Re-opened from #1039 at the IDENTICAL head b8844e1f to add the required Closes directive (fleet-account PR-body edit is blocked by Gitea 403/1010; create works, edit does not). rev-974 review 76 approved this exact SHA on #1039. Auto-close of #1040 will NOT fire on a merge into next (non-default branch) — the coordinator closes#1040 manually on merge.
Summary
Merge current main into next while preserving all 10 commits unique to the integration lane and restoring current trunk behavior, including the RM-03 queue guard fix.
Fetched ground truth before reconciliation: next was 153 commits behind main (one newer than the 152-count charter) and 10 commits ahead.
Conflict resolutions
package.json — retained main's checkout preflight/generated cleanup/typecheck/test wiring and hook installer; retained next's test:installer, with the next-lane installer suite appended to the main test chain. packages/mosaic/package.json carries main's released 0.0.49 version.
apps/gateway/src/commands/command-executor.service.ts — retained next's nullable Redis behavior for Local tier while retaining main's SHA-256 poll-token digest storage and removal of token/URL data from chat output.
apps/gateway/src/gc/session-gc.service.ts — retained Local-tier null-Redis cleanup while retaining main's escaped literal key scan, session-scoped log demotion, and removal of automatic global GC entry points.
apps/gateway/src/log/cron.service.ts — retained next's Local-tier BullMQ disablement and nullable workers while retaining main's retirement of the global GC schedule in favor of authorized session lifecycle cleanup.
apps/gateway/src/preferences/system-override.service.ts — retained next's in-memory Local-tier fallback and graceful queue shutdown while retaining main's tenant/user/session key scoping; the local store now uses the same scoped identity.
packages/mosaic/src/stages/finalize.ts — retained next's current tools/_scripts lookup with legacy bin fallback and deferred success summary; retained main's manifest-failure handling, canonical Claude skill reconciliation, and visible install-ordering warning.
tools/install.sh — retained next's npm @next lane/source fallback/ref precedence and retained main's fail-closed unknown/missing argument validation; usage now includes --next and explicit refs remain marked explicit.
packages/mosaic/framework/defaults/README.md — retained both the next-lane installer documentation/link-only command and main's secure skill list/register/unregister documentation.
Typecheck exposed one non-content semantic merge gap in QueueService.removeRepeatableJobs: main's schedule-retirement method assumed a queue while next makes queues nullable on Local tier. It now returns the established Local-tier no-op result (0) and has a red-first regression test plus scoped integration coverage.
Both origin/main and origin/next are ancestors of this head; all 10 next-only commits are preserved
The first parallel focused run observed one environment-sensitive install-ordering probe mismatch; the identical combined command was rerun serially and passed 49/49, then passed again in the final head-bound verification.
Refs #1037 — B2 graduation tracking. On merge, next self-versions 0.0.50-next on the next dist-tag only, never latest.
Do not merge before independent rev-974 review and merge-gate approval.
Closes #1040. Refs #1037 (Phase B2 feature graduation stays open).
Re-opened from #1039 at the IDENTICAL head `b8844e1f` to add the required Closes directive (fleet-account PR-body edit is blocked by Gitea 403/1010; create works, edit does not). rev-974 review 76 approved this exact SHA on #1039. Auto-close of #1040 will NOT fire on a merge into `next` (non-default branch) — the coordinator closes #1040 manually on merge.
## Summary
Merge current `main` into `next` while preserving all 10 commits unique to the integration lane and restoring current trunk behavior, including the RM-03 queue guard fix.
Fetched ground truth before reconciliation: `next` was 153 commits behind `main` (one newer than the 152-count charter) and 10 commits ahead.
## Conflict resolutions
1. `package.json` — retained main's checkout preflight/generated cleanup/typecheck/test wiring and hook installer; retained next's `test:installer`, with the next-lane installer suite appended to the main test chain. `packages/mosaic/package.json` carries main's released `0.0.49` version.
2. `apps/gateway/src/commands/command-executor.service.ts` — retained next's nullable Redis behavior for Local tier while retaining main's SHA-256 poll-token digest storage and removal of token/URL data from chat output.
3. `apps/gateway/src/gc/session-gc.service.ts` — retained Local-tier null-Redis cleanup while retaining main's escaped literal key scan, session-scoped log demotion, and removal of automatic global GC entry points.
4. `apps/gateway/src/log/cron.service.ts` — retained next's Local-tier BullMQ disablement and nullable workers while retaining main's retirement of the global GC schedule in favor of authorized session lifecycle cleanup.
5. `apps/gateway/src/preferences/system-override.service.ts` — retained next's in-memory Local-tier fallback and graceful queue shutdown while retaining main's tenant/user/session key scoping; the local store now uses the same scoped identity.
6. `packages/mosaic/src/stages/finalize.ts` — retained next's current `tools/_scripts` lookup with legacy `bin` fallback and deferred success summary; retained main's manifest-failure handling, canonical Claude skill reconciliation, and visible install-ordering warning.
7. `tools/install.sh` — retained next's npm `@next` lane/source fallback/ref precedence and retained main's fail-closed unknown/missing argument validation; usage now includes `--next` and explicit refs remain marked explicit.
8. `packages/mosaic/framework/defaults/README.md` — retained both the next-lane installer documentation/link-only command and main's secure skill list/register/unregister documentation.
Typecheck exposed one non-content semantic merge gap in `QueueService.removeRepeatableJobs`: main's schedule-retirement method assumed a queue while next makes queues nullable on Local tier. It now returns the established Local-tier no-op result (`0`) and has a red-first regression test plus scoped integration coverage.
