REQ-ROLE-2: a reason is required, bounded, and never sent with a decision
---
duration_ms: 23.298242
type: 'test'
...
# Subtest: REQ-COS-1: the chief of staff cannot end its own run; its end of the assistant stops the assistant's thread run
ok 7 - REQ-COS-1: the chief of staff cannot end its own run; its end of the assistant stops the assistant's thread run
---
duration_ms: 24.376739
type: 'test'
...
# Subtest: REQ-LIMIT-1, REQ-COS-1: organization.set from the chief of staff reaches the shared writer, named as the actor
ok 8 - REQ-LIMIT-1, REQ-COS-1: organization.set from the chief of staff reaches the shared writer, named as the actor
---
duration_ms: 18.346487
type: 'test'
...
# Subtest: REQ-LIMIT-1, REQ-COS-1: a refused organization.set logs action.refused and no action.allowed, like a refused limits.set
ok 9 - REQ-LIMIT-1, REQ-COS-1: a refused organization.set logs action.refused and no action.allowed, like a refused limits.set
---
duration_ms: 23.149091
type: 'test'
...
# Subtest: REQ-LIMIT-1: organization.set is refused for every caller whose role file lacks organization.change
ok 10 - REQ-LIMIT-1: organization.set is refused for every caller whose role file lacks organization.change
---
duration_ms: 26.114851
type: 'test'
...
# Subtest: REQ-LIMIT-1: the chief of staff is logged as allowed, and organization.set takes only the human's keys
ok 11 - REQ-LIMIT-1: the chief of staff is logged as allowed, and organization.set takes only the human's keys
---
duration_ms: 28.913122
type: 'test'
...
# Subtest: REQ-COS-1: organization.revision answers the revision alone to the chief of staff and spends nothing
ok 12 - REQ-COS-1: organization.revision answers the revision alone to the chief of staff and spends nothing
---
duration_ms: 23.086141
type: 'test'
...
# Subtest: REQ-COS-1, REQ-LIMIT-1: organization.revision is refused for every caller whose role file lacks organization.change
ok 13 - REQ-COS-1, REQ-LIMIT-1: organization.revision is refused for every caller whose role file lacks organization.change
---
duration_ms: 24.973528
type: 'test'
...
# Subtest: REQ-ROLE-3, REQ-LIMIT-1: a chief-of-staff change is validated, written and logged like a human's; an invalid one is refused
ok 14 - REQ-ROLE-3, REQ-LIMIT-1: a chief-of-staff change is validated, written and logged like a human's; an invalid one is refused
---
duration_ms: 121.448868
type: 'test'
...
# Subtest: REQ-COS-1: the chief of staff reads the revision, changes the file with it, and reads again after a stale one is refused
ok 15 - REQ-COS-1: the chief of staff reads the revision, changes the file with it, and reads again after a stale one is refused
---
duration_ms: 69.528621
type: 'test'
...
# Subtest: Q169: the chief of staff's change of the assistant is validated, written and logged; a stale or protection-stripping one is refused
ok 16 - Q169: the chief of staff's change of the assistant is validated, written and logged; a stale or protection-stripping one is refused
---
duration_ms: 77.400397
type: 'test'
...
# Subtest: row 65, Q169: the chief's change of the assistant's route runs the routing checks, and a valid one saves as the chief
ok 17 - row 65, Q169: the chief's change of the assistant's route runs the routing checks, and a valid one saves as the chief
---
duration_ms: 52.105961
type: 'test'
...
# Subtest: REQ-ROLE-2, REQ-COS-1: the 3c→3d migration lets the chief of staff end a held role with a reason; neither is still refused
ok 18 - REQ-ROLE-2, REQ-COS-1: the 3c→3d migration lets the chief of staff end a held role with a reason; neither is still refused
---
duration_ms: 75.179142
type: 'test'
...
# Subtest: row 194 T10: the chief's reason end of a kept instance refuses instance-kept, holds the claim and spends nothing
ok 19 - row 194 T10: the chief's reason end of a kept instance refuses instance-kept, holds the claim and spends nothing
---
duration_ms: 18.345149
type: 'test'
...
