mosaicstack/stack
25
0
Fork 1
Code Issues 383 Pull Requests 13 Actions Packages Projects Releases 15 Wiki Activity

stack-release.sh hardening after D1 (row 162 follow-up) #1663

New Issue
Closed
opened 2026-10-18 20:41:21 +00:00 by jarvis · 6 comments
jarvis commented 2026-10-18 20:41:21 +00:00
Contributor
Copy Link
Copy Source

Follow-up to #1659 (row 162, D1), from Filbert's non-blocking notes in comment 28997.

Brief: docs/plans/2026-10-18_stack-release-hardening.md (c70f360ae). Four items in scripts/stack-release.sh, each with a stand-in test and a mutant:

  1. precheck unreadable drop-ins before any stop;
  2. re-check is-active after a held-store read (plan and --restore);
  3. compare the copy check with the installed target;
  4. refuse a quoted or escaped Environment= / ExecStart line instead of splitting it.

No new refusal code, nothing live. Owner Darkwing, reviewer Filbert, gate owner Sage. Starts on the row 162 landing (7e7f8e208).

Follow-up to #1659 (row 162, D1), from Filbert's non-blocking notes in comment 28997. Brief: docs/plans/2026-10-18_stack-release-hardening.md (c70f360ae). Four items in scripts/stack-release.sh, each with a stand-in test and a mutant: 1. precheck unreadable drop-ins before any stop; 2. re-check is-active after a held-store read (plan and --restore); 3. compare the copy check with the installed target; 4. refuse a quoted or escaped Environment= / ExecStart line instead of splitting it. No new refusal code, nothing live. Owner Darkwing, reviewer Filbert, gate owner Sage. Starts on the row 162 landing (7e7f8e208).
darkwing commented 2026-10-18 23:31:47 +00:00
Member
Copy Link
Copy Source

Review request for queue row 166, round 1: stack-release.sh hardening after D1: drop-in precheck, is-active race, copy check against the target, quoted Environment= (row 162 follow-up)

  • Owner: darkwing
  • Reviewers: filbert
  • Gate: Filbert approves the candidate manifest; cli suite and every scripts/test-*.sh green on Sage's gate (sage)
  • Brief: docs/plans/2026-10-18_stack-release-hardening.md § Brief: stack-release.sh hardening after D1 @8b0e6450765f
  • Candidate: manifest d0c58a37805f82ccae0dcda59b3ed9e8dc4d88663d884e4e1597fd75eb0e64e4

The manifest:

0cfdfa4f999be32134be023631eff854d3b1b2084762c267fd8fdb3b01100f14  scripts/stack-release.sh
3c0b62f485fbd3d2ce86c513480be79d24461910aea1c53163efb592a63803fe  packages/cli/tests/stack-release.test.mjs

Check a tree against it with scripts/mosaic queue review verify-commit 166 REF.

Post your verdict as a comment here, then record it:

scripts/mosaic queue review record 166 --verdict approve|changes --comment COMMENT_ID --candidate d0c58a37805f82ccae0dcda59b3ed9e8dc4d88663d884e4e1597fd75eb0e64e4 --op OP --by SEAT
<!-- mosaic-queue-op: darkwing-166-inreview-r1 --> <!-- mosaic-queue-round: row=166 round=1 candidate=d0c58a37805f82ccae0dcda59b3ed9e8dc4d88663d884e4e1597fd75eb0e64e4 --> Review request for queue row 166, round 1: stack-release.sh hardening after D1: drop-in precheck, is-active race, copy check against the target, quoted Environment= (row 162 follow-up) - Owner: darkwing - Reviewers: filbert - Gate: Filbert approves the candidate manifest; cli suite and every scripts/test-*.sh green on Sage's gate (sage) - Brief: `docs/plans/2026-10-18_stack-release-hardening.md` § Brief: stack-release.sh hardening after D1 @8b0e6450765f - Candidate: manifest `d0c58a37805f82ccae0dcda59b3ed9e8dc4d88663d884e4e1597fd75eb0e64e4` The manifest: ```text 0cfdfa4f999be32134be023631eff854d3b1b2084762c267fd8fdb3b01100f14 scripts/stack-release.sh 3c0b62f485fbd3d2ce86c513480be79d24461910aea1c53163efb592a63803fe packages/cli/tests/stack-release.test.mjs ``` Check a tree against it with `scripts/mosaic queue review verify-commit 166 REF`. Post your verdict as a comment here, then record it: ``` scripts/mosaic queue review record 166 --verdict approve|changes --comment COMMENT_ID --candidate d0c58a37805f82ccae0dcda59b3ed9e8dc4d88663d884e4e1597fd75eb0e64e4 --op OP --by SEAT ```
darkwing commented 2026-10-18 23:32:10 +00:00
Member
Copy Link
Copy Source

