mosaicstack/stack
25
0 Fork 1
Code Issues 403 Pull Requests 13 Packages Projects Releases 15 Wiki Activity

PRD 1.2 step 7: Token accounting per run #1618

New Issue
Closed
opened 2026-10-14 18:40:39 +00:00 by jarvis · 5 comments
jarvis commented 2026-10-14 18:40:39 +00:00
Contributor
Copy link
Copy source

PRD 1.2 build step 7. Requirements: REQ-LIMIT-2, REQ-LIMIT-3, REQ-WEB-1.

Owner: rocko. Reviewer: dewey.

PRD: docs/prd/mosaic-stack.md version 1.2, landed in 7eb5ad0cb (lead decisions 141 and 142).
Brief: docs/plans/2026-10-14_prd-1.2-build.md, section "Token accounting per run". The queue row links to it.

PRD 1.2 build step 7. Requirements: REQ-LIMIT-2, REQ-LIMIT-3, REQ-WEB-1. Owner: rocko. Reviewer: dewey. PRD: docs/prd/mosaic-stack.md version 1.2, landed in 7eb5ad0cb (lead decisions 141 and 142). Brief: docs/plans/2026-10-14_prd-1.2-build.md, section "Token accounting per run". The queue row links to it.
jarvis commented 2026-10-18 15:29:27 +00:00
Author
Contributor
Copy link
Copy source

Review request for queue row 124, round 1: Token accounting per run

  • Owner: rocko
  • Reviewers: dewey
  • Gate: Dewey approves on #1618 naming the candidate manifest; Sage's full gate rerun at the landing target; Mos's go before landing (decision 123, Settings readout); untrusted-file guards each have a mutant (sage)
  • Brief: docs/plans/2026-10-14_prd-1.2-build.md § Token accounting per run @333adea856b1
  • Candidate: manifest b7139ea3909c49449436daee2eb45f542bca0ffce2515870e1f49ba27e918016

The manifest:

c84085d194f83d945adfe4cd41892c44e0f9c42461c6a5f71b98324d7e1dab8d  docs/TOOLS.md
edada4ba6c2369578d3a5a90214c3a9835ce4e9a7572c422d0fba96cbd314fce  packages/bus/README.md
bb2ba58175a111bb99681778911507846bef714a6d573f8a8af67580a3636950  packages/bus/schema.sql
54fc0523a19db8afc83e16eb94d4661e5b96d8a0e9350a0d200246e57c76dbc9  packages/bus/src/broker.mjs
76168e4f9f6b427286ddb8402fd833acadb01d6325a85f60e9ccf8d42fe2d1d0  packages/bus/src/migrations/3g-3h.sql
14b06d5c5f4c669a8ab4144bc15985b3b696af55c8559ffefad439ab3632f6c7  packages/bus/src/runtime.mjs
8a1b8eac60a5885bbfd36f939b63443de303ed298bf9e1ff653a5a7bcbae76d2  packages/bus/src/server.mjs
52997acb60b3ca245229fb1104682178612f31a1020ad4ae254262d29d8c57a7  packages/bus/src/store.mjs
607a3e561d8bc795f3432c450de5915bfae0f237850c3e7ff8fc6454ee3652e8  packages/bus/src/usage.mjs
ff3f357db13ca20259199d86760bcf47491a5216b61544e2ea8218841945ec0c  packages/bus/src/views.mjs
4af69fd4ea34828e037955bc7b021c94408042087e8e65623b5806bba051133b  packages/bus/tests/chief-of-staff.test.mjs
96c73f038dffbb082d80e7c790ea4dcd789bd2ed841533a2e27c758ec5a1d9dd  packages/bus/tests/comment-migration.test.mjs
a79b3dbe6f4dfba10871c01ad8513ea290071eb8d8af2b87be6db52dbcf23428  packages/bus/tests/fixtures/schema-3g.sql
1f0b6bd6cb6b3eba20b26b7ab57d9da1195f80c70440969fa1c335881ffd76df  packages/bus/tests/name-migration.test.mjs
ec8429a8f19f2d0cb99fbc76a1de1123b03f04a22cc9a0ce5ba0ad0b9735d85e  packages/bus/tests/schema.test.mjs
bb5230652446d9ed25a77a6ab3d6875965aca1c76d4c158b0fb88c267dac6717  packages/bus/tests/spec-migration.test.mjs
aa618d50e5131353a61e245f55b08ab60da014cc51ef7e1d11ee3850ed1c7f27  packages/bus/tests/thread-migration.test.mjs
4b2149ea4219f49db19669ada9f88931f7691cdd73dd27dceec6e8fe1f76dd0c  packages/bus/tests/usage-broker.test.mjs
a905f8590eca73f3ca905b493b32534d17572252236e85b49b9ed897001c75bb  packages/bus/tests/usage-migration.test.mjs
45e8a62f3237a08b673be65777b783d01793a76d2141081aed615c89bcc6534f  packages/bus/tests/usage-runtime.test.mjs
17156bb6a8c15ec2f56ce5a9bda3bf1628d00aef3bf28202aa47c60f4977c945  packages/bus/tests/usage.test.mjs
7d17230eac0b4377e3a3ac4554f7bebfb7d4dd0a912402c9fe6f5a4119c305fb  packages/cli/README.md
6872675e64b03adc1c0b918423e7b8cce7062a293876e42ca9c2989a65c66b6b  packages/cli/src/cli.mjs
5a8aeb1a48cb419f8365b080624ae3b7c6bd3dc0dbc5d6663afaec8dfe7f43fd  packages/cli/src/launcher.mjs
b31f2d997cd9acbe57f66631998c0c023f0a5a65ac9d5752bd5c6c54bdae1773  packages/cli/src/usage.mjs
13c92ba69e10f0f209c59c3316062789097b770cbf581d554d7fa0156622f154  packages/cli/tests/usage.test.mjs
f49172babf1de01195fb0adb5eaf16884bff14d4325d7442f1425e5ce593db86  packages/harness/src/runner.mjs
33a2291139414193cc2f9eb1812da32e9adb7a027c1003e91413f25a05ea686c  packages/harness/tests/runner.test.mjs
4d93dfe8b36a8498d5a8a7a84612c0d82f6d1e886719eeaaf2ecf394ac9500ec  packages/plugins/README.md
049b30ef97a6dfde390c61aca67a4950f92d65ee382007cc1301a490f57151f9  packages/plugins/tests/transcript.test.mjs
81b8ae3ce623d707c1ca3524fc58a8446643774db7337e10b453b2e6aca162b7  packages/plugins/usage-source/transcript/README.md
d09ae19db3eb69477783163559bd6a8e5b59a6f5af0eafd62d0e2e3bd325065e  packages/plugins/usage-source/transcript/index.mjs
209b252603a0093a63bed6a887cdafb894544f8d7ab2b90efc2dabe3f9225d1b  packages/webui/src/public/bus.js
6f6d113f271fb7d67fae57705b201a89e7a5b6b27acb73cb21fbbba0b861c5fd  packages/webui/src/serve.mjs
b860e41f7809ca7f769674641dea096e954a84754b06b41db117efcef8d029f6  packages/webui/tests/usage-browser.test.mjs
f96d06974bc83051c0d5c9000e38161ea0cc231997410bcc6c42ed7f55718dfd  packages/webui/tests/usage.test.mjs
839a39e28dcabdfc37c4fc403e14cea6a90a5e6441bd1d749066933d6276eb8e  scripts/mosaic

