Compare commits
2
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 jason.woltje
|
16e809457e | ||
|
jason.woltje
|
0761e603c0 |
@@ -1,449 +0,0 @@
|
||||
# Row 269 build notes (Gizmoduck)
|
||||
|
||||
264b, T1 item 7: per-session native store, workspace and single-writer fence. Gitea #1774. Brief:
|
||||
docs/plans/2026-10-21_t1-sessions.md (blob ff0be0c79), slices in agents/sage/work/queue-264/RULINGS.md
|
||||
(5f5b51dd6). Reviewer Duckworth, gate owner Sage. Plan gizmoduck-0228, accepted with rulings in
|
||||
sage-2707. Branch gizmoduck/row269 from refactor aca16404c. Row 253 lands first, and this branch is
|
||||
rebased onto its tip, under a new name, before the gate.
|
||||
|
||||
Claim: rev 3217, op gizmoduck-0230, 2026-10-22 14:29:42Z. That was 21 s after Gander's slot opened
|
||||
at 14:29:21Z (sage-2710). Reported in gizmoduck-0231 and not reverted, since a revert would be a
|
||||
second queue write.
|
||||
|
||||
## D9 consumer audit, sessions.json (sage-2707 Q3)
|
||||
|
||||
Q3 allows `session` as an optional field with no version bump, if every sessions.json reader at
|
||||
84f53540d selects by run and not by business, instance or thread. Every reader at 84f53540d:
|
||||
|
||||
| Reader | file:line at 84f53540d | Selects by |
|
||||
| --- | --- | --- |
|
||||
| `readSessions` (the only parser) | packages/seat/src/session.mjs:232-243 | nothing. Refuses any `sessionsVersion` but 1 (:241) and returns every entry with `live` |
|
||||
| `stopSession` (`mosaic stop <run>`) | session.mjs:249-250 | run (`s.run === run`) |
|
||||
| `launches list` | packages/cli/src/cli.mjs:526-530 | nothing. Prints every entry, and `--json` dumps them whole |
|
||||
| host start, `leftover` | packages/cli/src/launcher.mjs:235 | business, then `recover()` works one entry (one run) at a time (:955-972) |
|
||||
| runtime launch settings | packages/bus/src/runtime.mjs:149 -> packages/business/src/launch-settings.mjs:166 -> packages/business/src/launch.mjs:116-135 (`usageCounts`) | business. Counts entries per provider and model |
|
||||
| Console settings (C1, duckworth-0150) | packages/webui/src/reads.mjs:234 -> the same launchSettings `read()` -> readSessions | business, through usageCounts. Any throw becomes `launch: {refused: 'not-configured'}` |
|
||||
| stack-release R guard (C1) | scripts/stack-release.sh:2091-2096, its own JSON.parse, no version check | nothing. Takes `pid` and `runnerPid` of every entry in `sessions` and fails `sessions-live` if one is alive in /proc |
|
||||
|
||||
Not a reader: stack-release.sh:2199-2204 checks only that no sessions.json exists. packages/ledger
|
||||
readSessions (ledger.mjs:146) is a different function that reads seat directories.
|
||||
launch-settings `current()` (:129) doesn't call `sessions()`, so the limits the bus enforces don't
|
||||
read the file; only the `limits` verb's `read()` (:166, runtime.mjs:292) does.
|
||||
|
||||
Tests that read the file: packages/cli/tests/launcher.test.mjs (`readSessions` at :164 through
|
||||
:1097, each by run, by instance or whole) and packages/cli/tests/host.test.mjs:830 (file absent).
|
||||
|
||||
Not a file reader: `Registry` (session.mjs:192-230). Its list starts empty (:193), and the constructor
|
||||
writes it over the file (:198). `running(business, instance, thread)` at :217 is the one key on the
|
||||
thread, but it reads only the in-memory list this host added (launcher.mjs:529, removed at :553).
|
||||
Its callers are launcher.mjs:289 (check) and the thread pass. This row changes that key (see Design).
|
||||
|
||||
Result: no file reader keys on the thread. Q3's condition holds as worded.
|
||||
|
||||
One more finding sends me to v2 anyway. `recover()` rebinds a leftover run with
|
||||
`{business, role, run, harness, pid, startTime, thread}` and no `session` (launcher.mjs:964).
|
||||
The broker compares that record's body with the recorded `session.launched` body, and the body
|
||||
carries `session` whenever the launch record had one (broker.mjs:945). A mismatch refuses
|
||||
`launch-record-mismatch` (broker.mjs:952). Each new thread run binds with its session (Design), so
|
||||
after a rollback to 264a, a 264a host that finds a 264b entry logs "not ended, bindLaunch refused:
|
||||
launch-record-mismatch" (launcher.mjs:968), and the run's claim stays held. The host has
|
||||
already killed the process (:956-962), but it can't end the run. With v1 and an optional field,
|
||||
that failure is quiet.
|
||||
|
||||
Decision: sessions.json goes to v2 (`SESSIONS_VERSION` 2). New code reads v1 and v2 and writes v2.
|
||||
A v2 file keeps the `sessions` array and every v1 field of each entry, `pid` and `runnerPid`
|
||||
included, so the R guard (stack-release.sh:2094-2095) reads it unchanged (C1).
|
||||
A v1 entry has no `session`, and it is treated as the thread's legacy default session (D9). After a
|
||||
rollback, a 264a host refuses to start with exit 3, "sessions file is malformed"
|
||||
(session.mjs:241 via launcher.mjs:237), and the README's remedy applies: check which sessions still
|
||||
run, then move the file aside. Tradeoff: a rollback while runs are live needs a hand step, but it
|
||||
fails loudly at host start instead of leaving held claims. The rollback note names this refusal.
|
||||
|
||||
## D9 consumer audit, threadsState and threadIdle (sage-2707 audit addition)
|
||||
|
||||
These are trusted launcher APIs, not socket verbs (packages/bus/README.md:288, :294), and they're
|
||||
reached only through the host op table (packages/bus/src/process.mjs:23-24, :54-55;
|
||||
runtime.mjs:561-562). At aca16404c:
|
||||
|
||||
| Consumer | file:line | What it reads |
|
||||
| --- | --- | --- |
|
||||
| launcher thread pass | packages/cli/src/launcher.mjs:596, :611 | every row's `thread`, `holder`, `pending`, `unread`; threadIdle `{business, thread, run}` |
|
||||
| bus end-launch.test | packages/bus/tests/end-launch.test.mjs:193, :198 | whole rows (deepEqual), and `not-holder` |
|
||||
| bus thread-migration.test | packages/bus/tests/thread-migration.test.mjs:139 | `thread, holder, pending, unread` |
|
||||
| bus threads.test | packages/bus/tests/threads.test.mjs:352, :375-376, :407, :416 | rows keyed by `thread` |
|
||||
| cli launcher.test stub | packages/cli/tests/launcher.test.mjs:989 | wraps `host.op`, counts the op name |
|
||||
| cli lifecycle.test stub | packages/cli/tests/lifecycle.test.mjs:90-91, :749-752 | passes through, wraps `runtime.threadsState` |
|
||||
| cli thread-launch.test stub | packages/cli/tests/thread-launch.test.mjs:90-91, :163, :264-265, :304, :348, :443 | `.find(x => x.thread === ...)` then `holder` |
|
||||
|
||||
Console and webui: no reader. `git grep threadsState` over packages/webui, packages/control-board and
|
||||
scripts has no hit. The webui reads `thread.claims` (packages/webui/src/serve.mjs, cli.mjs,
|
||||
public/bus.js, tests shell.test, thread-claims.test, thread-claims-browser.test). This row doesn't change
|
||||
`thread.claims`. The webui's `session.launched` line reads only `harness` and `address`
|
||||
(public/bus.js:151), so a `session` field in the body changes nothing it shows.
|
||||
|
||||
## D9 consumer audit, workspace and native store
|
||||
|
||||
| Consumer | file:line at aca16404c | Change in this row |
|
||||
| --- | --- | --- |
|
||||
| `workspaceDir` | packages/seat/src/session.mjs:49 | unchanged, still the non-thread path and the legacy path |
|
||||
| launcher start, workspace | packages/cli/src/launcher.mjs:397-403 | a thread run uses its session workspace (Q1) |
|
||||
| launcher instance delete (V5) | launcher.mjs:841-866 | also retires the instance's session workspaces |
|
||||
| `threadStore` | session.mjs:59-74, launcher.mjs:388-393 | becomes the legacy branch of `sessionStore` |
|
||||
| sandbox binds | packages/seat/src/sandbox.mjs:102-125 | the workspace gets a separate in-sandbox path |
|
||||
| harness `transcript()` | packages/plugins/harness/pi/index.mjs:75, claude-code/index.mjs:130 | none: `{session, projects}` keeps its shape |
|
||||
| in-sandbox readers of `session.workspace` | packages/harness/src/runner.mjs:332, :386, :475-476; bundle.mjs:258, :327; gate.mjs:152 | none: they get the in-sandbox path |
|
||||
| task runner workspaces | scripts/mosaic-task.mjs:351 | none: `<dataRoot>/workspaces/<task>` is a legacy root the overlap check covers |
|
||||
| git socket | packages/cli/src/git-socket.mjs:7 | none: it takes bundles and reads no workspace |
|
||||
|
||||
## Pi and Claude resume, read offline (sage-2707: no pi run while P19 383 holds)
|
||||
|
||||
Pinned `@earendil-works/pi-coding-agent` 0.85.1 (package.json:8), read in node_modules/.../dist:
|
||||
|
||||
- adapters/pi/adapter.sh:46-52 passes `--session-dir "$MOSAIC_SESSION_DIR"`, plus `-c` when that
|
||||
directory isn't empty.
|
||||
- With `-c` and an explicit session dir, `continueRecent` filters by cwd
|
||||
(core/session-manager.js:1244-1250). It opens the newest `*.jsonl` whose header cwd resolves to
|
||||
the process cwd (:397-410, `sessionCwdMatches` :393-395). With no match, it makes a new session in
|
||||
the same directory (:1251), and nothing fails.
|
||||
- Both adapters `cd "$MOSAIC_WORKSPACE"` (pi adapter.sh:34-36, claude adapter.sh:46-47), the runner
|
||||
sets `MOSAIC_WORKSPACE` from `session.workspace` (runner.mjs:386), and the sandbox binds the
|
||||
workspace at its host path (sandbox.mjs:112, `argsOf` :128-131). So a legacy transcript's header
|
||||
cwd is `<dataRoot>/workspaces/<business>/<instance>`.
|
||||
- Opening a file whose header cwd doesn't exist exits 1 in a headless run (main.js:536-548,
|
||||
core/session-cwd.js:2-15). So `--session <file>` is no way around it either.
|
||||
|
||||
Result: a legacy default session run from `session-workspaces/.../<session>` as its cwd would
|
||||
quietly start a new pi conversation, and its old history wouldn't resume. Claude Code keys its
|
||||
projects directory on the cwd, and the adapter resumes by id (claude adapter.sh:53-59). I haven't
|
||||
read the Claude binary, so whether `--resume` finds an id saved under another cwd is unverified. I
|
||||
treat it as the same break.
|
||||
|
||||
## Design
|
||||
|
||||
### Legacy mapping (D9, M7)
|
||||
|
||||
A session is legacy when its row has `op='legacy-3l'`, which the migration gave every pre-3l thread
|
||||
with `id` = the thread id (3k-3l.sql:50-51). The rule reads only an immutable row, never the disk.
|
||||
|
||||
- A legacy session keeps the thread's existing store, `threads/<b>/<t>/{session,claude-projects}`
|
||||
(`threadStore`, unchanged).
|
||||
- Its workspace is new (Q1), `session-workspaces/<b>/<instance>/<session>/`, but inside the sandbox
|
||||
it's bound at the legacy path `workspaces/<b>/<instance>`. The cwd its transcripts recorded is
|
||||
unchanged, so pi `-c` and Claude `--resume` find them. The host's old instance workspace isn't
|
||||
mounted, so it stays as history (Q1, D9). Every in-sandbox reader gets the sandbox path (table
|
||||
above), and host git (`ensureCheckouts`) gets the host path.
|
||||
- Every other session uses D2's layout for both, and its sandbox path is its host path.
|
||||
- A thread made by 264a's `thread.create` has a random default id (broker.mjs:5993), so this rule
|
||||
doesn't call it legacy. A 264a launcher ran that thread from `threads/<b>/<t>/session`. A start
|
||||
for a session whose thread has no legacy-3l session, while `threads/<b>/<t>/session` exists,
|
||||
refuses `legacy-store-unmapped`, so it fails closed and doesn't start a fresh conversation. The
|
||||
re-pin plan lists such threads. If 264a and 264b go live together, there are none.
|
||||
|
||||
### Broker
|
||||
|
||||
- `threadsState(business)`: one row per session of every thread, not just the default, ordered by
|
||||
thread seq, then session seq. Each row adds `session` and `legacy` to the fields it has now.
|
||||
`#threadRows` joins `sessions` in place of `session_defaults` (broker.mjs:868-896).
|
||||
- `threadIdle(record)`: same keys. The row is the one for the session the run was bound to
|
||||
(`#runs` entry, broker.mjs:927), so a run is idled against its own session.
|
||||
- `bindLaunch`: no new refusal. It already takes `session` and puts it in the body (broker.mjs:945).
|
||||
The broker half of the single-writer fence is the per-session claim that exists now:
|
||||
a second claim on a held session refuses `thread-already-held` (broker.mjs:4815). A
|
||||
`session-running` refusal at bind would break two old tests that bind a second unended run to one
|
||||
session and then expect the claim refusal (threads.test.mjs:88-89, sessions.test.mjs:119-120).
|
||||
The launcher's registry check and the workspace lock are the host halves.
|
||||
|
||||
### Seat
|
||||
|
||||
- `sessionStore(dataRoot, business, thread, session, { legacy })`: the legacy branch is
|
||||
`threadStore`. Otherwise it's `threads/<b>/<t>/sessions/<s>/{session,claude-projects}`, with
|
||||
`threadStore`'s checks on every segment and directory (ID_PATTERN, no `..`, owner, 0700, no
|
||||
symlink), giving the same `{dir, session, projects}` shape.
|
||||
- `sessionWorkspace(dataRoot, business, instance, session, { live })`: makes
|
||||
`session-workspaces/<b>/<i>/<s>` 0700 with the same checks, then compares realpaths. It refuses
|
||||
`session-workspace-overlap` when the path is inside, or contains, `<dataRoot>/workspaces` (legacy,
|
||||
`.retired` and task workspaces) or any workspace in `live`. A segment that fails the lstat checks
|
||||
refuses `session-workspace-unsafe` first (C3).
|
||||
- Lock: `lockSessionWorkspace(path, owner)` makes `<path>.lock` with O_EXCL, next to the workspace
|
||||
and outside every mount. It holds the host's pid and start time, and the run's outer pid and
|
||||
start time once spawned. A lock whose host and run are both gone is stale and is taken over.
|
||||
Anything else refuses `session-workspace-busy`. start() takes it before `ensureCheckouts` and
|
||||
releases it only after the run's `close` (proven exit) or a failed start.
|
||||
- `Registry`: entries gain `session` and `workspace`, and the key becomes `running(business,
|
||||
instance, thread, session)`. `SESSIONS_VERSION` is 2, and `readSessions` reads 1 and 2.
|
||||
|
||||
### Launcher
|
||||
|
||||
- check(instance, { thread, session }): `instance-running` is per session. Q2 adds
|
||||
`legacy-run-live`: a start for a thread instance refuses while any registry entry or unrecovered
|
||||
leftover for that instance has no `session`.
|
||||
A survivor is still bound and ended host-lost (launcher.mjs:1030-1040), so the broker sees its
|
||||
claim free while it runs. A released claim doesn't prove the run has exited. Only this launcher
|
||||
check holds the instance then, for sessionless survivors and thread starts only (duckworth-0158
|
||||
N1). recover() waits up to 5 s per leftover for the outer pid and the runner (N2, see "recover()
|
||||
change, for a design read").
|
||||
Residual (duckworth-0159 N3): a survivor with a `session` counts nowhere, because :309 counts
|
||||
only sessionless entries. The same session could start again while the old runner lives. The
|
||||
lock doesn't catch it either: it records the outer pid as runPid (launcher.mjs:574), so with the
|
||||
outer pid gone it reads stale and is taken over. The base has the same exposure. In practice
|
||||
the runner dies with its pid namespace when the outer bwrap is killed.
|
||||
- start(): the store and workspace come from the session. The lock covers checkouts and spawn.
|
||||
`bindLaunch` gets `session`, and the entry records it.
|
||||
- threadPass(): one pass per session row. `startedFor` and `refusedThreads` key on the session.
|
||||
The `thread-idle`, `refused` and `end` records add `session`.
|
||||
- recover(): passes the entry's `session` when present.
|
||||
- remove(): moves `session-workspaces/<b>/<instance>` to `session-workspaces/<b>/.retired/<instance>-<transaction>`
|
||||
after the legacy move, and records `workspace-retired` with that path.
|
||||
- Admission (RULINGS Q5, D8): a named session starts only through threadPass, then check(), then
|
||||
start(), so it passes through every `admission()` call start() makes now (launcher.mjs:382-524).
|
||||
There is no second start path.
|
||||
|
||||
### Sandbox
|
||||
|
||||
`binds()` takes `workspaceDest` (default `workspace`), the in-sandbox path for the rw workspace
|
||||
bind. The store binds keep their shape: only the selected session's two directories.
|
||||
|
||||
## Tests
|
||||
|
||||
T1 run half, with the fake harness adapter from thread-launch.test (no pi or Claude binary):
|
||||
two sessions of one thread run at once, each with its own sentinel history, store and workspace;
|
||||
stopping one and restarting it resumes only that one. The legacy session resumes from the old
|
||||
store at the old in-sandbox cwd. A non-thread instance gets `thread-not-allowed`.
|
||||
|
||||
T2: a second start on a live session's workspace refuses `session-workspace-busy` before any
|
||||
checkout; a hand-made live lock from another host refuses; a symlinked or nested session root
|
||||
refuses `session-workspace-unsafe`; a workspace root symlinked into the session path refuses
|
||||
`session-workspace-overlap`; a store segment symlink refuses `thread-store-refused`. Under a halt, a
|
||||
named session's start refuses `processing-halted` and spawns nothing. A generation change after
|
||||
check() refuses `processing-generation-changed` and spawns nothing (M6).
|
||||
|
||||
N1 (DEFERRED.md:474-480): `refusedOnce` in packages/bus/tests/sessions.test.mjs pins `actor_run`.
|
||||
|
||||
## Old assertions that change (C4, duckworth-0150, mos-1285)
|
||||
|
||||
Every pre-existing test that reads threadsState at aca16404c, checked against one row per session:
|
||||
- packages/bus/tests/end-launch.test.mjs:193-195 deepEquals the whole row. This one changes. Mos
|
||||
allowed it in mos-1285 as an exact update: still a whole deepEqual on threadsState('demo'), still
|
||||
exactly one th-1 row, every old key and value the same, and two new keys with literal values,
|
||||
`session: 'th-1'` (the fixture's legacy default, :14-15) and `legacy: true` (op `legacy-3l`). The
|
||||
commit message names mos-1285 and the old row shape.
|
||||
- packages/bus/tests/threads.test.mjs:352, :375-376: fromEntries keyed by thread. Neither test, and
|
||||
neither fixture (`twoThreads`), makes a second session (no `session.create` in the file), so each
|
||||
thread still has one row. Unchanged.
|
||||
- packages/bus/tests/thread-migration.test.mjs:139: maps four fields of a one-session thread.
|
||||
Unchanged.
|
||||
- packages/cli/tests/thread-launch.test.mjs:163, :304, :348, :443: `find` by thread. One session
|
||||
per thread in every fixture. Unchanged. The default session also sorts first, by session seq.
|
||||
- packages/cli/tests/lifecycle.test.mjs:90-91, :749-752 and thread-launch.test.mjs:90-91, :264-265
|
||||
pass threadsState through. Unchanged.
|
||||
- packages/cli/tests/thread-launch.test.mjs:182 (found in the code round, after mos-1285). The test
|
||||
makes threads with `thread.create` (:171-172), so A's default session has a random id and op
|
||||
`default` (broker.mjs:5992-6009), not `legacy-3l`. The brief puts every new store in D2's layout
|
||||
(t1-sessions.md:100, :294), so A's store moves to `threads/acme/<A>/sessions/<A's session>`. The
|
||||
proposed exact update changes only the `store` path on :182, taking the session id from
|
||||
`threadsState` (the test already reads it at :162). Lines :183-185 stay as they are. One added
|
||||
line asserts that `threads/acme/<A>/session` doesn't exist. This goes to Mos through Sage, and no
|
||||
code commit edits the file until Mos rules.
|
||||
- The same file's :375 (`../evil` refuses `thread-store-refused`) and :381, :384 (no `threads`, no
|
||||
`workspaces`) stay unchanged: start() checks the store before it makes the session workspace.
|
||||
|
||||
Any other old assertion the code changes goes to Mos through Sage before the commit. After the
|
||||
first run I survey every touched file whole for one.
|
||||
|
||||
## Mutants
|
||||
|
||||
Each kill counts only as an assertion failure in a test that runs that path, never a throw or
|
||||
another fence (sage-2707, C3 duckworth-0128).
|
||||
|
||||
| Id | Change | Killed by |
|
||||
| --- | --- | --- |
|
||||
| M1 | `sessionWorkspace` drops the session segment: a thread's sessions share one checkout | T2 same-thread fence: `session-workspace-busy`, no second spawn |
|
||||
| M2 | the session segment becomes the session name: two threads' `default` sessions share one checkout | T2 cross-thread fence, same assertion |
|
||||
| M3 | the lock ignores a live holder | T2 hand-made lock: `session-workspace-busy` |
|
||||
| M4 | the realpath overlap check removed | T2 nesting: `session-workspace-unsafe` |
|
||||
| M5 | the launcher passes the thread's default store for every session | T1: the second session's sentinel history is its own |
|
||||
| M6 | start() calls a no-op in place of every `admission(admissionGeneration)` (launcher.mjs:382, :396, :407, :420, :495, :499, :520, :524) for a non-legacy session | the generation test (below): `assert.rejects` with code `processing-generation-changed`, then `assert.equal` spawn count 0 |
|
||||
| M7 | the legacy session maps to `sessions/<s>/` | the D9 test: the legacy run resumes the sentinel in `threads/<b>/<t>/session` |
|
||||
| M8 | a non-default session binds its workspace at the legacy `workspaces/<b>/<instance>` in-sandbox path | T1: `assert.equal` that a named session's in-sandbox workspace is its `session-workspaces/<b>/<instance>/<s>` path, read from the fake adapter's recorded cwd (sage-2717) |
|
||||
| M9 | `#threadRows` back to the default session only | T1: the named session's message starts its run |
|
||||
| M10 | the `legacy-run-live` refusal removed from check() | the legacy-run-live test: `outcome` equals `[[S, "legacy-run-live"]]` |
|
||||
| M11 | recover() keeps a survivor only when the outer pid outlived the kill (the runner ignored) | the legacy-run-live test: the survivor log `assert.ok` (session-launch.test.mjs:309); the host doesn't see the live runner, so the survivor line is never logged (run 17:49Z 10-22, duckworth-0181) |
|
||||
| M12 | check() reads every survivor, live or not | the legacy-run-live test: after the runner exits, `settle` gives one launch |
|
||||
|
||||
M6 and the halt fences (C2, duckworth-0150). A plain halt never reaches start(). tick() admits first
|
||||
(:579) and runs no thread pass while halted (:583), and check() admits at :282 and :376. The kill
|
||||
test lands the change between check() returning and the spawn:
|
||||
- The fake host's `credentialStatus` op (start() calls it at :395, after check() returned and after
|
||||
:382) records that it ran, then halts and resumes processing through `transition`. That leaves
|
||||
`halted` false and a new generation (state.mjs:115-121).
|
||||
- The tick and check fences see no halt, and start()'s second check() (:419) takes its own
|
||||
generation, so it passes too. withProcessing at :406 has no parent context (the launcher never
|
||||
opens one) and checks only `halted`, so it passes. The one fence left is start()'s own
|
||||
`admission(admissionGeneration)`, which refuses `processing-generation-changed` at :396.
|
||||
- The test asserts the hook ran (check passed), then the refusal code, then no spawn.
|
||||
M6 removes all eight calls because removing only :382 leaves :396 to refuse. The T2 halt test stays
|
||||
as written in Tests, but it doesn't kill M6 and isn't counted for it.
|
||||
|
||||
M4 and the segment checks (C3, duckworth-0150). The lstat check on each segment refuses a symlinked
|
||||
session root before the realpath compare runs, so the compare gets its own code,
|
||||
`session-workspace-overlap`, and the segment check keeps `session-workspace-unsafe`. M4's kill input
|
||||
passes every segment check: `<dataRoot>/workspaces/<b>` is a symlink to
|
||||
`session-workspaces/<b>/<i>/<s>`. Each segment of the session path is a real directory, and only the
|
||||
realpath compare finds that the session path contains the legacy workspace root. The test asserts
|
||||
`assert.rejects` with code `session-workspace-overlap` and no spawn. With M4 the start spawns, so
|
||||
the rejection assertion fails. The segment test keeps asserting `session-workspace-unsafe` for a
|
||||
symlinked session root, so it tells the two codes apart.
|
||||
|
||||
Duckworth's check for the early look (sage-2717): a non-default session never gets the legacy
|
||||
`workspaces/<b>/<instance>` bind path. Only a session with op `legacy-3l` takes `workspaceDest`
|
||||
set to the legacy path. M8 is that mutant.
|
||||
|
||||
### Code round corrections (local, not yet run)
|
||||
|
||||
Written before the first run, which waits for Sage's CLEAR.
|
||||
|
||||
- Tests live in two new files: packages/cli/tests/session-launch.test.mjs (T1, D9, T2) with a new
|
||||
stub adapter, fixtures/session-adapter.mjs (thread-adapter.mjs's turn plus the run's cwd and its
|
||||
entries; thread-adapter.mjs is unchanged), and packages/seat/tests/session-workspace.test.mjs
|
||||
(sessionStore, sessionWorkspace, the lock, sessions.json v2). The new launch tests copy
|
||||
thread-launch.test.mjs's host helpers rather than change them, so no other old test file changes.
|
||||
- M1 and M2 kill in T1, not in a busy test. A test that expects `session-workspace-busy` still
|
||||
passes when sessions share a path. T1 starts thread A's default and named sessions and thread B's
|
||||
default at once and asserts no refusal, three live entries and three distinct cwds. With M1 (A's
|
||||
two sessions) or M2 (the two `default` sessions) the second start refuses busy, and the
|
||||
`deepEqual(refused, [])` assertion fails.
|
||||
- Every wait a mutant could stall returns what it last saw (`settle`, `outcome`), so a kill is the
|
||||
assertion after it, never a timeout. That covers M3, M4, M6 and M9, where the mutant's run starts
|
||||
or never starts.
|
||||
- The M6 test also carries the halt fence. start() admits right after credentialStatus, before it
|
||||
makes the session workspace, so the first refusal leaves no workspace. On the retry the recheck's
|
||||
mayLaunch op halts after the lock is taken. The recheck refuses `processing-halted`, and the test
|
||||
asserts that the lock is gone (startLocked's throw releases it).
|
||||
- The lock's release() runs once. A second call would unlink a lock another host has written since.
|
||||
- `legacy-run-live` now has a test (Duckworth's early warning in duckworth-0156). Before, recover()
|
||||
kept a survivor only when a bwrap pid outlived SIGKILL, which a test can't make. It also ended
|
||||
a leftover whose runner still ran once the outer pid was gone, so the refusal never saw that run.