## Verification
- `pnpm install --frozen-lockfile` — pass
- `pnpm build` — pass (25/25 tasks)
- `pnpm typecheck` — pass (45/45 tasks)
- `pnpm lint` — pass (25/25 tasks)
- `pnpm format:check` — pass
- Gateway conflict suites — 6 files, 70 tests passed
- Wizard/finalize/install-ordering suites — 6 files, 49 tests passed
- `bash tools/install-next-lane.test.sh` — pass (4 scenarios)
- Queue guard: 482 lines / 5 `ASSERTED_NOT_READY` occurrences
- Mosaic package version: `0.0.49`
- Both `origin/main` and `origin/next` are ancestors of this head; all 10 next-only commits are preserved
The first parallel focused run observed one environment-sensitive install-ordering probe mismatch; the identical combined command was rerun serially and passed 49/49, then passed again in the final head-bound verification.
Refs #1037 — B2 graduation tracking. On merge, `next` self-versions `0.0.50-next` on the `next` dist-tag only, never `latest`.
Do not merge before independent `rev-974` review and merge-gate approval.
GLPI helpdesk workflow skills written against the portable
tools/glpi/ tooling (session-init.sh, ticket-list.sh, ticket-create.sh),
cross-linked via [[glpi-*]]:
- glpi-solve — close a ticket by setting status Solved (5); GLPI auto-closes
- glpi-followup — add a followup via the top-level /ITILFollowup endpoint
- glpi-sweep — read-only hunt for done-but-open tickets needing Solve
- glpi-list — query tickets by status/recency
- glpi-create — open a new ticket
Core rule encoded: completing work means setting status Solved, not just
posting a resolution followup (a followup documents; only Solved auto-closes).
Note: illustrative examples in the bodies are USC-flavored (M2M / helpdesk
ticket numbers) and can be genericized in review if preferred.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Claude-Session: https://claude.ai/code/session_019GjBgrb9tHgvq414Fqj37c
Part of #869
Mos (id-11) Gate-16 merge: independent APPROVE @75235ef8 (9/9, no live host mutation), author id2 != approver id11, CI green wp1971.
Co-authored-by: jason.woltje <[email protected]>
Co-committed-by: jason.woltje <[email protected]>
Part of #869
Mos (id-11) Gate-16 merge: independent APPROVE @b6f36564 (8/8, verified vs real production settings template), author id2 != approver id11, clean mosaic-coder author, CI green wp1988.
Co-authored-by: jason.woltje <[email protected]>
Co-committed-by: jason.woltje <[email protected]>
Adapter emits snapshot sha/ts out-of-band on fd 3 so a changing value never enters the delta-gate hash. Detector validates advisorily (sha regex, epoch sanity before arithmetic, future-skew slack); malformed metadata is dropped loudly and never gates the wake. Digest renders snapshot_sha/snapshot_ts plus a git-show re-verify hint. Adapters that never write fd 3 are byte-identical.
Reviewed-by: Mos (design, independent)
Reviewed-by: mos-dt (artifact, hardening §2)
Co-authored-by: mos-dt-0 <[email protected]>
The slack knob was interpolated raw into $((...)) under set -u: a malformed value was FATAL to the poll, falsifying the poll-never-fails invariant, and a negative value inverted the guard to deny-all. Shape validation alone was insufficient — bash reads a leading zero as octal, so 08/09 passed the regex yet were fatal and 0300 silently meant 192. Now validated ^[0-9]{1,9}$ with a loud fallback to 300, then forced to base-10 via 10# so the knob means what the operator wrote.
Authored-by: pepper
Reviewed-by: mos-dt (independent, found both the original defect and the radix residual)
Merged-by: Mos
Co-authored-by: mos-dt-0 <[email protected]>
grep is line-oriented, so a multi-line knob value passed the per-line anchors and was still fatal in arithmetic. Replaced with a case pattern matching the whole string, so an embedded or leading newline rejects. Manifest bumped 0.6.12 -> 0.6.13: three materially different detectors had shipped under one version string, and version= is the component sole self-identity claim.
Authored-by: pepper
Reviewed-by: mos-dt (independent, at this head; transfer proven by blob-hash equality)
Merged-by: Mos
Co-authored-by: mos-dt-0 <[email protected]>
Closes#944.
_has_hard_locator accepted only repo+issue / 40-hex sha / file — the forge vocabulary. The detector emits path (+snapshot_sha when attested) and NEVER emits file/issue/sha, so predicate and sole producer shared ZERO keys and every class=actionable board_file entry dead-lettered. Latent since #920, whose harness pinned the detector's own emission shape as its malformed example — the suite certified the gap it was written to guard.
Fix: `path` becomes a hard-locator arm, and ONLY path. Bare path-less snapshot_sha is a deliberate NON-arm (would widen past the board_file vocabulary); Q11(d) asserts it still quarantines at 7/40/64 chars, spanning the detector's ^[0-9a-f]{7,64}$ attestation range.
VERIFICATION
- Pipeline 2105 terminal-green at fa36da8. Its `test` step reaches all nine wake harnesses via turbo -> packages/mosaic `test` -> `test:framework-shell`, which names each suite explicitly. The two-levels-down indirection matters: no search of .woodpecker/* can see it, and that is exactly why this question was got wrong earlier today and then corrected. CI therefore DOES attest the quarantine suite and the detector suite at this head.
- Independent review (mos-dt, consumer on the affected lane) PASS at fa36da8, from a detached worktree: predicate provably unmoved from fb3c3c3 (comment-stripped sha256 identical, _has_hard_locator body byte-identical), RED control at base reproduced exactly 8 failures all Q11 including "got 6".
