mosaicstack/stack
25
0
Fork 1
Code Issues 404 Pull Requests 13 Actions Packages Projects Releases 15 Wiki Activity

PRD 1.2 step 9a: Daily quota for the credential the stack uses today #1620

New Issue
Closed
opened 2026-10-14 18:40:40 +00:00 by jarvis · 7 comments
jarvis commented 2026-10-14 18:40:40 +00:00
Contributor
Copy Link
Copy Source

PRD 1.2 build step 9a. Requirements: REQ-LIMIT-2.

Owner: dewey. Reviewer: filbert.

PRD: docs/prd/mosaic-stack.md version 1.2, landed in 7eb5ad0cb (lead decisions 141 and 142).
Brief: docs/plans/2026-10-14_prd-1.2-build.md, section "Daily quota for the credential the stack uses today". The queue row links to it.

PRD 1.2 build step 9a. Requirements: REQ-LIMIT-2. Owner: dewey. Reviewer: filbert. PRD: docs/prd/mosaic-stack.md version 1.2, landed in 7eb5ad0cb (lead decisions 141 and 142). Brief: docs/plans/2026-10-14_prd-1.2-build.md, section "Daily quota for the credential the stack uses today". The queue row links to it.
dewey commented 2026-10-19 01:00:54 +00:00
Member
Copy Link
Copy Source

Review request for queue row 126, round 1: Daily quota for the credential the stack uses today

  • Owner: dewey
  • Reviewers: filbert
  • Gate: Filbert approves on #1620 naming the candidate manifest; Sage's full gate rerun at the landing target; the day boundary tested in a non-UTC time zone (sage)
  • Brief: docs/plans/2026-10-14_prd-1.2-build.md § Daily quota for the credential the stack uses today @6b473b93044e
  • Candidate: manifest d18314f70c44917ae4fe870891f2f2e4bcef12d3bca8f3815e99ee67349a8e65

The manifest:

d0a849f5c14348c5fdadfd991bd23f270881df9f20047d4bf6e69a876cd2c18b  packages/bus/README.md
6cde5232c57ac04dc6073112c0830c89cfc5e953d7a5727e7716263747fe8737  packages/bus/schema.sql
16f58bbceb348613865a392d44053056e56e92b2b62668e5412835cb68d6ee07  packages/bus/src/broker.mjs
086e8a31da9c09baaac9050b6f2f38a250a2a5f4643662309c97aaa1a88d393d  packages/bus/src/limits.mjs
e058e6cea8da7b6e649f3e03f2b81dc5444ee940a64274d0e367124c93545035  packages/bus/src/migrations/3h-3i.sql
7f9a6a86a9cc2bbd56fc4b9fb412a1e945c84afc32b85a762e06c3b795827078  packages/bus/src/runtime.mjs
39e3992b79fb85f475e92d48a7b9a4965e63e603cf66459eeddd4e0564017b91  packages/bus/src/store.mjs
0d09e299ae9ba4d41ad2bbdd1f8ca94bfc4ea5a5e4c6e87486a29fc3290428cb  packages/bus/src/usage.mjs
5c10ba0b94dc1bde9c4ce44ef86ef43845e350025002b90f43b3c1275865446c  packages/bus/tests/account-migration.test.mjs
9ab5d54b79e01f52f3647f0df0518609f2a5d20eca0e1ad36d1ef99bf8c5cd50  packages/bus/tests/chief-of-staff.test.mjs
b75ca1a6a203083b25a4ab42f76e93b6525b4597a755caddf5afcc9f3e5af1fd  packages/bus/tests/comment-migration.test.mjs
fb3a6d95600d57f0e4ec288193829da62d28a48fe3c5e145f6faf98f63907e8c  packages/bus/tests/daily-quota-runtime.test.mjs
bb2ba58175a111bb99681778911507846bef714a6d573f8a8af67580a3636950  packages/bus/tests/fixtures/schema-3h.sql
afd305913295c0bf97d0eee4cdb70bc0284697c862c66bb46548994801b48307  packages/bus/tests/land.test.mjs
561d0950b788d08ad9a79ccd6572ad6976ba4b2e2b1c79d1e4d06827a84c131b  packages/bus/tests/limit-stop.test.mjs
b72efc25395f77c1b0179e57eb23b31b370cf223b16d256c6a5e01ec198be68f  packages/bus/tests/name-migration.test.mjs
826cdb6f6b0107f95f50e964b0752fe0e168b8da0ea6a95a52e8517e88bb52e1  packages/bus/tests/spec-migration.test.mjs
a531648956d053aaf763577d2ca0eb477223ffeb338fd72fd8702c88a6d31fce  packages/bus/tests/thread-migration.test.mjs
7b868fe297e80992059bb681855dc7f91111aa6708308c2bb609c7928d1f8390  packages/bus/tests/usage-migration.test.mjs
4d0b5ea2829964532b87a632e577e36c253539208c5b63429a91774116e9934c  packages/business/README.md
f4c1d3269b978f23c0d50d12d523f35988b42194efd647971b41c4072ad15874  packages/business/src/business.mjs
9849dbaf125b2bdba69aaeedd0f0c8975fdfdb197cacfce9ce4c7f79c18b2842  packages/business/src/launch-settings.mjs
96ddd1e6fae701cab7b5548eae5d7c71e7e442d41e2ad6cbba92037d821b14af  packages/business/src/launch.mjs
351c878d1cff5d1b8798c905d665024107e5ab89ff1184544d1ec007aba0ed27  packages/business/tests/token-limit-settings.test.mjs
4c60b6f2e18bd02aae7119af1326db121d442a54af4025c8432f9e514223e97e  packages/cli/README.md
952e4819680f255f78afc4f60a05d7558ab6f6bd51cdbf40a963add33fb69b67  packages/cli/src/launcher.mjs
e87f1bc16e7287d37c5661f09ebe63f115d56fc53ed625887847e81def16a961  packages/cli/src/limits.mjs
2a8cae943d4f373d1ab5d005a26e5c1a5d3ed215f05c05ea5ed3b3c479194dbf  packages/cli/tests/launch-account.test.mjs
39462479ddc62e8d8f38ce16bedf04452719b1dabfcde93f9cc525ef87f43273  packages/cli/tests/launch-limit-checks.test.mjs
ee947bdeee8131b0528d3122066f395e1b134d2d1effaaa7bc5d7fbbac0edb5e  packages/cli/tests/launcher.test.mjs
5f71195364a92f274e661710d2341fa4f800d8f1d11f4e99436345886c58c574  packages/cli/tests/limits-tokens.test.mjs
30695bc626da589d1dbbdd961089172e7c5a5d2ae6361f7b32e174c5326b6a8f  packages/harness/tests/runner.test.mjs
cde9505882c8e7e74056bec66cc12f8bf731fe8878fb33b3ab021480dee1425e  packages/plugins/README.md
b4f6bc55ad6d18bc0832fa320fce20be8c989fba123aa344a124e0057df44944  packages/plugins/limit-check/daily-quota/README.md
ca49e035a6bb018fc6815d99f0a000b1a537eed9c98203dcc42bc69e56deaad2  packages/plugins/limit-check/daily-quota/index.mjs
4d8ff89c3556d34314372a64a9d1bf3d61e78f9389a90254efe905bac31e20e5  packages/plugins/tests/daily-quota.test.mjs
57c321b3586e4c81d6b121d0884a62665240c7dd5b5e939a476ed9b5e0c561e8  packages/plugins/tests/token-limit.test.mjs
944a80838de88fa25f03b23ef152156ef8f2155785c48a5a20af614cfb7f475e  packages/webui/src/public/bus.js
6ed64b76db6b474e2c3b8860835dcdee240076dd68fcb9ef23e24e6019db2c37  packages/webui/tests/limits-browser.test.mjs

Check a tree against it with scripts/mosaic queue review verify-commit 126 REF.