Check a tree against it with scripts/mosaic queue review verify-commit 124 REF.

Post your verdict as a comment here, then record it:

scripts/mosaic queue review record 124 --verdict approve|changes --comment COMMENT_ID --candidate b7139ea3909c49449436daee2eb45f542bca0ffce2515870e1f49ba27e918016 --op OP --by SEAT
<!-- mosaic-queue-op: sage-q124-review-request-r1 --> <!-- mosaic-queue-round: row=124 round=1 candidate=b7139ea3909c49449436daee2eb45f542bca0ffce2515870e1f49ba27e918016 --> Review request for queue row 124, round 1: Token accounting per run - Owner: rocko - Reviewers: dewey - Gate: Dewey approves on #1618 naming the candidate manifest; Sage's full gate rerun at the landing target; Mos's go before landing (decision 123, Settings readout); untrusted-file guards each have a mutant (sage) - Brief: `docs/plans/2026-10-14_prd-1.2-build.md` § Token accounting per run @333adea856b1 - Candidate: manifest `b7139ea3909c49449436daee2eb45f542bca0ffce2515870e1f49ba27e918016` The manifest: ```text c84085d194f83d945adfe4cd41892c44e0f9c42461c6a5f71b98324d7e1dab8d docs/TOOLS.md edada4ba6c2369578d3a5a90214c3a9835ce4e9a7572c422d0fba96cbd314fce packages/bus/README.md bb2ba58175a111bb99681778911507846bef714a6d573f8a8af67580a3636950 packages/bus/schema.sql 54fc0523a19db8afc83e16eb94d4661e5b96d8a0e9350a0d200246e57c76dbc9 packages/bus/src/broker.mjs 76168e4f9f6b427286ddb8402fd833acadb01d6325a85f60e9ccf8d42fe2d1d0 packages/bus/src/migrations/3g-3h.sql 14b06d5c5f4c669a8ab4144bc15985b3b696af55c8559ffefad439ab3632f6c7 packages/bus/src/runtime.mjs 8a1b8eac60a5885bbfd36f939b63443de303ed298bf9e1ff653a5a7bcbae76d2 packages/bus/src/server.mjs 52997acb60b3ca245229fb1104682178612f31a1020ad4ae254262d29d8c57a7 packages/bus/src/store.mjs 607a3e561d8bc795f3432c450de5915bfae0f237850c3e7ff8fc6454ee3652e8 packages/bus/src/usage.mjs ff3f357db13ca20259199d86760bcf47491a5216b61544e2ea8218841945ec0c packages/bus/src/views.mjs 4af69fd4ea34828e037955bc7b021c94408042087e8e65623b5806bba051133b packages/bus/tests/chief-of-staff.test.mjs 96c73f038dffbb082d80e7c790ea4dcd789bd2ed841533a2e27c758ec5a1d9dd packages/bus/tests/comment-migration.test.mjs a79b3dbe6f4dfba10871c01ad8513ea290071eb8d8af2b87be6db52dbcf23428 packages/bus/tests/fixtures/schema-3g.sql 1f0b6bd6cb6b3eba20b26b7ab57d9da1195f80c70440969fa1c335881ffd76df packages/bus/tests/name-migration.test.mjs ec8429a8f19f2d0cb99fbc76a1de1123b03f04a22cc9a0ce5ba0ad0b9735d85e packages/bus/tests/schema.test.mjs bb5230652446d9ed25a77a6ab3d6875965aca1c76d4c158b0fb88c267dac6717 packages/bus/tests/spec-migration.test.mjs aa618d50e5131353a61e245f55b08ab60da014cc51ef7e1d11ee3850ed1c7f27 packages/bus/tests/thread-migration.test.mjs 4b2149ea4219f49db19669ada9f88931f7691cdd73dd27dceec6e8fe1f76dd0c packages/bus/tests/usage-broker.test.mjs a905f8590eca73f3ca905b493b32534d17572252236e85b49b9ed897001c75bb packages/bus/tests/usage-migration.test.mjs 45e8a62f3237a08b673be65777b783d01793a76d2141081aed615c89bcc6534f packages/bus/tests/usage-runtime.test.mjs 17156bb6a8c15ec2f56ce5a9bda3bf1628d00aef3bf28202aa47c60f4977c945 packages/bus/tests/usage.test.mjs 7d17230eac0b4377e3a3ac4554f7bebfb7d4dd0a912402c9fe6f5a4119c305fb packages/cli/README.md 6872675e64b03adc1c0b918423e7b8cce7062a293876e42ca9c2989a65c66b6b packages/cli/src/cli.mjs 5a8aeb1a48cb419f8365b080624ae3b7c6bd3dc0dbc5d6663afaec8dfe7f43fd packages/cli/src/launcher.mjs b31f2d997cd9acbe57f66631998c0c023f0a5a65ac9d5752bd5c6c54bdae1773 packages/cli/src/usage.mjs 13c92ba69e10f0f209c59c3316062789097b770cbf581d554d7fa0156622f154 packages/cli/tests/usage.test.mjs f49172babf1de01195fb0adb5eaf16884bff14d4325d7442f1425e5ce593db86 packages/harness/src/runner.mjs 33a2291139414193cc2f9eb1812da32e9adb7a027c1003e91413f25a05ea686c packages/harness/tests/runner.test.mjs 4d93dfe8b36a8498d5a8a7a84612c0d82f6d1e886719eeaaf2ecf394ac9500ec packages/plugins/README.md 049b30ef97a6dfde390c61aca67a4950f92d65ee382007cc1301a490f57151f9 packages/plugins/tests/transcript.test.mjs 81b8ae3ce623d707c1ca3524fc58a8446643774db7337e10b453b2e6aca162b7 packages/plugins/usage-source/transcript/README.md d09ae19db3eb69477783163559bd6a8e5b59a6f5af0eafd62d0e2e3bd325065e packages/plugins/usage-source/transcript/index.mjs 209b252603a0093a63bed6a887cdafb894544f8d7ab2b90efc2dabe3f9225d1b packages/webui/src/public/bus.js 6f6d113f271fb7d67fae57705b201a89e7a5b6b27acb73cb21fbbba0b861c5fd packages/webui/src/serve.mjs b860e41f7809ca7f769674641dea096e954a84754b06b41db117efcef8d029f6 packages/webui/tests/usage-browser.test.mjs f96d06974bc83051c0d5c9000e38161ea0cc231997410bcc6c42ed7f55718dfd packages/webui/tests/usage.test.mjs 839a39e28dcabdfc37c4fc403e14cea6a90a5e6441bd1d749066933d6276eb8e scripts/mosaic ``` Check a tree against it with `scripts/mosaic queue review verify-commit 124 REF`. Post your verdict as a comment here, then record it: ``` scripts/mosaic queue review record 124 --verdict approve|changes --comment COMMENT_ID --candidate b7139ea3909c49449436daee2eb45f542bca0ffce2515870e1f49ba27e918016 --op OP --by SEAT ```
dewey commented 2026-10-18 15:41:35 +00:00
Member
Copy link
Copy source

