stack/agents/goldie/work/queue-323/BUILD.md

Row 323 / #1819 — Case 1 factory business file

Goldie, 2026-10-23. New isolated worktree /home/jwoltje/.t3/worktrees/mosaic-stack/goldie-row323, branch goldie/row323, base local refactor da537e7d159be0bf39a36eaaa65cd16c20373b72 (descends from brief commit 68f3bded5). Row322 worktree remains unchanged.

Sources and input boundary

Read brief docs/plans/2026-10-23_case1-business-file-brief.md, row195 DESIGN.md (host values sections1/2/6/7), installer factory HELPER, precheck profile checks, case1-accept F3/F7, business loader and credentials/launch checks, role definitions and business fixture helpers. No host access or credential read.

DESIGN fixes business mosaic-stack, OS user mosaic, home /srv/mosaic, config /srv/mosaic/.config/mosaic-dev, data /srv/mosaic/.mosaic-dev, Claude only, tester on. Human id is explicitly left to the go (:82/:300), no project root is named. Business loader requires at least one project/root (:261-275), tracker.sync bot/botId/Vikunja credential reference (:85-94), launch.models and nonempty launch.instances excluding launcher (:186-193). These host/business values are not supplied by DESIGN. Per sage-3815 and brief, stop configuration rather than guess. Asked Sage in goldie-0008 for exact values.

Recommended minimal role set: chief-of-staff instance chief with claude-code harness plus credential-free assistant solely because launch.instances must contain a declared non-launcher. Both arbiters may reference chief; no additional PM/CTO role credential required. This remains a recommendation pending input, not a written host config.

Literal top-level library is ignored by the installer plan and rejected later by business validation as unsupported key; a library project is refused by the factory plan as profile-library-business. Asked Sage which intended refusal assertion to use; recommend covering both through their real paths without a product change.

Authority and status

Sage-3815 explicitly authorizes claimant queue moves despite brief's generic no-queue-writes boundary. Claim op goldie-0323-start-1 retries every20s on lock contention per sage-3814; no lock touched. Tests and mutant require new Sage CLEAR; none run. No business JSON or test written yet. No commit/push yet. BUILD/SESSIONS/BUILD-LOG notes record investigation only.

Rulings and static blocker, 23:02Z

Sage-3820 accepts chief + credential-free assistant because launch.instances must be nonempty and exclude chief, both arbiters chief. It accepts literal library-key rejection through final real business validation and library-project rejection through factory planning, no production change. Sage-3822 supplies project mosaic-stack at /srv/mosaic/src/mosaic-stack and model claude-opus-5-5 (provider/thinking to be sourced). Sage-3823 relays Mos-1554: human jason, no real tracker bot, token path must be absent and never created; stop immediately if this refuses boot/launch.

Static trace proves refusal, reported to Sage in goldie-0009:

• cli/src/config.mjs:127 loads business. trackerFor :60 returns null without tracker.baseUrl; :137-138 suppresses only config.trackers, not business tracker.sync.
• bus/src/runtime.mjs:131 registers business tracker.sync credentials under business/@sync; :157 constructs Credentials regardless of config.trackers.
• bus/src/credentials.mjs:134-139 eagerly reads every reference. Ordinary ref.file lstat/realpath failure at :225-228 throws credential-file during boot, before chief can launch.
• The business credential check warns for unset env, but bus/src/credentials.mjs:268 sends undefined to #format; :278 rejects credential-format. An env reference is not a bypass and is outside the brief's file requirement.
• Install refuses even earlier: business/src/cli.mjs:84-88 checks tracker.sync references, business/src/credentials.mjs:78-83 records a missing ordinary file as a problem, CLI :95-97 exits2. case2-install.sh:217-220 wraps validate refusal and removes the business file it created.
• business/src/business.mjs:41 requires tracker bot names to begin bot-, :42 requires positive botId. Mos's illustrative no-bot-mosaic-stack-sync would fail that shape; a bot-no-bot marker still cannot solve the absent-file refusal.

Status: real fail-closed product boundary. No business JSON, test, placeholder credential, host action or tests written/run. Await Sage/Mos resolution; do not bypass by inventing a token or expanding product scope. Only investigation notes exist in this worktree. Claim attempts continue separately under the queue window's explicit retry instruction.