|
||||
Now recover() waits up to 5 s on the outer pid and the runner. It keeps any leftover where
|
||||
either still runs, and logs `run <run> (<instance>) from an earlier host still runs`. check()
|
||||
reads only survivors that still run, so a start goes ahead once the run has exited. The test
|
||||
writes a sessionless leftover whose runner is a sleep child and whose outer pid is gone. It
|
||||
asserts the refusal, no launch, no session workspace, and then one launch after the child is
|
||||
killed. M10-M12 cover it. The registry and pre-recover leftover terms stay. A launching host
|
||||
can't reach them for a thread instance (check() refuses `session-required` first, and listen()
|
||||
runs recover() first), but they cost nothing.
|
||||
|
||||
### recover() change, for a design read (sage-2750)
|
||||
|
||||
Sage asked for this because recover() predates the row. Lines are launcher.mjs at 3d29876df plus
|
||||
the log-line edit after it, against aca16404c:947-976.
|
||||
|
||||
- What stays the same: every leftover is still bound and ended as host-lost (:1030-1040, base
|
||||
:963-973). The survivor push (:1026-1029) comes before the bind, and the loop carries on past it,
|
||||
so a kept leftover isn't left unended. Its bus run ends and its role is released, as in the base.
|
||||
The kill is unchanged too: SIGKILL only to a live outer pid whose cmdline is bwrap (:1018-1021,
|
||||
base :956-959).
|
||||
- What changes:
|
||||
1. The wait after the kill runs while the outer pid or the runner still runs (:1023). In the
|
||||
base it waited on the outer pid only (base :961).
|
||||
2. A leftover where either still runs after that goes on `survivors` and is logged (:1026-1029).
|
||||
3. check() counts a survivor only while it still runs (:309, `liveRun` at :255).
|
||||
- a. Nothing in this row kills a kept leftover's runner. The base didn't either: it ended the run
|
||||
and let the runner go on, unseen. The run is still ended (:1038), so the runner holds no role.
|
||||
Its capability died with the old broker (:1004-1008). The only thing a survivor does is refuse
|
||||
`legacy-run-live` for sessions of its instance while it lives, and each refusal is a `refused`
|
||||
launch record. For an operator, the log line names the run, the outer pid and the runner pid
|
||||
(:1028). Killing that pid clears it. check() re-reads liveness on each pass (:309), so the next
|
||||
tick starts the session with no host restart. If bindLaunch refuses (:1032-1036), the run stays
|
||||
unended and logged, as in the base (base :965-969). The survivor entry doesn't change that.
|
||||
- b. The 5 s wait only applies inside the kill branch (:1018-1024), so only to a leftover whose
|
||||
outer bwrap was still alive. A leftover with nothing running doesn't wait, and nor does one
|
||||
whose outer pid is gone: neither enters the branch. The wait ends as soon as both processes are
|
||||
gone. The base already waited up to 5 s in the same branch. It can now last longer only if the
|
||||
runner outlives its outer pid. With `--unshare-pid` and `--die-with-parent` the runner dies when
|
||||
the namespace goes.
|
||||
- c. Old tests that run recover() with a launching host and a leftover:
|
||||
- launcher.test.mjs:885-943, the "host that died hard" pair. It asserts the outer pid and the
|
||||
runner are gone right after setup (:917-918), the host-lost log (:919), one session.ended
|
||||
(:920-922), one end record (:924), an empty sessions.json (:925), and then "already ended" for
|
||||
a leftover whose processes are dead (:937-941). None of these expected values change.
|
||||
Waiting on the runner makes :918 hold sooner, not later. The new log line can appear only if
|
||||
a process outlives 5 s, which would already fail :917-918. The dead-process third host takes
|
||||
no wait and logs no survivor.
|
||||
- launcher.test.mjs:950-971 (`--no-launch`) returns before the loop (:1012-1015). It's
|
||||
unchanged.
|
||||
- stack-release.test.mjs:1928 writes `{pid: process.pid}` with no start times. `liveRun` is
|
||||
false for it, and that test reads it through bus status, not recover().
|
||||
- verbs.test.mjs:213 and the seat tests build a Registry with no launcher, so they aren't
|
||||
affected.
|
||||
|
||||
No expected value in an old test changes, so nothing goes to Mos under mos-1272 for this. If a
|
||||
run shows otherwise, I stop and send it before any change.
|
||||
- Fallback, if Duckworth or Sage doesn't accept this: revert recover() and check() to the base
|
||||
behaviour, keeping only the sessionless check over the registry, the pre-recover leftovers and
|
||||
bwrap survivors. Drop the legacy-run-live test and M10-M12, and name the untestable path here.
|
||||
- N1 (refusedOnce pins `actor_run`) changes a pre-existing test. Mos allowed it in mos-1292 (copy
|
||||
mos-1294) on mos-1285's terms, and it's committed as a81b3446e, with a closing line on the
|
||||
DEFERRED.md entry.
|
||||
|
||||
## Rollback
|
||||
|
||||
264b writes sessions.json v2. A 264a host given that file refuses to start, exit 3, "sessions file
|
||||
is malformed" (session.mjs:241 via launcher.mjs:235-237). Session workspaces and per-session stores
|
||||
stay on disk, and a 264a host never reads them.
|
||||
|
||||
What else refuses on a 264a stack while a v2 file is in place (C1, duckworth-0150). All of them go
|
||||
through the 264a readSessions, which throws SeatError "sessions file is malformed" (session.mjs:241):
|
||||
- `mosaic launches list` and `mosaic stop <run>`: exit 2 with that message (cli.mjs:526, :465).
|
||||
- the bus `limits` verb: `settings.read()` throws (runtime.mjs:149, :292, launch-settings.mjs:166),
|
||||
so the verb fails with that message. The limits the bus enforces still work, since `current()`
|
||||
doesn't read the file. I haven't traced the code a bus caller sees for that throw.
|
||||
- the Console settings view: launch shows `not-configured` (reads.mjs:234).
|
||||
- the R guard keeps working (above).
|
||||
All of these read the file on each call, so step 3 below clears them without a restart.
|
||||
|
||||
Console restart: the shape of what the Console reads doesn't change. usageCounts still counts
|
||||
entries per provider and model, and reads.mjs keeps its fields. What changes is the file, and a
|
||||
Console still on 264a code shows launch `not-configured` from the first v2 write until a human
|
||||
restarts it on a 264b copy. The re-pin that carries this row needs its Console restart (Jason or
|
||||
Mos), done right after the host's, as it does for a read-shape change. Step 3 covers the reverse
|
||||
case after a rollback with no restart.
|
||||
|
||||
Seeing live sessions without `launches list` (C1): read the file directly the way the R guard does.
|
||||
For each entry in `sessions`, a session is live if `/proc/<pid>/stat` or `/proc/<runnerPid>/stat`
|
||||
exists and its state isn't `Z` (stack-release.sh:2080, :2095). For a stronger check, compare
|
||||
`runnerStartTime` with field 22 of `/proc/<runnerPid>/stat`, which is what readSessions' `live`
|
||||
does through startTimeOf.
|
||||
|
||||
How a rollback host gets past exit 3 (sage-2717), run on NEW before the rollback activate:
|
||||
1. Stop the bus host on NEW. Its stop SIGKILLs what is left and ends those launches as `killed`
|
||||
(packages/cli/README.md:470).
|
||||
2. Read `sessions.json` with NEW's readSessions (`mosaic launches list`, cli.mjs:526-530). Go on only
|
||||
if it shows no live entry: every listed runner is gone (pid and start time no longer match). If
|
||||
NEW's CLI is already gone, use the /proc read above.
|
||||
3. Move `sessions.json` aside under a dated name, never delete it (packages/cli/README.md:478).
|
||||
4. Then roll back. The 264a host starts with no leftover file and nothing to recover.
|
||||
A live entry at step 2 stops the rollback until that run ends or `mosaic stop <run>` ends it.
|
||||
|
||||
Which re-pin plan step carries it: no re-pin plan names 264b yet. The 84f53540d re-pin carries 264a
|
||||
only. The first re-pin whose NEW includes this row puts steps 1-4 in its "Stop conditions and
|
||||
rollback" section, before `rollback --plan`, the section the 10-24 plan uses
|
||||
(agents/sage/work/window-plan/repin-1024-draft1.md:144-148). I'll name it to whoever drafts that
|
||||
plan when the row lands.
|
||||
|
||||
## Run limits (sage-2707)
|
||||
|
||||
Each node --test file and suite runs under `timeout -k 10 LIMIT`, and each scripts/test-*.sh under at
|
||||
least 3x its longest recorded run. Records are from agents/gizmoduck/work/queue-264/BUILD.md "Run
|
||||
limits" unless named.
|
||||
|
||||
| Run | Longest recorded | LIMIT |
|
||||
| --- | --- | --- |
|
||||
| stack-release.test alone | 575 s (264a r12 survey) | 1800 s |
|
||||
| each other touched file alone | 15 s (thread-launch.test); the rest have none | 300 s |
|
||||
| bus suite | 23 s | 900 s |
|
||||
| cli suite | 591 s (row 281 gate) | 1800 s |
|
||||
| webui suite | 57 s | 600 s |
|
||||
| seat suite | none recorded | 600 s |
|
||||
| harness suite | none recorded | 600 s |
|
||||
| each scripts/test-*.sh | 42 s (test-foundation) | 900 s |
|
||||
| each mutant probe | 1 s wall (264a M1-M4) | 300 s |
|
||||
@@ -0,0 +1,191 @@
|
||||
# Row 283 (#1788) C2-01d design, draft 2 (Honker)
|
||||
|
||||
Brief: docs/plans/2026-10-20_case2-rows.md "C2-01d" at refactor 94c33a43c. Sources: the design at
|
||||
agents/gosalyn/work/case2/DESIGN.md b68d79663, the ruling after r11 (:207), the M12 paragraph (:300),
|
||||
1.1 (:755) and 1.2 (:817). Base 94c33a43c. Reviewer Webby, gate owner Sage. Nothing is built yet. The
|
||||
build waits for 282 to land (sage-2906).
|
||||
|
||||
## 1. Mapping (packages/library/src/mapping.mjs)
|
||||
|
||||
`supporting`:
|
||||
- Every universe kind takes an optional `supporting` list: plain `['name','books','playground','supporting']`,
|
||||
hybrid adds it to its seven keys, and a draft gets `['kind','name','playground','supporting']`.
|
||||
- Each value is checked as a playground prefix is: a string ending in `/` whose body passes `folder()`.
|
||||
- The output carries `supporting` on every universe, `[]` when absent, the way a draft carries
|
||||
`books: []`. classify then needs no `?? []`. The business writer writes the raw document
|
||||
(organization.mjs:195), not this output, so no business file changes shape.
|
||||
- The prefix rules, across every entry (ruling after r11):
|
||||
- A supporting prefix holding another supporting prefix, or one listed twice, refuses
|
||||
`library-mapping-invalid`.
|
||||
- A prefix equal to one of its own entry's book folders, or holding one, refuses `library-mapping-invalid`.
|
||||
- A prefix inside or holding another entry's book folder refuses `library-supporting-other-universe`.
|
||||
- Level comes from where the prefix sits, as for the playground: inside one of its own entry's books
|
||||
is book level, and outside every book is universe level. A draft's prefixes are all universe level.
|
||||
- Between the two lists (my choice, Q2):
|
||||
- A supporting prefix may equal a playground prefix of the same entry. That folder is writable.
|
||||
- A playground prefix may hold a supporting prefix of the same entry. The inner folder is supporting
|
||||
and the rest stays playground.
|
||||
- A supporting prefix that holds a playground prefix refuses `library-mapping-invalid`. classify
|
||||
checks supporting first, so that playground prefix could never match.
|
||||
- A supporting prefix equal to, holding or inside a playground prefix of another entry refuses
|
||||
`library-mapping-invalid`. Otherwise one path would have two universes.
|
||||
- The book loop at mapping.mjs:128-140 becomes a helper that both lists call with their own code and
|
||||
label. The playground's messages and codes stay byte-equal, so no existing test text moves.
|
||||
|
||||
`editor`:
|
||||
- The entry takes an optional `editor`. When present, it is an object with exactly the keys `name` and
|
||||
`email` (via `only()`). Each value is a string that is non-empty after trim and has no control
|
||||
character (`[\u0000-\u001f\u007f-\u009f]`), `<` or `>` (webby-0169 R1: git drops them from an ident
|
||||
and commits under a different name, so C2-02 would never see a failure). Anything else refuses
|
||||
`library-mapping-invalid`.
|
||||
- The output carries `editor: { name, email }` only when present, as `user` and `vaultPrefix` do. A save
|
||||
with no `editor` refusing is C2-02's job.
|
||||
|
||||
## 2. Scope (scope.mjs)
|
||||
|
||||
- `classify` gets a supporting loop before the playground loop (design 1.2). It returns `place(...)`
|
||||
with `{ scope: 'supporting', universe, book }`. The book is the book folder holding the prefix, or
|
||||
null at universe level and in a draft. The type and folder come from the first folder under the
|
||||
prefix, as for the playground.
|
||||
- The `.md` check stays first, so a `.canvas` or `.base` under a supporting prefix stays unmapped.
|
||||
- The comment above `classify` names the three prefix scopes and the order.
|
||||
|
||||
## 3. supportingPath (new supporting.mjs)
|
||||
|
||||
`supportingPath(mapping, universe, path, tree)` returns `path` or throws
|
||||
`LibraryError('library-write-story-path', ...)`. It is pure and reads no git.
|
||||
|
||||
- `tree` is the array `listTree` returns (reader.mjs:26, `{ mode, type, oid, size, path }`), so the
|
||||
C2-02 broker passes its listing as it is (Q3). A non-array `tree` throws a TypeError, because that is
|
||||
a caller bug, not a path class.
|
||||
- The checks run in this order, each with its own message naming the class:
|
||||
1. The path must be a string of at most 1,024 UTF-8 bytes (`Buffer.byteLength`).
|
||||
2. It must have no control character, using the same control class as `editor` (not `<` or `>`).
|
||||
3. It must have no backslash.
|
||||
4. It must not be absolute (a leading `/`).
|
||||
5. It must have no empty, `.` or `..` segment. That also catches `//` and a trailing `/`.
|
||||
6. `classify(mapping, path)` must give scope `supporting` and that same `universe`. This one check
|
||||
covers an unknown universe, an unmapped path, a `.canvas`, `.base` or attachment, a canon or
|
||||
story path, a playground path that isn't also supporting, and another universe's prefix. The scope
|
||||
rule then has one source, and M1 below hits both.
|
||||
7. Every proper prefix of the path (`a`, `a/b`, ...) and the path itself must not be in `tree` with
|
||||
mode `120000` (symlink) or `160000` (gitlink).
|
||||
8. No prefix of the path, and not the path itself, may equal a tree path or a tree directory
|
||||
(derived from the entries' paths) after `normalize('NFC').toLowerCase()` on both sides, unless
|
||||
it equals that tree path exactly. NFC as well as case, because APFS treats NFC and NFD forms of
|
||||
a name as one file (webby-0169 N1).
|
||||
Directories are checked too, because the folders under a supporting prefix are hers to name. A
|
||||
path in a tree that holds both `a.md` and `A.md` refuses, which matches R7.
|
||||
- The refusal messages quote the path with JSON, except for the control-character class, whose message
|
||||
leaves the path out.
|
||||
- The delete rule ("A delete also needs the path to exist at the tip as a 100644 blob", M12) isn't in
|
||||
the brief's supportingPath list. It stays with C2-02's delete (Q4).
|
||||
The C2-02 brief doesn't name it (only design :308), so BUILD.md carries it to C2-02 under Handoffs
|
||||
(webby-0169 Q4).
|
||||
- index.mjs exports `supportingPath`.
|
||||
|
||||
## 4. README (packages/library/README.md)
|
||||
|
||||
- Mapping: `supporting` and its rules, the cross-list rules, and `editor`.
|
||||
- Refusals: a `library-supporting-other-universe` row, and the new cases in the
|
||||
`library-mapping-invalid` row.
|
||||
- Scope: supporting first, then playground, then canon.
|
||||
- A new section, "Agent write paths", for supportingPath and its classes.
|
||||
|
||||
## 5. Callers of classify outside files owned (Q1 for Sage)
|
||||
|
||||
- survey.mjs:65 builds `{ canon: 0, playground: 0, unmapped: 0 }` and increments
|
||||
`scopes[classify(...).scope]`. A supporting file adds `supporting: NaN`, and formatSurvey (:92) never
|
||||
prints it. I propose a departure: add `supporting: 0` and print it, so the line becomes
|
||||
`scopes canon 5, playground 1, supporting 0, unmapped 3; indexed 6`. That re-pins survey.test:73 and
|
||||
adds a count test. Without it, the survey reports garbage once she marks a folder. The departure
|
||||
covers two files, packages/library/src/survey.mjs and packages/library/tests/survey.test.mjs.
|
||||
- No change in the rest, each for a reason:
|
||||
- reader.mjs:183 skips only unmapped, so supporting files are indexed like playground files.
|
||||
- R5 (:207) flags only canon to playground, as design 1.3 R5 says. A canon link to a supporting file
|
||||
raises nothing.
|
||||
- render.mjs:23 gives supporting a null badge. The supporting badge belongs to C2-10b (design :1415).
|
||||
- mirror.mjs:246 refuses only unmapped. Reading supporting files by scope is C2-05c's.
|
||||
- No bus or webui source filters on scope (git grep at 94c33a43c).
|
||||
- M9 already protects the whole `projects` key from agent edits (library-projects-protected.test). No
|
||||
test is added there.
|
||||
|
||||
## 6. Tests
|
||||
|
||||
- mapping.test:
|
||||
- T1: `supporting` at book level, at universe level, in a hybrid and in a draft. The output carries
|
||||
it, with `[]` when absent. The draft `deepEqual` at :48 gains `supporting: []`.
|
||||
- T2: one test per prefix rule.
|
||||
- These refuse `library-mapping-invalid`: no trailing `/`, a bad folder, one holding another, one
|
||||
listed twice, one equal to its own book, one holding its own book, one holding a playground
|
||||
prefix, and one overlapping another entry's playground.
|
||||
- These refuse `library-supporting-other-universe`: one inside another universe's book, and one
|
||||
holding another universe's book.
|
||||
- An equal same-entry playground passes.
|
||||
- T3: `editor` passes, and absent passes. It refuses `library-mapping-invalid` for a non-object, an
|
||||
array, an extra key, a missing key, an empty or blank value, a non-string, and a control character,
|
||||
`<` or `>` in either value.
|
||||
- scope.test, T4:
|
||||
- Supporting at book level, universe level and in a draft each give their universe and book.
|
||||
- A folder in both lists is `supporting`, and a playground-only folder is `playground`.
|
||||
- A supporting `.canvas` or `.base` is unmapped.
|
||||
- supporting.test (new):
|
||||
- T5 passes at book level, universe level, in a draft, in a both-lists folder, and at exactly 1,024 bytes.
|
||||
- T6 has one refusal per class against a fixture tree with a symlink, a gitlink and a case variant.
|
||||
The classes are:
|
||||
- unmapped, `.canvas`, `.base`, an attachment, canon, playground-only, another universe's
|
||||
supporting prefix, and an unknown universe;
|
||||
- absolute, `..`, `.`, `//`, a trailing `/`, a backslash, a C0 control and DEL;
|
||||
- a symlink folder, a gitlink folder, and a symlink at the path itself;
|
||||
- a case-variant file, a case-variant folder, and an NFD-form variant of an NFC tree name;
|
||||
- 1,025 bytes made with a multi-byte character, so bytes and characters differ.
|
||||
- Each asserts the code `library-write-story-path`.
|
||||
- business.test: T7 adds one assertion that `validateBusinessDocument` refuses
|
||||
`library-supporting-other-universe`.
|
||||
- survey.test (only if Q1 is approved): T8 counts one supporting file, and :73 is re-pinned.
|
||||
|
||||
## 7. Mutants (exact strings go in BUILD.md)
|
||||
|
||||
| Mutant | Change | Killed by |
|
||||
|---|---|---|
|
||||
| M1 | classify checks playground before supporting (the brief's mutant) | T4 both-lists, T5 both-lists |
|
||||
| M2 | the other-universe fail for supporting is dropped | T2 |
|
||||
| M3 | the symlink and gitlink check is dropped | T6 |
|
||||
| M4 | the case check is dropped | T6 |
|
||||
| M4b | check 8 drops `normalize('NFC')` | T6 NFD variant |
|
||||
| M5 | the byte length uses `path.length` | T6 1,025 bytes |
|
||||
| M6 | the `editor` control-character check is dropped | T3 |
|
||||
| M6b | the `editor` `<` and `>` check is dropped | T3 |
|
||||
| M7 | supportingPath skips the universe match | T6 other universe |
|
||||
| M8 | the supporting-holds-playground check is dropped | T2 |
|
||||
|
||||
## 8. Gate
|
||||
|
||||
- Webby approves the manifest.
|
||||
- The library and business suites and every scripts/test-*.sh are green on Sage's gate.
|
||||
- Timeouts (mos-1275): each package `timeout -k 10 1800`, each script `timeout -k 10 300`, each single
|
||||
file and mutant `timeout -k 10 600`. These come from my row 256 gate at 10:34Z.
|
||||
- Before in-review, grep packages/*/tests for 64-hex pins on the changed files and for the changed
|
||||
message text, then drift-check BASE..refactor.
|
||||
|
||||
## 9. Questions
|
||||
|
||||
- Q1 (Sage): approve the survey.mjs and survey.test.mjs departure in section 5?
|
||||
- Q2 (Webby): the cross-list rules in section 1?
|
||||
- Q3 (Webby): `tree` as the `listTree` array?
|
||||
- Q4 (Webby): the delete's 100644 check stays with C2-02?
|
||||
- Q5 (Webby): `editor` refuses only blank values and control characters, as the brief says. `<` and `>`
|
||||
would break a git ident. I'd leave them to C2-02's commit step unless you want them refused here.
|
||||
|
||||
## 10. Draft 2 (webby-0169)
|
||||
|
||||
- R1 folded: `editor` refuses `<` and `>` too, with T3 cases and mutant M6b.
|
||||
- Q2 accepted. BUILD.md records the tradeoff: refusing a supporting prefix that holds a playground
|
||||
prefix goes past the brief, but it is the fail-closed reading and uses an existing code. The cost
|
||||
is that she can't nest a playground under a supporting folder, though she can nest the other way.
|
||||
- Q3 accepted. Q4: carried to C2-02 under Handoffs in BUILD.md, and Sage was asked to add it to C2-02's brief.
|
||||
- N1 folded into check 8 (NFC and case), with an NFD case in T6 and mutant M4b.
|
||||
- N2: the survey.test:73 pin gains only `supporting`, and the count test is the only addition
|
||||
(mos-1330, its own commit).
|
||||
- N3: before the build, re-grep tests outside packages/library for a `deepEqual` of the mapping output
|
||||
on the build base.
|
||||
@@ -1,54 +0,0 @@
|
||||
# PRD 1.16 brief: library.write routes under REQ-LIB-6
|
||||
|
||||
Sage, 2026-10-22, for mos-1328. This follows `docs/plans/BRIEF-TEMPLATE.md`. Gitea #1796.
|
||||
|
||||
## PRD 1.16 library.write routes under REQ-LIB-6 (mos-1328)
|
||||
|
||||
### Problem
|
||||
|
||||
Row 285 (C2-08b, #1790) adds the action `library.write` and grants it within-role to the six creative
|
||||
roles. REQ-WAIT-3 makes a new action a hard wait until a PRD version says it isn't, and REQ-WAIT-2 refuses
|
||||
a hard wait in a role file (`packages/business/src/vocabulary.mjs:68` ROUTED, `role.mjs`). PRD 1.15
|
||||
(row 282, #1787) lets creative agents write supporting docs but never routes the action. Scrooge found
|
||||
it (scrooge-285-routing-q1), and Webby confirmed it (webby-0164 B2). Mos ruled in mos-1328 that the
|
||||
routing changes the hard-waits list, so it needs a PRD version whose text Jason approves. Q223 and Q226
|
||||
don't cover it.
|
||||
|
||||
### Owner and reviewer
|
||||
|
||||
- Owner: Gosalyn.
|
||||
- Reviewer: Webby.
|
||||
- After: row 282 (PRD 1.15).
|
||||
|
||||
### Files owned
|
||||
|
||||
`docs/prd/mosaic-stack.md`, `packages/tasks/requirements.json` (the version only) and
|
||||
`packages/tasks/tests/requirements.test.mjs` (the version pin only).
|
||||
|
||||
### What ships
|
||||
|
||||
- A REQ-WAIT-3 note in the existing style: `library.write` was added as a hard wait and routes under
|
||||
REQ-LIB-6 since version 1.16.
|
||||
- The bounds are in the text: creative roles only, within-role; Markdown under supporting folders a human
|
||||
marked; never a story file; the writing agent's own live Gitea grant on the library project; one
|
||||
commit per write by its own account, with the trailer, the notice and revert.
|
||||
- REQ-LIB-6 names the action. Status, the header, a 1.16 source line and a 1.16 note.
|
||||
- Nothing else changes. 1.15's text stays as Mos accepted it.
|
||||
|
||||
### Out of scope
|
||||
|
||||
The ROUTED entry and the role files (row 285). The write verbs (row 288, C2-02). The grant executor
|
||||
(row 287, C2-21).
|
||||
|
||||
### Gate
|
||||
|
||||
Webby approves the text. Jason says yes to the exact text, which Mos puts to him as one question
|
||||
(mos-1328 step 3), and the row doesn't land before that. `requirements.test.mjs` and every
|
||||
`scripts/test-*.sh` that reads the PRD or `requirements.json` are green on Sage's gate. Mos gets the
|
||||
landing commit.
|
||||
|
||||
### Handoffs
|
||||
|
||||
Every seat hands off directly (DECISIONS Q210, mos-1221). When the owner pushes a round or the reviewer
|
||||
posts a verdict, that seat messages the next seat's T3 thread and Sage's with `mcp__t3__t3_send_message`.
|
||||
Copy Mos's thread when Mos has a step. Mos has one here, the question to Jason.
|
||||
@@ -478,8 +478,6 @@ at every gate. Started 2026-09-12 during the control board MVP.
|
||||
not that the event's `actor_run` is the refused run. Binds row 269 (264b,
|
||||
#1774), or the next row that changes `sessions.test.mjs`: pin `actor_run`
|
||||
in `refusedOnce`. (2026-10-22)
|
||||
Closed by row 269 (264b, #1774): `refusedOnce` selects `actor_run` and
|
||||
expects the refused run's name (mos-1292). (2026-10-22)
|
||||
|
||||
- **editor-provenance skips its rebuild check on esbuild 0.28.1.** (Duckworth
|
||||
N2 on the row 264a manifest round, duckworth-0146.) The webui test
|
||||
|
||||
+19
-29
@@ -33,7 +33,7 @@ Gaps found while working go to `docs/plans/DEFERRED.md`, not here.
|
||||
|
||||
<!-- mosaic-queue:begin -->
|
||||
|
||||
Generated from `docs/plans/queue.json` revision 3316 by `queue render`. Do not edit between the markers; change the queue with `scripts/mosaic queue`.
|
||||
Generated from `docs/plans/queue.json` revision 3216 by `queue render`. Do not edit between the markers; change the queue with `scripts/mosaic queue`.