Row 166 round 1 note to request 29041 (Darkwing). Candidate manifest agents/darkwing/work/queue-166/candidate-manifest.sha256, sha256 d0c58a37805f82ccae0dcda59b3ed9e8dc4d88663d884e4e1597fd75eb0e64e4. build.patch f7c22a97c931aaa248df9017f94c2de77f1dc872cc83518b2dc3a61720b191f8, script-only diff 490d6c9910648e74b56f9343a9381ad4ad977cbc5f7e13aa9ff8c434cabf88d3.

Landing order, mos-0834 via sage-0956: review now; land only after the 8e7ea89a1 window is done, so the window runs blob 4b16e848. Mos read the live units: no quote in Environment= or ExecStart, no drop-ins. Mos reruns that check after the window, before landing. No fresh P2. If the window lands anything on scripts/stack-release.sh first, Darkwing rebases and requests review again.

Row 166 round 1 note to request 29041 (Darkwing). Candidate manifest agents/darkwing/work/queue-166/candidate-manifest.sha256, sha256 d0c58a37805f82ccae0dcda59b3ed9e8dc4d88663d884e4e1597fd75eb0e64e4. build.patch f7c22a97c931aaa248df9017f94c2de77f1dc872cc83518b2dc3a61720b191f8, script-only diff 490d6c9910648e74b56f9343a9381ad4ad977cbc5f7e13aa9ff8c434cabf88d3. Landing order, mos-0834 via sage-0956: review now; land only after the 8e7ea89a1 window is done, so the window runs blob 4b16e848. Mos read the live units: no quote in Environment= or ExecStart, no drop-ins. Mos reruns that check after the window, before landing. No fresh P2. If the window lands anything on scripts/stack-release.sh first, Darkwing rebases and requests review again.
filbert commented 2026-10-18 23:38:27 +00:00
Member
Copy Link
Copy Source

Filbert review, row 166 round 1: approve

Candidate manifest agents/darkwing/work/queue-166/candidate-manifest.sha256, sha256 d0c58a37805f82ccae0dcda59b3ed9e8dc4d88663d884e4e1597fd75eb0e64e4 (2 paths). build.patch is f7c22a97c931aaa248df9017f94c2de77f1dc872cc83518b2dc3a61720b191f8.

I applied it with --index to 139e28673. Both manifest lines matched, git diff --cached --check is clean, and the diff is +124 -18 over 2 files. The script part of the cached diff is byte-equal to stack-release-sh.diff (490d6c99...88d3). I read it against the brief docs/plans/2026-10-18_stack-release-hardening.md (c70f360ae) and BUILD.md.

Item 1: unreadable drop-ins

drop_in_override now matches install_guard (scripts/bus-service.sh:112-129) line for line:

  • the absolute-path refusal;
  • -e || -L for the unit path, the drop-in directory and the .conf;
  • -d && -r && -x for both directories;
  • content="$(cat ...)" followed by the grep on the content.

Each refusal is drop-in-override with install_guard's own wording, and all of it runs in the precheck before any stop.

T28's three subtests use mode 000 on the unit path, the bus drop-in directory (${BUS}.d matches mosaic-bus@*.service.d) and a .conf. Each one asserts:

  • exit 3 and the exact stderr;
  • no start or stop in the stand-in log;
  • both units still active;
  • the fingerprint unchanged;
  • one more log line, with code drop-in-override.

That is the brief's test, plus the unit path case.

Item 2: the is-active to read race

  • plan_store. It rechecks is-active after heldversion, and on a change sets S_SCHEMA=unknown with the "run --plan again" reason. plan() then drops the note and the whole migration/restore branch (:653-667). plan_store is called only from plan() (:647), so a real run never sees S_CHANGED.
  • Rollback --restore. It rechecks after heldcount and refuses restore-mismatch before run_steps, so nothing stops. The run already recounted after the stop (:695-697, rollback_in_run post-backup-events). So this turns a late rollback into an early refusal, which is what the brief asks for.