Dewey review, row 124 (#1618), token accounting per run. Verdict: CHANGES.

Base 9098c33f7. Candidate manifest b7139ea3909c49449436daee2eb45f542bca0ffce2515870e1f49ba27e918016 (37 files), applied to a detached worktree; sha256sum -c passed before and after the runs. Packet: agents/dewey/work/queue-124-review/ (run.sh, probes.mjs, run.log, single/, mutants/).

Runs, in Sage's slot (sage-0723), 2026-10-18T15:39:29Z to 15:40:18Z:

  • The 20 candidate and touched test files, one node --test each (launcher with TMPDIR outside /tmp): all rc=0, 150 tests, 150 pass, 0 fail, 0 skipped. Per-file counts are in run.log.
  • probes.mjs, on scratch temp dirs only: rc=0, output in probes.log.
  • One mutant, d1: SURVIVED (see (b)). The script restored transcript/index.mjs and checked its hash against the manifest (d09ae19db3eb...).

Changes

(a) usage_records has no timestamp guard. packages/bus/src/store.mjs:55 timedTables lists every other table with an at column. Row 141 added instance_names when it added that table. usage_records is not in the list, and its DDL in 3g-3h.sql has no CHECK on at. #verifyTimes therefore never sees it: not at open, not at migration, not at commit. Probe p1: a non-canonical at (2026-10-04T00:00:00Z) is refused in events (invalid-timestamp, the control), but usage_records accepts it. The row is stored, and the store reopens with it in place.
Needed: add usage_records to timedTables, a test that a non-canonical at refuses invalid-timestamp, and a mutant that removes the entry.

(b) The brief's claude-code fixtures are missing. The acceptance line asks for "fixture transcripts for both harnesses, including a cut line, a symlink and an oversized file". In packages/plugins/tests/transcript.test.mjs only the dedup test (line 22) loops over both harnesses. The guard table (lines 29-43) and the symlink-root test (line 44) use fixture(t), which defaults to pi. The claude-code walk has its own code path: at depth 0 it opens each project directory with openSync(at(fd, entry.name), DIR) (transcript/index.mjs:90). No test puts a symlink there. Probe p2 shows the code itself handles claude-code correctly: a symlinked project dir and a symlinked session file give transcript-path, a cut line gives transcript-parse, and an oversized file gives transcript-size. The gap is that no test checks any of this. Mutant d1 drops O_NOFOLLOW from that open (constants.O_RDONLY | constants.O_DIRECTORY). transcript.test.mjs still passes 24/24. From reading the code, d1 is not equivalent: readdir reports the symlink as a non-file, so the open follows it, and the session files under the target are anchored and read normally.
Needed: run the guard table over both harnesses (or add claude-code cases for the cut line, a symlinked project directory, a symlinked session file and the oversized file), with the project-directory symlink case killing d1.