|
||||
|
||||
| # | Piece | Owner | Issues | State | After | Gate | Brief | Note |
|
||||
|---|---|---|---|---|---|---|---|---|
|
||||
@@ -209,8 +209,8 @@ Generated from `docs/plans/queue.json` revision 3316 by `queue render`. Do not e
|
||||
| 170 | A tester message to a role nobody runs is refused tester-target-not-running before it is stored; talk --tester exits 3 (P19 380, mos-0845 D2) | dewey; reviewers filbert | #1667 | done | — | Filbert approves the candidate manifest; bus and cli suites and every scripts/test-*.sh green on Sage's gate (sage) | `docs/plans/2026-10-19_tester-no-holder-refusal.md` § Brief: a tester message to a role nobody runs is refused, not queued | Rebased for landing onto 228aeb503 as cb43dcb45 (Sage, mos-0857 item 3). git range-diff 000730949..0b6ff260f 228aeb503..cb43dcb45 prints '1: 0b6ff260f = 1: cb43dcb45', and the six paths' +/- lines hash the same before and after. The candidate Filbert approved is unchanged. |
|
||||
| 171 | A thread project named like a business-file repo: project-name-is-repo refusal unless --repo matches, clearer CLI refusal (P19 379, mos-0854) | rocko; reviewers dewey | #1668 | done | — | Dewey approves the candidate manifest; bus, cli, webui and plugins suites and every scripts/test-*.sh green on Sage's gate (sage) | `docs/plans/2026-10-19_project-names-and-repos.md` § Brief: a thread project named like a business-file repo | Landed as 078518e4e (Sage). Rebuilt on d58c9c5cd as 9a29febb6, gate GATE_PASSED there, then cherry-picked onto ed045ac84+b2d3b6c47: git range-diff prints '9a29febb6 = 078518e4e'. All 11 paths match candidate manifest c498ca89. Pushed d58c9c5cd..078518e4e with 4d9114ab4, ed045ac84, b2d3b6c47 (doc and SESSIONS commits). |
|
||||
| 172 | Board-held sign-out wait times out under gate load: find and fix the cause, not the timeout (P19 366, mos-0858) | sage; reviewers darkwing | #1670 | done | 171 done | Darkwing approves the candidate manifest; the cause and trace are in the packet; webui suite 10 runs green under gate load and full gate green on Sage's gate (sage) | `docs/plans/2026-10-19_board-held-signout-flake.md` § Brief: the board-held sign-out wait times out under gate load | Landed be10e0c83 on 7f38a2f54, a cherry-pick of 15c3d8ca1 (base 164e1f97f). range-diff 164e1f97f..15c3d8ca1 vs 7f38a2f54..be10e0c83: 1 = 1. patch-id --stable fb6a65e7ec1d on both. packages/ tree equals 15c3d8ca1, whose full gate passed (sage-r172 gate-run1.txt); the commits between are packet, queue and SESSIONS only. Darkwing approve 29207, rev 2018. D1/D2 fixed in 7f38a2f54. Live only after a re-pin. |
|
||||
| 173 | A Seen click that waited out a Board read posts the intent the person clicked, not a toggle of the fresh row (#1671, mos-0861 A1) | dewey; reviewers darkwing | #1671 | in-progress | 66 done | darkwing approves on #1671 naming the candidate manifest; webui and every test-*.sh green on Sage's gate rerun (sage) | `docs/plans/2026-10-19_seen-click-intent.md` § Brief: a Seen click that waited out a Board read can undo another viewer's mark | — |
|
||||
| 174 | Skill reads keep a leading BOM and report fs errors inside a skill as skill-refused (#1672, row 64 N2/N3, mos-0863 D4) | louie; reviewers darkwing | #1672 | briefed | 173 done | darkwing approves on #1672 naming the candidate manifest; harness, cli and every test-*.sh green on Sage's gate rerun (sage) | `docs/plans/2026-10-19_skill-read-bom-errors.md` § Brief: skill reads strip a leading BOM and report some fs errors as launch-failed | — |
|
||||
| 173 | A Seen click that waited out a Board read posts the intent the person clicked, not a toggle of the fresh row (#1671, mos-0861 A1) | sage; reviewers darkwing | #1671 | queued | 66 done | darkwing approves on #1671 naming the candidate manifest; webui and every test-*.sh green on Sage's gate rerun (sage) | `docs/plans/2026-10-19_seen-click-intent.md` § Brief: a Seen click that waited out a Board read can undo another viewer's mark | — |
|
||||
| 174 | Skill reads keep a leading BOM and report fs errors inside a skill as skill-refused (#1672, row 64 N2/N3, mos-0863 D4) | sage; reviewers darkwing | #1672 | queued | 173 done | darkwing approves on #1672 naming the candidate manifest; harness, cli and every test-*.sh green on Sage's gate rerun (sage) | `docs/plans/2026-10-19_skill-read-bom-errors.md` § Brief: skill reads strip a leading BOM and report some fs errors as launch-failed | — |
|
||||
| 175 | Tester reads and writes for the test system: seven reads, seven writes recorded as tester (plugins, instances, routes set, name, talk without the prefix, project create, project init in the data root's project area); nine items stay human-only (#1673, Q173, mos-0870 N2, mos-0872) | dewey; reviewers filbert | #1673 | done | — | Filbert approves the candidate manifest; bus, cli, plugins, project, business and webui suites and every scripts/test-*.sh green on Sage's gate (sage) | `docs/plans/2026-10-19_tester-read-checks.md` § Brief: tester reads and writes for the test system | Landed as 98d29769e on 1d81c54ff (temp index from build.patch c9e545e5, manifest 2e30f2a1 25/25 on the tree; patch-id c1cf0ed66006 equals 9e74925c2..989699f7c). Sage gate on 716ddcf1e plus the patch: 15 package suites 2592 pass, 10 scripts/test-*.sh 422 pass, 0 fail. Filbert r3 approve 29279. F1 (TOOLS.md:452 'Until row 175 lands') is a doc-only follow-up. |
|
||||
| 176 | Console tester listener on 127.0.0.1 (--tester-port, 7333 in the window), TESTER_CLI bus calls, only the row 175 tester writes; 7332 refuses x-mosaic-tester for every Host; tester reads credentials, routes, project.files, project.file (#1674, Q173 N3, mos-0872, mos-0874) | rocko; reviewers dewey | #1674 | done | 169 done, 175 done | Dewey approves the candidate manifest; bus, cli, webui and business suites and every scripts/test-*.sh green on Sage's gate (sage) | `docs/plans/2026-10-19_console-tester-listener.md` § Brief: a loopback-only Console listener for the tester | Sage gate run 2 on 473258a51 plus the patch: 15 package suites 2455 pass, 0 fail, 1 skip (editor rebuild wants esbuild 0.28.2); 10 scripts/test-*.sh 422 selftests plus 156 queue tests, 0 fail. Run 1 failed T34 with capture-failed: activate and pm-on name runs by the second and collided. A row 169 base race (the base fails the same with the id pinned), Mos agreed (mos-0902); follow-up Vikunja P19 391. |
|
||||
| 177 | Tester threads: create, list, open, send and read tester-owned threads; owner and from_role tester, replies to tester, never the human's inbox; design first, Sage approves before code (#1675, Q173) | dewey; reviewers filbert | #1675 | done | 176 done | Filbert approves the candidate manifest; bus, webui and conversation suites and every scripts/test-*.sh green on Sage's gate (sage) | `docs/plans/2026-10-19_tester-threads.md` § Brief: tester threads (scoping) | Landed on refactor as 1f994257a (row 177) and 9d9d95485 (round 2), cherry-picked onto a2eebf997. range-diff vs gate candidate 1d5347670/5cb2905c7: both '='. Combined patch-id 15f9c7bba807, same as Filbert's approve (29351) and Sage's gate. Gate on c0d6bc7d5+2: GATE_PASSED, 25 steps rc=0, node 2627 pass 0 fail, scripts 422 pass 0 fail, network removed, 0 containers. |
|
||||
@@ -242,26 +242,26 @@ Generated from `docs/plans/queue.json` revision 3316 by `queue render`. Do not e
|
||||
| 203 | FED R2: the federation key in the system config (#414) | quackerjack; reviewers webby | #1701 | briefed | — | Webby approves the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_federation-r1-r2-r5.md` § Brief: FED R2, the federation key in the system config | Chained on row 192's candidate (Q177): starts on 192's candidate, lands after 192 (Sage) |
|
||||
| 204 | 193a: access level check widened to viewer (#1691) | morgana; reviewers duckworth | #1702 | done | — | Duckworth approves the manifest; business suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_human-users-build.md` § Brief: 193a, the access level check widened to viewer | Landed d0bbc5c1c on refactor (base c9f374284). Patch-id 92c18aea matches git diff 44e36fc4c..f869fd062 on the 3 manifest paths. Manifest d38de8c9, Duckworth approve 29595. Gate 2789/0 on 4385b9ec1, mutants 7/7. Unpushed. |
|
||||
| 205 | 193b1a: the message filter (#1703; FED R3 and 193b1b build on it) | morgana; reviewers duckworth | #1703 | done | 196 done | Duckworth approves the manifest; bus suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_human-users-build.md` § Brief: 193b1a, the message filter | Landed ce6a96ad6 fast-forward on 0fa7bf421 (3 commits, 4 paths, manifest 858463b1). Duckworth APPROVE r1 c30375 (signed :124 test diff, mos-1262). Gate: Morgana slot205 10 files, bus 652/0, M1 M11-M14 killed, 0 skips; Sage test-*.sh 10/10, 3 by-design skips. N1/N3 to 205b or R3, N2 to 193b2 brief, N4 = #1782 before any user thread. Rebase next: 268 r4, 194, 236, 253, 274. |
|
||||
| 206 | 193b2: thread shares, schema 3k-3l after the #436b build (#1691; live needs a --migrate window with Jason) | launchpad; reviewers duckworth | #1704 | briefed | 205 done, 234 done, 236 done, 275 done | Duckworth approves the manifest; bus suite, cli suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_human-users-build.md` § Brief: 193b2, thread shares (schema 3l) | — |
|
||||
| 207 | 193c: mosaic access user verbs and --level viewer (#1691) | megavolt; reviewers duckworth | #1705 | in-progress | 202 done | Duckworth approves the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_human-users-build.md` § Brief: 193c, mosaic access user verbs and --level viewer | — |
|
||||
| 206 | 193b2: thread shares, schema 3k-3l after the #436b build (#1691; live needs a --migrate window with Jason) | morgana; reviewers duckworth | #1704 | queued | 205 done, 234 done, 236 done, 275 done | Duckworth approves the manifest; bus suite, cli suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_human-users-build.md` § Brief: 193b2, thread shares (schema 3l) | — |
|
||||
| 207 | 193c: mosaic access user verbs and --level viewer (#1691) | morgana; reviewers duckworth | #1705 | queued | 202 done | Duckworth approves the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_human-users-build.md` § Brief: 193c, mosaic access user verbs and --level viewer | — |
|
||||
| 208 | 193d: Console shared list, share controls and viewer read-only (#1691; also after FED R6 when filed) | morgana; reviewers duckworth | #1706 | queued | 192 done, 206 done | Duckworth approves the manifest; webui suite and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_human-users-build.md` § Brief: 193d, the Console's shared list, share controls and viewer read-only | — |
|
||||
| 209 | FED R8: the hub window on 10.1.1.54, a recorded acceptance (#414, r4.11 b93f098f0; live window run by Jason and Mos, after the Case 2 install #416, Bean and Chet live and both Hermes gateways stopped) | sage; reviewers duckworth | — | queued | — | Every entry check's output is in the R8 record with who ran it; Jason signs in to the hub and sends one message, Melanie revokes, his next request is refused; Duckworth checks the record (sage) | `docs/plans/2026-10-20_federation-r1-r2-r5.md` § Brief: FED R8, the hub window on 10.1.1.54 | Stays queued until its entry gates near: Case 2 install on .54 (#416, by 2026-10-27), Bean and Chet live, both Hermes gateways on .54 stopped, R7, #412 phase 2, #419 answer. Filed per mos-1073 after duckworth-0034 (Sage) |
|
||||
| 210 | Agent host access with sudo through the credential store: grant per agent and host, the stack does ssh and sudo, the agent never sees the key (#1707, Vikunja #424, Q183/Q184, due 10-27; chained on row 199's candidate) | gizmoduck; reviewers duckworth | #1707 | done | — | Duckworth approves DESIGN.md, then the manifest; bus, business, cli suites and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_host-credentials.md` § Brief: agent host access with sudo through the credential store (#424) | Landed f5753c0e8 on refactor (base 9d165be8c), pushed. Patch-id 723b1c83 matches git diff ad95c888c..0485384e9 on the 23 manifest paths; landed files pass r5 manifest 688d38b9. Duckworth approve r2 rev 2592, r3 29851. Mutants 52/53, M22b equivalent (rev 2584). Gate on ad95c888c+patch: packages 2796/0, scripts 429/0; landed blobs equal the gate tree. |
|
||||
| 211 | Force-push guard: scripts/git-hooks/pre-push refuses non-fast-forward and delete pushes from every worktree, and scripts/slot-busy.sh exits 1 on BUSY (#1709, Vikunja #426, mos-1078/1083) | darkwing; reviewers dewey | #1709 | in-progress | — | Dewey approves the manifest; the new or changed scripts/test-*.sh and every other scripts/test-*.sh green on Sage's gate; the mutants killed; hook installed in the canonical checkout with a scripted refused force-push (sage) | `docs/plans/2026-10-20_force-push-guard.md` § Brief: a pre-push hook that refuses force-pushes, and a busy check that fails on BUSY (#426) | — |
|
||||
| 211 | Force-push guard: scripts/git-hooks/pre-push refuses non-fast-forward and delete pushes from every worktree, and scripts/slot-busy.sh exits 1 on BUSY (#1709, Vikunja #426, mos-1078/1083) | rocko; reviewers dewey | #1709 | briefed | — | Dewey approves the manifest; the new or changed scripts/test-*.sh and every other scripts/test-*.sh green on Sage's gate; the mutants killed; hook installed in the canonical checkout with a scripted refused force-push (sage) | `docs/plans/2026-10-20_force-push-guard.md` § Brief: a pre-push hook that refuses force-pushes, and a busy check that fails on BUSY (#426) | — |
|
||||
| 212 | Case 2 C2-01 packages/library: mapping, scope, reader, resolver, R-rules, renderItems, survey | gosalyn; reviewers webby | #1713 | done | — | Webby approves the manifest. The library tests and the cli suite are green on Sage's gate, along with every `scripts/test-*.sh`. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-01 packages/library: mapping, scope, reader, resolver, R-rules, renderItems, survey | Landed ee7b2f137 (pushed 09:13Z) on f6c70f944, alone per mos-1162: the 21 manifest paths from a2c72ac95. Patch-id ea84d3e35470 equals the candidate's; blobs and modes match; verify-commit ok (21 paths). No 212 path changed after c771a36f4. Gate: Sage's landing gate 08:51-09:03Z on 4ced5e63d plus 212's and 197's paths, GATE_PASSED, node 981/0, selftests 429/0. Gosalyn r3 slot 451/0, test-queue 28/0. Row 197 waits for r6 (lane proof stopped, sage-1881). |
|
||||
| 213 | Case 2 C2-08 creative roles, persona file and block, M1, M2, M6, M10, prompt passed by file | morgana; reviewers webby | #1714 | done | — | Webby approves the manifest. The business, bus and harness suites, `scripts/test-config.sh` and every `scripts/test-*.sh` are green on Sage's gate, and the `models` mutant is killed. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-08 creative roles, persona file and block, M1, M2, M6, M10, prompt passed by file | LANDED 361ba2387 (39 paths incl. 4 packet files). Patch-id f313e69b6f7e = c771a36f4..2b3e67e36; verify-commit ok, 35 manifest paths. Same combined gate as 195: business 200/0 bus 542/0 harness 140/0 cli 663/0, test-config 31/0 and all 10 scripts green, models mutant L1 killed. Webby N2 is row 235 acceptance (mos-1163). |
|
||||
| 214 | Case 2 C2-11a editor wikilink node, after measuring whether [[ round-trips | herb; reviewers filbert | #1715 | in-progress | — | Filbert approves the manifest. The webui suite is green on Sage's gate, along with every `scripts/test-*.sh`. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-11a editor wikilink node, after measuring whether [[ round-trips | — |
|
||||
| 214 | Case 2 C2-11a editor wikilink node, after measuring whether [[ round-trips | rocko; reviewers filbert | #1715 | briefed | — | Filbert approves the manifest. The webui suite is green on Sage's gate, along with every `scripts/test-*.sh`. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-11a editor wikilink node, after measuring whether [[ round-trips | — |
|
||||
| 215 | Case 2 C2-04 the library entry in the business file, consumer skips, M9, mirror, library.file and library.status | herb; reviewers filbert | #1716 | done | — | Filbert approves the manifest. The business, seat, cli, project, bus and webui suites are green on Sage's gate, along with every `scripts/test-*.sh`. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-04 the library entry in the business file, consumer skips, M9, mirror, library.file and library.status | LANDED e54e05463 on 6096b051b (sage-2094). Patch-id 2f68188b6c9d equals a36523713..dde3445ab; 118 paths, blobs and modes equal; tree 5b1613245 equals merge-tree. No path overlap with rows 66/243; no hash pins either way. Gate: Filbert APPROVE rev 2924; herb-0095 grant sage-2071 2634 pass 0 fail, 1 webui skip (editor rebuild needs esbuild 0.28.2, env, not a 215 path), accepted. |
|
||||
| 216 | Case 2 C2-05a lookup index and queries | researcher; reviewers filbert | #1717 | briefed | 268 done | Filbert approves the manifest. The library suite is green on Sage's gate, along with every `scripts/test-*.sh`. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-05a lookup index and queries | Rulings on phase A: agents/sage/work/queue-216/RULINGS.md (da9555ca2). r2 rebases on row 268's landing and adds the four PRD 1.14 playground tests. |
|
||||
| 217 | Case 2 C2-06 the citation guard, the page store, the runner texts and the retry | launchpad; reviewers webby | #1718 | briefed | 268 done | Webby approves the manifest. The library, bus and harness suites are green on Sage's gate, along with every `scripts/test-*.sh`. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-06 the citation guard, the page store, the runner texts and the retry | — |
|
||||
| 217 | Case 2 C2-06 the cited-reply guard, the page store and the three notices | launchpad; reviewers webby | #1718 | briefed | 268 done | Webby approves the manifest. The library, bus and harness suites are green on Sage's gate, along with every `scripts/test-*.sh`. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-06 the cited-reply guard, the page store and the three notices | — |
|
||||
| 218 | Case 2 C2-12 the setup sheet for Melanie and the survey run sheet | sage; reviewers webby | #1719 | done | — | Doc only. Webby approves it against C2-01's real flags. Before landing, grep `packages/*/tests` and `scripts/test-*.sh` to confirm no test reads either file. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-12 the setup sheet for Melanie and the survey run sheet | LANDED f8276c5eb (pushed, on Darkwing sessions b65f3a0e8). Webby APPROVE r1-r3 (revs 2848, 2856, 2860; r3 candidate 1a38baf5af2a = 89ba79d94). Patch-id 18ba1e40ad29 seat 5c6f73ed7..89ba79d94 equals landed b65f3a0e8..f8276c5eb; three blobs equal 89ba79d94. Gate: doc only, 0 test readers (control 3). Melanie handover waits on C2-06 and Jason (#419). |
|
||||
| 219 | Case 2 C2-09a one thread per creative instance | rocko; reviewers dewey | #1720 | briefed | — | Dewey approves the manifest. The bus, cli and webui suites are green on Sage's gate, along with every `scripts/test-*.sh`. Watch for hash pins on `bus.js` and `broker.mjs` (`packages/bus/tests/channel-proof.test.mjs` pins a webui file). (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-09a one thread per creative instance | — |
|
||||
| 220 | Case 2 C2-10a no raw session view (M7) and no raw Discord engine (M8) | researcher; reviewers filbert | #1721 | briefed | — | Filbert approves the manifest. The conversation and discord suites and `scripts/test-discord.sh` are green on Sage's gate, along with every `scripts/test-*.sh`. No test reaches a Discord server. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-10a no raw session view (M7) and no raw Discord engine (M8) | Rulings on phase A: agents/sage/work/queue-220/RULINGS.md (da9555ca2). Scope adds packages/business/src/library-seats.mjs (imported by path, no index export), its test, and control-board serve.mjs. r2 building as a Haiku subagent. |
|
||||
| 221 | Case 2 C2-20 Bean and Chet persona import, with a count-only dry run | gosalyn; reviewers webby | #1722 | done | — | Webby approves the manifest. The test file runs green on its own and the cli suite is green on Sage's gate, along with every `scripts/test-*.sh`. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-20 Bean and Chet persona import, with a count-only dry run | LANDED 300766450, pushed. Cand 8f403d0d4, manifest 20f05e3a6ad5, 22 paths, verify-commit ok, patch-id dfbb754c6fb4 equals 62ddc96cc..8f403d0d4. Gate 11:07:50-11:19Z on b1fece6f0: test file alone 11/0, harness 140/0, cli 677/0, all scripts green. Brief Gate met: webby-0073 approve, test file alone, cli, scripts. No live run in the Gate; the import itself waits on Jason. N1 N2 N4 go to C2-20b, N3 to DEFERRED. |
|
||||
| 222 | Case 2 C2-03a fetch-only sync | megavolt; reviewers dewey | #1723 | done | — | Dewey approves the manifest. The library and bus suites are green on Sage's gate, along with every `scripts/test-*.sh`, and the mutant is killed. A search of the test run's output for the fixture token finds nothing. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-03a fetch-only sync | sage-2024 on megavolt-0089: core.createObject=rename in the fetch argv is accepted as a brief departure, since C2-04 inspectMirror refuses nlink 2. Dewey checks it. The askpass env keys, export SAFE in project/src/git.mjs, bus/tests/library-sync.test.mjs and the SURVEY-RUN user line are accepted. The 5 s client timeout residual goes in BUILD.md and Dewey rules fix or defer. Slot after 197 proof 3 and the 249 gate. |
|
||||
| 223 | Case 2 C2-07 runner retry on a guard refusal, and the runner's notices | researcher; reviewers filbert | #1724 | blocked (from briefed): Q226: C2-07 folded into C2-06 (row 217). No work here; Jason parks it. | — | Filbert approves the manifest. The harness suite is green on Sage's gate, along with every `scripts/test-*.sh`. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-07 folded into C2-06 | — |
|
||||
| 224 | Case 2 C2-05b broker lookup verbs and typed tools | della; reviewers dewey | #1725 | in-progress | — | Dewey approves the manifest. The bus and harness suites are green on Sage's gate, along with every `scripts/test-*.sh`. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-05b broker lookup verbs and typed tools | — |
|
||||
| 225 | Case 2 C2-10b Console chat: replies, citations, write notices and the status line | researcher; reviewers dewey | #1726 | briefed | — | Dewey approves the manifest. The webui suite is green on Sage's gate, along with every `scripts/test-*.sh`. Grep for hash pins on `bus.js` and `serve.mjs` before in-review. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-10b Console chat: replies, citations, write notices and the status line | — |
|
||||
| 223 | Case 2 C2-07 runner retry on a guard refusal, and the runner's notices | researcher; reviewers filbert | #1724 | briefed | — | Filbert approves the manifest. The harness suite is green on Sage's gate, along with every `scripts/test-*.sh`. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-07 runner retry on a guard refusal, and the runner's notices | — |
|
||||
| 224 | Case 2 C2-05b broker lookup verbs and typed tools | rocko; reviewers dewey | #1725 | briefed | — | Dewey approves the manifest. The bus and harness suites are green on Sage's gate, along with every `scripts/test-*.sh`. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-05b broker lookup verbs and typed tools | — |
|
||||
| 225 | Case 2 C2-10b Console chat: cited items and the status line | researcher; reviewers dewey | #1726 | briefed | — | Dewey approves the manifest. The webui suite is green on Sage's gate, along with every `scripts/test-*.sh`. Grep for hash pins on `bus.js` and `serve.mjs` before in-review. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-10b Console chat: cited items and the status line | — |
|
||||
| 226 | Case 2 C2-13 install script and precheck for the host | gosalyn; reviewers webby | #1727 | in-progress | 215 done, 221 done, 222 done, 230 done | Webby approves the manifest. The test file and the cli suite are green on Sage's gate, along with every `scripts/test-*.sh`. The run on the host is a separate window with Jason's go. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-13b install script and library precheck | — |
|
||||
| 227 | Case 2 C2-14 end-to-end acceptance on a scratch root | launchpad; reviewers dewey | #1728 | briefed | — | Dewey runs the script and approves. It is green on Sage's gate with every `scripts/test-*.sh`. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-14 end-to-end acceptance on a scratch root | — |
|
||||
| 228 | Row A: ZAI_API_KEY passes through ENV_ALLOW to sessions, README line, pass-through test (XS, Haiku high) | researcher; reviewers webby | #1729 | done | — | Webby approves the manifest. The mutant is killed. The seat suite and the cli suite are green on Sage's gate with every scripts/test-*.sh. (sage) | `docs/plans/2026-10-20_case2-rows.md` § Brief: row A, ZAI_API_KEY in the session env allowlist | Landed 86249ac55 (pushed 07:25Z) on 59f817c32: the 3 manifest paths from cf18c42b9. Patch-id b6ffe31feb0d equals the candidate's; modes and blobs match; verify-commit ok (3 paths). Sage's combined 228+238 gate on c515273db plus both rows' 6 paths, 07:11:30Z to 07:23:34Z: seat 165/0, cli 640/0, all ten scripts/test-*.sh 585/0. |
|
||||
@@ -275,7 +275,7 @@ Generated from `docs/plans/queue.json` revision 3316 by `queue render`. Do not e
|
||||
| 236 | #436b Gitea grant path build: seat accounts and tokens through an approved grant, schema 3j-3k (design r5 1be535aca, due 10-27 at risk; live waits for Jason's section 8 approval and bootstrap step) | megavolt; reviewers dewey | #1742 | done | 210 done, 234 done | Dewey approves the manifest. The bus, business and cli suites and every scripts/test-*.sh are green on Sage's gate. Section 9's mutants are killed, N9's restart test included. (sage) (sage) | `docs/plans/2026-10-20_agent-credentials.md` § Brief: #436b Gitea grant path, build (schema 3j-3k) | Landed bd5f11ded on refactor, a fast-forward on be2b008cc. It is 08840f3c1 rebased past 194 (commit 1 unions only, 2-7 =) plus 2 stale-pin fixes and a gitea-not-configured raise test (sage-2559). Dewey approve on manifest 0b00269b. Megavolt gate under Sage CLEAR: 2c green, bus 765, business 228, cli 832, ten scripts rc=0, mutants 40/40; skips named, env-only. Overlap 13/257 clean. Schema 3j-3k. #1742 closed. |
|
||||
| 237 | Row 199 follow-up N1: one decision publishes once (publish-busy or #spent recheck) | megavolt; reviewers duckworth | #1743 | done | 199 done | Duckworth approves the manifest. The bus suite and every scripts/test-*.sh are green on Sage's gate, and the mutant is killed. (sage) (sage) | `docs/plans/2026-10-20_agent-credentials.md` § Brief: row 199 follow-up N1, one decision publishes once | Landed d7d943199 on refactor (local, push pending), patch-id c5f4beb4 = e42415935, manifest bb777cb0 blobs checked. Sage gate 01:31-01:44Z on 816d48b03+4 paths: M1 killed (bus 1/13, cli 1/8), every package suite and scripts/test-*.sh green (bus 478, cli 564). |
|
||||
| 238 | row 200 follow-up N1: the sso-config hint carries --instance NAME (#1744) | launchpad; reviewers webby | #1744 | done | 200 done | Webby approves the manifest; stack-release.test.mjs whole, cli suite and every scripts/test-*.sh green on Sage's gate; the mutant killed (sage) | `docs/plans/2026-10-20_stack-release-sso.md` § Brief: row 200 follow-up N1, the sso-config hint names the instance | Landed d49b1f2bd (pushed 07:25Z) on 86249ac55: the 3 manifest paths from 4c90099ea. Patch-id b9d0bb0ee3c7 equals the candidate's; modes and blobs match; verify-commit ok (3 paths). Sage's combined 228+238 gate on c515273db plus both rows' 6 paths, 07:11:30Z to 07:23:34Z: seat 165/0, cli 640/0, all ten scripts/test-*.sh 585/0. Mutant (sso-config drops --instance) killed, survived none. Round 1 N1 stays on the #1744 carry list. |
|
||||
| 239 | Row 194 follow-up: the credential revoke runs under the writer's lock, refusals after a revoke say so, and a stale-revision fire test (duckworth-0074, mos-1158) | honker; reviewers duckworth | #1745 | in-progress | 194 done | Duckworth approves the manifest. The bus, business, cli and webui suites and every scripts/test-*.sh are green on Sage's gate, and the mutants are killed. (sage) (sage) | `docs/plans/2026-10-20_agent-lifecycle.md` § Brief: row 194 follow-up, the revoke under the writer's lock and a fire test | — |
|
||||
| 239 | Row 194 follow-up: the credential revoke runs under the writer's lock, refusals after a revoke say so, and a stale-revision fire test (duckworth-0074, mos-1158) | honker; reviewers duckworth | #1745 | queued | 194 done | Duckworth approves the manifest. The bus, business, cli and webui suites and every scripts/test-*.sh are green on Sage's gate, and the mutants are killed. (sage) (sage) | `docs/plans/2026-10-20_agent-lifecycle.md` § Brief: row 194 follow-up, the revoke under the writer's lock and a fire test | — |
|
||||
| 240 | Installer I4: hostcheck, the bwrap profile check, pins and boot unit, from r6 B2 (MVP, Q187, Vikunja #432; split from I3) | darkwing; reviewers filbert | #1746 | done | 233 done | Filbert approves the manifest. The test file, the cli suite and every scripts/test-*.sh are green on Sage's gate, with the mutants killed. (sage) (sage) | `docs/plans/2026-10-20_installer-rows.md` § I4 hostcheck: the bwrap profile check, pins and boot unit | Landed c515273db (pushed 06:57Z) on da3051ccc: the 9 manifest paths from ad1b23ab2. Patch-id 48e376efe8a4 equals the candidate's; modes and blobs match; verify-commit ok (9 paths). Sage's gate on 060a17b54 plus the 9 paths, 06:45:05Z to 06:56:21Z: cli 639/0, all ten scripts/test-*.sh 585/0. Darkwing's r2: singles 37/0, M1-M8 8/8. Filbert N1 and N2 in DEFERRED (da3051ccc); N3 by design. |
|
||||
| 241 | Row 237 follow-up: one decision lands once, a two-ticket broker land test and three mutants on the landing guards (megavolt-0069, sage-1651, P19 441) | megavolt; reviewers duckworth | #1747 | done | 237 done | Duckworth approves the manifest. The bus, seat and cli suites and every scripts/test-*.sh are green on Sage's gate, and the three mutants are killed. (sage) (sage) | `docs/plans/2026-10-20_agent-credentials.md` § Brief: row 237 follow-up, one decision lands once, with tests at the broker | Landed 5d4a61776 on refactor, pushed (base e65a3ab4d). Blobs from 3e3ed303e on 2 paths; patch-id a1649f80 equals git diff f5753c0e8..3e3ed303e on those paths; ls-tree modes equal; manifest e8266864 verifies on the landed files. Sage slot on bbf3b1ee8: M1-M3 killed; gate 15 packages 2797/0, 10 script suites 429/0. Duckworth approve 29870 rev 2628. |
