mosaicstack/stack
1
0
Fork 1
Code Issues 200 Pull Requests 10 Actions Packages Projects Releases 15 Wiki Activity

feat(installer): transactional P0-P9 state machine #1053

Closed
be-coder-05 wants to merge 15 commits from feat/1050-install-state-machine-red-fixture into main
pull from: feat/1050-install-state-machine-red-fixture
merge into: :main
Conversation 0 Commits 15 Files Changed 52
+5305 -418
be-coder-05 commented 2026-08-05 18:08:52 +00:00
Collaborator
Copy Link
Copy Source

Summary

  • add the canonical transactional installer state machine P0 Resolve context through P9 Verify + commit
  • make --check a side-effect-free P0–P8 postcondition discriminator
  • open a private mutation journal and snapshot before target mutation, record prior state/reversal, fail fatally on record/sync failure, and seal at P9
  • persist required P4/P6 action failures so later checks cannot manufacture success
  • add P2–P8 fault injection, rollback path hardening, stale-projection recovery, exact lane/version checks, and offline source-build coverage
  • run the complete current checkout from zero in Debian/glibc as uid 1001 with no host HOME/cache/credentials and a fixture-pinned digest
  • wire expected-RED next/main lane and git-present/absent controls into Woodpecker

Refs #1050

Acceptance evidence

The final exact-checkout next run is intentionally attributable RED:

  • installer exit: 1
  • Done. claims: 0
  • P0/P1/P2/P3/P7: PASS
  • P4: NOT-MEASURED / UNDECLARED
  • P5/P6/P8: named FAIL
  • P9: refuses commit
  • P3 reports exactly 0.0.50-next.2207 at the absolute prefix path

The main parameter preserves exact stable P3 (0.0.49) and the same structural RED. The git-absent control fails P1 before mutation and leaves no false completion claim.

Verification

  • pnpm test:installer
  • pnpm typecheck
  • pnpm lint
  • pnpm format:check
  • Bash syntax + ShellCheck on all changed shell surfaces
  • framework upgrade manifest guard: 193/193
  • framework rollback: 28/28
  • durable snapshot: 41/41
  • install migration: 21/21
  • clean Debian/glibc checkout fixtures: next git-present, next git-absent, main git-present
  • provider commit read-back: 229f643a84ebf9600e997b321be68b04b6bbb255 authored by be-coder-05

Review dispositions ratified by tl-mosaic

The lane lead explicitly ratified both scope refusals and authorized citing that ruling in this PR:

  1. The expected P4/P9 RED is the C1 deliverable. Publishing .install-shipped-skills.json is C5-owned; making C1 green by implementing it would weaken C1's property and absorb C5.
  2. Canonical PRD v2 §3 explicitly records signed artifact provenance as correct long-term but out of scope. This change adds archive size/type/path controls and a fixture-pinned digest without inventing an unchartered signing system.

A valid review finding was accepted: checkout mode previously fetched an older remote framework. The fixture now packages, pins, and executes the complete current checkout.

Merge/status boundary

  • target is main under L0's trunk-only rule; the original lower-layer next charter was retargeted when the merge-guard rehearsal exposed the conflict
  • no self-merge
  • pr-merge.sh --dry-run correctly exposed the conflict; the wrapper was not patched, bypassed, or weakened
  • #1050 remains open pending independent Jarvis validation; this PR intentionally uses Refs, not Closes
  • status: believed-fixed, pending jarvis validation AND pending promotion to main via #1037
## Summary - add the canonical transactional installer state machine P0 Resolve context through P9 Verify + commit - make `--check` a side-effect-free P0–P8 postcondition discriminator - open a private mutation journal and snapshot before target mutation, record prior state/reversal, fail fatally on record/sync failure, and seal at P9 - persist required P4/P6 action failures so later checks cannot manufacture success - add P2–P8 fault injection, rollback path hardening, stale-projection recovery, exact lane/version checks, and offline source-build coverage - run the complete current checkout from zero in Debian/glibc as uid 1001 with no host HOME/cache/credentials and a fixture-pinned digest - wire expected-RED `next`/`main` lane and git-present/absent controls into Woodpecker Refs #1050 ## Acceptance evidence The final exact-checkout `next` run is intentionally attributable RED: - installer exit: `1` - `Done.` claims: `0` - P0/P1/P2/P3/P7: PASS - P4: `NOT-MEASURED / UNDECLARED` - P5/P6/P8: named FAIL - P9: refuses commit - P3 reports exactly `0.0.50-next.2207` at the absolute prefix path The `main` parameter preserves exact stable P3 (`0.0.49`) and the same structural RED. The git-absent control fails P1 before mutation and leaves no false completion claim. ## Verification - `pnpm test:installer` - `pnpm typecheck` - `pnpm lint` - `pnpm format:check` - Bash syntax + ShellCheck on all changed shell surfaces - framework upgrade manifest guard: 193/193 - framework rollback: 28/28 - durable snapshot: 41/41 - install migration: 21/21 - clean Debian/glibc checkout fixtures: next git-present, next git-absent, main git-present - provider commit read-back: `229f643a84ebf9600e997b321be68b04b6bbb255` authored by `be-coder-05` ## Review dispositions ratified by tl-mosaic The lane lead explicitly ratified both scope refusals and authorized citing that ruling in this PR: 1. The expected P4/P9 RED is the C1 deliverable. Publishing `.install-shipped-skills.json` is C5-owned; making C1 green by implementing it would weaken C1's property and absorb C5. 2. Canonical PRD v2 §3 explicitly records signed artifact provenance as correct long-term but out of scope. This change adds archive size/type/path controls and a fixture-pinned digest without inventing an unchartered signing system. A valid review finding was accepted: checkout mode previously fetched an older remote framework. The fixture now packages, pins, and executes the complete current checkout. ## Merge/status boundary - target is `main` under L0's trunk-only rule; the original lower-layer `next` charter was retargeted when the merge-guard rehearsal exposed the conflict - no self-merge - `pr-merge.sh --dry-run` correctly exposed the conflict; the wrapper was not patched, bypassed, or weakened - #1050 remains open pending independent Jarvis validation; this PR intentionally uses `Refs`, not `Closes` - status: **believed-fixed, pending jarvis validation AND pending promotion to `main` via #1037**
be-coder-05 changed target branch from next to main 2026-08-05 18:09:43 +00:00
be-coder-05 added 15 commits 2026-08-05 18:09:43 +00:00
feat(#462): add federation get verb (#683)
ci/woodpecker/push/ci Pipeline was successful
Details
838701bde2 
FED-M3-06 get verb. Trust boundary mirrors M3-05 AND-intersect (note returned only when owned by subject AND on an authorized mission). Reviewed (review-of-record APPROVE, head 80a259b2) + green PR-event CI 1620.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
test(#462): add federation M3 integration coverage (#685)
ci/woodpecker/push/ci Pipeline was successful
Details
a3c1ab923c 
FED-M3-10 integration tests for the federation M3 verbs (list/get/scope). Test-infra + docs only; green PR-event CI 1623 (all steps incl ci-postgres).

