feat(org): starter pack org file keys and applyPack (SP3, #1873) #1950

2026-11-12T21:37:34Z

jason.woltje commented

2026-11-12 21:37:34 +00:00

Starter packs slice SP3 (#1873): org file keys packs, board and workflows, and the applyPack writer op. Design: docs/plans/2026-11-12_starter-packs-design.md section 8, under Jason's full send of 11-12 about 21:05Z.

Loader (organization-config.mjs): new top keys packs, board and workflows, and project keys board and workflows, which the project copy keeps.
- A board is the five store states once each, with labels and a kanban or list layout.
- Workflows are checked for shape only, so a step naming a removed role still loads.
- packs records each applied pack and its proposed-hire pins. An inline pin keeps its full role entry, and the pin is that entry's hash.
Writer (organization.mjs applyPack): one commit, all or nothing.
- The secret check is required on every call and scans the whole plan before anything reads it.
- Plan keys are allowlisted, and scope fences project keys.
- An agent that writes definitions refuses human-required.
- Workflow step roles must resolve to an org definition, a V2 template or human at write time.
- The commit guard keeps every other key, the existing definitions and the packs history unchanged.
No refusal codes added. Nothing in roles/ or contracts/.

Tests: starter-pack-keys.test.mjs, 15/0. The red-before case refuses unsupported business file key: "board" on BASE. The lane gate ran 139 files, 1828/1; the one failure is the known CHAT-01 base red in conversation reader.test.mjs, which also fails on c0a60ed3a. test-config.sh passed 55/0. The Lead check ran separately under env -i.

Reviews (fresh Opus delegates):

Build: changes 1, P2 fixed with a test that a definition a workflow names can still be removed.
Security: changes 1. P2-1 was that assertClean was optional for board and workflow text; it is now required on every call.
Security re-check of the fix: approve.

Deferred P3s:

the generic write() can still change board, workflows and packs, though no caller reaches it;
the agent-actor check ignores projects.<p>.agents, which setDefinition also does;
the packs list has no length cap.

Starter packs slice SP3 (#1873): org file keys `packs`, `board` and `workflows`, and the `applyPack` writer op. Design: `docs/plans/2026-11-12_starter-packs-design.md` section 8, under Jason's full send of 11-12 about 21:05Z. - Loader (`organization-config.mjs`): new top keys `packs`, `board` and `workflows`, and project keys `board` and `workflows`, which the project copy keeps. - A board is the five store states once each, with labels and a `kanban` or `list` layout. - Workflows are checked for shape only, so a step naming a removed role still loads. - `packs` records each applied pack and its proposed-hire pins. An inline pin keeps its full role entry, and the pin is that entry's hash. - Writer (`organization.mjs` `applyPack`): one commit, all or nothing. - The secret check is required on every call and scans the whole plan before anything reads it. - Plan keys are allowlisted, and scope fences project keys. - An agent that writes definitions refuses `human-required`. - Workflow step roles must resolve to an org definition, a V2 template or `human` at write time. - The commit guard keeps every other key, the existing definitions and the `packs` history unchanged. - No refusal codes added. Nothing in `roles/` or `contracts/`. Tests: `starter-pack-keys.test.mjs`, 15/0. The red-before case refuses `unsupported business file key: "board"` on BASE. The lane gate ran 139 files, 1828/1; the one failure is the known CHAT-01 base red in conversation reader.test.mjs, which also fails on c0a60ed3a. `test-config.sh` passed 55/0. The Lead check ran separately under `env -i`. Reviews (fresh Opus delegates): - Build: changes 1, P2 fixed with a test that a definition a workflow names can still be removed. - Security: changes 1. P2-1 was that `assertClean` was optional for board and workflow text; it is now required on every call. - Security re-check of the fix: approve. Deferred P3s: - the generic `write()` can still change `board`, `workflows` and `packs`, though no caller reaches it; - the agent-actor check ignores `projects.<p>.agents`, which `setDefinition` also does; - the `packs` list has no length cap.

jason.woltje added 3 commits 2026-11-12 21:37:34 +00:00

feat(org): packs, board and workflows keys and the applyPack writer op (starter packs SP3) 2af12340ae

The organization file gains packs, board and workflows, and each code
project gains board and workflows. The reader checks their shapes and keeps
them on the loaded organization and on projects[id]. A workflow step's roles
are checked for shape only at load; applyPack resolves them at write time
(org definition, V2 template or human). An inline proposed hire keeps its
full role entry beside its {inline, sha256} pin, bounded as a definition
entry is.

applyPack(id, plan, {revision, actor, assertClean}) writes definitions,
board, workflows, project boards and workflows and one packs entry in one
commit. It keeps setDefinition's definition rules, refuses an agent writing
a definition with human-required, and refuses any other plan key.

test(org): a definition a workflow names can still be removed (starter packs SP3 review P2) 9cfb5f64fe

fix(org): applyPack requires the secret check on every write (starter packs SP3 security P2-1) 1e65ff3f8b

A board, workflow or pack write without assertClean now refuses
definition-secret-check-required, and the scan covers every key and
string in the plan before the writer reads any of it.

jason.woltje merged commit 1e65ff3f8b into refactor

2026-11-12 21:37:37 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: mosaicstack/stack#1950