Review round 1 on 4048e0f60 found two defects.
Startup recovery ran unconditionally. A continuation retry now refuses
while processing is halted, so a broker restart with a waiting
continuation failed with processing-halted. Startup recovery now waits
while processing is halted or invalid, as the periodic pass does;
processing.resume schedules it again.
#continuationStarting matched any launch without an end, so an older
launch whose end was lost (#1851) hid every later run's end. Only the
target's latest lifecycle event counts now.
Both regression tests fail on 4048e0f60 and pass here.
Expose the parent message class on agent delivery so the runner can stop automatic replies to answers while preserving requests and ordinary relays. Scope continuation retry versions to the target, suppress notices during processing halts and unclaimed launches, and clarify the instance-running refusal.
The bus suite excludes project-files.test.mjs because its 1 MiB socket test timed out on both the candidate and the untouched 1186cf7b1 base.
The chat.js fetch wrapper recorded a request-not-found from /api/requests/<id>/workspace as a missing request and then served a synthetic 404 to the request panel's rereads, failing 11 request-browser tests. Only the request's own read records a miss now. Adds a regression test that fails on 9d3eb9e11, and bounds the r3 held-404 test's check on its refresh reads, which raced Files' cached repaint under load.
A mosaic-request-state for an id now advances that id's own generation on every thread retaining it, so a 404 still in flight from before the observation cannot record the miss afterwards. Generations are pruned with the misses to retained rows. Adds a held-404 regression that fails on 16384bb12.
A same-thread refresh kept the last resolved live controls until the session and history reads finished. When the fresh project lookup finds the project archived or the archive state unknown, withdraw the unguarded thread controls and remount the request panel fenced before those reads.
A signal name with no number in os.constants.signals now exits 1 instead of a made-up 128. Known signals keep 128+n (SIGKILL 137, SIGTERM 143) and the content-free stderr receipt. Test covers all three through the real entrypoint.
The oversize and unresolved ask-PM notices were appended without
checking the room left by the lead, so a lead with 0-130 bytes left
pushed a 972-task request past exec capacity (E2BIG at 131,086).
quoteBlock now returns at most max(room, 0): the full notice, the
47-byte short line, or nothing. Tests sweep rooms -3..160 for both
steps and run a 972-task lifecycle that must still exec.
BUILD-LOG appends a correction to the r4 limits (40,774 / 88,234).
A click on the test Console's Resume button opened window.confirm and the
browser daemon hung: the mouse release, screenshots and the frame tree all
block until the dialog is answered, and ui-browser had no way to answer it.
A click that opens a dialog now returns {dialog:{type,message}}. The new
command `dialog accept|dismiss` answers it and records the type, message
and answer in the receipt. While a dialog is open other commands except
stop refuse (journaled), and no screenshot or URL check is attempted.
A real-Chromium confirm test covers accept, dismiss and the refusals.
Jason's owner report 2026-11-06: no way to archive or delete projects.
Archive is the reversible half; delete stays out of scope because project
and run records are write-once evidence.
- project.archive / project.unarchive: human-only (project.create's gate
minus the tester carve-out; tester, user and agent refused). State is the
latest row of a new append-only project_archives journal (3s->3t, additive;
the rows are the audit trail), so projects itself never changes and nothing
is deleted. Repeats refuse project-already-archived / project-not-archived.
- project.list hides archived projects until {includeArchived:true}, which
flags each with archived:true; a user still lists granted projects only.
- While archived, thread.create, thread.send, room.open and room.send refuse
project-archived; every existing record stays readable and unarchive
restores everything.
- Console: new public/project-archive.js (+css) and project-archive-http.mjs
routes (chatHTTP's write fence); chat.js gains two one-line hooks,
index.html one script and one link tag; styling only through the shell's
.project-archive-control / .project-archived-filter hooks.
- CLI: mosaic project archive|unarchive <name-or-id> and list --archived.
- stack-release COUNTED/LISTED gain project_archives (schema order); schema
step-count pins and migration fixtures updated for 3t.
bus 1601/1601 (Node 24; Node 26 has the pre-existing project-file socket
stall), webui 582/582, plugins 132/132, cli 1191/1194 (two pre-existing
load flakes of the row253 C4 and land_work families; both pass isolated and
the base commit's full suite fails four of the same family).
The room context event read project.repo without a guard, so a room
outside the loaded project list threw and failed the room load.
Gate: full WebUI with the editor build required, 633/0 on the second
run. The first run failed I1 inbox in decide-browser.test.mjs once;
three isolated runs each on this tree and on 5a346825b passed 9/0.
A pin corroborates a ledger target only when its binding names its own
campaign and the owner campaign. serveBudget freezes the startup campaign
and ledger paths and retains the ledger with its startup target; a running
service accepts its exactly unchanged startup ledger. Without retained
evidence an owner business/config retarget now refuses as ambiguous.
The r2 review found that counting raw bytes let JSON and control
escaping grow one quote six-fold, so the runner's MOSAIC_REQUEST
exceeded the exec string limit (E2BIG). The continuation renderer now
applies the 16384-byte budget to encoded title and text bytes, cutting
on whole code points. Adds an execution-boundary regression.
A valid owner pin and a v2 ledger that disagreed on target still halted
the ledger's binding, so a business-only edit or a foreign ledger could
redirect the stop. The ledger target now needs owner corroboration;
otherwise the owner-verified pin replaces it, or the check refuses.
Gate on Node 26.12.1, 31 files: 422 pass, 1 fail. The failure is the
row 66 unslop timing flake in packages/harness/tests/claude-session.test.mjs,
which fails about 1 run in 3 on the base too; the file rerun passed 14/0.
Append-only BUILD-LOG.md and docs/SESSIONS.md conflicts keep both sides.
Gate on the merged tree: business 307/0, bus 1596 pass with one
pre-existing hang (project-files.test.mjs, same on relay base 2f1cef4c1),
harness 243/1 on the row 66 unslop test, which also fails 1 in 3 runs
on the relay base (timing flake, pre-existing).
D3: coder/reviewer sandboxes cannot read the product records repo and
list_requirements stays PM/CTO-only (row 90, #1584). The bus now quotes
the task-cited approved requirement texts (exact text, id, title, citing
task refs, snapshot id, product key, records commit) into the
implementation and review continuations, resolved host-side through the
same catalog resolver behind the scoped requirements verb, never from
model input. Quotes are bounded at 16384 bytes and framed as quoted
data; an unresolvable or revoked snapshot degrades to an ask-PM line
without blocking the task. No role, tool or schema widened; one duty
note each in roles/coder.md and roles/reviewer.md.
Review M1 on 62bece4a9: a failed notice insert or route threw past
#refused, replacing request-evidence-required and skipping its audit.
The notice is now best-effort; its transaction still rolls back whole.
Tests: insert and route failures keep code, audit and lifecycle; retry
publishes once. Both red on 62bece4a9.
Capture task-grounded research, preserved evidence, wireframes before graphical
concepts and independent assessments with separate author/evaluator contexts.
Document frozen-method reuse, scoped feedback, null/zero arithmetic, coverage
and stopping rules without requiring a particular model, harness or subscription.
Personally authored by a scoped Codex agent. Fresh independent source and
forward-use review APPROVE; 14 package-focused checks pass. Retain the synthetic,
single-model limits and separate installation/activation authority.
Package manifest: b93d7836ed7c70db62386192d6e1db5c4f867f841aaa7645c3c861def5a9b140
Wake the existing PM when validated evidence arrives after its first notice,
including overlapping recovery across retained request history. Preserve durable
deduplication and current authority checks.
Put the exact verification record and verdict contract in the first scoped
review request. Carry linked owner-request provenance into runner headers and
expose the existing requirement-record example to planning tools.
Implementation: Codex Terra initial repair; Codex Sol lead R1 correction,
regressions and developer documentation. Independent R2 APPROVE, 115 focused
checks. Matching final local coverage proves 4,333 distinct required cases;
the intentional FEDR7 skip is covered by its standard scratch wrapper.
Reviewed patch: 18ff6455e7ab69bc55cef88845f86189ed5f67b114ad7996f714a35ca1a90239
Source manifest: 6daf0668101bbad030c45411304d0d049de5e4da32bdcb03c40095ed1c63128f
Enable CLI and WebUI channels in the Case 1 starter. Explain channel
refusals, preserve in-memory drafts, and distinguish failed reads from
successful empty data. Keep room refusal state through failed refreshes
and restore session controls after catalog recovery.
Integrates reviewed source commits 5558fe020 and a1ba9cd56. Independent
review R2 approved both recovery fixes; append-only records preserve
controller and implementation evidence.
The bus refuses a stale mode revision as request-mode-revision-conflict, so the Console route maps that
code to 409 instead of request-mode-stale and request-mode-unchanged, which no bus emits. The mode copy and the
request-mode-changed wait label describe Task 4's project-level change. The draft route relays Task 4's
{ candidate, prd, requirements } reply when its candidate names the request, and maps prd-candidate-required to 409.
Review r1 of lifecycle Task 3.
C1: the four owner controls (answer, attach, mode, cancel) inserted and routed a
human-to-PM message without the messaging policy check message.send makes. The
shared writer now reads the current human-to-PM edge inside the control's
transaction, before it inserts or routes anything, and refuses with
message-sender-refused. The refusal rolls back the journal row, the human.input
event, the message and a withdrawn selection decision. The cancel withdrawal
checks the same edge. Regression tests close the edge after the question and
cover all four controls, then reopen it and prove the same call lands once.
I1: serve.mjs read sso.publicOrigin for a request URL when the Console ran
without --sso (or in preview mode), which ended the process on an unauthenticated
GET /api/requests/r1. A request route now answers through requestHTTP with no
transports and no SSO fields: unavailable on a read, read-only on a write, 405
for the wrong method. Listener tests cover GET and POST without SSO and in
preview mode, named and loopback, and the process keeps serving.
M1: the browser test waiter allowed about 3 s and reload() could run out its loop
without failing. Waits are now deadline-bound at 15 s and name the expression,
and reload() waits for the new document's own ready flag and the mounted chat,
and throws if it never gets there. The no-repost and stored-answer assertions of
the lost-answer case are unchanged.
Migration 3p-3q is unchanged.
The owner handles a new request from the Console: pick the mode (new
autonomous, new guided or an existing project), answer the project
manager's questions and confirm an attachment, with no copy-to-terminal
step.
Bus: 3p->3q append-only migration widens the request_events kinds. The PM
asks one question with request.question. The owner-only
request.answer.console, request.attach.console, request.mode.console and
request.cancel.console join the two console reads in CONSOLE_VERBS. An
answer is an attributed human.input linked to its question and request,
recorded once per op and never a PRD approval. An attach pick makes the PM
propose that project as a confirmation decision; nothing is mapped on the
pick. A mode change takes the expected revisions and leaves the bound plan
as evidence. Cancel keeps a created project.
Console: request-http.mjs serves GET /api/requests/:request, /projects and
/draft and POST /answer, /attach, /mode and /cancel with the signed-in
owner, same-origin and bounded-body checks of the decision routes.
requests.js draws the panel under the owner's chat message, answers the
mode decision through the existing confirmation endpoints, and after a lost
answer response reads the request first and resends the same op only on the
owner's click.
Lifecycle Task 2 (#797). A confirmed new-project selection now becomes a
usable product: the code checkout, the organization mapping, the records
repository with the original intent as the owner's spec commit, the chat
association and the working repository, each journaled as its own receipt
(bootstrap:<plan_digest>:<step>) and recoverable after a kill.
- business: addProject is a private exact-add writer under the existing
organization lock and receipt discipline; hold runs a synchronous check
under that lock; findAddition recovers a prepared receipt. Ordinary
writers still refuse every project change.
- bus: prepareBootstrap and executeBootstrap; activateManagedProject
reloads only a receipt-backed additive root and admits it to the broker
after readiness; request.admission host IPC op for the launcher.
- #800: the bound organization revision and association are re-verified
inside the organization lock at the start of execution; a mismatch
records request-plan-stale and performs no effect.
- cli: trackerFor skips reserved products; the launcher refuses to clone a
product the bus has not admitted.
- seat: initializeWorking seeds the working repository, host-only, with no
work ref or push authority.
- schema: append-only migration 3o to 3p widens the request_events kind
list with bootstrap.stale and bootstrap.completed.
Chromium also targets the document when a handler-bearing element is attached to the live page and removed before the CSP event is sent, so the readHTML filter alone (directive, source file, line, target document) could not tell that from the inert parse. The page now also records, with a MutationObserver on the live document, every element that enters the page carrying an on* attribute and every on* attribute set on an element in the page, and h.quiet() asserts the record is empty. The live-handler test gains a case for a handler attached and removed in the same turn, and checks per case that the observer saw the handler enter the page (not for the element never attached). Test-only; no product change.
The factory profile of scripts/case2-unit.sh now takes the bare pair
--sso --send, ported from the lane's serve_flags rule (b00019548). Either
flag alone refuses, and the proxy preview set and the proof pair still
refuse. Before any unit write, a bounded query run as the stack user,
through the existing config-query supervisor, checks that the stack
user's system config has console.sso; the Console refuses --sso without
it at start (packages/webui/src/cli.mjs:95). The server needs no change.
The library profile is unchanged: still read-only, still refusing --send
and --sso. Taking library --send with forward-auth and proof would need
the #385 refusal reverted in cli.mjs:63, serve.mjs:681 and the service,
release and upgrade scripts, so it is not done here.
docs/guides/case1-business.mosaic-stack.json now launches
claude-opus-5-5 with provider proxy, route anthropic, under account
factory with credential proxy.
Chromium 156 (host upgrade 2026-11-03) checks script-src-attr when an
inline handler attribute is created, in a document with no window as well
(WPT PR 62762; the follow-up PR 64290 that skips windowless documents is
not in 156). prosemirror-view's readHTML parses pasted HTML into the body
of a new createHTMLDocument, so the paste test at :154 got one report per
pasted handler (img onerror, a onclick, a onmouseover, svg onload), each
at editor.js:8212 with the document as target. No pasted handler reaches
the live document; Chromium 153, 151 and Brave 154 report nothing there.
The page record now sets aside only a script-src-attr report whose event
names editor.js at that readHTML line and whose target is the document.
The line is found from the bundle's text, and the lines that make the
parse target a new createHTMLDocument body are pinned; the test file
refuses to load if they change. h.quiet(), inert(), injected, errors and
rejections are unchanged. No product or CSP change.
New test: after a hostile paste, three live handlers each still fail
h.quiet() with one script-src-attr report: an onclick set on an editor
paragraph and clicked, an img onerror parsed into a page-owned detached
element, and an onclick prosemirror-view sets through its attributes prop
(a report naming editor.js at another line).
Route selection moves into one helper, pickRoute(proxyOf), that both checks call: the
primary preflight, and the fallback with its own preflight only when the primary's
fails, with the same messages. The final check passes proxyFor and is otherwise
unchanged. The first check of a proxy launch passes a stand-in session proxy (marker
key PENDING_ADMISSION_KEY and the configured loopback base URL), which reaches only
the preflights, then runs gate() with a null session proxy on the predicted route only.
The round 1 union over both routes is gone.
The managed fixture takes extra (more harnesses switched on), real (harnesses loaded
unfaked) and hostEnv. Seven tests in proxy-launch-order.test.mjs.
The negative lookbehind in DYNAMIC and in the dynamic branch of IMPORT excluded any dot
before `import`. That also skipped the last dot of the spread punctuator, so
`${({...import('../x.mjs')})}` returned [] for an existing, a missing and an outside
target, and `{...import(name)}` in plain code was neither returned nor refused.
Both patterns now share one fragment: a word character or $ before `import`, or a single
dot (x.import, x?.import), makes it a property call; a dot that follows another dot ends a
spread and does not exclude it. `1..import(` is read as an import too, which errs toward
refusal; the header names it.
Tests: a spread inside a substitution refuses for an existing, a missing and an outside
target and for array spread; a spread in plain code is returned, reaches the target
checks, and is refused when its argument is not a plain string; x.import and x?.import
stay property calls in plain code and in a substitution.
The business-imports helper blanked a whole template literal, so a dynamic import inside a
${...} substitution was neither found nor refused and skipped the existence and containment
checks. The scanner now reads a substitution to its closing brace, refuses it with
"unsupported import inside a template substitution" when it holds a dynamic import, and drops
it otherwise, so a nested template and a brace inside a string no longer end it early.
A slash after a postfix ++ or -- was read as the start of a regular expression, so
`n++ / 2` threw "unterminated regular expression". After a ++ or -- pair that follows an
operand the slash is division; after one that follows an operator it still starts a regular
expression. The header names the rare form this still misreads.
Output on the real tree is byte-identical.
F1: with system.proxy set, the first launcher check no longer returns
before the account, sandbox, capacity and limit checks. It skips only the
harness preflight and the session proxy key match, which need the key P2
admits in startLocked. A launch that can never start now refuses before
authorizeLaunch, the workspace and checkouts, and modelPreflight. The first
proxy pass accepts only credential "proxy" for a declared account, tries
the fallback model when the primary refuses, and lets mayLaunch
key-quota-no-model-key through so P2 can issue the first key. The final
check is unchanged and still runs before newRun and spawn.
F4: the proxy test option is renamed testProxy and createLauncher throws
test-proxy-refused when it is given with system.proxy.
launch-account.test.mjs is a second caller, so the option stays.
Tests: proxy-launch-order.test.mjs (6), launcher.test.mjs F4 throw test;
the managed launch fixture gains bwrap, admit and trace.ops.
control-board serve.test: the non-loopback refusal test took a port from a
probe-and-close helper and then called startServer on it. It now binds its
own listener, keeps it for the whole test, and closes it in finally, so the
port cannot be taken by another process in between.
stack-release.test T-I4: the free port goes only to webui-service.sh install
rows that refuse before any listen, so it is now a closed lease
(leaseClosedPort), which refuses connects and blocks other binds.
The 22 other freePort callers hand the number to `stack-release.sh rehearse`,
which probes it and starts a Console later. That needs a script change and
is left as a design, with a comment above freePort naming the window.
The helper read imports with a regex that treated a commented import as live, missed
`import (` written with a space, skipped a missing target inside packages/business/src
before checking it existed, and resolved targets lexically. It now blanks comments
(and ignores import forms inside strings and regular expressions) before matching,
counts a spaced or line-broken dynamic import, throws on a dynamic import whose
argument is not a plain string and on a file with an unterminated string, comment,
template or regular expression, checks every target exists and is a regular file
before the inside-own-directory skip, and refuses a target whose real path is outside
the real repository root. The output for the real tree is unchanged.
business-imports.test.mjs builds small trees under a private temp directory.
The usage queue read drains the proxy. A batch that is then not written (the
client or the bus refuses its shape, an ambiguous key owner, a failed write) is
lost, and the Console showed proxy totals with no sign of it. The reader now
counts these per enabled business since the bus started, the proxy view returns
the count as droppedBatches, and the Console proxy section says so above 0.
A read that failed before the proxy answered or that it refused drained nothing
and is not counted. Telemetry only; no quota reads it. The log line stays
proxy-usage-read-failed.
observeOrphans kept the whole remembered set when the lookup failed, so a leaf
removed and added back during the failure logged no second orphan line. It now
keeps only the ids the refreshed document still holds and adds none. Quota
decisions are unchanged: a failed lookup still refuses.
Ruling 1: the bus runtime passes launchSettings a key lineage lookup read
from its own credential records (ids only). A new daily key quota takes the
earliest stored since among the old document's daily key quotas in its key's
lineage, and now only when there is none. A reset still sets now, a
caller-supplied since still refuses, and a quota removed and added back in a
later write is new. A failed or malformed lookup refuses proxy-key-refused; a
write that adds no new daily key quota never calls it.
Ruling 2: every limits refresh updates the remembered orphan set, an empty
set when no daily key quota is left, so a quota removed and added back logs
again. In memory only: a restart is a fresh observation.
Ruling 3: pollSettledAfterTick yields on the real setImmediate, captured at
load, inside its deadline.
Tests: p5-key-lineage (writer move counts 160, reset restarts, lookup
failure, orphan remove and re-add), p5-runtime (exhausted on A, moved to B
through the real runtime, refuses), p5-background (barrier with every timer
mocked), token-limit-settings (earliest, no match, re-add, caller since,
malformed answers, default refusal). READMEs: business, plugins, daily-quota,
cliproxy-queue.
Appends a BUILD-LOG entry that corrects the R1 entry without editing it: the
R1 walk change also dropped the recursive lstat, which R2 restores; the
tester-cli freePort helper has no callers and binds nothing; the stack-release
and control-board probe-then-bind window stays a known risk for a follow-up.
Appends one SESSIONS line.
R1 passed the parent's stat of a listed directory into the recursive walk,
so a recursive entry no longer took its own lstat. A directory replaced by a
symlink after that stat passed the stale directory check and readdirSync
followed the link; a directory replaced by a regular file leaked a raw
ENOTDIR instead of refusing with project-repository.
The walk now takes a root flag. The .git root keeps its raw lstat and its
own error; every recursive entry takes a fresh lstat through statEntry, so
a vanished entry still maps ENOENT to 'git metadata changed during
inspection' and a replaced one refuses with 'expected local .git directory'.
The mapper is unchanged: ENOENT only.
Two deterministic tests replace a directory under .git/objects inside the
lstat call that stats it as a listed entry, after the real stat is taken:
once with a symlink to a fixture-only directory outside the repo, once with
a regular file. Both refuse with project-repository.
leasePort({closed:true}) ignored its option: it probed an ephemeral port and
closed it, so a parallel test file could bind it and answer a request the
test expected to fail (preview.test.mjs:209 saw 200 instead of 502).
leaseClosedPort holds a bound, non-listening socket in a perl child until the
test's after hook. Connects still get ECONNREFUSED, bind() from another
process gets EADDRINUSE, and the kernel's ephemeral allocation skips the port.
Lane mode keeps its band and per-port lock, and releases the socket before
the lock. leasePort now refuses a closed option, so a stale call cannot get
the unheld port again.
Unanswerable callers (webui preview, serve, service) move to leaseClosedPort(t).
Callers that listen on the port themselves (stack-release rehearse, control-board
serve, tester-cli) keep leasePort and drop the ignored option.
Fixture helpers that commit to a repository the product later inspects now pass
maintenance.auto=false and gc.auto=0, as the product's own git calls already do,
so a detached git maintenance run no longer writes pack temp files mid-walk.
inspectGit now refuses a git metadata entry that vanishes between readdir and
lstat (or between listing a directory and reading it) with project-repository,
'git metadata changed during inspection', instead of leaking a raw ENOENT.
It still refuses rather than skipping or retrying. A missing .git keeps its
existing error.
A deterministic test removes the named entry from inside a replaced readdirSync,
for both a file and a directory.
Ruling 1: model records keep a bounded previous list (64 ids, oldest dropped)
of ids that left by rotation, grace expiry or re-issue; a fire removes the
record. A tokens.keys leaf matches and counts every id in the lineage that
holds it. Lineage ids are unique host-wide. An orphaned leaf limits nothing,
logs one value-free line when it becomes orphaned, and the Console usage
view lists it.
Ruling 2: an agent with no model key under a key quota refuses
key-quota-no-model-key, passed through the broker, launcher and stop reason.
Ruling 3: covered by the lineage; no mayLaunch change.
Ruling 4: the usage module receives a frozen { readUsageQueue } only.
Ruling 5: every telemetry fixture wait races a 5 s real-timer deadline.
GPT review of the 1.19 rebase found the test header still called the PRD a candidate and the rebase record placed lines 793 and 645 in the wrong requirements. Comment and record only; no assertion changes.
Rebased onto refactor as 1.19 because row 335 landed 1.18 first. Requirement text, IDs, order and the 101
records match the approved fd9ae104d apart from version labels. GPT review APPROVE with two P3s, fixed in the
next commit.
Adds agents/gosalyn/work/disk-prd118/REBASE-1.19.md: the cherry-pick
conflicts and their resolutions, every label moved to 1.19 and every 1.18
kept, the byte check against fd9ae104d with version labels normalized, and
the test runs and version mutant.
Row 335 landed PRD version 1.18 first, for the REQ-INST-2 correction. The
disk-space governance text that Jason approved as 1.18 in Q289 therefore
lands as 1.19. Only version labels move: the status line, the disk version
source bullet, the "since version" labels in the disk sections, the disk
milestone, and requirements.json "version". The requirement text, IDs,
order, defaults, settings and the 101 records are unchanged.
The prior approval history bullet now runs through version 1.18 and carries
the row 335 lines. The two test pins follow the renumbering.
Records the replayed join of row 333 R2 (0ef269da9) onto landed row 332 (5df0e9d6f) in merge c0c291cda: the two conflict hunks and their resolution, the comparison with the earlier join resolution, and the nine suite results. Adds the docs/SESSIONS.md line.
R3 (abc66a598) changed its mode from 100755 to 100644. Every other scripts/test-*.sh is 100755.
The landing gate runs it through bash, so no run broke; this restores the R2 mode.
Appends the R3 section to agents/steelbeak/work/queue-227/BUILD.md: the
R2 red on dummy links, the fixes, how the TMPDIR limit is derived, the
namespace containment and control table, runs, signal probes, the tip
check on 5df0e9d6f and follow-ups. One line each in BUILD-LOG.md and
docs/SESSIONS.md. Earlier entries are unchanged.
Joins row 333 R2 head 0ef269da9 (base 09a847eda: R1 503b91e56, overlay
2627321f6, docs c012b2e0a and ddb3e961f, R2 fixtures 12eba4b59 and
0ef269da9) onto refactor with row 332 landed at 5df0e9d6f. Run with the
union attributes for BUILD-LOG.md and docs/SESSIONS.md. Two files
conflicted; no other path did.
packages/business/src/launch.mjs, import block: 332 changed the errors
import to `{ BusinessError, refuse }` for the proxy route refusals; 333
added `isDailyModelQuota` from plugins/src/model-quota.mjs for the daily
model leaves under limits.tokens.keys. Kept both: the model-quota import
and the `{ BusinessError, refuse }` import. The rest of launch.mjs merged
without conflict (332's checkModels route handling and checkAccount
credential "proxy"; 333's checkTokenLimits keys block).
packages/plugins/README.md, end of file: 332 appended "Per-session proxy
context (P3)" and 333 appended "Proxy usage telemetry (row333 / P5)" at
the same spot. Kept both sections, P3 first, one blank line between.
The resolved files match the earlier 332 R1 join resolution
(join-resolution.patch) line for line apart from hunk offsets.
P1: a failed mktemp, mkdir or output redirect now stops the script with
exit 2 before it derives a path, sets a trap or starts anything. The
sandbox root is checked to be absolute, a new empty directory this user
owns and its own physical path, and its device:inode is recorded.
sweep_sandbox and remove_sandbox in scripts/case2/sandbox.sh each refuse
unless the root still matches, so an early, late or empty call gets a
refusal instead of a sweep of the host.
P2: the sweep reads every /proc/<pid>/cwd target with one find and
compares it as a string, root or root plus "/", so *, ? and [ in the
path are literal. A cwd in a deleted directory under the root matches.
P3: a TMPDIR whose tools socket path would pass the 107-byte limit in
packages/seat/src/session.mjs is refused at entry with one line naming
the limit and both lengths. The length comes from the socket path built
on the real sandbox root.
scripts/case2/sandbox-check.sh checks the guard and the match against
dummy symlinks; nothing in it sends a signal.