Resumed after Q247 landing — sage-3859

Current base is pushed dd6cb5872b972bcabb99b82589b2905e4e47dd3e. Preserved earlier investigation as a notes-only commit, then rebased onto that tip; only append-only BUILD-LOG/SESSIONS conflicts, resolved retaining the entire landed files and appending this row's original suffix. Earlier equivalent local refactor doc commits were skipped by git as already applied. No other row323 source existed before this resume.

Q247 removes the static blocker: this file now omits tracker entirely, with no dummy bot/token/reference. No tracker credential or token file is required or created. The separate Claude session login file remains the operator's run-sheet step, as described in DESIGN section3; this document contains no credential value or reference, and this work reads no credential.

Approved values and minimal role set:

• business mosaic-stack, factory bus.tester true, no library key/project (DESIGN sections1/2/7).
• human jason (Mos-1554, sage-3823); project mosaic-stack at /srv/mosaic/src/mosaic-stack (sage-3822).
• chief-of-staff chief and credential-free assistant, both arbiters chief, launch.by chief, launch.instances [assistant] (sage-3820). The loader requires nonempty launch.instances excluding the launcher (business.mjs:186-191), so a chief-only document cannot load. No other role is needed.
• Both roles use claude-code; plugins.harness enables only claude-code. No pi route or fallback.
• chief model claude-opus-5-5 is Sage's explicit choice (sage-3822). Provider anthropic/model claude-opus-5-5 is the repository model mapping at packages/business/README.md:185. There is no separate per-model default thinking catalog in the implementation: choose high from the Claude harness's supported LEVELS at packages/plugins/harness/claude-code/index.mjs:28, following the existing chief route convention at packages/cli/tests/session-launch.test.mjs:83. Both roles use that one declared model/effort; no extra model or capacity policy is introduced.

One new file packages/business/tests/case1-business-file.test.mjs has seven cases. It first loads the shipped JSON bytes unchanged from a temporary business-file location (loader checks shape, no host path access). Its runtime/CLI/install cases copy the document into a scratch input and replace only the project root with a scratch fixture root, per sage-3820's instruction to use test fixture paths. The real factory installer takes that input via --business-file and uses its real bootstrap/business validation, with only stack-copy stubbed (no clone/install/network). The boot case uses bootConfig + actual startBroker and asserts no tracker config or credential status. Negative cases cover bus.tester false (bus-tester-off), literal library (final validate unsupported key, per sage-3820), and a library project (factory plan profile-library-business). No pre-existing test changed.

The new tester-switch mutant flips only bus.tester in the shipped JSON, targets the new exact-document assertion, then restores/checks bytes in finally. Prepared but not run. Tests and mutant remain held until Sage CLEAR; only syntax/diff/static JSON checks have run. Row323 claimant is still in-progress from rev3749.

Field provenance and pre-test commit — sage-3861

Sage-3861 CLEAR explicitly requires committing the draft before any run, so test counts attach to a commit. This is a specific exception to the usual green-before-commit rule. Until recorded below, this commit is untested. No old test is modified.

Document field	Value and source
businessVersion	1, business loader's version requirement (business/src/business.mjs:233). Schema value, not a mos-1554 host choice.
id	mosaic-stack, row195 DESIGN section7 (sage-1813), restated by row323 brief.
human	jason, mos-1554 relayed by sage-3823.
arbiters.delivery / arbiters.technical	chief / chief, sage-3820's explicit minimal-role ruling; both reference the chief-of-staff definition.
projects.mosaic-stack.root	/srv/mosaic/src/mosaic-stack, sage-3822's explicit project-id/root decision. DESIGN supplied /srv/mosaic as home but did not supply this root.
vars.bus.tester	true, DESIGN section2 factory profile and installer bus-tester-off requirement.
plugins.harness	[claude-code], brief's Claude-only/P19 mos-0865 boundary and DESIGN section3.
roles.chief.definition	chief-of-staff, brief/roles/chief-of-staff.json; no credential or tracker bot.
roles.assistant.definition	assistant, sage-3820 acceptance of this one extra credential-free role, required because launch.instances must be nonempty and exclude chief.
roles.*.vars.harness	claude-code for both; same Claude-only rule, no fallback route.
roles.*.vars.model	claude-opus-5-5 for both, chief model explicitly chosen in sage-3822; reuse the single declared model for assistant to avoid adding another model decision.
roles.*.vars.thinking	high, supported effort in packages/plugins/harness/claude-code/index.mjs:28; existing chief convention packages/cli/tests/session-launch.test.mjs:83. The repository has no per-model default-effort catalog; this is an explicit supported-convention choice, not an invented catalog default.
launch.by	chief, brief and F7's requirement to name the chief launch; sage-3820.
launch.instances	[assistant], sage-3820 and business.mjs:186-191's nonempty/non-launcher rule.
launch.models.claude-opus-5-5.provider / model	anthropic / claude-opus-5-5, repository model mapping packages/business/README.md:185 and sage-3822. The model id is also the map key so no extra alias is introduced.
Omitted tracker / credentials / library	Q247/mos-1555 and sage-3859 supersede mos-1554's proposed absent-token placeholder; no bot, token path, credential value or library project/key is present.