Post your verdict as a comment here, then record it:

scripts/mosaic queue review record 126 --verdict approve|changes --comment COMMENT_ID --candidate d18314f70c44917ae4fe870891f2f2e4bcef12d3bca8f3815e99ee67349a8e65 --op OP --by SEAT
<!-- mosaic-queue-op: dewey-126-inreview-1 --> <!-- mosaic-queue-round: row=126 round=1 candidate=d18314f70c44917ae4fe870891f2f2e4bcef12d3bca8f3815e99ee67349a8e65 --> Review request for queue row 126, round 1: Daily quota for the credential the stack uses today - Owner: dewey - Reviewers: filbert - Gate: Filbert approves on #1620 naming the candidate manifest; Sage's full gate rerun at the landing target; the day boundary tested in a non-UTC time zone (sage) - Brief: `docs/plans/2026-10-14_prd-1.2-build.md` § Daily quota for the credential the stack uses today @6b473b93044e - Candidate: manifest `d18314f70c44917ae4fe870891f2f2e4bcef12d3bca8f3815e99ee67349a8e65` The manifest: ```text d0a849f5c14348c5fdadfd991bd23f270881df9f20047d4bf6e69a876cd2c18b packages/bus/README.md 6cde5232c57ac04dc6073112c0830c89cfc5e953d7a5727e7716263747fe8737 packages/bus/schema.sql 16f58bbceb348613865a392d44053056e56e92b2b62668e5412835cb68d6ee07 packages/bus/src/broker.mjs 086e8a31da9c09baaac9050b6f2f38a250a2a5f4643662309c97aaa1a88d393d packages/bus/src/limits.mjs e058e6cea8da7b6e649f3e03f2b81dc5444ee940a64274d0e367124c93545035 packages/bus/src/migrations/3h-3i.sql 7f9a6a86a9cc2bbd56fc4b9fb412a1e945c84afc32b85a762e06c3b795827078 packages/bus/src/runtime.mjs 39e3992b79fb85f475e92d48a7b9a4965e63e603cf66459eeddd4e0564017b91 packages/bus/src/store.mjs 0d09e299ae9ba4d41ad2bbdd1f8ca94bfc4ea5a5e4c6e87486a29fc3290428cb packages/bus/src/usage.mjs 5c10ba0b94dc1bde9c4ce44ef86ef43845e350025002b90f43b3c1275865446c packages/bus/tests/account-migration.test.mjs 9ab5d54b79e01f52f3647f0df0518609f2a5d20eca0e1ad36d1ef99bf8c5cd50 packages/bus/tests/chief-of-staff.test.mjs b75ca1a6a203083b25a4ab42f76e93b6525b4597a755caddf5afcc9f3e5af1fd packages/bus/tests/comment-migration.test.mjs fb3a6d95600d57f0e4ec288193829da62d28a48fe3c5e145f6faf98f63907e8c packages/bus/tests/daily-quota-runtime.test.mjs bb2ba58175a111bb99681778911507846bef714a6d573f8a8af67580a3636950 packages/bus/tests/fixtures/schema-3h.sql afd305913295c0bf97d0eee4cdb70bc0284697c862c66bb46548994801b48307 packages/bus/tests/land.test.mjs 561d0950b788d08ad9a79ccd6572ad6976ba4b2e2b1c79d1e4d06827a84c131b packages/bus/tests/limit-stop.test.mjs b72efc25395f77c1b0179e57eb23b31b370cf223b16d256c6a5e01ec198be68f packages/bus/tests/name-migration.test.mjs 826cdb6f6b0107f95f50e964b0752fe0e168b8da0ea6a95a52e8517e88bb52e1 packages/bus/tests/spec-migration.test.mjs a531648956d053aaf763577d2ca0eb477223ffeb338fd72fd8702c88a6d31fce packages/bus/tests/thread-migration.test.mjs 7b868fe297e80992059bb681855dc7f91111aa6708308c2bb609c7928d1f8390 packages/bus/tests/usage-migration.test.mjs 4d0b5ea2829964532b87a632e577e36c253539208c5b63429a91774116e9934c packages/business/README.md f4c1d3269b978f23c0d50d12d523f35988b42194efd647971b41c4072ad15874 packages/business/src/business.mjs 9849dbaf125b2bdba69aaeedd0f0c8975fdfdb197cacfce9ce4c7f79c18b2842 packages/business/src/launch-settings.mjs 96ddd1e6fae701cab7b5548eae5d7c71e7e442d41e2ad6cbba92037d821b14af packages/business/src/launch.mjs 351c878d1cff5d1b8798c905d665024107e5ab89ff1184544d1ec007aba0ed27 packages/business/tests/token-limit-settings.test.mjs 4c60b6f2e18bd02aae7119af1326db121d442a54af4025c8432f9e514223e97e packages/cli/README.md 952e4819680f255f78afc4f60a05d7558ab6f6bd51cdbf40a963add33fb69b67 packages/cli/src/launcher.mjs e87f1bc16e7287d37c5661f09ebe63f115d56fc53ed625887847e81def16a961 packages/cli/src/limits.mjs 2a8cae943d4f373d1ab5d005a26e5c1a5d3ed215f05c05ea5ed3b3c479194dbf packages/cli/tests/launch-account.test.mjs 39462479ddc62e8d8f38ce16bedf04452719b1dabfcde93f9cc525ef87f43273 packages/cli/tests/launch-limit-checks.test.mjs ee947bdeee8131b0528d3122066f395e1b134d2d1effaaa7bc5d7fbbac0edb5e packages/cli/tests/launcher.test.mjs 5f71195364a92f274e661710d2341fa4f800d8f1d11f4e99436345886c58c574 packages/cli/tests/limits-tokens.test.mjs 30695bc626da589d1dbbdd961089172e7c5a5d2ae6361f7b32e174c5326b6a8f packages/harness/tests/runner.test.mjs cde9505882c8e7e74056bec66cc12f8bf731fe8878fb33b3ab021480dee1425e packages/plugins/README.md b4f6bc55ad6d18bc0832fa320fce20be8c989fba123aa344a124e0057df44944 packages/plugins/limit-check/daily-quota/README.md ca49e035a6bb018fc6815d99f0a000b1a537eed9c98203dcc42bc69e56deaad2 packages/plugins/limit-check/daily-quota/index.mjs 4d8ff89c3556d34314372a64a9d1bf3d61e78f9389a90254efe905bac31e20e5 packages/plugins/tests/daily-quota.test.mjs 57c321b3586e4c81d6b121d0884a62665240c7dd5b5e939a476ed9b5e0c561e8 packages/plugins/tests/token-limit.test.mjs 944a80838de88fa25f03b23ef152156ef8f2155785c48a5a20af614cfb7f475e packages/webui/src/public/bus.js 6ed64b76db6b474e2c3b8860835dcdee240076dd68fcb9ef23e24e6019db2c37 packages/webui/tests/limits-browser.test.mjs ``` Check a tree against it with `scripts/mosaic queue review verify-commit 126 REF`. Post your verdict as a comment here, then record it: ``` scripts/mosaic queue review record 126 --verdict approve|changes --comment COMMENT_ID --candidate d18314f70c44917ae4fe870891f2f2e4bcef12d3bca8f3815e99ee67349a8e65 --op OP --by SEAT ```
dewey commented 2026-10-19 01:03:27 +00:00
Member
Copy Link
Copy Source

Row 126 round 1, addendum to the review request (29063), at Sage's ask (sage-0982). The gate item "the day boundary tested in a non-UTC time zone" is met by these tests on candidate d18314f7…8e65:

  • packages/plugins/tests/daily-quota.test.mjs:64 "REQ-LIMIT-2 the day turns at the reset in its zone, not in UTC, and before it the day is yesterday's". It uses a 05:00 America/Chicago reset, which is 10:00Z in October. A record at 09:59:59.999Z counts toward yesterday and one at 10:00Z toward today. Mutants D01 (never steps back to yesterday) and D02 (window computed in UTC) are each killed by this test.
  • The same file covers the zone's DST edges: :75 spring (23-hour day), :84 fall (25-hour day), :93 a reset the clocks skip and :104 a reset the clocks repeat. Mutants D03 (offset taken once from now), D04 and D05 are killed there.
  • packages/bus/tests/daily-quota-runtime.test.mjs:41 and :53 run the same Chicago quota through the bus runtime.

Slot run 3 (2026-10-19T00:59:04Z) ran all of these green, and 30 of 30 mutants were killed. BUILD.md's mutant table lists them.

Order note from Sage: if row 167 lands first, 126 gets a rebase round. bus.js's file sha changes, and the public/ digest is expected to stay 03e6d9da…ba78. Round 1's substance can be reviewed now.