Verified

  • MIGRATION.md's claim that nothing earlier changes. usage-migration.test.mjs compares every prior column, row and sequence counter on a copy built from the pinned 3g DDL. The schema digest covers all of sqlite_master, so views and triggers are pinned too. 3g-3h.sql only creates usage_records and its three triggers.
  • No transcript text is stored. The reader returns counters and ids only. Ids are capped at 512 chars, unknown codes go through a fixed whitelist (anything else becomes source-unknown), and the begin cursor holds the entries map (keys are relative file name and message id).
  • Replays are idempotent: UNIQUE(business,run,turn,source,phase), and perform() returns early when a row exists.
  • The webui route is read-only. serve.mjs adds usage as GET only (405 otherwise), returns 400 on any query string, and checks the shape (502 on a malformed value). bus.js tokenUsage() escapes every value through txt().
  • Rocko's evidence matches their logs: 914 tests, land-work 86, config 24, 64/64 mutants killed.

Notes (not blocking)

  1. A turn skipped because the state read failed (unread) still calls usage.end. It is recorded unknown (baseline-unknown) though no harness ran. That is the safe direction, but the bus README says unknown means a harness turn whose usage could not be read.
  2. Once a thread's transcript passes 8 MiB in total, or holds any line over 1 MiB, every later turn in it is unknown. That is fail-closed and correct, but long threads will lose accounting for good. Worth a line in the README or a follow-up.
  3. Each begin row stores the full entries map as its cursor. Storage grows with the square of thread length.
  4. With two sources enabled for one harness, both report the same turn and totals count it twice ("Totals sum reported records"). Only transcript ships now; worth a note before a second source.
  5. Doc-only, follow-up: MIGRATION.md calls Mos "his". It's a packet doc that no test reads.

Landing the webui route and public/ changes still needs Mos's decision 123 go after approval. Activation (offline 3g→3h migration and re-pin) is Mos's separate downtime window.

Dewey review, row 124 (#1618), token accounting per run. Verdict: CHANGES. Base 9098c33f7. Candidate manifest b7139ea3909c49449436daee2eb45f542bca0ffce2515870e1f49ba27e918016 (37 files), applied to a detached worktree; `sha256sum -c` passed before and after the runs. Packet: agents/dewey/work/queue-124-review/ (run.sh, probes.mjs, run.log, single/, mutants/). Runs, in Sage's slot (sage-0723), 2026-10-18T15:39:29Z to 15:40:18Z: - The 20 candidate and touched test files, one `node --test` each (launcher with TMPDIR outside /tmp): all rc=0, 150 tests, 150 pass, 0 fail, 0 skipped. Per-file counts are in run.log. - probes.mjs, on scratch temp dirs only: rc=0, output in probes.log. - One mutant, d1: SURVIVED (see (b)). The script restored transcript/index.mjs and checked its hash against the manifest (d09ae19db3eb...). ## Changes **(a) usage_records has no timestamp guard.** `packages/bus/src/store.mjs:55` timedTables lists every other table with an `at` column. Row 141 added instance_names when it added that table. usage_records is not in the list, and its DDL in 3g-3h.sql has no CHECK on `at`. `#verifyTimes` therefore never sees it: not at open, not at migration, not at commit. Probe p1: a non-canonical `at` (`2026-10-04T00:00:00Z`) is refused in events (`invalid-timestamp`, the control), but usage_records accepts it. The row is stored, and the store reopens with it in place. Needed: add usage_records to timedTables, a test that a non-canonical `at` refuses `invalid-timestamp`, and a mutant that removes the entry. **(b) The brief's claude-code fixtures are missing.** The acceptance line asks for "fixture transcripts for both harnesses, including a cut line, a symlink and an oversized file". In packages/plugins/tests/transcript.test.mjs only the dedup test (line 22) loops over both harnesses. The guard table (lines 29-43) and the symlink-root test (line 44) use `fixture(t)`, which defaults to pi. The claude-code walk has its own code path: at depth 0 it opens each project directory with `openSync(at(fd, entry.name), DIR)` (transcript/index.mjs:90). No test puts a symlink there. Probe p2 shows the code itself handles claude-code correctly: a symlinked project dir and a symlinked session file give `transcript-path`, a cut line gives `transcript-parse`, and an oversized file gives `transcript-size`. The gap is that no test checks any of this. Mutant d1 drops O_NOFOLLOW from that open (`constants.O_RDONLY | constants.O_DIRECTORY`). transcript.test.mjs still passes 24/24. From reading the code, d1 is not equivalent: readdir reports the symlink as a non-file, so the open follows it, and the session files under the target are anchored and read normally. Needed: run the guard table over both harnesses (or add claude-code cases for the cut line, a symlinked project directory, a symlinked session file and the oversized file), with the project-directory symlink case killing d1. ## Verified - MIGRATION.md's claim that nothing earlier changes. usage-migration.test.mjs compares every prior column, row and sequence counter on a copy built from the pinned 3g DDL. The schema digest covers all of sqlite_master, so views and triggers are pinned too. 3g-3h.sql only creates usage_records and its three triggers. - No transcript text is stored. The reader returns counters and ids only. Ids are capped at 512 chars, unknown codes go through a fixed whitelist (anything else becomes source-unknown), and the begin cursor holds the entries map (keys are relative file name and message id). - Replays are idempotent: UNIQUE(business,run,turn,source,phase), and perform() returns early when a row exists. - The webui route is read-only. serve.mjs adds `usage` as GET only (405 otherwise), returns 400 on any query string, and checks the shape (502 on a malformed value). bus.js tokenUsage() escapes every value through txt(). - Rocko's evidence matches their logs: 914 tests, land-work 86, config 24, 64/64 mutants killed. ## Notes (not blocking) 1. A turn skipped because the state read failed (`unread`) still calls usage.end. It is recorded unknown (baseline-unknown) though no harness ran. That is the safe direction, but the bus README says unknown means a harness turn whose usage could not be read. 2. Once a thread's transcript passes 8 MiB in total, or holds any line over 1 MiB, every later turn in it is unknown. That is fail-closed and correct, but long threads will lose accounting for good. Worth a line in the README or a follow-up. 3. Each begin row stores the full entries map as its cursor. Storage grows with the square of thread length. 4. With two sources enabled for one harness, both report the same turn and totals count it twice ("Totals sum reported records"). Only transcript ships now; worth a note before a second source. 5. Doc-only, follow-up: MIGRATION.md calls Mos "his". It's a packet doc that no test reads. Landing the webui route and public/ changes still needs Mos's decision 123 go after approval. Activation (offline 3g→3h migration and re-pin) is Mos's separate downtime window.
jarvis commented 2026-10-18 15:53:17 +00:00
Author
Contributor
Copy link
Copy source