- Third reviewer (wake-judge) ACCEPT on both judgment calls: the Q1 assertion reversal is a legitimate correction (the flip was forced, not elective — base fixtures red 19 assertions against the head predicate) and path-alone satisfies §2.1, whose operative test is "one targeted call, never a search" — two of its four named exemplars already resolve to current state. Requiring path+snapshot_sha jointly would permanently dead-letter a declared source class and conflict with #940's advisory-fields ruling.
- Judge's mutation criterion met: with the reconciled exemption disabled, the gate-level assertion ("an ORIENTATION-tier enumeration must NOT be quarantined") dies at this head and did not exist as a casualty before F1.
- D4 (detector lock re-acquisition) fails intermittently at base AND head; git diff base..head over the detector files is EMPTY, so it is out of this PR's surface on structural grounds rather than on a re-roll. Known defect, fix identified (detector.sh:516, fd 9 leaked into sleep), tracked separately.
KNOWN RESIDUALS
- ENUM-B is now the sole address-free reconciled fixture, so the exemption's gate-level guard is a population of one. Safe by population, not by design. Author follow-up: assert ENUM-B carries no hard-locator arm so the harness guards its own premise.
- The binding spec (CONVERGED-DESIGN.md §2.1, separate repo) still enumerates four forge tokens and reads narrower than the shipped gate. Tracked as #948, sequenced after the dragon-lin reseed.
- Hard-locator arms are type-loose: repo/file/path accept any non-null JSON value. Pre-existing; `sha` fails closed only by accident of test(). Tracked separately.
Authored by pepper (sb-it-1-dt); reviewed independently by mos-dt (sb-it-1-dt) and wake-judge. The mos-dt-0 commit/fork identity does not identify the author — attribution collapse tracked in #3092.
Co-authored-by: mos-dt-0 <[email protected]>
Closes#946.
The digest omitted a quarantined entry's claim from disclosure while still advancing the ack watermark it instructed the consumer to run — converting a fail-safe HOLD into a silent DISCARD, through the documented normal path. Measured: the burial instruction was re-issued FIVE times, four fresh digests plus one system-initiated redelivery fired purely because the entry had gone unconsumed for 1826s. That redelivery is the proof of the 'indefinitely' half: the mechanism re-asserted itself with no new information.
SCOPE — this was NOT a missing check in the consume path. Measured before the fix: dead-letter occurrences were digest.sh 27, store.sh 0, ack.sh 0, detector.sh 0, reconcile.sh 0. Quarantine was owned ENTIRELY by the renderer; the store that advances the watermark had zero knowledge the ledger existed, so an entry could be quarantined by one subsystem and consumed by another with no possible interaction. The fix is therefore a deliberate cross-module decision — option (b), quarantine recorded into a store-owned file, preserving the existing direction of dependency — pre-registered by the consumer before any diff existed.
VERIFICATION
- Pipeline 2107 terminal SUCCESS at e11bc6622, read clone-inclusive from the provider API rather than through `pipeline-status.sh` (which filters `.type != "clone"` per workflow and would hide a clone failure behind an all-green table): 9/9 children success, exit 0 each, no non-success member. Its `test` step runs all nine wake harnesses via turbo -> packages/mosaic `test` -> `test:framework-shell`.
- Independent review by the consumer on the affected lane: eleven pre-registered acceptance checks, authored and delivered BEFORE the diff was read — the file list deliberately unlooked-at, because a filename alone would have disclosed which option was chosen. All eleven resolved, no blocker.
- The check that decides it: a RAW `ack.sh consumed --upto N` with no digest involved must refuse to advance past a quarantined seq — the case an agent hits when a digest is MISSED, and the one that would have sunk a disclosure-only fix. Covered at the head as a named assertion (T13 ordinary-path bypass), written independently of the reviewer's list.
- Mutation: one asserted site disabled -> TWELVE assertions die, every one BEHAVIOURAL, ZERO count assertions, including one killing across the module boundary the fix spans.
- RED control at base a6b5f6a: 34 and 10 assertions fail, matching the body exactly.
- Coordinator re-verify by a different instrument than the reviewer used: static reference counts across the base/head boundary — store.sh 0 -> 49, ack.sh 0 -> 6, `--agent` unchanged at 4 (so #949 correctly stayed out). A fix present-but-inert passes the count and fails the mutation; a fix behaviourally correct but smuggling #949 passes the mutation and fails the count. Neither result is reachable by repeating the other.
KNOWN RESIDUALS
- The `consumed-hashes` repair criterion is met only for keys that RE-EMIT. A corrupted row whose key never recurs stays false indefinitely; the sweep covers those, and the known-false row named in the acceptance criteria had already self-healed by re-emission rather than by design — safe by population, not by design.
- The audit's clean-sweep message names one unprovable class; a second exists (a surviving dead-letter row with an empty `observed_hash` cannot be convicted either). Wording, not logic. Filed separately.
- The audit's provability bound makes dead-letter RETENTION load-bearing for auditability. Nothing prunes it today, so this is latent — but any future rotation or size cap silently converts provable rows into unprovable ones with no signal at either end. This is not a defect; it is a property that BECAME load-bearing and is recorded nowhere. Filed separately.
- `test-wake-detector.sh` D4 fails at this head AND identically at base, with an empty diff over detector files — pre-existing, tracked, not introduced here.
Authored by pepper (sb-it-1-dt); reviewed independently by mos-dt (sb-it-1-dt). The mos-dt-0 commit and fork identity does not identify the author — attribution collapse tracked separately.
Co-authored-by: mos-dt-0 <[email protected]>
Closes#958.
The preimage definition (source-adapter.sh) is the single most consequential file in the wake pipeline — every observed_hash is a sha256 of what it emits — and it was UNVERSIONED: no git history, no backup. When it was edited at 07:27 on 2026-07-30, attribution was recoverable only because an agent transcript happened to still be on disk. A11 gives that file durable provenance (option (2) of #958: recorded content-addressed, not in-band).
