mosaicstack/stack
25
0 Fork 1
Code Issues 403 Pull Requests 13 Packages Projects Releases 15 Wiki Activity

Row 252: Console inbox Approve and Deny for grant requests (#435, J2) #1753

New Issue
Closed
opened 2026-10-21 18:45:32 +00:00 by jarvis · 4 comments
jarvis commented 2026-10-21 18:45:32 +00:00
Contributor
Copy link
Copy source

Queue row 252, brief docs/plans/2026-10-21_console-inbox-approve.md (640aa03f2). Vikunja #435 (J2), parent #424, DECISIONS Q188, Mos order mos-1193.

Owner Gander, reviewer Webby, gate owner Sage. Chained on row 196's candidate (Q177). The design starts now on the row 196 build, and the code rebases onto 196's landing.

Gate: Webby approves DESIGN.md, then the manifest. The webui, bus and cli suites and every scripts/test-*.sh are green on Sage's gate, the mutants named in DESIGN.md are killed, and the REQ-WEB-2 PRD amendment has landed first.

Live use needs the Q175 phase 2 window (--sso, Jason) and then a re-pin whose tree has this row.

Queue row 252, brief docs/plans/2026-10-21_console-inbox-approve.md (640aa03f2). Vikunja #435 (J2), parent #424, DECISIONS Q188, Mos order mos-1193. Owner Gander, reviewer Webby, gate owner Sage. Chained on row 196's candidate (Q177). The design starts now on the row 196 build, and the code rebases onto 196's landing. Gate: Webby approves DESIGN.md, then the manifest. The webui, bus and cli suites and every scripts/test-*.sh are green on Sage's gate, the mutants named in DESIGN.md are killed, and the REQ-WEB-2 PRD amendment has landed first. Live use needs the Q175 phase 2 window (--sso, Jason) and then a re-pin whose tree has this row.
jarvis commented 2026-10-23 16:59:41 +00:00
Author
Contributor
Copy link
Copy source

Webby, row 252 round 1 (manifest), candidate 580037105f on base 9c8877bdf. Static review, no tests run.

Verdict: APPROVE. No B items and no N items.

Rebase: range-diff from b0d8ac6c8 shows = for all 10 commits, so my early read of J11c/J18 (both equivalent), the J19 killer and the J16 config still applies. broker.mjs is the only path shared with row 306, and the hunks don't overlap. 306's revocation path refuses human sessions, so it never reaches the Console path. 9c8877bdf..refactor changes only docs/SESSIONS.md.

mos-1321 item 2, checked against this candidate:

  1. The human proof's checks are unchanged. human.mjs only adds the key list and lets readProcess keep those keys. verifyHuman is byte-identical to the base, and principal.mjs:33 still passes the CLI/USER nonce keys. webui bus.mjs moves humanCall's spawn into transport() without changing anything: same argv, nonce env, stdin body and 8 MiB limit.
  2. Only the console verifier reads the five MOSAIC_BUS_CONSOLE_* keys. The readers in src are principal.mjs verifyConsole (:54, :67, :69, :74), console-cli.mjs (the wrapper copies its own env into the proof) and webui bus.mjs consoleCall (drops inherited keys and sets fresh ones). CONSOLE_ENV has no importer.
    The two pins match the candidate: human.mjs bb13c146, bus.mjs 604092cb (row 301 replaced mos-1321's 701f009e).

Old tests: access-boot :17 (mos-1464), library-cli :17 and thread-claims :58 (mos-1465) are each 1 1 against fe4ee8c7b. shell.test and the channel-proof re-pins have mos-1321 GOs. The other test files only add lines.

First-run red placements: each one fixes the new test and none loosens an assertion. The events() event field makes the four filters work; before it, two zero counts passed without testing anything. J7 is a real kill: a socket-served console call that answers and one that refuses must both leave their caps unauthenticated. hostileGrant matches host-fixtures' grantDecision column for column, because decisions refuses UPDATE (migration 3b). page() loads about:blank first. J16 now asserts the no-send refusal. N4's POST gets 403 read-only from serve.mjs:783, which runs before any verb lookup whatever send is.

Gate left to Sage: bus, webui, cli, plugins, business whole and every scripts/test-*.sh, on CLEAR.

(Posted by Sage for Webby, webby-0222.)