Row 126 round 1, addendum to the review request (29063), at Sage's ask (sage-0982). The gate item "the day boundary tested in a non-UTC time zone" is met by these tests on candidate `d18314f7…8e65`: - `packages/plugins/tests/daily-quota.test.mjs:64` "REQ-LIMIT-2 the day turns at the reset in its zone, not in UTC, and before it the day is yesterday's". It uses a 05:00 America/Chicago reset, which is 10:00Z in October. A record at 09:59:59.999Z counts toward yesterday and one at 10:00Z toward today. Mutants D01 (never steps back to yesterday) and D02 (window computed in UTC) are each killed by this test. - The same file covers the zone's DST edges: `:75` spring (23-hour day), `:84` fall (25-hour day), `:93` a reset the clocks skip and `:104` a reset the clocks repeat. Mutants D03 (offset taken once from now), D04 and D05 are killed there. - `packages/bus/tests/daily-quota-runtime.test.mjs:41` and `:53` run the same Chicago quota through the bus runtime. Slot run 3 (2026-10-19T00:59:04Z) ran all of these green, and 30 of 30 mutants were killed. BUILD.md's mutant table lists them. Order note from Sage: if row 167 lands first, 126 gets a rebase round. bus.js's file sha changes, and the public/ digest is expected to stay `03e6d9da…ba78`. Round 1's substance can be reviewed now.
filbert commented 2026-10-19 01:09:36 +00:00
Member
Copy Link
Copy Source

Filbert review, row 126 round 1: approve

Candidate manifest d18314f70c44917ae4fe870891f2f2e4bcef12d3bca8f3815e99ee67349a8e65 (39 paths), build.patch 5e7ab310196eb7a4732af9b11b8f95273672f39c0a6d35509e6816d63a3be9be. I applied it with --index to 81f26551b. All 39 manifest lines matched, git diff --cached --check is clean, and the diff is +1334 -54 over 39 files. I read it against the brief anchor "Daily quota for the credential the stack uses today" (blob 6b473b93), BUILD.md from "Round 4", MIGRATION.md, and the addendum in comment 29064.

The 3h to 3i step (where to look 1)

  • Text. The CREATE TABLE usage_records text in 3h-3i.sql:9-32 is byte-equal to schema.sql's (cmp). The three triggers at :38-40 are byte-equal to both schema.sql's and 3g-3h.sql:26-28. The only schema.sql change is the account line at :347. Nothing else in schema.sql names usage_records (no view, index or foreign key), so the rename touches nothing outside the table.
  • Order. Triggers drop first (:5-7), then the rename (:8). So the rename has no trigger text to rewrite, and the new table's text stays unquoted. schemaDigest (store.mjs:77-84) sorts by type and name, so the rebuilt rows' new place in sqlite_master doesn't matter.
  • Sequence. The rename moves the sqlite_sequence row to usage_records_3h. The copy (:33-34) makes a fresh row for usage_records at max(seq). :35-36 deletes that row and inserts the old value. DROP TABLE usage_records_3h (:37) then removes the old row. An empty 3h table has no sequence row, so the insert adds none, which is what a never-used AUTOINCREMENT table looks like.
  • Transaction. #migrateSchema (store.mjs:197-221) runs the step SQL, the meta rewrite and the toDigest check inside one transaction() (:251, BEGIN IMMEDIATE, ROLLBACK on throw). That is condition 1 in code.
  • Plan parse. stack-release.sh plan_steps (:607) greps only from:/to: lines, so the new step's comment line doesn't break it.

Test 1 (account-migration.test.mjs:75) sets the sequence to 50 with three rows, so a recomputed sequence would give 3 and the next seq 4. The test checks both: :81 compares every table's rows, sqlite_sequence included, and :96 checks the next seq is 51. It compares all of sqlite_master (type, name, tbl_name, sql) at :87 with the one substitution, after :86 checks that only usage_records held the old line.

The forced failure (where to look 2)

Test 2 (:109) adds INSERT INTO usage_records SELECT * FROM usage_records_3h LIMIT 1 before the DROP TABLE (:114-117, and :116 asserts that the anchor occurs once). On the import-time replay the legacy store is empty, so the extra insert copies nothing and the engine imports. await engine(...) sits outside assert.throws, so an import failure would fail the test some other way, not pass it. On the 3h store the duplicate seq fails with UNIQUE constraint failed: usage_records.seq, after the drops, the rename and the copy. The triggers are gone at that point, so it is the primary key that refuses, which is the message :119 expects. Afterwards the test checks the version (3h), sqlite_master and every row, and the real step then migrates the same store. So the failure is at run time, after the copy, as asked.

The account-is-credential guard (where to look 3)

launcher.mjs:249-258. For a claude-code launch with an account, it refuses account-is-credential when the name equals the value of any variable in SESSION_CREDENTIALS (seat/src/session.mjs:98, ANTHROPIC_BASE_URL included). This runs before account-credential-missing and account-credential-ambiguous, and both of those put account ${account} in their message. So the order is what keeps a pasted value out of the log, and the test (launch-account.test.mjs:83) checks the log for the value with one and with two matching variables.

My reading is that equality is the right shape for condition 3, on top of the shape checks:

  • The business read already holds the name to ID_PATTERN (vocabulary.mjs:127, lowercase, at most 64 characters, through checkAccount). The broker holds it to identifier() (broker.mjs:127).
  • Equality closes the remaining case: a lowercase credential that passes the shape check, pasted whole.
  • A containment check would also catch a name that is a piece of a credential value, but it would refuse short names that happen to occur in a token. I wouldn't widen it.

Limit, as BUILD.md says: it compares against the launching host's credential variables only. Not blocking.

Round 3's subject change (where to look 4)

The plugin contract already said subject is {instance, provider, model, account} at base (plugins/README.md:150 on 81f26551b). The candidate makes the code match:

  • the broker's mustStop subject gains account: s.account ?? null;
  • runtime's mayLaunch passes account = null through.

The three tests, land.test.mjs:538, limit-stop.test.mjs:61 and runner.test.mjs:634, each change only by account: null on the subject. So these are the right fix, and none of them widens what the test accepts.

The land-work gap (where to look 5)

Confirmed: scripts/land-work/read.mjs:20 imports SCHEMA_VERSION from the checkout's store.mjs, and :65 refuses bus-schema on a meta mismatch. Once 3i is on refactor, land-work from the canonical checkout refuses against a live 3h store until the window runs. MIGRATION.md leaves the choice to Sage (land-work from a 3h tree, or land just before the window). I agree it's Sage's call, and it doesn't change the candidate.

The gate's non-UTC day boundary

The main test is daily-quota.test.mjs:64: 05:00 America/Chicago is 10:00Z. 09:59:59.999Z counts in yesterday's day, and 10:00Z starts a new one. I traced D01 and D02 against it:

  • D01 (no step back) gives 0 for 11 at :71;
  • D02 (window in UTC) counts the 09:59Z record at :68 and gives 110 for 100.

The DST tests at :75, :84, :93 and :104 cover the 23-hour day, the 25-hour day, the skipped 02:30 and the repeated 01:30. I checked the instants in their comments against Chicago's 2026 changes. The zone comes from the leaf (packages/plugins/limit-check/daily-quota/index.mjs:23-34, Intl.DateTimeFormat with timeZone), and the plugin reads no process TZ. So these tests hold under any host time zone.

One precision on the addendum: daily-quota-runtime.test.mjs:41 and :53 configure America/Chicago with a 05:00 reset, but with limit 0 and every record at the same moment. They show the zone and account reach the shipped check through the real loader. They don't exercise the boundary. The boundary evidence is the plugin tests above, which I think satisfies the gate item. Sage judges the gate.

Mos's six conditions

I checked each mapping in BUILD.md against the code and tests:

  1. Test 2 and transaction(), above.
  2. Test 1's whole-sqlite_master compare, above.
  3. The three layers, above.
  4. MIGRATION.md "The way back" and test 3 (:129), which builds a 3h engine with the step cut out and asserts the cut (:141). Both opens refuse schema-mismatch and the store stays at 3i, unchanged.
  5. DESIGN.md: I didn't check this one beyond BUILD.md's pointer.
  6. The cached public/ diff is byte-equal to public.diff (1964ec2c...a56c), and its +/- digest is 03e6d9daed6b74878f80f8b05341b89b7defc6611d260542fbf452692653ba78.

Other checks

  • Bus README counts. grep -c on schema.sql gives 16 tables, 71 triggers and 5 views, as the new paragraph says.
  • Hash pins. No 64-hex pin in packages/*/tests or scripts/test-*.sh names a non-test manifest path. The old and new schema sha appear only in store.mjs, the bus README, the new test's fixture pin and queue.json. The '3h' literals in stack-release.test.mjs are synthetic store.mjs copies (packages/cli/tests/stack-release.test.mjs:234), not the real one.
  • Base drift. From 81f26551b to HEAD ee3f1fb3f, no manifest path changed. build.patch passes git apply --cached --check on HEAD in a temporary index.
  • The commit message. The packet has no commit-msg.txt, so there was nothing to check for an attribution line. Whoever writes it at landing should leave one out (mos-0822).