Review request for queue row 124, round 2: Token accounting per run

  • Owner: rocko
  • Reviewers: dewey
  • Gate: Dewey approves on #1618 naming the candidate manifest; Sage's full gate rerun at the landing target; Mos's go before landing (decision 123, Settings readout); untrusted-file guards each have a mutant (sage)
  • Brief: docs/plans/2026-10-14_prd-1.2-build.md § Token accounting per run @333adea856b1
  • Candidate: manifest e09313aba4d155a1c5af7bfb227ec397e96c0d57444782cd0b48593102bcc684

The manifest:

c84085d194f83d945adfe4cd41892c44e0f9c42461c6a5f71b98324d7e1dab8d  docs/TOOLS.md
edada4ba6c2369578d3a5a90214c3a9835ce4e9a7572c422d0fba96cbd314fce  packages/bus/README.md
bb2ba58175a111bb99681778911507846bef714a6d573f8a8af67580a3636950  packages/bus/schema.sql
54fc0523a19db8afc83e16eb94d4661e5b96d8a0e9350a0d200246e57c76dbc9  packages/bus/src/broker.mjs
76168e4f9f6b427286ddb8402fd833acadb01d6325a85f60e9ccf8d42fe2d1d0  packages/bus/src/migrations/3g-3h.sql
14b06d5c5f4c669a8ab4144bc15985b3b696af55c8559ffefad439ab3632f6c7  packages/bus/src/runtime.mjs
8a1b8eac60a5885bbfd36f939b63443de303ed298bf9e1ff653a5a7bcbae76d2  packages/bus/src/server.mjs
28527e767914c195e0ccc76de41c06844c69c8e4f811ee9b4558cdd418d0df41  packages/bus/src/store.mjs
607a3e561d8bc795f3432c450de5915bfae0f237850c3e7ff8fc6454ee3652e8  packages/bus/src/usage.mjs
ff3f357db13ca20259199d86760bcf47491a5216b61544e2ea8218841945ec0c  packages/bus/src/views.mjs
4af69fd4ea34828e037955bc7b021c94408042087e8e65623b5806bba051133b  packages/bus/tests/chief-of-staff.test.mjs
96c73f038dffbb082d80e7c790ea4dcd789bd2ed841533a2e27c758ec5a1d9dd  packages/bus/tests/comment-migration.test.mjs
a79b3dbe6f4dfba10871c01ad8513ea290071eb8d8af2b87be6db52dbcf23428  packages/bus/tests/fixtures/schema-3g.sql
1f0b6bd6cb6b3eba20b26b7ab57d9da1195f80c70440969fa1c335881ffd76df  packages/bus/tests/name-migration.test.mjs
ec8429a8f19f2d0cb99fbc76a1de1123b03f04a22cc9a0ce5ba0ad0b9735d85e  packages/bus/tests/schema.test.mjs
bb5230652446d9ed25a77a6ab3d6875965aca1c76d4c158b0fb88c267dac6717  packages/bus/tests/spec-migration.test.mjs
b712658fff0b05276934222e50904483a82a5cce5d494564d4bcd49168700523  packages/bus/tests/store.test.mjs
aa618d50e5131353a61e245f55b08ab60da014cc51ef7e1d11ee3850ed1c7f27  packages/bus/tests/thread-migration.test.mjs
4b2149ea4219f49db19669ada9f88931f7691cdd73dd27dceec6e8fe1f76dd0c  packages/bus/tests/usage-broker.test.mjs
a905f8590eca73f3ca905b493b32534d17572252236e85b49b9ed897001c75bb  packages/bus/tests/usage-migration.test.mjs
45e8a62f3237a08b673be65777b783d01793a76d2141081aed615c89bcc6534f  packages/bus/tests/usage-runtime.test.mjs
17156bb6a8c15ec2f56ce5a9bda3bf1628d00aef3bf28202aa47c60f4977c945  packages/bus/tests/usage.test.mjs
7d17230eac0b4377e3a3ac4554f7bebfb7d4dd0a912402c9fe6f5a4119c305fb  packages/cli/README.md
6872675e64b03adc1c0b918423e7b8cce7062a293876e42ca9c2989a65c66b6b  packages/cli/src/cli.mjs
5a8aeb1a48cb419f8365b080624ae3b7c6bd3dc0dbc5d6663afaec8dfe7f43fd  packages/cli/src/launcher.mjs
b31f2d997cd9acbe57f66631998c0c023f0a5a65ac9d5752bd5c6c54bdae1773  packages/cli/src/usage.mjs
13c92ba69e10f0f209c59c3316062789097b770cbf581d554d7fa0156622f154  packages/cli/tests/usage.test.mjs
f49172babf1de01195fb0adb5eaf16884bff14d4325d7442f1425e5ce593db86  packages/harness/src/runner.mjs
33a2291139414193cc2f9eb1812da32e9adb7a027c1003e91413f25a05ea686c  packages/harness/tests/runner.test.mjs
4d93dfe8b36a8498d5a8a7a84612c0d82f6d1e886719eeaaf2ecf394ac9500ec  packages/plugins/README.md
7491977e18817e65a398ba27551a938999b26f5ec1659ada2c2e4713c07c438d  packages/plugins/tests/transcript.test.mjs
81b8ae3ce623d707c1ca3524fc58a8446643774db7337e10b453b2e6aca162b7  packages/plugins/usage-source/transcript/README.md
d09ae19db3eb69477783163559bd6a8e5b59a6f5af0eafd62d0e2e3bd325065e  packages/plugins/usage-source/transcript/index.mjs
209b252603a0093a63bed6a887cdafb894544f8d7ab2b90efc2dabe3f9225d1b  packages/webui/src/public/bus.js
6f6d113f271fb7d67fae57705b201a89e7a5b6b27acb73cb21fbbba0b861c5fd  packages/webui/src/serve.mjs
b860e41f7809ca7f769674641dea096e954a84754b06b41db117efcef8d029f6  packages/webui/tests/usage-browser.test.mjs
f96d06974bc83051c0d5c9000e38161ea0cc231997410bcc6c42ed7f55718dfd  packages/webui/tests/usage.test.mjs
839a39e28dcabdfc37c4fc403e14cea6a90a5e6441bd1d749066933d6276eb8e  scripts/mosaic

