feat(console): dev-local-owner Console writes autonomy and restarts when detached (#1873) #1939

2026-11-11T20:20:13Z

jason.woltje commented

2026-11-11 20:20:13 +00:00

D1 (#1873, readiness audit P0-2 and P1-1): a --dev-local-owner Console can write as the owner, and Restart Console works on a detached Console.

A dev-local-owner Console passes send, so the owner writers it gates (autonomy and the rest) work: GET /api/orgs/<org>/autonomy reads writable:true and an owner save applies with a receipt.
A detached dev-owner Console runs under a supervisor, so Restart Console returns 202, the page comes back on the same port and the buses keep running.
console start --dev-local-owner refuses inside an agent run, including a sanitized ctx.env; a forced timeout kill no longer leaves start.lock behind.
Without --dev-local-owner nothing changes; tests pin it.

Policy boundary, per the dev no-sign-in rulings (unified-workspace ruling 13, LAN no-auth dev): on a dev-owner Console, any process that reaches the Console port acts as the owner over HTTP. The start-time agent refusal is cooperative. Deployed Consoles keep sign-in and send-mode rules.

Tests: new acceptance tests fail on BASE. Lane gate 312 files, 3107/0. Live devstack acceptance on f55fb2339 met every item.

Review: build (Opus) changes and security (daybreak-blue) changes, fixed in 59dd5f306; security re-check changes, fixed in f55fb2339 (each new test fails on 59dd5f306). Rebased onto 900daf521 (PR #1938): range-diff identical; shared files cli/src/cli.mjs and webui/src/cli.mjs. Lead check: 17 files after rebase onto 900daf521 (D1's tests, D2's org-recovery, org-revive, bus-revive, org-admin, autonomy-http and every cli/webui test that reads console-supervisor, org-console or dev-local-owner), 254/0.

Deferred: Restart offered after the supervisor dies stops the Console for good; no automated test that buses survive a Restart (live run covers it); the autonomy receipt's previous field is a host path (existing org service output).

D1 (#1873, readiness audit P0-2 and P1-1): a `--dev-local-owner` Console can write as the owner, and Restart Console works on a detached Console. - A dev-local-owner Console passes send, so the owner writers it gates (autonomy and the rest) work: `GET /api/orgs/<org>/autonomy` reads `writable:true` and an owner save applies with a receipt. - A detached dev-owner Console runs under a supervisor, so Restart Console returns 202, the page comes back on the same port and the buses keep running. - `console start --dev-local-owner` refuses inside an agent run, including a sanitized `ctx.env`; a forced timeout kill no longer leaves `start.lock` behind. - Without `--dev-local-owner` nothing changes; tests pin it. Policy boundary, per the dev no-sign-in rulings (unified-workspace ruling 13, LAN no-auth dev): on a dev-owner Console, any process that reaches the Console port acts as the owner over HTTP. The start-time agent refusal is cooperative. Deployed Consoles keep sign-in and send-mode rules. Tests: new acceptance tests fail on BASE. Lane gate 312 files, 3107/0. Live devstack acceptance on f55fb2339 met every item. Review: build (Opus) changes and security (daybreak-blue) changes, fixed in 59dd5f306; security re-check changes, fixed in f55fb2339 (each new test fails on 59dd5f306). Rebased onto 900daf521 (PR #1938): range-diff identical; shared files cli/src/cli.mjs and webui/src/cli.mjs. Lead check: 17 files after rebase onto 900daf521 (D1's tests, D2's org-recovery, org-revive, bus-revive, org-admin, autonomy-http and every cli/webui test that reads console-supervisor, org-console or dev-local-owner), 254/0. Deferred: Restart offered after the supervisor dies stops the Console for good; no automated test that buses survive a Restart (live run covers it); the autonomy receipt's `previous` field is a host path (existing org service output).

jason.woltje added 3 commits 2026-11-11 20:20:13 +00:00

feat(console): dev-local-owner Console writes autonomy and restarts when detached (#1873 ) 7ffe932250

A --dev-local-owner Console's organization pages read writable:false because
the per-org options had no autonomy writer and the route fell back to the
request transport, which org options never set. The org options now carry an
autonomy writer on the organization's console transport, fenced to the four
owner autonomy verbs. The route prefers it and keeps requestWrite otherwise.

mosaic console start --dev-local-owner --detach now runs the Console under a
detached supervisor, so Restart Console (exit 75) relaunches it on the same
address. A non-dev detached Console is unchanged. A deployed --sso --send
Console has no organization routes and keeps its root autonomy transport;
a test pins both.

fix(console): D1 review fixes for the detached dev-owner supervisor (#1873 ) 1947a056fb

Build review P2: the supervisor ignores a lost reply pipe and keeps
supervising. Security P2: a stop signal during start is held until the
start settles, and the CLI's start timeout signals the supervisor's
process group. Security P1 (part): console start --dev-local-owner
refuses inside an agent run. Tests cover review, confirm and reverse on
the org autonomy route; TOOLS.md and the webui README are corrected.

fix(console): D1 security re-check fixes for the dev-owner start (#1873 ) ebe2af86de

The agent-run refusal on a dev-local-owner start now checks the starting
process's own environment as well as the environment given for the
Console, so a caller cannot pass a clean env to get past it.

The start lock now names its holder (pid and start time). A detached
start that times out and kills its supervisor's process group clears the
lock only when it names that supervisor and the supervisor is gone, so a
forced kill no longer blocks every later start.

jason.woltje merged commit ebe2af86de into refactor

2026-11-11 20:20:16 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: mosaicstack/stack#1939