|
||||
| 242 | Row 237 follow-up N1: a retry after publish-timeout pushes once; hold the decision or kill and wait for the push, a slow-push retry test and a mutant (duckworth-0069, P19 440) | megavolt; reviewers duckworth | #1748 | done | 237 done | Duckworth approves the manifest. The bus and cli suites and every scripts/test-*.sh are green on Sage's gate, and the mutant is killed. (sage) (sage) | `docs/plans/2026-10-20_agent-credentials.md` § Brief: row 237 follow-up N1, a retry after publish-timeout pushes once | Landed 5fb736b92 on refactor, pushed (base 96bac588f). Blobs from 635c10924 on 3 paths; patch-id ceb741ee equals git diff 8fede5fc6..635c10924 on those paths; ls-tree modes equal; manifest 1fbfab6c verifies on the landed files. Megavolt M1/M2 killed on Sage's slot; Sage gate 15 packages 2826/0, 10 script suites 429/0. Duckworth approve 29889 rev 2639. |
|
||||
@@ -288,13 +288,13 @@ Generated from `docs/plans/queue.json` revision 3316 by `queue render`. Do not e
|
||||
| 249 | row 235 follow-up: the grant undo records hostLineLeft when install never returned, since the remote add can outlive an abort or timeout (mos-1166) | gizmoduck; reviewers duckworth | #1751 | done | — | Duckworth approves the manifest. On Sage's gate the bus suite and the whole touched test files are green, and a mutant that drops the new catch branch is killed. (sage) | `docs/plans/2026-10-20_host-credentials.md` § Machine grant row b follow-up: the undo can't prove the remote add has ended | LANDED 9de5a57ab on refactor, pushed with 7b9737953 (DEFERRED N1). Range-diff: 8a04f4aa4..05595794b vs 8ca064158..9de5a57ab, same 3 paths, patch-id 99551b122e66 on both. Gate sage-2026 14:53Z: grant-executor whole 39/0, bus 598/0, no stub left, C1 (drop :1025) killed by G8 and both G23. Duckworth approve c30070. |
|
||||
| 250 | K12 (cohort.test.mjs) reads cgroup.events after cgroup.kill under load: print the shim's reason, then fix the cause at the source (Vikunja #450) | gizmoduck; reviewers filbert | #1755 | done | 197 done | reviewer approves the manifest; conversation and control-board suites whole on Sage's slot (sage) | `docs/plans/2026-10-21_k12-cohort-events.md` § Brief: K12 reads cgroup.events after cgroup.kill under load | LANDED 1b6158ce2 on refactor 19:42Z: candidate c1a858975 on 3b0aef995, manifest eca0b8e2, Filbert APPROVE rev 2957 (#1755 c30130). patch-id 29786caa = candidate; blob diff empty; tree 59f1e4781 = merge-tree. Gate on Sage slot sage-2109 (gizmoduck-0150): P1/P2/M1 as predicted, conversation whole 3x 183/183 plus concurrent pair, control-board 124/124. No drift on paths since base. |
|
||||
| 251 | T27 (host-run.test.mjs:453) lists no identities right after ssh-add -t 1: print timing and agent state, then fix the cause at the source (Vikunja #453) | darkwing; reviewers dewey | #1756 | done | 197 done | reviewer approves the manifest; bus suite whole on Sage's slot (sage) | `docs/plans/2026-10-21_t27-ssh-add-lifetime.md` § Brief: T27 lists no identities right after ssh-add -t 1 | LANDED d37210288 on b79ad5f2c: candidate 27f01ef63 manifest f2bdd684, patch-id 440d2442c976 equal, blob diff empty, tree matches merge-tree. Dewey r2 approve rev 2996 (c30168). Gate: bus suite whole in a clean worktree, 627/627 at 21:30:33Z on Sage's slot. Overlap check vs 194/198/244/253/254 branches: none. DEFERRED sleep-orphan entry follows as a doc commit. |
|
||||
| 252 | Console inbox Approve and Deny for grant requests (#435, J2) | scrooge; reviewers webby | — | in-progress | — | Webby approves DESIGN.md then manifest; webui, bus, cli suites and every test-*.sh green on Sage's gate; DESIGN mutants killed; REQ-WEB-2 PRD amendment landed first (sage) | `docs/plans/2026-10-21_console-inbox-approve.md` § Gate | mos-1193. Chained on row 196's candidate (Q177): design starts now on Gander's row 196 build; code rebases onto 196's landing. Vikunja #435. |
|
||||
| 253 | F27: case2-unit.sh and case1-accept.sh move to --tester-socket and refuse --tester-port with stack-release's migration wording; no .53/.54 copy with 196 until this lands (mos-1198 item 4) | gander; reviewers duckworth | #1758 | done | 196 done | reviewer approves DESIGN.md then the manifest; cli and webui suites whole and every scripts/test-*.sh on Sage's slot; mutants per DESIGN.md; static check covers scripts and tests (sage) | `docs/plans/2026-10-21_tester-socket-scripts.md` § Brief: case2-unit.sh and case1-accept.sh move to --tester-socket (F27) | Landed 48e450ce8 on refactor (fast-forward from aca16404c, 22 commits; landed sha = candidate, so range-diff and patch-id are identical by construction). Manifest 591020a1 (7 paths) rechecked against the commit: 0 mismatches. Gate: run 5 whole, cli 55 files, webui 58 files, all 10 scripts/test-*.sh green; M1-M40 killed 40/40. Duckworth APPROVE round 1, Gitea #1758 comment 30696. |
|
||||
| 252 | Console inbox Approve and Deny for grant requests (#435, J2) | gander; reviewers webby | — | briefed | — | Webby approves DESIGN.md then manifest; webui, bus, cli suites and every test-*.sh green on Sage's gate; DESIGN mutants killed; REQ-WEB-2 PRD amendment landed first (sage) | `docs/plans/2026-10-21_console-inbox-approve.md` § Gate | mos-1193. Chained on row 196's candidate (Q177): design starts now on Gander's row 196 build; code rebases onto 196's landing. Vikunja #435. |
|
||||
| 253 | F27: case2-unit.sh and case1-accept.sh move to --tester-socket and refuse --tester-port with stack-release's migration wording; no .53/.54 copy with 196 until this lands (mos-1198 item 4) | gander; reviewers duckworth | #1758 | in-progress | 196 done | reviewer approves DESIGN.md then the manifest; cli and webui suites whole and every scripts/test-*.sh on Sage's slot; mutants per DESIGN.md; static check covers scripts and tests (sage) | `docs/plans/2026-10-21_tester-socket-scripts.md` § Brief: case2-unit.sh and case1-accept.sh move to --tester-socket (F27) | — |
|
||||
| 254 | Library sync follow-up: client timeout, STATUS codes, README (222 deferrals, #1759) | megavolt; reviewers dewey | #1759 | done | 196 done | Dewey approves the manifest; bus, library and webui suites whole and every scripts/test-*.sh green on Sage's slot; the timeout and STATUS mutants killed (sage) | `docs/plans/2026-10-21_library-sync-followup.md` § Gate | Landed 331597709 (candidate b31300d79 blobs and modes on 41b0cf755; patch-id 96216216 equal, range-diff differs only in the message) plus doc eb9672c91 (Dewey N1 README sentence closed; N2 four 502 codes to DEFERRED, binding the Console library routes row). Merged-tree rerun on Sage's slot 23:44-23:55Z: library 77/0, bus 628/0, webui 305/0 with 1 skip, cli 749/0. Megavolt's gate megavolt-0102 covers scripts and both mutants. |
|
||||
| 255 | Bundled Pocket ID for users with no OIDC provider, design (Q203, #1760) | launchpad; reviewers webby | — | queued | 252 done | Webby approves DESIGN.md; design only, build rows follow after Sage checks it against Q203, O6, REQ-WEB-2 and REQ-INST-1 (sage) | `docs/plans/2026-10-21_bundled-pocket-id.md` § Gate | Vikunja 458, Gitea #1760, mos-1202 item 2. REQ-INST-2 lands in PRD 1.10 as post-v1 (mos-1204). Design only: no install, no download, no .53/.54, dragon-lin keeps Authentik. |
|
||||
| 256 | the human deletes a creative instance; any other actor refused, fire unchanged (REQ-COS-3, before the v1 tag) | honker; reviewers webby | #1761 | done | 194 done | Webby approves the manifest; touched test files whole plus business, bus, cli and webui suites and every scripts/test-*.sh green on Sage's slot; both mutants killed (sage) | `docs/plans/2026-10-21_creative-delete-human.md` § Brief: the human deletes a creative instance (REQ-COS-3, after row 194) | LANDED f12441d4f ff from 0165be266 (4 Honker commits, patch-id b28e6374). Webby APPROVE manifest-r3 01eb75aa (10 paths), request c30518. Gate 10:33-10:52Z: 4 touched files 31/0, 18 packages 3757/0 (bus 788, business 231, cli 832, webui 335), 10 scripts rc=0, mutants M1-M4b killed; skips named, env only (webui esbuild pin, test-queue root, test-task live x2). Overlap 13/257 clean. Lands before the 10-27 v1 tag. |
|
||||
| 257 | Q198 S1: pressure parser and pure rules evaluator (post-v1) | morgana; reviewers filbert | #1762 | in-review, round 2, request posted | — | Reviewer approves the manifest; touched test files whole plus the package suite green on Sage's slot; both brief mutants killed (post-v1, MVP keeps slot priority) (sage) | `docs/plans/2026-10-21_post-v1-row-briefs.md` § Brief: Q198 S1 pressure parser and pure rules evaluator | — |
|
||||
| 258 | Email E01: mail PRD addendum draft and schemas (post-v1) | ludwig; reviewers della | #1763 | in-progress | — | Reviewer approves the manifest; the row's named tests whole plus the mail suite and touched suites green on Sage's slot; reviewer-named mutants killed (post-v1, MVP keeps slot priority) (sage) | `docs/plans/2026-10-21_post-v1-row-briefs.md` § Brief: E01 mail PRD addendum draft and schemas | — |
|
||||
| 258 | Email E01: mail PRD addendum draft and schemas (post-v1) | unassigned | #1763 | queued | — | Reviewer approves the manifest; the row's named tests whole plus the mail suite and touched suites green on Sage's slot; reviewer-named mutants killed (post-v1, MVP keeps slot priority) (sage) | `docs/plans/2026-10-21_post-v1-row-briefs.md` § Brief: E01 mail PRD addendum draft and schemas | — |
|
||||
| 259 | Email E03: mail ledger, state and quotas (post-v1) | unassigned | #1764 | queued | 258 done | Reviewer approves the manifest; the row's named tests whole plus the mail suite and touched suites green on Sage's slot; reviewer-named mutants killed (post-v1, MVP keeps slot priority) (sage) | `docs/plans/2026-10-21_post-v1-row-briefs.md` § Brief: E03 mail ledger, state and quotas | — |
|
||||
| 260 | Email E04: bounded MIME parsing and quarantine (post-v1) | unassigned | #1765 | queued | 258 done | Reviewer approves the manifest; the row's named tests whole plus the mail suite and touched suites green on Sage's slot; reviewer-named mutants killed (post-v1, MVP keeps slot priority) (sage) | `docs/plans/2026-10-21_post-v1-row-briefs.md` § Brief: E04 bounded MIME parsing and quarantine | — |
|
||||
| 261 | Email E05: Graph source module against a test-local registry (post-v1) | unassigned | #1766 | queued | 259 done, 260 done | Reviewer approves the manifest; the row's named tests whole plus the mail suite and touched suites green on Sage's slot; reviewer-named mutants killed (post-v1, MVP keeps slot priority) (sage) | `docs/plans/2026-10-21_post-v1-row-briefs.md` § Brief: E05 Graph source module against a test-local registry | — |
|
||||
@@ -305,29 +305,19 @@ Generated from `docs/plans/queue.json` revision 3316 by `queue render`. Do not e
|
||||
| 266 | Case 2 C2-10c Console room view: merged timeline and @name completion | researcher; reviewers dewey | #1771 | queued | 225 done, 265 done | Dewey approves the manifest. The webui suite is green on Sage's gate, along with every touched suite. Grep for hash pins on changed files before in-review. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-10c Console room view: merged timeline and @name completion | Haiku high subagent under decision 129. |
|
||||
| 267 | Case 2 C2-15 hybrid universes: exclusions, pins and the end-to-end crossover | morgana; reviewers filbert | #1772 | queued | 216 done, 217 done, 224 done | Filbert approves the manifest. The brief's tests and the end-to-end crossover run whole plus every touched suite on Sage's slot. Grep for hash pins on changed files before in-review. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-15 hybrid universes: exclusions, pins and the end-to-end crossover | R8 accepted (sage-2218). Webby's R8 noise note (gosalyn-0127) is for the builder. |
|
||||
| 268 | Case 2 C2-01c playground levels: universe-level prefixes and draft universes | gizmoduck; reviewers webby | #1773 | done | — | Webby approves the manifest. The brief's tests run whole plus the library suite and every touched suite on Sage's slot; the brief's gate grep over packages and docs/case2 finds no library-playground-outside-book. Grep for hash pins on changed files before in-review. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-01c playground levels: universe-level prefixes and draft universes | Landed c27207f6e fast-forward on ce6a96ad6 (1 commit, 9 paths, digest caa0fa4e). r4 is a carry of r3 aca53c4f0: range-diff =, patch-id 2942acc8 equal, blobs equal. Webby APPROVE round 2 on ecd9b35eb stands; carries webby-0112 (r3) and webby-0113 (r4, notes 34e1ab2bf). Gate: Gizmoduck r4 rerun brief 14/14, library 83/83, business 209/209, 0 skips; gate grep empty. 194 rebases next (business.test.mjs). |
|
||||
| 269 | 264b T1 item 7: per-session native store, workspace and single-writer fence | gizmoduck; reviewers duckworth | #1774 | done | 264 done | Duckworth approves this slice's manifest. Its design tests run whole plus every touched suite on Sage's slot, and its mutants are killed (RULINGS Q1). Tests T1 run half, T2 workspace and path mutants; whichever of 191 and 264b lands second wires 191's admission checks (Q5). (sage) | `docs/plans/2026-10-21_t1-sessions.md` § T1 item 7: independent sessions, compaction counts and clear context | Landed efcc9ea8d fast-forward on 94c33a43c (13 commits, 12 paths, manifest 455c12ee). r3 is a carry of r2 aafcc857c, range-diff = (Duckworth 0194, c30756, rev 3307). Gate r3 18:37-18:50Z all green, 0 skips: bus 834, seat 172, cli 869, case2-unit 43, singles 38. M1-M12 kills carry. Re-pin needs the Console restart by Jason or Mos right after the host. A 264a rollback refuses a v2 sessions.json, see BUILD.md Rollback. |
|
||||
| 269 | 264b T1 item 7: per-session native store, workspace and single-writer fence | gizmoduck; reviewers duckworth | #1774 | briefed | 264 done | Duckworth approves this slice's manifest. Its design tests run whole plus every touched suite on Sage's slot, and its mutants are killed (RULINGS Q1). Tests T1 run half, T2 workspace and path mutants; whichever of 191 and 264b lands second wires 191's admission checks (Q5). (sage) | `docs/plans/2026-10-21_t1-sessions.md` § T1 item 7: independent sessions, compaction counts and clear context | — |
|
||||
| 270 | 264c T1 item 7: compaction count, exact for Pi | gizmoduck; reviewers duckworth | #1775 | briefed | 269 done | Duckworth approves this slice's manifest. Its design tests run whole plus every touched suite on Sage's slot, and its mutants are killed (RULINGS Q1). Test T3 Pi half; Claude shows unknown with the Vikunja 466 reason (Q6). (sage) | `docs/plans/2026-10-21_t1-sessions.md` § T1 item 7: independent sessions, compaction counts and clear context | — |
|
||||
| 271 | 264d T1 item 7: clear context through row 194's lifecycle stop | gizmoduck; reviewers duckworth | #1776 | briefed | 194 done, 269 done | Duckworth approves this slice's manifest. Its design tests run whole plus every touched suite on Sage's slot, and its mutants are killed (RULINGS Q1). Tests T4 and T6; rebased onto 194's landing with no 194 code copied (Q4). (sage) | `docs/plans/2026-10-21_t1-sessions.md` § T1 item 7: independent sessions, compaction counts and clear context | — |
|
||||
| 272 | 264e T1 item 7: mosaic session CLI and Console chooser | huey; reviewers scrooge | #1777 | briefed | 264 done | Duckworth approves this slice's manifest. Its design tests run whole plus every touched suite on Sage's slot, and its mutants are killed (RULINGS Q1). Tests T5 legacy single human and T7 Console half; controls for unlanded verbs refuse with a reason (Q1, Q7). (sage) | `docs/plans/2026-10-21_t1-sessions.md` § T1 item 7: independent sessions, compaction counts and clear context | — |
|
||||
| 272 | 264e T1 item 7: mosaic session CLI and Console chooser | gizmoduck; reviewers duckworth | #1777 | briefed | 264 done | Duckworth approves this slice's manifest. Its design tests run whole plus every touched suite on Sage's slot, and its mutants are killed (RULINGS Q1). Tests T5 legacy single human and T7 Console half; controls for unlanded verbs refuse with a reason (Q1, Q7). (sage) | `docs/plans/2026-10-21_t1-sessions.md` § T1 item 7: independent sessions, compaction counts and clear context | — |
|
||||
| 273 | Q175 phase 2: stack-release.sh activate --send and --no-sso (F39, mos-1246) | darkwing; reviewers filbert | #1778 | done | — | Filbert approves the manifest. stack-release.test.mjs and stack-release-external.test.mjs run whole plus scripts/test-release.sh on Sage's slot, and the brief's mutants are killed. (sage) | `docs/plans/2026-10-22_activate-send-nosso.md` § Brief: activate --send and --no-sso | landed 0bbf0f6d1 03:35:55Z, FF of 378a76b85; rebase of cac7d0f67, 6 range-diff pairs =, patch-ids equal, manifest e1031023 unchanged. Gate by Darkwing on 0bbf0f6d1: stack-release.test 218/218, external 25/25, test-release.sh rc 0, T58 c0 pass c1 fail, M1-M7 killed. Filbert APPROVE rev 3111 c30308, carry c30319. Docs 5365adaef (TOOLS.md N1 + BUILD-LOG). #1778. |
|
||||
| 274 | FED R3: broker user principal (#414) | morgana; reviewers dewey | #1779 | done | — | Dewey approves the manifest. The bus and harness suites and every scripts/test-*.sh are green on Sage's gate, and the mutants are killed. (sage) | `docs/plans/2026-10-22_federation-r3.md` § Brief: FED R3, the broker user principal | LANDED 4c485c63b ff from 47a35bf43 (6 Morgana commits). Dewey APPROVE c30487 on 4c485c63b (manifest 00047b52, 13 paths). Gate 10:09-10:22Z: 23 touched files 0 fail, bus 787, harness 151, business 228, cli 832, seat 167, 10 scripts rc=0 (skips test-queue 1, test-task 2), 22/22 mutants. M3x wall code not-holder (kit comment said human-required). r5 f58cfc361 red, void. Overlap 13/257 clean. |
|
||||
| 275 | 193b1b: viewer verbs and board refusals (also after FED R4 when filed) | morgana; reviewers duckworth | #1780 | done | 205 done, 274 done | Duckworth approves the manifest. The bus suite and every scripts/test-*.sh are green on Sage's gate, and the mutants are killed. (sage) | `docs/plans/2026-10-20_human-users-build.md` § Brief: 193b1b, viewer verbs and board refusals | Landed 3410df7c3 on refactor (fast-forward from 48e450ce8, 3 commits; landed sha = candidate, so range-diff and patch-id are identical by construction). Manifest 39847b15 (4 paths) blobs match the commit. Gate: whole files 7/22/6, bus 834, cli 861, harness 151, business 231, seat 167, 0 fail; 10 scripts/test-*.sh rc 0 with 3 named skips; M6 and M10 killed. Duckworth APPROVE round 1, Gitea #1780 comment 30717. |
|
||||
| 276 | Row 253 F5: supervise the legacy AS_USER talk and diagnostics in the case scripts | gander; reviewers duckworth | #1781 | in-progress | 253 done | Duckworth approves the manifest. The touched test files run whole, every scripts/test-*.sh is green on Sage's gate, and the mutants are killed. (sage) | `docs/plans/2026-10-22_case-sudo-legacy-followup.md` § Brief: supervised legacy AS_USER calls | — |
|
||||
| 275 | 193b1b: viewer verbs and board refusals (also after FED R4 when filed) | morgana; reviewers duckworth | #1780 | briefed | 205 done, 274 done | Duckworth approves the manifest. The bus suite and every scripts/test-*.sh are green on Sage's gate, and the mutants are killed. (sage) | `docs/plans/2026-10-20_human-users-build.md` § Brief: 193b1b, viewer verbs and board refusals | — |
|
||||
| 276 | Row 253 F5: supervise the legacy AS_USER talk and diagnostics in the case scripts | gander; reviewers duckworth | #1781 | briefed | 253 done | Duckworth approves the manifest. The touched test files run whole, every scripts/test-*.sh is green on Sage's gate, and the mutants are killed. (sage) | `docs/plans/2026-10-22_case-sudo-legacy-followup.md` § Brief: supervised legacy AS_USER calls | — |
|
||||
| 277 | The owner sees a thread agent's claims: an owner or reader read lists held thread claims (10-27, mos-1262; no user thread live before it) | morgana; reviewers duckworth | #1782 | done | 205 done | Duckworth approves the manifest. The touched test files run whole, the bus and cli suites and every scripts/test-*.sh are green on Sage's gate, and the mutants are killed. (sage) | `docs/plans/2026-10-22_owner-thread-claims.md` § Brief: the owner sees thread claims | LANDED 62f53b1e0 ff from 46dedf925 (7 Morgana commits, range patch-id 7f0533520bd2). Duckworth APPROVE manifest e281aa2c (10 paths), comment 30539. Gate 11:01-11:14Z: 7 touched files 0 fail, bus 793, cli 836, harness 151, business 231, seat 167, 10 scripts rc=0, M1-M9 killed; skips named, env only (test-queue root, test-task live x2). Overlap 13/257 clean. N3 per-session claims carry to 264a r7. |
|
||||
| 278 | The Console Agents view shows thread claims (follow-up to row 277; no user thread live before it) | gander; reviewers webby | #1783 | done | 277 done | Webby approves the manifest. The touched test files run whole, the webui and bus suites and every scripts/test-*.sh are green on Sage's gate, and the mutants are killed. (sage) | `docs/plans/2026-10-22_owner-thread-claims.md` § Brief: the Console shows thread claims | LANDED 385a7194c ff on 6af85df4b (9 commits, manifest 8fa859a0). Run 3 green: bus 793/0/0, webui 345/0/1, ten shells 425/0 under SHELL-LIMITS 3x, M1-M6 killed. Runs 1-2 void (fixture fixes 964b6b184, 9696d1fcb per mos-1275). Skips named (Webby N1): webui esbuild 0.28.1/0.28.2 rebuild; test-queue canonical-root check; test-task two live-provider cases (row 244). Webby APPROVE c30588. #1783 closes. |
|
||||
| 279 | stopRun reads a live run's status at the deadline: the deadline branch is the only time exit (191 follow-up, MVP, mos-1269; lands before 194 b16) | rocko; reviewers dewey | #1784 | done | — | Dewey approves the manifest. The processing-control package's tests and every other touched test file run whole, the business and cli suites are green on Sage's gate, and M1 is killed. (sage) | `docs/plans/2026-10-22_stoprun-deadline.md` § Brief: stopRun's deadline branch is the only time exit | LANDED ceadad993 (carry of cad927137 onto 343b6dd76: range-diff 1:= 2:=, patch-ids 6d8ae7f4/e484c297 equal, Dewey APPROVE dewey-0809 c30409 + carry). Fix: stopRun loop is for(;;), deadline branch is the only time exit. Sage gate green: business 209/0/0, cli 794/0/0, discord processing+stop 9/0/0; Rocko stop-run 13/13, processing-control 62/62, M1 killed. Overlap sweep clean (13, 257). Next: 194 b16 rebases onto it (mos-1269). |
|
||||
| 280 | Bus tests: the scratch sshd proves it owns its port (194 gate follow-up, MVP, mos-1270) | rocko; reviewers duckworth | #1785 | done | — | Duckworth approves the manifest. Both files run whole, the bus suite is green on Sage's gate, the 30-run repeat has no timeout, and M1 is killed. Row 194 b17's full gate then runs on top. Any red goes to Mos (mos-1270). (sage) | `docs/plans/2026-10-22_sshd-port-race.md` § Brief: the scratch sshd's port is ours before a test uses it | Landed b0fd28b6f 07:57:30Z, ff from da5d3651d: b765f5cb8 (Duckworth approve rev 3153, manifest 27806c05) + slim packet. Sage gate bus 656/0/0, ge 41, hr 26 (c30431). Repeat 2010/2010 under cli 1588/1588, no timeout; M1/M2 killed 4/4. Full evidence d6c924764 on rocko/row280-da5d-20261022. N2-N4 carry in BUILD.md. 194 b17 rebases on b0fd28b6f. |
|
||||
| 281 | A fire or a delete revokes the instance's host and Gitea grants (194/236 follow-up, MVP, mos-1271) | megavolt; reviewers dewey | #1786 | done | 236 done | Dewey approves the design, then the manifest. Bus, business, cli and every touched test file run whole, plus the Docker gitea-grant test and every scripts/test-*.sh, green on Sage's gate. M1-M4 killed. Lands before .53 Case 1 hires a granted instance. Red goes to Sage, then Mos. (sage) | `docs/plans/2026-10-22_fire-revokes-grants.md` § Brief: no grant outlives its instance | LANDED e479521d3 ff on 385a7194c (17 commits, manifest b73d4c81). Slot on 7979fb41e green: bus 819, business 231, cli 837, dewey-bus 76 with gitea-grant-docker run, shells green under 3x limits, M1-M22 killed. M1 hang fixed in b4a (mos-1273). Skips: test-task row 244 live-provider pair, test-queue canonical root. DEFERRED: N1 host-unknown hint verb, N2 fire tool text, to the follow-up row. Dewey APPROVE c30614. |
|
||||
| 282 | PRD REQ-LIB-6 rewritten to Q223 and Q226 (mos-1320 item 8) | gosalyn; reviewers webby | #1787 | done | — | Webby approves against the ruling. requirements.test.mjs and every scripts/test-*.sh that reads the PRD or requirements.json are green on Sage's gate. Jason gets a report. (sage) | `docs/plans/2026-10-20_case2-rows.md` § PRD REQ-LIB-6 rewritten to Q223 and Q226 (mos-1320 item 8) | Landed 647424442 on 86a665bdf: 1841f7d4e and 6b5b06819 rebased, patch-ids equal (4e50b4b6, 16a7a02f), range-diff =, tree 4f30ed10a = Gosalyn's gated trial tree. Webby APPROVE rev 3308 c30764 on 6b5b06819. Gate 19:06Z on the tip tree: bus+tasks requirements and tasks verbs 37/0/0, 0 skips; no scripts/test-*.sh reads the PRD (control ok). PRD 1.15. 1.16 is row 291, waits for Jason. |
|
||||
| 283 | Case 2 C2-01d supporting folders, the supporting scope, the editor field and supportingPath (M12) | honker; reviewers webby | #1788 | briefed | 268 done, 282 done | Webby approves the manifest. The library and business suites are green on Sage's gate, along with every scripts/test-*.sh. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-01d supporting folders, the supporting scope, the editor field and supportingPath (M12) | — |
|
||||
| 284 | Case 2 C2-05c the supporting scope and blob in the lookups | della; reviewers dewey | #1789 | briefed | 224 done, 283 done | Dewey approves the manifest. Library, bus and harness suites and every scripts/test-*.sh green on Sage's gate. Grep packages/*/tests for the scope enum pin and ['canon', 'playground'] before in-review; update each. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-05c the supporting scope and blob in the lookups (sage-2833) | — |
|
||||
| 285 | Case 2 C2-08b role changes for agent writes and the chief's read grant | scrooge; reviewers webby | #1790 | briefed | 213 done, 291 done | Webby approves the manifest. Business suite, test-config.sh and every scripts/test-*.sh green on Sage's gate. Grep for CREATIVE_KINDS and 64-hex pins of changed role files. Sage checks it against mos-1309 item 5. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-08b role changes for agent writes and the chief's read grant (mos-1309 item 5) | — |
|
||||
| 286 | Case 2 C2-03b push and per-seat credentials for the library mirror (with R4, mos-1323) | ludwig; reviewers dewey | #1791 | briefed | 222 done | Dewey approves the manifest. Library and bus suites and every scripts/test-*.sh green on Sage's gate, mutant killed. A search of the run output for the fixture token finds nothing. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-03b push and per-seat credentials for the library mirror | — |
|
||||
| 287 | Case 2 C2-21 the grant executor for a library project | megavolt; reviewers dewey | #1792 | briefed | 226 done, 285 done | Dewey approves the manifest. Bus suite, Gitea Docker test, install test and every scripts/test-*.sh green on Sage's gate. A search of the run output for the fixture admin and seat tokens finds nothing. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-21 the grant executor for a library project | — |
|
||||
| 288 | Case 2 C2-02 agent writes, the notice, revert and her Console saves | honker; reviewers webby | #1793 | briefed | 215 done, 282 done, 283 done, 284 done, 285 done, 286 done | Webby approves the manifest. Library, bus and harness suites and every scripts/test-*.sh green on Sage's gate, mutants killed. A search of the run output for the fixture tokens finds nothing. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-02 agent writes, the notice, revert and her Console saves | — |
|
||||
| 289 | Case 2 C2-11b Console library pages and her saves (Haiku subagent, decision 129) | researcher; reviewers filbert | #1794 | briefed | 214 done, 288 done | Filbert approves the manifest. The webui suite and every scripts/test-*.sh are green on Sage's gate. Grep for hash pins on bus.js and serve.mjs before in-review. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-11b Console library pages and her saves | — |
|
||||
| 290 | Case 2 C2-12b the setup sheet rewrite for free chat, supporting folders and saves | louie; reviewers webby | #1795 | briefed | 217 done, 218 done, 285 done, 291 done | Doc only. Webby approves it against the ruling. Before landing, grep packages/*/tests and scripts/test-*.sh to confirm no test reads the file. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-12b the setup sheet rewrite for free chat, supporting folders and saves | — |
|
||||
| 291 | PRD 1.16 library.write routes under REQ-LIB-6 (mos-1328) | gosalyn; reviewers webby | #1796 | briefed | 282 done | Webby approves the text. Jason says yes to the exact text (Mos asks him, mos-1328 step 3); no landing before that. requirements.test.mjs and every scripts/test-*.sh that reads the PRD or requirements.json are green on Sage's gate. Mos gets the landing commit. (sage) | `docs/plans/2026-10-22_prd-1-16-brief.md` § PRD 1.16 library.write routes under REQ-LIB-6 (mos-1328) | — |
|
||||
|
||||
<!-- mosaic-queue:end -->
|
||||
|
||||
|
||||
+103
-3529
File diff suppressed because it is too large
Load Diff
+32
-104
@@ -1,6 +1,6 @@
|
||||
# PRD: Mosaic Stack
|
||||
|
||||
- Status: approved, version 1.15. Jason approved draft 0.4 unchanged as
|
||||
- Status: approved, version 1.14. Jason approved draft 0.4 unchanged as
|
||||
1.0 on 2026-10-05 (lead decision 61). They approved version 1.1, the
|
||||
Organization requirements, in decision 03130d08-ddce-480d-a601-e59f64744fc3
|
||||
on 2026-10-14. They approved version 1.2, the chief of staff, the
|
||||
@@ -41,21 +41,7 @@
|
||||
takes the same path as 1.11 (mos-1231, vikunja:19/463). Version 1.14
|
||||
adds the playground levels to REQ-LIB-2 and a draft universe to
|
||||
REQ-LIB-3, from the approved playground ruling. It takes the same path
|
||||
as 1.11 (mos-1233, mos-1238, mos-1241, vikunja:19/464). Version 1.15
|
||||
rewrites REQ-LIB-6 to Jason's Q223 and Q226 rulings and adds supporting
|
||||
folders to REQ-LIB-1 and REQ-LIB-2. Mos ordered it in mos-1320 item 8,
|
||||
and Jason gets a report.