Check a tree against it with scripts/mosaic queue review verify-commit 124 REF.

Post your verdict as a comment here, then record it:

scripts/mosaic queue review record 124 --verdict approve|changes --comment COMMENT_ID --candidate e09313aba4d155a1c5af7bfb227ec397e96c0d57444782cd0b48593102bcc684 --op OP --by SEAT
<!-- mosaic-queue-op: sage-q124-review-request-r2 --> <!-- mosaic-queue-round: row=124 round=2 candidate=e09313aba4d155a1c5af7bfb227ec397e96c0d57444782cd0b48593102bcc684 --> Review request for queue row 124, round 2: Token accounting per run - Owner: rocko - Reviewers: dewey - Gate: Dewey approves on #1618 naming the candidate manifest; Sage's full gate rerun at the landing target; Mos's go before landing (decision 123, Settings readout); untrusted-file guards each have a mutant (sage) - Brief: `docs/plans/2026-10-14_prd-1.2-build.md` § Token accounting per run @333adea856b1 - Candidate: manifest `e09313aba4d155a1c5af7bfb227ec397e96c0d57444782cd0b48593102bcc684` The manifest: ```text c84085d194f83d945adfe4cd41892c44e0f9c42461c6a5f71b98324d7e1dab8d docs/TOOLS.md edada4ba6c2369578d3a5a90214c3a9835ce4e9a7572c422d0fba96cbd314fce packages/bus/README.md bb2ba58175a111bb99681778911507846bef714a6d573f8a8af67580a3636950 packages/bus/schema.sql 54fc0523a19db8afc83e16eb94d4661e5b96d8a0e9350a0d200246e57c76dbc9 packages/bus/src/broker.mjs 76168e4f9f6b427286ddb8402fd833acadb01d6325a85f60e9ccf8d42fe2d1d0 packages/bus/src/migrations/3g-3h.sql 14b06d5c5f4c669a8ab4144bc15985b3b696af55c8559ffefad439ab3632f6c7 packages/bus/src/runtime.mjs 8a1b8eac60a5885bbfd36f939b63443de303ed298bf9e1ff653a5a7bcbae76d2 packages/bus/src/server.mjs 28527e767914c195e0ccc76de41c06844c69c8e4f811ee9b4558cdd418d0df41 packages/bus/src/store.mjs 607a3e561d8bc795f3432c450de5915bfae0f237850c3e7ff8fc6454ee3652e8 packages/bus/src/usage.mjs ff3f357db13ca20259199d86760bcf47491a5216b61544e2ea8218841945ec0c packages/bus/src/views.mjs 4af69fd4ea34828e037955bc7b021c94408042087e8e65623b5806bba051133b packages/bus/tests/chief-of-staff.test.mjs 96c73f038dffbb082d80e7c790ea4dcd789bd2ed841533a2e27c758ec5a1d9dd packages/bus/tests/comment-migration.test.mjs a79b3dbe6f4dfba10871c01ad8513ea290071eb8d8af2b87be6db52dbcf23428 packages/bus/tests/fixtures/schema-3g.sql 1f0b6bd6cb6b3eba20b26b7ab57d9da1195f80c70440969fa1c335881ffd76df packages/bus/tests/name-migration.test.mjs ec8429a8f19f2d0cb99fbc76a1de1123b03f04a22cc9a0ce5ba0ad0b9735d85e packages/bus/tests/schema.test.mjs bb5230652446d9ed25a77a6ab3d6875965aca1c76d4c158b0fb88c267dac6717 packages/bus/tests/spec-migration.test.mjs b712658fff0b05276934222e50904483a82a5cce5d494564d4bcd49168700523 packages/bus/tests/store.test.mjs aa618d50e5131353a61e245f55b08ab60da014cc51ef7e1d11ee3850ed1c7f27 packages/bus/tests/thread-migration.test.mjs 4b2149ea4219f49db19669ada9f88931f7691cdd73dd27dceec6e8fe1f76dd0c packages/bus/tests/usage-broker.test.mjs a905f8590eca73f3ca905b493b32534d17572252236e85b49b9ed897001c75bb packages/bus/tests/usage-migration.test.mjs 45e8a62f3237a08b673be65777b783d01793a76d2141081aed615c89bcc6534f packages/bus/tests/usage-runtime.test.mjs 17156bb6a8c15ec2f56ce5a9bda3bf1628d00aef3bf28202aa47c60f4977c945 packages/bus/tests/usage.test.mjs 7d17230eac0b4377e3a3ac4554f7bebfb7d4dd0a912402c9fe6f5a4119c305fb packages/cli/README.md 6872675e64b03adc1c0b918423e7b8cce7062a293876e42ca9c2989a65c66b6b packages/cli/src/cli.mjs 5a8aeb1a48cb419f8365b080624ae3b7c6bd3dc0dbc5d6663afaec8dfe7f43fd packages/cli/src/launcher.mjs b31f2d997cd9acbe57f66631998c0c023f0a5a65ac9d5752bd5c6c54bdae1773 packages/cli/src/usage.mjs 13c92ba69e10f0f209c59c3316062789097b770cbf581d554d7fa0156622f154 packages/cli/tests/usage.test.mjs f49172babf1de01195fb0adb5eaf16884bff14d4325d7442f1425e5ce593db86 packages/harness/src/runner.mjs 33a2291139414193cc2f9eb1812da32e9adb7a027c1003e91413f25a05ea686c packages/harness/tests/runner.test.mjs 4d93dfe8b36a8498d5a8a7a84612c0d82f6d1e886719eeaaf2ecf394ac9500ec packages/plugins/README.md 7491977e18817e65a398ba27551a938999b26f5ec1659ada2c2e4713c07c438d packages/plugins/tests/transcript.test.mjs 81b8ae3ce623d707c1ca3524fc58a8446643774db7337e10b453b2e6aca162b7 packages/plugins/usage-source/transcript/README.md d09ae19db3eb69477783163559bd6a8e5b59a6f5af0eafd62d0e2e3bd325065e packages/plugins/usage-source/transcript/index.mjs 209b252603a0093a63bed6a887cdafb894544f8d7ab2b90efc2dabe3f9225d1b packages/webui/src/public/bus.js 6f6d113f271fb7d67fae57705b201a89e7a5b6b27acb73cb21fbbba0b861c5fd packages/webui/src/serve.mjs b860e41f7809ca7f769674641dea096e954a84754b06b41db117efcef8d029f6 packages/webui/tests/usage-browser.test.mjs f96d06974bc83051c0d5c9000e38161ea0cc231997410bcc6c42ed7f55718dfd packages/webui/tests/usage.test.mjs 839a39e28dcabdfc37c4fc403e14cea6a90a5e6441bd1d749066933d6276eb8e scripts/mosaic ``` Check a tree against it with `scripts/mosaic queue review verify-commit 124 REF`. Post your verdict as a comment here, then record it: ``` scripts/mosaic queue review record 124 --verdict approve|changes --comment COMMENT_ID --candidate e09313aba4d155a1c5af7bfb227ec397e96c0d57444782cd0b48593102bcc684 --op OP --by SEAT ```
dewey commented 2026-10-18 15:57:23 +00:00
Member
Copy link
Copy source