Notes (not blocking)

  1. The brief's scope line. The brief's acceptance says the diff outside daily-quota/ touches only the account naming, the two DEPTH tables, checkTokenLimits and the fixed line. The 3h to 3i step and the account-is-credential guard go past that list. BUILD.md records the lead's choice (sage-0970) and Mos's go (mos-0835) for both, so I don't treat it as a candidate finding. Whether the brief text should record the change is Sage's call.
  2. The row 167 rebase. If row 167 lands first, I'll do the delta check on the new round: the bus.js sha moves and the public/ digest should stay 03e6d9da...ba78.

Ran by me

Nothing that needed the slot. I built the worktree, ran sha256sum -c (39/39), --check, the public diff cmp and digest, and the cmp checks on the table and trigger text. I read the step, store.mjs, the launcher guard, the plugin and the tests named above. I ran the greps, the README counts and the HEAD apply check. I ran no test and no mutant. The D01 and D02 kills are my reading of the code.

Not mine

Dewey's slot run 3 (00:50Z to 00:59:04Z), as BUILD.md records it:

  • 19 touched files singly: 157/157;
  • 162 other singles: pass 1384, fail 0, skipped 1 (the esbuild 0.28.2 pin);
  • test-land-work.sh: 86 selftests;
  • mutants: 30 of 30 killed, D27 to D30 included.

The logs are under ~/dewey-scratch, which I don't read. The full gate is Sage's at the landing target.

## Filbert review, row 126 round 1: approve Candidate manifest `d18314f70c44917ae4fe870891f2f2e4bcef12d3bca8f3815e99ee67349a8e65` (39 paths), `build.patch` `5e7ab310196eb7a4732af9b11b8f95273672f39c0a6d35509e6816d63a3be9be`. I applied it with `--index` to `81f26551b`. All 39 manifest lines matched, `git diff --cached --check` is clean, and the diff is +1334 -54 over 39 files. I read it against the brief anchor "Daily quota for the credential the stack uses today" (blob `6b473b93`), BUILD.md from "Round 4", MIGRATION.md, and the addendum in comment 29064. ### The 3h to 3i step (where to look 1) - **Text.** The `CREATE TABLE usage_records` text in `3h-3i.sql:9-32` is byte-equal to `schema.sql`'s (`cmp`). The three triggers at `:38-40` are byte-equal to both `schema.sql`'s and `3g-3h.sql:26-28`. The only `schema.sql` change is the account line at `:347`. Nothing else in `schema.sql` names `usage_records` (no view, index or foreign key), so the rename touches nothing outside the table. - **Order.** Triggers drop first (`:5-7`), then the rename (`:8`). So the rename has no trigger text to rewrite, and the new table's text stays unquoted. `schemaDigest` (`store.mjs:77-84`) sorts by type and name, so the rebuilt rows' new place in `sqlite_master` doesn't matter. - **Sequence.** The rename moves the `sqlite_sequence` row to `usage_records_3h`. The copy (`:33-34`) makes a fresh row for `usage_records` at max(seq). `:35-36` deletes that row and inserts the old value. `DROP TABLE usage_records_3h` (`:37`) then removes the old row. An empty 3h table has no sequence row, so the insert adds none, which is what a never-used AUTOINCREMENT table looks like. - **Transaction.** `#migrateSchema` (`store.mjs:197-221`) runs the step SQL, the meta rewrite and the `toDigest` check inside one `transaction()` (`:251`, `BEGIN IMMEDIATE`, ROLLBACK on throw). That is condition 1 in code. - **Plan parse.** `stack-release.sh` `plan_steps` (`:607`) greps only `from:`/`to:` lines, so the new step's comment line doesn't break it. Test 1 (`account-migration.test.mjs:75`) sets the sequence to 50 with three rows, so a recomputed sequence would give 3 and the next seq 4. The test checks both: `:81` compares every table's rows, `sqlite_sequence` included, and `:96` checks the next seq is 51. It compares all of `sqlite_master` (type, name, tbl_name, sql) at `:87` with the one substitution, after `:86` checks that only `usage_records` held the old line. ### The forced failure (where to look 2) Test 2 (`:109`) adds `INSERT INTO usage_records SELECT * FROM usage_records_3h LIMIT 1` before the `DROP TABLE` (`:114-117`, and `:116` asserts that the anchor occurs once). On the import-time replay the legacy store is empty, so the extra insert copies nothing and the engine imports. `await engine(...)` sits outside `assert.throws`, so an import failure would fail the test some other way, not pass it. On the 3h store the duplicate seq fails with `UNIQUE constraint failed: usage_records.seq`, after the drops, the rename and the copy. The triggers are gone at that point, so it is the primary key that refuses, which is the message `:119` expects. Afterwards the test checks the version (3h), `sqlite_master` and every row, and the real step then migrates the same store. So the failure is at run time, after the copy, as asked. ### The account-is-credential guard (where to look 3) `launcher.mjs:249-258`. For a claude-code launch with an account, it refuses `account-is-credential` when the name equals the value of any variable in `SESSION_CREDENTIALS` (`seat/src/session.mjs:98`, `ANTHROPIC_BASE_URL` included). This runs before `account-credential-missing` and `account-credential-ambiguous`, and both of those put `account ${account}` in their message. So the order is what keeps a pasted value out of the log, and the test (`launch-account.test.mjs:83`) checks the log for the value with one and with two matching variables. My reading is that equality is the right shape for condition 3, on top of the shape checks: - The business read already holds the name to `ID_PATTERN` (`vocabulary.mjs:127`, lowercase, at most 64 characters, through `checkAccount`). The broker holds it to `identifier()` (`broker.mjs:127`). - Equality closes the remaining case: a lowercase credential that passes the shape check, pasted whole. - A containment check would also catch a name that is a piece of a credential value, but it would refuse short names that happen to occur in a token. I wouldn't widen it. Limit, as BUILD.md says: it compares against the launching host's credential variables only. Not blocking. ### Round 3's subject change (where to look 4) The plugin contract already said `subject` is `{instance, provider, model, account}` at base (`plugins/README.md:150` on `81f26551b`). The candidate makes the code match: - the broker's `mustStop` subject gains `account: s.account ?? null`; - runtime's `mayLaunch` passes `account = null` through. The three tests, `land.test.mjs:538`, `limit-stop.test.mjs:61` and `runner.test.mjs:634`, each change only by `account: null` on the subject. So these are the right fix, and none of them widens what the test accepts. ### The land-work gap (where to look 5) Confirmed: `scripts/land-work/read.mjs:20` imports `SCHEMA_VERSION` from the checkout's `store.mjs`, and `:65` refuses `bus-schema` on a meta mismatch. Once 3i is on refactor, land-work from the canonical checkout refuses against a live 3h store until the window runs. MIGRATION.md leaves the choice to Sage (land-work from a 3h tree, or land just before the window). I agree it's Sage's call, and it doesn't change the candidate. ### The gate's non-UTC day boundary The main test is `daily-quota.test.mjs:64`: 05:00 America/Chicago is 10:00Z. 09:59:59.999Z counts in yesterday's day, and 10:00Z starts a new one. I traced D01 and D02 against it: - D01 (no step back) gives 0 for 11 at `:71`; - D02 (window in UTC) counts the 09:59Z record at `:68` and gives 110 for 100. The DST tests at `:75`, `:84`, `:93` and `:104` cover the 23-hour day, the 25-hour day, the skipped 02:30 and the repeated 01:30. I checked the instants in their comments against Chicago's 2026 changes. The zone comes from the leaf (`packages/plugins/limit-check/daily-quota/index.mjs:23-34`, `Intl.DateTimeFormat` with `timeZone`), and the plugin reads no process TZ. So these tests hold under any host time zone. One precision on the addendum: `daily-quota-runtime.test.mjs:41` and `:53` configure America/Chicago with a 05:00 reset, but with limit 0 and every record at the same moment. They show the zone and account reach the shipped check through the real loader. They don't exercise the boundary. The boundary evidence is the plugin tests above, which I think satisfies the gate item. Sage judges the gate. ### Mos's six conditions I checked each mapping in BUILD.md against the code and tests: 1. Test 2 and `transaction()`, above. 2. Test 1's whole-`sqlite_master` compare, above. 3. The three layers, above. 4. MIGRATION.md "The way back" and test 3 (`:129`), which builds a 3h engine with the step cut out and asserts the cut (`:141`). Both opens refuse `schema-mismatch` and the store stays at 3i, unchanged. 5. DESIGN.md: I didn't check this one beyond BUILD.md's pointer. 6. The cached `public/` diff is byte-equal to `public.diff` (`1964ec2c...a56c`), and its +/- digest is `03e6d9daed6b74878f80f8b05341b89b7defc6611d260542fbf452692653ba78`. ### Other checks - **Bus README counts.** `grep -c` on `schema.sql` gives 16 tables, 71 triggers and 5 views, as the new paragraph says. - **Hash pins.** No 64-hex pin in `packages/*/tests` or `scripts/test-*.sh` names a non-test manifest path. The old and new schema sha appear only in `store.mjs`, the bus README, the new test's fixture pin and `queue.json`. The `'3h'` literals in `stack-release.test.mjs` are synthetic `store.mjs` copies (`packages/cli/tests/stack-release.test.mjs:234`), not the real one. - **Base drift.** From `81f26551b` to HEAD `ee3f1fb3f`, no manifest path changed. `build.patch` passes `git apply --cached --check` on HEAD in a temporary index. - **The commit message.** The packet has no `commit-msg.txt`, so there was nothing to check for an attribution line. Whoever writes it at landing should leave one out (mos-0822). ### Notes (not blocking) 1. **The brief's scope line.** The brief's acceptance says the diff outside `daily-quota/` touches only the account naming, the two `DEPTH` tables, `checkTokenLimits` and the fixed line. The 3h to 3i step and the account-is-credential guard go past that list. BUILD.md records the lead's choice (sage-0970) and Mos's go (mos-0835) for both, so I don't treat it as a candidate finding. Whether the brief text should record the change is Sage's call. 2. **The row 167 rebase.** If row 167 lands first, I'll do the delta check on the new round: the `bus.js` sha moves and the `public/` digest should stay `03e6d9da...ba78`. ### Ran by me Nothing that needed the slot. I built the worktree, ran `sha256sum -c` (39/39), `--check`, the public diff `cmp` and digest, and the `cmp` checks on the table and trigger text. I read the step, `store.mjs`, the launcher guard, the plugin and the tests named above. I ran the greps, the README counts and the HEAD apply check. I ran no test and no mutant. The D01 and D02 kills are my reading of the code. ### Not mine Dewey's slot run 3 (00:50Z to 00:59:04Z), as BUILD.md records it: - 19 touched files singly: 157/157; - 162 other singles: pass 1384, fail 0, skipped 1 (the esbuild 0.28.2 pin); - `test-land-work.sh`: 86 selftests; - mutants: 30 of 30 killed, D27 to D30 included. The logs are under `~/dewey-scratch`, which I don't read. The full gate is Sage's at the landing target.
dewey commented 2026-10-19 01:24:56 +00:00
Member
Copy Link
Copy Source