|
||||
- Version 1.15 source: Jason's Q223, answering Q29: "The agents are not
|
||||
allowed to write the prose into the writing projects. Agents are
|
||||
allowed to CRUD character sheets, info summaries, cross-link info, and
|
||||
supporting documentation. They are NOT allowed to actually write any of
|
||||
the story." and "They are permitted to freely converse with the writer
|
||||
via chat interface." His Q226: "Q30: yes." to Mos's reading that a
|
||||
folder nobody has marked counts as story, and "F43: citations should be
|
||||
requireable. Tunable setting." Mos's reading of F43: "require-citation
|
||||
is a setting changed by a human only. Mos's default is off." The text
|
||||
is drafted from the Case 2 design's ruling after r11, "agents never
|
||||
write story", b68d79663 on `gosalyn/case2-design`.
|
||||
as 1.11 (mos-1233, mos-1238, mos-1241, vikunja:19/464).
|
||||
- Version 1.14 source: Jason's Q176 lines TARGET.md:92 "Brainstorm ideas
|
||||
in a "playground" where new universes can be created", :93 "Brainstorm
|
||||
ideas in a "playground" for books in a universe" and :94 "This means
|
||||
@@ -1182,14 +1168,12 @@ library is the user's own writing repository.
|
||||
|
||||
- **REQ-LIB-1.** A library project maps the user's writing repository
|
||||
onto universes, books, entity types such as character and place, the
|
||||
manuscript, playgrounds and supporting folders. The mapping sits in the
|
||||
organization file and fits the user's own folder layout. Only the
|
||||
human changes it, and an agent's organization write that changes it
|
||||
is refused. So
|
||||
manuscript, and playgrounds. The mapping sits in the organization file
|
||||
and fits the user's own folder layout. Only the human changes it, and
|
||||
an agent's organization write that changes it is refused. So
|
||||
`universe.book.{character,place,...}` reads as universe, book folder,
|
||||
type folder. (Design 1.1 and M9. Q176 Case 2 "Data is stored in
|
||||
little-endian organizational scheme". Version 1.15: supporting
|
||||
folders.)
|
||||
little-endian organizational scheme".)
|
||||
- **REQ-LIB-2.** Playgrounds are never confused with canon. A playground
|
||||
has one of three levels, set by where its prefix sits. A book-level
|
||||
prefix lies inside one of its universe's book folders, and its files
|
||||
@@ -1202,20 +1186,15 @@ library is the user's own writing repository.
|
||||
mapping is refused when a prefix lies inside or holds another
|
||||
universe's book folder, when a prefix equals or holds a book folder of
|
||||
its own universe, when two prefixes overlap, when a draft has books or
|
||||
no prefix, and when a hybrid names a draft as a source. Supporting
|
||||
prefixes, the folders agents may write in (REQ-LIB-6), follow the same
|
||||
placement rules. A file's scope comes from its path alone, prefixes
|
||||
first: a Markdown file under a supporting prefix is supporting, one
|
||||
under a playground prefix at any level is playground, any other
|
||||
Markdown file in a book folder is canon, and everything else is
|
||||
unmapped and never returned. A folder in both lists is supporting.
|
||||
Lookups return canon unless the caller asks for playground or
|
||||
supporting. A citation marked as canon must name a canon file, so an
|
||||
agent can't cite a playground or supporting file as canon. The Console
|
||||
shows each cite's scope. (Design 1.2, 5.2 and 7.4, the playground
|
||||
ruling, 51fdfb7e2, and the ruling after r11. Q176 Case 2, the
|
||||
playground items, TARGET.md:92-94. Version 1.14: the levels and the
|
||||
draft. Version 1.15: supporting.)
|
||||
no prefix, and when a hybrid names a draft as a source. A file's scope
|
||||
comes from its path alone, prefixes first: a Markdown file under a
|
||||
playground prefix at any level is playground, any other Markdown file
|
||||
in a book folder is canon, and everything else is unmapped and never
|
||||
returned. Lookups return canon unless the caller asks for playground.
|
||||
An agent can't cite a playground file as a fact, a finding or a
|
||||
correction. The Console shows each cite's scope. (Design 1.2, 5.2 and
|
||||
7.4, and the playground ruling, 51fdfb7e2. Q176 Case 2, the playground
|
||||
items, TARGET.md:92-94. Version 1.14: the levels and the draft.)
|
||||
- **REQ-LIB-3.** Universes stay separate. Every lookup names one universe,
|
||||
and its results never leave it. A draft universe (REQ-LIB-2) counts as
|
||||
a universe here. It has no canon, so a lookup in a draft asks for
|
||||
@@ -1250,27 +1229,18 @@ library is the user's own writing repository.
|
||||
item and "Connections are always visible".)
|
||||
- **REQ-LIB-6.** The creative roles are ideas, research, proofreader,
|
||||
fact-checker and continuity, plus a companion role that the user's own
|
||||
named agents run as. Agents never write the story. A creative agent may
|
||||
create, edit and delete Markdown files only under the supporting
|
||||
folders a human marks (REQ-LIB-1), such as character sheets, summaries,
|
||||
cross-link notes and research notes. Every other path in the user's
|
||||
repository is read-only to it, chapters and unmarked folders included,
|
||||
and the broker refuses such a write before any git call. Each agent
|
||||
write is one commit by that agent's own Gitea account, with a trailer
|
||||
naming the agent. The user sees a notice for it and can revert it. Its
|
||||
tools are the lookups, a message to the human and the two write tools,
|
||||
and research and companion also fetch web pages through the broker.
|
||||
Agents talk with the user in free text. A reply may cite lines of the
|
||||
repository at a commit or pages the agent fetched, and the broker
|
||||
checks every citation before it stores the message. A setting,
|
||||
`requireCitation`, makes every reply carry a citation, except the
|
||||
runner's fixed notices for no answer, a failed turn, no answer passing
|
||||
the citation check and an answer too long to send. Only the human
|
||||
changes it, and it is off by default. The user sees only stored
|
||||
messages, on every channel. (Design 4, 5.2 and the ruling after r11.
|
||||
Q223 and Q226. Q180 for Bean and Chet. Q176 Case 2, the agent list,
|
||||
"User sets strict guardrails for agent capabilities" and TARGET.md:101
|
||||
"Agents NEVER write prose for the user". Version 1.15.)
|
||||
named agents run as. No creative agent can write to the user's
|
||||
repository. Its tools are the lookups and a message to the human, and
|
||||
research and companion also fetch web pages through the broker. Every
|
||||
message an agent sends the user is a short list of items. Each item
|
||||
cites a line of the repository at a commit, or a page the agent
|
||||
fetched, and the broker checks every cite before it stores the message.
|
||||
The one exception is a message with no items and one of three fixed
|
||||
notices: no cited answer, no answer, or the turn failed. The Console
|
||||
shows each notice as a fixed line, with no text from the model.
|
||||
The user sees only stored messages, on every channel. (Design 4, 5.1,
|
||||
5.2 and 5.3; Q180 for Bean and Chet. Q176 Case 2, the agent list and
|
||||
"User sets strict guardrails for agent capabilities".)
|
||||
- **REQ-LIB-7.** The user talks to several creative agents in one chat. A
|
||||
room holds one thread per creative agent in a project. A message goes
|
||||
to every agent in the room, or only to the agents named by @tags at its
|
||||
@@ -1621,14 +1591,11 @@ latest-by date and a hard target (Q176).
|
||||
- REQ-PROJ-1's "no remote" covers project record repositories. A
|
||||
library project is a separate kind with no record repository, and its
|
||||
mirror fetches from the remote (design 2.1, 7.2).
|
||||
- REQ-LIB-6 has a stated residual: a supporting doc can hold any text,
|
||||
a drafted scene included, and code can't tell a scene from a note.
|
||||
Every agent write shows as a notice and a commit trailer, and the user
|
||||
can revert it. Nothing an agent writes lands in a story path. The
|
||||
agent's Gitea token can write any path of the repository, and the
|
||||
bus's path check is the only path limit, which holds while the bus
|
||||
code does (design, ruling after r11). (Version 1.15 replaced the
|
||||
item-list residual. The old text is in the Version 1.15 note.)
|
||||
- REQ-LIB-6 has a stated residual: an `idea` item carries free text,
|
||||
up to 5 items of 200 characters per reply, and code can't tell story
|
||||
text from advice (design 5.1). Accepting it is Jason's or Melanie's
|
||||
(design section 10, step 8). It goes to Jason through Mos
|
||||
(vikunja:19/465).
|
||||
- Where each id is built: REQ-USER-3 and REQ-USER-4 are rows 193a to
|
||||
193d (#1691), with FED R1 to R6. REQ-LIFE-1 is row 194 (#1692) and
|
||||
its follow-up row 239. REQ-KILL-1 is row 191 (#1689). The REQ-LIB ids
|
||||
@@ -1711,45 +1678,6 @@ latest-by date and a hard target (Q176).
|
||||
candidates if they have started. C2-12's setup sheet gets one line
|
||||
per level (design section 8). Sage files it under Vikunja 464. This
|
||||
amendment adds the requirements only.
|
||||
- Version 1.15:
|
||||
- The 1.14 text of REQ-LIB-6 was: "The creative roles are ideas,
|
||||
research, proofreader, fact-checker and continuity, plus a companion
|
||||
role that the user's own named agents run as. No creative agent can
|
||||
write to the user's repository. Its tools are the lookups and a
|
||||
message to the human, and research and companion also fetch web pages
|
||||
through the broker. Every message an agent sends the user is a short
|
||||
list of items. Each item cites a line of the repository at a commit,
|
||||
or a page the agent fetched, and the broker checks every cite before
|
||||
it stores the message. The one exception is a message with no items
|
||||
and one of three fixed notices: no cited answer, no answer, or the
|
||||
turn failed. The Console shows each notice as a fixed line, with no
|
||||
text from the model. The user sees only stored messages, on every
|
||||
channel. (Design 4, 5.1, 5.2 and 5.3; Q180 for Bean and Chet. Q176
|
||||
Case 2, the agent list and "User sets strict guardrails for agent
|
||||
capabilities".)"
|
||||
- The 1.12 note's REQ-LIB-6 residual was: "an `idea` item carries free
|
||||
text, up to 5 items of 200 characters per reply, and code can't tell
|
||||
story text from advice (design 5.1). Accepting it is Jason's or
|
||||
Melanie's (design section 10, step 8). It goes to Jason through Mos
|
||||
(vikunja:19/465)." Q223 removed the item list, and the residual went
|
||||
with it. The note now states the new one.
|
||||
- REQ-LIB-1 gains "and supporting folders" in its first sentence and a
|
||||
version tag. REQ-LIB-2 gains the supporting scope, its placement rule
|
||||
and the canon-cite rule, which replaces "An agent can't cite a
|
||||
playground file as a fact, a finding or a correction." The rest of
|
||||
both is unchanged.
|
||||
- REQ-LIB-3, REQ-LIB-4, REQ-LIB-5 and REQ-LIB-7 are unchanged. REQ-LIB-4
|
||||
already says bus writes and pushes come in later rows (C2-02,
|
||||
C2-03b), which covers agent writes and the user's Console saves. Its
|
||||
fetch still uses a read-only token, now the chief of staff's read
|
||||
grant.
|
||||
- The titles of REQ-LIB-1, REQ-LIB-2 and REQ-LIB-6 in
|
||||
`packages/tasks/requirements.json` change with their text. The id
|
||||
count stays 85.
|
||||
- The new refusal codes, settings and row order are in the design's
|
||||
ruling after r11 and in the Q226 briefs of
|
||||
`docs/plans/2026-10-20_case2-rows.md`. Sage files the rows under
|
||||
Vikunja 416. This amendment adds the requirements only.
|
||||
|
||||
## Risks and open questions
|
||||
|
||||
|
||||
+13
-16
@@ -846,7 +846,7 @@ export class Broker {
|
||||
return cap;
|
||||
}
|
||||
// Row 121 (#1615): what the launcher needs to start, stop and recover thread sessions.
|
||||
// Trusted launcher API, not a socket verb. Per session of each thread (row 269, 264b): messages to the instance that no
|
||||
// Trusted launcher API, not a socket verb. Per thread: messages to the instance that no
|
||||
// run has been delivered yet, messages delivered to the current holder and not yet read
|
||||
// (a turn in progress), and the latest message, open and claim times. A message delivered
|
||||
// to an earlier run and never read (it crashed mid-turn) isn't the holder's turn, so it
|
||||
@@ -866,31 +866,30 @@ export class Broker {
|
||||
const session = this.#runs.get(key) ?? fail('unknown-run');
|
||||
if (this.#ended.has(key)) fail('run-ended');
|
||||
// A run holds at most one session, so this also refuses another thread and a non-thread run.
|
||||
// Row 269 (264b): the row is the session the run was bound to, so a run is idled against its own.
|
||||
const [t] = this.#threadRows('t.business=? AND t.id=? AND se.id=?', record.business, identifier(record.thread), session.session);
|
||||
// Row 264a: the row is the thread's default session's, so a run of another session is refused too.
|
||||
const [t] = this.#threadRows('t.business=? AND t.id=?', record.business, identifier(record.thread));
|
||||
if (t?.holder !== record.run) fail('not-holder');
|
||||
if (t.pending || t.unread) return { released: false, pending: t.pending, unread: t.unread };
|
||||
this.#store.transaction(() => this.#claimEnd(session, this.#own(session), 'release', null));
|
||||
return { released: true };
|
||||
}
|
||||
// Row 269 (264b, #1774): one row per session of each thread, oldest thread first, then oldest
|
||||
// session. `legacy` is a session the 3k-3l migration made (op legacy-3l), whose store and
|
||||
// in-sandbox workspace path are the thread's old ones.
|
||||
// Row 264a (#1769): each row is the thread's default session's. Until 264b the launcher starts
|
||||
// default sessions only, so another session's messages wait.
|
||||
#threadRows(where, ...params) {
|
||||
return this.#store
|
||||
.all(
|
||||
`SELECT t.id, t.instance, se.id AS session, se.op AS session_op,
|
||||
(SELECT count(*) FROM messages m JOIN message_threads mt ON mt.message=m.id WHERE mt.session=se.id AND m.to_role=t.instance
|
||||
`SELECT t.id, t.instance,
|
||||
(SELECT count(*) FROM messages m JOIN message_threads mt ON mt.message=m.id WHERE mt.session=ds.session AND m.to_role=t.instance
|
||||
AND NOT EXISTS(SELECT 1 FROM deliveries d WHERE d.message=m.id AND d.op IN ('delivered','read'))) AS pending,
|
||||
(SELECT count(*) FROM messages m JOIN message_threads mt ON mt.message=m.id WHERE mt.session=se.id AND m.to_role=t.instance
|
||||
(SELECT count(*) FROM messages m JOIN message_threads mt ON mt.message=m.id WHERE mt.session=ds.session AND m.to_role=t.instance
|
||||
AND c.op='claim' AND EXISTS(SELECT 1 FROM deliveries d WHERE d.message=m.id AND d.op='delivered' AND d.holder_run=c.holder_run)
|
||||
AND NOT EXISTS(SELECT 1 FROM deliveries d WHERE d.message=m.id AND d.op='read')) AS unread,
|
||||
(SELECT max(m.at) FROM messages m JOIN message_threads mt ON mt.message=m.id WHERE mt.session=se.id) AS last_message,
|
||||
(SELECT max(at) FROM thread_opens WHERE session=se.id) AS last_open,
|
||||
(SELECT max(m.at) FROM messages m JOIN message_threads mt ON mt.message=m.id WHERE mt.session=ds.session) AS last_message,
|
||||
(SELECT max(at) FROM thread_opens WHERE session=ds.session) AS last_open,
|
||||
c.at AS claim_at, c.op AS claim_op, c.holder_run AS holder_run
|
||||
FROM threads t JOIN sessions se ON se.thread=t.id
|
||||
LEFT JOIN thread_claims c ON c.seq=(SELECT max(seq) FROM thread_claims WHERE session=se.id)
|
||||
WHERE ${where} ORDER BY t.seq, se.seq`,
|
||||
FROM threads t JOIN session_defaults ds ON ds.seq=(SELECT max(seq) FROM session_defaults WHERE thread=t.id)
|
||||
LEFT JOIN thread_claims c ON c.seq=(SELECT max(seq) FROM thread_claims WHERE session=ds.session)
|
||||
WHERE ${where} ORDER BY t.seq`,
|
||||
...params,
|
||||
)
|
||||
.map((r) => ({
|
||||
@@ -902,8 +901,6 @@ export class Broker {
|
||||
lastOpen: r.last_open,
|
||||
lastClaim: r.claim_at,
|
||||
holder: r.claim_op === 'claim' ? r.holder_run : null,
|
||||
session: r.session,
|
||||
legacy: r.session_op === 'legacy-3l',
|
||||
}));
|
||||
}
|
||||
// Trusted launcher API, deliberately NOT a socket verb. S6 supplies immutable launch records.
|
||||
|
||||
@@ -191,7 +191,7 @@ test('broker process: launch ops authorize role.launch, record refusals and end
|
||||
assert.deepEqual((await ask(child, { op: 'credentialStatus', business: 'demo', role: 'pm' })).result, []);
|
||||
// The launcher's thread view, through the same child.
|
||||
assert.deepEqual((await ask(child, { op: 'threadsState', business: 'demo' })).result, [
|
||||
{ thread: 'th-1', instance: 'coder', pending: 0, unread: 0, lastMessage: null, lastOpen: '2026-10-15T00:00:01.000Z', lastClaim: null, holder: null, session: 'th-1', legacy: true },
|
||||
{ thread: 'th-1', instance: 'coder', pending: 0, unread: 0, lastMessage: null, lastOpen: '2026-10-15T00:00:01.000Z', lastClaim: null, holder: null },
|
||||
]);
|
||||
// And its idle release (Dewey's F3, 28591): the op reaches the broker, which refuses a run
|
||||
// that doesn't hold the thread.
|
||||
|
||||
@@ -199,21 +199,21 @@ test('T2 sage-2257: a released or revoked run\'s retired generation refuses its
|
||||
// Each refusal leaves its one action.refused event (request()'s catch, #refused); nothing else is
|
||||
// written: no approval, delivery, read or claim state (mos-1277).
|
||||
const lastSeq = () => store.get('SELECT max(seq) AS s FROM events').s;
|
||||
const refusedOnce = (fn, label, run) => {
|
||||
const refusedOnce = (fn, label) => {
|
||||
const from = lastSeq();
|
||||
assert.throws(fn, { code: 'not-holder' }, label);
|
||||
const added = store.all('SELECT kind, actor_run, body FROM events WHERE seq > ? ORDER BY seq', from);
|
||||
const added = store.all('SELECT kind, body FROM events WHERE seq > ? ORDER BY seq', from);
|
||||
assert.deepEqual(
|
||||
added.map((e) => [e.kind, e.actor_run, JSON.parse(e.body)]),
|
||||
[['action.refused', run, { code: 'not-holder' }]],
|
||||
added.map((e) => [e.kind, JSON.parse(e.body)]),
|
||||
[['action.refused', { code: 'not-holder' }]],
|
||||
label,
|
||||
);
|
||||
};
|
||||
const refused = (name, { d, taken }) => {
|
||||
const { events, ...before } = counts();
|
||||
refusedOnce(() => call(name, 'decision.withdraw', { id: d.id }), 'approval', `${name}-run`);
|
||||
refusedOnce(() => call(name, 'message.receive'), 'delivery', `${name}-run`);
|
||||
refusedOnce(() => call(name, 'message.read', { id: taken.id }), 'read', `${name}-run`);
|
||||
refusedOnce(() => call(name, 'decision.withdraw', { id: d.id }), 'approval');
|
||||
refusedOnce(() => call(name, 'message.receive'), 'delivery');
|
||||
refusedOnce(() => call(name, 'message.read', { id: taken.id }), 'read');
|
||||
const { events: after, ...rest } = counts();
|
||||
assert.deepEqual(rest, before);
|
||||
assert.equal(after, events + 3);
|
||||
|
||||
+50
-117
@@ -75,15 +75,6 @@
|
||||
// threadStore()), so the next run for the thread resumes the harness
|
||||
// session (REQ-THREAD-2).
|
||||
//
|
||||
// Row 269 (264b, #1774): threadsState has one row per session of each
|
||||
// thread, and everything above is per session. Each session has its own
|
||||
// store (session.mjs sessionStore()) and its own workspace under
|
||||
// session-workspaces/ (sessionWorkspace()), which a lock beside it keeps to
|
||||
// one writer from before the clones until the run's proven exit. A legacy
|
||||
// session (op legacy-3l) keeps the thread's store, and its new workspace
|
||||
// shows inside the sandbox at the old instance path, the cwd its history
|
||||
// recorded. The broker's half of the fence is its per-session claim.
|
||||
//
|
||||
// Landing runs (row 156, #1651). Every launch of a non-thread instance
|
||||
// reads the broker's landHolders (launch op): the approved, unspent merge
|
||||
// decisions each non-thread instance raised. The instance's entries go into
|
||||
@@ -130,14 +121,12 @@
|
||||
// processing-halted.