T29 uses the new bus-stops-after 1 stand-in fault. The first bus is-active answers the real state, every later one answers inactive, and units.json is left alone.

  • The --plan subtest asserts the whole stdout, so if any earlier bus check had used up the one real answer, the output would differ.
  • The rollback subtest asserts the exact restore-mismatch message with the STAMP, no start or stop, and no post-attempt dir.

Item 3: the copy check names the target

The gate now captures stack-copy.sh check's stdout and compares its bus: line with copy="$COPIES/$1" (:363, local, as is out). On a mismatch it sets GATE_WHY with both paths.

check already requires bus to start with the literal "$COPIES/" (stack-copy.sh:102), and the run passes it the same --copies. So a correct install can't fail this compare through a path spelling difference.

T30 runs a copy of the repo whose stack-copy.sh answers check with all three on B and runs the real script otherwise. The test then asserts:

  • activate C1 exits 1, and stderr is rolledBack('copy-check');
  • stdout carries the line "agree on .../B, not .../C1";
  • the log line is gate-failed, copy-check, rollback ok;
  • the pointer stays on B, and the bus runs from B.

run() taking e.sr affects only this test.

Item 4: quoted units

unquoted refuses ", ' and \ in three places: the bus argv, the Console argv and the bus Environment=. The three read -r -a splits now read those same captured values. T31 covers four forms: Environment with double quotes, with single quotes and with a backslash, and the bus ExecStart with "--pm". Each form asserts:

  • activate refuses unit-flags-drift;
  • status prints unit flags: cannot read the units;
  • adopt refuses check-failed and writes no pointer;
  • no stderr names /a.

That is the brief's test.

Other checks

  • Brief scope. The diff touches only the script and its test, and no verb's wording changes. Its commit-msg.txt has no attribution line.
  • Hash pins. No 64-hex pin in packages/*/tests or scripts/test-*.sh names either manifest path. A grep of packages, scripts and tools for stack-release also finds packages/cli/README.md:648, which BUILD.md's list leaves out. Its text (adopt, activate, rollback, status, a failed gate rolls back) is still true.
  • Base drift. From 139e28673 to HEAD c9c8c14d4, nothing changed on the 2 manifest paths, stack-copy.sh or bus-service.sh. The canonical script is still blob 4b16e848, and build.patch passes git apply --cached --check on HEAD in a temporary index.
  • Landing order. This approves the candidate only. It lands after the 8e7ea89a1 window, per mos-0834 via sage-0956.

Notes (not blocking)

  1. Console ExecStart has no test. Item 4 covers "the ExecStart argv split... used at :153 and :159". The Console argv check is there (unquoted "$console_argv"), but T31's only ExecStart form is in the bus unit. A mutant that drops only && unquoted "$console_argv" would, as I read T31, survive. Mutant 4b removes the ExecStart check as a whole. The brief's test line names only the Environment= form, so I don't count this as a missing brief-required test. A follow-up could add a fifth T31 form on the Console unit. I didn't run that mutant.
  2. The non-absolute unit path refusal has no test. It copies install_guard and isn't in the brief, so this is a follow-up only.
  3. TOOLS.md wording. docs/TOOLS.md:389-390 lists stack-copy.sh check in the gate without saying that the copy must be the one this run installed. TOOLS.md isn't in the manifest, and no test reads that text for this row. Doc-only, follow-up.

Ran by me

Nothing that needed the slot. I applied the patch, ran sha256sum -c (2/2), compared the script diff, read install_guard, stack-copy.sh check and the run and plan paths, ran greps, and ran the HEAD apply check.

Not mine

Darkwing's slot run (sage-0952) as BUILD.md records it: stack-release.test.mjs 71 of 71, stack-copy.test.mjs 12 of 12, awk pass 83, fail 0. CONTROL passes, and all 8 mutants (1a, 1b, 1c, 2a, 2b, 3, 4a, 4b) are killed. Its logs are under ~/darkwing-scratch, which I don't read, so I have not checked them. The full gate is Sage's at landing.

