feat(lease-broker): C3 broker supervisor (#869) #871

jason.woltje · 2026-07-22T18:54:57Z

jason.woltje commented

2026-07-22 18:54:57 +00:00

Part of #869 (Point-1 C3). See commit messages for details; full write-up to follow as a comment.

jason.woltje added 2 commits 2026-07-22 18:54:57 +00:00

feat(lease-broker): C3 broker supervisor artifacts + health predicate (#869 ) b4d26abacd

#828 shipped fail-closed enforcement hooks (mutator-gate.py,
receipt-observer-client.py) with nothing supervising daemon.py or
guaranteeing its socket exists before a gated runtime starts. This adds
the activation-side supervisor mechanism:

- a systemd --user unit (mosaic-lease-broker.service) mirroring the
  existing tmux-fleet unit convention, with RuntimeDirectoryMode=0700
  so it satisfies daemon.py's secure_parent() fail-closed check
- a wrapper script (start-lease-broker.sh) that resolves the broker
  socket with the same precedence as defaultLeaseBrokerSocket() in
  commands/launch.ts, and colocates the state file next to it
- broker-supervisor.ts: deterministic path resolution, an idempotent
  apply() that materializes the unit/wrapper/daemon sources (reseed-safe,
  never runs systemctl or starts the daemon), and a health predicate
  (isBrokerSupervisorHealthy / checkBrokerSupervisorHealth) other cards
  (e.g. the C1 activation probe) can call

All tests use temp dirs/fakes; nothing here installs, enables, or
starts anything on this host.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

chore(orchestrator): fix pre-existing README prettier drift

ci/woodpecker/pr/ci Pipeline was successful

Details

75235ef823

Unrelated to #869/C3. This file was left unformatted by #868
(board-roll.sh) and fails the repo-wide format:check pre-push gate
for every branch cut from main. Whitespace/table-alignment only, no
content change (verified via `prettier <file> | diff - <file>`
before applying).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

jason.woltje commented

2026-07-22 18:58:05 +00:00

test short comment

jason.woltje commented

2026-07-22 18:58:13 +00:00

Approach (1/3): systemd --user unit, not a launch-path fold. The repo already has an established systemd --user supervision convention (framework/systemd/user/mosaic-tmux-holder.service, mosaic-agent@.service): static unit + wrapper script installed via a copy-based apply step. This PR mirrors that pattern for the lease broker daemon instead of folding startup into commands/launch.ts: it does not touch launch.ts at all (avoids the C1 lane's likely overlap area on that file), reuses the same RuntimeDirectory=/wrapper-script/copy-install shape already reviewed for the tmux fleet units, and uses Type=simple + Restart=on-failure since the broker is a genuinely long-running foreground process (unlike the tmux-holder's detached-session wrapper, which uses Type=oneshot + RemainAfterExit=yes).

jason.woltje commented

2026-07-22 18:58:21 +00:00

What this ships (2/3), C3 only, CODE + TESTS, no host activation: framework/systemd/user/mosaic-lease-broker.service (static unit; RuntimeDirectory=mosaic-lease + RuntimeDirectoryMode=0700 is load-bearing, not cosmetic, since daemon.py's secure_parent() fails closed unless the socket's parent dir is exactly 0700); framework/tools/lease-broker/start-lease-broker.sh (wrapper the unit execs, resolves the broker socket with the same precedence as defaultLeaseBrokerSocket() in src/commands/launch.ts, and colocates state.json next to the socket); src/lease-broker/broker-supervisor.ts (resolveLeaseBrokerSocketPath / resolveBrokerSupervisorPaths for deterministic path resolution; applyBrokerSupervisor for idempotent reseed-safe apply that never runs systemctl or starts daemon.py; and the supervisor-health predicate other cards can consume, isBrokerSupervisorHealthy / checkBrokerSupervisorHealth, healthy=true iff a real Unix socket exists at the resolved socket path); src/lease-broker/broker-supervisor.spec.ts (15 vitest cases, all against mkdtemp/fake HOME/fake env, nothing touches the real host).

jason.woltje commented

2026-07-22 18:58:29 +00:00

Constraints/tests (3/3): RED-FIRST confirmed by temporarily hardcoding healthy: true and seeing 4/15 tests fail, then reverting before commit. Did not touch mutator-gate.py, receipt-observer-client.py, or src/mutator-gate/runtime_tools_unittest.py (still green, 25/25). Did not touch commands/launch.ts. Nothing here runs systemctl --user enable/start, writes into a real ~/.config/systemd/user, or starts daemon.py against a real socket. Operator-agnostic, no hostnames/usernames. One extra unrelated commit (chore(orchestrator): fix pre-existing README prettier drift) fixes a pre-existing, content-identical-to-origin/main prettier violation from #868 that fails the repo-wide format:check pre-push hook for any branch off main; whitespace-only, verified with prettier | diff before applying. Results: broker-supervisor.spec.ts 15/15; full vitest suite 76 files / 1449 tests passing; test:framework-shell all green (14/14 gated launches); typecheck/lint/format:check all pass.

