252 lines
16 KiB
Markdown
252 lines
16 KiB
Markdown
# Row 206 build notes (Launchpad): 193b2, thread shares (#1704)
|
|
|
|
Brief: docs/plans/2026-10-20_human-users-build.md, "Brief: 193b2, thread shares (schema 3l)"
|
|
(blob de3a6310b). Design: agents/morgana/work/queue-193/DESIGN.md at e2d161e2e (sha256 dd7fcb41…),
|
|
sections 4.3, 5.2-5.6 and 8. Reviewer: Duckworth. Assignment: sage-2789.
|
|
|
|
## Base and chain
|
|
|
|
- Started on aca16404c (sage-2789) on branch launchpad/row206; 631a256ba pushed there (sage-2854).
|
|
- Round 2: rebased onto Morgana's 275 r3, 957a9bfe0 (morgana-0143, which carries duckworth-0166
|
|
B1), on the new branch launchpad/row206-r275. No force push of the old branch.
|
|
- Round 3 (C3): 253 landed at 48e450ce8. Morgana rebased 275 onto it as morgana/row275-48e4, tip
|
|
3410df7c3 (morgana-0144, range-diff `=` for all three). 206 is rebased onto 3410df7c3 as
|
|
launchpad/row206-48e4. Range-diff against the round 2 commits is `=` for all five, and the 22
|
|
manifest blobs equal round 2's (e4dba2a84). C3 sweep: outside agents/ and docs/, 253 changed
|
|
BUILD-LOG.md, packages/cli/tests/{case-sudo-fixture.mjs, case1-accept.test.mjs,
|
|
case2-unit.test.mjs}, packages/webui/README.md and scripts/{case1-accept.sh, case2-unit.sh}.
|
|
None is a 275 or 206 path, and no bus test, stack-release.test or stack-release.sh reads them.
|
|
- Round 4 (slot rebase, sage-2959): 275 landed, then 269 (efcc9ea8d) and 282 (647424442), and
|
|
refactor is 17f415792. 206 is rebased onto it as launchpad/row206-17f4. 275's three commits drop
|
|
out as already applied, and the seven 206 commits apply clean. Sweep 3410df7c3..17f415792 over
|
|
packages/ and scripts/: broker.mjs (269: the launcher's `#threadRows` reads one row per session,
|
|
and `idle`; no share, read or grant code), sessions.test.mjs (269: `refusedOnce` checks
|
|
actor_run; 206's hunks are the three '3l'→'3m' pins at T7 and engine3k, which still apply),
|
|
end-launch.test.mjs, cli launcher and session-launch tests, seat session and sandbox, and tasks
|
|
requirements. None reads a share table or the schema version. schema.sql, store.mjs, the
|
|
migration tests, schema.test, stack-release.sh and stack-release.test are unchanged since 48e450ce8,
|
|
so SCHEMA_VERSION on refactor is still '3l', the label 3l→3m stands, the table and trigger pins
|
|
and COUNTED/LISTED lists stand, and fixtures/schema-3l.sql still equals refactor's schema.sql
|
|
byte for byte. engine3k's strip regex starts at 264a's step comment and ends at the list's close,
|
|
so it cuts 206's step too, as before.
|
|
- 275 gives `VIEWER_VERBS`, `userLevel(verb)` and verb-aware `#granted`/`#grantedThread`, and
|
|
`#userGrants` keeps a live grant of any level, so a viewer binds. On the rebase:
|
|
- USER_VERBS keeps 275's block and gains the three share verbs. They are not in VIEWER_VERBS,
|
|
so `userLevel` asks collaborator and a viewer is refused each `access-refused` (design 4.3).
|
|
- `#threadRead`'s owner path passes `thread.messages` to `#grantedThread`, so a viewer owner
|
|
reads its own thread at the viewer level (duckworth-0169 C1). Share and unshare pass `verb`;
|
|
shares passes `thread.shares`.
|
|
- Two conflicts, both in broker.mjs: the USER_VERBS block and the `thread.messages` line (275's
|
|
`#grantedThread(s, 'thread.messages', #thread(...))` gives way to `#threadRead`, which now
|
|
holds that check). user-principal.test.mjs merged clean.
