mosaicstack/stack
1
0
Fork 0
Code Issues 42 Pull Requests Actions Packages Projects Releases 15 Wiki Activity

feat(agent): add Matrix native runtime provider #744

Merged
jason.woltje merged 1 commits from feat/tess-matrix-provider into main 2026-07-13 15:29:38 +00:00
Conversation 1 Commits 1 Files Changed 7 +1231
jason.woltje commented 2026-07-13 15:09:01 +00:00
Owner
Copy Link

Summary

  • add MatrixNativeRuntimeProvider behind the common AgentRuntimeProvider contract
  • add concrete Matrix CS-API native transport with authenticated whoami checks, configured session-to-room bindings, idempotency-derived transaction IDs, scoped metadata, and replay-cursor event normalization
  • add shared tmux/fleet ↔ Matrix/native parity suite over the migration-safe contract intersection
  • keep Matrix non-default: no gateway, Discord, or provider-registry wiring is changed

Security boundaries

  • clients cannot select Matrix rooms; only configured bindings resolve session IDs
  • configured local identity is verified with whoami; inbound events require configured remote identity
  • read/control/write authority remains default-deny; attachments bind to immutable scope

Verification

  • TURBO_FORCE=true pnpm typecheck
  • TURBO_FORCE=true pnpm lint
  • TURBO_FORCE=true pnpm format:check
  • TURBO_FORCE=true pnpm test (42 tasks)
  • Codex code/security reviews: no findings

Closes #711; implements TESS-M5-001 / TESS-TRN-001.

## Summary - add MatrixNativeRuntimeProvider behind the common AgentRuntimeProvider contract - add concrete Matrix CS-API native transport with authenticated whoami checks, configured session-to-room bindings, idempotency-derived transaction IDs, scoped metadata, and replay-cursor event normalization - add shared tmux/fleet ↔ Matrix/native parity suite over the migration-safe contract intersection - keep Matrix non-default: no gateway, Discord, or provider-registry wiring is changed ## Security boundaries - clients cannot select Matrix rooms; only configured bindings resolve session IDs - configured local identity is verified with `whoami`; inbound events require configured remote identity - read/control/write authority remains default-deny; attachments bind to immutable scope ## Verification - `TURBO_FORCE=true pnpm typecheck` - `TURBO_FORCE=true pnpm lint` - `TURBO_FORCE=true pnpm format:check` - `TURBO_FORCE=true pnpm test` (42 tasks) - Codex code/security reviews: no findings Closes #711; implements TESS-M5-001 / TESS-TRN-001.
jason.woltje added 1 commit 2026-07-13 15:09:01 +00:00
feat(agent): add Matrix native runtime provider
All checks were successful
ci/woodpecker/pr/ci Pipeline was successful
Details
b4fcf139a7
jason.woltje commented 2026-07-13 15:20:08 +00:00
Author
Owner
Copy Link

VERIFIED APPROVE reviewer-of-record [W-jarvis:reviewer] head b4fcf139a7

Reviewed exact live head b4fcf139a73678e9e59c8f6b63c108c095a87b3a; Woodpecker pipeline 1776 is SUCCESS for that commit.

Findings:

  • Scope is limited to packages/agent + packages/mosaic and two barrel exports. No gateway, Discord, or runtime-registry wiring changed, so Matrix is not promoted/defaulted in this PR.
  • MatrixNativeRuntimeProvider implements the normalized AgentRuntimeProvider shape and declares only concretely wired runtime ops (session.list/tree/stream/send/attach/terminate). Matrix room/event/credential mechanics stay transport-local.
  • Authority boundaries are fail-closed: default read/write authorities deny, writes require both preflight and exact authorization, read attachments are immutable-scope-bound, and control attach is rejected before transport verification.
  • The parity suite runs the same contract scenarios against both existing tmux/fleet and Matrix/native fixtures (it.each(fixtures())): shared capabilities/list shape, empty send rejection before transport, empty termination approval rejection before transport, and read-only attach + cross-scope detach denial.
  • MatrixNativeRuntimeTransport is concrete Matrix CS API code: HTTPS homeserver validation, configured session→room bindings only, whoami configured-user checks before ops, deterministic idempotency-key-derived transaction IDs, trusted scope metadata in outbound events, and stream filtering to the configured remote identity/session.
  • apps/gateway/src/commands/command-authorization.service.ts is byte-identical to main, hash a9f829e7ecec721c6c585fe0da56fb5d6a6441e9.
  • No live credentials or hardcoded Tess identity found; test-token is test fixture data. Transport errors do not include token values.

No merge performed by reviewer.

Marker: ROR-744-VERIFIED-APPROVE-b4fcf139

VERIFIED APPROVE reviewer-of-record [W-jarvis:reviewer] head b4fcf139a73678e9e59c8f6b63c108c095a87b3a Reviewed exact live head `b4fcf139a73678e9e59c8f6b63c108c095a87b3a`; Woodpecker pipeline `1776` is SUCCESS for that commit. Findings: - Scope is limited to `packages/agent` + `packages/mosaic` and two barrel exports. No gateway, Discord, or runtime-registry wiring changed, so Matrix is not promoted/defaulted in this PR. - `MatrixNativeRuntimeProvider` implements the normalized `AgentRuntimeProvider` shape and declares only concretely wired runtime ops (`session.list/tree/stream/send/attach/terminate`). Matrix room/event/credential mechanics stay transport-local. - Authority boundaries are fail-closed: default read/write authorities deny, writes require both preflight and exact authorization, read attachments are immutable-scope-bound, and control attach is rejected before transport verification. - The parity suite runs the same contract scenarios against both existing tmux/fleet and Matrix/native fixtures (`it.each(fixtures())`): shared capabilities/list shape, empty send rejection before transport, empty termination approval rejection before transport, and read-only attach + cross-scope detach denial. - `MatrixNativeRuntimeTransport` is concrete Matrix CS API code: HTTPS homeserver validation, configured session→room bindings only, whoami configured-user checks before ops, deterministic idempotency-key-derived transaction IDs, trusted scope metadata in outbound events, and stream filtering to the configured remote identity/session. - `apps/gateway/src/commands/command-authorization.service.ts` is byte-identical to main, hash `a9f829e7ecec721c6c585fe0da56fb5d6a6441e9`. - No live credentials or hardcoded Tess identity found; `test-token` is test fixture data. Transport errors do not include token values. No merge performed by reviewer. Marker: ROR-744-VERIFIED-APPROVE-b4fcf139
jason.woltje merged commit 6345dbfcf2 into main 2026-07-13 15:29:38 +00:00
jason.woltje deleted branch feat/tess-matrix-provider 2026-07-13 15:29:38 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
fleet-enhancement
Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
jason.woltje
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#744
Delete Branch "feat/tess-matrix-provider"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?