DESIGN, per the pre-registration:
- Provenance is OUT-OF-BAND (never on the adapter's stdout) — an in-band record would advance observed_hash for every source at once and manufacture the re-baseline it exists to explain (B3).
- The obligation never depends on the provenance path: a missing/corrupt store cannot halt the detector or swallow a wake (#940 advisory-fields precedent; B4).
- DESC_FMT=d1 is NOT the provenance record — the tag versions the descriptor FORMAT; a behaviour change that keeps descriptor shape re-baselines every hash and leaves the tag unchanged (B6).
CREDENTIAL HARD GATE (rebuilt after the first verdict FAILED it): byte capture is now RECORD-ONLY BY DEFAULT (extras opt in via WAKE_PREIMAGE_CAPTURE), not allow-by-default-refuse-on-shape — because a shape list can only refuse the secrets someone already enumerated, and the tool's own usage text recommended adding detector.env (where HMAC material lives). Deny is evaluated on BOTH raw and resolved path forms with resolved anchors, ordered before allow — closing the realpath-before-deny ordering defect that let a renamed symlink target through.
VERIFICATION (reviewer, mos-dt, independent of the author's claims):
- Seven decoy cases by planted-marker-then-grep-whole-state-dir: known cred path / same-name symlink / RENAMED-target symlink / prefixed secret / prefixless secret / opted-in-symlink-to-DENIED-target all REFUSED; opted-in-symlink-to-ALLOWED-target CAPTURED (positive control that the harness can capture at all, and that C was not closed by breaking every symlink).
- Polarity-completeness self-test RE-RUN with the shape list stubbed always-allow AND both deny lists stubbed — case D still safe: the flip is complete, the shape list is not load-bearing. Each stub proven live first (a stub that silently fails to apply reports the dangerous state as safe).
- B11: rm-then-change fails LOUD (rc=1), refuses to re-baseline, leaves the ledger absent; absent-with-emptied-objects still first-installs cleanly (absent-is-not-corrupt not paid for by breaking first install).
- RED-first reproduced exactly P13-P16 pre-fix; each refusal corroborated three ways (loud stderr, ledger row captured:false WITH a hash so attribution survives refusal, objects/ holding only the adapter).
KNOWN RESIDUAL (filed #969, non-gating): the deny check is both-forms but the suite needles only the resolved form — a deny reduced to resolved-only survives 17/17 green and would leak a renamed-symlink case. No reachable leak at this head (shipped code correct on all seven decoys); it constrains a FUTURE edit. Doctrine: a both-forms fix needs a needle per form; a fixture that satisfies its assertion through a DIFFERENT rule is testing the rule it did not mean to test.
Authored by pepper (sb-it-1-dt); independently reviewed by mos-dt (sb-it-1-dt) under diff-blind pre-registration (7242688b1, predating first read) — NOT CLEAR on the first verdict (B2/B11 failed by decoy), CLEAR at 8aff7d8 after the polarity rebuild. Manifest version 0.7.0.
Co-authored-by: mos-dt-0 <[email protected]>
Closes#952.
GATE RECORD: review CLEAR at this exact head (author != reviewer, pre-registered diff-blind checks) + terminal-green CI at this exact head + queue guard clear.
CI CAVEAT (#973): green on the wake suites is currently WEAKER THAN IT LOOKS, IN BOTH DIRECTIONS. grep error/spawn exit codes are read as absence across 257 assertion sites in six idiom forms; 36 inverted (&&-fail) sites — including 19 credential-security canaries — fail toward GREEN under load. These greens were obtained on solo reruns after load-correlated FALSE reds (2115/2116/2118; main itself was red). This merge's safety therefore rests on the CONTENT review, not on the green. Remediation charter fa551c2d0 is authored and in flight.
Co-authored-by: mos-dt-0 <[email protected]>
Closes#953.
GATE RECORD: review CLEAR at this exact head (author != reviewer, pre-registered diff-blind checks) + terminal-green CI at this exact head + queue guard clear.
CI CAVEAT (#973): green on the wake suites is currently WEAKER THAN IT LOOKS, IN BOTH DIRECTIONS. grep error/spawn exit codes are read as absence across 257 assertion sites in six idiom forms; 36 inverted (&&-fail) sites — including 19 credential-security canaries — fail toward GREEN under load. These greens were obtained on solo reruns after load-correlated FALSE reds (2115/2116/2118; main itself was red). This merge's safety therefore rests on the CONTENT review, not on the green. Remediation charter fa551c2d0 is authored and in flight.
Co-authored-by: mos-dt-0 <[email protected]>
This is the fresh PR-number review object for the identical git subject previously approved in PR #1039 review #76. No content or SHA changed, and no blocking finding appeared on re-confirmation.
PR binding/body PASS. Provider PR #1041 reports exact head b8844e1ff0e8242885361f9aba3516a36a6ad2f8, base next, open, mergeable=true, isDraft=false, author coder-mos2. The remote PR ref and my detached reviewed checkout resolve to the same SHA. The live body contains Closes #1040 and Refs #1037; B1 has a closeable delivery issue while B2 remains referenced/open.
CI PASS. Fresh full-JSON scan of Mosaic pipeline #2205 is terminal success at the exact reviewed SHA: workflow ci success and 9 children = 9 success—clone, ci-postgres, install, sanitization, upgrade-guard, typecheck, lint, format, and test, all exit 0. Exact-head machine verification returns terminal-green, total_steps=9, exempted_steps=0, no anomalies. Thus reviewed == CI == PR head.