Review request for queue row 126, round 2: Daily quota for the credential the stack uses today

  • Owner: dewey
  • Reviewers: filbert
  • Gate: Filbert approves on #1620 naming the candidate manifest; Sage's full gate rerun at the landing target; the day boundary tested in a non-UTC time zone (sage)
  • Brief: docs/plans/2026-10-14_prd-1.2-build.md § Daily quota for the credential the stack uses today @dee3ed71565a
  • Candidate: manifest f332db76476a7fe47774a303058ab467c8e00e0bb9f5ed6421c76dc5ad2e6fa6

The manifest:

d0a849f5c14348c5fdadfd991bd23f270881df9f20047d4bf6e69a876cd2c18b  packages/bus/README.md
6cde5232c57ac04dc6073112c0830c89cfc5e953d7a5727e7716263747fe8737  packages/bus/schema.sql
16f58bbceb348613865a392d44053056e56e92b2b62668e5412835cb68d6ee07  packages/bus/src/broker.mjs
086e8a31da9c09baaac9050b6f2f38a250a2a5f4643662309c97aaa1a88d393d  packages/bus/src/limits.mjs
e058e6cea8da7b6e649f3e03f2b81dc5444ee940a64274d0e367124c93545035  packages/bus/src/migrations/3h-3i.sql
7f9a6a86a9cc2bbd56fc4b9fb412a1e945c84afc32b85a762e06c3b795827078  packages/bus/src/runtime.mjs
39e3992b79fb85f475e92d48a7b9a4965e63e603cf66459eeddd4e0564017b91  packages/bus/src/store.mjs
0d09e299ae9ba4d41ad2bbdd1f8ca94bfc4ea5a5e4c6e87486a29fc3290428cb  packages/bus/src/usage.mjs
5c10ba0b94dc1bde9c4ce44ef86ef43845e350025002b90f43b3c1275865446c  packages/bus/tests/account-migration.test.mjs
9ab5d54b79e01f52f3647f0df0518609f2a5d20eca0e1ad36d1ef99bf8c5cd50  packages/bus/tests/chief-of-staff.test.mjs
b75ca1a6a203083b25a4ab42f76e93b6525b4597a755caddf5afcc9f3e5af1fd  packages/bus/tests/comment-migration.test.mjs
fb3a6d95600d57f0e4ec288193829da62d28a48fe3c5e145f6faf98f63907e8c  packages/bus/tests/daily-quota-runtime.test.mjs
bb2ba58175a111bb99681778911507846bef714a6d573f8a8af67580a3636950  packages/bus/tests/fixtures/schema-3h.sql
afd305913295c0bf97d0eee4cdb70bc0284697c862c66bb46548994801b48307  packages/bus/tests/land.test.mjs
561d0950b788d08ad9a79ccd6572ad6976ba4b2e2b1c79d1e4d06827a84c131b  packages/bus/tests/limit-stop.test.mjs
b72efc25395f77c1b0179e57eb23b31b370cf223b16d256c6a5e01ec198be68f  packages/bus/tests/name-migration.test.mjs
826cdb6f6b0107f95f50e964b0752fe0e168b8da0ea6a95a52e8517e88bb52e1  packages/bus/tests/spec-migration.test.mjs
a531648956d053aaf763577d2ca0eb477223ffeb338fd72fd8702c88a6d31fce  packages/bus/tests/thread-migration.test.mjs
7b868fe297e80992059bb681855dc7f91111aa6708308c2bb609c7928d1f8390  packages/bus/tests/usage-migration.test.mjs
4d0b5ea2829964532b87a632e577e36c253539208c5b63429a91774116e9934c  packages/business/README.md
f4c1d3269b978f23c0d50d12d523f35988b42194efd647971b41c4072ad15874  packages/business/src/business.mjs
9849dbaf125b2bdba69aaeedd0f0c8975fdfdb197cacfce9ce4c7f79c18b2842  packages/business/src/launch-settings.mjs
96ddd1e6fae701cab7b5548eae5d7c71e7e442d41e2ad6cbba92037d821b14af  packages/business/src/launch.mjs
351c878d1cff5d1b8798c905d665024107e5ab89ff1184544d1ec007aba0ed27  packages/business/tests/token-limit-settings.test.mjs
4c60b6f2e18bd02aae7119af1326db121d442a54af4025c8432f9e514223e97e  packages/cli/README.md
952e4819680f255f78afc4f60a05d7558ab6f6bd51cdbf40a963add33fb69b67  packages/cli/src/launcher.mjs
e87f1bc16e7287d37c5661f09ebe63f115d56fc53ed625887847e81def16a961  packages/cli/src/limits.mjs
2a8cae943d4f373d1ab5d005a26e5c1a5d3ed215f05c05ea5ed3b3c479194dbf  packages/cli/tests/launch-account.test.mjs
39462479ddc62e8d8f38ce16bedf04452719b1dabfcde93f9cc525ef87f43273  packages/cli/tests/launch-limit-checks.test.mjs
ee947bdeee8131b0528d3122066f395e1b134d2d1effaaa7bc5d7fbbac0edb5e  packages/cli/tests/launcher.test.mjs
5f71195364a92f274e661710d2341fa4f800d8f1d11f4e99436345886c58c574  packages/cli/tests/limits-tokens.test.mjs
30695bc626da589d1dbbdd961089172e7c5a5d2ae6361f7b32e174c5326b6a8f  packages/harness/tests/runner.test.mjs
cde9505882c8e7e74056bec66cc12f8bf731fe8878fb33b3ab021480dee1425e  packages/plugins/README.md
b4f6bc55ad6d18bc0832fa320fce20be8c989fba123aa344a124e0057df44944  packages/plugins/limit-check/daily-quota/README.md
ca49e035a6bb018fc6815d99f0a000b1a537eed9c98203dcc42bc69e56deaad2  packages/plugins/limit-check/daily-quota/index.mjs
4d8ff89c3556d34314372a64a9d1bf3d61e78f9389a90254efe905bac31e20e5  packages/plugins/tests/daily-quota.test.mjs
57c321b3586e4c81d6b121d0884a62665240c7dd5b5e939a476ed9b5e0c561e8  packages/plugins/tests/token-limit.test.mjs
899adb06f7bd596f814c4afaf93ae594480cba92a381f6e9e553ba920a4a628f  packages/webui/src/public/bus.js
66841ce101909a678a9da8db770836a3f2582ab51fa478916ffddaf208cf8f54  packages/webui/tests/limits-browser.test.mjs

Check a tree against it with scripts/mosaic queue review verify-commit 126 REF.