# Subtest: row 194 T10 (Q2): a role.revoke citing a decision the human resolved still ends a kept run
ok 20 - row 194 T10 (Q2): a role.revoke citing a decision the human resolved still ends a kept run
---
duration_ms: 19.386726
type: 'test'
...
# Subtest: row 194 T10 (B7): the chief's organization.set of a kept instance's model refuses before the writer; the human's limits.set does not
ok 21 - row 194 T10 (B7): the chief's organization.set of a kept instance's model refuses before the writer; the human's limits.set does not
---
duration_ms: 19.01179
type: 'test'
...
# Subtest: row 194 T13: organization.set and limits.set refuse the launch, retired, keep and noHire keys before the writer
ok 22 - row 194 T13: organization.set and limits.set refuse the launch, retired, keep and noHire keys before the writer
---
duration_ms: 23.117738
type: 'test'
...
# Subtest: row 194 T18 (D2.4): from a chief session veto.set and instances.set refuse, and nothing reaches the writer
ok 23 - row 194 T18 (D2.4): from a chief session veto.set and instances.set refuse, and nothing reaches the writer
---
duration_ms: 22.420802
type: 'test'
...
# Subtest: row 194 T8: the chief hires with a reason and no decision, the writer gets the reason as context, and the log names it
ok 24 - row 194 T8: the chief hires with a reason and no decision, the writer gets the reason as context, and the log names it
---
duration_ms: 21.138167
type: 'test'
...
# Subtest: row 194 T11: on a bus with two businesses, the chief of one hires and fires only in its own
ok 25 - row 194 T11: on a bus with two businesses, the chief of one hires and fires only in its own
---
duration_ms: 18.321241
type: 'test'
...
# Subtest: row 194 T8: hire and fire need a reason of 1 to 500 characters and refuse a decision key
ok 26 - row 194 T8: hire and fire need a reason of 1 to 500 characters and refuse a decision key
---
duration_ms: 29.401579
type: 'test'
...
# Subtest: row 194 T8 (sage-1471): only the chief hires or fires; every other role refuses role-not-chief, even one granted the actions
ok 27 - row 194 T8 (sage-1471): only the chief hires or fires; every other role refuses role-not-chief, even one granted the actions
---
duration_ms: 27.890795
type: 'test'
...
# Subtest: row 194 T8 (sage-1471): a chief whose authority lacks role.hire or role.fire refuses decision-required before the writer
ok 28 - row 194 T8 (sage-1471): a chief whose authority lacks role.hire or role.fire refuses decision-required before the writer
---
duration_ms: 39.940767
type: 'test'
...
# Subtest: row 194 T8a: a re-hire of a fired name goes to the writer like a hire, and the writer's refusals pass through by name
ok 29 - row 194 T8a: a re-hire of a fired name goes to the writer like a hire, and the writer's refusals pass through by name
---
duration_ms: 23.456981
type: 'test'
...
# Subtest: row 194 T8b: a definition is hireable only when every action is on HIRE_ALLOWED, it is version 2, the chief lists it and noHire doesn't
ok 30 - row 194 T8b: a definition is hireable only when every action is on HIRE_ALLOWED, it is version 2, the chief lists it and noHire doesn't
---
duration_ms: 664.437436
type: 'test'
...
# Subtest: row 194 T8b: a hire without the role files configured refuses not-configured
ok 31 - row 194 T8b: a hire without the role files configured refuses not-configured
---
duration_ms: 18.714128
type: 'test'
...
# Subtest: row 194 T9: a fire revokes the claim, cancels open requests, asks the launcher to kill the runs, then delists and logs
ok 32 - row 194 T9: a fire revokes the claim, cancels open requests, asks the launcher to kill the runs, then delists and logs
---
duration_ms: 21.402072
type: 'test'
...
# Subtest: row 194 T9a (bus): a fire end's done writes lifecycle.end.killed and lifecycle.end.alive with run and pid, and an unknown stop's reason; a terminate's done or a bad stop refuses
ok 33 - row 194 T9a (bus): a fire end's done writes lifecycle.end.killed and lifecycle.end.alive with run and pid, and an unknown stop's reason; a terminate's done or a bad stop refuses
---
duration_ms: 25.798012
type: 'test'
...
# Subtest: row 194 T9: fire refusals come before step A and leave the claim, the requests and the file alone
ok 34 - row 194 T9: fire refusals come before step A and leave the claim, the requests and the file alone
---
duration_ms: 22.191888
type: 'test'
...
