fix(refusals): name validated identifiers the system already shows (#1873) #1920

2026-11-11T05:39:58Z

jason.woltje commented

2026-11-11 05:39:58 +00:00

Refusal follow-up to redact4 (#1916, #1873): put back names that are safe to show.

redact4 removed every config value from refusal text. That also removed names an operator needs, like the seat, owner, reviewer or request op a queue refusal is about. This puts a name back only when two things hold at the refusal site:

the value already passed a strict identifier check or a closed-list check before the refusal, and
the system already shows that value elsewhere (queue render, queue show, the business view).

Everything else stays redacted: free text, paths, evidence digests, unchecked claimants, and generic duplicates. Conditions, check order, error classes, codes, exit codes and authority decisions are unchanged.

Sources: organization/src/role.mjs (authority action names after the ACTIONS and GATED_ONLY checks), organization/src/access.mjs (user and grant ids after requireId, duplicate scope entries after their check), queue/src/queue.mjs (owner, reviewers, gate owner, claimant only when it equals the owner, request ops), scripts/mosaic-config.mjs (the federation id in the duplicate-peer refusal, after its pattern check) and scripts/mosaic-task.mjs (a duplicate tool, after the supported-tools check).
Each restored site has a test that a valid name appears and a malformed value in the same slot never does (sk-test-NOT-A-SECRET-1234 sentinel, including JSON-escaped forms). New: packages/organization/tests/safe-names.test.mjs; queue malformed boundaries in last-values.test.mjs.
62 acceptance expectations changed from "omits the name" to "names the validated value". The lane report lists each with its source site, its validation proof and the malformed control that still holds.

Lane: Sol. Review: Opus (changes 2, both P3, test strength and report detail; fixed). Gate on 82dcba2d4: 195 files, 2633/0. Rebased by the Lead onto d0cfebe28 (M3, #1918), then onto 57052c53d (#1919); range-diff all = both times. On d0cfebe28 the organization, queue, cli and webui suites, every refusal-redaction and last-values file, and test-queue, test-config and test-task reran. On 57052c53d the files both changes touch (accounts, agent-levels-write, rename-b-identity, access, role, safe-names, last-values) reran green, and stack-release passed alone, 237/0. Case 1 fails only row253 C4 P10 inner, which fails on base 57052c53d too under the same load (known red, fix in flight).

Refusal follow-up to redact4 (#1916, #1873): put back names that are safe to show. redact4 removed every config value from refusal text. That also removed names an operator needs, like the seat, owner, reviewer or request op a queue refusal is about. This puts a name back only when two things hold at the refusal site: - the value already passed a strict identifier check or a closed-list check before the refusal, and - the system already shows that value elsewhere (queue render, queue show, the business view). Everything else stays redacted: free text, paths, evidence digests, unchecked claimants, and generic duplicates. Conditions, check order, error classes, codes, exit codes and authority decisions are unchanged. - Sources: `organization/src/role.mjs` (authority action names after the ACTIONS and GATED_ONLY checks), `organization/src/access.mjs` (user and grant ids after `requireId`, duplicate scope entries after their check), `queue/src/queue.mjs` (owner, reviewers, gate owner, claimant only when it equals the owner, request ops), `scripts/mosaic-config.mjs` (the federation id in the duplicate-peer refusal, after its pattern check) and `scripts/mosaic-task.mjs` (a duplicate tool, after the supported-tools check). - Each restored site has a test that a valid name appears and a malformed value in the same slot never does (`sk-test-NOT-A-SECRET-1234` sentinel, including JSON-escaped forms). New: `packages/organization/tests/safe-names.test.mjs`; queue malformed boundaries in `last-values.test.mjs`. - 62 acceptance expectations changed from "omits the name" to "names the validated value". The lane report lists each with its source site, its validation proof and the malformed control that still holds. Lane: Sol. Review: Opus (changes 2, both P3, test strength and report detail; fixed). Gate on 82dcba2d4: 195 files, 2633/0. Rebased by the Lead onto d0cfebe28 (M3, #1918), then onto 57052c53d (#1919); range-diff all `=` both times. On d0cfebe28 the organization, queue, cli and webui suites, every refusal-redaction and last-values file, and test-queue, test-config and test-task reran. On 57052c53d the files both changes touch (accounts, agent-levels-write, rename-b-identity, access, role, safe-names, last-values) reran green, and stack-release passed alone, 237/0. Case 1 fails only `row253 C4 P10 inner`, which fails on base 57052c53d too under the same load (known red, fix in flight).

jason.woltje added 2 commits 2026-11-11 05:39:58 +00:00

fix(refusals): restore validated identifiers already shown by the system (#1873 ) 3e82bc16c3

test(refusals): detect escaped malformed identifiers (#1873 ) f7813339b5

jason.woltje merged commit f7813339b5 into refactor

2026-11-11 05:40:01 +00:00

jason.woltje referenced this pull request

2026-11-11 05:41:33 +00:00

fix(webui): task board conflicts reopen on the current task and say why (#1873) #1921

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: mosaicstack/stack#1920