Co-Authored-By: Claude Opus 4.8 <[email protected]>
feat(installer): add next integration lane (#686)
ci/woodpecker/push/ci Pipeline was successful
Details
94d6538061 
Add --next installer flag (build-from-source at the next integration branch; MOSAIC_NEXT=1 env equiv; explicit --ref wins). Three-lane install docs (stable @latest / --next prerelease / --dev source) + @next dist-tag pipeline design doc. Green PR-event CI 1626 + review-of-record APPROVE (head 3a5c12a5).

Co-Authored-By: Claude Opus 4.8 <[email protected]>
ci(#462): add durable next publish pipeline (#687)
ci/woodpecker/push/ci Pipeline was successful
Details
ci/woodpecker/push/publish Pipeline was successful
Details
c25a551c28 
Durable @next integration-line publish: on next pushes, compute <patch+1>-next.<pipeline#> prerelease versions (in-CI, uncommitted) and publish @mosaicstack/* under the next dist-tag; gateway image sha-only on next. Strict guardrails: next-only, never writes latest, never tags from next; main path unchanged. PR-event CI 1631 fully green + review-of-record APPROVE (head b1a887a2). Guardrails independently verified.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
feat(installer): prefer npm next lane (#688)
ci/woodpecker/push/ci Pipeline was successful
Details
ci/woodpecker/push/publish Pipeline was successful
Details
940ae3cc41 
--next now prefers a fast npm @next install (CLI + gateway from the Gitea registry) and falls back to source build at next if the dist-tag is unavailable. Registry lane gated to non-dev, non-explicit-ref next installs; CLI/gateway prerelease versions must share a pipeline suffix. Adds tools/install-next-lane.test.sh (wired into CI). PR-event CI 1635 fully green + review-of-record APPROVE (functional install test, head 2fd7cfc3).

Co-Authored-By: Claude Opus 4.8 <[email protected]>
fix(gateway): disable Redis consumers on local tier (#689)
ci/woodpecker/push/ci Pipeline was successful
Details
ci/woodpecker/push/publish Pipeline was successful
Details
56787fabf1
fix(wizard): resolve skills sync script path (#690)
ci/woodpecker/push/ci Pipeline was successful
Details
ci/woodpecker/push/publish Pipeline was successful
Details
0883fb91ec
fix(wizard): report gateway failures before success summary (#691)
ci/woodpecker/push/ci Pipeline was successful
Details
ci/woodpecker/push/publish Pipeline was successful
Details
b96cc7982a
fix(wizard): avoid rerunning completed setup steps (#692)
ci/woodpecker/push/ci Pipeline was successful
Details
ci/woodpecker/push/publish Pipeline was successful
Details
495f73bfdb
fix(wizard): honor MOSAIC_GATEWAY_SKIP_NPM_INSTALL — unblock install.sh --dev gateway testing (#698)
ci/woodpecker/push/ci Pipeline was successful
Details
ci/woodpecker/push/publish Pipeline was successful
Details
193331544d
wip(sync): merge main into next with combined resolutions 906ad8dc30
fix(sync): close local queue semantic merge gap
ci/woodpecker/pr/ci Pipeline was successful
Details
b8844e1ff0
Merge pull request 'chore(sync): merge main → next (B1) — resolve 8 conflicts, restore next current' (#1041) from sync/b1-main-into-next into next
ci/woodpecker/push/publish Pipeline failed
Details
4df478cdd1 
chore(sync): merge main → next (B1) — restore next current, resolve 8 conflicts (#1041)

Brings next current with main incl the RM-03 guard fix (482/5); preserves next's 10 in-flight commits. Closes #1040.
test(installer): preregister P0-P9 greenfield RED 033bb7aa87
feat(installer): add transactional P0-P9 state machine
ci/woodpecker/pr/ci Pipeline failed
Details
ci/woodpecker/pr/greenfield-install Pipeline was successful
Details
229f643a84
Mos closed this pull request 2026-08-05 18:11:35 +00:00

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
bug
Defect in framework tooling or delivered code
 fleet-enhancement
Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
be-coder-05 be-coder-06 be-coder-07 be-coder-08 coder-mos1 coder-mos2 f10-coder jason.woltje (Jason Woltje) merge-gate mos-dt-0 pepper rev-974 (Rev-974 (Mosaic reviewer seat, web1)) rev-security-02 scooby (Scooby)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#1053