Row 333 made packages/business/src/launch.mjs and organization.mjs import
packages/plugins/src/model-quota.mjs. The stack-release fixtures copy
packages/business/src and added only plugins/src/kinds.mjs, so their copies
failed with 'Cannot find module .../model-quota.mjs'. Whole cli runs on the
row 333 tip gave stack-release 56 pass 168 fail, stack-release-external
4/21 and stack-upgrade 7/14.
business-imports.mjs reads the imports of packages/business/src and returns
the files outside it that they reach, so both fixture builders copy what
business needs instead of a hard-coded name. No product code, schema or
assertion changes.
Appends the "R2" section to agents/steelbeak/work/queue-227/BUILD.md: findings and fixes,
no step failures past launchFixture, the environment and signal controls, the mutant table
(m6 on requireCitation survived and is a follow-up), run times and the tip check. One line
each in BUILD-LOG.md and docs/SESSIONS.md. Earlier sections are unchanged.
F1 fixed in da1f0ceda, with the federation acceptance red and green runs and
the script suite results. F2: the invalid-proxy-context BundleError is raised
at launcher.mjs:569, outside the try at :655, so :686 never sees it;
fromSession maps it at :1199 and launchPm rethrows it at :1215.
GPT review F1: prepare() built the host env from HOME, PATH, TMPDIR,
MOSAIC_CONFIG and NODE_EXTRA_CA_CERTS only, so the pi credential preflight
refused the assistant launch (no-session-credential) and the RESULT wait
failed. scripts/test-federation-acceptance.sh red on 6e9f3d723, green with
the fake ZAI_API_KEY the cli tests use.
Remove the R1 slot-controller ties from the C2-14 fixture: the ROW227_CONTROL_ROOT
check, the native permit wait in bindLaunch, the fixture-cleanup.json write, the
priority.mjs preload and the owned-bwrap.sh override. The launcher uses its own bwrap.
The shell runs the driver from an explicit env -i environment (PATH, LANG, a sandbox
HOME, XDG dirs and TMPDIR, MOSAIC_CONFIG, no global git config) as its own process
group. On a signal the driver gets 3 s by the clock, then its group and any process
whose cwd is in the sandbox get SIGKILL, inside the landing gate's 5 s grace.
The fixture credentials are defined only in scripts/case2/fixture-credentials.mjs.
The new scripts/case2/leak-check.mjs reads them from there and never prints them.
Append-only R2 section: correction to R1's evidence, the two causes of the
53 cli failures, items 1 to 6 with their tests, RED, hermetic and GREEN
tables, five killed mutants on 39eadf8ba, and the F1, F4 and F2 docs
follow-ups.
The cli tests that launch pi deleted only the session login names, so pi's
preflight passed or refused by whatever provider keys the host exported. A
shared helper now deletes every credential pi's preflight reads and gives pi
launches one made-up key. The refusal itself is unchanged.
pi bundle() takes a default argument again, so a call with none returns the
non-proxy bundle, as before P3. pi.bundle leaves out a launch.models entry
whose provider has no proxy route instead of failing every pi launch (F2);
malformed proxy entries still refuse. The invalid session proxy context
BundleError gets the code invalid-proxy-context. New tests cover F2, the code,
and the three proxy account branches in the launcher (F3).
Unclaimed files left in the canonical checkout. Inventory: canonical-cleanup-inventory.md (commit-as-evidence groups). detect-secrets scan clean on 2026-11-02: hits are sha256 pins, git object ids, test sentinels already in tracked tests and unit-file lines.
Unclaimed files left in the canonical checkout. Inventory: canonical-cleanup-inventory.md (commit-as-evidence groups). detect-secrets scan clean on 2026-11-02: hits are sha256 pins, git object ids, test sentinels already in tracked tests and unit-file lines.
Unclaimed files left in the canonical checkout. Inventory: canonical-cleanup-inventory.md (commit-as-evidence groups). detect-secrets scan clean on 2026-11-02: hits are sha256 pins, git object ids, test sentinels already in tracked tests and unit-file lines.
Unclaimed files left in the canonical checkout. Inventory: canonical-cleanup-inventory.md (commit-as-evidence groups). detect-secrets scan clean on 2026-11-02: hits are sha256 pins, git object ids, test sentinels already in tracked tests and unit-file lines.
Unclaimed files left in the canonical checkout. Inventory: canonical-cleanup-inventory.md (commit-as-evidence groups). detect-secrets scan clean on 2026-11-02: hits are sha256 pins, git object ids, test sentinels already in tracked tests and unit-file lines.
Unclaimed files left in the canonical checkout. Inventory: canonical-cleanup-inventory.md (commit-as-evidence groups). detect-secrets scan clean on 2026-11-02: hits are sha256 pins, git object ids, test sentinels already in tracked tests and unit-file lines.
Unclaimed files left in the canonical checkout. Inventory: canonical-cleanup-inventory.md (commit-as-evidence groups). detect-secrets scan clean on 2026-11-02: hits are sha256 pins, git object ids, test sentinels already in tracked tests and unit-file lines.
The row 173 test called setup(false), which starts the page with Show machine sessions off, so the sessions table it waits for never renders. Its sibling uses setup(true). Change the one argument; app.js is unchanged. The same test fails on the r2 tip 6d15eb5fc2, so base drift was not the cause.
(cherry picked from commit 996c79524f)
Members equal their blobs at 503b91e56. The secret-scan hits are the PEM_BEGIN constant in packages/bus/src/credentials.mjs and a detection regex in packages/discord/src/tools.mjs, not key material.
Commits the row 227 evidence under agents/steelbeak/work/queue-227/: the remaining gate/ files, runs/ (first, corrected1, priorityprobe), target-packet, target-packet-r2, target-packet-r3, target-packet-r4, static/, and the two top-level manifests. Also commits BUILD.md and the append-only BUILD-LOG.md and docs/SESSIONS.md entries. The R4 packet hashes are PACKET.sha256 4eb60915b2144137df9b5a42afd0c5b266718d71de051fb8be53a27430a2cad4 and CURRENT-SOURCE.sha256 0cfd47c2073bc18a3ba7bff1ce6fdf39fe33a64b7fca209be71517b9feb89020, both checked against the files. The overlay bytes are committed in 4ac6f13bc. This commit adds receipts and packets only and records no scripts/test-case2.sh run on the R4 overlay.
Commits the 5 product paths and 7 gate helpers of the row 227 R4 source overlay on top of HEAD 5a0c801cb. scripts/case2/console.mjs is already committed at HEAD and is not part of this commit. The R4 independent review is sha256 6667baaa6af9d6d78a3ec7c64d9f3163ecbc350b94050f62899d9c01deabe002, verdict APPROVE source-only. Packet hashes: PACKET.sha256 4eb60915b2144137df9b5a42afd0c5b266718d71de051fb8be53a27430a2cad4, CURRENT-SOURCE.sha256 0cfd47c2073bc18a3ba7bff1ce6fdf39fe33a64b7fca209be71517b9feb89020. The 12 committed files match the review hash table, the applied overlay JSON (size, mode, hash) and the saved overlay tar. No scripts/test-case2.sh run exists on these bytes.
Commits agents/codex/work/queue-333/r1-repair/ (packet, receipts, review and author files) and the append-only BUILD-LOG.md and docs/SESSIONS.md entries. The packet INDEX.json sha256 is 3eb9b8d10445aa328be3b854385e4792dda2c5712b19d443d485d1b00a18d0f8 and source-tests.patch is a78bc385801b64be270fb9d6e84672c443738a5fce8eb68f7d2a01359a57a770; the product commit for these bytes is 2627321f. Two packet tarballs are deliberately not committed: packet/baseline-input-bytes.tar.gz and packet/fixed-input-bytes.tar.gz. The secret check reported a -----BEGIN marker in each (members packages/bus/src/credentials.mjs and packages/discord/src/tools.mjs, byte-identical to 503b91e56 and with no PEM body). They stay untracked until the lead rules on them.
Commits the 18 product paths of the row 333 R1 repair exactly as the reviewed overlay. Packet hashes: source-tests.patch sha256 a78bc385801b64be270fb9d6e84672c443738a5fce8eb68f7d2a01359a57a770 (40623 bytes), INDEX.json sha256 3eb9b8d10445aa328be3b854385e4792dda2c5712b19d443d485d1b00a18d0f8, changed-source-tests.json sha256 42f770fc3e2384362efd1e416091355c064b6cca22dd40f3b5ef8f7b67e43a52. The committed bytes were checked by applying source-tests.patch to 503b91e56 in a scratch tree and comparing the 18 paths. The approvals are source only: R2 (APPROVE source-only, 2026-10-26 23:32:39Z) and Boyd's first review (APPROVE, source only, 2026-10-27T00:27:55Z), both on HEAD 503b91e56 plus this overlay. No test has run on these bytes yet.
#156 changes src/run-agent.sh and src/load-contracts.sh, which are baked into
the worker image. Its run-agent.sh refuses to start unless the launcher sets
MOSAIC_SYSTEM_PROMPT_FILE, and no launcher before #156 does. Rebuilding the
shared 0.0.12 tag would break the live pinned copy and rollback targets, so the
new image gets its own tag. No code change.
Source-candidate: poe d9a564e6d20f5f0fd75ce45b12cbbf8bb4c9d568\nSource-candidate: magica38ba5762b06716db1dee00d0afec162656488f5c\nValidated321whole-file phase plus whole bus1349/model-proxy100/webui490; final gate tooling checks pending, not landed.
A builder's whole-file run list for a row comes from imports, not a text
grep, and goes in the builder's report before the run. Files on the
mos-1592 list stay off unless Mos approved the run. Row 329 round 2's
path grep matched fixture text and reran case1-accept.
Mos approved the P4 brief with upstream API keys added: a human-only write-only verb, z.ai-only allowlist, apikey-invalid and provider-not-allowed refusals, a canary test and an echo mutant. Account ids hash the proxy's own credential identifier, never a token or key value. Account removal stays out of P4.
Jason's Q46 and Q47 (DECISIONS Q250, mos-1606): accounts are entered in the Console's own proxy page and D8's /proxy/ forward to the upstream panel is dropped. The new P4 brief is its own file so the rows doc blob that rows 329 and 331-333 pin stays unchanged. Design D5-D8, D10, D20, migration step 4, J3-J5, the rows table and the Mos rulings list are amended.
The fence sits near business.mjs:166, clear of row 287's :283-291. Its message
starts with the N10 text. An assistant-instance test keeps the no-gitea branch
covered, and a creative-instance test covers the fence. Nothing here has run.
Fixture data only, plus two named tests that a chief or creative instance
without credentials.gitea refuses at load. chief-of-staff.test :88 and :155
change expected values and wait on Mos's mos-1272 ruling. Nothing here has run.
The creative role files declare gitea with SEAT_SCOPES, the scopes the Gitea
grant mints. The chief declares read scopes only, so #giteaRole refuses it
with gitea-not-declared until row 287 mints its declared scopes.
library.write is not yet routed: it waits on PRD 1.16 (row #1796), and the
fixture change waits on Mos's mos-1272 rulings. Nothing here has run.
Guard, limits, M11 fence, broker guard/page store/check event, BusError
reason, runtime wiring and the CLI replies verb. No runner work, no tests,
nothing run. BUILD.md lists the rulings, the row 225 contract and what is left.
Quackerjack stops row 296 here. BUILD.md holds the verified reads, the proposed
harness design, the open decisions for Lena, and the R2 learning that R7 depends on.
No test or code changes in this commit.
Apply only the paths and legacy absence pins approved by mos-1420 and sage-3243. Preserve exact expected history and the stopped run evidence. No product change or rerun.
Apply mos-1408 and sage-3178 without creating the directory being asserted. Preserve the first red evidence and select TAP explicitly for the next approved run.
Preserve the draft for inspection under sage-3113. Tests and mutants have not run. Old-test adaptations approved in mos-1316 and mos-1317 are recorded in OLD-TEST-CHANGES.md.
Console granted-user sign-in, a user-cli transport per session, the
per-request grant re-read, the owner-only gate and user page, the notice,
the hub label and peer links, accessContextFor peers, and the bus boot
access wiring (sage-3142). Tests G1-G8 and B1-B3 are written and not yet
run; runs wait for Sage's CLEAR. Choices C1-C9 in
agents/launchpad/work/queue-294/BUILD.md.
The pattern test coerces an absent value to the string 'undefined', which
matches, so the typeof halves are the only refusal for a missing value. Adds
a case for each, and M15-M17 in BUILD.md; keeps the config-console-key check
name on purpose. Not run yet.
stack-release config_checks refuses a target whose loader refuses a key the
config holds; it looked only for console, so a federation-only config passed
to a pre-203 copy. The probe now reads console or federation. The fixture's
B loader replace follows the new rejectUnknownKeys list, which the federation
key changed.
Adds a test for each federation refusal in test-config.sh (six uncovered,
plus trailing slash and duplicate peer id), and one stack-release test for
the target-loader refusal. Mutants M7-M14 in BUILD.md. Not run yet.
The loader validates an optional federation block: self and peers[].id
labels, peers[].origin as an https origin with no path, query or userinfo,
peers[].label non-empty and at most 80 characters, peer ids unique and
distinct from self. Unknown sub-keys refuse. Labels and URLs only; the key
grants no trust. Absent key: config loads with no federation output.
Tests in scripts/test-config.sh cover each refusal and the no-key case.
Notes and mutants M1-M6 in agents/quackerjack/work/queue-203/BUILD.md.
Not run yet: the gate runs on CLEAR.
#readable returns false for an agent session, so a `*` share no longer shows a user's message
in an agent's trail. New tests: a sharee's session.list refuses (Q1), and an agent bound to the
shared thread, a chief run and the tester match no share (Q2). BUILD.md records the Q1
follow-up, Q2-Q4 and the live --migrate as Mos's go under Q173. README names the agent rule.
thread_shares (row 193 design 5.2) with its index and append-only triggers; the
3l-3m step only adds them. thread.share, thread.unshare and thread.shares for a
thread's owner; #readable holds design 5.4's four rules, #threadRead serves
thread.messages only, and thread.list {shared:true} adds owner. replies and
trail show shared user threads to the owner and readers. COUNTED, LISTED,
timedTables and the clock list take the table. Tests: thread-shares.test.mjs
and the 3l→3m pins. Packet agents/launchpad/work/queue-206/BUILD.md. Not run
yet: node waits for Sage's CLEAR (sage-2789).
A halt inside the op reaches the bus's own fence first (runtime.mjs:564-566,
processingWork at :352-356), so the launcher refused limit-check-failed
(launcher.mjs:389-391) before its recheck admission() at :397. First-run red of
a new test on 6d9ab3503 early signal, placed under mos-1272.
The section "recover() change, for a design read" covers three things, with
file:line against aca16404c. Every leftover is still bound and ended as
host-lost, and a survivor only refuses legacy-run-live while it lives. The
5 s wait applies only in the bwrap kill branch. No old test's expected value
changes. The fallback is to revert to the base recover() and leave the
refusal untested. The survivor log line now names the outer and runner pids
so an operator can clear it, and the new test's log assertion matches.
recover() kept a survivor only when a bwrap outer pid outlived SIGKILL, so
the Q2 refusal (BUILD.md:177-179, t1-sessions.md:109) had no test. A leftover
whose runner still ran after its outer pid was gone was ended and dropped.
Now recover() waits on the outer pid and the runner, keeps any leftover where
either still runs, and logs that it still runs. check() reads only the
survivors that still run.
session-launch.test.mjs adds a test where a sessionless leftover's runner is
a sleep child and its outer pid is gone. It asserts the legacy-run-live
refusal with no launch and no session workspace, then one launch once the
child exits. BUILD.md adds mutants M10-M12 and replaces the "no test" note.
Allowed by Mos in mos-1292 (copy mos-1294) on mos-1285's terms. The SELECT
reads actor_run, the expected row gets the run-name literal, and the three
callers pass `${name}-run`. Nothing else in the test changes. The old
expected row was:
[['action.refused', { code: 'not-holder' }]]
DEFERRED.md gets a closing line on the entry naming row 269.
threadsState gives one row per session with `session` and `legacy`; threadIdle
idles a run against its bound session. Each session gets its own store
(threads/<b>/<t>/sessions/<s>/, or the thread's old store for a legacy-3l
session) and its own workspace (session-workspaces/<b>/<i>/<s>/), held by an
O_EXCL <ws>.lock from before the clones to the run's proven exit. A legacy
session's workspace binds in-sandbox at the old instance path. sessions.json
is v2 and reads v1. New tests: cli session-launch.test.mjs, seat
session-workspace.test.mjs. Not yet run: tests wait for Sage's CLEAR.
Two old assertions change as exact updates:
- mos-1285: end-launch.test.mjs threadsState deepEqual. The old row shape was
{ thread: 'th-1', instance: 'coder', pending: 0, unread: 0, lastMessage: null,
lastOpen: '2026-10-15T00:00:01.000Z', lastClaim: null, holder: null }; the
row keeps every key and value and adds session: 'th-1', legacy: true.
- mos-1289: thread-launch.test.mjs:182, old line
`const store = join(f.dataRoot, "threads", "acme", A);`
now reads A's default session id from threadsState's `session` key; :183-185
unchanged; one added assert that threads/acme/<A>/session is absent.
The peer-output fixture execs isolated system Python to write its exact bytes
and exit with peer-status. This avoids masking parser/status faults behind the
supervisor session check. All17 faults assert an exact reason with a delimiter;
every existing assertion remains. No product change or timing delay.
Old packages/cli/tests/case1-accept.test.mjs💯
const PYTHON_STUB = `[ -f "$HC/peer-output" ] && { cat "$HC/peer-output"; exit "$(cat "$HC/peer-status")"; }
Diagnostic under sage-2752 found probe-inner-session for malformed output and
nonzero exit. Mos confirmed the fixture mask and authorized this repair.
No tests ran after the repair; Duckworth review and fresh whole gate follow.
sessions and session_defaults are new and append-only. thread_claims, message_threads and
thread_opens are rebuilt in place with a session column, and thread_claims gains a generation
counted from claim rows. Each existing thread gets a default session with the thread's id; new
threads get a random one. Holder, per-run, release and delivery triggers key on the session,
and two id triggers keep session and thread ids apart (Duckworth checks 1-7, duckworth-0106).
The broker binds a thread run to a session (the default when the record names none), and
thread.open, thread.send and thread.messages take an optional session. New verbs session.list
and session.create (idempotent on op). Tests: sessions.test.mjs for T1 bus half, T2 and T7 with
a pinned 3k fixture; count, version and verb pins; hand-made test threads write the legacy
default session.
Built on row 236 (8f51900b5), which takes 3j-3k, so this step is 3k-3l by landing order
(row264 Q2, sage-2412). The op values are legacy-3l and migration-3l. gitea-migration.test reads
its store after both steps. Not run yet: every run waits for Sage's CLEAR.
Row 191's #processingGate refuses agent verbs off its read list while
processing is halted. grants.status joins hosts.status on that list, per
the kill-switch plan (2026-10-20_kill-switch.md:16): reads still work.
An agent's grants.revoke stays refused while halted, as hosts.revoke is.
Gitea grant executor (steps 0-8, settle, restart, revoke and fire, sweep,
status), the grants.* verbs and mosaic grants, the 3j-3k migration with
gitea_users and gitea_grants, and the section 9 tests with a fake Gitea and
a scratch gitea/gitea:1.27.1 X-G3 test. Build notes in
agents/megavolt/work/queue-236/BUILD.md.
checkMapping takes kind absent, hybrid or draft. A draft has a name and one
or more prefixes and no books, and comes back with books []. A prefix inside
or holding another entry's book refuses library-playground-other-universe,
which replaces library-playground-outside-book. A prefix equal to a book or
holding its own refuses library-mapping-invalid, as does a draft source.
classify returns a playground file's entry and the book holding its prefix,
or null at universe level and in a draft.
Bound the halt-abort expectation, check Discord refusal before malformed journal reads, and isolate HTTP origin and valid oversized-body guards. These test changes are committed for the row 191 gate; execution awaits the coordinated slot.
Unify halt and fire cancellation by verified run identity with durable first-owner receipts and shared deadlines. Integrate the instance control with the current host, library and tester-socket paths. Focused nine-file evidence is 62 passing tests; broad suites, mutants and review remain pending.
TOOLS.md: activate takes --no-sso and --send; three lines state the F39 rules.
BUILD-LOG: the row 202 landing line held since 02:01Z and the row 273 landing line.
B1: row 200's rollback to a Console without --sso kept the pointer's --send,
which F39 b forbids once --send can sit beside --sso. send_for_target drops it
whenever the run drops the pointer's --sso, and the plan and steps say so.
N1: an ok line with no activation refuses sso-off-flags instead of being
skipped.
(a) --sso on, then two re-pins that carry it, then --no-sso gives back the
arrival's ExecStart byte for byte. (b) every set in the log holds --sso, so
--no-sso refuses sso-off-flags before any unit stops.
activate --send turns send on only when the run's Console flags hold
--sso, given or carried (F39 b), and puts it after --sso and before the
tester flags. activate --no-sso turns --sso off with the Console flags
from the set of the activation that turned it on, drops --send (F39 a)
and keeps the pointer's tester. Both are usage errors under --units
external. T58 covers the brief's T1-T4; the external test covers T5.
Design and the set-walk choice: agents/darkwing/work/queue-273/BUILD.md.
Candidate quackerjack/fed-r5-r5 a74cd9f87 on c3d88840c, manifest of 6
paths (CANDIDATE.sha256). Duckworth APPROVE round 5, rev 3026 (#1700
c30184). C1 gate on Sage's slot by Quackerjack on the merge of a74cd9f87
onto a849d89b7 (3b86180b9), finished 01:56:24Z: cli suite 771/771, skip 0
(run 2; run 1 red on a too-long gate TMPDIR, harness only), every
scripts/test-*.sh rc 0 with Docker up, mutants M1-M13 killed by their
named tests. Landed onto 9c9732983 with the candidate's blobs and modes
for the 6 paths; c3d88840c..9c9732983 touches none of them.
- docs/plans/2026-10-22_activate-send-nosso.md: the row Mos approved in mos-1246. Darkwing builds,
Filbert reviews. --no-sso drops --send, --send refuses without --sso (F39), test-release.sh cases.
- docs/plans/2026-10-22_federation-r3.md: FED R3, the broker user principal, on 193b1a's candidate.
Owner Morgana, reviewer Dewey. Its parents R1 and row 196 have landed, and the filing was owed.
- human-users-build.md: 193b1 split into 193b1a (message filter, chained on 196) and 193b1b (viewer
verbs and board refusals, after FED R3 and R4). Mutant 3 moves to 193b2 (sage-2288, morgana-0063).
- sso-phase2-window.md draft 2: the tool gap paragraph names the approved row, and rollback step 1
drops "--send follows the pointer", since --no-sso drops --send (mos-1246 items 2 and 3).
R1 same-copy rollback, 7247d80c7 named, placeholder stop, step 10 aimed at a
tester-owned thread, agent config writes. Names the tool gap: activate has no
--send and no --no-sso, and --expect-from is external-units only.
Doc-only commit after the row 254 landing. The library README now says
that a sync outlasting the server's 120-second hold gets request-timeout
and still finishes (Dewey N1, #1759 comment 30173; server.mjs sets the
120 s socket timeout and the broker promise runs on). DEFERRED records
Dewey N2: library-mapping-invalid, library-remote-invalid,
library-state-invalid and library-git still map to 502 until the Console
library routes row decides them. No test reads either file's content.
Candidate megavolt/row254 b31300d79 on c3d88840c, manifest be63cfbe
(7 paths). Dewey APPROVE r1, rev 3006 (#1759 c30173). Gate on Sage's
slot by Megavolt, 23:37:27-23:40:52Z on b31300d79: library 77/77, bus
628/628, webui 305 pass with 1 skip (editor rebuild needs esbuild
0.28.2), every scripts/test-*.sh rc 0; the human-cli timeout and
library-fetch-failed STATUS mutants killed by their behaviour tests.
Landed onto 41b0cf755 with the candidate's blobs and modes for the 7
paths; c3d88840c..41b0cf755 touches none of them. Merged-tree rerun of
library, bus, webui and cli on Sage's slot before the push.
Five slices 264a-264e, all MVP; schema label by landing order across rows 236, 264a and 206; PRD 1.13
already landed; row 194 is the stop owner for 264d; one admission hook for row 191; Pi count exact with
Claude unknown until Vikunja 466; legacy single human until row 193 (gizmoduck-0154, #1769, Vikunja 463).
Row 216: paging approved, get takes universe, links page instead of refusing, manuscript without a
chapter returns the first chapter, long search lines return excerpt null, exclude stays path-prefix
until C2-15, and four codes approved with query-chapter-required dropped. The next round rebases on
row 268's landing and adds the PRD 1.14 playground-level tests.
Row 220: one business helper gives library and creative seat sets from the business files, so the
Discord binding schema doesn't change. M7 is wired in the control board, M8 in discord check and run.
Both fail closed on an unreadable business file. The scope grows by the helper, its test and the board's
serve.mjs. Questions 2 to 4 are answered as proposed.
Lands docs/plans/2026-10-21_t1-sessions.md as of 2c843d190 on origin/huey/t1-sessions-design (347278044, e19e30df2, 2c843d190 on cca206cdc) with its three BUILD-LOG and three SESSIONS append lines, onto the current refactor tip. The design blob is unchanged. Build dependency N2 (Claude completed-compaction format and the managed dataRoot reader) is Vikunja 466.
Follows Jason's Q211 ruling and Mos's reading. Adds to v1 and removes nothing.
- Status and a Version 1.11 source bullet quoting Q211.
- Users: two v1 users on their own instances (Q176). Where it runs: two PVE VMs, dragon-lin dev only (Q180, Q181).
- Out of scope: minting credentials (Q188, Q190), SSO (Q175) and access beyond localhost (Q176, Q179, Q180) move into v1. The bundled Pocket ID stays out (REQ-INST-2, Q203). Codex and SetSpark stay out. Case 2's own organization is v1.
- REQ-CRED-1: Gitea per seat through a grant (Q190).
- REQ-FED-1: person-to-person v1, agent-to-agent post-v1 (Q179, Q180).
- New REQ-INST-3: one-command install and upgrade, Console unit enabled in both v1 profiles (Q187, Q189).
- Acceptance: the 10-27 goal (Q176). The 1.10 note at :1217 now points to Q211. A Version 1.11 technical note keeps the old list text.
requirements.json goes to 1.11 with 71 ids. Both requirements tests are updated to match.
Lands docs/plans/2026-10-21_email-plan.md (merged plan, 399 lines) with
Della's independent plan and her review of Ludwig's plan, from
origin/della/email-plan b0844a5ce on c3d88840c. Della's 10 BUILD-LOG and
4 SESSIONS lines are carried as appended. All rows are post-v1; no live
mailbox, credential, DNS, spend, external mail or re-pin is authorized.
Candidate morgana/row244 94ab4c2fe on a36523713, manifest 6e7e3e3c (8 paths).
Webby APPROVE r1, rev 3008 (webby-0084, REVIEW-r1.md at webby/reviews
ebb3d83bf; request #1757 c30154). Gate on Sage's slot at 81e037d20
(sage-2147): the five gate-lane files whole 51/0, test-task.sh 91/0,
test-release.sh 14/0, mutants M-G, M-L, M-A, M-T and M-F killed.
94ab4c2fe adds only BUILD.md results. Webby's drift check: a36523713..d37210288
changes none of the 8 paths and no path either suite reads; merge-tree clean.
Rulings A and C (sage-1914, sage-2061). The dropped real-model coverage goes
to DEFERRED in the follow-up doc commit.