# Subtest: row 194 T9c: a writer failure at B leaves the instance firing, and the repeat delists and logs once
ok 35 - row 194 T9c: a writer failure at B leaves the instance firing, and the repeat delists and logs once
---
duration_ms: 23.500086
type: 'test'
...
# Subtest: row 194 T9c: a failure at C leaves the fire unlogged and the instance firing, and the repeat logs it
ok 36 - row 194 T9c: a failure at C leaves the fire unlogged and the instance firing, and the repeat logs it
---
duration_ms: 24.322177
type: 'test'
...
# Subtest: row 194 W-N1: a fire.done before a later fire.stopped of the same instance leaves it firing; another instance's done does not end it
ok 37 - row 194 W-N1: a fire.done before a later fire.stopped of the same instance leaves it firing; another instance's done does not end it
---
duration_ms: 21.989082
type: 'test'
...
# Subtest: row 194 T10: a hire or fire of a kept name refuses instance-kept before the writer
ok 38 - row 194 T10: a hire or fire of a kept name refuses instance-kept before the writer
---
duration_ms: 18.687603
type: 'test'
...
# Subtest: row 194 T10: a fire the writer's check refuses from the file stops nothing and leaves the instance launchable
ok 39 - row 194 T10: a fire the writer's check refuses from the file stops nothing and leaves the instance launchable
---
duration_ms: 18.529568
type: 'test'
...
# Subtest: row 194 T18: hire and fire take only their own keys, and a refused call writes nothing
ok 40 - row 194 T18: hire and fire take only their own keys, and a refused call writes nothing
---
duration_ms: 24.530376
type: 'test'
...
# Subtest: row 194 T8, T9, T18: through the runtime the chief hires and fires with the real writer, the receipt carries the reason, and a refusal leaves the file alone
ok 41 - row 194 T8, T9, T18: through the runtime the chief hires and fires with the real writer, the receipt carries the reason, and a refusal leaves the file alone
---
duration_ms: 67.04966
type: 'test'
...
# Subtest: row 194 W-N1: the launcher's take of a launch or regenerate of a firing instance closes it as instance-firing
ok 42 - row 194 W-N1: the launcher's take of a launch or regenerate of a firing instance closes it as instance-firing
---
duration_ms: 24.174855
type: 'test'
...
1..42
# tests 42
# suites 0
# pass 42
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 2069.126162
@@ -1 +0,0 @@
["timeout", "-k", "10", "300", "node", "--test", "--test-reporter=tap", "packages/bus/tests/comment-migration.test.mjs"]
@@ -1,40 +0,0 @@
TAP version 13
# Subtest: explicit 3b copy migration preserves evidence and opens as 3g; normal startup never migrates
ok 1 - explicit 3b copy migration preserves evidence and opens as 3g; normal startup never migrates
---
duration_ms: 66.915434
type: 'test'
...
# Subtest: migration refuses active writers and drifted legacy schemas, with no partial upgrade
ok 2 - migration refuses active writers and drifted legacy schemas, with no partial upgrade
---
duration_ms: 87.090397
type: 'test'
...
# Subtest: named migration registry chains 3b through 3g to a fixture-only future version in order
ok 3 - named migration registry chains 3b through 3g to a fixture-only future version in order
---
duration_ms: 92.896241
type: 'test'
...
# Subtest: migration refuses mismatched source metadata without changing schema or evidence
ok 4 - migration refuses mismatched source metadata without changing schema or evidence
---
duration_ms: 36.477831
type: 'test'
...
# Subtest: offline command migrates only the supplied fixture root and reports usage errors
ok 5 - offline command migrates only the supplied fixture root and reports usage errors
---
duration_ms: 168.952237
type: 'test'
...
1..5
# tests 5
# suites 0
# pass 5
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 517.394008
@@ -1 +0,0 @@
["timeout", "-k", "10", "300", "node", "--test", "--test-reporter=tap", "packages/bus/tests/end-launch.test.mjs"]
@@ -1,52 +0,0 @@
TAP version 13
# Subtest: endLaunch writes session.ended, releases the run claim and kills its capabilities
ok 1 - endLaunch writes session.ended, releases the run claim and kills its capabilities
---
duration_ms: 19.923626
type: 'test'
...