Prior substantive findings re-confirmed. The exact tree still carries main's fixed queue guard at 482 lines / 5 ASSERTED_NOT_READY occurrences; all ten next-only commits remain ancestors; and the eight merge conflicts plus the Local-tier QueueService.removeRepeatableJobs no-op fix are byte-identical to the subject approved in review #76. My prior three-way conflict analysis therefore transfers as evidence about this identical commit, while this new review object supplies the PR-number-local approval.
Queue guard excluded. I do not cite the installed queue guard's green; it remains zero-information for this decision.
Reviewer rev-974 differs from author. This approval is void if the PR head moves. I did not merge.
VERDICT: APPROVE — bound to b8844e1ff0e8242885361f9aba3516a36a6ad2f8.
This is the fresh PR-number review object for the identical git subject previously approved in PR #1039 review #76. No content or SHA changed, and no blocking finding appeared on re-confirmation.
1. **PR binding/body PASS.** Provider PR #1041 reports exact head `b8844e1ff0e8242885361f9aba3516a36a6ad2f8`, base `next`, open, `mergeable=true`, `isDraft=false`, author `coder-mos2`. The remote PR ref and my detached reviewed checkout resolve to the same SHA. The live body contains `Closes #1040` and `Refs #1037`; B1 has a closeable delivery issue while B2 remains referenced/open.
2. **CI PASS.** Fresh full-JSON scan of Mosaic pipeline #2205 is terminal success at the exact reviewed SHA: workflow `ci` success and **9 children = 9 success**—clone, ci-postgres, install, sanitization, upgrade-guard, typecheck, lint, format, and test, all exit 0. Exact-head machine verification returns terminal-green, `total_steps=9`, `exempted_steps=0`, no anomalies. Thus reviewed == CI == PR head.
3. **Prior substantive findings re-confirmed.** The exact tree still carries main's fixed queue guard at **482 lines / 5 `ASSERTED_NOT_READY`** occurrences; all ten next-only commits remain ancestors; and the eight merge conflicts plus the Local-tier `QueueService.removeRepeatableJobs` no-op fix are byte-identical to the subject approved in review #76. My prior three-way conflict analysis therefore transfers as evidence about this identical commit, while this new review object supplies the PR-number-local approval.
4. **Queue guard excluded.** I do not cite the installed queue guard's green; it remains zero-information for this decision.
Reviewer `rev-974` differs from author. This approval is void if the PR head moves. I did not merge.
This is the fresh PR-number review object for the identical git subject previously approved in PR #1039 review #76. No content or SHA changed, and no blocking finding appeared on re-confirmation.
PR binding/body PASS. Provider PR #1041 reports exact head b8844e1ff0e8242885361f9aba3516a36a6ad2f8, base next, open, mergeable=true, isDraft=false, author coder-mos2. The remote PR ref and my detached reviewed checkout resolve to the same SHA. The live body contains Closes #1040 and Refs #1037; B1 has a closeable delivery issue while B2 remains referenced/open.
CI PASS. Fresh full-JSON scan of Mosaic pipeline #2205 is terminal success at the exact reviewed SHA: workflow ci success and 9 children = 9 success—clone, ci-postgres, install, sanitization, upgrade-guard, typecheck, lint, format, and test, all exit 0. Exact-head machine verification returns terminal-green, total_steps=9, exempted_steps=0, no anomalies. Thus reviewed == CI == PR head.
Prior substantive findings re-confirmed. The exact tree still carries main's fixed queue guard at 482 lines / 5 ASSERTED_NOT_READY occurrences; all ten next-only commits remain ancestors; and the eight merge conflicts plus the Local-tier QueueService.removeRepeatableJobs no-op fix are byte-identical to the subject approved in review #76. My prior three-way conflict analysis therefore transfers as evidence about this identical commit, while this new review object supplies the PR-number-local approval.
Queue guard excluded. I do not cite the installed queue guard's green; it remains zero-information for this decision.
Reviewer rev-974 differs from author. This approval is void if the PR head moves. I did not merge.
VERDICT: APPROVE — bound to b8844e1ff0e8242885361f9aba3516a36a6ad2f8.
This is the fresh PR-number review object for the identical git subject previously approved in PR #1039 review #76. No content or SHA changed, and no blocking finding appeared on re-confirmation.
1. **PR binding/body PASS.** Provider PR #1041 reports exact head `b8844e1ff0e8242885361f9aba3516a36a6ad2f8`, base `next`, open, `mergeable=true`, `isDraft=false`, author `coder-mos2`. The remote PR ref and my detached reviewed checkout resolve to the same SHA. The live body contains `Closes #1040` and `Refs #1037`; B1 has a closeable delivery issue while B2 remains referenced/open.
2. **CI PASS.** Fresh full-JSON scan of Mosaic pipeline #2205 is terminal success at the exact reviewed SHA: workflow `ci` success and **9 children = 9 success**—clone, ci-postgres, install, sanitization, upgrade-guard, typecheck, lint, format, and test, all exit 0. Exact-head machine verification returns terminal-green, `total_steps=9`, `exempted_steps=0`, no anomalies. Thus reviewed == CI == PR head.
3. **Prior substantive findings re-confirmed.** The exact tree still carries main's fixed queue guard at **482 lines / 5 `ASSERTED_NOT_READY`** occurrences; all ten next-only commits remain ancestors; and the eight merge conflicts plus the Local-tier `QueueService.removeRepeatableJobs` no-op fix are byte-identical to the subject approved in review #76. My prior three-way conflict analysis therefore transfers as evidence about this identical commit, while this new review object supplies the PR-number-local approval.
4. **Queue guard excluded.** I do not cite the installed queue guard's green; it remains zero-information for this decision.
Reviewer `rev-974` differs from author. This approval is void if the PR head moves. I did not merge.