|
||||
// - delete: instance-running against the registry, then lifecycleDelete
|
||||
// (the writer's commit), then the rename of workspaces/<b>/I/ to
|
||||
// workspaces/<b>/.retired/I-<transaction>/, and of
|
||||
// session-workspaces/<b>/I/ to session-workspaces/<b>/.retired/I-<transaction>/
|
||||
// (row 269). A failed rename closes it workspace-rename-failed with the
|
||||
// transaction; a later delete retries it.
|
||||
// workspaces/<b>/.retired/I-<transaction>/. A failed rename closes it
|
||||
// workspace-rename-failed with the transaction; a later delete retries it.
|
||||
|
||||
import { createServer } from "node:net";
|
||||
import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, renameSync, rmSync } from "node:fs";
|
||||
import { dirname, join, relative } from "node:path";
|
||||
import { dirname, join } from "node:path";
|
||||
import { configDir, loadBusiness, resolveInstance, systemVars } from "../../business/src/index.mjs";
|
||||
import { limitHit } from "../../business/src/launch.mjs";
|
||||
import { BundleError, buildBundle, hasFallback, readSkills, sessionModel } from "../../harness/src/bundle.mjs";
|
||||
@@ -153,10 +142,8 @@ import {
|
||||
runnerOf,
|
||||
SESSION_CREDENTIALS,
|
||||
sessionEnv,
|
||||
threadStore,
|
||||
sessionExit,
|
||||
sessionStore,
|
||||
sessionWorkspace,
|
||||
lockSessionWorkspace,
|
||||
spawnSession,
|
||||
workspaceDir,
|
||||
writeSessionFile,
|
||||
@@ -250,9 +237,6 @@ export function createLauncher({
|
||||
throw new CliError(`${e.message}; check which sessions still run, then move the file aside`, 3);
|
||||
}
|
||||
const registry = new Registry(dataRoot, { readOnly: !launches });
|
||||
// Row 269: earlier-host runs still live after recover(). check() sees each while it lives.
|
||||
const survivors = [];
|
||||
const liveRun = (s) => startTimeOf(s.pid) === s.startTime || startTimeOf(s.runnerPid) === s.runnerStartTime;
|
||||
const children = new Map();
|
||||
let chain = Promise.resolve();
|
||||
let closed = false;
|
||||
@@ -294,7 +278,7 @@ export function createLauncher({
|
||||
// nothing else launches for one. Row 194 (#1692, V2): `human` is the
|
||||
// human's launch request, which may name any declared instance. The listing
|
||||
// limits the chief, not the human. launch.by still takes the `pm` branch.
|
||||
async function check(instance, { pm = false, thread = null, session = null, human = false } = {}) {
|
||||
async function check(instance, { pm = false, thread = null, human = false } = {}) {
|
||||
const admissionGeneration = admission().generation;
|
||||
try { b=loadBusiness(host.business,{dir:configDir(env),rolesDir:rolesDir(env)}); } catch(e){throw new Refusal("organization-refused",e.message);}
|
||||
if (!b.launch) throw new Refusal("launch-not-configured", `business ${b.id} has no launch block`);
|
||||
@@ -302,12 +286,7 @@ export function createLauncher({
|
||||
const threaded = b.roles[instance]?.definition === THREAD_DEFINITION;
|
||||
if (threaded && !thread) throw new Refusal("thread-required", `${instance} runs only for a thread`);
|
||||
if (!threaded && thread) throw new Refusal("thread-not-allowed", `${instance} isn't a thread instance`);
|
||||
if (threaded && !session) throw new Refusal("session-required", `${instance} runs for one session of a thread`);
|
||||
if (registry.running(b.id, instance, thread, session)) throw new Refusal("instance-running");
|
||||
// Row 269 (Q2): a run an earlier host started with no session works in the instance's old
|
||||
// workspace and the thread's store, so no session of the instance starts while one lives.
|
||||
if (threaded && [...registry.sessions, ...leftover, ...survivors.filter(liveRun)].some((s) => s.business === b.id && s.instance === instance && !s.session))
|
||||
throw new Refusal("legacy-run-live", `a run of ${instance} with no session is still live`);
|
||||
if (registry.running(b.id, instance, thread)) throw new Refusal("instance-running");
|
||||
let resolved;
|
||||
try {
|
||||
resolved = resolveInstance({ system: vars, business: b, instance });
|
||||
@@ -399,59 +378,29 @@ export function createLauncher({
|
||||
}
|
||||
|
||||
// Bundle, spawn, bind, register, hand over the capability.
|
||||
async function start({ instance, launchedBy, resolved, model, account = null, thread = null, session = null, legacy = false, legacyThread = legacy, human = false, admissionGeneration }) {
|
||||
async function start({ instance, launchedBy, resolved, model, account = null, thread = null, human = false, admissionGeneration }) {
|
||||
admission(admissionGeneration);
|
||||
// Every launch path ends here, so a --no-launch host spawns nothing whichever path asked.
|
||||
if (!launches) throw new Refusal("launches-disabled", "this host was started with --no-launch");
|
||||
// A thread session's store is checked first, so a bad id or an unsafe
|
||||
// directory launches nothing.
|
||||
// A thread's store is checked first, so a bad id or an unsafe directory
|
||||
// launches nothing.
|
||||
let store = null;
|
||||
if (thread) {
|
||||
try {
|
||||
store = sessionStore(dataRoot, b.id, thread, session, { legacy, legacyThread });
|
||||
store = threadStore(dataRoot, b.id, thread);
|
||||
} catch (e) {
|
||||
throw new Refusal(e.code === "legacy-store-unmapped" ? e.code : "thread-store-refused", e.message);
|
||||
throw new Refusal("thread-store-refused", e.message);
|
||||
}
|
||||
}
|
||||
const credentials = await host.op({ op: "credentialStatus", business: b.id, role: instance });
|
||||
admission(admissionGeneration);
|
||||
// The clones come before the run, so one that can't be made leaves no
|
||||
// run behind. The host's git treats each clone as hostile, and its
|
||||
// checks hold only while no session writes the workspace. A non-thread
|
||||
// workspace is one instance's, check() refused instance-running, and
|
||||
// launches are serialized. A thread session's workspace is its own (row
|
||||
// 269), and its lock refuses a second writer, whichever host asks.
|
||||
let workspace;
|
||||
let workspaceDest = null;
|
||||
let lock = null;
|
||||
if (thread) {
|
||||
try {
|
||||
const live = registry.sessions.filter((s) => s.business === b.id && s.workspace).map((s) => s.workspace);
|
||||
workspace = sessionWorkspace(dataRoot, b.id, instance, session, { live });
|
||||
lock = lockSessionWorkspace(workspace, { hostPid: process.pid, hostStartTime: startTimeOf(process.pid), business: b.id, instance, thread, session });
|
||||
} catch (e) {
|
||||
if (["session-workspace-unsafe", "session-workspace-overlap", "session-workspace-busy"].includes(e.code)) throw new Refusal(e.code, e.message);
|
||||
throw e;
|
||||
}
|
||||
if (legacy) workspaceDest = workspaceDir(dataRoot, b.id, instance);
|
||||
} else {
|
||||
workspace = workspaceDir(dataRoot, b.id, instance);
|
||||
mkdirSync(workspace, { recursive: true, mode: 0o700 });
|
||||
}
|
||||
try {
|
||||
return await startLocked({ instance, launchedBy, resolved, model, account, thread, session, human, admissionGeneration, store, credentials, workspace, workspaceDest, lock });
|
||||
} catch (e) {
|
||||
// Every failure path in startLocked has proven the run's exit, or never spawned one.
|
||||
lock?.release();
|
||||
throw e;
|
||||
}
|
||||
}
|
||||
|
||||
// The rest of start(): clones, bundle, spawn, bind, register. The lock, when there is one, is
|
||||
// released at the run's close.
|
||||
async function startLocked({ instance, launchedBy, resolved, model, account, thread, session, human, admissionGeneration, store, credentials, workspace, workspaceDest, lock }) {
|
||||
// What the session sees: a legacy session's workspace at the old instance path.
|
||||
const inSandbox = workspaceDest ?? workspace;
|
||||
// checks hold only while no session writes the workspace: a workspace
|
||||
// is one instance's, check() refused instance-running, and launches are
|
||||
// serialized, so none does.
|
||||
const workspace = workspaceDir(dataRoot, b.id, instance);
|
||||
mkdirSync(workspace, { recursive: true, mode: 0o700 });
|
||||
let checkouts;
|
||||
try {
|
||||
checkouts = await withProcessing(dataRoot, () => {
|
||||
@@ -467,7 +416,7 @@ export function createLauncher({
|
||||
else if (c.outcome === "fetched") record({ event: "checkout-fetched", instance, project: c.project, reason: c.reason });
|
||||
}
|
||||
let harness, route, routeReason;
|
||||
({resolved,model,account,harness,route,routeReason}=await check(instance,{pm:instance===b.launch.by,thread,session,human}));
|
||||
({resolved,model,account,harness,route,routeReason}=await check(instance,{pm:instance===b.launch.by,thread,human}));
|
||||
admission(admissionGeneration);
|
||||
const { run, runDir } = newRun(dataRoot, b.id);
|
||||
const sessionDir = store ? store.session : join(runDir, "session");
|
||||
@@ -491,7 +440,7 @@ export function createLauncher({
|
||||
arbiter: Object.values(b.arbiters).includes(instance),
|
||||
tracker,
|
||||
credentials,
|
||||
session: { run, launchedBy, workspace: inSandbox, toolSocket, turnMarker, checkouts: inSandbox === workspace ? checkouts : checkouts.map((c) => ({ ...c, path: join(inSandbox, relative(workspace, c.path)) })) },
|
||||
session: { run, launchedBy, workspace, toolSocket, turnMarker, checkouts },
|
||||
harness,
|
||||
route,
|
||||
routeReason,
|
||||
@@ -522,7 +471,7 @@ export function createLauncher({
|
||||
brokerSocket: host.path,
|
||||
launchSocket: launchSocketPath(dataRoot),
|
||||
gitSocket: git,
|
||||
workspace: inSandbox,
|
||||
workspace,
|
||||
sessionDir,
|
||||
adapter,
|
||||
bundle: files,
|
||||
@@ -535,7 +484,6 @@ export function createLauncher({
|
||||
|
||||
const paths = {
|
||||
workspace,
|
||||
workspaceDest,
|
||||
adapter,
|
||||
harnessMounts,
|
||||
brokerSocket: host.path,
|
||||
@@ -571,12 +519,11 @@ export function createLauncher({
|
||||
updateRuntime(dataRoot, managed.id, { runnerPid: runner.pid, runnerStartTime: runner.startTime });
|
||||
admission(admissionGeneration);
|
||||
if (!outerStart) throw new Error("the session process exited at once");
|
||||
lock?.update({ run, runPid: child.pid, runStartTime: outerStart });
|
||||
const launch = await host.bindLaunch({ business: b.id, role: instance, run, harness: model.harness, provider: model.provider, model: model.model, account, transcript, pid: child.pid, startTime: outerStart, ...(thread ? { thread, session } : {}) });
|
||||
const launch = await host.bindLaunch({ business: b.id, role: instance, run, harness: model.harness, provider: model.provider, model: model.model, account, transcript, pid: child.pid, startTime: outerStart, ...(thread ? { thread } : {}) });
|
||||
bound = true;
|
||||
admission(admissionGeneration);
|
||||
entry = {
|
||||
business: b.id, instance, ...(thread ? { thread, session, workspace } : {}), run, launchedBy, harness: model.harness, model: model.model, provider: model.provider, modelKey: model.modelKey,
|
||||
business: b.id, instance, ...(thread ? { thread } : {}), run, launchedBy, harness: model.harness, model: model.model, provider: model.provider, modelKey: model.modelKey,
|
||||
pid: child.pid, startTime: outerStart, runnerPid: runner.pid, runnerStartTime: runner.startTime, runDir, startedAt: new Date().toISOString(),
|
||||
};
|
||||
registry.add(entry);
|
||||
@@ -605,15 +552,13 @@ export function createLauncher({
|
||||
const ended = await endRun(run, reason, signal ? null : code);
|
||||
registry.remove(b.id, run);
|
||||
// Row 125 (#1619, REQ-LIMIT-4): a run a limit check stopped names the limit, from the claim row.
|
||||
record({ event: "end", instance, ...(thread ? { thread, session } : {}), run, reason, exitCode: code, signal, ...(haltGeneration ? { haltGeneration } : {}), ...(ended?.limit ? { limit: ended.limit } : {}) });
|
||||
record({ event: "end", instance, ...(thread ? { thread } : {}), run, reason, exitCode: code, signal, ...(haltGeneration ? { haltGeneration } : {}), ...(ended?.limit ? { limit: ended.limit } : {}) });
|
||||
log(`run ${run} (${instance}) ended: ${reason}`);
|
||||
} catch (e) {
|
||||
log(`run ${run}: ${e.message}`);
|
||||
} finally {
|
||||
try { unregisterRuntime(dataRoot, managed.id); }
|
||||
catch { log(`run ${run}: processing receipt cleanup refused`); }
|
||||
try { lock?.release(); }
|
||||
catch (e) { log(`run ${run}: workspace lock release: ${e.message}`); }
|
||||
children.delete(run);
|
||||
stopping.delete(run);
|
||||
spawnedAt.delete(run);
|
||||
@@ -621,7 +566,7 @@ export function createLauncher({
|
||||
refusedRelease.delete(run);
|
||||
}
|
||||
});
|
||||
record({ event: "launch", instance, ...(thread ? { thread, session } : {}), run, launchedBy, harness: model.harness, route, routeReason, model: model.model, provider: model.provider, modelKey: model.modelKey, account, pid: child.pid, runnerPid: entry.runnerPid, manifest });
|
||||
record({ event: "launch", instance, ...(thread ? { thread } : {}), run, launchedBy, harness: model.harness, route, routeReason, model: model.model, provider: model.provider, modelKey: model.modelKey, account, pid: child.pid, runnerPid: entry.runnerPid, manifest });
|
||||
return { run, instance, harness: model.harness, model: model.model };
|
||||
}
|
||||
|
||||
@@ -655,12 +600,9 @@ export function createLauncher({
|
||||
}
|
||||
const now = Date.now();
|
||||
const ms = (at) => (at ? Date.parse(at) : 0);
|
||||
// Row 269: a thread with a legacy session keeps its old store for that session only.
|
||||
const legacyThreads = new Set(threads.filter((t) => t.legacy).map((t) => t.thread));
|
||||
for (const t of threads) {
|
||||
if (closed) return;
|
||||
const key = `${t.thread}/${t.session}`;
|
||||
const s = registry.running(b.id, t.instance, t.thread, t.session);
|
||||
const s = registry.running(b.id, t.instance, t.thread);
|
||||
if (s) {
|
||||
const last = Math.max(ms(s.startedAt), ms(t.lastMessage), ms(t.lastOpen));
|
||||
if (!stopping.has(s.run) && now - last >= b.launch.threadIdleSeconds * 1000) {
|
||||
@@ -674,7 +616,7 @@ export function createLauncher({
|
||||
// A turn in progress, or a message since the snapshot: the run keeps going.
|
||||
if (!idle.released) continue;
|
||||
stopping.add(s.run);
|
||||
record({ event: "thread-idle", instance: t.instance, thread: t.thread, session: t.session, run: s.run });
|
||||
record({ event: "thread-idle", instance: t.instance, thread: t.thread, run: s.run });
|
||||
try {
|
||||
if (startTimeOf(s.runnerPid) === s.runnerStartTime) process.kill(s.runnerPid, "SIGTERM");
|
||||
} catch {}
|
||||
@@ -687,21 +629,20 @@ export function createLauncher({
|
||||
// the work (it died before its claim, say) waits for the next one
|
||||
// rather than start again every tick. A refused start isn't a start.
|
||||
const signature = `${t.lastMessage}|${t.lastOpen}`;
|
||||
if (startedFor.get(key) === signature) continue;
|
||||
if (startedFor.get(t.thread) === signature) continue;
|
||||
await serialize(async () => {
|
||||
if (closed || registry.running(b.id, t.instance, t.thread, t.session)) return;
|
||||
if (closed || registry.running(b.id, t.instance, t.thread)) return;
|
||||
try {
|
||||
const where = { thread: t.thread, session: t.session };
|
||||
await start({ instance: t.instance, launchedBy: b.human, ...where, legacy: t.legacy, legacyThread: legacyThreads.has(t.thread), ...(await check(t.instance, where)) });
|
||||
startedFor.set(key, signature);
|
||||
refusedThreads.delete(key);
|
||||
await start({ instance: t.instance, launchedBy: b.human, thread: t.thread, ...(await check(t.instance, { thread: t.thread })) });
|
||||
startedFor.set(t.thread, signature);
|
||||
refusedThreads.delete(t.thread);
|
||||
} catch (e) {
|
||||
const code = e instanceof Refusal ? e.code : "launch-failed";
|
||||
// Logged once per code, not once per tick.
|
||||
if (refusedThreads.get(key) === code) return;
|
||||
refusedThreads.set(key, code);
|
||||
log(`thread ${t.thread} session ${t.session} (${t.instance}): start refused: ${code}`);
|
||||
record({ event: "refused", by: b.human, instance: t.instance, thread: t.thread, session: t.session, code, why: e.message, ...(e.limit?{limit:e.limit}:{}) });
|
||||
if (refusedThreads.get(t.thread) === code) return;
|
||||
refusedThreads.set(t.thread, code);
|
||||
log(`thread ${t.thread} (${t.instance}): start refused: ${code}`);
|
||||
record({ event: "refused", by: b.human, instance: t.instance, thread: t.thread, code, why: e.message, ...(e.limit?{limit:e.limit}:{}) });
|
||||
}
|
||||
});
|
||||
}
|
||||
@@ -908,23 +849,20 @@ export function createLauncher({
|
||||
const transaction = out?.transaction ?? null;
|
||||
if (transaction === null) return { refusal: "workspace-rename-failed" };
|
||||
const bot = out.bot ? { bot: out.bot } : {};
|
||||
// The old instance workspace, then (row 269) the instance's session workspaces, each moved
|
||||
// whole. A retry moves whichever is still in place.
|
||||
for (const from of [workspaceDir(dataRoot, b.id, r.instance), join(dataRoot, "session-workspaces", b.id, r.instance)]) {
|
||||
if (!existsSync(from)) continue;
|
||||
const to = join(dirname(from), ".retired", `${r.instance}-${transaction}`);
|
||||
try {
|
||||
mkdirSync(dirname(to), { recursive: true, mode: 0o700 });
|
||||
chmodSync(dirname(to), 0o700);
|
||||
if (existsSync(to)) throw new Error(`${to} exists`);
|
||||
renameSync(from, to);
|
||||
chmodSync(to, 0o700);
|
||||
} catch (e) {
|
||||
log(`request ${r.request} (${r.instance}): workspace rename failed: ${e.message}; left at ${from}`);
|
||||
return { transaction, ...bot, refusal: "workspace-rename-failed", why: `${e.message}; left at ${from}` };
|
||||
}
|
||||
record({ event: "workspace-retired", instance: r.instance, request: r.request, transaction, path: to });
|
||||
const from = workspaceDir(dataRoot, b.id, r.instance);
|
||||
if (!existsSync(from)) return { transaction, ...bot };
|
||||
const to = join(dirname(from), ".retired", `${r.instance}-${transaction}`);
|
||||
try {
|
||||
mkdirSync(dirname(to), { recursive: true, mode: 0o700 });
|
||||
chmodSync(dirname(to), 0o700);
|
||||
if (existsSync(to)) throw new Error(`${to} exists`);
|
||||
renameSync(from, to);
|
||||
chmodSync(to, 0o700);
|
||||
} catch (e) {
|
||||
log(`request ${r.request} (${r.instance}): workspace rename failed: ${e.message}; left at ${from}`);
|
||||
return { transaction, ...bot, refusal: "workspace-rename-failed", why: `${e.message}; left at ${from}` };
|
||||
}
|
||||
record({ event: "workspace-retired", instance: r.instance, request: r.request, transaction, path: to });
|
||||
return { transaction, ...bot };
|
||||
}
|
||||
|
||||
@@ -1020,15 +958,10 @@ export function createLauncher({
|
||||
process.kill(s.pid, "SIGKILL");
|
||||
} catch {}
|
||||
const end = Date.now() + 5000;
|
||||
while (liveRun(s) && Date.now() < end) await new Promise((r) => setTimeout(r, 20));
|
||||
}
|
||||
// Row 269 (Q2): the session or its runner outlived the kill, or wasn't a session to kill.
|
||||
if (liveRun(s)) {
|
||||
survivors.push(s);
|
||||
log(`run ${s.run} (${s.instance}) from an earlier host still runs (pid ${s.pid}, runner ${s.runnerPid}): no session of ${s.instance} starts until it exits`);
|
||||
while (startTimeOf(s.pid) === s.startTime && Date.now() < end) await new Promise((r) => setTimeout(r, 20));
|
||||
}
|
||||
try {
|
||||
await host.bindLaunch({ business: b.id, role: s.instance, run: s.run, harness: s.harness, pid: s.pid, startTime: s.startTime, ...(s.thread ? { thread: s.thread } : {}), ...(s.session ? { session: s.session } : {}) });
|
||||
await host.bindLaunch({ business: b.id, role: s.instance, run: s.run, harness: s.harness, pid: s.pid, startTime: s.startTime, ...(s.thread ? { thread: s.thread } : {}) });
|
||||
} catch (e) {
|
||||
// A host that died after ending the run but before updating sessions.json.
|
||||
if (e.code === "run-ended") log(`run ${s.run} (${s.instance}) from an earlier host was already ended`);
|
||||
@@ -1036,7 +969,7 @@ export function createLauncher({
|
||||
continue;
|
||||
}
|
||||
await endRun(s.run, "host-lost", null);
|
||||
record({ event: "end", instance: s.instance, ...(s.thread ? { thread: s.thread } : {}), ...(s.session ? { session: s.session } : {}), run: s.run, reason: "host-lost", exitCode: null, signal: null });
|
||||
record({ event: "end", instance: s.instance, ...(s.thread ? { thread: s.thread } : {}), run: s.run, reason: "host-lost", exitCode: null, signal: null });
|
||||
log(`run ${s.run} (${s.instance}) from an earlier host ended: host-lost`);
|
||||
}
|
||||
leftover = [];
|
||||
|
||||
-18
@@ -1,18 +0,0 @@
|
||||
// A stand-in harness turn for the session launch tests (row 269, #1774).
|
||||
// thread-adapter.mjs's turn, plus the run's cwd and the names in it, so a
|
||||
// test reads from the reply which workspace the session saw and at what
|
||||
// in-sandbox path. It keeps a history in $MOSAIC_SESSION_DIR, the session's
|
||||
// store.
|
||||
|
||||
import { appendFileSync, existsSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
|
||||
import { join } from "node:path";
|
||||
|
||||
const request = process.env.MOSAIC_REQUEST ?? "";
|
||||
const body = request.match(/^Message [^\n]*:\n\n([\s\S]*)$/m)?.[1] ?? "";
|
||||
const historyFile = join(process.env.MOSAIC_SESSION_DIR, "history");
|
||||
const before = existsSync(historyFile) ? readFileSync(historyFile, "utf8").split("\n").filter(Boolean) : [];
|
||||
const cwd = process.cwd();
|
||||
const entries = readdirSync(cwd).sort();
|
||||
appendFileSync(historyFile, `${body}\n`);
|
||||
process.stdout.write(`THREAD ${JSON.stringify({ body, before, cwd, entries })}\n`);
|
||||
writeFileSync(process.env.MOSAIC_TURN_MARKER, "done\n");
|
||||
@@ -1,414 +0,0 @@
|
||||
// Session runs (row 269, 264b, #1774): every session of a thread runs on its
|
||||
// own, with its own store under threads/<b>/<t>/sessions/<s>/ and its own
|
||||
// workspace under session-workspaces/<b>/<instance>/<s>/, and a lock beside
|
||||
// the workspace keeps it to one writer. A legacy session (op legacy-3l) keeps
|
||||
// the thread's old store, and its workspace shows inside the sandbox at the
|
||||
// old instance path. Real runners in the bwrap sandbox; a stub adapter keeps
|
||||
// a history in the store and answers with what it found, its cwd and what
|
||||
// the cwd holds.
|
||||
//
|
||||
// The host is thread-launch.test.mjs's: startBroker on bootConfig's config,
|
||||
// with the ops the broker child forwards, and the human capability from
|
||||
// bindHuman directly.
|
||||
|
||||
import { test } from "node:test";
|
||||
import assert from "node:assert/strict";
|
||||
import { spawn, spawnSync } from "node:child_process";
|
||||
import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, symlinkSync, writeFileSync } from "node:fs";
|
||||
import { join } from "node:path";
|
||||
import { fileURLToPath } from "node:url";
|
||||
import { launchDoc } from "../../business/tests/helpers.mjs";
|
||||
import { BusError } from "../../bus/src/broker.mjs";
|
||||
import { startBroker } from "../../bus/src/runtime.mjs";
|
||||
import { Store } from "../../bus/src/store.mjs";
|
||||
import { transition } from "../../processing-control/src/state.mjs";
|
||||
import { gitEnv } from "../../seat/src/checkout.mjs";
|
||||
import { startTimeOf } from "../../seat/src/proc.mjs";
|
||||
import { sandboxProblem } from "../../seat/src/sandbox.mjs";
|
||||
import { launchLogFile, readSessions, Registry, SESSION_CREDENTIALS } from "../../seat/src/session.mjs";
|
||||
import { bootConfig, loadSystem } from "../src/config.mjs";
|
||||
import { createLauncher } from "../src/launcher.mjs";
|
||||
import { fakeHarnesses, fixture, tmp } from "./helpers.mjs";
|
||||
// A thread made by hand gets the default session the 3k-3l migration gives a legacy thread, with
|
||||
// the thread's id (as in thread-launch.test.mjs).
|
||||
const DEFAULT_SESSION = [
|
||||
"INSERT INTO sessions(at,business,thread,id,instance,owner,name,op) SELECT at,business,id,id,instance,owner,'default','legacy-3l' FROM threads WHERE id=?",
|
||||
"INSERT INTO session_defaults(at,thread,session,by) SELECT at,id,id,'migration-3l' FROM threads WHERE id=?",
|
||||
];
|
||||
|
||||
const ADAPTER = fileURLToPath(new URL("./fixtures/session-adapter.mjs", import.meta.url));
|
||||
const skip = sandboxProblem() ?? false;
|
||||
|
||||
async function until(fn, ms = 20000) {
|
||||
const end = Date.now() + ms;
|
||||
while (Date.now() < end) {
|
||||
const v = await fn();
|
||||
if (v) return v;
|
||||
await new Promise((r) => setTimeout(r, 50));
|
||||
}
|
||||
throw new Error("timed out waiting");
|
||||
}
|
||||
// A mutant's kill is an assertion failure, not a timeout (sage-2707), so the waits a mutant could
|
||||
// stall return what they last saw and the assertions after them decide.
|
||||
async function settle(fn, ms = 20000) {
|
||||
const end = Date.now() + ms;
|
||||
let v;
|
||||
while (Date.now() < end) {
|
||||
v = await fn();
|
||||
if (v) return v;
|
||||
await new Promise((r) => setTimeout(r, 50));
|
||||
}
|
||||
return v;
|
||||
}
|
||||
|
||||
function gitIn(cwd, ...args) {
|
||||
const r = spawnSync("git", ["-c", "user.name=test", "-c", "[email protected]", "-C", cwd, ...args], { env: gitEnv(), encoding: "utf8" });
|
||||
assert.equal(r.status, 0, r.stderr);
|
||||
}
|
||||
|
||||
// Each directory made 0700, as the store and workspace checks want.