# Subtest: endLaunch refuses an unknown run, a second end and a rebind of the ended run
ok 2 - endLaunch refuses an unknown run, a second end and a rebind of the ended run
---
duration_ms: 11.57898
type: 'test'
...
# Subtest: a restarted broker refuses to rebind an ended run; a refused rebind leaves the run unbound
ok 3 - a restarted broker refuses to rebind an ended run; a refused rebind leaves the run unbound
---
duration_ms: 13.959669
type: 'test'
...
# Subtest: endLaunch leaves a claim another run took alone
ok 4 - endLaunch leaves a claim another run took alone
---
duration_ms: 15.607261
type: 'test'
...
# Subtest: refuse records action.refused against the caller with the code only
ok 5 - refuse records action.refused against the caller with the code only
---
duration_ms: 11.34653
type: 'test'
...
# Subtest: launches off refuses role.launch with launch-revoked until launches on
ok 6 - launches off refuses role.launch with launch-revoked until launches on
---
duration_ms: 15.612767
type: 'test'
...
# Subtest: broker process: launch ops authorize role.launch, record refusals and end runs
ok 7 - broker process: launch ops authorize role.launch, record refusals and end runs
---
duration_ms: 162.081295
type: 'test'
...
1..7
# tests 7
# suites 0
# pass 7
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 323.68804
@@ -1 +0,0 @@
["timeout", "-k", "10", "300", "node", "--test", "--test-reporter=tap", "packages/bus/tests/fire-revokes-grants.test.mjs"]
@@ -1,142 +0,0 @@
TAP version 13
# Subtest: row 281 T2: a fire with host grants on two hosts and a Gitea grant answers with a job, then revokes all three
ok 1 - row 281 T2: a fire with host grants on two hosts and a Gitea grant answers with a job, then revokes all three
---
duration_ms: 232.783752
type: 'test'
...
# Subtest: row 281 T3 (sage-2575): a delete with grants takes two requests: the first starts the job, the next completes
ok 2 - row 281 T3 (sage-2575): a delete with grants takes two requests: the first starts the job, the next completes
---
duration_ms: 223.116777
type: 'test'
...
# Subtest: row 281 T3b (Q2): a delete whose job refuses on host B; the retry refuses grant-revoke-failed and revokes only B and Gitea
ok 3 - row 281 T3b (Q2): a delete whose job refuses on host B; the retry refuses grant-revoke-failed and revokes only B and Gitea
---
duration_ms: 211.879543
type: 'test'
...
# Subtest: row 281 T3b: B cleared by hand with hosts.revoke; the next delete starts a job for Gitea and the leftover line only
ok 4 - row 281 T3b: B cleared by hand with hosts.revoke; the next delete starts a job for Gitea and the leftover line only
---
duration_ms: 208.941116
type: 'test'
...
# Subtest: row 281 T3c (sage-2575 condition 4): a delete of an instance with no grant completes in one request
ok 5 - row 281 T3c (sage-2575 condition 4): a delete of an instance with no grant completes in one request
---
duration_ms: 52.070752
type: 'test'
...
# Subtest: row 281 T4: host B unreachable in a fire: the job refuses, A stays revoked, B and Gitea untouched; a repeat completes
ok 6 - row 281 T4: host B unreachable in a fire: the job refuses, A stays revoked, B and Gitea untouched; a repeat completes
---
duration_ms: 193.713805
type: 'test'
...
# Subtest: row 281 T4b (Q1): a line a manual hosts.revoke left on C is removed by the fire, with its close
ok 7 - row 281 T4b (Q1): a line a manual hosts.revoke left on C is removed by the fire, with its close
---
duration_ms: 100.196392
type: 'test'
...
# Subtest: row 281 T4b (Q1): with C unreachable, the fire completes and names the line in grantsLeft
ok 8 - row 281 T4b (Q1): with C unreachable, the fire completes and names the line in grantsLeft
---
duration_ms: 82.925658
type: 'test'
...
# Subtest: row 281 T5: Gitea's admin token can't be checked: the job refuses with the Gitea grant intact
ok 9 - row 281 T5: Gitea's admin token can't be checked: the job refuses with the Gitea grant intact
---
duration_ms: 112.342135
type: 'test'
...