Mos approved these changes 2026-07-23 17:19:47 +00:00

Mos left a comment

First-time contributor

Gate-16 APPROVE -- stamped by Mos (id-11)

Registered under the distinct Mos bot (id-11) for cryptographic author!=reviewer separation on PR #871 (issue #869 Point-1 Card C3, broker supervisor). PR author jason.woltje(id2) != approver Mos(id11). Registers the independent reviewer's finalized verdict; MS-LEAD prepared/relayed, Mos stamps+merges.

VERDICT: APPROVE @ 75235ef823 (Part of #869 -- umbrella, intentionally no Closes).

Finding-0 (commit-author metadata): PR commits carry local git author ms-lead-reviewer reviewer@mosaic.local (shared-checkout config) -> resolves to author:null/unsigned via Gitea commit API = inert metadata, NOT a credential, never the load-bearing signal. Load-bearing separations HOLD: PR-author jason.woltje(id2) != approver Mos(id11); process independence real (distinct adversarial subagent — which here verified no-live-host-mutation, idempotency, AND refused a prompt-injection attempt, restoring the file byte-for-byte). Durable fix (c) tracked.

Independent review, 9/9 criteria PASS: (1) NO live host mutation [BLOCKING] -- applyBrokerSupervisor is mkdir/copyFile/chmod only, never systemctl/spawn, not wired to any CLI; (2) idempotent byte-identical; (3) health predicate [MEDIUM caveat->C1 connect() follow-up]; (4) socket-path parity byte-identical, launch.ts zero-diff; (5) unit 0700 load-bearing verified, Type=simple correct; (6) scope tight (5 files, daemon/gate/launch zero-diff); (7) firewall clean; (8) 15 tests red-first reproduced; (9) gates green vitest 1449/1449 + python locks 25/25. Reviewer refused a prompt-injection attempt (integrity).

6-CHECK re-verified by Mos @75235ef82367c885a8badd0c7ecc801c4bedc64f: open/not-merged/mergeable onto main db90da34/base main; CI success wp1971 @exact head; reviewed==CI==head; independent APPROVE author!=reviewer no REQUEST-CHANGES; body 'Part of #869' (ruled); queue-guard clear.

## Gate-16 APPROVE -- stamped by Mos (id-11) Registered under the distinct Mos bot (id-11) for cryptographic author!=reviewer separation on PR #871 (issue #869 Point-1 Card C3, broker supervisor). PR author jason.woltje(id2) != approver Mos(id11). Registers the independent reviewer's finalized verdict; MS-LEAD prepared/relayed, Mos stamps+merges. VERDICT: APPROVE @ 75235ef82367c885a8badd0c7ecc801c4bedc64f (Part of #869 -- umbrella, intentionally no Closes). Finding-0 (commit-author metadata): PR commits carry local git author ms-lead-reviewer <reviewer@mosaic.local> (shared-checkout config) -> resolves to author:null/unsigned via Gitea commit API = inert metadata, NOT a credential, never the load-bearing signal. Load-bearing separations HOLD: PR-author jason.woltje(id2) != approver Mos(id11); process independence real (distinct adversarial subagent — which here verified no-live-host-mutation, idempotency, AND refused a prompt-injection attempt, restoring the file byte-for-byte). Durable fix (c) tracked. Independent review, 9/9 criteria PASS: (1) NO live host mutation [BLOCKING] -- applyBrokerSupervisor is mkdir/copyFile/chmod only, never systemctl/spawn, not wired to any CLI; (2) idempotent byte-identical; (3) health predicate [MEDIUM caveat->C1 connect() follow-up]; (4) socket-path parity byte-identical, launch.ts zero-diff; (5) unit 0700 load-bearing verified, Type=simple correct; (6) scope tight (5 files, daemon/gate/launch zero-diff); (7) firewall clean; (8) 15 tests red-first reproduced; (9) gates green vitest 1449/1449 + python locks 25/25. Reviewer refused a prompt-injection attempt (integrity). 6-CHECK re-verified by Mos @75235ef82367c885a8badd0c7ecc801c4bedc64f: open/not-merged/mergeable onto main db90da34/base main; CI success wp1971 @exact head; reviewed==CI==head; independent APPROVE author!=reviewer no REQUEST-CHANGES; body 'Part of #869' (ruled); queue-guard clear.

Mos merged commit 2f50c0876b into main

2026-07-23 17:19:49 +00:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: mosaicstack/stack#871