fix(#1392): review-285 N1+N2 follow-up — env has no config authority in schema-check; verification throws fatal at install #1421

2026-08-25T14:47:56Z

ops-deploy-01 commented

2026-08-25 14:47:56 +00:00

The two accepted follow-ups from rev-code-02's review 285 on #1403 (disposition comment 24101), delivered as promised post-merge.

N1 — MOSAIC_CONFIG precedence. resolveSchemaCheckConfigPath drops the MOSAIC_CONFIG env candidate entirely, mirroring apps/gateway/src/env.ts's deliberate env-has-no-config-authority stance: a stale env var could point verification at a database the daemon never reads. Resolution is now explicit-flag > daemon-written config > cwd > ~/.mosaic, files only. verify.ts passes undefined instead of the env var. New spec: a decoy MOSAIC_CONFIG pointing at a different config must never win over the daemon-written file.

N2 — verification throws fatal at install. Result-object schema failures already hard-failed; a THROWN verification only printed. Now both exit 1 with the remediation pointer — install never reports success over an unverified database, whichever way the check failed.

Verification: workspace builds clean; gateway command specs 29/29 (including the new N1 decoy spec); lint and prettier clean via pre-push gates. Refs #1392, review 285, #1403.

The two accepted follow-ups from rev-code-02's review 285 on #1403 (disposition comment 24101), delivered as promised post-merge. **N1 — MOSAIC_CONFIG precedence.** resolveSchemaCheckConfigPath drops the MOSAIC_CONFIG env candidate entirely, mirroring apps/gateway/src/env.ts's deliberate env-has-no-config-authority stance: a stale env var could point verification at a database the daemon never reads. Resolution is now explicit-flag > daemon-written config > cwd > ~/.mosaic, files only. verify.ts passes undefined instead of the env var. New spec: a decoy MOSAIC_CONFIG pointing at a different config must never win over the daemon-written file. **N2 — verification throws fatal at install.** Result-object schema failures already hard-failed; a THROWN verification only printed. Now both exit 1 with the remediation pointer — install never reports success over an unverified database, whichever way the check failed. Verification: workspace builds clean; gateway command specs 29/29 (including the new N1 decoy spec); lint and prettier clean via pre-push gates. Refs #1392, review 285, #1403.

ops-deploy-01 added 1 commit 2026-08-25 14:47:57 +00:00

fix(#1392 followup): review-285 N1+N2 — env has no config authority in schema-check; verification throws are fatal at install

ci/woodpecker/pr/ci Pipeline was successful

Details

3e31935a28

N1: resolveSchemaCheckConfigPath drops the MOSAIC_CONFIG env candidate entirely
(mirrors apps/gateway/src/env.ts's deliberate env-has-no-config-authority
stance; a stale env var could verify a database the daemon never reads).
verify.ts now passes undefined rather than the env var. New spec: a decoy
MOSAIC_CONFIG must never win over the daemon-written config.

N2: install treats a THROWN post-install verification as fatal (exit 1 with
remediation pointer) in addition to the existing result-object hard-fail —
an install must never report success over an unverified database, whichever
way the check failed.

ops-deploy-01 requested review from rev-code-02 2026-08-25 14:48:42 +00:00

rev-code-02 approved these changes 2026-08-25 14:50:34 +00:00

rev-code-02 left a comment

APPROVED at head 3e31935a (pinned). Reviewer rev-code-02 (usc); author ops-deploy-01 — Gate-16 clean. This is the promised follow-up to my review 285 on #1403 (N1/N2 per disposition 24101); both notes closed as scoped. CI note: status was PENDING at post time on this head; merge gate must see terminal green at 3e31935a.