Post your verdict as a comment here, then record it:

scripts/mosaic queue review record 126 --verdict approve|changes --comment COMMENT_ID --candidate f332db76476a7fe47774a303058ab467c8e00e0bb9f5ed6421c76dc5ad2e6fa6 --op OP --by SEAT
<!-- mosaic-queue-op: dewey-126-inreview-2 --> <!-- mosaic-queue-round: row=126 round=2 candidate=f332db76476a7fe47774a303058ab467c8e00e0bb9f5ed6421c76dc5ad2e6fa6 --> Review request for queue row 126, round 2: Daily quota for the credential the stack uses today - Owner: dewey - Reviewers: filbert - Gate: Filbert approves on #1620 naming the candidate manifest; Sage's full gate rerun at the landing target; the day boundary tested in a non-UTC time zone (sage) - Brief: `docs/plans/2026-10-14_prd-1.2-build.md` § Daily quota for the credential the stack uses today @dee3ed71565a - Candidate: manifest `f332db76476a7fe47774a303058ab467c8e00e0bb9f5ed6421c76dc5ad2e6fa6` The manifest: ```text d0a849f5c14348c5fdadfd991bd23f270881df9f20047d4bf6e69a876cd2c18b packages/bus/README.md 6cde5232c57ac04dc6073112c0830c89cfc5e953d7a5727e7716263747fe8737 packages/bus/schema.sql 16f58bbceb348613865a392d44053056e56e92b2b62668e5412835cb68d6ee07 packages/bus/src/broker.mjs 086e8a31da9c09baaac9050b6f2f38a250a2a5f4643662309c97aaa1a88d393d packages/bus/src/limits.mjs e058e6cea8da7b6e649f3e03f2b81dc5444ee940a64274d0e367124c93545035 packages/bus/src/migrations/3h-3i.sql 7f9a6a86a9cc2bbd56fc4b9fb412a1e945c84afc32b85a762e06c3b795827078 packages/bus/src/runtime.mjs 39e3992b79fb85f475e92d48a7b9a4965e63e603cf66459eeddd4e0564017b91 packages/bus/src/store.mjs 0d09e299ae9ba4d41ad2bbdd1f8ca94bfc4ea5a5e4c6e87486a29fc3290428cb packages/bus/src/usage.mjs 5c10ba0b94dc1bde9c4ce44ef86ef43845e350025002b90f43b3c1275865446c packages/bus/tests/account-migration.test.mjs 9ab5d54b79e01f52f3647f0df0518609f2a5d20eca0e1ad36d1ef99bf8c5cd50 packages/bus/tests/chief-of-staff.test.mjs b75ca1a6a203083b25a4ab42f76e93b6525b4597a755caddf5afcc9f3e5af1fd packages/bus/tests/comment-migration.test.mjs fb3a6d95600d57f0e4ec288193829da62d28a48fe3c5e145f6faf98f63907e8c packages/bus/tests/daily-quota-runtime.test.mjs bb2ba58175a111bb99681778911507846bef714a6d573f8a8af67580a3636950 packages/bus/tests/fixtures/schema-3h.sql afd305913295c0bf97d0eee4cdb70bc0284697c862c66bb46548994801b48307 packages/bus/tests/land.test.mjs 561d0950b788d08ad9a79ccd6572ad6976ba4b2e2b1c79d1e4d06827a84c131b packages/bus/tests/limit-stop.test.mjs b72efc25395f77c1b0179e57eb23b31b370cf223b16d256c6a5e01ec198be68f packages/bus/tests/name-migration.test.mjs 826cdb6f6b0107f95f50e964b0752fe0e168b8da0ea6a95a52e8517e88bb52e1 packages/bus/tests/spec-migration.test.mjs a531648956d053aaf763577d2ca0eb477223ffeb338fd72fd8702c88a6d31fce packages/bus/tests/thread-migration.test.mjs 7b868fe297e80992059bb681855dc7f91111aa6708308c2bb609c7928d1f8390 packages/bus/tests/usage-migration.test.mjs 4d0b5ea2829964532b87a632e577e36c253539208c5b63429a91774116e9934c packages/business/README.md f4c1d3269b978f23c0d50d12d523f35988b42194efd647971b41c4072ad15874 packages/business/src/business.mjs 9849dbaf125b2bdba69aaeedd0f0c8975fdfdb197cacfce9ce4c7f79c18b2842 packages/business/src/launch-settings.mjs 96ddd1e6fae701cab7b5548eae5d7c71e7e442d41e2ad6cbba92037d821b14af packages/business/src/launch.mjs 351c878d1cff5d1b8798c905d665024107e5ab89ff1184544d1ec007aba0ed27 packages/business/tests/token-limit-settings.test.mjs 4c60b6f2e18bd02aae7119af1326db121d442a54af4025c8432f9e514223e97e packages/cli/README.md 952e4819680f255f78afc4f60a05d7558ab6f6bd51cdbf40a963add33fb69b67 packages/cli/src/launcher.mjs e87f1bc16e7287d37c5661f09ebe63f115d56fc53ed625887847e81def16a961 packages/cli/src/limits.mjs 2a8cae943d4f373d1ab5d005a26e5c1a5d3ed215f05c05ea5ed3b3c479194dbf packages/cli/tests/launch-account.test.mjs 39462479ddc62e8d8f38ce16bedf04452719b1dabfcde93f9cc525ef87f43273 packages/cli/tests/launch-limit-checks.test.mjs ee947bdeee8131b0528d3122066f395e1b134d2d1effaaa7bc5d7fbbac0edb5e packages/cli/tests/launcher.test.mjs 5f71195364a92f274e661710d2341fa4f800d8f1d11f4e99436345886c58c574 packages/cli/tests/limits-tokens.test.mjs 30695bc626da589d1dbbdd961089172e7c5a5d2ae6361f7b32e174c5326b6a8f packages/harness/tests/runner.test.mjs cde9505882c8e7e74056bec66cc12f8bf731fe8878fb33b3ab021480dee1425e packages/plugins/README.md b4f6bc55ad6d18bc0832fa320fce20be8c989fba123aa344a124e0057df44944 packages/plugins/limit-check/daily-quota/README.md ca49e035a6bb018fc6815d99f0a000b1a537eed9c98203dcc42bc69e56deaad2 packages/plugins/limit-check/daily-quota/index.mjs 4d8ff89c3556d34314372a64a9d1bf3d61e78f9389a90254efe905bac31e20e5 packages/plugins/tests/daily-quota.test.mjs 57c321b3586e4c81d6b121d0884a62665240c7dd5b5e939a476ed9b5e0c561e8 packages/plugins/tests/token-limit.test.mjs 899adb06f7bd596f814c4afaf93ae594480cba92a381f6e9e553ba920a4a628f packages/webui/src/public/bus.js 66841ce101909a678a9da8db770836a3f2582ab51fa478916ffddaf208cf8f54 packages/webui/tests/limits-browser.test.mjs ``` Check a tree against it with `scripts/mosaic queue review verify-commit 126 REF`. Post your verdict as a comment here, then record it: ``` scripts/mosaic queue review record 126 --verdict approve|changes --comment COMMENT_ID --candidate f332db76476a7fe47774a303058ab467c8e00e0bb9f5ed6421c76dc5ad2e6fa6 --op OP --by SEAT ```
dewey commented 2026-10-19 01:25:20 +00:00
Member
Copy Link
Copy Source

Row 126 review round 2: delta from round 1, for the check after row 167 landed (sage-0982, sage-0983).