Integrates origin/huey/system-manager-design 1715efb78 (base 6c75887b0) as one
doc-only commit: docs/plans/2026-10-21_q198-system-manager.md (blob 4fbebd3e,
pinned code evidence base 6c75887b0) plus Huey's 14 BUILD-LOG lines and 7
SESSIONS lines, appended unchanged. Scrooge approved r6 (scrooge-0004) and
confirmed r6.1 N1-N3 closed (scrooge-0005). No package, script, runtime or
queue change. Slices S1-S6 go to the queue under Vikunja 452.
Candidate darkwing/row251 27f01ef63 on 3b0aef995, manifest f2bdd684
(BUILD.md and packages/bus/tests/host-run.test.mjs). Dewey APPROVE r2,
rev 2996 (#1756 c30168). Gate on Sage's slot: bus suite whole in a clean
worktree on f7a77721a plus the two manifest paths (b79ad5f2c adds docs only),
627/627 at 21:30:33Z.
Darkwing's slot runs (darkwing-0114) are on the old base and are not the
gate.
Doc-only append after 7247d80c7. BUILD-LOG takes Gander's ten row 196 lines from 527b9a1e6 unchanged. DEFERRED records Duckworth's C1 (round 1 N2, the dead testerNoSignIn, binding the next serve.mjs row) and round 2 N5 (the Console library routes row decides on library.sync for the tester listener). No test reads either file's content.
Adds REQ-INST-2 after REQ-INST-1 as drafted in sage-2144 and ruled in mos-1204: Jason's Q203 sentence verbatim, marked post-v1 the way REQ-FED-1 is, with Mos's reading (mos-1202) labelled as his. A Version 1.10 technical note records, as fact, that REQ-WEB-2 uses the Console's own OIDC sign-in while the out-of-scope list still names 'Pocket ID and SSO', which Jason hasn't ruled on (vikunja:19/459). The list and the Pocket ID technical note are unchanged. requirements.json goes to 1.10 with 70 ids, and both requirements tests are updated to match. Design row 255 (#1760, Vikunja 458).
Jason approved the buttons in decision 00ed58e2 (vikunja:19/266) and chose
O6 in Q203 (OIDC-only), relayed by Mos in mos-1202 with "Land PRD 1.9 with
REQ-WEB-2 as written". The wording is sage-2067's draft. requirements.json
goes to 1.9 with 69 ids; tasks suite 97/0 and bus requirements.test.mjs 3/0
on Sage's slot.
The business file accepts a kind "library" project entry, and each consumer
that assumed a project root skips it. An organization write whose projects
differ from the file's is refused (M9). The bare mirror is created at the
projectRepo path with no remote. library.file and library.status are human
only and refuse an agent session with human-required.
Candidate herb/row215-on197 dde3445ab on a36523713, Filbert APPROVE rev 2924.
process.test, proof-cli.test and sso.test set the too-open mode with chmod
instead of taking it from the umask. stack-instances.test bootstraps under an
explicit umask and asserts the 0700 config dir under umask 077.
Candidate morgana/row243 6581f750e (code 137bda3af), Webby APPROVE rev 2939.
Lands Sage's sage/row66-r5 at 7ffb640ac, round 4 (r4d 82c830779) rebased onto a36523713 after row 197,
approved by Dewey (comment 30085) and Filbert (30086) on manifest 6cfd812da4ca (23 paths, rev 2905). The
rebase had no conflict. The range-diff is = except one pi-session.test.mjs hunk header. Patch-id without
agents/ is d67275ac4251 on 7b9737953, a36523713 and this commit's parent. Gate (mos-1186): unslop,
harness, cli and every scripts/test-*.sh green on r4d, harness 149/0 again on r5. Landing sessions on a
scratch root from the candidate tree: Claude Code r4ab24630d323 showed the note, the injected notice and
counts checked 2, flagged 1, notices 1. Pi r1dd94171bede is launch only until #383 (Vikunja #454).
An abort or a timeout kills only the local ssh. A non-pty sshd command gets no SIGHUP, so the remote
add can still write its line after the undo's remove. The broker now marks install done only after
`await install(...)` returns. When it never returned, the undo records hostLineLeft with the tag, so
grant.failed and status name the line, hosts.remove refuses until `mosaic hosts sweep` clears it.
The :432 test comment now matches. Row a's enroll does no remote add, so it has no such race.
Candidate gizmoduck/row249-on-8a04 05595794b (Gizmoduck), manifest 3a969bb136bc, approved by
Duckworth in round 1 (rev 2889-2890 request c30068, verdict c30070). Gate on Sage's slot 14:53Z
(sage-2026): grant-executor.test.mjs whole 39/0 and bus 598/0 with no stub left, and C1, which
drops the `if (!installed)` branch, fails G8 and both G23 tests. Webby's N1 on X5 `sleep 30` is
deferred by Duckworth (DEFERRED.md).
The row 197 r8 D5 proof stopped on a leftover hold-add stub. G23 and G13 write release, finish and
remove the test dir before the stub polls again, so the stub looped forever on sshd's side. 4 runs
of the file left 7 stubs. Both hold loops now also stop once $D is gone.
Candidate 4d99c178b, approved by Webby in round 1 (rev 2883, webby-0080). Gate on Sage's slot
13:05-13:07Z: the whole file 3 runs at 37/0 with no stub left, bus 596/0, and a mutant that drops
the hold-add check leaves 2 stubs. The late remote add the leak exposed is row 249 (#1751).
Gosalyn's 6d43618a3 (gosalyn/c2-20b), Webby round 1 APPROVE webby-0076 (rev 2852), manifest 6d3f279f692b,
4 paths. Webby's row 221 notes N1, N2 and N4. Slot runs sage-1969 (red base, the builder's comma
regression) and sage-1971 (14/0, M1-M4 killed). M1/M2 sit at :248 in this commit, not :237 as
BUILD.md says (gosalyn-0111). JSON.stringify leaves DEL, C1, U+2028/9 and bidi raw, a known limit
by sage-1964.
Sage gate on 5c6f73ed7 plus these 4 paths (12:10-12:21Z): the test file alone 14/0, cli 680/0,
every scripts/test-*.sh 429/0. f8276c5eb adds only docs/SESSIONS and docs/case2 sheets no test reads.
Doc only, Sage's sage/row218 89ba79d94 (three commits squashed). Webby APPROVE round 1 (webby-0075,
rev 2848), round 2 (webby-0077, rev 2856) and round 3 (webby-0078, rev 2860). docs/case2/SETUP-SHEET.md
tells Melanie what the agents read, the playground, link and property forms, and what changes for
Bean and Chet, with M5's 1,200 character reply total (mos-1165). It goes to her only after C2-06
lands and on Jason's go (#419). docs/case2/SURVEY-RUN.md is design 10 step 7's run sheet: the
bare mirror as the source, a node check, output lines and refusals from survey.mjs. Claim sources
and rulings are in agents/sage/work/queue-218/BUILD.md. No test reads either doc path.
The survey reads HEAD and has no ref flag, and design 10 step 7 surveys the bus mirror. Row 222 is not
built yet, so this adds one requirement and one test to its brief before the build starts.
Webby approved row 221 round 1 (webby-0073) with four notes that don't block. N1, N2 and N4 are in
scripts/case2-persona-import.mjs and go in before Jason's one import run (sage-1941), as row C2-20b,
owned by Gosalyn and reviewed by Webby. N3 is tooling outside the product and waits in DEFERRED.
Lands Gosalyn's round 1 candidate, 8f403d0d4 on gosalyn/c2-20-r2 (48f044ccc plus its BUILD.md, on
62ddc96cc), approved by Webby (webby-0073, REVIEW-r1 a0a00630e, rev 2808). 22 paths, manifest
20f05e3a6ad5. No 221 path changed between 62ddc96cc and this commit's parent. Patch-id dfbb754c6fb4, the
same as 62ddc96cc..8f403d0d4. The two state.db fixtures and auth.json are short text stand-ins.
Webby's N1, N2 and N4 go to the C2-20b follow-up row before Jason's import run. N3 (mutants.py:48
anchor) is in DEFERRED.md. The script itself runs only under Jason's go (design 10 step 6, 9.1).
Evidence: Gosalyn's singles on my slot, 419/0 on 48f044ccc (gosalyn-0104).
Gate on my slot, 11:07:50-11:19Z on b1fece6f0 plus the 22 paths: case2-persona-import.test.mjs alone
11/0, harness 140/0 (bundle.mjs changed), cli 677/0, and every scripts/test-*.sh green (auth 15,
conductor 17, config 31, discord 78, extension-package 18, foundation 44, land-work 86, queue 156 and 28,
release 14, task 98, all 0 failed). Lands before row 197 r7: no shared paths, and r7's proof candidates
both carry it (sage-1954).
Lands Gizmoduck's round 1 candidate, ed4193316 on gizmoduck/row235-e (one commit on 62ddc96cc), approved
by Duckworth (duckworth-0089, REVIEW-r1 d9ecec514 on duckworth/reviews, #1741 comment 30022). 13 paths,
manifest dad377ca8fe4. No 235 path changed between 62ddc96cc and this commit's parent. Patch-id
c355d2fc457d, the same as 62ddc96cc..ed4193316. broker.mjs keeps row 213's import and decision.raise
creative refusal as landed.
Creative roles (mos-1163, mos-1164, sage-1908): #hostDefinition refuses host-creative-role at the raise
and at the step 1 recheck, and #hostAccess refuses it at host.run before reading the grant record, which
stays for hosts.revoke. Duckworth checked from the code that a creative role can't raise, approve or
spend a host grant, and ruled the upsert mutant equivalent.
Evidence: Gizmoduck's runs on my slot. B1-B37 on 5df4b52c5, and run 2 on 534f2254a (10:12:52-10:14:51Z):
grant-host 9/9, grant-executor 37/37 and grant-enroll 24/24, each run whole, with B16, B23, B27, B38 and
B39 killed. B1-B39: 38 killed, and B17 is equivalent (sage-1904).
Gate on my slot, 10:30:55-10:42:43Z on 29ce1e360 plus the 13 paths: bus 596/0 (its first whole run on
this head, duckworth-0089 N1), business 200/0, cli 666/0, and every scripts/test-*.sh green (auth 15,
conductor 17, config 31, discord 78, extension-package 18, foundation 44, land-work 86, queue 156 and 28,
release 14, task 98, all 0 failed).
Lands Gosalyn's round 2 candidate, f37a65857 on gosalyn/c2-01b-r2 (base fefd54e13; commits 3647a5a93,
88daaac50, f37a65857), approved by Webby at merge scope (webby-0072, REVIEW-r2 efd6c1f02 on webby/reviews,
#1733 comment 30005, rev 2787). Nine paths, manifest 312c16fc4f65. No 231 path changed between fefd54e13
and this commit's parent. Patch-id 59b98b1b3e00, the same as fefd54e13..f37a65857.
Evidence: Gosalyn's singles on my slot, 61/0 on r2 (gosalyn-0099; run 1 60/1 was a test order defect).
Gate on my slot, 10:05:31-10:07:52Z on 62ddc96cc plus the nine paths: library 45/0, and every scripts/test-*.sh
green (auth 15, conductor 17, config 31, discord 78, extension-package 18, foundation 44, land-work 86,
queue 156 and 28, release 14, task 98, all 0 failed).
Webby's N4 (README:88 "A link to ... an attachment is R4" next to the embed paragraph) is doc-only and
stays as restored (sage-1917).
Lands Morgana's round 4 candidate, 2b3e67e36 (base c771a36f4, branch morgana/row213-r4), approved by Webby
(webby-0071, REVIEW-r4 02bb0afb3, rev 2775). Manifest digest 26d4d0ecff56, 35 paths, plus Morgana's
four packet files under agents/morgana/work/queue-213/ (base.txt, BUILD.md, candidate-manifest.sha256,
mutants.py): 39 paths, blobs and modes from the candidate. No 213 path changed between c771a36f4 and
this commit's parent. Patch-id f313e69b6f7e, the same as c771a36f4..2b3e67e36.
Evidence: Morgana's slot run on 2b3e67e36 (sage-1844): singles 191/0 and 31/31 mutants killed.
Gate on my slot (sage-r195land, base 38b83ea5c plus 195's 5 and 213's 39 paths, 09:45:52-09:57:52Z): business 200/0, bus 542/0, harness 140/0, cli 663/0; scripts auth 15/0, conductor 17/0, config 31/0, discord 78/0, extension-package 18/0, foundation 44/0, land-work 86/0, queue 156/0 plus 28/0, release 14/0, task 98/0; the models mutant L1 killed (launch-settings 15/1), restore matched.
Between the gate base 38b83ea5c and 4364dddb0 only docs/plans/2026-10-20_host-credentials.md changed (01e1fe512, 4364dddb0), which no test reads. Row 195 landed as this commit's parent; it shares no path with 213.
Webby's N2 (a host grant for a creative role) is a row 235 acceptance item (mos-1163), not a deferral.
Lands Darkwing's manifest round 1 candidate, 37171f65b (base 4ced5e63d), approved by Duckworth
(duckworth-0088, REVIEW-m1 6afcee2a5, #1693 comment 29988, rev 2758). Five paths:
scripts/case1-accept.sh (100755), packages/cli/tests/case1-accept.test.mjs, docs/TOOLS.md,
agents/darkwing/work/queue-195/DESIGN.md (r7, approved duckworth-0087) and BUILD.md. No 195 path changed
between 4ced5e63d and this commit's parent. Patch-id 656e43ff25de, the same as 4ced5e63d..37171f65b.
Evidence: Darkwing's slot runs: single 22/22 (sage-1829), 12/12 mutants killed and gate cli 662/0 plus
selftests 429/0 on ddf7dce6c (sage-1865, sage-1870).
Gate on my slot (sage-r195land, base 38b83ea5c plus 195's 5 and 213's 39 paths, 09:45:52-09:57:52Z): business 200/0, bus 542/0, harness 140/0, cli 663/0; scripts auth 15/0, conductor 17/0, config 31/0, discord 78/0, extension-package 18/0, foundation 44/0, land-work 86/0, queue 156/0 plus 28/0, release 14/0, task 98/0; the models mutant L1 killed (launch-settings 15/1), restore matched.
Between the gate base 38b83ea5c and 4364dddb0 only docs/plans/2026-10-20_host-credentials.md changed (01e1fe512, 4364dddb0), which no test reads.
Duckworth's notes N1-N3 go to docs/plans/DEFERRED.md in the next commit.
N7: lane-image.mjs:41 inspects a base BuildKit never tagged (row 197 proof try 1).
Brief: the process.test.mjs mode chmod row and the fixture PI_AUTH_FILE row, both after row 197.
Lands Gosalyn's round 3 candidate, a2c72ac95 (commit candidate, base c771a36f4), approved by Webby
(29979, rev 2731). 21 paths: the new packages/library (src, tests, fixtures, package.json, README),
scripts/stack-copy.sh (packages/library/src in COPY_PATHS), packages/cli/tests/stack-copy.test.mjs,
scripts/mosaic and agents/gosalyn/work/queue-212/BUILD.md. The 21-path patch-id, ea84d3e35470, equals
the candidate's.
Evidence: Gosalyn's slot run on round 3: 20 files 451 pass, 0 fail; test-queue 28/0 (gosalyn-0086).
Landing gate (Sage, 08:51-09:03Z, base 4ced5e63d) on a tree that also held row 197's 32 paths:
GATE_PASSED, node tests 981 pass 0 fail (library 39, cli 681, control-board 38, harness 16, webui 51, plus
the scripts/test-*.sh node suites), selftests 429 passed 0 failed. Row 212 lands alone (mos-1162); row
197 waits for an r6 after its lane proof stopped. No 212 path changed between c771a36f4 and this commit's
parent.
`queue review verify-commit 212` -> ok row 212 round 3: a2c72ac95 matches the commit candidate (21 paths).
Lands Launchpad's round 3 candidate, manifest 1bf831f3 (4c90099ea on launchpad/row238-r4, base
c515273db), approved by Webby (29956, rev 2717). Three paths: scripts/stack-release.sh, packages/cli/tests/
stack-release.test.mjs and docs/TOOLS.md. It is row 200's follow-up N1. Round 3 only merges docs/TOOLS.md
onto the row 240 landing: the landed blob plus the one hunk at :599. The 3-path patch-id, b9d0bb0ee3c7,
is the same in all three rounds, and stack-release.sh stays 100755.
Evidence: Launchpad's slot run on round 2, 2afbfbb01: stack-release.test.mjs 196/0 (sage-1794). Sage's
combined gate with row 228 on c515273db plus both rows' paths (07:11:30Z to 07:23:34Z): packages/seat 165 pass, 0 fail; packages/cli 640 pass, 0 fail; all ten scripts/test-*.sh 585 pass, 0 fail (out/, run.log). Row 238's mutant, the sso-config first step dropping --instance NAME, was killed (2 fails), survived: none, and stack-release.sh was restored to its blob.
`queue review verify-commit 238` matches the manifest on all 3 paths. Round 1's N1 stays on the #1744
carry list.
Lands Researcher's round 3 candidate, manifest 82cf98c6 (cf18c42b9 on researcher/row228-r3, base
c771a36f4), approved by Webby (29949, rev 2708). Three paths: packages/seat/src/session.mjs (ZAI_API_KEY
in ENV_ALLOW), packages/seat/tests/session.test.mjs (the pass-through test) and packages/cli/README.md
(the line, with the round 1 and round 2 N1 trims at :711 and :718). Round 3 is the round 2 rebase onto
the row 234 landing; the two seat files carry the blobs approved in rounds 1 and 2.
Evidence: Researcher's slot run on cf18c42b9: session.test.mjs 13/0, host.test.mjs 42/0 (sage-1796).
Round 2's seat and cli runs, 94/0, and its killed mutant stand, since the seat blobs are unchanged.
Sage's combined gate with row 238 on c515273db plus both rows' paths (07:11:30Z to 07:23:34Z):
packages/seat 165 pass, 0 fail; packages/cli 640 pass, 0 fail; all ten scripts/test-*.sh 585 pass, 0 fail (out/, run.log). bus runtime.mjs and webui reads.mjs import only readSessions from session.mjs, which this
change doesn't touch. `queue review verify-commit 228` matches the manifest on all 3 paths.
Lands Darkwing's round 1 candidate, manifest 573ece95a4a9 (ad1b23ab2 on darkwing/row240-r3, base
c771a36f4), approved by Filbert (29945, rev 2696). Nine paths: scripts/case1-hostcheck.sh (new),
scripts/case1-pins.sh (new), packages/cli/systemd/mosaic-hostcheck.service (new),
packages/cli/tests/case1-hostcheck.test.mjs (new), scripts/stack-upgrade.sh,
packages/cli/tests/stack-upgrade.test.mjs, docs/guides/host-run-sheet.md, docs/TOOLS.md and
agents/darkwing/work/queue-240/BUILD.md. File modes match the candidate. case1-hostcheck.sh and
stack-upgrade.sh are 100755. case1-pins.sh is 100644, because the host check sources it.
Evidence: Darkwing's first slot run failed one test, the N1 test's after hook (ENOENT once the
fixture had removed its root). The fix b45852daa is test-only. The second run on b45852daa was green:
singles 37/0, mutants M1-M8 8 of 8 killed, cli 639/0, scripts 585/0. Since c771a36f4 no commit
touches the nine paths. Sage's gate on 060a17b54 plus the nine paths (06:45:05Z to 06:56:21Z):
packages/cli 639 pass, 0 fail, and all ten scripts/test-*.sh 585 pass, 0 fail (out/, run.log). `queue review verify-commit 240` matches the manifest on all 9 paths.
Filbert's notes: N1 (the boot unit orders only mosaic-bus@mosaic-stack) and N2 (the run sheet writes
the apt hook before the first --check) are in docs/plans/DEFERRED.md. N3, repeated DRIFT lines after
bwrap is closed, is by design and is noted with N2.
Lands Gizmoduck's round 3 candidate, manifest 4782c8b5ecb7 (c783d5e39 on gizmoduck/row234-r3, one commit
on 57f59e0c3), approved by Duckworth: content on round 1 (861182fa6, 29919), the round 2 rebase check
(29928, rev 2670) and round 3 (REVIEW-r3.md 7c8c38b69, posted 29935, rev 2683). 41 paths.
Round 3 fixes the two failures in Sage's combined gate with row 233: bus schema.test.mjs now counts 18
tables and 71 triggers for the new hosts and host_grants tables, and stack-release.test.mjs T46 puts both
tables in the untimed restore-guard list, since every write shares a transaction with a grant.* event.
Round 3 rebuilt on the row 233 landing as one commit. 38 of the 39 round 2 blobs are unchanged and BUILD.md
is append-only. Gizmoduck's singles on round 3: stack-release 196/0, schema 1/0.
Evidence: Gizmoduck's slot runs, 25 of 25 mutants killed (A22b and A23 included, A9 structural), singles on
r2 387/0 over 47 files. Sage's landing gate on the c783d5e39 tree: 06:02:12Z to 06:15:26Z, every package except queue 2890 pass, 0 fail (15 packages; bus 539, cli 622), and all ten scripts/test-*.sh 585 pass, 0 fail.
This is code only. The live stack runs from a pinned copy at schema 3i. The 3i to 3j migration runs in the
10-24 window (mos-1145), agent-run under Q173, with a backup first. Duckworth's N10 (hosts.mjs
Object.hasOwn) and N12 (doc-only) go to row 235's carry list.
Lands Darkwing's round 1 candidate, manifest 464ce9eb177a (1a1dc80ca on darkwing's branch), approved by
Filbert (29922, rev 2659). Seven paths: scripts/stack-upgrade.sh (new), scripts/stack-release.sh,
docs/guides/host-run-sheet.md (new), docs/TOOLS.md, packages/cli/tests/stack-upgrade.test.mjs (new),
packages/cli/tests/stack-release.test.mjs and agents/darkwing/work/queue-233/BUILD.md.
Evidence: Darkwing's gate on d99166ade (base e65a3ab4d) 1201/0, mutants m1-m8 8 of 8 killed. The N1 fix
08db6ac3f (flock sleep leak in stack-upgrade.test.mjs) reran c0 20/0 with m1 killed (sage-1708); BUILD.md
doesn't record that rerun. Since e65a3ab4d no commit touches the seven paths. Rows 241 and 242 changed bus
and cli files. Only cli tests read the seven paths, so Sage ran the cli suite on 5465fd52d plus the seven
paths: 617 pass, 0 fail (out233/pkg-cli.log, 05:26:33Z to 05:35:00Z). A combined gate with row 234 failed bus schema.test.mjs:522 on 234's new tables, and
Gizmoduck found a second 234 failure (stack-release.test.mjs T46), so Sage stopped it. Row 234 round 3 fixes
both and rebuilds on this landing, since its T46 lines go in a file this commit changes.
Filbert's N1, N4 and N5 go to row 240 (brief b00d7d94d). N2 and N3 are in DEFERRED.md.
Megavolt's c5a125f4b on megavolt/row242-docs, parent 5fb736b92 (the row 242
landing). Comments and .md only: git-socket.mjs changes comment lines at
:39-44 and :433-435, BUILD.md records N2 and N4. No test pins either path's
hash. Landed without a gate under the doc-only rule.
Megavolt's candidate 635c10924 on megavolt/row242, manifest 1fbfab6c (3 paths:
agents/megavolt/work/queue-242/BUILD.md, packages/bus/src/runtime.mjs,
packages/cli/tests/publish-socket.test.mjs). Duckworth approved (comment 29889, rev 2639).
Mutants M1 and M2, run by Megavolt on Sage's slot: both killed (publish-socket 8/1 each).
Sage's landing gate on 12b8538e0 (96bac588f plus these 3 paths): 15 packages 2826 pass 0 fail (bus 500, cli 594, seat 164), 10 scripts/test-*.sh suites 429 pass 0 fail plus 156 node tests in the queue suite, 03:59Z to 04:12:44Z
The 3 paths are unchanged on refactor since the candidate's base 8fede5fc6. Follow-ups:
Duckworth's doc notes N1, N2 and N4 go in a later doc-only commit; the late-record notice
to the run is Vikunja 440 comment 432. No live change.
Megavolt's candidate 3e3ed303e on megavolt/row241, manifest e8266864 (2 paths:
agents/megavolt/work/queue-241/BUILD.md, packages/bus/tests/land.test.mjs). Tests and
packet only, no source change. Duckworth approved (comment 29870, rev 2628).
Sage's slot on bbf3b1ee8 (0444acd08 plus these 2 paths):
- mutants M1 (#spent recheck, broker.mjs:963), M2 (CAS old value, seat working.mjs:391),
M3 (land-busy, cli git-socket.mjs:351): all killed
- full gate: 15 packages 2797 pass 0 fail (bus 500, cli 565), 10 scripts/test-*.sh suites 429 pass 0 fail plus 156 node tests in the queue suite, 03:21:13Z to 03:34:16Z
Row 232's landing e65a3ab4d sits between that base and this commit. Its 9 paths are
disjoint from these 2 and touch no bus code. No live change.
Blobs of Darkwing's round 2 da2da2f6c on origin/darkwing/row232-r2 (base
8fede5fc6), the 9 manifest paths, manifest 7af3c943. Round 2 is a
rebase-only round over row 230 (c8bc5cf4c): packages/cli/README.md is a
clean 3-way merge with 232's hunk unchanged, and the other 8 paths keep the
round 1 hashes (manifest 7a3b4ea1). Filbert approve round 1 (comment 29829)
and round 2 (comment 29865).
Under --units user every command line and every byte of output is the
base's. Under external the script reads root's system units, starts and
stops none, stages a copy behind AWAITING-UNITS, and confirm gates root's
start on the bus unit's ActiveEnterTimestamp and launches list.
Mutants 17 of 17 killed (BUILD.md). Darkwing's landing gate on da2da2f6c,
03:07:15Z to 03:17:48Z: packages/cli 593 pass 0 fail, 10 scripts/test-*.sh
suites 429 pass 0 fail (plus 156 node tests in the queue suite). Refactor
moved to 0444acd08 since, three commits touching no manifest path. No live
change: the stack runs from copy 4429a104f, and --units user stays the
default.
Blobs of Gizmoduck's r5 0485384e9 on origin/gizmoduck/row210-r5 (base
ad95c888c), the 23 manifest paths, manifest 688d38b9. Duckworth approve
round 2 (rev 2592) and round 3 (comment 29851, rev 2614). Round 3 is a
rebase-only round over row 237 (d7d943199): broker.mjs is a clean 3-way
merge (610af0c4), the 210 hunks sit away from 237's insert, and range-diff
against r4 c43008749 is all equal.
Mutants 52 of 53 killed on the merged tree. M22b is equivalent (rev 2584);
its coverage moves to row 235. Preflight singles: seat sandbox 10/0, bus
project-runtime 3/0. Gate on ad95c888c plus these paths: 15 package suites
2796 pass 0 fail, 10 scripts/test-*.sh suites 429 pass 0 fail (plus 156 node
tests in the queue suite). Refactor moved to 9d165be8c since, two briefs
touching no manifest path. No live change: the stack runs from copy
4429a104f until the 10-24 re-pin window.
1.7 is PRD-1.7-DRAFT.md (sha256 e896746d), approved by decision d52febb5 (prd.approve, yes). 1.8 is r7
82df17347 (sha256 de079281), approved by Jason in T3, relayed by Mos (mos-1154, DECISIONS Q192), so it has no
in-Stack prd.approve. packages/tasks/requirements.json moves to version 1.8 with 68 ids: COS-3, CRED-3, CRED-4,
GRANT-1 to 4, TRUST-1, TRUST-2 and LAND-2 are new. The tasks and bus requirement pins move to 68 and 1.8.
Written by Honker (honker/prd-17-18 2884ee496), reviewed by Duckworth (duckworth-0075, -0076, -0077).