Only human=jason is a literal field value supplied by mos-1554. The no-bot intent also comes from mos-1554; Q247 implements it by omission. Other fields deliberately cite the actual design/schema/Sage source rather than attributing them to mos-1554.

Planned runs under sage-3861: new file whole; business suite whole; CLI suite whole; tester-switch mutant; restored new file whole. Fresh scratch TMPDIR and timeout-k10 for each, one process at a time. Existing-test red or any additional old-test edit stops work; first-run new red is recorded and reported. Push remains own branch goldie/row323 after the test sequence/report evidence is concrete.

First slot result — stopped on existing CLI test red

Committed draft before any test: 571376c30e77f46bbe41069633390cc001f57ac8 (base dd6cb5872b), per sage-3861. Fresh TMPDIR /mnt/storage/scratch/tmp/goldielKvBJv, allocated by mktemp under the mandated scratch parent. All runs serialized with timeout -k 10. Source and test bytes remained unchanged throughout.

Run	Command after TMPDIR/timeout	Outcome
New whole file	timeout -k 10 180 node --test --test-reporter=tap packages/business/tests/case1-business-file.test.mjs	7/7 pass, 0 fail/skip/cancel; test-new.log
Whole business suite	timeout -k 10 600 node --test --test-reporter=tap --test-concurrency=1 packages/business/tests/	261/261 pass, 0 fail/skip/cancel; test-business-suite.log
Whole CLI suite	timeout -k 10 1200 node --test --test-reporter=tap --test-concurrency=1 packages/cli/tests/	Interrupted on existing-test failure; 631 top-level passes/1 failure recorded before termination, no final full-suite totals; test-cli-suite.log
Tester-switch mutant	Not run	Stop rule reached first
Restored new file	Not run	Mutant not run; source already matches manifest

Existing failure: CLI test579, packages/cli/tests/revoke-window.test.mjs:170: row 306 REQ-LAUNCH-1 R4 a revoked run whose call lands before the SIGTERM ends stopped/0; a run the human stopped in the same window still ends session-invalid/22. After 20111.683685ms it failed no RESULT on 61c275d4-42f9-4a92-8a43-1ae94c25b730, ask assertion at167, Promise.all index1, test at194. This file has no changes from base. No cause or flakiness claim is established.

On observing the red in the suite log, sent SIGTERM to this run's verified timeout process; the suite ended exit1 with Interrupted while running: packages/cli/tests/stack-release-external.test.mjs (it had progressed while output was being inspected). One remaining process was positively identified by an argument under this exact scratch TMPDIR and cleaned with SIGTERM; no live host process/state touched. No further tests or reruns, no old test changes.

Reported immediately to Sage as goldie-0016, returned slot, requested the bounded investigation/retry ruling. JSON/new-test manifest still verifies. Candidate is not verified/ready for review and has not been pushed as such. These failure notes/logs remain local evidence until Sage's ruling; no mutant acceptance claim.

Mos-1560 isolated rerun — second red, stopped

Sage-3864 CLEAR authorized three whole-file revoke-window runs on unchanged571376c30, followed only on three passes by CLI/mutant/restored runs. Every run had to begin with date -u, uptime and the last line of sage-busy-now.sh. Only run1 occurred; it failed, reaching the second-red stop condition.

Log: revoke-window-run-1.log. Exact start/load lines:

Sat Oct 24 00:24:22 UTC 2026
 19:24:22 up 10 days, 10:44,  2 users,  load average: 1.46, 1.68, 2.70
CLEAR
TMPDIR=/mnt/storage/scratch/tmp/goldieBObDQ9

Command: TMPDIR=<fresh mktemp above> timeout -k 10 180 node --test --test-reporter=tap packages/cli/tests/revoke-window.test.mjs.