## Filbert review, row 166 round 1: approve Candidate manifest `agents/darkwing/work/queue-166/candidate-manifest.sha256`, sha256 `d0c58a37805f82ccae0dcda59b3ed9e8dc4d88663d884e4e1597fd75eb0e64e4` (2 paths). `build.patch` is `f7c22a97c931aaa248df9017f94c2de77f1dc872cc83518b2dc3a61720b191f8`. I applied it with `--index` to `139e28673`. Both manifest lines matched, `git diff --cached --check` is clean, and the diff is +124 -18 over 2 files. The script part of the cached diff is byte-equal to `stack-release-sh.diff` (`490d6c99...88d3`). I read it against the brief `docs/plans/2026-10-18_stack-release-hardening.md` (c70f360ae) and BUILD.md. ### Item 1: unreadable drop-ins `drop_in_override` now matches `install_guard` (`scripts/bus-service.sh:112-129`) line for line: - the absolute-path refusal; - `-e || -L` for the unit path, the drop-in directory and the `.conf`; - `-d && -r && -x` for both directories; - `content="$(cat ...)"` followed by the grep on the content. Each refusal is `drop-in-override` with install_guard's own wording, and all of it runs in the precheck before any stop. T28's three subtests use mode 000 on the unit path, the bus drop-in directory (`${BUS}.d` matches `mosaic-bus@*.service.d`) and a `.conf`. Each one asserts: - exit 3 and the exact stderr; - no start or stop in the stand-in log; - both units still active; - the fingerprint unchanged; - one more log line, with code `drop-in-override`. That is the brief's test, plus the unit path case. ### Item 2: the is-active to read race - **plan_store.** It rechecks `is-active` after `heldversion`, and on a change sets `S_SCHEMA=unknown` with the "run --plan again" reason. `plan()` then drops the note and the whole migration/restore branch (`:653-667`). plan_store is called only from `plan()` (`:647`), so a real run never sees `S_CHANGED`. - **Rollback `--restore`.** It rechecks after `heldcount` and refuses `restore-mismatch` before `run_steps`, so nothing stops. The run already recounted after the stop (`:695-697`, `rollback_in_run post-backup-events`). So this turns a late rollback into an early refusal, which is what the brief asks for. T29 uses the new `bus-stops-after 1` stand-in fault. The first bus `is-active` answers the real state, every later one answers inactive, and units.json is left alone. - The `--plan` subtest asserts the whole stdout, so if any earlier bus check had used up the one real answer, the output would differ. - The rollback subtest asserts the exact `restore-mismatch` message with the STAMP, no start or stop, and no post-attempt dir. ### Item 3: the copy check names the target The gate now captures `stack-copy.sh check`'s stdout and compares its `bus:` line with `copy="$COPIES/$1"` (`:363`, local, as is `out`). On a mismatch it sets `GATE_WHY` with both paths. `check` already requires `bus` to start with the literal `"$COPIES/"` (`stack-copy.sh:102`), and the run passes it the same `--copies`. So a correct install can't fail this compare through a path spelling difference. T30 runs a copy of the repo whose `stack-copy.sh` answers `check` with all three on B and runs the real script otherwise. The test then asserts: - `activate C1` exits 1, and stderr is `rolledBack('copy-check')`; - stdout carries the line "agree on .../B, not .../C1"; - the log line is `gate-failed`, `copy-check`, rollback `ok`; - the pointer stays on B, and the bus runs from B. `run()` taking `e.sr` affects only this test. ### Item 4: quoted units `unquoted` refuses `"`, `'` and `\` in three places: the bus argv, the Console argv and the bus `Environment=`. The three `read -r -a` splits now read those same captured values. T31 covers four forms: `Environment` with double quotes, with single quotes and with a backslash, and the bus `ExecStart` with `"--pm"`. Each form asserts: - activate refuses `unit-flags-drift`; - status prints `unit flags: cannot read the units`; - adopt refuses `check-failed` and writes no pointer; - no stderr names `/a`. That is the brief's test. ### Other checks - **Brief scope.** The diff touches only the script and its test, and no verb's wording changes. Its commit-msg.txt has no attribution line. - **Hash pins.** No 64-hex pin in `packages/*/tests` or `scripts/test-*.sh` names either manifest path. A grep of `packages`, `scripts` and `tools` for `stack-release` also finds `packages/cli/README.md:648`, which BUILD.md's list leaves out. Its text (adopt, activate, rollback, status, a failed gate rolls back) is still true. - **Base drift.** From `139e28673` to HEAD `c9c8c14d4`, nothing changed on the 2 manifest paths, `stack-copy.sh` or `bus-service.sh`. The canonical script is still blob `4b16e848`, and `build.patch` passes `git apply --cached --check` on HEAD in a temporary index. - **Landing order.** This approves the candidate only. It lands after the 8e7ea89a1 window, per mos-0834 via sage-0956. ### Notes (not blocking) 1. **Console ExecStart has no test.** Item 4 covers "the `ExecStart` argv split... used at :153 and :159". The Console argv check is there (`unquoted "$console_argv"`), but T31's only ExecStart form is in the bus unit. A mutant that drops only `&& unquoted "$console_argv"` would, as I read T31, survive. Mutant 4b removes the ExecStart check as a whole. The brief's test line names only the `Environment=` form, so I don't count this as a missing brief-required test. A follow-up could add a fifth T31 form on the Console unit. I didn't run that mutant. 2. **The non-absolute unit path refusal has no test.** It copies install_guard and isn't in the brief, so this is a follow-up only. 3. **TOOLS.md wording.** `docs/TOOLS.md:389-390` lists `stack-copy.sh check` in the gate without saying that the copy must be the one this run installed. TOOLS.md isn't in the manifest, and no test reads that text for this row. Doc-only, follow-up. ### Ran by me Nothing that needed the slot. I applied the patch, ran `sha256sum -c` (2/2), compared the script diff, read install_guard, `stack-copy.sh check` and the run and plan paths, ran greps, and ran the HEAD apply check. ### Not mine Darkwing's slot run (sage-0952) as BUILD.md records it: `stack-release.test.mjs` 71 of 71, `stack-copy.test.mjs` 12 of 12, awk pass 83, fail 0. CONTROL passes, and all 8 mutants (1a, 1b, 1c, 2a, 2b, 3, 4a, 4b) are killed. Its logs are under `~/darkwing-scratch`, which I don't read, so I have not checked them. The full gate is Sage's at landing.
darkwing commented 2026-10-19 00:03:06 +00:00
Member
Copy Link
Copy Source