The decision is spent only at recordPublish, after the push, so two checkPublish calls on one decision could
both push and land the commit on two fork refs. checkPublish now refuses publish-busy while an open ticket
holds the same business and decision. A refusal drops the ticket and leaves the decision unspent. Broker test
and a socket race test with exactly one git-receive-pack. Residuals 1-3 in BUILD.md; residual 3 (checkLand)
is a follow-up row.
Built by Megavolt (megavolt/row237 e42415935, duckworth-0068 N1), reviewed by Duckworth (approve, comment
29810, manifest bb777cb0). Sage's gate on 816d48b03 plus these paths: M1 killed, every package suite and every
scripts/test-*.sh green.
Squash of Gosalyn's 96768766c on gosalyn/c2-13a-r2 (base 722136772), the
5 manifest paths, build.patch 56649f9a, manifest fbb0d7e42c67 (Webby
approve round 2, rev 2563). Gosalyn's gate on 96768766c: cli 541 pass
0 fail; scripts/test-*.sh 429 pass 0 fail (summed by script); mutants
10 of 10 killed. packages/cli/README.md is a 3-way merge with row 199
(cb5fdb064): the hunks don't overlap (line 710 vs 1022). host.test.mjs:855
is the only test that reads that file. On cb5fdb064 plus the patch,
case2-unit.test.mjs 30/0 and host.test.mjs 42/0. Refactor moved to
390ea5261 since, a README fix touching no manifest path. The script
runs on a host only in a separate window with Jason's go.
Megavolt's 5d7e4d26e on megavolt/n3-readme, from cb5fdb064. Doc-only: no
test or scripts/test-*.sh reads packages/business/README.md. The text
matches packages/business/src/vocabulary.mjs, where GATED_ONLY has nine
actions.
Squash of Megavolt's 627979a17..86963d281 on origin/megavolt/row199-on-190
(base 00d4cc1f6, row 190's landing), the 37 manifest paths, build.patch
05383075, manifest 35f900fd (Duckworth approve round 1, comment 29779,
rev 2540). Mutant batches 1 and 2 in agents/megavolt/work/queue-199/BUILD.md:
batch 2 26 of 28 killed, M17 and M27 equivalent. docs/TOOLS.md is a 3-way
merge with row 200 (9e1085816): row 199's hunk applies unchanged (patch-id
d88379111e2e) and no test reads the file. Gate on 9e1085816 plus the patch:
15 package suites 2735 pass 0 fail, 10 scripts/test-*.sh suites 429 pass
0 fail (plus 156 node tests in the queue suite). Refactor moved to 76134dfde
since, a brief touching no manifest path. No live change: the stack runs from
copy 4429a104f until the 10-24 re-pin window.
Squash of Launchpad's 30e4bb1a3..9df40878f (round 3 on row 190's landing
00d4cc1f6), the 3 manifest paths: scripts/stack-release.sh,
packages/cli/tests/stack-release.test.mjs, docs/TOOLS.md. Manifest
b3ead55c8b48 (Webby approve round 3, rev 2539, comment 29772).
Patch b2a8f5de18b7. Gate on 9df40878f: 15 package suites 2675 pass
0 fail, 10 scripts/test-*.sh suites 429 pass 0 fail (plus 156 node tests
in the queue suite). Mutants 13 of 14 killed, M12 the ruled equivalent
(sage-1446). Refactor moved to 722136772 since the base, touching none of
the 3 paths. No live change: the stack runs from copy 4429a104f until a
re-pin.
Squash of Darkwing's 176a6bf4b..df65a3d4c on origin/darkwing/row190-r3,
the 25 manifest paths, build-r3.patch efe898c2, manifest cc0ea9e8
(Filbert approve round 3, comment 29713). Design revision 3 in
agents/darkwing/work/queue-190/DESIGN.md. Gate on base d0bbc5c1c with
the patch: 15 package suites 2664 pass 0 fail, 10 scripts/test-*.sh
suites 429 pass 0 fail (plus 156 node tests in the queue suite).
Refactor moved to 99a406ed3 since, a window record touching no manifest
path. Mutants 20 of 20 killed (BUILD.md, round 3). No live change: the
stack runs from copy 4429a104f until a re-pin.
Squash of Morgana's 7f07da4aa..f869fd062 on origin/morgana/row193a (diff
from R1's candidate 44e36fc4c), the three manifest paths, manifest d38de8c9
(Duckworth approve, comment 29595). LEVELS gains collaborator and viewer,
covers() takes a required least level, and an unknown grant level covers
nothing. Gate on base 4385b9ec1 with the patch: packages and
scripts/test-*.sh 2789 pass 0 fail. Refactor moved to c9f374284 since, a
SESSIONS line only. Mutants 7 of 7 killed (agents/morgana/work/queue-193a/
mutants.log on the branch). No live change.
Squash of Gizmoduck's ae3c36f24..44e36fc4c, the three manifest paths,
manifest 225597146daf1c0e3ffe2049636095733f40a3395318f8ba07dad1bf08c0c520
(Duckworth approve, comment 29581). Gate on 44e36fc4c, run by Gizmoduck in
Sage's slot: business suite 173 pass 0 fail, scripts/test-*.sh 10 scripts
422 pass 0 fail, mutants 44 of 44 killed. index.mjs gains one additive
export line. No live change.
Squash of Launchpad's launchpad/row192 53bb59462..37582e820, manifest round 2
6f8cee147713c53652b58d47c5efd15ed47da1efbef6a126464857269b0b7787 (18 paths).
Sage's gate on 088087ac9: package suites 2758 pass 0 fail, scripts/test-*.sh
429 pass 0 fail; mutants 22 of 23 killed, #23 (second origin check) declared
equivalent by Launchpad (sage-1407). New dependency oauth4webapi 3.8.8: the
canonical checkout and any stack copy need npm ci. No live change; the live
re-pin is a window with Mos (mos-1099 item 3).
@@ -21,7 +21,7 @@ system prompt has been generated.
| Variable | Meaning |
|---|---|
| `MOSAIC_SYSTEM_PROMPT_FILE` | Absolute path to the generated system prompt (contracts + optional mission section). Read it; do not modify it. |
| `MOSAIC_SYSTEM_PROMPT_FILE` | Absolute path to the generated per-container system prompt (contracts + optional mission section). Read it; do not modify it. |
| `MOSAIC_REQUEST` | The exact user request text (may contain newlines). |
| `MOSAIC_PROVIDER` | Configured provider name. |
| `MOSAIC_MODEL` | Configured model id. |
@@ -42,7 +42,8 @@ Optional, adapter-specific (documented per adapter):
1. Adapters print ONLY the response on stdout. Status lines go to stderr.
2. Adapters never read configuration files; the resolved settings arrive via environment.
3. Adapters never write outside `/var/lib/mosaic`.
3. Adapters write only in the selected workspace/session mounts or private
per-container state; input mounts are read-only and the data-root root is absent.
4. Adding a worker adapter requires: a new directory, the contract
implementation, and adding the name to the allowlist in
`scripts/mosaic-config.mjs`. A managed-session adapter (below) is selected
@@ -75,7 +76,10 @@ session's workspace and its own process group. Same contract, plus:
| `MOSAIC_POLICY_FILE`, `MOSAIC_TOOLS_FILE` | The bundle's gate policy and typed tools. |
| `MOSAIC_TOOL_SOCKET` | The runner's tool socket, which the typed tools call. |
| `MOSAIC_TURN_MARKER` | `pi`: the extension writes it at `agent_end`; a pi turn that exits 0 without it failed. |
| `MOSAIC_EXTENSIONS` | `pi` only: extension files loaded with `-e`; a missing one exits 2. |
| `MOSAIC_MODEL_ACTIVITY_DIR` | Managed runner's existing writable run directory. Trusted model streaming events publish the fixed `output\n` token to `proxy-first-output` (0600, exclusive create). No event contents or credentials enter it. Claude's private stream reader and Pi's extension signal thinking, tool-use and text activity before final stdout; init/status, tool results and workspace writes do not count. |
| `MOSAIC_MODEL_ACTIVITY_SOURCE` | The harness module may set `adapter` in its bundle environment to declare model events authoritative and disable the runner's stdout activity fallback. Claude declares this because final stdout can be a synthetic error. Pi and mock retain the fallback. The runner reads the declaration from module metadata, ignoring any ambient environment copy. |
| `MOSAIC_EXTENSIONS` | `pi` only: extension files loaded with `-e`; a missing one exits 2. The pi module names two: the gate and typed tools extension, then the unslop check's `tools/unslop-hook/extension.ts` (row 66). |
| `MOSAIC_UNSLOP_LOG` | The unslop check's JSONL log, `<run>/unslop.jsonl`, which the runner sets for both adapters and reads after each turn (row 66). |
| `MOSAIC_CLAUDE_SETTINGS`, `MOSAIC_CLAUDE_MCP_CONFIG` | `claude` only: the bundle's gate hook and MCP server; required. |
| `MOSAIC_THINKING` | The route's thinking level (row 65), which the harness module's `levels()` already checked. `pi` passes `--thinking` (`off`, `minimal`, `low`, `medium`, `high`, `xhigh`, `max`) and omits it when unset, as for `run-task.sh` workers. `claude` passes `--effort` (`low`, `medium`, `high`, `xhigh`, `max`) and requires it; unset exits 2. |
| `MOSAIC_CLAUDE_BIN` | `claude` only: absolute path of the CLI to run, from the host's environment (the bus unit pins it). Unset or empty runs `claude` from `PATH`; a relative path or a non-executable file exits 2. |
@@ -83,10 +87,30 @@ session's workspace and its own process group. Same contract, plus:
The layers each adapter relies on, and what they don't cover, are in
`packages/harness/README.md`.
Claude uses `--output-format stream-json --verbose --include-partial-messages`.
The adapter's `stream.mjs` consumes those events and prints a complete final
result, including error results, with the same newline as the CLI's text format.
CLI failures retain their nonzero exit status. Claude's model events alone mark
activity; its final stdout may be a synthetic error. The runner retains stdout
activity marking for Pi and mock adapters. Malformed or incomplete streams emit
only the fixed diagnostic and fail the turn; a failed or interrupted first turn
does not persist a reusable session ID. The helper is mounted read-only and
its digest is recorded in the launch bundle. A private completion pipe separates
handled CLI exits from helper launch/runtime failures, even if their exit codes
collide. The helper acknowledges only after its answer has been handed to
stdout, and the token names its exit status (`complete <status>`). The adapter
emits the fixed diagnostic if completion is absent, the stream is invalid, or
the helper's actual exit differs from the acknowledged status (the helper died
while its answer was draining), suppressing helper stacks and shell crash text. CLI stderr
keeps its existing channel; the CLI does not inherit the completion pipe. No extra
writable mount or completion file is needed. Pi retains print mode and signals
activity through its existing extension. Mock remains a test-only echo.
### A role's skills (row 64)
A managed session's skills reach both adapters as text in the bundle's
`prompt.md`, which they pass with `--system-prompt`. Neither adapter loads a
`prompt.md`, which they pass as a file: `pi` with `--system-prompt <path>`
and `claude` with `--system-prompt-file <path>` (row 213). Neither adapter loads a
skill of its own: `pi` keeps `--no-skills`, since role sessions never get
`MOSAIC_SKILLS`, and `claude` keeps `--disable-slash-commands` and
`--restricted`. Sage chose this on 2026-10-19 from a probe, recorded in
@@ -104,5 +128,23 @@ skill of its own: `pi` keeps `--no-skills`, since role sessions never get
The cost is prompt size: a role's skill text is in every turn, where the
other routes load a skill when it's used. The bundle caps a role's skills at
64 KiB together, since`claude` passes`prompt.md` as one argument and Linux
caps one argument at 128 KiB.
64 KiB together. The cap dates from when`claude` passed`prompt.md` as one
argument, which Linux caps at 128 KiB; row 213 passes the file instead, so no
local user reads the prompt in `/proc/<pid>/cmdline`. Pi 0.85.1 uses the path
string itself as the prompt when the file is missing or can't be read, so the
pi adapter exits 2 unless the path is a readable regular file.
### The unslop check (row 66)
Both adapters run the mechanical writing check from `tools/unslop-hook`,
driven by one `lists.json`. `pi` loads it as its second `-e` extension.
`claude` runs `claude-hook.js` from the bundle's `settings.json`: the Stop
hook checks the turn's replies, and the UserPromptSubmit hook adds the
correction notice as context on the next turn when the last reply had
tells. Each hook command ends `; exit 0`, so neither blocks. Both log to
`MOSAIC_UNSLOP_LOG`, and the runner adds a note for the operator to the
next RESULT it sends (`packages/harness/README.md`, the runner). The
harness modules mount the three files read-only at their own paths, and
the manifest records their digests. `MOSAIC_UNSLOP_HOOK` and `UNSLOP_LISTS`
aren't in the session environment's allowlist, so a managed session can't
@@ -16,6 +16,22 @@ not fleet seats. Keep changes in `/mnt/storage/src/mosaic-stack`; do not modify
| Rocko | General development, investigation, testing, and review | T3 session (Codex, gpt-6.1-sol, thread d99326cc, lead decision 122; Claude thread b84bb264 retired 2026-10-12); launcher Claude Code, Sonnet model | `agents/rocko/launch.sh` |
| Filbert | General development, investigation, testing, and review | T3 session (Claude, Opus 5.5, thread 048f3c63, non-sandbox reviews only, lead decisions 130 and 134; Codex threads f712d8af and 50342f6a retired 2026-10-13, Claude thread 9cb9731e retired 2026-10-12); launcher Pi, `openai-codex/gpt-6-astra:low`, not to be used under R26 until it changes (lead decision 69) | `agents/filbert/launch.sh` |
| Researcher | Source-grounded technical research and evidence | T3 session (Claude, Sonnet 5.5, thread 9bac0794, rows 97 and 98, lead decision 124); Haiku rows (71, 80, 84, 88, later 96) run as subagents Sage dispatches with model haiku, effort high and a worktree (lead decision 129); Haiku thread c98aaf4a retired 2026-10-13 unused; launcher Pi, configured Mosaic model | `agents/researcher/launch.sh` |
| Launchpad | Builder, MVP T1 row 192 (Q175 SSO phase 1) | T3 session (Claude, Opus 5.5), started by Sage under mos-0974/0977 | none, T3 only |
| Morgana | Builder, MVP T1 row 193 (human users and RBAC) | T3 session (Claude, Opus 5.5), started by Sage under mos-0974/0977 | none, T3 only |
| Honker | Builder, MVP T1 row 194 (agent lifecycle) | T3 session (Claude, Opus 5.5), started by Sage under mos-0974/0977 | none, T3 only |
| Gander | Builder, the human boundary across uids (P19 333, #1694) | T3 session (Codex, gpt-6.1-sol), started by Sage under mos-0977 | none, T3 only |
| Herb | Builder, a second gate lane (#1695) | T3 session (Codex, gpt-6.1-sol), started by Sage under mos-0977 | none, T3 only |
| Bushroot | Builder, retire the control board writer on 7331 (#1696) | T3 session (Claude, claude-haiku-5-5), started by Sage under mos-1008 | none, T3 only |
| Megavolt | Builder, MVP T1 item 6 (agent credentials and git identity, #1697) | T3 session (Claude, Opus 5.5), started by Sage under mos-0974/0977 | none, T3 only |
| Quackerjack | Builder, federation R5 and R2 (#414) | T3 session (Claude, claude-haiku-5-5), started by Sage under mos-1023 | none, T3 only |
| Gizmoduck | Federation design (#414) and builder of FED R1 | T3 session (Claude, Opus 5.5, thread 9312a896) | none, T3 only |
| Webby | Reviewer: Case 2 designs, rows 192 and 194 | T3 session (Claude, Opus 5.5, thread 03086006), started by Mos (mos-0981) | none, T3 only |
| Duckworth | Reviewer: federation designs, row 193 | T3 session (Claude, Opus 5.5, thread ffceafec), started by Mos (mos-0977) | none, T3 only |
| Della | Builder, email plan (Vikunja 460) and row 224 (C2-05b) | T3 session (Codex, gpt-6.1-sol, thread 66735a7f), started by Mos | none, T3 only |
| Scrooge | Builder of row 252 and reviewer of row 272 | T3 session (Claude, Opus 5.5, thread 629b6cd3), started by Mos | none, T3 only |
| Huey | Builder, row 272 (T1 sessions) | T3 session (Codex, gpt-6.1-sol, thread cabd45ca), started by Mos | none, T3 only |
| Louie | Builder and research, editor evaluation and row 174 | T3 session (Codex, gpt-6-luna, thread bfd13d49), started by Mos | none, T3 only |
| Ludwig | Builder and reviewer, post-v1 email PRD and row 258 (E01) | T3 session (Claude, Opus 5.5, thread 8615b2a6), started by Mos | none, T3 only |
| Sage | Project lead: coordination, review, integration; earlier DYOR strategy records retained | T3 session (Claude Code); Pi launcher `zai/glm-5.3:high` retained | `agents/sage/launch.sh` |
Each script supports `--check` and `--fresh`. Normal launches resume the agent's
@@ -31,6 +47,14 @@ its launch configuration remains fixed, including on resume. Use Filbert's
wrapper to select that configuration; a direct shared-helper invocation uses
its own supplied flags or the system defaults.
Any run that includes the webui suite, whether a seat's slot run or a landing
gate, sets `MOSAIC_REQUIRE_EDITOR_BUILD=1`, so a missing editor toolchain fails
the run instead of skipping the rebuild test. A worktree that links the
canonical `node_modules` also runs `npm ci --ignore-scripts --no-audit --no-fund`
in its own `packages/webui` first. The root install carries esbuild 0.28.1
through pi-coding-agent, and the rebuild needs the 0.28.2 that
- Still required: Sage CLEAR for targeted runs; fix first-run failures; supporting
scope acceptance against row 283; 216 index/readLibrary fixture comparison;
285/runtime drift check; full library/business/bus/cli/harness/seat suites and
every scripts/test-*.sh on Sage's gate; mutant execution; Webby approval.
- Before in-review, perform brief's obsolete-code/key search and report outside
ownership hits to Sage. render.mjs/render.test.mjs hits belong to 225.
- No queue changes, protected branch pushes, gate claims or acceptance claims.
Static obsolete-code/key search completed: only packages/library/src/render.mjs:6 and packages/library/tests/render.test.mjs:58 match no-cited-answer; both belong to row 225 per standing ruling. No owned-path hit. Repeat before in-review after dependency changes.
## Webby early look 0939c0682 / webby-0249 and sage-3668/3670
This remains an untested draft. The follow-up adds tests only; production E4
changes wait for the held-lock regression's first RED under Sage CLEAR.
- E1: added an ordinary actor `mallory` that sets both `human` to itself and
`replyLimits`. The existing role/tester actors did not distinguish M2 because
the actor-shape exclusions rejected them independently of the human comparison.
M2 is still unrun; no kill claimed.
- E2: added a real bus event assertion for `agent: "acme/scribe"` from a file's
Mosaic-Agent trailer. The cited tip includes a later unrelated commit, so the
event must store the file commit rather than the library tip. thread.messages
must show `last === file` for that unchanged path. Supporting scope still waits
for row 283's real fixture, as ruled.
- E3: sage-3668 accepts direct writer.write tests under chief and tester actors
as substitutes for the brief's setter cases (brief lines 483-491 at base
45dca69f6). Correction to the early-look premise: organization.set DOES exist,
broker.mjs:4701/4709, but ORGANIZATION_KEYS excludes replyLimits; instances.set
also cannot carry it. Direct writes exercise the shared M11 boundary those
setters cannot reach with that input. Sage confirmed the accurate reason in
sage-3670; the unrelated actor case remains required.
- E4: traced readSyncState -> withLibraryLock -> library-sync-busy after five
seconds -> servedMirror catch-all -> null served -> misleading citation-invalid.
New real-flock/socket test first proves the cite valid, holds the lock, asserts
the exact citation-unavailable reason the agent receives, verifies no insert,
and checks fixed fallback delivery and recovery after unlock. Additional tests
distinguish malformed sync state from absent/new mirrors, and assert that the
actual runner retry request contains that reason. These tests are expected RED
until the fix. Planned production change: only an absent mirror or legitimate
empty state yields null; other failures become GuardError citation-unavailable;
bodies without path cites do not require the mirror lock. Add the code to
GUARD_CODES so the runner sends the agent that reason on its one retry. Per
sage-3670, existing four fallback bodies can remain only if that delivery is
verified. M5 restores catch-all behavior; authored, not run.
- E5: first-library-project selection is a Launchpad handoff implementation
choice, not a validated rule that a business can only have one library.
Cites into another library remain a limitation. No mapping/schema rule added.
- E6: the broker's full guard table now runs as both coder and research.
- E7: new citation-runtime.test.mjs starts the real runtime, reads limits from
the real organization file, then changes, corrupts and removes that fixture
file and checks library.status without replacing the library adapter.
No Node, tests or mutants ran. No test that predated row 217 changed.
## Webby follow-up 192049c98 / webby-0258
E1, E2, E6 and E7 closed statically; no executed acceptance claimed. E3 correction and E5 limitation accepted. E4 tests accepted statically; real RED then production fix/green remain on hold for Sage CLEAR, with supporting scope waiting on 283. F1: citation-helpers status now uses its mutable served value, matching guard/last after setServed instead of reporting the original fixture commit. Test-only fixture correction, unrun. manifest.r3.sha256 records the updated helper; no production or old-test changes.
## Round 2 / sage-4037 — 2026-10-24, Untested
New branch `beakley/row217-r2` from published `dde5b8496`, rebased exactly onto
`origin/refactor` at `e0c6142f3` (109 upstream commits since `45dca69f6`). The
published original branch is unchanged; no amend or force-push. The replayed
four commits are b9ef816ff, 7400509ba, a447880cb, 2655ec010. Full range-diff:
`rebase-r2.range-diff.txt`. Last commit is `=`, the first three are `!` from
conflict context/indentation and append-log placement described below.
Conflict resolutions:
- broker.mjs: retained landed grants.scope/grants.scope.set dispatch and added
library.limits.set to the organization verb dispatch; neither path removed.
- runtime.mjs: retained grants.scope.set and added library.limits.set alongside
it; retained query/sync wiring and all new base lifecycle behavior.
- organization.mjs: retained row 239's beforeWrite/revoked wrapper, placing both
M11 fences before validations/revocation as on the old candidate. A refused
reply-limit write cannot invoke beforeWrite.
- library/index.mjs: retained C2-05a buildIndex/query exports and added the guard
and reply-limits exports.
- BUILD-LOG.md and docs/SESSIONS.md: retained upstream appends followed by all
Beakley appends. Static byte-prefix checks prove the entire e0c6142f3 log
histories survive; all original Beakley entries also survive.
- business.mjs, cli README and sandbox.mjs auto-merged. Static diff against the
target confirms only this row's TOP_KEYS addition, README paragraph and one
import-free protocol mount; landed supporting scope and room-address mount
remain intact. runtime diff contains only the approved import, injected
guard/limits/last adapters and setter dispatch, now beside grants.scope.set.
Correction recorded honestly: the first unpublished rebase attempt used an
unbounded marker regex that removed code after a conflict. The diff stat caught
it immediately; aborted the rebase and repeated with bounded markers. No result
from that discarded attempt was pushed. The successful first replay matches the
original 589 insertions/20 deletions; no broad deletions remain.
Implemented E4 under sage-4037's explicit direction to make the product fix
while keeping all tests unrun. This supersedes the earlier planned RED-first
execution order; no RED or green has been observed. The existing regression
cases predate the fix. GUARD_CODES now includes citation-unavailable. Only a
mirror confirmed absent by lstat, or readSyncState's legitimate empty state,
yields no served commit. Other read/lock/metadata errors give the fixed safe
reason: "The library is busy or unavailable. Retry the answer when the library
is available." The runner receives it through BusError.reason and includes it
in its one retry request. The existing four fallback bodies remain. Plain,
web-only and fixed replies require no mirror read, so a busy mirror cannot
block the runner's fixed fallback. M5's real production anchor now exists.
Supporting scope after row 283 (`8d2856ee3`): added two broker tests using real
mapping/reader classification, not a scope stub. A path in both supporting and
playground refuses as canon; an agent-committed supporting path stores
scope=supporting, agent=acme/scribe and its file commit in message.checked.
C2-05a comparison: index-build.mjs builds its file map directly from readLibrary
files; indexFor calls that same reader at the requested commit. Added a real
fixture test comparing the index set, readLibrary set and libraryReader.lines
admission, including supporting, unmapped Markdown and .canvas. This comparison
is authored and statically traced, not executed; numerical results wait on CLEAR.
Current packet: manifest.r4.sha256, relative to e0c6142f3. No test file already
present at that base was edited. No Node, npm, tests, mutants or webui build run.
Ready for CLEAR after Lena's row 296. On CLEAR, install with npm ci
--ignore-scripts --no-audit --no-fund in THIS worktree root and packages/webui;
never link to canonical node_modules or run npm/rm in the canonical checkout.
Use short mktemp TMPDIR and timeout -k 10. Any old-test red goes to Sage before
an edit. Full green gate, mutants and Webby verdict remain outstanding.
Range-diff receipt rendering trims trailing whitespace on diff separator lines; no substantive range-diff content changed. This removes whitespace warnings caused by embedding raw diff output in a tracked text file.
Final base-to-candidate whitespace check found a trailing blank line inherited from Launchpad in limits.mjs; removed it without behavior changes. manifest.r5.sha256 supersedes r4 for the exact candidate file hashes.
## CLEAR sage-4042/4043 — execution started 2026-10-24
and npm-webui.log; m1-anchors.txt; m5-red/ and mutants/. All are text, no binary
artifact added. All Node/mutant/npm runs used the short TMPDIR and timeout -k 10.
Both node_modules trees are local npm ci installs. No canonical npm/rm or
canonical dependency link. No further runtime/source changes after the tests.
Acceptance formerly waiting on dependencies is executed: real row283 supporting
canon refusal and supporting/agent event pass; the C2-05a readLibrary/index set
comparison passes; runtime readRaw live/corrupt/missing-file test passes; runner
retry request carries the E4 availability reason. The repeat obsolete-name
search finds only render.mjs:6 and render.test.mjs:58, owned by row225; no owned
hit. First-library selection remains the accepted E5 limitation. Webby-0274 N1
is a nonblocking wording limitation: configuration faults share the safe
busy-or-unavailable retry text. No policy/schema restriction was invented.
Current complete changed-file manifest over e0c6142f3..candidate is
candidate-manifest.sha256, excluding itself to avoid a circular hash. It includes
source, tests, records and evidence. Earlier numbered manifests are historical.
Formal Webby verdict and all scripts/test-*.sh at landing remain Sage's steps;
this is verified for review, not an integration/deployment claim.
Exact negative-test logs retain Node's whitespace-only diagnostic lines. Whole diff --check reports those 12 blank-line padding warnings in run-r2 logs; source/docs diff --check excluding captured run-r2 evidence is clean. No source whitespace problem or test failure is hidden by that exclusion.
row 217: citation runner retry and acceptance draft (Untested)
## BUILD-LOG.md ##
-@@ BUILD-LOG.md: Row 299 (573, #1806, Gander, Filbert): before, the P10 band test timed a fault r
- 2026-10-23T17:29:46Z | Gyro Vikunja571 sage-3542 Connections amendment | Branch gyro/editor-connections-design cut exactly from landed PRD1.17 30e6bb680; read REQ-LIB-5 in that PRD. Replaced stale J-b waits in parent and W4. Proposed W8 owns current authorized Markdown/DOCX links/backlinks list, labels, versioned refresh, leakage refusals and fixture tests. Build order under mos-1470/comment961 is W7 closed routing candidate, W8 landing, then W7 human first-real-import opening. No REQ-LIB-8 condition or acceptance change. Q234/mos-1363/S0 M1-M14 and post-10-27/MVP priority fixed. Static diff, twelve brief sections and append-only checks pass. No repo Node, tests, build, browser, queue mutation or live action. Fenton reviews after authorized docs branch push; Sage lands on approval.