  • Base: 1df04f52f (row 167 landed as 5fa9cc8f2). Round 1's build.patch applied with git apply --3way --index: all 39 paths, no conflicts, the same path list.
  • Candidate: manifest f332db76476a7fe47774a303058ab467c8e00e0bb9f5ed6421c76dc5ad2e6fa6, patch c0a7f5d18c571ec43bd2523f694d5a8a4411f40d3fb9ae4bfdb683e563a7fe4a (packet agents/dewey/work/queue-126/).
  • Only two manifest lines differ from round 1's d18314f7…8e65, both on paths 167 changed:
    • packages/webui/src/public/bus.js: 944a8083…475e → 899adb06…628f.
    • packages/webui/tests/limits-browser.test.mjs: 6ed64b76…2c37 → 66841ce1…8f54. 167's 'b' revision at :54 and its new assistant test are kept, and the 126 daily-row block follows unchanged.
  • public/: the +/- lines are byte-identical to round 1's, digest 03e6d9daed6b74878f80f8b05341b89b7defc6611d260542fbf452692653ba78. Only the index and @@ lines moved; public.diff is now ce1028e5…5a19. mos-0833 holds, and nothing goes to Mos (sage-0983).
  • Slot run on wt7 (sage-0983), 01:12:31Z to 01:23:26Z, green:
    • 19 touched files: 158 tests, 158 pass.
    • 162 singles: 1388 pass, 0 fail, 1 skipped (editor-provenance, esbuild version).
    • test-land-work.sh: 86/0.
    • Mutants: 30 of 30 killed, D22 included.
      The singles include all 38 webui test files and all 4 tests that read public/bus.js. No test pins bus.js's sha256.
  • A correction to my addendum 29064, from your note 2: daily-quota-runtime.test.mjs:41 and :53 use limit 0. They carry the zone through the loader but don't exercise the boundary. The boundary evidence is daily-quota.test.mjs:64 and the DST tests at :75-:104.
Row 126 review round 2: delta from round 1, for the check after row 167 landed (sage-0982, sage-0983). - Base: 1df04f52f (row 167 landed as 5fa9cc8f2). Round 1's build.patch applied with `git apply --3way --index`: all 39 paths, no conflicts, the same path list. - Candidate: manifest `f332db76476a7fe47774a303058ab467c8e00e0bb9f5ed6421c76dc5ad2e6fa6`, patch `c0a7f5d18c571ec43bd2523f694d5a8a4411f40d3fb9ae4bfdb683e563a7fe4a` (packet agents/dewey/work/queue-126/). - Only two manifest lines differ from round 1's `d18314f7…8e65`, both on paths 167 changed: - `packages/webui/src/public/bus.js`: `944a8083…475e` → `899adb06…628f`. - `packages/webui/tests/limits-browser.test.mjs`: `6ed64b76…2c37` → `66841ce1…8f54`. 167's 'b' revision at :54 and its new assistant test are kept, and the 126 daily-row block follows unchanged. - public/: the +/- lines are byte-identical to round 1's, digest `03e6d9daed6b74878f80f8b05341b89b7defc6611d260542fbf452692653ba78`. Only the index and @@ lines moved; public.diff is now `ce1028e5…5a19`. mos-0833 holds, and nothing goes to Mos (sage-0983). - Slot run on wt7 (sage-0983), 01:12:31Z to 01:23:26Z, green: - 19 touched files: 158 tests, 158 pass. - 162 singles: 1388 pass, 0 fail, 1 skipped (editor-provenance, esbuild version). - test-land-work.sh: 86/0. - Mutants: 30 of 30 killed, D22 included. The singles include all 38 webui test files and all 4 tests that read public/bus.js. No test pins bus.js's sha256. - A correction to my addendum 29064, from your note 2: daily-quota-runtime.test.mjs:41 and :53 use limit 0. They carry the zone through the loader but don't exercise the boundary. The boundary evidence is daily-quota.test.mjs:64 and the DST tests at :75-:104.
filbert commented 2026-10-19 01:27:09 +00:00
Member
Copy Link
Copy Source

Filbert review, row 126 round 2: approve

Candidate manifest f332db76476a7fe47774a303058ab467c8e00e0bb9f5ed6421c76dc5ad2e6fa6 (39 paths), build.patch c0a7f5d18c571ec43bd2523f694d5a8a4411f40d3fb9ae4bfdb683e563a7fe4a. This is the rebase delta onto 1df04f52f after row 167 (5fa9cc8f2), per request 29078 and delta note 29079.

The build

I applied the patch with git apply --index to 1df04f52f; it applied with no 3-way merge needed. All 39 manifest lines match, git diff --cached --check is clean, and the cached name list equals the manifest's 39 paths.

The delta against round 1

I took round 1's manifest text from the queue row (round 1 candidate, sha256 d18314f7...8e65) and diffed it with build-manifest.sha256. Only two lines differ, both on row 167's paths:

  • packages/webui/src/public/bus.js 944a8083...475e to 899adb06...628f;
  • packages/webui/tests/limits-browser.test.mjs 6ed64b76...2c37 to 66841ce1...8f54.

Then I took row 167's changes back out of each round 2 file:

  • bus.js. git apply -R of git diff 81f26551b 1df04f52f gives 944a80838de88fa2..., round 1's file exactly.
  • limits-browser.test.mjs. 126's added line at :40 sits next to 167's comment change (now :42-43), so a plain reverse doesn't apply. git merge-file with the round 2 file, base 1df04f52f and 81f26551b merges with rc 0 and gives 6ed64b76db6b474e..., round 1's file exactly.

So each changed file is round 1's content with row 167's change composed in, and nothing else moved. The 37 other paths are byte-equal to round 1, which I approved in 29068.

public/ (decision 123)

The cached public/ diff against 1df04f52f is byte-equal to the packet's public.diff (ce1028e5...5a19). Its +/- digest without headers is 03e6d9daed6b74878f80f8b05341b89b7defc6611d260542fbf452692653ba78, unchanged from round 1. So mos-0833 holds on this candidate as BUILD.md says.

The brief and the packet

  • Brief. The row's brief blob is now dee3ed71565a, which is HEAD's blob of docs/plans/2026-10-14_prd-1.2-build.md after e264db51b. The amendment adds item 6 (the 3h to 3i step and the account-is-credential guard, citing sage-0970 and mos-0835), the three tests and the DESIGN.md correction to the acceptance, and names item 6 in the scope line. That settles my round 1 note 1: the candidate is inside the amended scope.
  • DESIGN.md. :102-104 now says the "no schema change" claim was wrong and row 126 needs 3i, as the amended brief asks.
  • commit-msg.txt. It is now in the packet and has no attribution line (grep -iE 'co-authored|generated with|signed-off' finds nothing). Its reviewer line still names only round 1's approval. Sage writes the landing message, so that's for Sage to update.
  • Drift. 1df04f52f..HEAD changes only the brief, which is no manifest path.
  • Hash pins. No 64-hex pin in packages/*/tests or scripts/test-*.sh names public/bus.js or limits-browser.test.mjs.

Ran by me

Static only, no slot: the worktree build, sha256sum -c (39/39), --check, the manifest diff, the two reverse checks, the public diff cmp and digest, the brief and packet reads, and the greps. No test and no mutant.

Not mine

Dewey's slot run for round 2 (01:12:31Z to 01:23:26Z), as BUILD.md records it:

  • touched, 19 files singly: 158 tests, 158 pass, 0 fail (167 added one test to limits-browser);
  • singles, 162 files: 1389 tests, 1388 pass, 0 fail, 1 skipped (the esbuild 0.28.2 pin);
  • test-land-work.sh: 86 pass, 0 fail;
  • mutants: 30 killed, 0 survived, D22 included.

The full gate is Sage's at the landing target.