Dewey review, row 124 (#1618) round 2, token accounting per run. Verdict: APPROVE.

Candidate manifest e09313aba4d155a1c5af7bfb227ec397e96c0d57444782cd0b48593102bcc684 (38 paths) on 23533625d. Packet inventory f44ed0b7…ba4b (95 entries) checks OK. It applies to a detached worktree, and sha256sum -c passed before and after the runs. No base drift: no manifest path changed between 9098c33f7 and 23533625d. Since round 1, only packages/bus/src/store.mjs, packages/bus/tests/store.test.mjs and packages/plugins/tests/transcript.test.mjs changed. Packet: agents/dewey/work/queue-124-review/r2/ (run.sh, run.log, probes.log, single/, mutants/).

Runs, in Sage's slot (sage-0733), 2026-10-18T15:56:05Z to 15:56:53Z:

  • The same 20 test files as round 1, one node --test each (launcher with TMPDIR outside /tmp): all rc=0. Script-summed: 163 tests, 163 pass, 0 fail, 0 skipped. That is round 1's 150 plus 1 store test plus 12 transcript tests.
  • probes.mjs, on scratch temp dirs only: rc=0.
  • Two mutants, one per round 2 check, both caught. Each was restored, and its hash checked against the manifest inside the script: store.mjs 28527e76…df41, transcript/index.mjs d09ae19d…065e.

Round 1 findings

(a) Fixed. timedTables in store.mjs now lists usage_records. The new store.test.mjs case usage_records refuses non-canonical timestamps atomically refuses 2026-10-04T00:00:00Z with invalid-timestamp, leaves no row, then accepts the canonical form. My probe p1 now gets invalid-timestamp from usage_records as well as from the events control, and leaves 0 rows. My mutant m65 removes that table entry. It is caught by exactly that test (store.test.mjs 6/7). Rocko's store-red.log shows the same test failing before the fix.

(b) Fixed. transcript.test.mjs runs the whole guard table over pi and claude-code: cut line, invalid UTF-8, missing, negative, fractional and unsafe counters, oversized file and line, symlinked session file and hardlink. The claude-code counter cases edit the claude field names (input_tokens, output_tokens), so they exercise that harness's own parse. The root-symlink test loops over both harnesses. The new claude-code refuses a symlinked project directory points project/ at a sibling directory outside the root that holds a valid session.jsonl, and expects transcript-path. My mutant m66 is round 1's d1, which drops O_NOFOLLOW from the project-directory open. It is caught by exactly that test (transcript.test.mjs 35/36). The transcript source is unchanged from round 1 (same hash d09ae19d…065e), which matches probe p2 in round 1: the code was right, only the tests were missing.

Doc fix. MIGRATION.md now says "their approved window" for Mos.

Still open, not blocking

Round 1 notes 1-4 stand as follow-ups, as Rocko's BUILD.md says: an unread-state turn is recorded unknown with no harness run; past 8 MiB or a 1 MiB line, a long thread stays unknown for good; begin cursors grow quadratically with thread length; two sources reporting the same turn would double-count.

Landing the webui route and public/ changes still needs Mos's decision 123 go. Activation (the offline 3g→3h migration and re-pin) is Mos's separate downtime window.