# Subtest: row 281 T5b (N1): a failed token DELETE refuses gitea-left; the repeat retries only this agent's entries
ok 10 - row 281 T5b (N1): a failed token DELETE refuses gitea-left; the repeat retries only this agent's entries
---
duration_ms: 295.497967
type: 'test'
...
# Subtest: row 281 T6 (sage-2574): a host decision approved before the fire and run after it ends revoked, with nothing applied
ok 11 - row 281 T6 (sage-2574): a host decision approved before the fire and run after it ends revoked, with nothing applied
---
duration_ms: 64.894992
type: 'test'
...
# Subtest: row 281 T6b (sage-2574): a Gitea decision approved before the fire and run after it ends revoked before any Gitea write
ok 12 - row 281 T6b (sage-2574): a Gitea decision approved before the fire and run after it ends revoked before any Gitea write
---
duration_ms: 86.54008
type: 'test'
...
# Subtest: row 281 T6c: a host executor in flight aborts and ends revoked; a Gitea executor in flight is awaited and leaves no token
ok 13 - row 281 T6c: a host executor in flight aborts and ends revoked; a Gitea executor in flight is awaited and leaves no token
---
duration_ms: 237.49431
type: 'test'
...
# Subtest: row 281 T6d (B1): undecided host and Gitea decisions are in the set, and approved after the fire both end revoked
ok 14 - row 281 T6d (B1): undecided host and Gitea decisions are in the set, and approved after the fire both end revoked
---
duration_ms: 92.642809
type: 'test'
...
# Subtest: row 281 T6e (B1): a grant raise refuses instance-fired while firing and after the fire, goes through after a rehire, and refuses grant-revoke-running during a delete job
ok 15 - row 281 T6e (B1): a grant raise refuses instance-fired while firing and after the fire, goes through after a rehire, and refuses grant-revoke-running during a delete job
---
duration_ms: 104.408759
type: 'test'
...
# Subtest: row 281 T7: an instance with no grant fires as today, synchronously, with the same events
ok 16 - row 281 T7: an instance with no grant fires as today, synchronously, with the same events
---
duration_ms: 52.79141
type: 'test'
...
# Subtest: row 281 T9 (B3): one step G per agent; the manual verbs refuse while it runs, and sweep names it running
ok 17 - row 281 T9 (B3): one step G per agent; the manual verbs refuse while it runs, and sweep names it running
---
duration_ms: 223.695847
type: 'test'
...
# Subtest: row 281 T10 (B2): the fire and the delete answer while their jobs are held, and the broker answers other verbs
ok 18 - row 281 T10 (B2): the fire and the delete answer while their jobs are held, and the broker answers other verbs
---
duration_ms: 196.138967
type: 'test'
...
# Subtest: row 281 T11 (C1): a fire's job completes after the chief's run ends and processing halts
ok 19 - row 281 T11 (C1): a fire's job completes after the chief's run ends and processing halts
---
duration_ms: 81.192633
type: 'test'
...
# Subtest: row 281 T12 (C1, N7): a step B refusal in the job is fire.failed, and the repeat runs B and C synchronously
ok 20 - row 281 T12 (C1, N7): a step B refusal in the job is fire.failed, and the repeat runs B and C synchronously
---
duration_ms: 76.945309
type: 'test'
...
# Subtest: row 281 T13 (N4): a restart records each held job interrupted once, with one message each; an ended job gets none
ok 21 - row 281 T13 (N4): a restart records each held job interrupted once, with one message each; an ended job gets none
---
duration_ms: 129.403455
type: 'test'
...
# Subtest: row 281 T14 (N1, sage-2653): a host removed under an undecided decision stops the fire on host-unknown; the human's no closes it, and the repeat fire has no job
ok 22 - row 281 T14 (N1, sage-2653): a host removed under an undecided decision stops the fire on host-unknown; the human's no closes it, and the repeat fire has no job
---
duration_ms: 61.78992
type: 'test'
...