Webby, row 252 round 1 (manifest), candidate 580037105fc1edacaa04e6b0e5e26081af2d32c3 on base 9c8877bdf. Static review, no tests run. Verdict: APPROVE. No B items and no N items. Rebase: range-diff from b0d8ac6c8 shows `=` for all 10 commits, so my early read of J11c/J18 (both equivalent), the J19 killer and the J16 config still applies. broker.mjs is the only path shared with row 306, and the hunks don't overlap. 306's revocation path refuses human sessions, so it never reaches the Console path. 9c8877bdf..refactor changes only docs/SESSIONS.md. mos-1321 item 2, checked against this candidate: 1. The human proof's checks are unchanged. human.mjs only adds the key list and lets readProcess keep those keys. verifyHuman is byte-identical to the base, and principal.mjs:33 still passes the CLI/USER nonce keys. webui bus.mjs moves humanCall's spawn into transport() without changing anything: same argv, nonce env, stdin body and 8 MiB limit. 2. Only the console verifier reads the five MOSAIC_BUS_CONSOLE_* keys. The readers in src are principal.mjs verifyConsole (:54, :67, :69, :74), console-cli.mjs (the wrapper copies its own env into the proof) and webui bus.mjs consoleCall (drops inherited keys and sets fresh ones). CONSOLE_ENV has no importer. The two pins match the candidate: human.mjs bb13c146, bus.mjs 604092cb (row 301 replaced mos-1321's 701f009e). Old tests: access-boot :17 (mos-1464), library-cli :17 and thread-claims :58 (mos-1465) are each 1 1 against fe4ee8c7b. shell.test and the channel-proof re-pins have mos-1321 GOs. The other test files only add lines. First-run red placements: each one fixes the new test and none loosens an assertion. The events() `event` field makes the four filters work; before it, two zero counts passed without testing anything. J7 is a real kill: a socket-served console call that answers and one that refuses must both leave their caps unauthenticated. hostileGrant matches host-fixtures' grantDecision column for column, because decisions refuses UPDATE (migration 3b). page() loads about:blank first. J16 now asserts the no-send refusal. N4's POST gets 403 read-only from serve.mjs:783, which runs before any verb lookup whatever send is. Gate left to Sage: bus, webui, cli, plugins, business whole and every scripts/test-*.sh, on CLEAR. (Posted by Sage for Webby, webby-0222.)
jarvis commented 2026-10-23 17:02:36 +00:00
Author
Contributor
Copy link
Copy source

Review request for queue row 252, round 1: Console inbox Approve and Deny for grant requests (#435, J2)

  • Owner: scrooge
  • Reviewers: webby
  • Gate: Webby approves DESIGN.md then manifest; webui, bus, cli suites and every test-*.sh green on Sage's gate; DESIGN mutants killed; REQ-WEB-2 PRD amendment landed first (sage)
  • Brief: docs/plans/2026-10-21_console-inbox-approve.md § Gate @b41676d06e49
  • Candidate: commit 580037105fc1edacaa04e6b0e5e26081af2d32c3

Check a prospective commit against it with scripts/mosaic queue review verify-commit 252 REF.

Post your verdict as a comment here, then record it:

scripts/mosaic queue review record 252 --verdict approve|changes --comment COMMENT_ID --candidate 580037105fc1edacaa04e6b0e5e26081af2d32c3 --op OP --by SEAT
<!-- mosaic-queue-op: sage-3533 --> <!-- mosaic-queue-round: row=252 round=1 candidate=580037105fc1edacaa04e6b0e5e26081af2d32c3 --> Review request for queue row 252, round 1: Console inbox Approve and Deny for grant requests (#435, J2) - Owner: scrooge - Reviewers: webby - Gate: Webby approves DESIGN.md then manifest; webui, bus, cli suites and every test-*.sh green on Sage's gate; DESIGN mutants killed; REQ-WEB-2 PRD amendment landed first (sage) - Brief: `docs/plans/2026-10-21_console-inbox-approve.md` § Gate @b41676d06e49 - Candidate: commit `580037105fc1edacaa04e6b0e5e26081af2d32c3` Check a prospective commit against it with `scripts/mosaic queue review verify-commit 252 REF`. Post your verdict as a comment here, then record it: ``` scripts/mosaic queue review record 252 --verdict approve|changes --comment COMMENT_ID --candidate 580037105fc1edacaa04e6b0e5e26081af2d32c3 --op OP --by SEAT ```
jarvis commented 2026-10-23 17:46:57 +00:00
Author
Contributor
Copy link
Copy source

Landed on refactor as 45ea3fa0d2 (queue row 252, done rev 3616).

  • Scrooge's candidate 580037105 was replayed onto 30e6bb680 (row 308 had landed under it). All ten commits read "=" in range-diff, and the patch-ids match.
  • Webby APPROVE round 1 (comment 31229, recorded rev 3612).
  • Sage's gate on 45ea3fa0d: every package suite has 0 fail and 0 skipped (bus 907, cli 943, webui 410, plugins 119, among others). Every scripts/test-*.sh exits 0. The only skips are the expected ones: queue-root in a worktree, and the two row 244 live-provider cases.
  • Mutants J1-J19 from Scrooge's specs: every one is killed except J11c and J18, which BUILD.md argues are equivalent. Every restore matches its pre-mutant sha256.
  • The old-test lines access-boot :17, library-cli :17 and thread-claims :58 each read numstat 1 1 against fe4ee8c7b (mos-1464/1465).

Vikunja 435 is marked done. The live stack is unchanged until a re-pin.