|
|
- C2 sweep on 957a9bfe0: 275 touches agents/morgana/work/queue-275/BUILD.md, broker.mjs,
|
|
user-principal.test.mjs and viewer.test.mjs. Overlap with 206 is broker.mjs and
|
|
user-principal.test.mjs, both handled above. viewer.test.mjs has no schema-version or hash
|
|
pins, and its "every verb off the user list" test reads USER_VERBS, so the share verbs drop
|
|
out of it on their own.
|
|
- The live `--migrate` (3l→3m on the running bus) is not part of this build. It is Mos's go under
|
|
Q173, with a backup first and a STATE report after (mos-1310 item 4).
|
|
|
|
## What changed
|
|
|
|
- Schema 3l→3m. `thread_shares` as design 5.2, its index and three append-only triggers, in
|
|
schema.sql and in the new step `src/migrations/3l-3m.sql` with the same SQL text. SCHEMA_SHA256
|
|
d5ca9bb9268994b175ac79d38939be4bb7f2e80bc0d9ea273eedaae50c29b8a9, SCHEMA_VERSION 3m.
|
|
`tests/fixtures/schema-3l.sql` is the 3l schema.sql (sha256 cd68512212ce…).
|
|
- `thread_shares` joins `timedTables` (store.mjs), the broker's clock list, `COUNTED` in
|
|
scripts/stack-release.sh and `LISTED` in stack-release.test (T46). It has `at`, so it goes in
|
|
the counted list, not the untimed one.
|
|
- broker.mjs:
|
|
- `#readable(s, t)` holds rules 1-4 of design 5.4. `#shared` reads the latest row per thread and
|
|
target. `#covered` reads the access document once per call and covers nothing on a read
|
|
failure, as `#userGrants` does.
|
|
- `#threadRead` admits the owner (with `#grantedThread`) or `#readable`, and serves only
|
|
`thread.messages`. `#thread` keeps the owner check for every write verb.
|
|
- `thread.share`, `thread.unshare`, `thread.shares` (design 5.3). `thread.list {shared:true}`
|
|
adds `owner`; the plain list keeps its shape (5.5).
|
|
- `replies` leaves out user thread messages except those in threads `#readable` admits.
|
|
`trail` needed no change: it already filters through `#hiddenMessage`, which calls `#readable`.
|
|
- USER_VERBS gains the three share verbs. `thread.shares` joins `#processingGate`'s read list.
|
|
- packages/bus/README.md: the verb rows, a "Thread shares" section, and the schema line (v3m, the
|
|
new sha, 23 tables, 90 triggers). schema.test counts 89 triggers because it drops one first.
|
|
|
|
## Choices and departures (for Sage and Duckworth)
|
|
|
|
1. Label 3l→3m, not 3i-3j (design) or 3l (brief title). 264a took 3k-3l, and labels go by
|
|
landing order (sage-2789).
|
|
2. A share covers every session of the thread, and `session.list` stays owner-only (sage-2818
|
|
Q1, from Sage's Q7 ruling, agents/sage/work/queue-264/RULINGS.md:72-77). broker.mjs keeps its
|
|
"no shares (Q7)" refusal: a sharee reads any session it can name but can't list them. A test
|
|
holds the refusal (human `thread-not-owned`, reader `read-only`, user `access-refused`).
|
|
**Follow-up**, bound to whichever of row 193 or the share wiring lands second: wire the sharee's
|
|
`session.list`. The bar is T1 sessions line 7 and REQ-USER-4 (candidate PRD 1509c7cc5,
|
|
docs/prd/mosaic-stack.md:1027-1052): read-only, and it needs current grants, the thread
|
|
owner's included.
|
|
3. A reader session matches shares as the business human (sage-2818 Q2: accepted, for the human
|
|
principal only). Design 4.3 says reader sessions "stay owner-only", and 5.5 says "messages in
|
|
other users' unshared threads hidden" for human, reader and tester. The reader sees what the
|
|
owner sees, shares to the owner included. Q2 also found a gap in the first tip (16b9c6df6): an
|
|
agent session has no owner, but it matched a `*` share, so a shared user message showed in an
|
|
agent's trail. `#readable` now returns false unless the session is the business human, a
|
|
reader or a user. A test binds an assistant run to the shared thread and a chief run with no
|
|
thread, and checks that neither (nor the tester) sees the message after a `*` share and a share
|
|
to the owner.