1..22
# tests 22
# suites 0
# pass 22
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 3217.339801
@@ -1 +0,0 @@
["timeout", "-k", "10", "300", "node", "--test", "--test-reporter=tap", "packages/bus/tests/gitea-grant.test.mjs"]
@@ -1,304 +0,0 @@
TAP version 13
# Subtest: versionAtLeast compares numbers and refuses a prerelease of 1.27.0
ok 1 - versionAtLeast compares numbers and refuses a prerelease of 1.27.0
---
duration_ms: 1.237036
type: 'test'
...
# Subtest: X-G1: a raise that fails a check refuses and stores nothing
ok 2 - X-G1: a raise that fails a check refuses and stores nothing
---
duration_ms: 62.068324
type: 'test'
...
# Subtest: X-G1: a creative role, a role without identity and a missing or due slot refuse at raise
ok 3 - X-G1: a creative role, a role without identity and a missing or due slot refuse at raise
---
duration_ms: 180.218463
type: 'test'
...
# Subtest: X-G2: admin set refuses each failed check and writes nothing, then writes the slot once
ok 4 - X-G2: admin set refuses each failed check and writes nothing, then writes the slot once
---
duration_ms: 143.52952
type: 'test'
...
# Subtest: X-G3 to X-G8: an approve makes the user, mints the token, forks, checks reach and writes the file, record and grant.applied
ok 5 - X-G3 to X-G8: an approve makes the user, mints the token, forks, checks reach and writes the file, record and grant.applied
---
duration_ms: 102.221906
type: 'test'
...
# Subtest: X-G4: a user this stack did not make, an admin, a disabled user and a remade user each refuse
ok 6 - X-G4: a user this stack did not make, an admin, a disabled user and a remade user each refuse
---
duration_ms: 306.504597
type: 'test'
...
# Subtest: X-G6 and X-G8: the user and mint steps are written before their calls, and each result after its call
ok 7 - X-G6 and X-G8: the user and mint steps are written before their calls, and each result after its call
---
duration_ms: 100.565961
type: 'test'
...
# Subtest: X-G4: a fork by the seat user of another repository than the project refuses fork-foreign
ok 8 - X-G4: a fork by the seat user of another repository than the project refuses fork-foreign
---
duration_ms: 79.418473
type: 'test'
...
# Subtest: X-G5: a failure after the mint deletes the token, unloads nothing it did not load and leaves no file
ok 9 - X-G5: a failure after the mint deletes the token, unloads nothing it did not load and leaves no file
---
duration_ms: 124.149748
type: 'test'
...
# Subtest: X-G5: a token delete that fails is left at Gitea, shown by status and taken by sweep
ok 10 - X-G5: a token delete that fails is left at Gitea, shown by status and taken by sweep
---
duration_ms: 128.702874
type: 'test'
...
# Subtest: X-G5: a mint that fails deletes by name, and a refusal at step 0 leaves the decision unspent
ok 11 - X-G5: a mint that fails deletes by name, and a refusal at step 0 leaves the decision unspent
---
duration_ms: 145.353601
type: 'test'
...
# Subtest: X-G5: an agent held for an unknown token is refused at step 0 with no Gitea call
ok 12 - X-G5: an agent held for an unknown token is refused at step 0 with no Gitea call
---
duration_ms: 65.829336
type: 'test'
...
# Subtest: X-G5 and X-G9 (step 7): a rotation whose old-token delete fails stays applied with the old id left
ok 13 - X-G5 and X-G9 (step 7): a rotation whose old-token delete fails stays applied with the old id left
---
duration_ms: 170.790626
type: 'test'
...
# Subtest: X-G10: in a rotation the store file holds the new token before the old one is deleted
ok 14 - X-G10: in a rotation the store file holds the new token before the old one is deleted
---
duration_ms: 145.852525
type: 'test'
...
# Subtest: X-G6: a rotation cut before the rename settles back at once, and the old token stays live
ok 15 - X-G6: a rotation cut before the rename settles back at once, and the old token stays live
---
duration_ms: 167.483708
type: 'test'
...
# Subtest: X-G6: a rotation whose step 8 write fails is settle-pending, and a restart settles it forward
ok 16 - X-G6: a rotation whose step 8 write fails is settle-pending, and a restart settles it forward
---
duration_ms: 178.569723
type: 'test'
...
# Subtest: X-G6: a restart settles an open rotation back when the file still holds the old token
ok 17 - X-G6: a restart settles an open rotation back when the file still holds the old token
---
duration_ms: 134.9967
type: 'test'
...
