feat(webui): F3 self-service restarts and owner settings writes on an org (#1873) #1884

2026-11-09T22:44:54Z

jason.woltje commented

2026-11-09 22:44:54 +00:00

F3 (REQ-WEB-3), part of #1873: restart the Console, an organization's bus and its agents from the WebUI, and make the owner's settings writes (routing, agents, instances, name, assistant stop, limits, model proxy) on a selected organization's bus.

What changed

Settings offers Console restart (supervised Consoles exit and mosaic console start relaunches them on the same arguments).
The bus-down banner offers Restart; POST /api/orgs/<id>/restart/bus answers with a done receipt.
Routing apply shows how a change reaches each saved agent, with Restart NAME now.
Each Console restart, bus restart, routing, agent and instance change appends one line to <dataRoot>/console/actions.jsonl (0600).

Review: one Sol (gpt-6.1-sol xhigh) round, verdict CHANGES 1/0/1.

P1: on a --dev-local-owner Console a local agent can send the right Origin and Fetch Metadata headers and reach these controls. The pinned startup warning already says agents reach the loopback dev Console as owner, and the no-auth dev flags are an accepted ruling. The README falsely claimed otherwise; it now states the residual and names sign-in as the boundary. The cooperative local-agent peer refusal is follow-up #1883.
P3: the instances route did not write its trail line. Fixed, with a regression test that fails on 999d173fd and passes on this head.

Tests: the F3 combined list was 354/0 on 999d173fd. After the fix round and the refactor merge, 25 files that exercise the touched code and README readers: 195/0. Each file ran serially, with env -i.

Known follow-ups: defect l (do not press Restart bus after adding an agent that declares a credential), the bus restart refusal code, a stale-lock Recover control, and merging the banner Restart with the Settings Start into one control.

F3 (REQ-WEB-3), part of #1873: restart the Console, an organization's bus and its agents from the WebUI, and make the owner's settings writes (routing, agents, instances, name, assistant stop, limits, model proxy) on a selected organization's bus. What changed - Settings offers Console restart (supervised Consoles exit and `mosaic console start` relaunches them on the same arguments). - The bus-down banner offers Restart; `POST /api/orgs/<id>/restart/bus` answers with a done receipt. - Routing apply shows how a change reaches each saved agent, with Restart NAME now. - Each Console restart, bus restart, routing, agent and instance change appends one line to `<dataRoot>/console/actions.jsonl` (0600). Review: one Sol (gpt-6.1-sol xhigh) round, verdict CHANGES 1/0/1. - P1: on a `--dev-local-owner` Console a local agent can send the right Origin and Fetch Metadata headers and reach these controls. The pinned startup warning already says agents reach the loopback dev Console as owner, and the no-auth dev flags are an accepted ruling. The README falsely claimed otherwise; it now states the residual and names sign-in as the boundary. The cooperative local-agent peer refusal is follow-up #1883. - P3: the instances route did not write its trail line. Fixed, with a regression test that fails on 999d173fd and passes on this head. Tests: the F3 combined list was 354/0 on 999d173fd. After the fix round and the refactor merge, 25 files that exercise the touched code and README readers: 195/0. Each file ran serially, with env -i. Known follow-ups: defect l (do not press Restart bus after adding an agent that declares a credential), the bus restart refusal code, a stale-lock Recover control, and merging the banner Restart with the Settings Start into one control.

jason.woltje added 5 commits 2026-11-09 22:44:54 +00:00

feat(webui): restart the Console, the org bus and agents from the WebUI (F3) 1b6cac2bdf

Self-service operation from the WebUI, for a dev instance first.

- Settings > Console > Restart Console. A foreground `mosaic console
  start` now supervises the webui: the child exits 75 after answering a
  restart and the supervisor relaunches it with the same argv. Org buses
  keep running. /api/config carries a per-process boot id, so the open
  page polls until a new process answers and then reloads. A detached
  Console has no supervisor and answers 409.
- Restart bus on every "Restart needed" receipt and on the bus-down
  banner: POST /api/orgs/<id>/restart/bus restarts a running bus or
  starts a stopped one, then shows a done receipt with the time.
- Settings > Routing: after a save, the page lists how the change
  reaches each agent (next start, session end, thread idle) and offers
  "Restart <agent> now" for a running one. A session is terminated with
  the reason "route change" and launched again; a thread is terminated.
- Organization settings: the signed-in owner's settings, routing,
  agent, plug-in and Model proxy writes now reach the selected org's
  bus instead of answering 403. Org mode exists only under
  --dev-local-owner. Proxy setup stays a terminal step; a dev-only note
  names the two commands.

Every control needs the signed-in owner session, the page's exact
Origin and Sec-Fetch-Site: same-origin. The tester listener, granted
users, API tokens, agents and bus roles are refused before any work.
Each use is written to <dataRoot>/console/actions.jsonl (0600, no
symlinks) with who, when, what and the outcome. The Console and bus
restart trails fail closed. No change to credential handling, the
broker, the bus tenant boundary or v2 schemas.

Merge refactor 2bed0aebe into F3 (console restart, owner settings writes) e98909d907

Conflicts kept both sides: rename stage B organization paths and the
relative-launch re-exec with F3 imports, F2 onboarding script and the
north-star fence exemption with F3 console-restart.js and ORG_OWNER_WRITE,
and the /api/config fields from both.

Merge refactor fdd6658a6 into F3 (E2E5 fixes) 999d173fd4

app.js busDown conflict: refactor's order (org list read before
bus-status, E2E5 review P2) with F3's Restart the bus attachment on
the Bus unavailable banner.

fix(webui): F3 review round: instances trail line, honest dev-mode README 0a73279d62

The instances route now passes the owner trail note, so an organization
instance change appends the actions.jsonl line the README promises (P3).

The README claimed no agent reaches the F3 controls. On a dev local owner
Console that is false: every local request acts as the owner, which the
pinned startup warning already says. The README now states it and names
sign-in as the boundary; a local-agent peer refusal is a follow-up (P1).

Merge remote-tracking branch 'origin/refactor' into org-f3-merge a8f9f09573

jason.woltje merged commit a8f9f09573 into refactor

2026-11-09 22:45:01 +00:00

jason.woltje referenced this pull request

2026-11-09 22:46:04 +00:00

docs: BUILD-LOG and session line for organizations F3 (#1873) #1885

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: mosaicstack/stack#1884