|
|
4. Access is read per request (sage-2818 Q3). Design 5.6's "30 s timer" and `access.reload` have
|
|
no path at this base: runtime.mjs:263 passes `access: () => loadAccess(file, context)`, read on
|
|
every request. The tests cover the per-request read (removed, expired, out of scope and
|
|
unreadable), which is the stricter case.
|
|
5. Rule 3 asks the owner's grant for any level, like rule 2 (design: "still has a live grant
|
|
covering t"). A user owner lowered to viewer keeps the thread readable to its sharees.
|
|
6. An unshare checks no coverage, so an owner can end a share whose target lost its grant.
|
|
7. `thread.shares` for a user goes through `#grantedThread` at the collaborator level, like share
|
|
and unshare, so a viewer is refused it. Design 4.3 lists shares as "refused" for viewers.
|
|
|
|
## Tests
|
|
|
|
New: tests/thread-shares.test.mjs, 16 tests: the read flow and the write refusals, `*`, rule 2,
|
|
rule 3 (with trail for human and reader), latest-row state, share-not-covered, target checks,
|
|
lost owner coverage, tester and reader refusals (18 `action.refused` events, no rows), trail and
|
|
replies, sessions, the sharee's `session.list` refusal (Q1), agents and the tester matching no
|
|
share (Q2), the viewer column (C1: a viewer reads a share, its share verbs refuse,
|
|
and a viewer target binds and reads), the 3l→3m migration and the 3l engine's refusal of a 3m store.
|
|
|
|
Pins moved 3l→3m: account-, chief-of-staff, comment-, gitea-, grant-, name-, spec-, usage- and
|
|
thread-migration, sessions, schema (23 tables, 89 triggers) and user-principal (USER_VERBS).
|
|
The engine copies in account-, gitea-, grant- and comment-migration gain 3l-3m.sql;
|
|
comment-migration's future step becomes 3m→3n. `later3l` in account-, gitea- and grant-migration
|
|
also leaves out `thread_shares` objects, and the gitea and grant `rows()` lists leave out the
|
|
table, since each compares a store migrated through 3m against an older one.
|
|
|
|
## Mutants (design section 8 numbers)
|
|
|
|
Each runs on a copy of the candidate tree with one edit, under `timeout -k 10 300`. The named
|
|
test must fail on an assertion; a thrown error or a refusal before the assertion doesn't count.
|
|
|
|
- M2. In `#readable`, delete the rule 2 line (`if (s.user && !this.#covered(s.user, ...)) return
|
|
false;`). Killed by "mutant 2: a share never widens a grant" (bob reads after his grant moves to
|
|
p2) and by the `*` test (carol reads).
|
|
- M3. In `#readable`, delete the rule 3 line. Killed by "mutant 3" (the human reads A after
|
|
alice's grant is removed).
|
|
- M4. In `#shared`, replace the latest-row lookup with any share row:
|
|
`SELECT op FROM thread_shares WHERE thread=? AND target=? AND op='share' LIMIT 1`. Killed by
|
|
"mutant 4" (bob still reads after the unshare).
|
|
- M7. In `thread.send`, replace `this.#thread(s, a.thread)` with `this.#threadRead(s, a.thread)`.
|
|
Killed by the first test (bob's send to A must refuse `thread-not-owned`).
|
|
- M8. In `thread.share`, delete the `share-not-covered` line. Killed by "mutant 8" (the share
|
|
to user:carol must refuse).
|
|
- M9. In `thread.share`/`thread.unshare`, replace `this.#thread(s, a.thread)` with
|
|
`this.#threadRow(s, a.thread)`. Killed by the first test (bob's share of A to `*` must refuse).
|
|
- Q2 probe (not a design mutant). In `#readable`, delete the human-principal line
|
|
(`if (!s.human && !s.reader && !s.user) return false;`). Killed by "only a human principal
|
|
matches a share" (the agent's trail shows the message after the `*` share).