# Subtest: X-G6: a restart settles an open rotation forward when the file holds the new token
ok 18 - X-G6: a restart settles an open rotation forward when the file holds the new token
---
duration_ms: 113.009774
type: 'test'
...
# Subtest: X-G6: a 401 on the file token loses the grant: both tokens go, the record goes and memory unloads
ok 19 - X-G6: a 401 on the file token loses the grant: both tokens go, the record goes and memory unloads
---
duration_ms: 136.104972
type: 'test'
...
# Subtest: X-G6: a 403, 404, 500, a hang and a dropped socket each leave the rotation settle-pending with nothing deleted
ok 20 - X-G6: a 403, 404, 500, a hang and a dropped socket each leave the rotation settle-pending with nothing deleted
---
duration_ms: 996.868783
type: 'test'
...
# Subtest: X-G6: a file token no grant minted is held; the next restart says so again; a revoke clears it and takes both ids
ok 21 - X-G6: a file token no grant minted is held; the next restart says so again; a revoke clears it and takes both ids
---
duration_ms: 155.766188
type: 'test'
...
# Subtest: N9: a revoke of an open rotation, then a restart: no settle, no Gitea call and no message
ok 22 - N9: a revoke of an open rotation, then a restart: no settle, no Gitea call and no message
---
duration_ms: 113.207925
type: 'test'
...
# Subtest: N9: a 404 on a delete by id counts as done
ok 23 - N9: a 404 on a delete by id counts as done
---
duration_ms: 128.801734
type: 'test'
...
# Subtest: X-G6: a restart undoes each step a killed child left, and spends an approved unspent decision
ok 24 - X-G6: a restart undoes each step a killed child left, and spends an approved unspent decision
---
duration_ms: 416.149926
type: 'test'
...
# Subtest: X-G6: a restart with no admin slot leaves the user an orphan and the token left
ok 25 - X-G6: a restart with no admin slot leaves the user an orphan and the token left
---
duration_ms: 53.694027
type: 'test'
...
# Subtest: X-G7: a change to the definition, identity, publish remotes or admin slot after the raise ends decision-mismatch
ok 26 - X-G7: a change to the definition, identity, publish remotes or admin slot after the raise ends decision-mismatch
---
duration_ms: 140.801435
type: 'test'
...
# Subtest: X-G7 and X-G9: an admin rotate voids open decisions, and rotate --finish deletes what was left
ok 27 - X-G7 and X-G9: an admin rotate voids open decisions, and rotate --finish deletes what was left
---
duration_ms: 123.822535
type: 'test'
...
# Subtest: X-G9: a rotate whose name is taken refuses and writes nothing; remove takes the slot away
ok 28 - X-G9: a rotate whose name is taken refuses and writes nothing; remove takes the slot away
---
duration_ms: 73.422448
type: 'test'
...
# Subtest: X-G9: a slot past its rotate-by date refuses a run at step 0, leaving the decision unspent
ok 29 - X-G9: a slot past its rotate-by date refuses a run at step 0, leaving the decision unspent
---
duration_ms: 50.180389
type: 'test'
...
# Subtest: X-G11: run refuses every caller but the human, an unapproved, a spent and a busy decision
ok 30 - X-G11: run refuses every caller but the human, an unapproved, a spent and a busy decision
---
duration_ms: 105.874572
type: 'test'
...
# Subtest: kill switch (plan :16): while halted the chief still reads grants.status, and an agent grants.revoke refuses
ok 31 - kill switch (plan :16): while halted the chief still reads grants.status, and an agent grants.revoke refuses
---
duration_ms: 106.333602
type: 'test'
...
# Subtest: X-G11: a revoke while the executor runs aborts it and the grant ends revoked
ok 32 - X-G11: a revoke while the executor runs aborts it and the grant ends revoked
---
duration_ms: 110.333063
type: 'test'
...
# Subtest: X-G11: a revoke unloads memory and removes the file before its Gitea delete
ok 33 - X-G11: a revoke unloads memory and removes the file before its Gitea delete
---
duration_ms: 132.61075
type: 'test'
...