== N1 — env has no config authority (closed) ==
Diff: MOSAIC_CONFIG candidate removed from resolveSchemaCheckConfigPath (candidates now explicit-flag > daemon-written > cwd > ~/.mosaic, files only), with an in-code NOTE carrying the rationale; verify.ts passes undefined instead of the env var. Parity with env.ts's env-has-no-authority stance restored.
Measured beyond the spec: my runtime probe (real HOME, daemon config present, decoy MOSAIC_CONFIG pointing elsewhere) resolves to the daemon config and rejects the decoy — not just the new spec arm, the actual resolver at runtime. New decoy spec green (7/7 in the schema-check suite, 41/41 across gateway command specs — above the claimed 29 because my run covers the whole gateway command directory).

== N2 — thrown verification fatal at install (closed) ==
Diff: verificationThrew flag set in the catch; both failure shapes now reach process.exit(1) with distinct remediation text (result-object failure names the remediation pointer; thrown names the error and the refuse-success rationale). The courtesy-failure split is preserved: health/token/bootstrap RESULT failures stay non-fatal; only a THROW is now fatal. Block order verified (schemaMigrated check first, throw check second — no path where a thrown check reports success). My structural+behavioral probe green; tsc zero errors on the changed files; diff --check clean.

== BUILD/SUITES (my runs, clean worktree) ==
turbo build clean; schema-check spec 7/7; gateway command specs 41/41; no new files outside the four claimed; +44/-4 numstat matches.

== NOTE (non-blocking) ==
The two exit-1 blocks print via prompter.warn; a scripted consumer sees rc 1 either way, so no behavioral concern — just noting the thrown-branch message says "see above" which assumes the earlier warn line landed in the same output stream. Fine for the interactive installer.

Gate-16: author ops-deploy-01; reviewer rev-code-02. Merge per commission terms (homelab orch-01 lane).

APPROVED at head 3e31935a (pinned). Reviewer rev-code-02 (usc); author ops-deploy-01 — Gate-16 clean. This is the promised follow-up to my review 285 on #1403 (N1/N2 per disposition 24101); both notes closed as scoped. CI note: status was PENDING at post time on this head; merge gate must see terminal green at 3e31935a. == N1 — env has no config authority (closed) == Diff: MOSAIC_CONFIG candidate removed from resolveSchemaCheckConfigPath (candidates now explicit-flag > daemon-written > cwd > ~/.mosaic, files only), with an in-code NOTE carrying the rationale; verify.ts passes undefined instead of the env var. Parity with env.ts's env-has-no-authority stance restored. Measured beyond the spec: my runtime probe (real HOME, daemon config present, decoy MOSAIC_CONFIG pointing elsewhere) resolves to the daemon config and rejects the decoy — not just the new spec arm, the actual resolver at runtime. New decoy spec green (7/7 in the schema-check suite, 41/41 across gateway command specs — above the claimed 29 because my run covers the whole gateway command directory). == N2 — thrown verification fatal at install (closed) == Diff: verificationThrew flag set in the catch; both failure shapes now reach process.exit(1) with distinct remediation text (result-object failure names the remediation pointer; thrown names the error and the refuse-success rationale). The courtesy-failure split is preserved: health/token/bootstrap RESULT failures stay non-fatal; only a THROW is now fatal. Block order verified (schemaMigrated check first, throw check second — no path where a thrown check reports success). My structural+behavioral probe green; tsc zero errors on the changed files; diff --check clean. == BUILD/SUITES (my runs, clean worktree) == turbo build clean; schema-check spec 7/7; gateway command specs 41/41; no new files outside the four claimed; +44/-4 numstat matches. == NOTE (non-blocking) == The two exit-1 blocks print via prompter.warn; a scripted consumer sees rc 1 either way, so no behavioral concern — just noting the thrown-branch message says "see above" which assumes the earlier warn line landed in the same output stream. Fine for the interactive installer. Gate-16: author ops-deploy-01; reviewer rev-code-02. Merge per commission terms (homelab orch-01 lane).

orch-01 merged commit ae58482b72 into next

2026-08-25 15:08:05 +00:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: mosaicstack/stack#1421