Dewey review, row 124 (#1618) round 2, token accounting per run. Verdict: APPROVE. Candidate manifest e09313aba4d155a1c5af7bfb227ec397e96c0d57444782cd0b48593102bcc684 (38 paths) on 23533625d. Packet inventory f44ed0b7…ba4b (95 entries) checks OK. It applies to a detached worktree, and `sha256sum -c` passed before and after the runs. No base drift: no manifest path changed between 9098c33f7 and 23533625d. Since round 1, only packages/bus/src/store.mjs, packages/bus/tests/store.test.mjs and packages/plugins/tests/transcript.test.mjs changed. Packet: agents/dewey/work/queue-124-review/r2/ (run.sh, run.log, probes.log, single/, mutants/). Runs, in Sage's slot (sage-0733), 2026-10-18T15:56:05Z to 15:56:53Z: - The same 20 test files as round 1, one `node --test` each (launcher with TMPDIR outside /tmp): all rc=0. Script-summed: 163 tests, 163 pass, 0 fail, 0 skipped. That is round 1's 150 plus 1 store test plus 12 transcript tests. - probes.mjs, on scratch temp dirs only: rc=0. - Two mutants, one per round 2 check, both caught. Each was restored, and its hash checked against the manifest inside the script: store.mjs 28527e76…df41, transcript/index.mjs d09ae19d…065e. ## Round 1 findings **(a) Fixed.** timedTables in store.mjs now lists usage_records. The new store.test.mjs case `usage_records refuses non-canonical timestamps atomically` refuses `2026-10-04T00:00:00Z` with invalid-timestamp, leaves no row, then accepts the canonical form. My probe p1 now gets invalid-timestamp from usage_records as well as from the events control, and leaves 0 rows. My mutant m65 removes that table entry. It is caught by exactly that test (store.test.mjs 6/7). Rocko's store-red.log shows the same test failing before the fix. **(b) Fixed.** transcript.test.mjs runs the whole guard table over pi and claude-code: cut line, invalid UTF-8, missing, negative, fractional and unsafe counters, oversized file and line, symlinked session file and hardlink. The claude-code counter cases edit the claude field names (input_tokens, output_tokens), so they exercise that harness's own parse. The root-symlink test loops over both harnesses. The new `claude-code refuses a symlinked project directory` points project/ at a sibling directory outside the root that holds a valid session.jsonl, and expects transcript-path. My mutant m66 is round 1's d1, which drops O_NOFOLLOW from the project-directory open. It is caught by exactly that test (transcript.test.mjs 35/36). The transcript source is unchanged from round 1 (same hash d09ae19d…065e), which matches probe p2 in round 1: the code was right, only the tests were missing. **Doc fix.** MIGRATION.md now says "their approved window" for Mos. ## Still open, not blocking Round 1 notes 1-4 stand as follow-ups, as Rocko's BUILD.md says: an unread-state turn is recorded unknown with no harness run; past 8 MiB or a 1 MiB line, a long thread stays unknown for good; begin cursors grow quadratically with thread length; two sources reporting the same turn would double-count. Landing the webui route and public/ changes still needs Mos's decision 123 go. Activation (the offline 3g→3h migration and re-pin) is Mos's separate downtime window.
jarvis commented 2026-10-18 16:09:13 +00:00
Author
Contributor
Copy link
Copy source

Landed as 70504d23a on refactor (pushed 7a13129be..70504d23a). Rocko round 2 candidate e09313aba4d155a1c5af7bfb227ec397e96c0d57444782cd0b48593102bcc684, approved by Dewey in comment 28923 (queue rev 1757). Decision 123 go: Mos, mos-0737.

Sage full gate on the landing tree d52327229 + candidate, 16:03:32Z to 16:08:02Z: every package suite and every scripts/test-*.sh green, 2014 package tests and 422 script selftests, 0 failed. Queue row 124 done at rev 1758.

Nothing is live yet. Live stays on 52f35e7a0. Activation takes the store from schema 3g to 3h, a migrating run with Jason present, in Mos's combined re-pin after row 149 lands.

Landed as 70504d23a on refactor (pushed 7a13129be..70504d23a). Rocko round 2 candidate e09313aba4d155a1c5af7bfb227ec397e96c0d57444782cd0b48593102bcc684, approved by Dewey in comment 28923 (queue rev 1757). Decision 123 go: Mos, mos-0737. Sage full gate on the landing tree d52327229 + candidate, 16:03:32Z to 16:08:02Z: every package suite and every scripts/test-*.sh green, 2014 package tests and 422 script selftests, 0 failed. Queue row 124 done at rev 1758. Nothing is live yet. Live stays on 52f35e7a0. Activation takes the store from schema 3g to 3h, a migrating run with Jason present, in Mos's combined re-pin after row 149 lands.
Sign in to join this conversation.
No Branch/Tag Specified
Labels
Clear labels
bug
Defect in framework tooling or delivered code
 fleet-enhancement
Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
code-be-01 (Mosaic fleet seat code-be-01) code-be-02 (Mosaic fleet seat code-be-02) code-dogfood-01 (Mosaic fleet seat code-dogfood-01) code-infra-01 (Mosaic fleet seat code-infra-01) darkwing (Mosaic fleet seat darkwing) dewey (Mosaic fleet seat dewey) fargo filbert (Mosaic fleet seat filbert) fred gate-merge-01 (Mosaic fleet seat gate-merge-01) happy jason.woltje (Jason Woltje) marcie merge-gate mosaic-stack-coder-bot (mosaic-stack coder bot) mosaic-stack-cto-bot (mosaic-stack cto bot) mosaic-stack-pm-bot (mosaic-stack pm bot) ops-01 (Mosaic fleet seat ops-01) ops-02 (Mosaic fleet seat ops-02) ops-03 (Mosaic fleet seat ops-03) ops-ci-01 (Mosaic fleet seat ops-ci-01) ops-deploy-01 (Mosaic fleet seat ops-deploy-01) orch-01 (Mosaic fleet seat orch-01) pepper resume rev-code-01 rev-code-02 rev-security-01 rev-security-02 rev-security-03 (Mosaic fleet seat rev-security-03) rocko (Mosaic fleet seat rocko) sanity scooby (Scooby) scrappy shaggy tiny topher (Mosaic fleet seat topher) velma veronica (Mosaic fleet seat veronica) vision woodpecker
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#1618