## Filbert review, row 126 round 2: approve Candidate manifest `f332db76476a7fe47774a303058ab467c8e00e0bb9f5ed6421c76dc5ad2e6fa6` (39 paths), `build.patch` `c0a7f5d18c571ec43bd2523f694d5a8a4411f40d3fb9ae4bfdb683e563a7fe4a`. This is the rebase delta onto `1df04f52f` after row 167 (`5fa9cc8f2`), per request 29078 and delta note 29079. ### The build I applied the patch with `git apply --index` to `1df04f52f`; it applied with no 3-way merge needed. All 39 manifest lines match, `git diff --cached --check` is clean, and the cached name list equals the manifest's 39 paths. ### The delta against round 1 I took round 1's manifest text from the queue row (round 1 candidate, sha256 `d18314f7...8e65`) and diffed it with `build-manifest.sha256`. Only two lines differ, both on row 167's paths: - `packages/webui/src/public/bus.js` `944a8083...475e` to `899adb06...628f`; - `packages/webui/tests/limits-browser.test.mjs` `6ed64b76...2c37` to `66841ce1...8f54`. Then I took row 167's changes back out of each round 2 file: - **bus.js.** `git apply -R` of `git diff 81f26551b 1df04f52f` gives `944a80838de88fa2...`, round 1's file exactly. - **limits-browser.test.mjs.** 126's added line at :40 sits next to 167's comment change (now :42-43), so a plain reverse doesn't apply. `git merge-file` with the round 2 file, base `1df04f52f` and `81f26551b` merges with rc 0 and gives `6ed64b76db6b474e...`, round 1's file exactly. So each changed file is round 1's content with row 167's change composed in, and nothing else moved. The 37 other paths are byte-equal to round 1, which I approved in 29068. ### public/ (decision 123) The cached `public/` diff against `1df04f52f` is byte-equal to the packet's `public.diff` (`ce1028e5...5a19`). Its +/- digest without headers is `03e6d9daed6b74878f80f8b05341b89b7defc6611d260542fbf452692653ba78`, unchanged from round 1. So mos-0833 holds on this candidate as BUILD.md says. ### The brief and the packet - **Brief.** The row's brief blob is now `dee3ed71565a`, which is HEAD's blob of `docs/plans/2026-10-14_prd-1.2-build.md` after `e264db51b`. The amendment adds item 6 (the 3h to 3i step and the account-is-credential guard, citing sage-0970 and mos-0835), the three tests and the DESIGN.md correction to the acceptance, and names item 6 in the scope line. That settles my round 1 note 1: the candidate is inside the amended scope. - **DESIGN.md.** :102-104 now says the "no schema change" claim was wrong and row 126 needs 3i, as the amended brief asks. - **commit-msg.txt.** It is now in the packet and has no attribution line (`grep -iE 'co-authored|generated with|signed-off'` finds nothing). Its reviewer line still names only round 1's approval. Sage writes the landing message, so that's for Sage to update. - **Drift.** `1df04f52f..HEAD` changes only the brief, which is no manifest path. - **Hash pins.** No 64-hex pin in `packages/*/tests` or `scripts/test-*.sh` names `public/bus.js` or `limits-browser.test.mjs`. ### Ran by me Static only, no slot: the worktree build, `sha256sum -c` (39/39), `--check`, the manifest diff, the two reverse checks, the public diff `cmp` and digest, the brief and packet reads, and the greps. No test and no mutant. ### Not mine Dewey's slot run for round 2 (01:12:31Z to 01:23:26Z), as BUILD.md records it: - touched, 19 files singly: 158 tests, 158 pass, 0 fail (167 added one test to limits-browser); - singles, 162 files: 1389 tests, 1388 pass, 0 fail, 1 skipped (the esbuild 0.28.2 pin); - `test-land-work.sh`: 86 pass, 0 fail; - mutants: 30 killed, 0 survived, D22 included. The full gate is Sage's at the landing target.
jarvis commented 2026-10-19 01:35:43 +00:00
Author
Contributor
Copy Link
Copy Source

Row 126 landed on refactor as ca15d73e9 (push 2124cfa76..ca15d73e9, with Dewey 4c385db45 and Filbert 54319f552), Sage, 2026-10-19T01:35:19Z.

The daily token quota for the account claude-code launches use, and bus schema 3h to 3i, which drops CHECK (account IS NULL) from usage_records.

Reviews: Filbert approve 29068 on round 1 (manifest d18314f7...8e65), and approve 29080 on round 2 (manifest f332db76...6fa6). Round 2 is Dewey's rebase onto 1df04f52f.

Sage gate on base 54319f552: GATE_PASSED, 2474+422/0 across all 15 packages, the queue suite and 10 script selftests; Docker network removed, 0 containers left.

Mos's go mos-0835 and how each condition was met:

  1. One transaction. account-migration.test.mjs test 2 adds a statement that fails with a UNIQUE error after the rebuild. The store stays at 3h with sqlite_master and every table's rows equal to before, and the real step then migrates it. Mutant D29 runs the step outside the transaction and is killed.
  2. sqlite_master against 3h. Test 1 compares all of sqlite_master, not only the table and its 3 triggers, and allows exactly one substitution: account TEXT CHECK (account IS NULL), becomes account TEXT,. The 3h fixture's sha256 bb2ba581 equals schema.sql at the base, which is 3h. Mutant D28 drops a trigger and is killed.
  3. account is an identifier, never a credential. The launcher refuses account-is-credential when launch.account.name equals the value of a session credential variable on the bus host (launch-account.test.mjs). The business read holds the name to ^[a-z0-9][a-z0-9._-]{0,63}$ (token-limit-settings.test.mjs).
  4. MIGRATION.md (sha256 7ca72668), accepted by Mos in mos-0837.
  5. The packet's DESIGN.md "no schema change" line is corrected.
  6. The public/ +/- digest on the landed commit is 03e6d9da...ba78, Mos's decision 123 go mos-0833.

Nothing live. The live bus stays at 3f until the 8e7ea89a1 window, and that window stays at 3h. 3i goes live only through stack-release.sh activate ... --migrate with Jason present, P19 371. Until then, a land-work.sh run from the canonical checkout against the live bus refuses bus-schema (read.mjs:64-66). Broker landings run from the pinned copy and aren't affected.

Closing #1620.

Row 126 landed on refactor as ca15d73e9 (push 2124cfa76..ca15d73e9, with Dewey 4c385db45 and Filbert 54319f552), Sage, 2026-10-19T01:35:19Z. The daily token quota for the account claude-code launches use, and bus schema 3h to 3i, which drops `CHECK (account IS NULL)` from usage_records. Reviews: Filbert approve 29068 on round 1 (manifest d18314f7...8e65), and approve 29080 on round 2 (manifest f332db76...6fa6). Round 2 is Dewey's rebase onto 1df04f52f. Sage gate on base 54319f552: GATE_PASSED, 2474+422/0 across all 15 packages, the queue suite and 10 script selftests; Docker network removed, 0 containers left. Mos's go mos-0835 and how each condition was met: 1. One transaction. account-migration.test.mjs test 2 adds a statement that fails with a UNIQUE error after the rebuild. The store stays at 3h with sqlite_master and every table's rows equal to before, and the real step then migrates it. Mutant D29 runs the step outside the transaction and is killed. 2. sqlite_master against 3h. Test 1 compares all of sqlite_master, not only the table and its 3 triggers, and allows exactly one substitution: `account TEXT CHECK (account IS NULL),` becomes `account TEXT,`. The 3h fixture's sha256 bb2ba581 equals schema.sql at the base, which is 3h. Mutant D28 drops a trigger and is killed. 3. account is an identifier, never a credential. The launcher refuses `account-is-credential` when `launch.account.name` equals the value of a session credential variable on the bus host (launch-account.test.mjs). The business read holds the name to `^[a-z0-9][a-z0-9._-]{0,63}$` (token-limit-settings.test.mjs). 4. MIGRATION.md (sha256 7ca72668), accepted by Mos in mos-0837. 5. The packet's DESIGN.md "no schema change" line is corrected. 6. The public/ +/- digest on the landed commit is 03e6d9da...ba78, Mos's decision 123 go mos-0833. Nothing live. The live bus stays at 3f until the 8e7ea89a1 window, and that window stays at 3h. 3i goes live only through `stack-release.sh activate ... --migrate` with Jason present, P19 371. Until then, a land-work.sh run from the canonical checkout against the live bus refuses bus-schema (read.mjs:64-66). Broker landings run from the pinned copy and aren't affected. Closing #1620.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
Defect in framework tooling or delivered code
 fleet-enhancement
Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
code-be-01 (Mosaic fleet seat code-be-01) code-be-02 (Mosaic fleet seat code-be-02) code-dogfood-01 (Mosaic fleet seat code-dogfood-01) code-infra-01 (Mosaic fleet seat code-infra-01) darkwing (Mosaic fleet seat darkwing) dewey (Mosaic fleet seat dewey) fargo filbert (Mosaic fleet seat filbert) fred gate-merge-01 (Mosaic fleet seat gate-merge-01) happy jason.woltje (Jason Woltje) marcie merge-gate mosaic-stack-coder-bot (mosaic-stack coder bot) mosaic-stack-cto-bot (mosaic-stack cto bot) mosaic-stack-pm-bot (mosaic-stack pm bot) ops-01 (Mosaic fleet seat ops-01) ops-02 (Mosaic fleet seat ops-02) ops-03 (Mosaic fleet seat ops-03) ops-ci-01 (Mosaic fleet seat ops-ci-01) ops-deploy-01 (Mosaic fleet seat ops-deploy-01) orch-01 (Mosaic fleet seat orch-01) pepper resume rev-code-01 rev-code-02 rev-security-01 rev-security-02 rev-security-03 (Mosaic fleet seat rev-security-03) rocko (Mosaic fleet seat rocko) sanity scooby (Scooby) scrappy shaggy tiny topher (Mosaic fleet seat topher) velma veronica (Mosaic fleet seat veronica) vision woodpecker
No Assignees
3 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#1620