|
||||
function privateDir(...parts) {
|
||||
for (let i = 1; i <= parts.length; i++) {
|
||||
const d = join(...parts.slice(0, i));
|
||||
if (!existsSync(d)) mkdirSync(d, { mode: 0o700 });
|
||||
if (i > 1) chmodSync(d, 0o700);
|
||||
}
|
||||
return join(...parts);
|
||||
}
|
||||
|
||||
// The assistant is the thread instance; sonnet is its model's limit.
|
||||
function prepare(t, { sonnet = 3, idle = 1 } = {}) {
|
||||
const root = tmp(t, "mosaic-session-");
|
||||
const f = fixture(root, "acme", (doc) => {
|
||||
doc.roles.chief.vars = { harness: "pi", model: "claude-opus-5-5", thinking: "high" };
|
||||
doc.roles.assistant = { definition: "assistant", vars: { harness: "pi", model: "claude-sonnet-5-5", thinking: "high" } };
|
||||
doc.launch = launchDoc("chief", ["coder", "assistant"], { opus: 1, sonnet });
|
||||
doc.launch.threadIdleSeconds = idle;
|
||||
return doc;
|
||||
});
|
||||
for (const k of SESSION_CREDENTIALS.flat()) delete f.env[k];
|
||||
const project = f.doc.projects.stack.root;
|
||||
gitIn(project, "init", "-q", "-b", "main");
|
||||
writeFileSync(join(project, "file.txt"), "one\n");
|
||||
gitIn(project, "add", "file.txt");
|
||||
gitIn(project, "commit", "-q", "-m", "one");
|
||||
const adapter = join(root, "adapter.sh");
|
||||
writeFileSync(adapter, `exec '${process.execPath}' '${ADAPTER}'\n`, { mode: 0o644 });
|
||||
return { root, f, adapter };
|
||||
}
|
||||
|
||||
// A host and its launcher on the prepared root. `ops` replaces launch ops, given the runtime.
|
||||
async function start(t, { f, adapter }, { tickMs = 100, ops: replace } = {}) {
|
||||
const system = loadSystem({ env: f.env });
|
||||
const { trackers, ...boot } = bootConfig({ system, businessId: "acme", env: f.env });
|
||||
assert.equal(trackers, undefined);
|
||||
const runtime = await startBroker(boot);
|
||||
const ops = {
|
||||
identity: (m) => runtime.identity(m.cap),
|
||||
authorizeLaunch: (m) => runtime.authorizeLaunch(m.cap, m.instance),
|
||||
refuse: (m) => runtime.refuse(m.cap, m.code, m.subject),
|
||||
endLaunch: (m) => runtime.endLaunch(m.record),
|
||||
credentialStatus: (m) => runtime.credentialStatus(m.business, m.role),
|
||||
threadsState: (m) => runtime.threadsState(m.business),
|
||||
threadIdle: (m) => runtime.threadIdle(m.record),
|
||||
mayLaunch: (m) => runtime.mayLaunch(m),
|
||||
landHeld: (m) => runtime.landHeld(m.record),
|
||||
landHolders: (m) => runtime.landHolders(m.business),
|
||||
landRelease: (m) => runtime.landRelease(m.record),
|
||||
...replace?.(runtime),
|
||||
};
|
||||
const refusing = (what, fn) => async (m) => {
|
||||
try {
|
||||
return fn(m);
|
||||
} catch (e) {
|
||||
const code = e instanceof BusError ? e.code : `${what}-refused`;
|
||||
throw Object.assign(new Error(`${what} refused: ${code}`), { code });
|
||||
}
|
||||
};
|
||||
const hooks = [];
|
||||
let closing = null;
|
||||
const host = {
|
||||
business: "acme",
|
||||
path: runtime.path,
|
||||
dataRoot: f.dataRoot,
|
||||
op: refusing("launch-op", (m) => {
|
||||
if (!Object.hasOwn(ops, m.op)) throw new BusError("invalid-host-request");
|
||||
return ops[m.op](m);
|
||||
}),
|
||||
bindLaunch: refusing("launch bind", (r) => runtime.bindLaunch(r)),
|
||||
beforeClose: (fn) => void hooks.push(fn),
|
||||
};
|
||||
const logs = [];
|
||||
const launcher = createLauncher({
|
||||
host,
|
||||
system,
|
||||
env: f.env,
|
||||
makeLoader: await fakeHarnesses(t, { pi: adapter, "claude-code": adapter }),
|
||||
sessionDefaults: { pollInterval: 100 },
|
||||
harnessVersion: "0.85.1",
|
||||
readOnly: [ADAPTER],
|
||||
threadTickMs: tickMs,
|
||||
log: (l) => logs.push(l),
|
||||
});
|
||||
const close = () =>
|
||||
(closing ??= (async () => {
|
||||
for (const fn of hooks) await fn(0);
|
||||
await runtime.close();
|
||||
})());
|
||||
t.after(close);
|
||||
await launcher.listen();
|
||||
const human = runtime.broker.bindHuman({ business: "acme", human: f.doc.human, via: "cli", outsideAgent: true });
|
||||
const call = (verb, args = {}) => runtime.broker.request(human, { verb, args });
|
||||
return { host, runtime, launcher, call, logs, close };
|
||||
}
|
||||
|
||||
const launchLog = (f) =>
|
||||
existsSync(launchLogFile(f.dataRoot, "acme"))
|
||||
? readFileSync(launchLogFile(f.dataRoot, "acme"), "utf8").trim().split("\n").map((l) => JSON.parse(l))
|
||||
: [];
|
||||
const events = (f, event) => launchLog(f).filter((e) => e.event === event);
|
||||
const sessionWs = (f, session) => join(f.dataRoot, "session-workspaces", "acme", "assistant", session);
|
||||
// The refusals once there are n, or once anything launched.
|
||||
const outcome = async (f, n = 1) => {
|
||||
await settle(() => events(f, "refused").length >= n || events(f, "launch").length);
|
||||
return events(f, "refused").map((e) => [e.session, e.code]);
|
||||
};
|
||||
const historyOf = (p) => (existsSync(p) ? readFileSync(p, "utf8") : null);
|
||||
|
||||
// Send to one session of a thread; reply() waits for the assistant's RESULT reply in that session.
|
||||
function send(call, thread, session, body) {
|
||||
const sent = call("thread.send", { thread, ...(session ? { session } : {}), body });
|
||||
const reply = async () => {
|
||||
const r = await until(() => call("thread.messages", { thread, ...(session ? { session } : {}) }).find((m) => m.in_reply_to === sent.id && m.class === "RESULT"));
|
||||
assert.equal(r.from_role, "assistant");
|
||||
return JSON.parse(r.body.match(/THREAD (\{.*\})/)[1]);
|
||||
};
|
||||
return { sent, reply };
|
||||
}
|
||||
|
||||
// A thread made with thread.create, its default session and a second named one.
|
||||
function twoSessions(call) {
|
||||
const project = call("project.create", { name: "stack work", repo: "stack" }).id;
|
||||
const A = call("thread.create", { project, name: "alpha" }).id;
|
||||
const [{ id: D }] = call("session.list", { thread: A });
|
||||
const S = call("session.create", { thread: A, name: "second", op: "op-second" }).id;
|
||||
return { project, A, D, S };
|
||||
}
|
||||
|
||||
test("REQ-THREAD-2 REQ-LAUNCH-1 two sessions of one thread, and another thread's default, run at once, each with its own store and workspace; a restart of one resumes only that one", { skip, timeout: 90000 }, async (t) => {
|
||||
const prepared = prepare(t, { idle: 5 });
|
||||
const { f } = prepared;
|
||||
const host = await start(t, prepared);
|
||||
const { project, A, D, S } = twoSessions(host.call);
|
||||
const B = host.call("thread.create", { project, name: "beta" }).id;
|
||||
const [{ id: BD }] = host.call("session.list", { thread: B });
|
||||
|
||||
const toD = send(host.call, A, D, "first for D");
|
||||
const toS = send(host.call, A, S, "first for S");
|
||||
const toB = send(host.call, B, null, "first for B");
|
||||
// All three run together (M1, M2: a shared workspace would refuse the second start busy).
|
||||
await settle(() => readSessions(f.dataRoot).length === 3 || events(f, "refused").length);
|
||||
assert.deepEqual(events(f, "refused"), []);
|
||||
assert.deepEqual(readSessions(f.dataRoot).map((s) => [s.thread, s.session]).sort(), [[A, D], [A, S], [B, BD]].sort());
|
||||
const [sawD, sawS, sawB] = await Promise.all([toD.reply(), toS.reply(), toB.reply()]);
|
||||
// Each session's history is its own (M5), and each runs in its own workspace at its own path (M8).
|
||||
assert.deepEqual([sawD.body, sawD.before, sawD.cwd], ["first for D", [], sessionWs(f, D)]);
|
||||
assert.deepEqual([sawS.body, sawS.before, sawS.cwd], ["first for S", [], sessionWs(f, S)]);
|
||||
assert.deepEqual([sawB.body, sawB.before, sawB.cwd], ["first for B", [], sessionWs(f, BD)]);
|
||||
const store = (thread, session) => join(f.dataRoot, "threads", "acme", thread, "sessions", session, "session", "history");
|
||||
assert.deepEqual([historyOf(store(A, D)), historyOf(store(A, S)), historyOf(store(B, BD))], ["first for D\n", "first for S\n", "first for B\n"]);
|
||||
for (const thread of [A, B]) assert.equal(existsSync(join(f.dataRoot, "threads", "acme", thread, "session")), false);
|
||||
assert.equal(existsSync(join(f.dataRoot, "workspaces", "acme", "assistant")), false, "no thread session uses the old instance workspace");
|
||||
for (const e of events(f, "launch")) assert.ok([D, S, BD].includes(e.session), JSON.stringify(e));
|
||||
|
||||
// All three stop when idle, and each lock goes with its run.
|
||||
await until(() => events(f, "end").length === 3, 30000);
|
||||
assert.deepEqual(readSessions(f.dataRoot), []);
|
||||
for (const s of [D, S, BD]) assert.equal(existsSync(`${sessionWs(f, s)}.lock`), false, s);
|
||||
|
||||
// The named session's next message starts only that session (M9), which finds only its history.
|
||||
const again = await send(host.call, A, S, "second for S").reply();
|
||||
assert.deepEqual([again.before, again.cwd], [["first for S"], sessionWs(f, S)]);
|
||||
assert.deepEqual(events(f, "launch").slice(3).map((e) => [e.thread, e.session]), [[A, S]]);
|
||||
assert.equal(historyOf(store(A, D)), "first for D\n");
|
||||
});
|
||||
|
||||
// D9 (M7): a thread from before 3l. Its legacy session resumes from the thread's old store, and
|
||||
// its new workspace shows at the old instance path, which the transcripts recorded as the cwd.
|
||||
// The old host workspace isn't mounted.
|
||||
test("REQ-THREAD-2 REQ-LAUNCH-1 a legacy session resumes the thread's old store at the old in-sandbox cwd, in a workspace of its own", { skip, timeout: 60000 }, async (t) => {
|
||||
const prepared = prepare(t);
|
||||
const { f } = prepared;
|
||||
const store = new Store(f.dataRoot);
|
||||
const at = () => new Date().toISOString();
|
||||
store.run("INSERT INTO projects(id,at,business,name,repo,created_by) VALUES(?,?,?,?,?,?)", "p-hand", at(), "acme", "hand made", "stack", "jason");
|
||||
store.run("INSERT INTO threads(id,at,business,project,instance,owner,name) VALUES(?,?,?,?,?,?,?)", "th-legacy", at(), "acme", "p-hand", "assistant", "jason", "old");
|
||||
for (const sql of DEFAULT_SESSION) store.run(sql, "th-legacy");
|
||||
store.close();
|
||||
const old = privateDir(f.dataRoot, "threads", "acme", "th-legacy");
|
||||
writeFileSync(join(privateDir(old, "session"), "history"), "old sentinel\n");
|
||||
privateDir(old, "claude-projects");
|
||||
writeFileSync(join(privateDir(f.dataRoot, "workspaces", "acme", "assistant"), "old-file"), "the 264a workspace\n");
|
||||
|
||||
const host = await start(t, prepared);
|
||||
const saw = await send(host.call, "th-legacy", null, "after 3l").reply();
|
||||
assert.deepEqual(saw.before, ["old sentinel"]);
|
||||
assert.equal(saw.cwd, join(f.dataRoot, "workspaces", "acme", "assistant"));
|
||||
assert.equal(saw.entries.includes("old-file"), false, "the old host workspace isn't mounted");
|
||||
assert.equal(readFileSync(join(old, "session", "history"), "utf8"), "old sentinel\nafter 3l\n");
|
||||
assert.equal(existsSync(join(old, "sessions")), false);
|
||||
assert.ok(existsSync(sessionWs(f, "th-legacy")));
|
||||
assert.deepEqual(readdirSync(join(f.dataRoot, "workspaces", "acme", "assistant")), ["old-file"]);
|
||||
assert.deepEqual(events(f, "launch").map((e) => [e.thread, e.session]), [["th-legacy", "th-legacy"]]);
|
||||
});
|
||||
|
||||
// T2, M3: another host's live lock on the session's workspace refuses the start before any
|
||||
// checkout. Once that host is gone the lock is stale, and the next start takes it over.
|
||||
test("REQ-THREAD-2 REQ-LAUNCH-1 a live lock on a session workspace refuses session-workspace-busy before any checkout; a stale one is taken over", { skip, timeout: 60000 }, async (t) => {
|
||||
const prepared = prepare(t);
|
||||
const { f } = prepared;
|
||||
const host = await start(t, prepared);
|
||||
const { A, S } = twoSessions(host.call);
|
||||
const other = spawn("sleep", ["60"], { stdio: "ignore" });
|
||||
const gone = new Promise((r) => other.once("exit", r));
|
||||
t.after(() => other.kill("SIGKILL"));
|
||||
const otherStart = await until(() => startTimeOf(other.pid));
|
||||
privateDir(f.dataRoot, "session-workspaces", "acme", "assistant");
|
||||
const lock = `${sessionWs(f, S)}.lock`;
|
||||
const held = `${JSON.stringify({ hostPid: other.pid, hostStartTime: otherStart, business: "acme", instance: "assistant", thread: A, session: S })}\n`;
|
||||
writeFileSync(lock, held, { mode: 0o600 });
|
||||
|
||||
const toS = send(host.call, A, S, "for S");
|
||||
assert.deepEqual(await outcome(f), [[S, "session-workspace-busy"]]);
|
||||
assert.equal(events(f, "refused")[0].thread, A);
|
||||
assert.deepEqual(events(f, "launch"), []);
|
||||
assert.deepEqual(readSessions(f.dataRoot), []);
|
||||
assert.deepEqual(readdirSync(sessionWs(f, S)), [], "no checkout");
|
||||
assert.equal(readFileSync(lock, "utf8"), held);
|
||||
|
||||
other.kill("SIGKILL");
|
||||
await gone;
|
||||
const saw = await toS.reply();
|
||||
assert.deepEqual([saw.before, saw.cwd], [[], sessionWs(f, S)]);
|
||||
await until(() => events(f, "end").length === 1);
|
||||
assert.equal(existsSync(lock), false);
|
||||
});
|
||||
|
||||
// Q2 (BUILD.md:177-179, t1-sessions.md:109): an earlier host's sessionless run of the instance is
|
||||
// still live, so no session of it starts until that run has exited. A sleep child stands in for
|
||||
// its runner; its outer pid is gone, so recover() has nothing to kill and keeps it as a survivor.
|
||||
test("REQ-THREAD-2 REQ-LAUNCH-1 a session start refuses legacy-run-live while an earlier host's sessionless run lives, and starts once it has exited", { skip, timeout: 60000 }, async (t) => {
|
||||
const prepared = prepare(t);
|
||||
const { f } = prepared;
|
||||
const runner = spawn("sleep", ["60"], { stdio: "ignore" });
|
||||
const gone = new Promise((r) => runner.once("exit", r));
|
||||
t.after(() => runner.kill("SIGKILL"));
|
||||
const runnerStartTime = await until(() => startTimeOf(runner.pid));
|
||||
new Registry(f.dataRoot).add({ business: "acme", instance: "assistant", thread: "th-old", run: "run-left", harness: "pi", pid: 2 ** 22 + 7, startTime: "gone", runnerPid: runner.pid, runnerStartTime });
|
||||
const host = await start(t, prepared);
|
||||
assert.ok(host.logs.includes(`run run-left (assistant) from an earlier host still runs (pid ${2 ** 22 + 7}, runner ${runner.pid}): no session of assistant starts until it exits`), host.logs.join("\n"));
|
||||
const { A, S } = twoSessions(host.call);
|
||||
|
||||
const toS = send(host.call, A, S, "for S");
|
||||
assert.deepEqual(await outcome(f), [[S, "legacy-run-live"]]);
|
||||
assert.equal(events(f, "refused")[0].thread, A);
|
||||
assert.deepEqual(events(f, "launch"), [], "nothing spawned");
|
||||
assert.deepEqual(readSessions(f.dataRoot), []);
|
||||
assert.equal(existsSync(sessionWs(f, S)), false, "refused before the workspace");
|
||||
|
||||
runner.kill("SIGKILL");
|
||||
await gone;
|
||||
assert.equal(await settle(() => events(f, "launch").length), 1, "it starts once the run has exited");
|
||||
const saw = await toS.reply();
|
||||
assert.deepEqual([saw.before, saw.cwd], [[], sessionWs(f, S)]);
|
||||
await until(() => events(f, "end").length === 1);
|
||||
});
|
||||
|
||||
// T2, C3: a symlinked session root refuses session-workspace-unsafe, at the segment check.
|
||||
test("REQ-THREAD-2 REQ-LAUNCH-1 a symlinked session workspace root refuses session-workspace-unsafe and launches nothing", { skip, timeout: 60000 }, async (t) => {
|
||||
const prepared = prepare(t);
|
||||
const { f } = prepared;
|
||||
const elsewhere = privateDir(prepared.root, "elsewhere");
|
||||
symlinkSync(elsewhere, join(f.dataRoot, "session-workspaces"));
|
||||
const host = await start(t, prepared);
|
||||
const { A, D } = twoSessions(host.call);
|
||||
send(host.call, A, D, "for D");
|
||||
assert.deepEqual(await outcome(f), [[D, "session-workspace-unsafe"]]);
|
||||
assert.deepEqual(events(f, "launch"), []);
|
||||
assert.deepEqual(readdirSync(elsewhere), []);
|
||||
});
|
||||
|
||||
// T2, M4: every segment of the session path is a real directory, but workspaces/<b> is a symlink
|
||||
// to it, so only the realpath compare finds that the session workspace holds the legacy root.
|
||||
test("REQ-THREAD-2 REQ-LAUNCH-1 a session workspace that holds the legacy workspace root refuses session-workspace-overlap and launches nothing", { skip, timeout: 60000 }, async (t) => {
|
||||
const prepared = prepare(t);
|
||||
const { f } = prepared;
|
||||
const host = await start(t, prepared);
|
||||
const { A, D } = twoSessions(host.call);
|
||||
const ws = privateDir(f.dataRoot, "session-workspaces", "acme", "assistant", D);
|
||||
symlinkSync(ws, join(privateDir(f.dataRoot, "workspaces"), "acme"));
|
||||
send(host.call, A, D, "for D");
|
||||
assert.deepEqual(await outcome(f), [[D, "session-workspace-overlap"]]);
|
||||
assert.deepEqual(events(f, "launch"), []);
|
||||
assert.deepEqual(readdirSync(ws), []);
|
||||
});
|
||||
|
||||
// T2: a symlink among the store's segments refuses thread-store-refused before the workspace.
|
||||
test("REQ-THREAD-2 REQ-LAUNCH-1 a symlinked session store refuses thread-store-refused and makes no workspace", { skip, timeout: 60000 }, async (t) => {
|
||||
const prepared = prepare(t);
|
||||
const { f } = prepared;
|
||||
const host = await start(t, prepared);
|
||||
const { A, D } = twoSessions(host.call);
|
||||
const elsewhere = privateDir(prepared.root, "elsewhere");
|
||||
symlinkSync(elsewhere, join(privateDir(f.dataRoot, "threads", "acme", A), "sessions"));
|
||||
send(host.call, A, D, "for D");
|
||||
assert.deepEqual(await outcome(f), [[D, "thread-store-refused"]]);
|
||||
assert.match(events(f, "refused")[0].why, /is unsafe$/);
|
||||
assert.deepEqual(events(f, "launch"), []);
|
||||
assert.deepEqual(readdirSync(elsewhere), []);
|
||||
assert.equal(existsSync(join(f.dataRoot, "session-workspaces")), false);
|
||||
});
|
||||
|
||||
// T2, M6 and the halt fence (C2). The credentialStatus op runs in start() after check() returned.
|
||||
// Its first call halts and resumes, a new generation with no halt, so only start()'s own
|
||||
// admission(admissionGeneration) refuses, before the session workspace is made. On the retry,
|
||||
// the recheck's mayLaunch op (inside check(), after the lock is taken) halts once it has answered,
|
||||
// and the recheck's admission() refuses processing-halted. Neither attempt spawns, and the second releases its lock.
|
||||
test("REQ-THREAD-2 REQ-LAUNCH-1 a named session's start refuses processing-generation-changed, then processing-halted, after check() and before any spawn", { skip, timeout: 60000 }, async (t) => {
|
||||
const prepared = prepare(t);
|
||||
const { f } = prepared;
|
||||
let credentials = 0;
|
||||
let halts = 0;
|
||||
const halt = () => transition(f.dataRoot, { business: "acme", human: f.doc.human, halted: true });
|
||||
const host = await start(t, prepared, {
|
||||
ops: (runtime) => ({
|
||||
credentialStatus: (m) => {
|
||||
if (m.role === "assistant" && ++credentials === 1) {
|
||||
transition(f.dataRoot, { business: "acme", human: f.doc.human, halted: false, generation: halt().generation });
|
||||
halts++;
|
||||
}
|
||||
return runtime.credentialStatus(m.business, m.role);
|
||||
},
|
||||
// The halt lands after the op answers: halted inside it, the bus's own fence
|
||||
// (runtime.mjs processingWork) throws and the launcher refuses limit-check-failed.
|
||||
mayLaunch: async (m) => {
|
||||
const may = await runtime.mayLaunch(m);
|
||||
if (m.instance === "assistant" && credentials === 2 && halts === 1) {
|
||||
halt();
|
||||
halts++;
|
||||
}
|
||||
return may;
|
||||
},
|
||||
}),
|
||||
});
|
||||
const { A, S } = twoSessions(host.call);
|
||||
send(host.call, A, S, "for S");
|
||||
const refused = await outcome(f, 2);
|
||||
assert.deepEqual(refused, [[S, "processing-generation-changed"], [S, "processing-halted"]]);
|
||||
assert.deepEqual([credentials, halts], [2, 2], "check() passed both times");
|
||||
assert.equal(events(f, "launch").length, 0);
|
||||
assert.deepEqual(readSessions(f.dataRoot), []);
|
||||
assert.equal(existsSync(join(f.dataRoot, "launches", "acme")), false, "no run directory");
|
||||
assert.ok(existsSync(sessionWs(f, S)), "the retry made the workspace");
|
||||
assert.equal(existsSync(`${sessionWs(f, S)}.lock`), false, "and released its lock");
|
||||
});
|
||||
@@ -179,11 +179,10 @@ test("REQ-THREAD-2 REQ-LAUNCH-1 REQ-MSG-1 a thread message starts the thread's s
|
||||
assert.deepEqual(first.saw, { body: "first for A", before: [], transcripts: [] });
|
||||
const [run1] = launchLog(f).filter((e) => e.event === "launch" && e.thread === A).map((e) => e.run);
|
||||
assert.ok(run1);
|
||||
const store = join(f.dataRoot, "threads", "acme", A, "sessions", host.runtime.threadsState("acme").find((x) => x.thread === A).session);
|
||||
const store = join(f.dataRoot, "threads", "acme", A);
|
||||
assert.equal(readFileSync(join(store, "session", "history"), "utf8"), "first for A\n");
|
||||
assert.deepEqual(readdirSync(join(store, "claude-projects")), ["turn-1.jsonl"]);
|
||||
assert.equal(existsSync(join(f.dataRoot, "launches", "acme", run1, "session")), false, "a thread run keeps no per-run session directory");
|
||||
assert.equal(existsSync(join(f.dataRoot, "threads", "acme", A, "session")), false, "a thread.create session keeps no thread-level store");
|
||||
await idleStop(f, host, A, run1);
|
||||
|
||||
// A second run of the same thread finds the first run's history.
|
||||
|
||||
@@ -97,12 +97,9 @@ function systemBinds(node = process.execPath) {
|
||||
// the harness module's mounts (row 65: its mounts(), [{ src, dest, why }],
|
||||
// read-only), the broker socket, the launch socket (null for a role that may
|
||||
// not launch), the git socket (null for a role that neither pushes nor
|
||||
// reviews), the thread's session store (session.mjs threadStore() or
|
||||
// sessionStore(), or null) and node. workspaceDest (row 269) is where the
|
||||
// workspace shows inside the sandbox when that isn't its host path: a legacy
|
||||
// thread session's, so its harness finds the cwd its history recorded.
|
||||
// `readOnly` adds files, for tests only.
|
||||
export function binds({ runDir, workspace, workspaceDest = null, adapter, harnessMounts = [], brokerSocket, launchSocket = null, gitSocket = null, threadStore = null, node = process.execPath, readOnly = [] }) {
|
||||
// reviews), the thread's session store (session.mjs threadStore(), or null)
|
||||
// and node. `readOnly` adds files, for tests only.
|
||||
export function binds({ runDir, workspace, adapter, harnessMounts = [], brokerSocket, launchSocket = null, gitSocket = null, threadStore = null, node = process.execPath, readOnly = [] }) {
|
||||
const out = systemBinds(node);
|
||||
for (const f of RUNNER_FILES) out.push({ kind: "ro", src: f, why: "a repository file the runner loads" });
|
||||
out.push({ kind: "ro", src: adapter, why: "the harness adapter the runner starts each turn" });
|
||||
@@ -112,7 +109,7 @@ export function binds({ runDir, workspace, workspaceDest = null, adapter, harnes
|
||||
if (gitSocket) out.push({ kind: "ro", src: gitSocket, why: "the host's git socket, for push_working and fetch_review, and land_work" });
|
||||
for (const f of readOnly) out.push({ kind: "ro", src: f, why: "a test fixture" });
|
||||
out.push(
|
||||
{ kind: "rw", src: workspace, ...(workspaceDest && workspaceDest !== workspace ? { dest: workspaceDest } : {}), why: "the instance's workspace, where the harness works" },
|
||||
{ kind: "rw", src: workspace, why: "the instance's workspace, where the harness works" },
|
||||
{ kind: "rw", src: runDir, why: "the run directory: turns/, session/, tools.sock, turn.done, home/, tmp/" },
|
||||
{ kind: "ro", src: join(runDir, "bundle"), why: "the run's bundle stays as the host wrote it" },
|
||||
{ kind: "ro", src: join(runDir, "session.json"), why: "the session file stays as the host wrote it" },
|
||||
|
||||
+17
-176
@@ -20,22 +20,17 @@
|
||||
// every launch, refusal and end
|
||||
// workspaces/<business>/<instance>/ the instance's workspace (0700), kept
|
||||
// across launches
|
||||
// threads/<business>/<thread>/ a legacy thread session's store (0700),
|
||||
// kept across its runs (row 121):
|
||||
// threads/<business>/<thread>/ a thread's session store (0700), kept
|
||||
// across the thread's runs (row 121):
|
||||
// session/ and claude-projects/
|
||||
// threads/<business>/<thread>/sessions/<session>/
|
||||
// any other session's store (row 269)
|
||||
// session-workspaces/<business>/<instance>/<session>/
|
||||
// a thread session's workspace (0700),
|
||||
// with <session>.lock beside it
|
||||
// bus-host/sessions.json the running sessions (0600), written
|
||||
// only by the host; `mosaic stop` reads it
|
||||
|
||||
import { spawn } from "node:child_process";
|
||||
import { randomBytes } from "node:crypto";
|
||||
import { appendFileSync, closeSync, existsSync, linkSync, lstatSync, mkdirSync, openSync, readdirSync, readFileSync, realpathSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
|
||||
import { appendFileSync, closeSync, existsSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, writeFileSync } from "node:fs";
|
||||
import { constants } from "node:os";
|
||||
import { dirname, join, sep } from "node:path";
|
||||
import { dirname, join } from "node:path";
|
||||
import { childrenOf, cmdlineOf, startTimeOf } from "./proc.mjs";
|
||||
import { binds, prepareRun, REPO, sandboxArgv } from "./sandbox.mjs";
|
||||
import { SeatError } from "./seat.mjs";
|
||||
@@ -43,10 +38,7 @@ import { ID_PATTERN } from "../../business/src/vocabulary.mjs";
|
||||
|
||||
export { REPO };
|
||||
export const RUNNER = join(REPO, "packages", "harness", "src", "runner.mjs");
|
||||
// Row 269 (264b): 2 adds `session` and `workspace` to a thread run's entry.