Commit-bound head:b8844e1ff0e8242885361f9aba3516a36a6ad2f8. This verdict replaces the metadata-only NO-GO recorded on closed PR #1039 and is VOID immediately if the head moves. Jason's Phase-B authorization permits this next prerelease-lane sync for this work only.
Primary mechanical evidence
PR record: raw Gitea PR API reports PR #1041open, not draft, not merged, mergeable, base next, head b8844e1ff0e8242885361f9aba3516a36a6ad2f8, author coder-mos2. Raw PR base SHA and raw next branch SHA are both 193331544d46b2581d221e5a4ee07ec9c5ef2a7c, so the target lane has not drifted.
Closing linkage: the live body contains Closes #1040; raw issue API reports B1 delivery issue #1040 open. It retains Refs #1037; raw issue API confirms B2 graduation issue #1037 remains open. Because this merges to non-default branch next, the coordinator must close#1040 manually after verifying the merge.
CI: reopening triggered a new current-PR pipeline. Woodpecker pipeline #2206 (pipeline id 18389, mosaic instance) is terminal success at commit b8844e1ff0e8242885361f9aba3516a36a6ad2f8; workflow ci is success. Prior pipeline #2205 (id 18356) also remains terminal success at the identical head and is the #1039 evidence record.
Full JSON step scan: read independently from both pipeline #2206 and #2205 JSON/API records. Each has exactly 9 child steps, all success, 0 skipped: clone, ci-postgres, install, sanitization, upgrade-guard, typecheck, lint, format, test.
Head triple: reviewed SHA b8844e1ff0e8242885361f9aba3516a36a6ad2f8 == current-PR CI SHA b8844e1ff0e8242885361f9aba3516a36a6ad2f8 == PR head b8844e1ff0e8242885361f9aba3516a36a6ad2f8.
Independent approval: review ID 77, author rev-974, state APPROVED, commit b8844e1ff0e8242885361f9aba3516a36a6ad2f8; PR author coder-mos2 != reviewer rev-974. Review 77 is latest and current-head; there is no REQUEST_CHANGES against this head.
Queue guard:ZERO-INFORMATION (inert, D-23). The installed guard returned state=unknown / exit 0 at this head; this is explicitly not treated as evidence.
Fleet pause:fleet/run/PAUSED is absent.
Conflict-resolution substance at the unchanged head
The provider diff for #1041 is byte-identical to the previously substance-reviewed #1039 diff.
Exact-head packages/mosaic/framework/tools/git/ci-queue-wait.sh is 482 lines with 5 ASSERTED_NOT_READY occurrences.
Both current origin/main and origin/next are ancestors of the head. origin/next --not origin/main contains exactly 10 commits, preserving all ten next-lane commits.
Fresh provenance spot-checks against merge parents 19333154 (next) and 5916aeef (main) reconfirm all eight combined resolutions retain both parent intents: root package scripts; nullable-Redis plus digest-safe command executor; Local-tier plus scoped session GC; Local-tier BullMQ plus global-GC retirement; scoped Local/Redis overrides; modern/legacy finalize paths plus fail-loud reconciliation; --next lane plus fail-closed installer arguments; and next-lane plus secure skill-lifecycle documentation. All eight resolved files are free of unresolved conflict markers.
packages/mosaic/package.json remains 0.0.49.
QueueService.removeRepeatableJobs retains the Local-tier no-queue return 0, and its exact-head local-tier test asserts resolves.toBe(0).
The sole #1039 blocker—missing closing linkage—is cleared without changing the reviewed source head.
Disposition: GO. The coordinator retains the head-pinned merge hand into next and manually closes#1040 after provider verification. I did not merge.
## MERGE-GATE RE-VERDICT: GO
**Commit-bound head:** `b8844e1ff0e8242885361f9aba3516a36a6ad2f8`. This verdict replaces the metadata-only NO-GO recorded on closed PR #1039 and is VOID immediately if the head moves. Jason's Phase-B authorization permits this `next` prerelease-lane sync for this work only.
### Primary mechanical evidence
- **PR record:** raw Gitea PR API reports PR #1041 `open`, not draft, not merged, mergeable, base `next`, head `b8844e1ff0e8242885361f9aba3516a36a6ad2f8`, author `coder-mos2`. Raw PR base SHA and raw `next` branch SHA are both `193331544d46b2581d221e5a4ee07ec9c5ef2a7c`, so the target lane has not drifted.
- **Closing linkage:** the live body contains `Closes #1040`; raw issue API reports B1 delivery issue #1040 open. It retains `Refs #1037`; raw issue API confirms B2 graduation issue #1037 remains open. Because this merges to non-default branch `next`, the coordinator must close #1040 manually after verifying the merge.
- **CI:** reopening triggered a new current-PR pipeline. Woodpecker pipeline **#2206** (pipeline id **18389**, mosaic instance) is terminal `success` at commit `b8844e1ff0e8242885361f9aba3516a36a6ad2f8`; workflow `ci` is `success`. Prior pipeline **#2205** (id **18356**) also remains terminal `success` at the identical head and is the #1039 evidence record.
- **Full JSON step scan:** read independently from both pipeline #2206 and #2205 JSON/API records. Each has exactly **9 child steps**, all `success`, **0 skipped**: `clone`, `ci-postgres`, `install`, `sanitization`, `upgrade-guard`, `typecheck`, `lint`, `format`, `test`.
- **Head triple:** reviewed SHA `b8844e1ff0e8242885361f9aba3516a36a6ad2f8` == current-PR CI SHA `b8844e1ff0e8242885361f9aba3516a36a6ad2f8` == PR head `b8844e1ff0e8242885361f9aba3516a36a6ad2f8`.