+@@ BUILD-LOG.md: remain; no live state, schema or bus policy change.
- 2026-10-23T17:32:37Z | Gyro sage-3544 fenton-0016 N1/N2 delta | Before: W7 Gate/final real-conversion list omit the W8 build-order cross-reference and W8 human-view filtering cites agent settings. After: both locations explicitly put W8 landing before human opening as mos-1470 build order, not acceptance; comment/tracked-deletion links are not current story links and never appear in the human Connections view regardless of agent settings. New commit atop approved 5af060fb5, no amend. Static diff and append-only checks pass. Docs only, no repo Node/tests/live action. Fenton checks only this delta.
-+
+ 2026-10-24 | Goldie | Row265 / #1770 verified (mos-1567, sage-3942) | Approved correction adds solely address import pin + Row265 comment to project-runtime.test and one pure-source RUNNER_FILES mount; new block checks parser has no imports. Serialized fresh-short-TMP timeout-k10: unchanged sandbox10/10, parser15/15, rooms18/18, full bus957/957, twelve named refusal mutants killed (each Node1, driver0), restored parser15/15 + rooms18/18. All positives zero fail/skip/cancel; every mutation restored full broker SHA71b32ee4. Old first-red evidence retained, no other old-test change. Slot returned goldie-0034; Boyd packet explicitly includes mount-list review, candidate push next.
+ 2026-10-24T07:18:53Z | Sage | Row 327 (#1825, Bradford, Poe and Dewey) LANDED 68c08b4e7. Before: refactor at 94d9e90a6; the push guard was a scratch script with no reviewed-binary check. After: scripts/push-check.sh and scripts/test-push-check.sh on refactor, 3 commits cherry-picked onto 6a5e12511 with blobs equal to the round 3 tip d858c9f8b, plus doc commits 76f84465f and 68c08b4e7. Binaries are found by numstat or a NUL in the first 8000 committed bytes, regardless of attributes; each needs its sha256 and path in an approved latest-round candidate; an unconfirmed queue tail exits 2. Reviews: Poe c31525 rev 3882, Dewey c31526 rev 3883. Gate: 1st run 06:57Z RED, not the candidate: canonical node_modules was empty from 05:45:15Z (sage-4023). Rerun with its own root npm ci GREEN 07:15:49Z: 17 package suites 0 failures (cli 986, plugins 119, webui 418), 11 scripts exit 0, push-check 6 mutants KILLED; skips are the queue canonical-root check and the row 244 live provider cases. The landed push-check.sh passed its own push (NO_BINARY, NO_ATTRIBUTION, PUSH_READY). mos-1575: gates install their own node_modules; canonical restored with npm ci (128 packages).
+2026-10-23 | Beakley (88b97f65) | Row 217 #1718 takeover, before implementation | Clean base 45dca69f6 on beakley/row217. Recovering Launchpad handoff for citation guard, live settings, page store and runner retry. Acceptance is C2-06/design 5.2 plus sage-3595/3599/3602. Tracking agents/beakley/work/queue-217/BUILD.md; no product changes or Node/tests; Sage CLEAR required.
+
+2026-10-23 | Beakley (88b97f65) | Row 217 #1718 untested draft checkpoint | Continued Launchpad e25ef0373; added runner retry/text/note implementation, pure protocol constants and sage-3640 approved single read-only mount, CLI documentation and new acceptance test files. Static checks caught missing projects compatibility, async request mutation and Git pathspec matching; bounded fixes and regression tests authored. git diff --check clean. No Node/test/mutant executed; Sage holds CLEAR. 283/216/285 dependency checks and all acceptance execution remain open. Packet agents/beakley/work/queue-217/MANIFEST.md.
@@ agents/beakley/work/queue-217/mutants.py (new)
## docs/SESSIONS.md ##
@@ docs/SESSIONS.md: are never rewritten or removed; corrections are new entries.
- 2026-10-23T17:48:43Z | Scrooge (629b6cd3) | Row 252 Console inbox Approve and Deny (#1753) | Rebased onto 306 landing as 580037105 (range-diff all =), slot run bus 907/0 webui 410/0 cli 943/0, in-review revs 3608/3609, Webby r1 APPROVE, J1-J19 specs to Sage; Sage landed 45ea3fa0d (done rev 3616). Part 1 mutant results were never in BUILD.md; they went to Sage by T3 (scrooge-0252-mutant-specs).
- 2026-10-23 | Sage (1ef1e4f8) | Rows 308 and 252 landings, 571 Connections design amendment, Vikunja 597 | 308 (PRD 1.17, #1815) landed 30e6bb680 and 252 (#1753) landed 45ea3fa0d (replay of 580037105 onto 30e6bb680, range-diff all =), each after a full gate on the landed tree (252 also J1-J19, J11c and J18 equivalent); Gyro's 571 amendment (Fenton APPROVE) landed e8bb13df8; Vikunja 570, 435 and 597 done, canonical webui esbuild 0.28.2; queue revs 3589-3616 committed 59f013247
- 2026-10-23 | Sage (1ef1e4f8) | Vikunja 571 W build rows; rows 13, 42, 257 and 289 check | Filed the design's ten W rows as queue rows 309-318 (revs 3617-3626, owners set to unassigned 3627-3636, queue commit 293b42fee pushed); Vikunja 571 done (comment 994). Row 13's candidate fd72d2689 is on refactor, gate is Monday's row 7 ledger run; 42 paused under mos-1184; 257 post-v1; 289 waits on 214 and 288. Slot released 17:56Z.
+ 2026-10-24T04:27Z | Goldie (a13dd6d5-5e73-4b7d-8318-02abeff24940) | Row265 / #1770 C2-09b rooms | Goldie owns build, Boyd reviews under sage-3915. New goldie/row265 worktree at ec86f2c84, claim rev3814; room verbs/parser/new tests prepared, no old tests changed. Sage-3932 slot: new parser14/14 and rooms18/18 passed; whole bus in progress before refusal mutants, stop rule active.
+ 2026-10-24T04:35Z | Goldie (a13dd6d5-5e73-4b7d-8318-02abeff24940) | Row265 / #1770 verified | First slot stopped at project-runtime import pin. mos-1567 narrowly authorizes pin and pure-source mount correction. sage-3942 rerun: sandbox10/10, parser15/15, rooms18/18, bus957/957, twelve refusal mutants killed/restored SHA71b32ee4, parser15/15 + rooms18/18 again. Slot returned goldie-0034; no further test runs. Boyd reviews RUNNER_FILES alongside rooms; own-branch push/claimant in-review next.
+ 2026-10-24T07:18:53Z | Sage (1ef1e4f8) | Row 327 / #1825 push guard landed (mos-1572 option A, mos-1575) | Gate went red 06:57Z on an empty canonical node_modules (Glomgold's webui npm ci through a link to canonical, glomgold-0011); rerun with its own npm ci GREEN 07:15:49Z on 1bd214e38; pushed 68c08b4e7 07:18:03Z; #1825 closed c31530; canonical restored (128 packages); brief template rule 4db23a51f | landed
+
+2026-10-23 | Beakley (88b97f65, Codex gpt-6.1-sol) | Row 217 #1718 takeover under Q245 | Registered beakley/row217; read brief/design and standing Sage rulings; awaiting Launchpad ref before implementation. Queue next refused linked worktree; reported to Sage. Untested, no Node/test run pending CLEAR.
3: b6c3129d2 ! 3: a447880cb row 217: early-review coverage and availability RED cases (Untested)
@@ Commit message
row 217: early-review coverage and availability RED cases (Untested)
## BUILD-LOG.md ##
-@@ BUILD-LOG.md: Row 299 (573, #1806, Gander, Filbert): before, the P10 band test timed a fault r
+@@ BUILD-LOG.md: remain; no live state, schema or bus policy change.
2026-10-23 | Beakley (88b97f65) | Row 217 #1718 takeover, before implementation | Clean base 45dca69f6 on beakley/row217. Recovering Launchpad handoff for citation guard, live settings, page store and runner retry. Acceptance is C2-06/design 5.2 plus sage-3595/3599/3602. Tracking agents/beakley/work/queue-217/BUILD.md; no product changes or Node/tests; Sage CLEAR required.
2026-10-23 | Beakley (88b97f65) | Row 217 #1718 untested draft checkpoint | Continued Launchpad e25ef0373; added runner retry/text/note implementation, pure protocol constants and sage-3640 approved single read-only mount, CLI documentation and new acceptance test files. Static checks caught missing projects compatibility, async request mutation and Git pathspec matching; bounded fixes and regression tests authored. git diff --check clean. No Node/test/mutant executed; Sage holds CLEAR. 283/216/285 dependency checks and all acceptance execution remain open. Packet agents/beakley/work/queue-217/MANIFEST.md.
4: dde5b8496 = 4: 2655ec010 row 217: keep fixture status on its current served tip (Untested)
✔ row 323: literal library key refuses through final business validation (176.986326ms)
✔ row 323: a library project refuses through the factory profile plan (36.685902ms)
✔ row 325: the Case 1 project's sole key matches the repository project id (7.063988ms)
✔ row 325: real business validate reports the copied repository project valid (203.591785ms)
✔ row 325: the old mosaic-stack project key refuses against those same project bytes (227.47487ms)
✔ the role file loads and resolves through loadBusiness (22.21166ms)
✔ the shipped file is exactly the approved list (0.355811ms)
✔ the resolved record matches the approved list, so a widened file fails (4.433743ms)
✔ the chief of staff holds role.launch, message.send, role.end, organization.change, record.write, instance.name, role.hire and role.fire; every other action is gated (6.025087ms)
✔ the pm does not hold role.launch (7.814194ms)
✔ a business grant of a gated action through limits does not widen the role (5.309288ms)
✔ a limit that drops role.launch leaves the chief of staff with no launch block (5.488981ms)
✔ a launch block whose by is the pm instance is refused (4.031539ms)
✔ the contract names no duty to talk to the human and the pm contract no launch (1.077581ms)
✔ the instance takes no credential references and no tracker (7.111256ms)
✔ C2-04: business validate and resolve skip a library before code projects and credential checks (581.819531ms)
✔ usage errors exit 4 (330.347677ms)
✔ validate: a good business exits 0 and prints instance digests (80.712835ms)
✔ validate: project files (358.68705ms)
✔ validate: missing files and a broken system config (272.747082ms)
✔ validate: credential reference problems exit 2 and name each one (75.47514ms)
✔ validate: a not-issued store agent dated today passes, and an issued one with a past expiry fails (152.378642ms)
✔ validate: a token file inside the repository is refused (76.459487ms)
✔ validate: role definitions come from MOSAIC_ROLES_DIR (210.323656ms)
✔ resolve: prints one instance's record (260.543734ms)
✔ resolve: refusals (375.881441ms)
✔ parse: exactly one of file or env, plus the service's date (3.551882ms)
✔ check: a good file has no problems (1.2198ms)
✔ check never opens the file: a write-only token passes (0.477268ms)
✔ check: file problems (1.60977ms)
✔ check: token files can't live in the repository or dataRoot, even through a linked directory (1.508979ms)
✔ check: dates and environment references (0.686041ms)
✔ each definition loads, with a contract file, and is exactly the approved list (4.83466ms)
✔ an organization file that declares them passes, and each resolves to least privilege (10.307081ms)
✔ the chief of staff launches each one; no other role does (11.082937ms)
✔ a C-suite role can't be made the launcher: launch.by must hold role.launch (5.052598ms)
✔ limits can narrow a C-suite role but never widen it (4.524289ms)
✔ any unknown key, tool, action or version in a role file is refused (4.904699ms)
✔ row 298: checkGrantScope takes the D2 shape and refuses anything else (2.752624ms)
✔ row 298: a missing scope is empty and a bad one falls back to empty, which covers nothing (0.482721ms)
✔ row 298: a Gitea grant is in scope only when its agent and every project are listed (0.341447ms)
✔ row 298 (sage-3594 Q2): host commands match whole argv tokens, and enrollment is never in scope (0.467524ms)
✔ row 298: a bad grantScope in the file still loads, and the read shows the fallback (18.355754ms)
✔ row 298: the writer checks the scope, logs the change and removes the key for {} (142.313501ms)
✔ row 298 (sage-3594 Q1): the general writers can't write grantScope (25.353249ms)
✔ REQ-WAIT-1: GATED_ONLY is exactly the hard waits; the new actions are in the vocabulary (1.86466ms)
✔ REQ-ROLE-2: END_PROTECTED includes the assistant's thread definition (0.234237ms)
✔ REQ-COS-3: role.hire and role.fire are routed, not hard waits (0.300439ms)
✔ REQ-WAIT-3: every action is routed or a hard wait, never both, and the routed list names only actions (0.967731ms)
✔ REQ-WAIT-3: instance.name is routed under REQ-MSG-2 (1.5), not a hard wait (row 141, sage-0589) (1.313696ms)
✔ REQ-WAIT-2: a role listing a hard wait at either class is refused; the actions that left can be granted (5.343386ms)
✔ S1: the business file refuses hosts at the top level and in a role, and host.<id> references (56.500208ms)
✔ T1: address, user and host key checks, which the enrollment raise uses (11.374442ms)
✔ T26: no wildcard and no shell, runner or interpreter as a prefix (2.722004ms)
✔ D6: argv shape and the literal prefix match (0.922698ms)
✔ C2-04: instance settings skip a library while checking a later code project (98.596648ms)
✔ row 165 read lists each instance and the definitions add accepts (16.615936ms)
✔ row 165 add: two instances join, validate exits 0, the log names the human, and the writer asks for no restart (row 194, D3) (308.207149ms)
✔ row 165 change: definition, vars and launch membership log before and after; none asks for a restart, the bus reloads (row 194, D3) (180.35178ms)
✔ row 165 refuses each validation failure and leaves the file's bytes alone (44.040709ms)
✔ T19 add of a credentialed definition writes store references dated today, names its bot, and validate exits 0 (101.60641ms)
✔ T19 add of a definition that declares host writes references for its token services only (12.273146ms)
✔ row 165 refuses a definition change to or from one that declares credentials (6.011439ms)
✔ row 165 a vars or launch change on an instance with its binding succeeds and keeps the binding (87.081633ms)
✔ row 165 refuses an END_PROTECTED definition and every change to a protected instance (9.425714ms)
✔ row 165 refuses while a project file doesn't resolve, as validate would (21.508015ms)
✔ row 165 refuses a stale revision and leaves the file's bytes alone (13.794117ms)
✔ row 65 an instance write refuses harness-off, thinking-unsupported, an unknown model and a partial fallback (38.79158ms)
✔ row 213 a creative instance is the human's: add, vars and definition changes, persona digest only (105.47603ms)
✔ row 256 T1-T3, T5 the human deletes a creative instance, no other actor does, and the assistant stays (106.119319ms)
✔ row 256 T4 the human's delete of the only listed instance, a creative one, is the last-listed refusal (3.635722ms)
✔ REQ-LIMIT-1 schema: every scope unset or zero, adjustable above four, bad values and unknown models refuse (27.767213ms)
✔ REQ-LIMIT-1 counts each exact scope at/over limit, unlimited and old tuple after model reassignment (1.218782ms)
✔ REQ-ROLE-3 writer: pre-rename fault leaves old file, post-rename recovery records commit, conflicting recovery refuses (42.79247ms)
✔ REQ-LIMIT-1 / decision145 migration prints only, preserves values, rejects ambiguity, and is idempotent (20.740471ms)
✔ REQ-LIMIT-1 shared settings validates the complete proposed selection and logs exact actor (73.013224ms)
✔ REQ-LIMIT-1 provider is table data: another provider routes separately and aliases share exact counts (5.530215ms)
✔ REQ-ROLE-3 refuses live writer locks, symlink targets and uncertain recovery without changing bytes (31.489428ms)
✔ Q169 assistants: vars and definition change and log the actor; tracker null leaves no tracker (74.510885ms)
✔ Q169 assistants: refuses other instances, other definitions, holder and credentials, empty entries, a tracker the definition has no credential for and a stale revision (46.648048ms)
✔ Q169 assistants: a definition with a vikunja credential takes a tracker change and refuses its removal or a used bot (28.59175ms)
✔ row 65 routes lists every instance with harness, model, thinking and fallback, the switched-on harnesses, the model keys and each harness's levels (4.496203ms)
✔ row 65 setRoutes saves a harness, model, thinking and whole fallback, reads each back from the file, logs the actor, and a null fallback clears all three (28.880486ms)
✔ row 65 setRoutes refuses a partial fallback, a switched-off harness, a level the harness doesn't apply, an unloaded module, an unknown model or instance, a malformed route, no change and a stale revision, with the file unchanged (33.617502ms)
✔ row 65 a file with harness vars and no plugins.harness loads and its views read; a model change still saves, and a route change refuses harness-off (15.471063ms)
✔ B7 kept instance: the models keys it names and the instances key are the human's (32.512862ms)
✔ B7 kept instance: its route is the human's (13.733689ms)
✔ M10 creative instance: models keys it names, the instances key and its route are the human's (41.972839ms)
✔ C2-04 M9: changed playground and hybrid entries leave business and changes.jsonl byte-identical (75.744651ms)
✔ C2-04 M9: code projects, additions, deletions and array changes are protected too (73.935851ms)
✔ C2-04 M9: canonical key order is allowed and a non-project setter still records its change (53.997154ms)
✔ C2-04 M9: a serialization hook cannot change projects after the canonical comparison (29.857522ms)
✔ M7/M8: library seats come from library businesses, creative seats from their creative definitions (20.881147ms)
✔ M8: a business with no library project puts no seat in either set (19.190367ms)
✔ M7/M8: a business file that is not valid JSON throws; no empty set (7.135915ms)
✔ M7/M8: an absent businesses directory gives empty sets (1.688414ms)
✔ M7/M8: a businesses path that is not a directory throws; no empty set (4.583153ms)
✔ M7/M8: a businesses symlink to a missing target throws; no empty set (2.208552ms)
✔ M7/M8: a config directory under a regular file throws (lstat fails with ENOTDIR); no empty set (0.601986ms)
✔ M7/M8: a business file that can't be read throws; no empty set (12.318486ms)
✔ T6 delete refuses in the design's order and leaves the file's bytes alone (104.896221ms)
✔ T6 delete refuses the last listed instance (7.490182ms)
✔ T6 a clean delete removes the entry and its own references, adds retired, and the name can't come back (213.690055ms)
✔ T7 veto: keep, unkeep, nohire and hire each write once, a repeat is no change, and the log names the human (171.894178ms)
✔ T7 veto refuses an unknown or END_PROTECTED keep, a bad request, a stale revision and a business without launch (26.238526ms)
✔ D2.2 hire adds and lists a new instance, logs the chief's context, and sets only model and limits (92.062371ms)
✔ D2.2 hire refuses noHire, a kept name and a listed name, and re-lists a fired one only as it was (29.586421ms)
✔ D2.2 fire delists and keeps the entry, a repeat is done with no write, and each refusal holds (88.451593ms)
✔ row 256 checkDelete passes the human's creative delete and refuses another actor's; fire still refuses (5.294872ms)
✔ row 239 T1 a fire on a revision that goes stale before the writer's lock refuses there and revokes nothing (5.756058ms)
✔ row 239 T2 a write after the revoke refused before publication carries revoked, and the file keeps the edit (7.753057ms)
✔ row 239 T3 any error after the revoke carries revoked, for a fire and a delete; a revoke that throws carries nothing (32.403692ms)
✔ Q247: omitting tracker loads as null and preserves independent role bots (10.793015ms)
✔ Q247: real business validate passes without a sync credential reference or file (168.186763ms)
✔ Q247: present tracker retains its values and validation without mutating the input (9.372029ms)
✔ Q247: present null, undefined and malformed trackers still refuse (18.314895ms)
✔ Q247: absent business tracker does not waive a role's Vikunja bot requirement (2.859494ms)
✔ REQ-PLUG-1 schema: plugins is optional, names known kinds and checked module names (40.546579ms)
✔ REQ-PLUG-1 REQ-ROLE-3 the setter writes plugins through the organization writer and logs old and new names (92.751615ms)
✔ vikunja:19/309 a patch changes only the kinds it names; null removes one kind, explicitly and in the trail (100.494327ms)
✔ vikunja:19/309 an unknown kind (set or removed), a bad module, an empty patch and null on the wrong shape are refused, nothing written (9.927988ms)
✔ REQ-PLUG-1 REQ-ROLE-3 the writer checks the bytes it writes: a Date in plugins is refused there too (19.985103ms)
✔ REQ-PLUG-1 REQ-ROLE-3 a refused setter write throws a code, changes nothing and logs nothing (4.143331ms)
✔ vikunja:19/305 with an exists check, the setter refuses a module no tree file answers to, before anything is written (18.273494ms)
✔ optional project repo is preserved and must be a normalized absolute path (32.895793ms)
✔ loaded business project repo cannot be nested in any declared code checkout (6.807091ms)
✔ path and load (3.706713ms)
✔ refusals (1.897981ms)
✔ record.write is within-role for the eleven approved v2 agents, never gated-only (3.85853ms)
✔ C2-06 M11 human replacement works; omitted settings return to defaults (98.331729ms)
✔ C2-06 M11 agents and tester cannot change settings, including by changing human (55.766765ms)
✔ C2-06 M11 serialization cannot replace settings after the first fence (17.47904ms)
✔ C2-06 M11 an unrelated actor cannot appoint itself human and change reply limits (16.039248ms)
✔ C2-06 invalid setter values preserve the business and changes.jsonl (17.259974ms)
✔ C2-06 validator accepts hand-edited settings; raw reader fails closed on invalid files (19.048524ms)
✔ C2-04: a library first in projects does not hide a later project layer (21.880181ms)
✔ systemVars flattens the validated config (1.820728ms)
✔ limits narrow the definition and never widen it (8.400306ms)
✔ role.launch stays within-role only for the instance the launch block names (18.468852ms)
✔ limits.authority without role.launch leaves the launcher with no launch block (13.185333ms)
✔ limits.authority narrows cross-role actions too (2.699689ms)
✔ classify (6.249491ms)
✔ the record carries what the broker and launcher need (4.7922ms)
✔ digest: key order doesn't matter, any value change does (12.395981ms)
✔ refusals (3.790542ms)
✔ the four shipped version 2 roles load (5.229965ms)
✔ shipped role scopes match addendum B section 2 and the SR runbook (2.178782ms)
✔ shipped authority follows the note's table (13.291498ms)
✔ every role file in roles/ loads through the validator, and a v2 contract exists (2.100731ms)
✔ version 1 files keep loading with no authority (1.521097ms)
✔ the conductor policy isn't a role (0.302424ms)
✔ a missing role file is exit 4, a symbolic link too (0.564721ms)
✔ version 2 refusals (3.788273ms)
✔ authority: closed vocabulary, no gated-only action, no overlap (3.881951ms)
✔ messaging: optional, role definitions and human, never the tester (1.949889ms)
✔ row 64 skills: optional, distinct skill directory names, none on version 1 (2.255987ms)
✔ credentials: Gitea scopes (1.343013ms)
✔ credentials: Vikunja scopes are a group-to-verbs map from the grantable list (1.709889ms)
✔ credentials: services (0.759517ms)
✔ contract: a non-empty regular Markdown file beside the role file (0.838905ms)
✔ the six creative roles load: read tools, message.send only, messaging with the human only (0.693212ms)
✔ M1: a creative role file wider than read and answer is refused (1.897832ms)
✔ hireable: HIRE_ALLOWED is exactly the six plain work actions, and every one is routed (0.173708ms)
✔ hireable: a list naming a definition that holds any refused action refuses at load, one case per action (18.133668ms)
✔ hireable: a mixed definition refuses, a clean list loads, and the named file's own hireable isn't read (1.146869ms)
✔ hireable: a missing, version 1, duplicate or badly named entry refuses, and the key is optional (3.734122ms)
✔ the pm and the cto check a saved spec against settled decisions and work in flight, and answer with a BLOCK or an accept (11.616694ms)
✔ the chief of staff relays a BLOCK or an accept to the assistant as a reply to the message that carried it (1.277302ms)
✔ the assistant summarizes a spec review in its own words and doesn't repeat the chief of staff's text (0.70976ms)
✔ REQ-LIMIT-3 schema: each subject kind, limit 0 and no ceiling are accepted; bad limits, times, keys and undeclared instances refuse (49.216064ms)
✔ REQ-LIMIT-3 the writer stamps since: a new limit gets now, a changed one keeps its time, a different time is refused (85.0223ms)
✔ REQ-LIMIT-3 only tokens.* at schema depth holds token limits: agent limits named `limit` save as sent, and a token limit named `limit` is stamped and reset (67.775561ms)
✔ REQ-LIMIT-3 a reset moves since to now, is logged with its actor, and refuses a path that is not a limit (34.296428ms)
✔ REQ-LIMIT-2 schema: launch.account names a credential set; a daily quota needs a reset and an IANA zone and names the account (33.871693ms)
✔ REQ-LIMIT-2 the writer stamps a daily quota's since, keeps its reset and zone, and a reset moves since (33.845575ms)
✔ every key names known layers and a merge rule (1.726458ms)
✔ unknown keys and wrong layers refuse (1.084085ms)
✔ types (3.275461ms)
✔ merge: defaults, then the most specific layer wins (0.419589ms)
✔ merge: limits only narrow, and provenance lists each source (0.757115ms)
✔ merge doesn't change its inputs (0.206627ms)
✔ web.searxng takes https anywhere and http on loopback, so Jason's 127.0.0.1:8888 passes (0.262745ms)
✔ both definitions load, with a contract file, and are exactly the approved lists (5.013658ms)
✔ security-reviewer has no write or shell tool and classifies only the verdict as its own (9.066819ms)
✔ merge-gate's only grant is git.merge.protected cross-role, and it has no write tool (3.470869ms)
✔ neither role can be an arbiter: its messaging lists refuse the business file (row 133) (8.498658ms)
✔ every role contract carries the proactive line in its Authority section (1.099286ms)
✔ pm and chief-of-staff say where a raise goes under REQ-DEC-2 (0.851681ms)
✔ the merge landing takes two runs: merge-gate, cto and chief-of-staff each say their part (0.660442ms)
✖ C2-06 held library lock gives the agent citation-unavailable and its retry reason (5108.905478ms)
✖ C2-06 malformed sync state is availability failure, never a fabricated invalid cite (40.518617ms)
✔ C2-06 no mirror or freshly initialized empty mirror still means no served citation (37.68422ms)
ℹ tests 3
ℹ suites 0
ℹ pass 1
ℹ fail 2
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 5261.169843
✖ failing tests:
test at packages/bus/tests/citation-availability.test.mjs:13:1
✖ C2-06 held library lock gives the agent citation-unavailable and its retry reason (5108.905478ms)
AssertionError [ERR_ASSERTION]: Expected values to be strictly equal:
+ actual - expected
+ 'citation-invalid'
- 'citation-unavailable'
^
at Object.<anonymous> (file:///mnt/storage/scratch/tmp/tNoueZ/row217-mutant-pd3x2htc/packages/bus/tests/citation-availability.test.mjs:29:14)
at expectedException (node:assert:547:17)
at expectsError (node:assert:672:21)
at strict.rejects (node:assert:738:3)
at process.processTicksAndRejections (node:internal/process/task_queues:104:5)
at async file:///mnt/storage/scratch/tmp/tNoueZ/row217-mutant-pd3x2htc/packages/bus/tests/citation-availability.test.mjs:28:5
at async withLibraryLock (file:///mnt/storage/scratch/tmp/tNoueZ/row217-mutant-pd3x2htc/packages/library/src/mirror.mjs:171:18)
at async TestContext.<anonymous> (file:///mnt/storage/scratch/tmp/tNoueZ/row217-mutant-pd3x2htc/packages/bus/tests/citation-availability.test.mjs:27:3)
at async Test.run (node:internal/test_runner/test:1409:7)
at async startSubtestAfterBootstrap (node:internal/test_runner/harness:387:3) {
generatedMessage: true,
code: 'ERR_ASSERTION',