Whole file result: 0/1 pass, 1 failure, exit1, no skips/cancellations. Same unchanged row306 R4 test at revoke-window.test.mjs:170 failed after20126.967034ms: no RESULT on dc4ccc94-4d08-4da1-bc66-2f4fcfc098dc, ask167, Promise.all index1, test194. No edits, no run2/3, no full CLI rerun, no mutant/restored run. No remaining process with this exact run's scratch path was found after the file finished. Manifest still matches. This proves repeat failure under the recorded CLEAR/load conditions, not a root cause.

Reported to Sage as goldie-0018 with full log path, time/load/busy lines, test and error. Slot returned; holding for root-cause assignment/ruling on base dd6cb5872. Remote goldie/row323 stays the unverified draft571376c30; post-run failure evidence remains local. All row323 product/test sources are still exactly those committed before the first slot.

Root cause correction and accepted evidence — mos-1561, sage-3869

The repeated revoke-window red was caused by TMPDIR length, not Codex. Sage identified and reproduced it (sage-3869; recorded in their local dda2d07b4): newRun rejects a tools.sock path exceeding107 bytes at packages/seat/src/session.mjs:278. The 37-byte /mnt/storage/scratch/tmp/goldieXXXXXX combined with revoke-window's fixture root produces109 bytes, while Sage's35-byte prefix fits107. The test drops the launcher refusal log, so the symptom was a20s no-RESULT wait. The detached base dd6cb5872 also failed0/1 after20106.869486ms with long TMPDIR (log copied as revoke-window-detached-base.log). Prior messages attributing the difference to an unspecified environment are superseded by this diagnosis; no product/old-test fix is needed for row323.

From now on every suite uses export TMPDIR=$(mktemp -d /mnt/storage/scratch/tmp/XXXXXX) (31bytes). Under sage-3869 CLEAR, all source/test bytes remained exactly571376c30; each run got its own fresh31-byte TMPDIR and began with date-u, uptime, and busy-helper's last line:

Run / log	UTC start	Load averages	Busy	Result
revoke-window-short-tmp.log	2026-10-24 00:36:41	1.01,1.34,1.91	CLEAR	Whole file1/1 pass; test703.937594ms, file838.51754ms; TMPDIR lCsnmg
test-business-short-tmp.log	2026-10-24 00:36:50	1.08,1.35,1.91	CLEAR	Whole suite261/261 pass, 6415.261266ms; TMPDIR flQGnB
test-new-short-tmp.log	2026-10-24 00:37:03	1.37,1.40,1.92	CLEAR	Whole new file7/7 pass, 611.516605ms; TMPDIR HNhoti
mutant-driver.log + mutant.log	2026-10-24 00:37:12	1.38,1.41,1.92	CLEAR	Mutant killed: targeted exact-document test0/1, expected exit1; driver exit0; TMPDIR XAmmxp
test-new-restored.log	2026-10-24 00:37:25	1.61,1.46,1.93	CLEAR	Restored new file7/7 pass, 616.699665ms; TMPDIR IVLOcQ

All TMPDIRs above are under /mnt/storage/scratch/tmp/. Every run used timeout-k10 (180s limit, business suite600s), one run at a time. Positive runs have0 failures/skips/cancellations. These are fresh accepted row323 results on committed571376c30. No full CLI rerun was authorized or performed: under mos-1561, Sage's landing gate supplies the CLI suite acceptance/counts, while Goldie's evidence is the business suite, new file and mutant. The earlier partial CLI log remains diagnostic evidence, not a passing-suite claim.

Required tester-switch mutant:

-    "bus.tester": true
+    "bus.tester": false

It fails the new committed-document assertion at case1-business-file.test.mjs:66 (false !== true). mutant.py restores exact original bytes in finally; restored JSON SHA256 85e6b9ac62785734fb9d854ea70ea550e171b5060b5cad0417e2f42f0b60c59e. Both manifest entries verify after restoration, and the whole new file passes again. No pre-existing test or production source changed. git diff --check passes.

Committing these notes and preserved logs is evidence-only on top of the tested571376c30. The product manifest remains the same two paths/digests. Duckworth's static review and Sage's integration/full gate remain their authority. Logs have trailing whitespace removed for git diff --check; substantive output/results are unchanged. Earlier stopped runs remain recorded honestly above and in their logs.