|
||||
// readSessions still reads a version 1 file an earlier host left.
|
||||
export const SESSIONS_VERSION = 2;
|
||||
const SESSIONS_READ = [1, 2];
|
||||
export const SESSIONS_VERSION = 1;
|
||||
|
||||
export const sessionsFile = (dataRoot) => join(dataRoot, "bus-host", "sessions.json");
|
||||
export const launchSocketPath = (dataRoot) => join(dataRoot, "bus-host", "launch.sock");
|
||||
@@ -55,7 +47,6 @@ export const gitSocketPath = (dataRoot) => join(dataRoot, "bus-host", "git.sock"
|
||||
export const runsDir = (dataRoot, business) => join(dataRoot, "launches", business);
|
||||
export const launchLogFile = (dataRoot, business) => join(dataRoot, "launches", `${business}.jsonl`);
|
||||
export const workspaceDir = (dataRoot, business, instance) => join(dataRoot, "workspaces", business, instance);
|
||||
export const sessionWorkspaceDir = (dataRoot, business, instance, session) => join(dataRoot, "session-workspaces", business, instance, session);
|
||||
|
||||
// Row 121 (#1615): a thread's session store, which outlives each of the
|
||||
// thread's runs so the next run resumes the harness session (REQ-THREAD-2).
|
||||
@@ -65,174 +56,24 @@ export const sessionWorkspaceDir = (dataRoot, business, instance, session) => jo
|
||||
// is the run's sessionDir; claude-projects/ is bound at the run's
|
||||
// home/.claude/projects (sandbox.mjs binds()). Throws SeatError.
|
||||
const segment = (x) => typeof x === "string" && ID_PATTERN.test(x) && !x.includes("..");
|
||||
const seatError = (message, code) => Object.assign(new SeatError(message, 2), { code });
|
||||
function segments(what, pairs, code) {
|
||||
for (const [name, x] of pairs) {
|
||||
if (!segment(x)) throw seatError(`${what}: ${name} ${JSON.stringify(x)} isn't an id`, code);
|
||||
export function threadStore(dataRoot, business, thread) {
|
||||
for (const [what, x] of [["business", business], ["thread", thread]]) {
|
||||
if (!segment(x)) throw new SeatError(`thread store: ${what} ${JSON.stringify(x)} isn't an id`, 2);
|
||||
}
|
||||
}
|
||||
// Makes each directory in order, then checks it is ours, a real directory and private.
|
||||
function privateDirs(what, dirs, code) {
|
||||
for (const d of dirs) {
|
||||
const dir = join(dataRoot, "threads", business, thread);
|
||||
const out = { dir, session: join(dir, "session"), projects: join(dir, "claude-projects") };
|
||||
for (const d of [join(dataRoot, "threads"), join(dataRoot, "threads", business), dir, out.session, out.projects]) {
|
||||
try {
|
||||
mkdirSync(d, { mode: 0o700 });
|
||||
} catch (e) {
|
||||
if (e.code !== "EEXIST") throw e;
|
||||
}
|
||||
const st = lstatSync(d);
|
||||
if (st.isSymbolicLink() || !st.isDirectory() || st.uid !== process.getuid() || st.mode & 0o077) throw seatError(`${what}: ${d} is unsafe`, code);
|
||||
if (st.isSymbolicLink() || !st.isDirectory() || st.uid !== process.getuid() || st.mode & 0o077) throw new SeatError(`thread store: ${d} is unsafe`, 2);
|
||||
}
|
||||
}
|
||||
export function threadStore(dataRoot, business, thread) {
|
||||
segments("thread store", [["business", business], ["thread", thread]], "thread-store-refused");
|
||||
const dir = join(dataRoot, "threads", business, thread);
|
||||
const out = { dir, session: join(dir, "session"), projects: join(dir, "claude-projects") };
|
||||
privateDirs("thread store", [join(dataRoot, "threads"), join(dataRoot, "threads", business), dir, out.session, out.projects], "thread-store-refused");
|
||||
return out;
|
||||
}
|
||||
|
||||
// Row 269 (264b, #1774): one session's store. A legacy session (op legacy-3l,
|
||||
// whose id is its thread's) keeps the thread's store, so its harness resumes
|
||||
// the history it has; any other session gets its own under sessions/, with
|
||||
// the same checks on every segment and directory. Same shape as threadStore.
|
||||
// legacyThread: the thread has a legacy session. When it has none, a
|
||||
// threads/<b>/<t>/session left by a 264a run of the thread's default session
|
||||
// refuses legacy-store-unmapped, so that history isn't silently left behind.
|
||||
export function sessionStore(dataRoot, business, thread, session, { legacy = false, legacyThread = legacy } = {}) {
|
||||
if (legacy) return threadStore(dataRoot, business, thread);
|
||||
segments("thread store", [["business", business], ["thread", thread], ["session", session]], "thread-store-refused");
|
||||
const threadDir = join(dataRoot, "threads", business, thread);
|
||||
if (!legacyThread) {
|
||||
let old = true;
|
||||
try {
|
||||
lstatSync(join(threadDir, "session"));
|
||||
} catch (e) {
|
||||
if (e.code !== "ENOENT") throw e;
|
||||
old = false;
|
||||
}
|
||||
if (old) throw seatError(`thread store: ${join(threadDir, "session")} holds history no legacy session maps`, "legacy-store-unmapped");
|
||||
}
|
||||
const dir = join(threadDir, "sessions", session);
|
||||
const out = { dir, session: join(dir, "session"), projects: join(dir, "claude-projects") };
|
||||
privateDirs("thread store", [join(dataRoot, "threads"), join(dataRoot, "threads", business), threadDir, join(threadDir, "sessions"), dir, out.session, out.projects], "thread-store-refused");
|
||||
return out;
|
||||
}
|
||||
|
||||
const inside = (a, b) => a === b || a.startsWith(b + sep);
|
||||
const realOrNull = (p) => {
|
||||
try {
|
||||
return realpathSync(p);
|
||||
} catch (e) {
|
||||
if (e.code === "ENOENT") return null;
|
||||
throw e;
|
||||
}
|
||||
};
|
||||
// Row 269: a thread session's workspace, session-workspaces/<b>/<i>/<s>. Each
|
||||
// segment is an id and each directory ours, real and private
|
||||
// (session-workspace-unsafe). Then the realpaths: it may not be inside, or
|
||||
// contain, the legacy workspaces root, its business and instance directories
|
||||
// or any entry of either (old instance, .retired and task workspaces), nor
|
||||
// sit above or below a `live` workspace (session-workspace-overlap). The same
|
||||
// path as a live one is left to the lock, which refuses session-workspace-busy.
|
||||
export function sessionWorkspace(dataRoot, business, instance, session, { live = [] } = {}) {
|
||||
segments("session workspace", [["business", business], ["instance", instance], ["session", session]], "session-workspace-unsafe");
|
||||
const root = join(dataRoot, "session-workspaces");
|
||||
const path = join(root, business, instance, session);
|
||||
privateDirs("session workspace", [root, join(root, business), join(root, business, instance), path], "session-workspace-unsafe");
|
||||
const real = realpathSync(path);
|
||||
const legacy = join(dataRoot, "workspaces");
|
||||
const named = [legacy, join(legacy, business), join(legacy, business, instance)];
|
||||
const entries = (d) => {
|
||||
try {
|
||||
return readdirSync(d).map((x) => join(d, x));
|
||||
} catch (e) {
|
||||
if (e.code === "ENOENT" || e.code === "ENOTDIR") return [];
|
||||
throw e;
|
||||
}
|
||||
};
|
||||
for (const p of [...named, ...entries(legacy), ...entries(join(legacy, business))]) {
|
||||
const other = realOrNull(p);
|
||||
if (other && (inside(real, other) || inside(other, real))) throw seatError(`session workspace: ${path} overlaps the legacy workspace ${p}`, "session-workspace-overlap");
|
||||
}
|
||||
for (const p of live) {
|
||||
const other = realOrNull(p);
|
||||
if (other && other !== real && (inside(real, other) || inside(other, real))) throw seatError(`session workspace: ${path} overlaps the live workspace ${p}`, "session-workspace-overlap");
|
||||
}
|
||||
return path;
|
||||
}
|
||||
|
||||
// Row 269: the single-writer lock on a session workspace, <workspace>.lock,
|
||||
// beside it and outside every mount. It names the host (pid, start time) and,
|
||||
// once spawned, the run's outer process. A lock whose host and run are both
|
||||
// gone is stale and is taken over; any other refuses session-workspace-busy.
|
||||
// Returns { file, update(fields), release() }.
|
||||
const lockAlive = (pid, start) => Number.isSafeInteger(pid) && pid > 0 && start != null && startTimeOf(pid) === start;
|
||||
export function lockSessionWorkspace(workspace, owner) {
|
||||
const file = `${workspace}.lock`;
|
||||
let held = { ...owner };
|
||||
const write = (flag) => writeFileSync(file, `${JSON.stringify(held)}\n`, { mode: 0o600, flag });
|
||||
const busy = (why) => seatError(`session workspace ${workspace} is busy: ${why}`, "session-workspace-busy");
|
||||
for (let attempt = 0; attempt < 2; attempt++) {
|
||||
try {
|
||||
write("wx");
|
||||
// One release per lock: a second unlink could take a lock another host has written since.
|
||||
let released = false;
|
||||
return {
|
||||
file,
|
||||
update(fields) {
|
||||
if (released) return;
|
||||
held = { ...held, ...fields };
|
||||
write("w");
|
||||
},
|
||||
release() {
|
||||
if (released) return;
|
||||
released = true;
|
||||
try {
|
||||
unlinkSync(file);
|
||||
} catch (e) {
|
||||
if (e.code !== "ENOENT") throw e;
|
||||
}
|
||||
},
|
||||
};
|
||||
} catch (e) {
|
||||
if (e.code !== "EEXIST") throw e;
|
||||
}
|
||||
let raw;
|
||||
try {
|
||||
raw = readFileSync(file, "utf8");
|
||||
} catch (e) {
|
||||
if (e.code === "ENOENT") continue;
|
||||
throw e;
|
||||
}
|
||||
let other = null;
|
||||
try {
|
||||
other = JSON.parse(raw);
|
||||
} catch {}
|
||||
// An unreadable lock may be one being written, so it counts as held.
|
||||
if (!other || typeof other !== "object") throw busy(`${file} is unreadable`);
|
||||
if (lockAlive(other.hostPid, other.hostStartTime)) throw busy(`host pid ${other.hostPid} holds it`);
|
||||
if (lockAlive(other.runPid, other.runStartTime)) throw busy(`run pid ${other.runPid} holds it`);
|
||||
// Stale. Move it aside; if what moved isn't what was judged stale, another
|
||||
// host took it over in between, so it goes back and this start refuses.
|
||||
const aside = `${file}.stale-${process.pid}-${randomBytes(4).toString("hex")}`;
|
||||
try {
|
||||
renameSync(file, aside);
|
||||
} catch (e) {
|
||||
if (e.code === "ENOENT") continue;
|
||||
throw e;
|
||||
}
|
||||
if (readFileSync(aside, "utf8") !== raw) {
|
||||
try {
|
||||
linkSync(aside, file);
|
||||
} catch {}
|
||||
unlinkSync(aside);
|
||||
throw busy(`another host took ${file} over`);
|
||||
}
|
||||
unlinkSync(aside);
|
||||
}
|
||||
throw busy(`${file} could not be taken`);
|
||||
}
|
||||
|
||||
// The session's environment is an allowlist: nothing else from the host's
|
||||
// environment passes, so a founder credential variable (GITEA_TOKEN,
|
||||
// GH_TOKEN, SSH_AUTH_SOCK, ...) never reaches a session (REQ-CRED-2).
|
||||
@@ -371,10 +212,10 @@ export class Registry {
|
||||
count(business, provider, model = undefined) {
|
||||
return this.#sessions.filter((s) => s.business === business && s.provider === provider && (model === undefined || s.model === model)).length;
|
||||
}
|
||||
// A thread instance runs once per thread session (row 121, row 269), so
|
||||
// `thread` and `session` are part of the key; null is an entry without one.
|
||||
running(business, instance, thread = null, session = null) {
|
||||
return this.#sessions.find((s) => s.business === business && s.instance === instance && (s.thread ?? null) === thread && (s.session ?? null) === session) ?? null;
|
||||
// A thread instance runs once per thread (row 121), so `thread` is part of
|
||||
// the key; null is a session that holds no thread.
|
||||
running(business, instance, thread = null) {
|
||||
return this.#sessions.find((s) => s.business === business && s.instance === instance && (s.thread ?? null) === thread) ?? null;
|
||||
}
|
||||
#write() {
|
||||
if (this.#readOnly) return;
|
||||
@@ -397,7 +238,7 @@ export function readSessions(dataRoot) {
|
||||
} catch {
|
||||
throw new SeatError(`sessions file is unreadable: ${file}`, 2);
|
||||
}
|
||||
if (!SESSIONS_READ.includes(doc?.sessionsVersion) || !Array.isArray(doc.sessions)) throw new SeatError(`sessions file is malformed: ${file}`, 2);
|
||||
if (doc?.sessionsVersion !== SESSIONS_VERSION || !Array.isArray(doc.sessions)) throw new SeatError(`sessions file is malformed: ${file}`, 2);
|
||||
return doc.sessions.map((s) => ({ ...s, live: startTimeOf(s.runnerPid) === s.runnerStartTime }));
|
||||
}
|
||||
|
||||
|
||||
@@ -1,126 +0,0 @@
|
||||
// Row 269 (264b, #1774): a thread session's store, its workspace and the
|
||||
// single-writer lock beside the workspace (session.mjs sessionStore(),
|
||||
// sessionWorkspace(), lockSessionWorkspace()), and sessions.json v2.
|
||||
|
||||
import { test } from "node:test";
|
||||
import assert from "node:assert/strict";
|
||||
import { spawn } from "node:child_process";
|
||||
import { existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, realpathSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs";
|
||||
import { tmpdir } from "node:os";
|
||||
import { dirname, join } from "node:path";
|
||||
import { startTimeOf } from "../src/proc.mjs";
|
||||
import { SeatError } from "../src/seat.mjs";
|
||||
import { lockSessionWorkspace, readSessions, Registry, sessionsFile, sessionStore, sessionWorkspace, threadStore } from "../src/session.mjs";
|
||||
|
||||
function scratch(t) {
|
||||
const dir = realpathSync(mkdtempSync(join(tmpdir(), "mosaic-session-ws-")));
|
||||
t.after(() => rmSync(dir, { recursive: true, force: true }));
|
||||
return dir;
|
||||
}
|
||||
const mode = (p) => statSync(p).mode & 0o777;
|
||||
const refuses = (code) => (e) => e instanceof SeatError && e.code === code;
|
||||
|
||||
test("REQ-THREAD-2 sessionStore: a legacy session keeps the thread's store, any other gets sessions/<s>/, each segment checked first", (t) => {
|
||||
const root = scratch(t);
|
||||
assert.deepEqual(sessionStore(root, "acme", "th-1", "th-1", { legacy: true }), threadStore(root, "acme", "th-1"));
|
||||
const s = sessionStore(root, "acme", "th-1", "s-2", { legacyThread: true });
|
||||
const dir = join(root, "threads", "acme", "th-1", "sessions", "s-2");
|
||||
assert.deepEqual(s, { dir, session: join(dir, "session"), projects: join(dir, "claude-projects") });
|
||||
for (const d of [dirname(dir), dir, s.session, s.projects]) assert.equal(mode(d), 0o700, d);
|
||||
for (const [thread, session] of [["..", "s"], ["th-1", ".."], ["th-1", "a/b"], ["th-1", null]])
|
||||
assert.throws(() => sessionStore(root, "acme", thread, session, { legacyThread: true }), refuses("thread-store-refused"), `${thread}/${session}`);
|
||||
assert.deepEqual(readdirSync(join(root, "threads", "acme", "th-1", "sessions")), ["s-2"], "a refused call makes nothing");
|
||||
});
|
||||
|
||||
test("REQ-THREAD-2 sessionStore refuses legacy-store-unmapped for a thread whose old store no legacy session maps", (t) => {
|
||||
const root = scratch(t);
|
||||
threadStore(root, "acme", "th-1");
|
||||
assert.throws(() => sessionStore(root, "acme", "th-1", "s-1"), (e) => refuses("legacy-store-unmapped")(e) && /holds history no legacy session maps$/.test(e.message));
|
||||
assert.equal(existsSync(join(root, "threads", "acme", "th-1", "sessions")), false);
|
||||
// A thread with a legacy session: its other sessions take D2's layout.
|
||||
assert.ok(sessionStore(root, "acme", "th-1", "s-1", { legacyThread: true }).dir.endsWith(join("sessions", "s-1")));
|
||||
const elsewhere = join(root, "elsewhere");
|
||||
mkdirSync(elsewhere, { mode: 0o700 });
|
||||
symlinkSync(elsewhere, join(root, "threads", "acme", "th-2"));
|
||||
assert.throws(() => sessionStore(root, "acme", "th-2", "s-1"), (e) => refuses("thread-store-refused")(e) && /is unsafe$/.test(e.message));
|
||||
assert.deepEqual(readdirSync(elsewhere), []);
|
||||
});
|
||||
|
||||
test("REQ-THREAD-2 sessionWorkspace: private directories per session, unsafe segments and overlaps refused", (t) => {
|
||||
const root = scratch(t);
|
||||
const ws = sessionWorkspace(root, "acme", "assistant", "s-1");
|
||||
assert.equal(ws, join(root, "session-workspaces", "acme", "assistant", "s-1"));
|
||||
for (const d of [join(root, "session-workspaces"), dirname(dirname(ws)), dirname(ws), ws]) assert.equal(mode(d), 0o700, d);
|
||||
assert.equal(sessionWorkspace(root, "acme", "assistant", "s-1"), ws, "a second call reuses it");
|
||||
assert.notEqual(sessionWorkspace(root, "acme", "assistant", "s-2"), ws);
|
||||
for (const session of ["..", "a/b", ""]) assert.throws(() => sessionWorkspace(root, "acme", "assistant", session), refuses("session-workspace-unsafe"), session);
|
||||
// A live workspace at the same path is the lock's to refuse; one above or below it overlaps.
|
||||
assert.equal(sessionWorkspace(root, "acme", "assistant", "s-1", { live: [ws] }), ws);
|
||||
assert.throws(() => sessionWorkspace(root, "acme", "assistant", "s-3", { live: [dirname(ws)] }), refuses("session-workspace-overlap"));
|
||||
// The legacy root symlinked into a session path: every segment is real, only the realpath finds it.
|
||||
mkdirSync(join(root, "workspaces"), { mode: 0o700 });
|
||||
symlinkSync(ws, join(root, "workspaces", "acme"));
|
||||
assert.throws(() => sessionWorkspace(root, "acme", "assistant", "s-1"), refuses("session-workspace-overlap"));
|
||||
// A symlinked root fails the segment check first.
|
||||
const other = scratch(t);
|
||||
const elsewhere = join(other, "elsewhere");
|
||||
mkdirSync(elsewhere, { mode: 0o700 });
|
||||
symlinkSync(elsewhere, join(other, "session-workspaces"));
|
||||
assert.throws(() => sessionWorkspace(other, "acme", "assistant", "s-1"), refuses("session-workspace-unsafe"));
|
||||
assert.deepEqual(readdirSync(elsewhere), []);
|
||||
});
|
||||
|
||||
test("REQ-THREAD-2 lockSessionWorkspace: one writer; a live host or run holds it, a stale lock is taken over, an unreadable one holds", async (t) => {
|
||||
const root = scratch(t);
|
||||
const ws = sessionWorkspace(root, "acme", "assistant", "s-1");
|
||||
const me = { hostPid: process.pid, hostStartTime: startTimeOf(process.pid) };
|
||||
const lock = lockSessionWorkspace(ws, me);
|
||||
assert.equal(lock.file, `${ws}.lock`);
|
||||
assert.equal(mode(lock.file), 0o600);
|
||||
assert.throws(() => lockSessionWorkspace(ws, me), refuses("session-workspace-busy"));
|
||||
lock.update({ run: "r-1", runPid: 1, runStartTime: "x" });
|
||||
assert.deepEqual(JSON.parse(readFileSync(lock.file, "utf8")), { ...me, run: "r-1", runPid: 1, runStartTime: "x" });
|
||||
lock.release();
|
||||
assert.equal(existsSync(lock.file), false);
|
||||
|
||||
// A run that outlives its host still holds it.
|
||||
const run = spawn("sleep", ["60"], { stdio: "ignore" });
|
||||
const gone = new Promise((r) => run.once("exit", r));
|
||||
t.after(() => run.kill("SIGKILL"));
|
||||
let runStart = null;
|
||||
for (let i = 0; i < 100 && !runStart; i++) {
|
||||
runStart = startTimeOf(run.pid);
|
||||
if (!runStart) await new Promise((r) => setTimeout(r, 20));
|
||||
}
|
||||
const held = `${JSON.stringify({ hostPid: 2 ** 22 + 7, hostStartTime: "gone", runPid: run.pid, runStartTime: runStart })}\n`;
|
||||
writeFileSync(`${ws}.lock`, held, { mode: 0o600 });
|
||||
assert.throws(() => lockSessionWorkspace(ws, me), refuses("session-workspace-busy"));
|
||||
assert.equal(readFileSync(`${ws}.lock`, "utf8"), held);
|
||||
run.kill("SIGKILL");
|
||||
await gone;
|
||||
// Now stale: taken over, and nothing is left beside it.
|
||||
const taken = lockSessionWorkspace(ws, me);
|
||||
assert.deepEqual(JSON.parse(readFileSync(taken.file, "utf8")), me);
|
||||
assert.deepEqual(readdirSync(dirname(ws)).sort(), ["s-1", "s-1.lock"]);
|
||||
// One release per lock: a second doesn't remove a lock written since.
|
||||
taken.release();
|
||||
writeFileSync(`${ws}.lock`, "{}\n", { mode: 0o600 });
|
||||
taken.release();
|
||||
assert.equal(readFileSync(`${ws}.lock`, "utf8"), "{}\n");
|
||||
// An unreadable lock may be one being written, so it holds.
|
||||
writeFileSync(`${ws}.lock`, "{", { mode: 0o600 });
|
||||
assert.throws(() => lockSessionWorkspace(ws, me), refuses("session-workspace-busy"));
|
||||
});
|
||||
|
||||
test("REQ-THREAD-2 sessions.json v2: entries carry session and workspace, running() keys on the session, a v1 file still reads", (t) => {
|
||||
const root = scratch(t);
|
||||
const registry = new Registry(root);
|
||||
const entry = { business: "acme", instance: "assistant", thread: "th-1", session: "s-1", workspace: "/w", run: "r-1" };
|
||||
registry.add(entry);
|
||||
assert.equal(JSON.parse(readFileSync(sessionsFile(root), "utf8")).sessionsVersion, 2);
|
||||
assert.deepEqual(registry.running("acme", "assistant", "th-1", "s-1"), entry);
|
||||
assert.equal(registry.running("acme", "assistant", "th-1", "s-2"), null);
|
||||
assert.equal(registry.running("acme", "assistant", "th-1"), null, "an entry with a session isn't the thread's sessionless run");
|
||||
writeFileSync(sessionsFile(root), `${JSON.stringify({ sessionsVersion: 1, sessions: [{ business: "acme", instance: "assistant", thread: "th-1", run: "r-0" }] })}\n`);
|
||||
assert.deepEqual(readSessions(root).map((s) => [s.run, s.session ?? null]), [["r-0", null]]);
|
||||
});
|
||||
@@ -1,6 +1,6 @@
|
||||
{
|
||||
"prd": "docs/prd/mosaic-stack.md",
|
||||
"version": "1.15",
|
||||
"version": "1.14",
|
||||
"requirements": [
|
||||
{ "id": "REQ-ROLE-1", "title": "Each role is a reviewed roles/<name>.json: contract, authority map, credentials" },
|
||||
{ "id": "REQ-ROLE-2", "title": "One holder per role instance, one per assistant session; the chief of staff may end a run, others need a decision" },
|
||||
@@ -77,12 +77,12 @@
|
||||
{ "id": "REQ-SESS-1", "title": "Each session shows its lifetime count of completed compactions on pi and Claude Code; an unproven count shows unknown" },
|
||||
{ "id": "REQ-SESS-2", "title": "Clear context retires a session after a safe stop and starts a fresh successor with none of the old context" },
|
||||
{ "id": "REQ-SESS-3", "title": "Every session start passes the launch checks: authority, route, revocation, kill switch, limits and admission" },
|
||||
{ "id": "REQ-LIB-1", "title": "A library maps the user's repository onto universes, books, types, playgrounds and supporting folders, set by a human" },
|
||||
{ "id": "REQ-LIB-2", "title": "Scope comes from the path, lookups default to canon, and a playground or supporting file is never cited as canon" },
|
||||
{ "id": "REQ-LIB-1", "title": "A library maps the user's writing repository onto universes, books, types and playgrounds; only the human changes it" },
|
||||
{ "id": "REQ-LIB-2", "title": "Scope comes from the path; lookups default to canon and a playground file is never cited as canon" },
|
||||
{ "id": "REQ-LIB-3", "title": "Universes stay separate; a crossover is a hybrid universe only a human creates, reading its sources' canon" },
|
||||
{ "id": "REQ-LIB-4", "title": "Git holds every change; the bus fast-forwards a read-only mirror every 60 seconds and agents read only that" },
|
||||
{ "id": "REQ-LIB-5", "title": "Agents check the library through typed lookup tools that name the commit and show links out and in" },
|
||||
{ "id": "REQ-LIB-6", "title": "Agents never write story, only docs in supporting folders a human marks. Chat is free text, and any citation is checked" },
|
||||
{ "id": "REQ-LIB-6", "title": "Creative agents can't write the repository; messages to the user are cited items the broker checks, or a fixed notice" },
|
||||
{ "id": "REQ-LIB-7", "title": "One chat room with several creative agents, addressed by leading @tags; an unknown tag sends nothing" },
|
||||
{ "id": "REQ-INST-1", "title": "The installer offers optional components: pinned, health-checked, removable, switched on in config; first is SearXNG" },
|
||||
{ "id": "REQ-INST-2", "title": "With no OIDC provider to configure, the installer deploys a bundled Pocket ID, Q203 (post-v1)" },
|
||||
|
||||
@@ -21,7 +21,7 @@ test("the list holds the PRD's requirement ids, in its order, at its version", (
|
||||
assert.equal(ids.length, 85);
|
||||
assert.deepEqual(list.requirements.map((r) => r.id), ids);
|
||||
assert.match(prd, new RegExp(`^- Status: approved, version ${list.version.replace('.', '\\.')}\\.`, 'm'));
|
||||
assert.deepEqual([list.prd, list.version], ['docs/prd/mosaic-stack.md', '1.15']);
|
||||
assert.deepEqual([list.prd, list.version], ['docs/prd/mosaic-stack.md', '1.14']);
|
||||
});
|
||||
|
||||
test('the committed list loads frozen', () => {
|
||||
|
||||
Reference in New Issue
Block a user