actual: 'citation-invalid',
expected: 'citation-unavailable',
operator: 'strictEqual',
diff: 'simple'
}
test at packages/bus/tests/citation-availability.test.mjs:40:1
✖ C2-06 malformed sync state is availability failure, never a fabricated invalid cite (40.518617ms)
AssertionError [ERR_ASSERTION]: Expected values to be strictly deep-equal:
+ actual - expected
Comparison {
+ code: 'citation-invalid'
- code: 'citation-unavailable'
}
at async TestContext.<anonymous> (file:///mnt/storage/scratch/tmp/tNoueZ/row217-mutant-pd3x2htc/packages/bus/tests/citation-availability.test.mjs:45:3)
at async Test.run (node:internal/test_runner/test:1409:7)
at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) {
generatedMessage: true,
code: 'ERR_ASSERTION',
actual: Error: citation-invalid: citation 1 (Book One/Characters/Mara Vell.md) isn't an indexed file at a commit reachable from the served commit
at refuse (file:///mnt/storage/scratch/tmp/tNoueZ/row217-mutant-pd3x2htc/packages/library/src/guard.mjs:24:42)
at checkReply (file:///mnt/storage/scratch/tmp/tNoueZ/row217-mutant-pd3x2htc/packages/library/src/guard.mjs:80:25)
at async waitForActual (node:assert:615:5)
at async strict.rejects (node:assert:738:25)
at async TestContext.<anonymous> (file:///mnt/storage/scratch/tmp/tNoueZ/row217-mutant-pd3x2htc/packages/bus/tests/citation-availability.test.mjs:45:3)
at async Test.run (node:internal/test_runner/test:1409:7)
at async Test.processPendingSubtests (node:internal/test_runner/test:974:7),
✖ C2-06 held library lock gives the agent citation-unavailable and its retry reason (5104.72293ms)
✖ C2-06 malformed sync state is availability failure, never a fabricated invalid cite (35.117198ms)
✔ C2-06 no mirror or freshly initialized empty mirror still means no served citation (31.286656ms)
ℹ tests 3
ℹ suites 0
ℹ pass 1
ℹ fail 2
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 5250.151124
✖ failing tests:
test at packages/bus/tests/citation-availability.test.mjs:13:1
✖ C2-06 held library lock gives the agent citation-unavailable and its retry reason (5104.72293ms)
AssertionError [ERR_ASSERTION]: Expected values to be strictly equal:
+ actual - expected
+ 'citation-invalid'
- 'citation-unavailable'
^
at Object.<anonymous> (file:///mnt/storage/scratch/tmp/tNoueZ/row217-mutant-xglaeqeb/packages/bus/tests/citation-availability.test.mjs:29:14)
at expectedException (node:assert:547:17)
at expectsError (node:assert:672:21)
at strict.rejects (node:assert:738:3)
at process.processTicksAndRejections (node:internal/process/task_queues:104:5)
at async file:///mnt/storage/scratch/tmp/tNoueZ/row217-mutant-xglaeqeb/packages/bus/tests/citation-availability.test.mjs:28:5
at async withLibraryLock (file:///mnt/storage/scratch/tmp/tNoueZ/row217-mutant-xglaeqeb/packages/library/src/mirror.mjs:171:18)
at async TestContext.<anonymous> (file:///mnt/storage/scratch/tmp/tNoueZ/row217-mutant-xglaeqeb/packages/bus/tests/citation-availability.test.mjs:27:3)
at async Test.run (node:internal/test_runner/test:1409:7)
at async startSubtestAfterBootstrap (node:internal/test_runner/harness:387:3) {
generatedMessage: true,
code: 'ERR_ASSERTION',
actual: 'citation-invalid',
expected: 'citation-unavailable',
operator: 'strictEqual',
diff: 'simple'
}
test at packages/bus/tests/citation-availability.test.mjs:40:1
✖ C2-06 malformed sync state is availability failure, never a fabricated invalid cite (35.117198ms)
AssertionError [ERR_ASSERTION]: Expected values to be strictly deep-equal:
+ actual - expected
Comparison {
+ code: 'citation-invalid'
- code: 'citation-unavailable'
}
at process.processTicksAndRejections (node:internal/process/task_queues:104:5)
at async TestContext.<anonymous> (file:///mnt/storage/scratch/tmp/tNoueZ/row217-mutant-xglaeqeb/packages/bus/tests/citation-availability.test.mjs:45:3)
at async Test.run (node:internal/test_runner/test:1409:7)
at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) {
generatedMessage: true,
code: 'ERR_ASSERTION',
actual: Error: citation-invalid: citation 1 (Book One/Characters/Mara Vell.md) isn't an indexed file at a commit reachable from the served commit
at refuse (file:///mnt/storage/scratch/tmp/tNoueZ/row217-mutant-xglaeqeb/packages/library/src/guard.mjs:24:42)
at checkReply (file:///mnt/storage/scratch/tmp/tNoueZ/row217-mutant-xglaeqeb/packages/library/src/guard.mjs:80:25)
at process.processTicksAndRejections (node:internal/process/task_queues:104:5)
at async waitForActual (node:assert:615:5)
at async strict.rejects (node:assert:738:25)
at async TestContext.<anonymous> (file:///mnt/storage/scratch/tmp/tNoueZ/row217-mutant-xglaeqeb/packages/bus/tests/citation-availability.test.mjs:45:3)
at async Test.run (node:internal/test_runner/test:1409:7)
at async Test.processPendingSubtests (node:internal/test_runner/test:974:7),
✔ resolveSetBy: explicit --by wins over the environment; absent or empty environment gives unknown; invalid explicit or environment values refuse with exit 4 (0.590318ms)
✔ validateRegistration/readRegistration: taskSetBy is optional; a record without it (written before #1511) still loads unchanged; an invalid one is refused; the version does not change (0.734057ms)
✔ updateTask: records setBy, preserves startedAt and every unrelated field, upgrades an old record in place only when the task is set, and replaces a previous attribution (0.906133ms)
✔ CLI seat task: --by beats MOSAIC_AGENT_NAME, the environment beats nothing, empty environment is unknown, invalid --by or environment refuses with exit 4 and leaves the record byte for byte (330.90649ms)
✔ REQ-THREAD-2 sessionStore: a legacy session keeps the thread's store, any other gets sessions/<s>/, each segment checked first (5.360486ms)
✔ REQ-THREAD-2 sessionStore refuses legacy-store-unmapped for a thread whose old store no legacy session maps (1.608175ms)
✔ REQ-THREAD-2 sessionWorkspace: private directories per session, unsafe segments and overlaps refused (3.523108ms)
✔ REQ-THREAD-2 lockSessionWorkspace: one writer; a live host or run holds it, a stale lock is taken over, an unreadable one holds (15.189866ms)
✔ REQ-THREAD-2 sessions.json v2: entries carry session and workspace, running() keys on the session, a v1 file still reads (1.889362ms)
✔ REQ-LIMIT-1: family substring matching is no longer exported (1.378459ms)
✔ sessionEnv passes only the allowlist, the repo's bin on PATH, and the run id (1.063207ms)
✔ ZAI_API_KEY passes the session allowlist, and ZAI_TOKEN does not (0.239826ms)
✔ sessionExit gives a runner's signal death back as the signal; a session credential is one whole set of nonempty variables (0.405172ms)
✔ newRun: short ids, 0700 directories, and a refusal when the socket path won't fit (2.727102ms)
✔ session file and launch log: 0600, the session file written once (2.111664ms)
✔ endReason maps the runner's exit codes; a signal is killed (0.220582ms)
✔ Registry mirrors to sessions.json; readSessions marks live entries; bad files refuse (2.216711ms)
✔ a read-only Registry never writes sessions.json, refuses add() and leaves the file on remove() (2.154331ms)
✔ REQ-THREAD-1 Registry.running keys a thread run by business, instance and thread (1.027065ms)
✔ REQ-THREAD-2 REQ-LAUNCH-1 threadStore checks both segments before the join and refuses an unsafe directory (2.628544ms)
✔ stopSession refuses an unknown run, reports a stale one, and won't signal a pid that isn't a runner (1.552738ms)
✔ a session runs in its sandbox as pid 1 of its namespace, claims, answers, and stops on mosaic stop (293.088316ms)
✔ workRef and validBranch take only what a ref name can hold (2.280976ms)
✔ a push lands as the task's work ref, a fast-forward lands after it, and main is the root's (187.443563ms)
✔ a rewritten branch refuses non-fast-forward and the work ref stays (124.192671ms)
✔ a branch with no history in common with main refuses unrelated-history (60.579235ms)
✔ a bundle that needs commits the working repository lacks refuses missing-prerequisite (51.079109ms)
✔ the root is fetched again before each push and main follows it, so a clone of a newer root pushes (129.47937ms)
✔ a root moved back after the clone leaves the push's base unknown: missing-prerequisite (78.854404ms)
✔ a commit with a broken object refuses invalid-bundle, and only because fsck is on (86.468293ms)
✔ only a v2 bundle with the named branch is read (64.914471ms)
✔ a branch named main, or named for another task, moves only this task's work ref (102.371349ms)
✔ a record that throws moves the work ref back, or removes a new one (141.771502ms)
✔ a work ref that can't go back refuses rollback-failed, naming the ref and the commit (362.776758ms)
✔ a root that can't be read refuses root-unreadable (28.853641ms)
✔ a git past its time gets SIGTERM, leaves no ref lock, and the next push lands (2132.860162ms)
✔ a git that ignores SIGTERM gets SIGKILL once the grace period is over (1025.936026ms)
✔ a working repository path that isn't a directory refuses (23.030329ms)
✔ review bundles a pushed commit as refs/mosaic/review, leaving out what the reviewer has (120.899663ms)
✔ review of a project with no working repository refuses unknown-commit (14.031146ms)
✔ the runner's git tools hold the host's limits and branch rule (1.219295ms)
✔ a reseed moves root but leaves a landed main, and main forwards once root contains it (184.469774ms)
✔ after a landing, a push built on the root still lands and main stays where the landing put it (126.530409ms)
✔ once the root shares no history with a landed main, a push is checked against main, not the root (179.004093ms)
✔ a landing squashes the reviewed diff onto main as the bus host and moves main only at finish (105.224989ms)
✔ a landing refuses ref-moved, base-conflict and root-file before it makes a commit (308.132399ms)
✔ a landing whose applied diff isn't the reviewed one refuses patch-drift and leaves no worktree (121.415385ms)
✔ finish refuses base-moved when main moved, and a record that throws moves main back (242.643351ms)
✔ halted push receipt rolls back only its unrecorded ref and cleans temporary refs (198.696687ms)
Full touched-package suites and every scripts/test-*.sh remain for Sage's full gate; this CLEAR authorized only the five whole files. Candidate remains
marked Untested for the full gate. No queue row has been changed by Boyd.
## Dewey final delta review (dewey-0935, 2026-10-23 19:31:55Z)
Dewey reviewed 574ece13c..bcd93dc08 with local git only, no Node: CLEAN,
nothing blocks. Verified all 13 manifest entries, exact package-file coverage,
project-runtime 1/1, M5-M10 mutation sites, all ten mutation log hashes and
counts, named assertion kills without loader/syntax errors, final five logs
29/0/0, and N1-N5 coverage. No production code delta in this review range.
Formal Gitea APPROVE on #1804 and queue record wait on the row 291 hold release
and Sage's go. Sage's touched-package and every scripts/test-*.sh gate remains
required. Boyd has released lane B and has no running test processes.
## Rebase after row 239 (sage-3794)
Current branch: `boyd/row298-r2`, rebased from published row 298 tip
`2fc27bce6bfac2debe9703782bf308132c26b393` onto
`833ec1cc8d7c11842efb82e57c1a0b256c8d22d7`, which includes row 239 through
`e0cb1db2c`. Original `boyd/row298` remains intact locally and remotely. A new
Boyd branch carries the rebased candidate so no published history is amended
or force-pushed. This section supersedes the original base/branch header for
current candidate work.
Conflicts: only the first Boyd log append in `BUILD-LOG.md` and
`docs/SESSIONS.md` conflicted while replaying 574ece13c. For each, verified the
old commit's log started with the merge base bytes, then retained the new
base's complete log bytes and appended only Boyd's suffix (434 and 281 bytes
respectively). Later Boyd appends replayed automatically. No prior entries
were removed or rewritten. Five commits replayed; the third/fourth range-diff
entries differ only in append-log context; package-only range-diff is all `=`.
The overlapping product files merged automatically: broker.mjs, runtime.mjs
and instance-settings.mjs had no textual conflicts. Inspected their diff
against the new base: only the existing row 298 scope additions remain.
Preserved row 239's injected writer, fire/delete beforeWrite callback, and
commit() passing beforeWrite into writer.write. There is no pre-lock revoke
call in commit(). `packages/business/src/organization.mjs` is byte-identical
to the new base: beforeWrite still runs inside withLock, after revision and
validation checks; post-revoke errors still carry revoked true. Broker's
row-239 error handling and runtime's lock/revoke wiring remain intact.
Static checks only: package patch range-diff all equal, organization writer
from before `await publishLibraryWrite(...)` to immediately after that await inside the same try.
Successful operations keep their notice, but the outcome-unknown publication path drops it. The
C2-02 E4 real-push corruption test must fail on its exact notice assertion. Run on CLEAR and restore.
No Node/tests/build/mutants run. Static git diff --check clean. Della's first284 head0ed4fbab9 is
explicitly incomplete and not a finished dependency; waiting for her complete-head pin before tools.
Webby webby-0253 (static, cef503cb9) closes E4 per mos-1520; no tests ran. N1: a failed notice insert throws from onPushed before publication, so served stays at the prior commit until sync; the store-failure test pins this safe direction. Only E5 (284 tools/snapshot integration) remains open in this early review.
## 2026-10-23 complete284 merge and final tool integration (unrun)
Della della-0037 supplied complete untested head47db04eba85ac3ceb7e81385603f97bb6f8c1a38,
replacing the incomplete head. Merged intact as c0ca3894c. Its22423816cf28 and2164f3fbc25a
lineage is retained. Three conflicts were in overlapping production wiring only:
- broker.mjs: keep Della's LIBRARY_LOOKUPS object and #requestLibraryLookup byte-for-byte, and
keep288 writer/notice methods; LIBRARY_VERBS contains both sets and request dispatch calls lookup.
Accepted brief: docs/plans/2026-10-24_model-proxy-rows.md P5; associated design D18–D20 with mos-1600 correction.
Queue next codex refused a linked worktree; no canonical mutation. Parent supplied accepted assignment/authority and coordinated runtime collector ownership. No remote issue posting or live configuration/credential reads.
Ruling: preserve existing schema by carrying safe modelKeyId in usage cursor metadata; proxy telemetry uses a separate source excluded from turnRecords and every quota check. Existing account limits stay compatible. A model key daily quota is keys.<12-hex-id> with reset/timeZone; unset remains no quota. Human-only protection applies to model-key limit changes and resets. No launcher/session/harness/business route edits.
Verification uses serial nice19 node tests with private HOME/XDG_CONFIG_HOME/TMPDIR/MOSAIC_CONFIG and unchanged test budgets. Broad/full gates reserved to parent after row334 target returns. Receipts below are actual command outputs; failures retained.
Parent steering receipts: runtime ownership confirmed createUsage/createLimits collector wiring/tick/close exclusively P5; Fethry avoids this area. Broker changes only usage option accepted by human plugins.set and mustStop run identity. No launch/harness/session/business-route bytes changed.
Exact additive old expectation update authorized by parent: kinds.test.mjs old five-entry Object.keys(KINDS) expected array retains all five in their original order and adds usage. loader.test.mjs complete loaded() expected objects retain all original members and add usage:[]. No old assertion was removed, guard relaxed, timeout increased or sleep added.
First RED receipts: 01-token-red (native key limit incorrectly allows); 02-contract-red (daily key quota, key schema and HTTP method absent); 04-integration-red (new collector absent; native attribution and plugins.set config missing); 08-edges-red (lookup fails open, nonhuman usage writer allowed, Console labels absent); 10-lookup-behavior-red (existing runtime lookup extracted unchanged: missing exception for missing/foreign/ambiguous ownership). 09 captured the preceding missing export, not behavior proof. 05 captured duplicate local variable syntax error, fixed before 06. Runtime fixture failures 12/13 were missing required process identity then incorrect cap extraction; corrected fixture follows actual runtime contract. 14 proves actual model-key issue/preflight, native accounting at key quota, stopping, later launch denial and broker human plugin setting path.
Unexpected existing named failure (reported to parent before any rerun): receipt18 was 169/170, failing `REQ-LIMIT-4 a role run at its limit stops at the end of its turn: RESULT and read land first, the claim is revoked by limit-check` at limit-stop.test.mjs:61. Cause: additional run in the broker's second mustStop argument violated its existing exact subject contract. Fix keeps that argument unchanged; run moves to a separate internal third context and is consumed by host lookup only. The old assertion remains byte-for-byte unchanged. Correction to initial parent message: the quoted name here is the exact failing test name (the first report paraphrased it).
Scoped receipt19: original contract corrected, 170/170 current whole-file tests GREEN. Parent then required direct native-context/no-bypass regression: receipt20 genuinely RED (`stop:false` on a supplied safe-looking modelKeyId when lookup returned null). Removed that fallback entirely and stripped caller modelKeyId/run from the public check subject. Only trusted host resolver can provide the ID; only the separate third internal context provides run. Receipt21: direct context tests, original unmodified limit-stop file and proxy telemetry whole files 15/15 GREEN. Retiring/current mapping rejects wrong business/instance/run and unknown or ambiguous retained IDs.
Final implementation decisions and evidence:
- Native source records carry only the immutable run modelKeyId. New and retained generations resolve from safe Credentials.status metadata; missing, duplicate, foreign or no-longer-retained mappings fail `proxy-key-refused`. Third mustStop context is internal and associated by the broker from its authenticated session, never an agent argument. Missing context is fail-closed (receipt23 genuine RED `stop:false`, fixed in receipt24).
-`tokens.keys.<12hex>` accepts the daily quota shape, uses daily-quota when reset/timeZone are present, and remains unset by default. Existing named account keys and account daily quotas retain their plugins and contracts. All model-key quota/reset changes and usage module/poll changes are fenced at both organization validation points for every writer, tester included.
- Management queue HTTP GET is fixed to loopback with count=100, original 5-second default and 8 MiB response cap, no retries/redirects. Client api_key and upstream source hash immediately to the first 12 SHA-256 hex characters. Fields are whitelisted; malformed batches are atomic. No raw values, upstream body or arbitrary error text reaches product store/log/view/audit.
- Exactly one bus writer owns the collector, shares one management client, drains once and assigns metadata owners, including retained keys. Unknown msk IDs get reconcile receipts; disabled businesses and foreign unmanaged keys get no telemetry. Polling defaults 15 seconds, accepts integer 1..59 and serializes concurrent ticks. `@proxy/cliproxy-queue` records are append-only but excluded before every native turn record/total/limit decision. Availability and account counts are explicitly proxy-reported in the Console.
- Named upstream-value mutant changed `accountId: sha256(event.source).slice(0,12)` to the raw `event.source`: receipt16 exit1, four tests failed. Restoration matched original client SHA256 f5f86cad661034f223a76352d877fa8d7883bfa921a7a01282347a9a03272441, receipt17 positive 15/15. Final receipt24 also runs after restoration and is GREEN.
- Final current whole-file verification: `bash agents/codex/work/queue-333/verify-scoped.sh` → 174/174 PASS, 24 explicitly listed whole files, serial nice19, private HOME/XDG_CONFIG_HOME/TMPDIR/MOSAIC_CONFIG, original test budgets. Raw output: receipts/24-final-current-wholefiles-green.txt SHA256 3358af061c35d42b00d5ee1e001939534c5e7563d4f5418ea85431605d0b9f6d. Runner SHA256 c8a2bf4539bffe38f3198308fd60e9c1ad338841b406af160ab0739c15394290.
- Source freeze: source-inputs.sha256 enumerates all 202 consumed repository inputs (182 modules/scripts plus 20 schema/PIN/other files), traced on final execution and rehashed unchanged after it. Manifest SHA256 b4662dcafb2aeb27a06e5dbd3b9d0b6d184e8624e344fed351ff20e3b255951b. Raw per-process trace is receipts/source-inputs.raw.jsonl. candidate-sourcepaths.txt and candidate-sourcehashes.sha256 list every changed package file for parent combination; receipts.sha256 covers every raw run and source trace. Runner/trace use no content logging.
- Cleanup: original private mktemp root removed and absence verified; scoped runner EXIT trap removes its separate private root. All fixture servers/stores close through test cleanup. Mutant backup and temporary root marker removed. Isolated worktree retained for parent review; no production process, real proxy, account, config, credential path or provider was contacted.
Limits and handoff: scoped GREEN is not the full landing gate. No package/full gates, Chromium/browser gates, acceptance binary, canonical queue mutation, remote issue post, push, merge or landing was run. Full/browser/combined gates remain with the parent under 1014.Q264 after admission; fresh independent Codex review is the parent's next task. No self-approval is claimed. Base remains 09a847eda and no unlanded662/657/658 feature bytes were imported.
## R2 fixtures
Base 09a847eda, row 333 tip ddb3e961f, R2 fixture commit 12eba4b59. Author: Claude (sub-agent of the Mosaic Stack lead, T3 c5c1e8ba). Issue #1831. No product code, business document schema or test assertion changed.
Cause. Row 333 added packages/plugins/src/model-quota.mjs and imports it from packages/business/src/launch.mjs:3 and packages/business/src/organization.mjs:11. The cli release fixtures build smaller copies than a real stack copy: they copy packages/business/src and add only packages/plugins/src/kinds.mjs. Their business loader therefore failed with "Cannot find module .../packages/plugins/src/model-quota.mjs". Real copies are unaffected, because scripts/stack-copy.sh ships all of packages/plugins (COPY_PATHS, line 41). R1's evidence ran the 24 touched test files only (verify-scoped.sh, 174/174) and no package or cli gate, so it never built a release fixture copy and could not see this.
Fixture changes (tests only):
- packages/cli/tests/business-imports.mjs (new, 26 lines): businessImportedFiles(repo) reads the relative imports of every .mjs under packages/business/src and returns, sorted and repo-relative, the files outside that directory they reach, following those files' own imports. An import of a missing file throws. At this tip it returns packages/library/src/limits.mjs, mapping.mjs, problems.mjs, packages/plugins/src/kinds.mjs and packages/plugins/src/model-quota.mjs.
- packages/cli/tests/stack-release-fixture.mjs:314 (copies for stack-release.test.mjs, stack-release-external.test.mjs and stack-upgrade.test.mjs): after the business, library and roles copy, copy each returned file that is not already in the copy. kinds.mjs is skipped on purpose, because the fixture has already written its KINDS_OLD or KINDS_NEW form there.
- packages/cli/tests/stack-release.test.mjs:1994 (the RCOPIES copies): same loop.
Searched for other fixtures that copy packages/business/src without the whole plugins directory: the grep over packages/*/tests, scripts and scripts/testing finds only those two. packages/cli/tests/case2-install.test.mjs:74 copies packages/business/src/vocabulary.mjs alone, which has no imports. stack-copy.test.mjs and stack-release-external.test.mjs:450 copy tracked files or the whole repository, so they carry model-quota.mjs already.
Production check (every place that copies, mounts or packages business code or plugins/src/kinds.mjs without the whole plugins directory):
- scripts/stack-copy.sh:32 copies packages/business/src and :41 copies the whole packages/plugins, so model-quota.mjs reaches every real copy. scripts/case2-install.sh:185 calls it.
- scripts/stack-release.sh:371 and :378 import the copy's own packages/business/src/business.mjs, which reaches launch.mjs and so model-quota.mjs. That copy comes from stack-copy.sh, which takes both directories from the same commit.
- packages/seat/src/sandbox.mjs RUNNER_FILES (:50-:72) mounts packages/business/src/vocabulary.mjs (:67) and packages/plugins/src/kinds.mjs (:68) only. A transitive import walk from all 19 listed files reaches no file of packages/business or packages/plugins outside that list; launch.mjs, organization.mjs, business.mjs, loader.mjs and model-quota.mjs are not reached. vocabulary.mjs and kinds.mjs import nothing. packages/seat/src imports only vocabulary.mjs from business (compactions.mjs:46, sandbox.mjs:40, session.mjs:42). model-quota.mjs is therefore not needed in the sandbox.
- scripts/test-darkwing-launch.mjs:34 and scripts/test-rocko-launch.mjs:25 copy packages/seat/src alone, which needs only vocabulary.mjs.
- Containerfile:23-26 copies contracts, src, two processing-control files and adapters; src imports nothing from packages. compose.yaml mounts the data root and the auth file only.
- scripts/mosaic:35 and scripts/case2-precheck.sh:85,171 import business code from the repository or copy they sit in, which holds all of packages/plugins.
Result: no production path misses model-quota.mjs. No product change was needed or made.
RED, on ddb3e961f before the change (whole files, from packages/cli, one at a time, TMPDIR /mnt/storage/scratch/tmp/QYOMZY):
- stack-release.test.mjs: 224 tests, 56 pass, 168 fail, 0 skip, 186 s. 127 log lines carry the missing-module message.
These match the counts the join child recorded (56/168, 4/21, 7/14).
GREEN, on 12eba4b59:
- stack-release.test.mjs: 224/224 pass, 0 fail, 0 skip, 694 s. stack-release-external.test.mjs: 25/25, 88 s. stack-upgrade.test.mjs: 21/21, 66 s.
- cli whole (node --test tests/*.test.mjs): 1045 tests, 1044 pass, 0 fail, 1 skip, 656 s. The skip is "FED R7 scratch two-instance acceptance", which names scripts/test-federation-acceptance.sh as the way to run it.
- business 286/286, 3 s. bus 1380/1380, 49 s. plugins 123/123, 1 s. model-proxy 108/108, 1.4 s. webui 492/492, 63 s. No skips in these. The model-final-completion.test.mjs:69 host flake (16 !== 19) did not appear, so no rerun was needed.
- The counts for business (286) and plugins (123) are lower than the join's (292, 128) because the join included row 332's tests; this branch stays on base 09a847eda.
Mutant. With the helper changed to drop model-quota.mjs from its result (a one-line filter in business-imports.mjs), stack-release.test.mjs gave 224 tests, 56 pass, 168 fail in 183 s, with 127 "Cannot find module .../packages/plugins/src/model-quota.mjs" lines. The helper then printed four files, without model-quota.mjs. git checkout restored the file; git status --short printed nothing afterwards.
## Join onto landed 332
Written 2026-11-02T22:49Z by Claude (sub-agent of the Mosaic Stack lead, T3 c5c1e8ba), author of this join. Issue #1831. Checkout branch t3/row-333-join-replay.