# Subtest: X-G11: a revoke during a rotation step 7 ends it revoked, and step 8 writes no record back
ok 34 - X-G11: a revoke during a rotation step 7 ends it revoked, and step 8 writes no record back
---
duration_ms: 217.837803
type: 'test'
...
# Subtest: X-G11: a revoke while a sweep settles a rotation, forward or back, ends it revoked with no record
ok 35 - X-G11: a revoke while a sweep settles a rotation, forward or back, ends it revoked with no record
---
duration_ms: 373.129907
type: 'test'
...
# Subtest: X-G11: a revoke during a settle whoami that finds a foreign token ends it revoked, not held
ok 36 - X-G11: a revoke during a settle whoami that finds a foreign token ends it revoked, not held
---
duration_ms: 159.428511
type: 'test'
...
# Subtest: X-G11: a revoke during a settle whoami that gets a 401 ends it revoked, not lost
ok 37 - X-G11: a revoke during a settle whoami that gets a 401 ends it revoked, not lost
---
duration_ms: 190.121277
type: 'test'
...
# Subtest: X-G12: a token that reaches wider than its forks fails with the repository named
ok 38 - X-G12: a token that reaches wider than its forks fails with the repository named
---
duration_ms: 422.103379
type: 'test'
...
# Subtest: X-G12: reach is paged by X-Total-Count and a count that does not add up refuses
ok 39 - X-G12: reach is paged by X-Total-Count and a count that does not add up refuses
---
duration_ms: 268.091756
type: 'test'
...
# Subtest: X-G13: an agent cannot record a grant event, and the trigger refuses one from any writer but the grant writer
ok 40 - X-G13: an agent cannot record a grant event, and the trigger refuses one from any writer but the grant writer
---
duration_ms: 41.808143
type: 'test'
...
# Subtest: X-G14: credentials delete fires the user: tokens go, login is prohibited, and grant.revoke.closed records it
ok 41 - X-G14: credentials delete fires the user: tokens go, login is prohibited, and grant.revoke.closed records it
---
duration_ms: 293.964549
type: 'test'
...
# Subtest: X-G14: a fire whose token delete or login PATCH fails lands it in serviceLeft
ok 42 - X-G14: a fire whose token delete or login PATCH fails lands it in serviceLeft
---
duration_ms: 155.089131
type: 'test'
...
# Subtest: X-G14: a fire whose user is gone or remade skips the fire steps and says why
ok 43 - X-G14: a fire whose user is gone or remade skips the fire steps and says why
---
duration_ms: 259.152973
type: 'test'
...
# Subtest: X-G14: a sweep retries a fire only for the user it fired: a remade or gone user is skipped and named
ok 44 - X-G14: a sweep retries a fire only for the user it fired: a remade or gone user is skipped and named
---
duration_ms: 347.428274
type: 'test'
...
# Subtest: X-G14: a revoke Gitea cannot reach stays open, and a restart closes it
ok 45 - X-G14: a revoke Gitea cannot reach stays open, and a restart closes it
---
duration_ms: 116.580427
type: 'test'
...
# Subtest: row 281 T8: a tester grants.revoke refuses tester-dev-only once bus.tester is off; the human revoke keeps its records and starts no job
ok 46 - row 281 T8: a tester grants.revoke refuses tester-dev-only once bus.tester is off; the human revoke keeps its records and starts no job
---
duration_ms: 132.268866
type: 'test'
...
# Subtest: X-G15: look-alike commit steps outside the grant writer are ignored at start, by revoke and by status
ok 47 - X-G15: look-alike commit steps outside the grant writer are ignored at start, by revoke and by status
---
duration_ms: 127.609667
type: 'test'
...
# Subtest: X-G15: a look-alike spend under another kind with the grant writer pair is not an open grant
ok 48 - X-G15: a look-alike spend under another kind with the grant writer pair is not an open grant
---
duration_ms: 43.046865
type: 'test'
...
# Subtest: status lists the slot, users, grants and nothing secret, and every grants verb needs service gitea
ok 49 - status lists the slot, users, grants and nothing secret, and every grants verb needs service gitea
---
duration_ms: 109.158689
type: 'test'
...
1..49
# tests 49
# suites 0
# pass 49
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 8542.307737
Loaded 100 of 1672 files, more files were not shown because too many files have changed in this diff. Show more