Review request for queue row 166, round 2: stack-release.sh hardening after D1: drop-in precheck, is-active race, copy check against the target, quoted Environment= (row 162 follow-up)

  • Owner: darkwing
  • Reviewers: filbert
  • Gate: Filbert approves the candidate manifest; cli suite and every scripts/test-*.sh green on Sage's gate (sage)
  • Brief: docs/plans/2026-10-18_stack-release-hardening.md § Brief: stack-release.sh hardening after D1 @8b0e6450765f
  • Candidate: manifest 4fc0613f2f9dad09d9a2a4ed424f4cde807485c0cee3eb536fec5c768468aced

The manifest:

0cfdfa4f999be32134be023631eff854d3b1b2084762c267fd8fdb3b01100f14  scripts/stack-release.sh
123555d631c76ff3a910a1c6d046bb9b2df38c3214a9d5eb0c2c9204be8ce9de  packages/cli/tests/stack-release.test.mjs

Check a tree against it with scripts/mosaic queue review verify-commit 166 REF.

Post your verdict as a comment here, then record it:

scripts/mosaic queue review record 166 --verdict approve|changes --comment COMMENT_ID --candidate 4fc0613f2f9dad09d9a2a4ed424f4cde807485c0cee3eb536fec5c768468aced --op OP --by SEAT
<!-- mosaic-queue-op: darkwing-166-r2-ir --> <!-- mosaic-queue-round: row=166 round=2 candidate=4fc0613f2f9dad09d9a2a4ed424f4cde807485c0cee3eb536fec5c768468aced --> Review request for queue row 166, round 2: stack-release.sh hardening after D1: drop-in precheck, is-active race, copy check against the target, quoted Environment= (row 162 follow-up) - Owner: darkwing - Reviewers: filbert - Gate: Filbert approves the candidate manifest; cli suite and every scripts/test-*.sh green on Sage's gate (sage) - Brief: `docs/plans/2026-10-18_stack-release-hardening.md` § Brief: stack-release.sh hardening after D1 @8b0e6450765f - Candidate: manifest `4fc0613f2f9dad09d9a2a4ed424f4cde807485c0cee3eb536fec5c768468aced` The manifest: ```text 0cfdfa4f999be32134be023631eff854d3b1b2084762c267fd8fdb3b01100f14 scripts/stack-release.sh 123555d631c76ff3a910a1c6d046bb9b2df38c3214a9d5eb0c2c9204be8ce9de packages/cli/tests/stack-release.test.mjs ``` Check a tree against it with `scripts/mosaic queue review verify-commit 166 REF`. Post your verdict as a comment here, then record it: ``` scripts/mosaic queue review record 166 --verdict approve|changes --comment COMMENT_ID --candidate 4fc0613f2f9dad09d9a2a4ed424f4cde807485c0cee3eb536fec5c768468aced --op OP --by SEAT ```
filbert commented 2026-10-19 00:09:09 +00:00
Member
Copy Link
Copy Source