Base and heads. Row 333 R2 head 0ef269da9 on base 09a847eda (R1 503b91e56, overlay 2627321f6, docs c012b2e0a and ddb3e961f, R2 fixtures 12eba4b59 and 0ef269da9). Row 332 landed on refactor at 5df0e9d6f (R2 and the lead correction). The branch started at 5df0e9d6f with no commits of its own and a clean tree. Command: git -c core.attributesFile=/mnt/storage/scratch/q284gate/union.attributes merge --no-ff --no-commit 0ef269da9. Merge commit c0c291cda, parents 5df0e9d6f and 0ef269da9, made at 22:33:47Z.
Why a replay. The earlier join (eabeb1aa8) was made on 332 R1. Row 332 then changed (R2 and a lead fix) and row 333 gained two fixture commits. Both rows change packages/business/src/launch.mjs and packages/plugins/README.md.
Conflicts. Exactly two paths, the two named in the brief. No other path conflicted.
- packages/business/src/launch.mjs, import block (lines 3 to 8 before resolution). 332 changed the errors import to `{ BusinessError, refuse }` for the proxy route refusals in checkModels. 333 added `import { isDailyModelQuota } from "../../plugins/src/model-quota.mjs"` for the daily model leaves in checkTokenLimits. They do not contradict. Resolution: both imports, the model-quota line first, then `{ BusinessError, refuse }`. The rest of launch.mjs merged without conflict: 332's checkModels route handling and the checkAccount `proxy` credential, and 333's checkTokenLimits keys block.
- packages/plugins/README.md, end of file (lines 331 to 378 before resolution). 332 appended "Per-session proxy context (P3)" and 333 appended "Proxy usage telemetry (row333 / P5)" after the same last paragraph. Resolution: keep both, P3 section first, one blank line between, P5 section last.
Other paths touched by both sides, merged without a conflict and not edited by hand: BUILD-LOG.md and docs/SESSIONS.md (union attribute, both sides' lines kept), and packages/cli/tests/stack-release.test.mjs (333's 3 lines for the business-imports helper, 332's R2 hermetic-launch edits). No product or test file was edited by hand.
Comparison with the reference resolution (/mnt/storage/scratch/tmp/iLeQSZ/join-resolution.patch). I took git diff 5df0e9d6f for the two files and compared it with the reference patch after removing the index lines. The result is identical, and the hunk headers (-1,5 +1,6; -76,8 +77,16; -365,3 +365,12) are equal too, so there is no difference to explain. The reference was a diff against the 332 R1 blobs. launch.mjs is d9ef01b40 and README.md is d4625c9f6 on both 332 R1 and landed 332, so R2 and the lead fix did not change these two files, which is why the earlier resolution carries over unchanged. A correction to the merge commit message: it says the files match the reference "apart from hunk offsets", but the hunk offsets match as well. The commit stays as made.
Tests, on c0c291cda. node_modules linked from /mnt/storage/src/mosaic-stack (a link at the root and a real directory of links under packages/webui), TMPDIR /mnt/storage/scratch/tmp/Z280Ko (31 bytes), each suite whole, one at a time, from its package directory with node --test tests/*.test.mjs, 30-minute limit, started 22:34:09Z. Nothing was skipped, failed or rerun except as noted.
The one cli skip is "FED R7 scratch two-instance acceptance", which names scripts/test-federation-acceptance.sh as the way to run it. That script passed 1/1 in the last row, with "R7 cleanup: no child groups, ports or sockets remain". The model-final-completion.test.mjs:69 host flake (16 !== 19) did not appear, so no rerun was needed. Business and plugins are one test higher than the earlier join's 292 and 128, and bus 1382 is two above R2's 1380 on the 09a847eda base; this record does not attribute those differences to a cause.
Cleanup. No test process of mine remained after the runs. The node_modules links and the TMPDIR were removed; git ls-files -co --exclude-standard | grep node_modules printed nothing, and git status --short showed only this file and docs/SESSIONS.md before this commit.
## R3 rotation fix
Written 2026-11-03 by Claude Opus 5.5, implementation sub-agent of the Mosaic Stack lead (T3 c5c1e8ba). Issue #1831. Brief: /mnt/storage/scratch/mosaic-lead/briefs/row333-r3-fix.md. Review: /mnt/storage/scratch/mosaic-lead/reviews/row333-opus.md, findings 1 to 5. Branch t3/row333-r3-fix on base b37cc5087. Product, tests and docs are commit 3692fca52.
### Ruling 1: the quota follows the agent's key lineage
- Model record. `Credentials.#format` accepts an optional `previous`: a non-empty array of at most 64 entries, each exactly `{ keyId, retiredAt }` with a 12-hex id and a canonical ISO time. Anything else refuses `credential-format`, on write and when the file is opened. A record without the field loads unchanged. Safe status shows `previous` (ids and times) next to `retiring`, and an empty array for a record without it. No key value is in it.
- When an id is added. `ModelKeys` adds an id when the key leaves the record. On a rotation the old key first becomes retiring, as before, and its id moves to `previous` when the sweep removes it, at grace expiry or at once when no run is bound to it. On a re-issue (the `#issue` path where the proxy no longer lists the old key) the old id goes straight to `previous`. The field stays absent until the first id leaves. Past 64 the writer drops the oldest, so a record never carries 65; the format refuses 65 as well. A fire removes the record, as before, so a re-hired agent starts a new lineage. The revocation proofs still compare whole records with `isDeepStrictEqual`; a test fires an agent whose record carries `previous` and the proof holds.
- Lineage. An agent's lineage is its current id, its retiring ids, then its earlier ids. `modelUsageKey` checks uniqueness over every lineage on the host: an id in two agents' lineages, or twice in one, refuses `proxy-key-refused`. The new `modelKeyLineages` lists the business's lineages and applies the same host-wide check. `createLimits` takes a `keyLineages` hook, which refuses by default, and passes `lineages` to the checks only when a daily key leaf exists. The subject's key must be in exactly one lineage read in the same call, or the launch refuses and the turn stops. `report` shows every limit `check failed: proxy-key-refused` when the lineages can't be read.
- daily-quota. A key leaf applies to a subject whose key is in the lineage holding the leaf's id, and its tally sums the day's records for every id in that lineage. Usage records and the Console per-key counts stay per key id. Missing or malformed `lineages` throws `bad-lineages`; account quotas never need them.
- mustStop resolves the run's bound key, and that key's lineage decides the leaf. A run may be bound only to the current or a retiring key. A run whose bound id has moved to `previous` refuses `proxy-key-refused`, which stops it.
- Orphaned leaves. A leaf whose id is in no hired agent's lineage counts its own id only and matches no subject, so it refuses no launch. The limits code logs `{event: 'limit-key-orphaned', business, path}` once when a leaf becomes orphaned, not per launch, and again only if it stops being orphaned and becomes orphaned later. `orphanedKeys` feeds `orphanedKeyQuotas` in the usage view, and the Console usage view lists each one: "Key quota <id> matches no agent, so it limits nothing. A fire and re-hire gives the agent a new key; set the quota on the new key id." A fire and re-hire therefore leaves the old leaf orphaned, and the human sees it in that view. The Token limits panel can only reset leaves, not rename them, so the text points at the new key id rather than at that panel.
- Docs. packages/plugins/usage/cliproxy-queue/README.md (where row 333 documents `tokens.keys` leaves), packages/plugins/README.md (the limit-check interface gains `lineages` and `subject.modelKeyId`, plus the daily-quota section) and packages/plugins/limit-check/daily-quota/README.md each gain the rotation and orphan sentences. The business package documents no model-key leaf, so it has no doc change.
- Rollback. A release from before this round refuses a record that carries `previous` with `credential-format`, which fails closed. No live stack holds proxy model records yet (no proxy cutover until Vikunja #774), so no migration was built.
Departures from the expected shape, and why:
- 65 entries: both refuse and trim. The format refuses 65 (a hand-edited or foreign record), and the writer trims to the newest 64 so the bus never writes one. Both are pinned.
- A keyless agent under a key quota refuses even when every key leaf is orphaned. An orphaned leaf matches no subject, so the refusal is not needed to enforce it, but resolving the subject's key comes first and I kept that fail-closed order rather than add a second path that skips it.
- Moving a leaf through the human writer. The brief says moving a leaf from A to B on rotation day must not reset the count. The tally does sum A and B: a leaf named B whose `since` is the day's start counts 160 (90 on A, 70 on B) and refuses. But the human settings writer treats a rename as a new leaf and stamps `since` with the move time, so a leaf moved through the writer counts only the usage after the move (100 in the test, not 160). I did not change the writer: the `since` stamping is the row 125/126 human-writer contract, in the business package, and changing it widens this round. With the lineage, the move is not needed, since the leaf on A keeps applying after rotation. Both cases are pinned in p5-key-lineage.test.mjs. Recommended follow-up if the lead wants a moved leaf to keep its count: let the writer carry `since` over when the old and new ids are in one lineage.
- The proxy-usage owner map stays current plus retiring. It attributes proxy queue events, which can only name keys the proxy still accepts, so earlier ids would never match. That is telemetry, not the quota, and I left it.
### Ruling 2: key-quota-no-model-key
`modelUsageKey` throws `key-quota-no-model-key` when the agent has no model record, or one with no key issued. `createLimits` passes that code and `proxy-key-refused` through by name; any other lookup failure is still `proxy-key-refused`. Pass-through, after grepping `proxy-key-refused` across packages/*/src: the broker's organization-error pass-through list gains the code (bus/src/broker.mjs; no organization writer raises it today, but it now passes through the same way as the other proxy key codes). The launcher maps every bus refusal to `limit-check-failed` with message `bus: <code>`, and the turn-end stop reason is `limit: bus failed <code>`; neither needed a change, and both are pinned for the new code (cli launch-limit-checks.test.mjs, bus limit-stop.test.mjs). With no key quota there is no lookup and no refusal.
### Ruling 3: rotation between preflight and mayLaunch
The lineage covers it. Finding 3's case is preflight admitting A, the sweep rotating A to B, and `mayLaunch` checking B. B and A are now one lineage, so a leaf named A matches the subject B and counts A and B: the launch refuses. The rotation test asserts exactly this state (A retiring, B current, `mayLaunch` refuses under the A leaf). After a re-issue, A is not current or retiring, so binding a run to A refuses. I found no gap, so `mayLaunch` does not take the admitted key id.
### Ruling 4: the usage module gets readUsageQueue only
`createProxyUsage` hands the module `Object.freeze({ readUsageQueue: () => management.readUsageQueue() })`. cliproxy-queue reads `read({ readUsageQueue })`. The test wraps the real loader to capture the argument. It has exactly one own key, `readUsageQueue`, a function, is frozen with `Object.prototype` as its prototype, and a walk over every own property, accessor and prototype reachable from it finds neither the client, its prototype, its class nor any of its other methods by name or by reference. Spies on every client method show only `readUsageQueue` was called, and the event was still recorded.
### Ruling 5: fixture deadlines
Each wait in p5-telemetry-fixture.mjs (`waitLog`, `waitQueue`, `settleInitial`, `pollSettledAfterTick`) races a deadline on the real `setTimeout`, captured when the module loads, before any test mocks timers. The default is `WAIT_MS` = 5000 ms; the fixture takes `waitMs`. The rejection names what it waited for, for example `p5 fixture: no usage queue read number 1 within 50 ms`. The new test mocks every timer API, never advances it, and asserts all four rejections by exact message with `waitMs: 50`. The p5-background.test.mjs header is updated.
### Tests
Added: packages/bus/tests/p5-key-lineage.test.mjs (9 tests). It uses the real `Credentials`, `ManagementClient`, `ModelKeys` and its sweep, `createLimits`, `modelUsageKey`, `modelKeyLineages` and the daily-quota module, with a fake loopback management server, a made-up management key and a fresh temp root. Only `Date` is mocked.
- Rotation mid-day under a hit leaf named A: refuses before, right after (A retiring, B current), inside the grace, after the grace (A in `previous`) and after a restart that reloads the record. The run bound to A stops at its turn end after the rotation. Another agent stays allowed.
- Re-issue: the proxy no longer lists A at preflight, B is issued, A is in `previous`, and the leaf still refuses, including after a restart. A limit of 101 allows.
- The leaf moved from A to B on rotation day still refuses with count 160, and the run bound to A stops.
- The settings-writer move: `since` is the move time and the count is 100.
- Lineage uniqueness: an id in two agents' lineages refuses both, and the report shows check failed. An id twice in one lineage refuses too.
- Format: a record without `previous` loads; thirteen malformed values refuse `credential-format` on write and on open, including 65 entries, a key value in place of an id and an empty array; 64 earlier plus 64 retiring load within the 16384-byte cap.
- A re-issue on a record holding 64 drops the oldest.
- Fire and re-hire: the revocation proof holds with `previous` present, the old leaf is orphaned, three launches go ahead, one log line, the view lists it, and no key value is in the logs, view, receipts, status or store files.
- Ruling 2 on `modelUsageKey`, `mayLaunch` and `mustStop`, and no lookup without a key quota.
Also added: three daily-quota tests (lineage match and count, orphan, `bad-lineages`), one usage-render test (the orphan list, escaped), the ruling 4 test in proxy-usage.test.mjs, the ruling 5 test in p5-background.test.mjs, and the new code in limit-stop.test.mjs and cli launch-limit-checks.test.mjs. Changed for the new rules: limit-checks.test.mjs (a leaf on a retiring key now applies to the agent's current key too, so the launch refuses; an unrelated lineage still allows), p5-key-context.test.mjs (the two no-owner cases now expect `key-quota-no-model-key`; a wrong run stays `proxy-key-refused`), p5-key-compatibility.test.mjs (passes `lineages` to the module) and the p5-telemetry-fixture.mjs waits.
### Runs
All on 3692fca52, one at a time, each under a 30-minute limit, with TMPDIR under /mnt/storage/scratch/tmp and output to files there. Each whole run is `node --test` over the package's tests directory.
| Run | Tests | Pass | Fail | Skip | Time |
|---|---|---|---|---|---|
| bus whole | 1393 | 1393 | 0 | 0 | 49 s, 23:55:28Z to 23:56:17Z on 2026-11-02 |
The model-final-completion.test.mjs:69 host flake (16 !== 19) did not appear, so no rerun was needed. Against the join record above, bus is up 11 (the 9 lineage tests, the ruling 4 test and the ruling 5 test), plugins up 3 (the daily-quota tests) and webui up 1 (the usage-render test); business is unchanged. The other changed tests changed existing cases or added table rows, not tests.
### Mutants
Each was applied to the committed tree, run against the named file, and restored with `git checkout -- <file>`; `git status --short` was clean after each.
| Mutant | Change | Killed by | Result |
|---|---|---|---|
| M1 | daily-quota matches a key leaf to the subject by the leaf's own id only | p5-key-lineage.test.mjs:101, the rotation test: right after the rotation the launch was allowed where a refusal with count 100 was expected. Also :138 (re-issue), :156 (moved leaf, run not stopped), :252 (fire and re-hire) and daily-quota.test.mjs:197 | lineage 4 of 9 fail, daily-quota 1 of 17 fail |
| M2 | the tally counts only the leaf's own id | p5-key-lineage.test.mjs:155, the moved-leaf test: allowed where limit 160 and count 160 were expected. Also :179 (writer move), :252 (count 100, expected 105) and daily-quota.test.mjs:197 | lineage 3 of 9 fail, daily-quota 1 of 17 fail |
| M3 | `#issue` records no old id on a re-issue | p5-key-lineage.test.mjs:137, the re-issue test: `previous` was undefined where `[{ keyId: 'f6548f12575e', retiredAt: '2026-10-24T12:01:00.000Z' }]` was expected. Also :241 (trim at 64) | lineage 2 of 9 fail |
| M4 | the usage module gets `{ client: management, readUsageQueue }` | proxy-usage.test.mjs:89: own keys were `['client', 'readUsageQueue']` | 1 of 8 fail |
| M4b | the client hidden as a non-enumerable property on the `readUsageQueue` function | proxy-usage.test.mjs:98: the walk reached the client | 1 of 8 fail |
M4b is extra; it shows the ruling 4 test finds a hidden path and not only an extra own key.
### Not done
- The settings writer still stamps a new `since` on a renamed leaf (Departures above). Recommended follow-up, not built.
- No migration, per the brief: no live stack holds proxy model records yet.
- No push, queue, Vikunja, Gitea or PR action, per the brief.
## R4 since carry
Written 2026-11-03 by Claude Opus 5.5, implementation sub-agent of the Mosaic Stack lead (T3 c5c1e8ba). Issue #1831. Brief: /mnt/storage/scratch/mosaic-lead/briefs/row333-r4-fix.md. Branch t3/row333-r4-fix on the R3 tip fe3ef5128 (base b37cc5087, no rebase). Product, tests and docs are commit f65faf9df. The R3 section above is unchanged; where R4 changes something it says, this section says so.
### Ruling 1: a moved key quota keeps its count
- The lookup. runtime.mjs builds `keyLineage(business, keyId)` as `modelKeyLineage(credentials.status(), business, keyId)` and passes it to `launchSettings`. `modelKeyLineage` (limits.mjs) returns the lineage in that business holding the id, or `[]` when none does. It is built on `modelKeyLineages`, so the same host-wide uniqueness check runs and a duplicate id throws. It reads the bus's own credential records through their safe status: ids, never a key value. The writer hands it only a business id and a key id, so no caller-supplied lineage reaches it, and the runtime spreads `organization` before `keyLineage`, so an organization option can't replace it.
- The writer. `stamp` keeps its rules: a leaf with a stored `since` at the same path keeps it, and a caller-supplied `since` that differs refuses `invalid-request` (on a new leaf any caller `since` differs, so it always refuses). New: a `tokens.keys` leaf with no stored `since` that is a daily key quota asks the lookup for its key's lineage and takes the earliest stored `since` among the old document's `tokens.keys` daily key quotas whose ids are in it. Whether the same write removes the old leaf doesn't matter. With none it takes now. `reset` runs after `stamp` in the same write, so a reset sets now, in the move write or a later one.
- Lookup failure. `launchSettings`'s default `keyLineage` throws, so a writer built without one refuses. A throw, an answer that isn't an array, an id that isn't twelve lowercase hex, or a non-empty answer without the asked id refuses `OrganizationError('proxy-key-refused')` and writes nothing. The broker already passes that code through by name. A write that adds no new daily key quota never calls the lookup: account limits, legacy leaves, a changed or unchanged quota, a reset.
- Remove then re-add. A quota removed in one write and added back in a later one finds no old leaf, so it is a new quota and gets now. Documented in the `carried` comment and the READMEs.
- Docs. packages/plugins/usage/cliproxy-queue/README.md: the last paragraph's "stamps a new `since` on a renamed leaf ... restarts its count" is replaced by the carry rule, the remove-then-re-add rule and the lookup refusal. packages/plugins/README.md (daily-quota section) and packages/plugins/limit-check/daily-quota/README.md (model-key section) gain the carry sentence. packages/business/README.md had no `since` rule and, as the R3 review said, no model-key leaf; it now has a paragraph after `launch.limits.tokens.daily` on the leaf, the writer's `since` rules with the carry, and `keyLineage`.
Choices and departures, and why:
- Which leaves ask. Only a new leaf that is a daily key quota once stamped (`isDailyModelQuota` with `since` set to now). A twelve-hex-named plain `{limit}` leaf is a legacy account limit under row 333's rule, so it keeps the plain new-leaf rule and the lookup is not called. Source leaves must be daily key quotas too, so a legacy leaf's `since` never carries into a daily quota.
- A leaf that changes shape at the same path, a legacy `{limit, since}` becoming a daily quota, keeps its stored `since` under the existing same-path rule. Unchanged; found while writing the default-lookup case, which now adds a fresh id.
- Earliest against latest. The business test separates them: A from T0, B added from A (T0) and then reset to T1, both moved to C, and C takes T0 where the latest would give T1. Mutant M3 shows the test tells them apart.
- The real-runtime test uses a re-issue, not a rotation. The runtime keeps its `ModelKeys` inside and exposes no rotate, and its sweep rotates only at `rotateBy`, 30 days after issue, which no daily window spans without mocking the runtime's clock. The re-issue gives the same shape of lineage (B current, A among the earlier ids) and goes through the real `startBroker` wiring, the broker's `limits.set` and the runtime's own lookup. The rotation path through the writer is p5-key-lineage's R4 writer test, with the real `Credentials`, `ModelKeys`, `createLimits` and daily-quota module.
- The R3 "settings-writer move" test, which pinned a count of 100, now requires 160 and is renamed for R4. The R3 departure 3 and its "Not done" item are superseded by this ruling.
### Ruling 2: the orphan set on every refresh
`observeOrphans` (limits.mjs) runs in `refresh`, which the runtime calls after each committed verb and at boot, and in `orphanedKeys`. With no daily key quota left it stores an empty set for the business; otherwise it reads the lineages and calls `noteOrphans`, which logs each id not in the stored set and stores the current set. When the lineages can't be read it leaves the stored set as it was and logs nothing. So a quota removed and added back logs again, and an unchanged orphan logs once however many refreshes see it. The set is in memory: a restart is a fresh observation, and a quota still orphaned after it logs once more. No marker is persisted. This is in the `orphansLogged` comment and the cliproxy-queue README.
Consequence: the orphan line now comes at the first refresh that sees the orphan, which can be boot or the refresh at the start of a launch decision, before that decision's own refusal line. Two R3 tests asserted the old order and now expect the orphan line first: the fire and re-hire test (the line comes at the keyless launch before the re-hire, not at the first launch after it) and the ruling 2 test. The number of orphan lines is unchanged in both.
### Ruling 3: the barrier's last yield
p5-telemetry-fixture.mjs captures `realSetImmediate` at module load with the other real timers, and `pollSettledAfterTick` yields on it inside the deadline, so a mocked `setImmediate` can't hold the barrier and the deadline covers the whole wait. Both options in the ruling, since together they cost nothing. The new p5-background test mocks `Date`, `setInterval`, `setTimeout` and `setImmediate`, advances one poll tick through the barrier, never ticks again, and requires the barrier to settle within a real bound of twice `WAIT_MS`, with the second queue read seen and the proxy state `available`. Against the R3 fixture it fails "pollSettledAfterTick did not settle" (about 10 s, the outer bound); I checked that before keeping the test.
### Ruling 4: records
- The 64-id bound is a limit. A lineage holds the current id, the retiring ids and the newest 64 earlier ids. Once an id falls out of the newest 64, a quota named by it is in no lineage, so it is orphaned while the agent stays hired: it limits nothing and the usage view lists it. Moving the quota to a current id fixes it, and since the old id is no longer in the lineage the writer can't carry its `since`, so the moved quota starts at now. Recorded here and in the cliproxy-queue README.
- R3 departure 4, corrected. Its reason, that proxy queue events "can only name keys the proxy still accepts, so earlier ids would never match", is wrong. A queued event the proxy accepted before the key left the record and that the bus drains after it names an id that is no longer current or retiring. proxy-usage.mjs:42-67 builds its owner map from current and retiring ids only, so that event goes to the reconcile log as `proxy-usage-unknown-key` and is not recorded. That loses telemetry attribution for the event. It is not a quota bypass: quotas count the native transcript records, which carry the run's bound key id. The owner map is unchanged in R4.
### Tests
Added:
- packages/bus/tests/p5-key-lineage.test.mjs. The R3 writer test becomes the R4 writer test: A's quota is set at the start, the agent uses 60 on A, rotates, the human moves the unchanged quota to B, B's `since` equals A's, and after 30 more on A and 70 on B the launch refuses with count 160 and the report shows 160; a reset after the move sets now, the count is 0 and the launch goes ahead. New: a lineage that can't be read (an id in two agents' lineages) refuses a write adding a key quota with `proxy-key-refused`, the file unchanged, and a write adding none (a changed limit and a legacy hex leaf) saves without asking. New: an orphaned quota removed and added back logs twice, three more refreshes, a launch and `orphanedKeys` add nothing, and after a restart three refreshes add exactly one.
- packages/bus/tests/p5-runtime.test.mjs. Real `startBroker`, fake loopback proxy: a 2-token quota on A, a turn spends 2 on A, the launch refuses, the proxy stops listing A, `modelPreflight` issues B, `limits.set` moves the unchanged quota to B with no reset, the stored leaf is B with A's `since`, no key value is in the limits view, and the next `mayLaunch` refuses.
- packages/bus/tests/p5-background.test.mjs. The ruling 3 barrier test.
- packages/business/tests/token-limit-settings.test.mjs, with a stub lookup. One test: B added beside A carries A's time; earliest over latest; an id in no lineage gets now; a caller-supplied `since` refuses on a new leaf, a moved leaf and with the carried time itself; a reset in the move write sets now; removed and added back gets now. The other: no lookup for account limits, legacy hex leaves, a changed quota or a reset; a lookup that throws (with and without a code) or answers a string, a list holding a number, a list holding an uppercase id, a list without the asked id or an object refuses `proxy-key-refused` with the file unchanged; the default writer refuses a new daily key quota and saves account and legacy limits.
Changed: the existing P5 business test passes a lookup answering `[]`, since a writer without one now refuses that leaf. In p5-key-lineage, the R3 fire and re-hire test and the ruling 2 test expect the orphan line first (Ruling 2 above).
### Runs
One at a time, each under a 30-minute limit (`timeout -k 10 1800 node --test`), Node v26.8.1, with TMPDIR under /mnt/storage/scratch/tmp and output to files there. Each whole run is `node --test` over the package's tests directory. All times are 2026-11-03 UTC. The first runs were on the working tree that became f65faf9df, committed with no edit between; the cli stack runs and the closing whole-package runs were on f65faf9df itself, the latter after the mutants were restored.
| Run | Tree | Tests | Pass | Fail | Skip | Time |
|---|---|---|---|---|---|---|
| bus whole | before commit | 1397 | 1397 | 0 | 0 | 50 s, 00:55:51Z to 00:56:41Z |
| plugins whole | before commit | 132 | 132 | 0 | 0 | under 1 s, 00:56:53Z |
| business whole | before commit | 295 | 295 | 0 | 0 | 4 s, 00:56:53Z to 00:56:57Z |
| webui whole, run 1 | before commit | 499 | 498 | 1 | 0 | 88 s, 00:57:00Z to 00:58:28Z |
The webui run 1 failure was editor-browser.test.mjs:93, the CSP editor test: `Condition timed out: !document.querySelector("#doc-save").disabled` at :122, with the host's load average between 45 and 60. R4 changes nothing webui loads. The file passed alone and the whole package passed twice after, so I read it as load, not R4; both runs are listed. The model-final-completion.test.mjs:69 flake (16 !== 19) did not appear in either bus run. Against R3, bus is up 4 (p5-key-lineage's lookup-failure and orphan re-add tests, the p5-runtime move test, the p5-background barrier test; the writer test is renamed, not added) and business up 2. Plugins and webui are unchanged.
Pins. No test pins any changed path with a hash: the grep of every test, script and fixture naming a changed file's basename for a 64-hex string found only packages/queue/tests/fixtures/queue-marked.md, which names none of the four READMEs. The tests that read a changed file by path (limit-checks.test.mjs:319 and :323, host-run.test.mjs:429) are in packages/bus, run whole. Outside the four packages, harness tools.test.mjs imports `SETTINGS_KEYS` from launch-settings.mjs and ran whole (above). Nineteen packages/cli test files import `startBroker` from bus runtime.mjs; they import, they don't pin, and beyond the four cli files the brief names they were not run (Not done).
