fix(org): Console start reattaches to org buses and revives a provably dead host (#1873) #1938

2026-11-11T20:15:28Z

jason.woltje commented

2026-11-11 20:15:28 +00:00

D2 (#1873, readiness audit P0-3): org buses come back after a Console stop or restart, and Restart bus recovers a provably dead host.

Console start reattaches to every org bus and revives a host that is provably dead (no live pid, lock owner gone). A live host, a live writer lock, or an identity that cannot be proven (argv mismatch on a live pid) still refuses with files unchanged.
Restart bus on a dead host clears only the entries it inspected, renaming each aside and checking dev and inode before removal, restoring on a mismatch or receipt failure, then starts the bus with a receipt.
bus recover refuses inside an agent run, and the Console start-up revive does nothing under an agent marker. A deployed Console's rules are unchanged; the revive wiring is dev-only.
The start-up revive uses pm:false; the chief returns on a person's press.

Tests: new acceptance tests fail on BASE. Lane gate: webui 1309/0, cli+bus 3585/0 on the build commit; 225/0 on 24 affected files and 92/0 on 9 more at HEAD. e2e on HEAD: both buses answer after Console stop and start; one Restart bus press revives a killed host; a live writer lock is refused. The same run on BASE shows dead buses.

Review: build (Opus) changes, fixed in f9dae1eba. Security (daybreak-blue) changes 3 (2 P1, 1 P2), fixed in 900daf521; re-check: findings 2 and 3 fixed, finding 1 accepted for recover and revive. Lead check: 13 files on 900daf521 (org-recovery, org-revive, bus-revive, org-admin and every cli/webui test that reads org-bus, bus-revive, console-restart or org-admin), 150/0.

Open, pre-existing on BASE and outside this change: bus start|stop|restart and console start have no agent-run guard (security re-check P1). Recorded as a follow-up for the Lead. Also deferred: leftover .recovering-* asides after an interrupted recovery (fails closed), revived hosts still inside the Console cgroup, stale Restart bus time and header text.

D2 (#1873, readiness audit P0-3): org buses come back after a Console stop or restart, and Restart bus recovers a provably dead host. - Console start reattaches to every org bus and revives a host that is provably dead (no live pid, lock owner gone). A live host, a live writer lock, or an identity that cannot be proven (argv mismatch on a live pid) still refuses with files unchanged. - Restart bus on a dead host clears only the entries it inspected, renaming each aside and checking dev and inode before removal, restoring on a mismatch or receipt failure, then starts the bus with a receipt. - `bus recover` refuses inside an agent run, and the Console start-up revive does nothing under an agent marker. A deployed Console's rules are unchanged; the revive wiring is dev-only. - The start-up revive uses `pm:false`; the chief returns on a person's press. Tests: new acceptance tests fail on BASE. Lane gate: webui 1309/0, cli+bus 3585/0 on the build commit; 225/0 on 24 affected files and 92/0 on 9 more at HEAD. e2e on HEAD: both buses answer after Console stop and start; one Restart bus press revives a killed host; a live writer lock is refused. The same run on BASE shows dead buses. Review: build (Opus) changes, fixed in f9dae1eba. Security (daybreak-blue) changes 3 (2 P1, 1 P2), fixed in 900daf521; re-check: findings 2 and 3 fixed, finding 1 accepted for recover and revive. Lead check: 13 files on 900daf521 (org-recovery, org-revive, bus-revive, org-admin and every cli/webui test that reads org-bus, bus-revive, console-restart or org-admin), 150/0. Open, pre-existing on BASE and outside this change: `bus start|stop|restart` and `console start` have no agent-run guard (security re-check P1). Recorded as a follow-up for the Lead. Also deferred: leftover `.recovering-*` asides after an interrupted recovery (fails closed), revived hosts still inside the Console cgroup, stale Restart bus time and header text.

jason.woltje added 3 commits 2026-11-11 20:15:28 +00:00

fix(org): Console start reattaches to org buses and revives a provably dead host (P0-3) f063158875

A Console unit stop (KillMode=mixed) SIGKILLs the bus hosts the Console
started, leaving host.json, host.lock and the socket behind, and the
dev Console's Restart bus refused 409 on that stale state.

- busRevive (org-bus): busRecover, then busStart detached on the
  options the dead host recorded. busRecover still refuses a live host
  pid, a lock that is not the dead host's, a live writer pid, or a
  socket that answers or is uncertain.
- reviveBuses (webui): when a dev-local-owner Console starts, a bus that
  answers is left (reattached); a bus with stale state goes to busRevive
  with pm:false, trailed as bus.revive before anything changes.
- Restart bus (org-admin): for the exact dev owner only, a stale-state
  refusal goes to busRevive; a signed-in owner keeps the refusal.
- The receipt reads "Dead bus host cleared; bus started".

fix(org): D2 build review: pin pm:false, wait for the start-up revive, say when a clear was followed by a failed start f9dae1ebad

- The Console-start revive asks busRevive for pm:false; reviveStartOptions holds the rule (never
  wider than the dead host's record) and is tested on its own. A dropped --pm is logged with the
  way back.
- A Restart bus press waits for that organization's start-up revive (revivePending) before it reads
  the bus, so it no longer races it for the lifecycle lock; a press that still meets org-locked gets
  409 bus-busy, nothing changed.
- busRevive marks an error from busStart after a successful clear (error.recovered); the trail, the
  Console log and the press response then say "failed", not "refused". A non-CliError logs its code.
- Tests: bus-revive.test.mjs (new), org-admin and org-revive cases for the above.

fix(org): D2 security review: live identity refuses, clear only inspected entries, no revive from an agent run 900daf5213

- busRecover: a live pid with the recorded start time is the recorded process, so it refuses
  ("bus host identity is uncertain") whatever its argv. It used to read a mismatching argv as a dead
  host. The pinned recovery test now covers a reused pid (live, other start time) as the wrong
  process, and a new test covers the refusal.
- busRecover clears through setAside: each inspected entry is renamed aside and checked by device
  and inode; a swapped entry puts everything back and refuses before any receipt or deletion, and
  the deletion names only the aside entries.
- mosaic bus recover refuses inside an agent run (refuseInsideAgent), like mosaic org reload. The
  Console-start revive does nothing when the Console's own environment carries an agent marker.
- Tests: org-recovery (identity, agent refusal), org-revive (setAside swap), bus-revive (markers);
  the other reviveBuses tests pass an explicit env.

jason.woltje merged commit 900daf5213 into refactor

2026-11-11 20:15:32 +00:00

jason.woltje referenced this pull request

2026-11-11 20:20:13 +00:00

feat(console): dev-local-owner Console writes autonomy and restarts when detached (#1873) #1939

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: mosaicstack/stack#1938