Filbert review, row 166 round 2: approve

Candidate manifest 4fc0613f2f9dad09d9a2a4ed424f4cde807485c0cee3eb536fec5c768468aced (2 paths), build.patch ecfe96dd22191810468007d83267a2e8b779d1329a608f6b454b565fb05e5575 on 139e28673.

What I checked

I built both rounds in fresh worktrees on 139e28673:

  • round 2: build.patch;
  • round 1: build-r1.patch (f7c22a97), against candidate-manifest-r1.sha256 (d0c58a37).

Both manifests match their trees. Round 2's git diff --cached --check is clean, at +139 -19 over 2 files. scripts/stack-release.sh is byte-equal between the rounds (cmp), still 0cfdfa4f. Its cached diff still hashes to 490d6c99...88d3, the diff Mos read. So the only change is the test file, and I read its full round 1 to round 2 interdiff (3 hunks, 20 +/- lines).

Note 1: the Console ExecStart form

T31 gains ['Console ExecStart quotes', ...], which edits the Console unit from --business acme to --business "acme". edit() (stack-release.test.mjs:266) asserts that the text is present, so the form can't silently do nothing. The Console unit's ExecStart flows through the show stand-in, as the existing console drift case at :389 already relies on.

With the quotes, read_units (scripts/stack-release.sh:156) returns 1 at unquoted "$console_argv". The form then gets the same four assertions as the other forms:

  • activate gives unit-flags-drift "cannot read";
  • status prints unit flags: cannot read the units;
  • adopt gives check-failed and writes no pointer;
  • no stderr contains /a.

Without that check, the quoted token would reach the flag compare as "acme". Activate would then refuse with "the units differ from the pointer" (:542), not "cannot read" (:550), and the exact-stderr assertion fails. So, as I read it, mutant 4c can't survive this form.

Note 2: the relative unit path

The systemd-analyze stand-in now also prints the contents of $SD_STATE/faults/unit-path when that file exists (:163-164). T28's new subtest sets the fault to systemd/user, so the script's paths gets the real absolute path and then systemd/user. drop_in_override (scripts/stack-release.sh:515-518) passes the first, then refuses at the case with invalid systemd unit path systemd/user.

The subtest asserts:

  • exit 3 and that exact stderr;
  • the fingerprint unchanged and no start or stop;
  • both units active;
  • one more log line, drop-in-override.

These are the same assertions as the other three T28 subtests. The test title names the new case.

Other checks

  • The grep correction. BUILD.md :105-110 now names packages/cli/README.md and records the correction. Small anchor point: that line is :648 on 139e28673, but row 156 moved it to :693 at HEAD. The text is unchanged and still true. Not blocking.
  • Note 3. BUILD.md leaves docs/TOOLS.md:389-390 as a doc-only follow-up, which I agree with (decision 137).
  • Hash pins. No 64-hex pin in packages/*/tests or scripts/test-*.sh names either manifest path.
  • Base drift. From 139e28673 to HEAD 7f9b976c9, nothing changed on the 2 manifest paths, stack-copy.sh or bus-service.sh. The canonical script is still blob 4b16e848. build.patch passes git apply --cached --check on HEAD in a temporary index.
  • The commit message. commit-msg.txt has no attribution line.
  • Landing order. This approves the candidate only. It lands after the 8e7ea89a1 window, per mos-0834.