### Mutants
Each was applied to f65faf9df, run against the named files, and restored with `git checkout -- <file>`; `git status --short` was empty after each.
| Mutant | Change | Killed by | Result |
|---|---|---|---|
| M1 | launch-settings.mjs:73 `entry.since = kept ?? now;`, so stamp ignores the lineage | p5-key-lineage.test.mjs:173, the writer test, at :185: B's `since` was the move time `2026-10-24T12:01:00.000Z` where A's `2026-10-24T12:00:00.000Z` was expected. p5-runtime.test.mjs:62 at :106: the stored B leaf had the move time, not A's. token-limit-settings.test.mjs:178 at :184: B took the write time 08:00 where A's 07:00 was expected. Also p5-key-lineage :198 at :206 and token-limit-settings :204 at :212, both because the lookup is never called (`asked` was 0 where 1 was expected, and `[]` where `[A]` was) | p5-key-lineage 2 of 11 fail, p5-runtime 1 of 2, token-limit-settings 2 of 9 |
| M2 | runtime.mjs:346 passes `launchSettings` no `keyLineage` | p5-runtime.test.mjs:62 at :88: `proxy-key-refused` from the broker at the first `limits.set` that adds a key quota, since the writer's default lookup refuses. The R3 P5 runtime test at :39 fails the same way | p5-runtime 2 of 2 fail |
| M3 | launch-settings.mjs:96 sorts descending, so the latest `since` wins | token-limit-settings.test.mjs:178 at :189: C had `since` 08:00 (T1, B's reset time) where 07:00 (T0, A's) was expected | token-limit-settings 1 of 9 fail. p5-key-lineage and p5-runtime pass (13 of 13): each of their moves has one source leaf, so earliest and latest are the same there |
| M4 | limits.mjs:130, `refresh` no longer calls `observeOrphans` | p5-key-lineage.test.mjs:348, the orphan re-add test, at :358: one `limit-key-orphaned` line where two were expected; the set was never cleared, so the re-added leaf was still remembered. Also the R3 fire and re-hire test at :299 and the R3 ruling 2 test at :341, each missing the orphan line the refresh now logs first | p5-key-lineage 3 of 11 fail |
| M4b | limits.mjs:90 returns `[]` with no daily key quota but leaves the remembered set alone | p5-key-lineage.test.mjs:348 at :358, the same one-line-for-two failure | p5-key-lineage 1 of 11 fail |
| M5 | p5-telemetry-fixture.mjs restored to its R3 content | p5-background.test.mjs:71, the barrier test: `pollSettledAfterTick did not settle` after 10 s | p5-background 1 of 5 fail |
M4b and M5 are extra. M4b shows the empty set itself is needed, not only the refresh call. M5 shows the ruling 3 test fails on the R3 barrier, whose last yield used the mocked `setImmediate` outside the deadline.
### Not done
- No push, queue, Vikunja, Gitea or PR action, per the brief.
- No migration or persisted orphan marker, per the rulings.
- The proxy-usage owner map still holds only current and retiring ids (Ruling 4 above).
- The nineteen packages/cli test files that import bus runtime.mjs were not run beyond the four the brief names: they import it and pin nothing, and the runtime change adds only the lookup, used when a write adds a daily key quota.
These are first guards to establish on the admitted runner. Current controls have NOT run after the priority STOP; no source guard is described as observed RED/GREEN.
| R1 finding | Whole-file control | Baseline first guard / RED cause | Fixed positive and boundary controls |
|---|---|---|---|
|1 P1 identity|packages/bus/tests/p5-identity.test.mjs|Boot foreign sentinel still leaves queueCalls=1 where0 required; later foreign/refused listener increments calls; all are behavior assertions, not fixture errors.|Matching sentinel drains without any issued agent key; boot/later refusal zero queue consumption; human plugins/usage reads stay available; fresh sentinel check precedes each drain; sticky refusal never retries the management list.|
|2 P2 namespace/checks|packages/bus/tests/p5-key-compatibility.test.mjs|Plain abcdefabcdef account native count at10 is ignored; no-model lookup returns proxy-key-refused below limit; empty checks wrongly perform metadata lookup; chief reset of plain account leaf refuses.|Below/at legacy quota, original account count/report with no proxy and unrelated proxy metadata; zero lookups for plain leaves or empty checks (legacy and daily); shared validated daily shape; daily model matching/report positive; old/new daily/plain/removal/reset human fence; malformed partial daily schema refuses.|
|3 P2 nonblocking|packages/bus/tests/p5-background.test.mjs|The queue response is causally held; queue arrival plus one event-loop barrier leaves f.bus=null because503 startBroker awaits the poll. Startup assertion must fail before releasing the held response.|Ready/control/native key preflight/native usage/limit work completes while held; interval shares singleflight; explicit success/failure release updates availability; close of a held poll remains pending at4999ms and completes at the original5000ms virtual client deadline. No sleeps/deadline increase.|
The preserved24 whole files remain explicitly listed in whole-files.txt, plus the three new controls and the affected existing ModelKeys whole file (28 total). Current503-added cumulative-model fixture tests in token-limit/limit-checks/p5-key-context are corrected to legacy plain-account or accepted DAILY model semantics; their count/refusal/ownership assertions remain. All original09a847 base assertions/deadlines are retained; authorized usage inventory additions are unchanged.
Overlay sequence (isolated private copies only):
1. Materialize Git503b91e56137482abef475bc3b1b72a64b0a329c in a private admitted runner root. Do not run product from this author worktree.
2. Apply packet/baseline-controls.patch, which adds exactly the current three control files and fake fixture; it changes no production byte. This is the original503 baseline for all three first guards.
3. Execute each control whole file under the admitted private gate-tool/native priority contract. Retain every genuine behavior RED.
4. Apply packet/baseline-to-fixed.patch. It is the complete fixed source/test delta with the four already-installed controls removed from the patch to avoid reapplication. This must yield packet/source-tests.patch's exact fixed overlay on503.
5. Rehash every fixed input, run the three controls then all28 current whole files with original budgets, collect native priority root/actual-child evidence, raw receipts/exit codes, actual consumed-source map and cleanup. Priority/setup failure stops, not retries.
Additional forensic snapshot: baselines/runtime-before-background-fix.mjs captures finding1+2-prepared runtime immediately before the finding3 source edit. It is evidence only; canonical baseline for replay is Git503 plus controls. No snapshot substitutes unobserved source controls for runtime evidence.
HEAD must remain `503b91e56137482abef475bc3b1b72a64b0a329c` until applicable runner GREEN. This packet is an UNCOMMITTED source/test overlay, not a new accepted product commit. Parent owns the dedicated1014 admission/profile and runtime execution. No full/browser/provider/namespace or scheduler change is part of this packet.
## Entry ownership and limitation
The actual diagnostic entry used in receipt07 was
`agents/codex/work/queue-333/r1-repair/run-strict19.sh`, calling the private
`run-priority.mjs` and `priority-guard.mjs` in that directory. Those exact source
bytes are preserved as evidence. It is **NOT an admitted gate entry and must not
be retried**: native drift was observed and Node --test's root did not execute
its forwarded preload, so the direct-child handshake capture was incomplete.
`run-light.sh` is likewise an old nice-only behavior runner, not a strict19 gate.
No new execution entry/profile on1014 has been admitted. The parent must name
and pin its private gate-tool entry and the actual selected root before running.
Do not substitute either old runner or the original503 scoped runner. Read-only
R2 may examine this packet before runtime acceptance; it cannot admit a gate.
## Requirements for the parent's private gate-tool entry
1. Invoke only the exact whole-file list in the frozen packet, serial concurrency1. Preserve all existing test timeouts and budgets. Use a fresh mktemp private HOME/XDG_CONFIG_HOME/TMPDIR/MOSAIC_CONFIG for each baseline/fixed pass; no real instance/auth/env/credential paths, provider traffic or host proxy.
2. Establish native own-process priority19 in the actual gate-tool root before module execution: setPriority(0,19) and native readback. A shell's relative nice or inherited priority is not evidence. The observer/root must itself retain the required priority for the run; any setup refusal or observed drift is STOP/UNVERIFIED, never behavior RED.
3. Establish the same own-process native preexec/set/readback in **every actual test child**, not only a preload forwarded to a Node test runner or an inert wrapper. The gate root must execute its own prelude, and each test child must execute its prelude before importing the tested modules. Do not add a no-op prelude that misses Node's --test parent. No retry/repeated renice or host-daemon modification around drift is permitted.
4. Capture native getPriority(child.pid) from the direct parent before tested module execution and after tested module work while that child still exists; use a causal acknowledgement barrier rather than a timed race. Capture child self-readbacks before/after and on exit as well. Record pid/ppid, phase, actual priority, exit/signal and the source pin of every private helper. Both root and actual testchild evidence are required. A missing/ESRCH sample, missing handshake, setup failure or drift makes the pass unverified, independent of test assertion counts.
5. Pin the gate helper path/hash/Gitblob, selected test root and applied overlay hash in each raw receipt. Resolve the baseline/fixed source manifests before execution. Record exact Node version and all consumed module/data inputs from the real admitted pass; the static map here is not execution provenance.
6. Run the per-control baseline first guards against the preserved503 baseline plus the current controls-only overlay. Only the named behavior assertion failure with complete strict19 capture is intended RED. Missing imports, fixture/setup errors, timeout/priority failures are not RED. Then apply the complete fixed overlay and run each control and all28 listed whole files. Preserve output/exit statuses without normalizing raw whitespace. Recheck hashes after execution and collect cleanup proof.
Programmatic Node test-runner entry or a native preexec wrapper may implement
these requirements, but the implementation and target profile remain the
parent's admission decision. This document authorizes no workstation retry.
2. Confirmed regex-only key classification changes valid legacy account limits and chief resets; host lookup also runs for zero checks. Accepted scope requires daily model quotas, not cumulative model namespace takeover. Repair will use the validated daily shape consistently and drop the invented cumulative model interpretation.
3. Confirmed startup awaits proxyUsage.tick and may wait the existing management-client timeout for optional telemetry. Repair will supervise first poll in background with unchanged deadlines/singleflight/close.
Original candidate, runner, raw receipts and source pins remain unchanged. R1 repair evidence is separate in this directory. No independent approval/self-review, heavy/full/browser gate or deployment authority claimed.
Priority evidence correction (Mos1971): command text `nice -n19` is insufficient on this workstation (ananicy node16/bash-4). Earlier R1 receipts01–06 are behavior observations with priority unverified; no strict19 acceptance claim attaches to them. New bounded checks use OWN-process native setPriority(0,19) plus readback before modules and at beforeExit/exit, and wrapper native getPriority(child.pid) before/after the direct child. A setup failure, any observed drift or incomplete capture returns78 UNVERIFIED/STOP; it is never treated as intended RED or GREEN. No scheduler/daemon mutation, repeated renice, deadline change or retry around a priority refusal is authorized.
## Native priority STOP (receipt07)
Actual trace07-priority-native.jsonl: wrapper PID2643577 before=19, after=16; test PID2643590 before-modules=19, after-modules=16, exit=16. Six behavior assertions completed, but the test runner reports a file failure because priority guard changed exit status. This is **UNVERIFIED/STOP exit78**, not intended RED and not GREEN. Node --test forwarded --import to its test subprocess, so the direct test-runner parent did not execute that preload: the requested direct-child handshake/capture is also incomplete. No priority or provenance proof is inferred from command text or the six assertions. No further local test runs are authorized after this observed drift; no scheduler mutation or retry was attempted. Admitted runner verification is required. Source/regression preparation continues under the user's explicit fallback mandate.
Added ModelKeys.verifyIdentity(), serialized by the existing controller. It requires the existing ready state, performs a fresh sentinel-only management-list check, never issues an agent credential, never reconciles, and honors sticky proxy-open refusal. Collector now awaits client acquisition; the P5 runtime usage callback verifies that identity before returning its management client. Boot refusal and later failure retain the human surface, unavailable telemetry and value-free receipt, with zero queue drain. Matching sentinel requires no issued agent key.
Receipts01/02: actual behavior REDs under nice-relative priority, later reclassified priority-UNVERIFIED. Boot observed queue1 vs expected0; later refusal queue2 vs expected1; changed-listener predrain control likewise failed. Receipt03 recorded12/12 behavior passes after the fix (identity, proxy collector, native quota runtime files), also priority-UNVERIFIED. These are observations only, not strict19 acceptance. Current identity controls now await the initial poll's actual receipt to preserve the same assertions after the nonblocking startup change; current bytes have not run.
A shared pure isDailyModelQuota() validates key ID and the full daily {limit,since,reset,timeZone} leaf. Business schema, daily and cumulative checks, host metadata lookup and both old/new organization fences use it. Plain {limit,since} keys stay legacy account leaves regardless of twelve-hex spelling; token-limit matches/reports account only. Zero loaded checks returns before any model metadata lookup. Daily model changes, plain→daily, daily→plain/removal and reset remain human-only; plain legacy chief resets remain permitted. The invented cumulative model-key interpretation is removed, not moved into a new namespace.
Receipts04/05 captured actual legacy failures (lookup refusals, wrong account matching, empty checks, chief reset) under nice-relative priority. Receipt04 also contained a new fixture missing-system error; receipt05 corrects the fixture and demonstrates the actual chief-reset refusal. Receipt06 recorded6/6 behavior passes after source repair, priority-UNVERIFIED. Receipt07 later observed strict-priority drift and STOP. Candidate503-specific cumulative-model test fixtures are retargeted to accepted daily leaves with every enforcement assertion retained; the appended token-limit test now asserts legacy account semantics. Pre-P5/base assertions and deadlines remain unchanged. No post-STOP execution is claimed.
## Finding 3 source response / execution pending
Prepared p5-background.test.mjs with a queue response held open, explicit queue-arrival/event-loop barriers (no sleeps or racing deadlines), native readiness/control/key-preflight/usage/limit work while held, scheduled singleflight, success/failure release, and cleanup at the original5000ms management deadline using virtual timers. First guard is that f.bus is nonnull while the queue is still held; original503 awaits that held response and should fail this behavior assertion. These controls have NOT RUN locally, not RED/GREEN evidence.
Saved exact immediately-pre-fix runtime bytes in baselines/runtime-before-background-fix.mjs. Fixed runtime uses one supervised usageTick function for the initial call and later interval. The first call is background; the same collector singleflight and original close/pending/client deadline apply. Only P5 usage wiring/tick hunks changed; no launcher/session/harness/business route edits. Admitted runner must establish genuine priority-verified RED then GREEN on the pinned baseline/fixed overlays before any new product commit.
## Static packet handoff — no product commit
Per latest owner direction, HEAD remains original503 and all repairs stay UNCOMMITTED. No local tests or Node product execution followed receipt07 STOP, including no syntax-check substitute. New background controls and final current source bytes are pending execution. The packet contains the complete source/test diff from503 (including untracked controls/helper), controls-only baseline overlay, baseline→fixed remainder, exact baseline/fixed bytes with SHA256/size/Gitblob IDs, static module/dependency edges and full28-file list. Its input map is explicitly STATIC, not a fresh consumed-source observation. Genuine strict19 baseline RED/fixed GREEN and actual consumed-source capture must come from the admitted runner before any product commit. The parent may request new read-onlyR2 on these exact bytes before execution; this author issues no independent/self-review verdict.
Gate entry/root and root+actual-testchild native preexec/readback requirements are in GATE-ENTRY.md. Existing diagnostic drivers are preserved only as failed/incomplete priority evidence and are not authorized for retry. Dedicated1014 admission/profile and private gate-tool entry remain pending with the parent. Cleanup from every actual test run used private mktemp EXIT/test fixture cleanup. No scheduler, live proxy/account/credential/provider, P3 launcher/session/harness/business-route, queue, remote or landing state was changed.
Review time: 2026-10-26 23:03 UTC (2026-10-26 18:03 CDT).
Reviewed the exact candidate/base Git objects, all 31 changed package files, and supporting callers/contracts. The isolated worktree HEAD equals the full candidate and its status was clean. The parent's integrated row334 product was not substituted for this candidate. Requirements are accepted P5 in `docs/plans/2026-10-24_model-proxy-rows.md`, design D18–D20 with the mos-1600 per-key/no-raw-upstream correction, and the review assignment's compatibility and nonblocking constraints.
## Findings
### 1. P1 — Do not drain a listener after its instance identity was refused
Primary location: candidate `packages/bus/src/runtime.mjs:387–389`; destructive read at `packages/bus/src/proxy-usage.mjs:31–33`.
Source trigger: enable `plugins.usage: "cliproxy-queue"`, point the instance at a loopback management listener that accepts its management authentication but lacks this config directory's sentinel (for example a different instance with a reused management key). `ModelKeys.reconcile()` checks the sentinel before modifying the list (`model-keys.mjs:80–84`) and throws `proxy-open`; runtime intentionally catches that refusal to retain the control surface (`runtime.mjs:326–327`). Nevertheless the new collector receives `client: () => modelProxyClient` unconditionally and performs the queue GET at startup and on later ticks. It never consults the controller's identity/readiness refusal.
The GET consumes the other listener's queue. Resolving local owners *after*`module.read()` and dropping/logging unknown IDs cannot undo that consumption. The local Store writer lock prevents two local writers, but does not establish ownership of a remote loopback listener. This is a new P5 side effect after a fail-closed refusal; it is not a request to change P2's existing decision to keep human controls available.
Smallest remedy: fence the collector's management-client access behind verified identity for this instance, honoring boot and subsequent sentinel refusals before any queue GET. Keep an unavailable telemetry state and value-free receipt when verification is absent; do not retry around `proxy-open`. This must not require a particular agent to have an issued key merely to establish instance identity.
Required regression evidence: a fake listener accepts management auth and returns a valid foreign sentinel/list, while its queue records/drains calls. With telemetry enabled, assert `proxy-open`, zero queue requests/consumption across startup and scheduled ticks, and an available human/control surface. Add the matching-instance positive case and a refusal after a previously successful identity check. Current `p5-runtime.test.mjs` uses the correct sentinel and enables telemetry only after startup; `proxy-usage.test.mjs` bypasses this host identity boundary entirely.
### 2. P2 — Twelve-hex legacy account names lose their quota, reset, and no-check behavior
Primary location: candidate `packages/plugins/limit-check/token-limit/index.mjs:33–35`; related new gates at `packages/bus/src/limits.mjs:126–136` and `packages/business/src/organization.mjs:85–91`.
Concrete legacy input: `launch.account.name = "abcdefabcdef"`, an ordinary existing `tokens.keys.abcdefabcdef = { limit: 10, since: <canonical timestamp> }`, and native records/subject whose `account` is `abcdefabcdef`. No proxy or model record is needed by this previously valid configuration. `ID_PATTERN` accepts this account name (`business/src/vocabulary.mjs:206`; `launch.mjs:85–92`), and the base token-limit matched every keys leaf against `account` (`base token-limit/index.mjs:31–34`). Nothing in the accepted P5 brief reserves existing twelve-hex account names.
The candidate changes this plain leaf to match `modelKeyId` solely because its name matches a regex. Consequently:
- With `token-limit` enabled and no proxy/model record, `createLimits` returns `proxy-key-refused` even below the account limit, before asking the check. At the plug-in level, known account records at the limit are instead ignored and its count becomes zero.
- With no limit checks configured, `state().checks` is `[]`, so it passes the `!st.checks` guard. The same lookup still runs before the empty loop and returns `proxy-key-refused`. The base returned `allow:true` / `stop:false` here. Thus an unused legacy limit now blocks launches/stops turns even though enforcement is switched off.
- With proxy metadata present, the resolved model ID generally differs from the account name; the account quota silently stops matching its original records. The new organization fence also prevents the chief's previously permitted reset of this plain account leaf.
These outcomes follow directly from the branches above, independently of the builder's test counts. They are introduced regressions, not Mos1864 baseline defects. The same reasoning applies to the previously examined valid name `abcdef012345`; the parent's additional `abcdefabcdef` example confirms the ambiguity without relying on a digit-leading name.
Smallest contract-preserving remedy within accepted P5: distinguish the genuinely new daily model-key leaf by its validated `reset`/`timeZone` shape, retain ordinary `{limit,since}` keys leaves as legacy account limits, and use that same classification consistently in the host lookup, matching, reports and both organization fences (including old-to-new/removal transitions). Preserve the empty-check path before performing metadata lookup. P5 requires daily model-key quotas; newly added cumulative model-key support must not silently take over the existing account namespace. If cumulative model-key quotas are retained, they need an unambiguous separately authorized representation.
Required regression evidence: cover `abcdefabcdef` with plain account limits, no proxy/model record, below/at limit, original account report count and chief reset; repeat with proxy metadata whose ID differs. Cover no configured checks with that legacy leaf and with a new daily model-key leaf: preserve the established no-check result without resolving model metadata. Retain positive daily per-key enforcement, current/retiring native lookup, and human-only changes/removals/resets for actual model-key daily quotas. Existing P5 tests cover an invented cumulative model-key interpretation and a daily key, but not this legacy collision or the empty-check branch.
Source trigger: correct sentinel/reconciliation, telemetry enabled at boot, and a queue endpoint that stalls while other management operations work. The initial `await proxyUsage.tick()` waits for that queue read, up to the existing five-second client deadline (`model-proxy/src/client.mjs:10,45`). The process waits for `startBroker()` before sending its ready answer and launch capabilities (`bus/src/process.mjs:147–152`). Thus optional telemetry delays native readiness/launch admission even though it has no quota authority. Later timer ticks are independent of native requests; the startup await is the exception.
Smallest remedy: start the first poll in the same supervised background path as subsequent ticks, preserving single-flight handling, value-free errors and close cleanup. Do not increase any existing deadline.
Required regression evidence: hold a fake queue response open while allowing required reconcile requests, prove startup/native readiness completes before releasing the queue, and exercise native usage/limit work while a poll is outstanding. Then release/fail the response and verify availability, no duplicate drain and bounded cleanup. Current whole-file receipts contain no such slow-queue readiness test.
## Independent evidence checks
Performed read-only Git/filesystem/hash analysis, not product execution:
- `source-inputs.sha256` SHA-256 is exactly `b4662dcafb2aeb27a06e5dbd3b9d0b6d184e8624e344fed351ff20e3b255951b`. All **202** listed file hashes match candidate Git blobs and the pinned isolated tree, with zero mismatches. The 944 raw JSONL entries contain exactly 202 distinct path/hash pairs, exactly equal to the manifest; no path has multiple traced hashes.
- All **31** changed package paths exactly equal `candidate-sourcepaths.txt`; every entry in `candidate-sourcehashes.sha256` matches both sources. That manifest's SHA-256 is `b1457ec57c0fb695f05a08ba20b420820be5f32cac2b77ac5ea20b02115153e2`.
- All **25** entries in `receipts.sha256` match candidate blobs and isolated-tree bytes. Receipt-manifest SHA-256: `a8b91660ada571eab9c0328b74407517ec63e1ff56172302acec1d347253a810`. Raw source-trace SHA-256: `9c16aa4b8e6d81aa5b9867fec5e0890b22e90db5c307da55badfcfa9f240aef1`.
- The scoped runner explicitly names **24 whole test files**, uses `nice -n 19`, `--test-concurrency=1`, and private HOME/XDG_CONFIG_HOME/TMPDIR/MOSAIC_CONFIG with cleanup. Its SHA-256 is `c8a2bf4539bffe38f3198308fd60e9c1ad338841b406af160ab0739c15394290`. These are verified runner bytes and recorded output, not independent observation of the original processes' environment.
- Receipt24 records **174 tests, 174 pass, 0 fail/cancelled/skipped/todo**, SHA-256 `3358af061c35d42b00d5ee1e001939534c5e7563d4f5418ea85431605d0b9f6d`. This remains builder scoped evidence, not an independent test run, full gate or browser gate.
RED history is retained as RED. Receipt16 records the upstream-value mutant with **11/15 passing and four failing tests**: the client exposes the raw account value, while collector validation refuses it and downstream expectations fail. Receipt17 records restored **15/15**. Final client bytes hash to `f5f86cad661034f223a76352d877fa8d7883bfa921a7a01282347a9a03272441`, matching the documented restoration hash and final source pins. The receipts do not contain a separately captured pre/post backup or mutant patch hash, so byte-identical restoration at that historical instant is documented by the builder rather than independently replayed here.
Receipt18 is **169/170**, with the exact existing `REQ-LIMIT-4 a role run at its limit stops at the end of its turn: RESULT and read land first, the claim is revoked by limit-check` assertion failing at `limit-stop.test.mjs:61` because `run` was added to the original second subject argument. The candidate keeps that argument's shape and puts `{run}` in the private third context. The entire original limit-stop file is byte-identical to base. Receipt19 records **170/170** after that correction. Receipt20 is a genuine **2/3** RED for the supplied modelKeyId fallback; receipt21 is **15/15** after its removal. Receipt22 records **173/173**. Receipt23 is a genuine **3/4** RED for missing native context; receipt24 records **174/174** after the explicit context refusal. These were builder development REDs, not prior independent review findings, and are not relabelled GREEN. Receipt05 also remains a syntax-error RED despite its filename; receipts12/13 remain failed runtime-fixture runs.
All modified pre-existing test files other than the two authorized inventory updates retain their entire base bytes as an unchanged prefix. The kinds/loader edits are the strictly additive `usage`/`usage:[]` expected inventories; no old assertion or deadline was removed or weakened.
## Other source conclusions and limits
Telemetry source rows are excluded at the start of `turnRecords`, before native totals and quota input. The collector validates and whitelists persisted fields, uses hashed client/upstream identities, retains only safe failure metadata, serializes concurrent ticks, and routes current/retiring ownership from credential status. Malformed/unknown/oversize/non-finite/unsafe counts cannot flow through the new queue client as raw values into store, error, audit or Console fields: the queue operation reuses fixed loopback GET, count=100, original response cap/deadline and value-free errors/receipts. No second queue consumer was found in the product sources; finding 1 concerns foreign-listener identity rather than local double counting.
Native model-key authority comes from the host's run map and credential metadata, not a JSON-supplied key ID. Lookup rejects missing/duplicate owners, foreign business/instance/run, missing retained generations and ambiguous IDs. The broker's private context is derived from its authenticated session; the public subject drops supplied run/modelKeyId fields. The new usage and model-quota fences run before validation and again against serialized bytes, compare against the old human, and reject tester/agent identities even when names collide. Finding 2 concerns which leaves those otherwise fail-closed fences classify.
Polling is absent by default, defaults to 15 seconds when enabled, validates integer 1..59, and is exposed through the exact human `plugins.set` argument contract. Console native key rows and optional proxy-reported account counts are separated and labelled; telemetry is explicitly described as incomplete and non-enforcing. Broker imports are unchanged, kinds remains import-free, and no host management implementation was added to the pure Broker/sandbox import closure. No P3 launcher/session/harness/business-routing files changed.
No tests, Node/product runtime, HTTP, browser, provider, real instance config, credential files or live proxy paths were run/read. Hash checking used repository files only. No code, tests, helpers, queue, session/build logs, issues, posts, pushes, commits, merges or live state were changed; this report is the only authorized write. Static analysis establishes the reported branch behavior; the suggested regression cases remain to be executed by the authorized builder/gate owner. Hash equality verifies the captured inputs/receipts, not completeness of uninstrumented reads or independent execution provenance.
These three findings are in the candidate delta. No pre-existing issue is being promoted to a new landing blocker; any separately identified baseline defect belongs under Mos1864 unless a required gate is RED. #662 / 72f77815 and #657/#658 remain excluded/backlog; #267/#289 are outside the 10-27 slice but remain in full scope. The #660 full-gate target is not admitted by this review. No landing authority or full/browser/combined-gate approval is implied.
Loaded 100 of 13729 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
jason.woltje
mos
Steelbeak
rocko