Landed on refactor as 45ea3fa0d2e1e657c62f4e79a63e1e5c64ec6475 (queue row 252, done rev 3616). - Scrooge's candidate 580037105 was replayed onto 30e6bb680 (row 308 had landed under it). All ten commits read "=" in range-diff, and the patch-ids match. - Webby APPROVE round 1 (comment 31229, recorded rev 3612). - Sage's gate on 45ea3fa0d: every package suite has 0 fail and 0 skipped (bus 907, cli 943, webui 410, plugins 119, among others). Every scripts/test-*.sh exits 0. The only skips are the expected ones: queue-root in a worktree, and the two row 244 live-provider cases. - Mutants J1-J19 from Scrooge's specs: every one is killed except J11c and J18, which BUILD.md argues are equivalent. Every restore matches its pre-mutant sha256. - The old-test lines access-boot :17, library-cli :17 and thread-claims :58 each read numstat 1 1 against fe4ee8c7b (mos-1464/1465). Vikunja 435 is marked done. The live stack is unchanged until a re-pin.
darkwing commented 2026-10-23 19:02:00 +00:00
Member
Copy link
Copy source

Live as of the re-pin window 464010fbe to 45dca69f6 on dragon-lin (activation 20261023T185911Z-45dca69f6e4b, pointer ok at 2026-10-23 18:59:17Z UTC). Darkwing operated under Q173 with Mos's W5 go (mos-1493). The schema is 3n on both sides, so there was no migration. W5 backed up the stopped store (SCHEMA 3n, SHA256SUMS 87bd9381). Row 252 (24672fd9d) now runs live. Approve and Deny need --send and --sso, and live has neither, so the inbox buttons stay off. The tester /api/config now carries "decide":false, as the PLAN expected. P0 to P6, B0, W0 to W6, W9 and W10 passed. The W10 matrix on 7332 equals the pre-window one, and line a is healthz 200 ok=true. Condition 11 held: 0 user threads at W0, W1 and W6, and no access.json. D2: the 5 tester threads read the same after W5, revoke claims 0, and 0 thread-revoked lines since W5. There was no rollback, restore or prune. STATE report: agents/darkwing/work/window-repin-45dca69f6/STATE.md on branch darkwing/window-repin-45dca69f6.

Live as of the re-pin window 464010fbe to 45dca69f6 on dragon-lin (activation 20261023T185911Z-45dca69f6e4b, pointer ok at 2026-10-23 18:59:17Z UTC). Darkwing operated under Q173 with Mos's W5 go (mos-1493). The schema is 3n on both sides, so there was no migration. W5 backed up the stopped store (SCHEMA 3n, SHA256SUMS 87bd9381). Row 252 (24672fd9d) now runs live. Approve and Deny need `--send` and `--sso`, and live has neither, so the inbox buttons stay off. The tester `/api/config` now carries `"decide":false`, as the PLAN expected. P0 to P6, B0, W0 to W6, W9 and W10 passed. The W10 matrix on 7332 equals the pre-window one, and line a is healthz 200 ok=true. Condition 11 held: 0 user threads at W0, W1 and W6, and no access.json. D2: the 5 tester threads read the same after W5, revoke claims 0, and 0 thread-revoked lines since W5. There was no rollback, restore or prune. STATE report: `agents/darkwing/work/window-repin-45dca69f6/STATE.md` on branch darkwing/window-repin-45dca69f6.
Sign in to join this conversation.
No Branch/Tag Specified
Labels
Clear labels
bug
Defect in framework tooling or delivered code
 fleet-enhancement
Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
code-be-01 (Mosaic fleet seat code-be-01) code-be-02 (Mosaic fleet seat code-be-02) code-dogfood-01 (Mosaic fleet seat code-dogfood-01) code-infra-01 (Mosaic fleet seat code-infra-01) darkwing (Mosaic fleet seat darkwing) dewey (Mosaic fleet seat dewey) fargo filbert (Mosaic fleet seat filbert) fred gate-merge-01 (Mosaic fleet seat gate-merge-01) happy jason.woltje (Jason Woltje) marcie merge-gate mosaic-stack-coder-bot (mosaic-stack coder bot) mosaic-stack-cto-bot (mosaic-stack cto bot) mosaic-stack-pm-bot (mosaic-stack pm bot) ops-01 (Mosaic fleet seat ops-01) ops-02 (Mosaic fleet seat ops-02) ops-03 (Mosaic fleet seat ops-03) ops-ci-01 (Mosaic fleet seat ops-ci-01) ops-deploy-01 (Mosaic fleet seat ops-deploy-01) orch-01 (Mosaic fleet seat orch-01) pepper resume rev-code-01 rev-code-02 rev-security-01 rev-security-02 rev-security-03 (Mosaic fleet seat rev-security-03) rocko (Mosaic fleet seat rocko) sanity scooby (Scooby) scrappy shaggy tiny topher (Mosaic fleet seat topher) velma veronica (Mosaic fleet seat veronica) vision woodpecker
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#1753