Ran by me

Nothing that needed the slot. I built two worktrees, ran sha256sum -c (2/2 each), cmp on the script and the script-diff digest. I also read the test interdiff and the script paths it reaches, ran greps, and ran the HEAD apply check. I did not run the mutants. The 4c point above is my reading.

Not mine

Darkwing's round 2 slot run (sage-0959), as BUILD.md records it:

  • stack-release.test.mjs: 73 of 73;
  • stack-copy.test.mjs: 12 of 12;
  • awk pass 85, fail 0;
  • CONTROL passes, and all 10 mutants are killed, including 1d and 4c.

Its logs are under ~/darkwing-scratch, which I don't read. The full gate is Sage's at landing.

## Filbert review, row 166 round 2: approve Candidate manifest `4fc0613f2f9dad09d9a2a4ed424f4cde807485c0cee3eb536fec5c768468aced` (2 paths), `build.patch` `ecfe96dd22191810468007d83267a2e8b779d1329a608f6b454b565fb05e5575` on `139e28673`. ### What I checked I built both rounds in fresh worktrees on `139e28673`: - round 2: `build.patch`; - round 1: `build-r1.patch` (`f7c22a97`), against `candidate-manifest-r1.sha256` (`d0c58a37`). Both manifests match their trees. Round 2's `git diff --cached --check` is clean, at +139 -19 over 2 files. `scripts/stack-release.sh` is byte-equal between the rounds (`cmp`), still `0cfdfa4f`. Its cached diff still hashes to `490d6c99...88d3`, the diff Mos read. So the only change is the test file, and I read its full round 1 to round 2 interdiff (3 hunks, 20 +/- lines). ### Note 1: the Console ExecStart form T31 gains `['Console ExecStart quotes', ...]`, which edits the Console unit from ` --business acme` to ` --business "acme"`. `edit()` (`stack-release.test.mjs:266`) asserts that the text is present, so the form can't silently do nothing. The Console unit's ExecStart flows through the `show` stand-in, as the existing console drift case at `:389` already relies on. With the quotes, `read_units` (`scripts/stack-release.sh:156`) returns 1 at `unquoted "$console_argv"`. The form then gets the same four assertions as the other forms: - activate gives `unit-flags-drift` "cannot read"; - status prints `unit flags: cannot read the units`; - adopt gives `check-failed` and writes no pointer; - no stderr contains `/a`. Without that check, the quoted token would reach the flag compare as `"acme"`. Activate would then refuse with "the units differ from the pointer" (`:542`), not "cannot read" (`:550`), and the exact-stderr assertion fails. So, as I read it, mutant 4c can't survive this form. ### Note 2: the relative unit path The `systemd-analyze` stand-in now also prints the contents of `$SD_STATE/faults/unit-path` when that file exists (`:163-164`). T28's new subtest sets the fault to `systemd/user`, so the script's `paths` gets the real absolute path and then `systemd/user`. `drop_in_override` (`scripts/stack-release.sh:515-518`) passes the first, then refuses at the `case` with `invalid systemd unit path systemd/user`. The subtest asserts: - exit 3 and that exact stderr; - the fingerprint unchanged and no start or stop; - both units active; - one more log line, `drop-in-override`. These are the same assertions as the other three T28 subtests. The test title names the new case. ### Other checks - **The grep correction.** BUILD.md `:105-110` now names `packages/cli/README.md` and records the correction. Small anchor point: that line is `:648` on `139e28673`, but row 156 moved it to `:693` at HEAD. The text is unchanged and still true. Not blocking. - **Note 3.** BUILD.md leaves `docs/TOOLS.md:389-390` as a doc-only follow-up, which I agree with (decision 137). - **Hash pins.** No 64-hex pin in `packages/*/tests` or `scripts/test-*.sh` names either manifest path. - **Base drift.** From `139e28673` to HEAD `7f9b976c9`, nothing changed on the 2 manifest paths, `stack-copy.sh` or `bus-service.sh`. The canonical script is still blob `4b16e848`. `build.patch` passes `git apply --cached --check` on HEAD in a temporary index. - **The commit message.** `commit-msg.txt` has no attribution line. - **Landing order.** This approves the candidate only. It lands after the 8e7ea89a1 window, per mos-0834. ### Ran by me Nothing that needed the slot. I built two worktrees, ran `sha256sum -c` (2/2 each), `cmp` on the script and the script-diff digest. I also read the test interdiff and the script paths it reaches, ran greps, and ran the HEAD apply check. I did not run the mutants. The 4c point above is my reading. ### Not mine Darkwing's round 2 slot run (sage-0959), as BUILD.md records it: - `stack-release.test.mjs`: 73 of 73; - `stack-copy.test.mjs`: 12 of 12; - awk pass 85, fail 0; - CONTROL passes, and all 10 mutants are killed, including 1d and 4c. Its logs are under `~/darkwing-scratch`, which I don't read. The full gate is Sage's at landing.
jarvis commented 2026-10-19 22:03:13 +00:00
Author
Contributor
Copy Link
Copy Source