- **Independent approval:** review **ID 77**, author `rev-974`, state `APPROVED`, commit `b8844e1ff0e8242885361f9aba3516a36a6ad2f8`; PR author `coder-mos2` != reviewer `rev-974`. Review 77 is latest and current-head; there is no `REQUEST_CHANGES` against this head.
- **Queue guard:** **ZERO-INFORMATION (inert, D-23)**. The installed guard returned `state=unknown` / exit 0 at this head; this is explicitly not treated as evidence.
- **Fleet pause:** `fleet/run/PAUSED` is absent.
### Conflict-resolution substance at the unchanged head
- The provider diff for #1041 is byte-identical to the previously substance-reviewed #1039 diff.
- Exact-head `packages/mosaic/framework/tools/git/ci-queue-wait.sh` is **482 lines** with **5 `ASSERTED_NOT_READY` occurrences**.
- Both current `origin/main` and `origin/next` are ancestors of the head. `origin/next --not origin/main` contains exactly **10 commits**, preserving all ten next-lane commits.
- Fresh provenance spot-checks against merge parents `19333154` (next) and `5916aeef` (main) reconfirm all eight combined resolutions retain both parent intents: root package scripts; nullable-Redis plus digest-safe command executor; Local-tier plus scoped session GC; Local-tier BullMQ plus global-GC retirement; scoped Local/Redis overrides; modern/legacy finalize paths plus fail-loud reconciliation; `--next` lane plus fail-closed installer arguments; and next-lane plus secure skill-lifecycle documentation. All eight resolved files are free of unresolved conflict markers.
- `packages/mosaic/package.json` remains `0.0.49`.
- `QueueService.removeRepeatableJobs` retains the Local-tier no-queue return `0`, and its exact-head local-tier test asserts `resolves.toBe(0)`.
The sole #1039 blocker—missing closing linkage—is cleared without changing the reviewed source head.
**Disposition: GO.** The coordinator retains the head-pinned merge hand into `next` and manually closes #1040 after provider verification. I did not merge.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Closes #1040. Refs #1037 (Phase B2 feature graduation stays open).
Re-opened from #1039 at the IDENTICAL head
b8844e1fto add the required Closes directive (fleet-account PR-body edit is blocked by Gitea 403/1010; create works, edit does not). rev-974 review 76 approved this exact SHA on #1039. Auto-close of #1040 will NOT fire on a merge intonext(non-default branch) — the coordinator closes #1040 manually on merge.Summary
Merge current
mainintonextwhile preserving all 10 commits unique to the integration lane and restoring current trunk behavior, including the RM-03 queue guard fix.Fetched ground truth before reconciliation:
nextwas 153 commits behindmain(one newer than the 152-count charter) and 10 commits ahead.Conflict resolutions
package.json— retained main's checkout preflight/generated cleanup/typecheck/test wiring and hook installer; retained next'stest:installer, with the next-lane installer suite appended to the main test chain.packages/mosaic/package.jsoncarries main's released0.0.49version.apps/gateway/src/commands/command-executor.service.ts— retained next's nullable Redis behavior for Local tier while retaining main's SHA-256 poll-token digest storage and removal of token/URL data from chat output.apps/gateway/src/gc/session-gc.service.ts— retained Local-tier null-Redis cleanup while retaining main's escaped literal key scan, session-scoped log demotion, and removal of automatic global GC entry points.apps/gateway/src/log/cron.service.ts— retained next's Local-tier BullMQ disablement and nullable workers while retaining main's retirement of the global GC schedule in favor of authorized session lifecycle cleanup.apps/gateway/src/preferences/system-override.service.ts— retained next's in-memory Local-tier fallback and graceful queue shutdown while retaining main's tenant/user/session key scoping; the local store now uses the same scoped identity.packages/mosaic/src/stages/finalize.ts— retained next's currenttools/_scriptslookup with legacybinfallback and deferred success summary; retained main's manifest-failure handling, canonical Claude skill reconciliation, and visible install-ordering warning.tools/install.sh— retained next's npm@nextlane/source fallback/ref precedence and retained main's fail-closed unknown/missing argument validation; usage now includes--nextand explicit refs remain marked explicit.packages/mosaic/framework/defaults/README.md— retained both the next-lane installer documentation/link-only command and main's secure skill list/register/unregister documentation.Typecheck exposed one non-content semantic merge gap in
QueueService.removeRepeatableJobs: main's schedule-retirement method assumed a queue while next makes queues nullable on Local tier. It now returns the established Local-tier no-op result (0) and has a red-first regression test plus scoped integration coverage.Verification
pnpm install --frozen-lockfile— passpnpm build— pass (25/25 tasks)pnpm typecheck— pass (45/45 tasks)pnpm lint— pass (25/25 tasks)pnpm format:check— passbash tools/install-next-lane.test.sh— pass (4 scenarios)ASSERTED_NOT_READYoccurrences0.0.49origin/mainandorigin/nextare ancestors of this head; all 10 next-only commits are preservedThe first parallel focused run observed one environment-sensitive install-ordering probe mismatch; the identical combined command was rerun serially and passed 49/49, then passed again in the final head-bound verification.