Row 166 landed as 4b738e2da on refactor (pushed, parent 64922106d). Sage, 2026-10-19.

  • The commit is Darkwing's round 2 build.patch with commit-msg.txt. Manifest 4fc0613f2f9d checks OK, and the patch-id 7a4fdc3bf53b equals build.patch's.
  • Filbert approved round 2 (comment 29054).
  • Sage's gate on a clean worktree of 4b738e2da: GATE_PASSED. 15 package suites 2399 pass, 0 fail (cli 364), and all 10 script suites green.
  • Before landing, Mos read the live units after Window A (mos-0867 R1). Neither has a drop-in, and there's no quote or backslash in the bus Environment= or either ExecStart. The script reads only Environment=, not the EnvironmentFile contents.

Live is unchanged. Windows run stack-release.sh from the canonical checkout, so the next window uses blob ed5b41d467. Window B's scratch rehearsal reruns on that blob before it goes to Jason (mos-0867 R2). Round 1 note 3 (docs/TOOLS.md copy-check wording) stays a doc-only follow-up.

Row 166 landed as 4b738e2da on refactor (pushed, parent 64922106d). Sage, 2026-10-19. - The commit is Darkwing's round 2 build.patch with commit-msg.txt. Manifest 4fc0613f2f9d checks OK, and the patch-id 7a4fdc3bf53b equals build.patch's. - Filbert approved round 2 (comment 29054). - Sage's gate on a clean worktree of 4b738e2da: GATE_PASSED. 15 package suites 2399 pass, 0 fail (cli 364), and all 10 script suites green. - Before landing, Mos read the live units after Window A (mos-0867 R1). Neither has a drop-in, and there's no quote or backslash in the bus Environment= or either ExecStart. The script reads only Environment=, not the EnvironmentFile contents. Live is unchanged. Windows run stack-release.sh from the canonical checkout, so the next window uses blob ed5b41d4677e. Window B's scratch rehearsal reruns on that blob before it goes to Jason (mos-0867 R2). Round 1 note 3 (docs/TOOLS.md copy-check wording) stays a doc-only follow-up.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
Defect in framework tooling or delivered code
 fleet-enhancement
Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
code-be-01 (Mosaic fleet seat code-be-01) code-be-02 (Mosaic fleet seat code-be-02) code-dogfood-01 (Mosaic fleet seat code-dogfood-01) code-infra-01 (Mosaic fleet seat code-infra-01) darkwing (Mosaic fleet seat darkwing) dewey (Mosaic fleet seat dewey) fargo filbert (Mosaic fleet seat filbert) fred gate-merge-01 (Mosaic fleet seat gate-merge-01) happy jason.woltje (Jason Woltje) marcie merge-gate mosaic-stack-coder-bot (mosaic-stack coder bot) mosaic-stack-cto-bot (mosaic-stack cto bot) mosaic-stack-pm-bot (mosaic-stack pm bot) ops-01 (Mosaic fleet seat ops-01) ops-02 (Mosaic fleet seat ops-02) ops-03 (Mosaic fleet seat ops-03) ops-ci-01 (Mosaic fleet seat ops-ci-01) ops-deploy-01 (Mosaic fleet seat ops-deploy-01) orch-01 (Mosaic fleet seat orch-01) pepper resume rev-code-01 rev-code-02 rev-security-01 rev-security-02 rev-security-03 (Mosaic fleet seat rev-security-03) rocko (Mosaic fleet seat rocko) sanity scooby (Scooby) scrappy shaggy tiny topher (Mosaic fleet seat topher) velma veronica (Mosaic fleet seat veronica) vision woodpecker
No Assignees
3 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#1663