Refs #1037 — B2 graduation tracking. On merge,
nextself-versions0.0.50-nexton thenextdist-tag only, neverlatest.Do not merge before independent
rev-974review and merge-gate approval.The slack knob was interpolated raw into $((...)) under set -u: a malformed value was FATAL to the poll, falsifying the poll-never-fails invariant, and a negative value inverted the guard to deny-all. Shape validation alone was insufficient — bash reads a leading zero as octal, so 08/09 passed the regex yet were fatal and 0300 silently meant 192. Now validated ^[0-9]{1,9}$ with a loud fallback to 300, then forced to base-10 via 10# so the knob means what the operator wrote. Authored-by: pepper Reviewed-by: mos-dt (independent, found both the original defect and the radix residual) Merged-by: Mos Co-authored-by: mos-dt-0 <[email protected]>has_match/count_linesacross all ten suites (closes #973) (#983)VERDICT: APPROVE — bound to
b8844e1ff0.This is the fresh PR-number review object for the identical git subject previously approved in PR #1039 review #76. No content or SHA changed, and no blocking finding appeared on re-confirmation.
b8844e1ff0e8242885361f9aba3516a36a6ad2f8, basenext, open,mergeable=true,isDraft=false, authorcoder-mos2. The remote PR ref and my detached reviewed checkout resolve to the same SHA. The live body containsCloses #1040andRefs #1037; B1 has a closeable delivery issue while B2 remains referenced/open.cisuccess and 9 children = 9 success—clone, ci-postgres, install, sanitization, upgrade-guard, typecheck, lint, format, and test, all exit 0. Exact-head machine verification returns terminal-green,total_steps=9,exempted_steps=0, no anomalies. Thus reviewed == CI == PR head.ASSERTED_NOT_READYoccurrences; all ten next-only commits remain ancestors; and the eight merge conflicts plus the Local-tierQueueService.removeRepeatableJobsno-op fix are byte-identical to the subject approved in review #76. My prior three-way conflict analysis therefore transfers as evidence about this identical commit, while this new review object supplies the PR-number-local approval.Reviewer
rev-974differs from author. This approval is void if the PR head moves. I did not merge.VERDICT: APPROVE — bound to
b8844e1ff0.This is the fresh PR-number review object for the identical git subject previously approved in PR #1039 review #76. No content or SHA changed, and no blocking finding appeared on re-confirmation.
b8844e1ff0e8242885361f9aba3516a36a6ad2f8, basenext, open,mergeable=true,isDraft=false, authorcoder-mos2. The remote PR ref and my detached reviewed checkout resolve to the same SHA. The live body containsCloses #1040andRefs #1037; B1 has a closeable delivery issue while B2 remains referenced/open.cisuccess and 9 children = 9 success—clone, ci-postgres, install, sanitization, upgrade-guard, typecheck, lint, format, and test, all exit 0. Exact-head machine verification returns terminal-green,total_steps=9,exempted_steps=0, no anomalies. Thus reviewed == CI == PR head.ASSERTED_NOT_READYoccurrences; all ten next-only commits remain ancestors; and the eight merge conflicts plus the Local-tierQueueService.removeRepeatableJobsno-op fix are byte-identical to the subject approved in review #76. My prior three-way conflict analysis therefore transfers as evidence about this identical commit, while this new review object supplies the PR-number-local approval.Reviewer
rev-974differs from author. This approval is void if the PR head moves. I did not merge.MERGE-GATE RE-VERDICT: GO
Commit-bound head:
b8844e1ff0e8242885361f9aba3516a36a6ad2f8. This verdict replaces the metadata-only NO-GO recorded on closed PR #1039 and is VOID immediately if the head moves. Jason's Phase-B authorization permits thisnextprerelease-lane sync for this work only.Primary mechanical evidence
open, not draft, not merged, mergeable, basenext, headb8844e1ff0e8242885361f9aba3516a36a6ad2f8, authorcoder-mos2. Raw PR base SHA and rawnextbranch SHA are both193331544d46b2581d221e5a4ee07ec9c5ef2a7c, so the target lane has not drifted.Closes #1040; raw issue API reports B1 delivery issue #1040 open. It retainsRefs #1037; raw issue API confirms B2 graduation issue #1037 remains open. Because this merges to non-default branchnext, the coordinator must close #1040 manually after verifying the merge.successat commitb8844e1ff0e8242885361f9aba3516a36a6ad2f8; workflowciissuccess. Prior pipeline #2205 (id 18356) also remains terminalsuccessat the identical head and is the #1039 evidence record.success, 0 skipped:clone,ci-postgres,install,sanitization,upgrade-guard,typecheck,lint,format,test.b8844e1ff0e8242885361f9aba3516a36a6ad2f8== current-PR CI SHAb8844e1ff0e8242885361f9aba3516a36a6ad2f8== PR headb8844e1ff0e8242885361f9aba3516a36a6ad2f8.rev-974, stateAPPROVED, commitb8844e1ff0e8242885361f9aba3516a36a6ad2f8; PR authorcoder-mos2!= reviewerrev-974. Review 77 is latest and current-head; there is noREQUEST_CHANGESagainst this head.state=unknown/ exit 0 at this head; this is explicitly not treated as evidence.fleet/run/PAUSEDis absent.Conflict-resolution substance at the unchanged head
packages/mosaic/framework/tools/git/ci-queue-wait.shis 482 lines with 5ASSERTED_NOT_READYoccurrences.origin/mainandorigin/nextare ancestors of the head.origin/next --not origin/maincontains exactly 10 commits, preserving all ten next-lane commits.19333154(next) and5916aeef(main) reconfirm all eight combined resolutions retain both parent intents: root package scripts; nullable-Redis plus digest-safe command executor; Local-tier plus scoped session GC; Local-tier BullMQ plus global-GC retirement; scoped Local/Redis overrides; modern/legacy finalize paths plus fail-loud reconciliation;--nextlane plus fail-closed installer arguments; and next-lane plus secure skill-lifecycle documentation. All eight resolved files are free of unresolved conflict markers.packages/mosaic/package.jsonremains0.0.49.QueueService.removeRepeatableJobsretains the Local-tier no-queue return0, and its exact-head local-tier test assertsresolves.toBe(0).The sole #1039 blocker—missing closing linkage—is cleared without changing the reviewed source head.
Disposition: GO. The coordinator retains the head-pinned merge hand into
nextand manually closes #1040 after provider verification. I did not merge.