|
|
|
|
## Run limits
|
|
|
|
From 264's table (agents/gizmoduck/work/queue-264/BUILD.md, Run limits), each at least 3x the
|
|
longest recorded run. A timeout with no failed test goes to Sage first; a timeout in the shell
|
|
phase goes to Mos unplaced (mos-1275).
|
|
|
|
| Run | LIMIT |
|
|
|---|---|
|
|
| stack-release.test alone | 1800 s |
|
|
| each other touched file alone | 300 s |
|
|
| bus suite | 900 s |
|
|
| cli suite | 1800 s |
|
|
| each scripts/test-*.sh | 900 s |
|
|
| each mutant probe | 300 s |
|
|
|
|
## Review
|
|
|
|
- Manifest aca16404c..631a256ba: APPROVE, no blockers (Duckworth, duckworth-0169, 16:57Z,
|
|
note agents/duckworth/work/row206/REVIEW-manifest-631a256ba.md on duckworth/reviews 84458606d).
|
|
Static only. Departures 1-7 accepted. Departure 1: whichever of 206 and row 271 lands second
|
|
relabels its step. Departure 4: the 30 s timer and `access.reload` case binds the row that adds
|
|
`access.reload` (193c).
|
|
- Conditions for the 275 rebase round:
|
|
- C1, design 4.3's viewer column: share, unshare and shares each refuse a viewer; a viewer
|
|
reads a thread shared with it; `#threadRead`'s owner path passes `thread.messages` to 275's
|
|
verb-aware `#grantedThread`.
|
|
- C2: rerun the drift and pin sweeps on the rebased base (253 and 275 touch broker.mjs; 275
|
|
also touches the user-principal USER_VERBS pin).
|
|
- Notes, no change asked: N1 `#readableThreads` binds a reader's owner as NULL (harmless); N2
|
|
replies reads the access file once per shared thread; N3 a share to a user absent from `users`
|
|
is stopped only by coverage; N4 the gate evidence goes in "Runs" below before in-review.
|
|
- Round 2 on d4fbce501 (rebased on 275 r3 957a9bfe0): C1 and C2 met, round 1 APPROVE carries
|
|
(Duckworth, duckworth-0175, 17:32Z, note agents/duckworth/work/row206/R2-C1C2-d4fbce501.md on
|
|
duckworth/reviews cd0fb90e2). 4ae94c5c9 is patch-identical to 631a256ba; manifest 22 paths.
|
|
- C3, for the post-253 rebase: rerun the drift and pin sweep against 253's tip, and push the
|
|
branch so the manifest is read from the pushed tip. N4 still applies.
|
|
- Round 3 on 670658dd1 (rebased on 275 at 3410df7c3, on 253's 48e450ce8): C3 met, approve
|
|
carries (Duckworth, duckworth-0179, note agents/duckworth/work/row206/R3-C3-670658dd1.md,
|
|
01f29379b). Pushed as launchpad/row206-48e4 at 670658dd1 in sage-2886's gap, after Morgana's
|
|
morgana/row275-48e4; Duckworth's ls-remote matched the tip (duckworth-0180).
|
|
|
|
## Runs
|
|
|
|
Slot from sage-2959 (CLEAR 19:13Z 10-22). Claimed rev 3317. Everything ran on launchpad/row206-17f4
|
|
on refactor 17f415792, after `npm ci --ignore-scripts` from the lockfile (oauth4webapi 3.8.8, no
|
|
symlinked node_modules). Each run had TMPDIR from `mktemp -d /mnt/storage/scratch/tmp/gXXXXXX` and
|
|
`timeout -k 10` at the limits above. Logs are in /mnt/storage/scratch/launchpad-r206/runs/.
|
|
|
|
- First-run red, placed under mos-1272 (Sage accepted it, sage-2960). On 1a228f395,
|
|
thread-shares.test.mjs "the owner's trail and replies..." failed with ERR_SQLITE_ERROR "a threaded
|
|
message's session is in its thread". The test inserted the reply's message_threads row with
|
|
session = the thread id, but a fresh thread's default session has its own id (264a; only a
|
|
migrated thread's reuses the thread's). The fix (9538e0fc8) reads the session from
|
|
session_defaults. It changes one fixture line in a new test, with no product change and no
|
|
assertion changed.
|
|
- Each touched file, whole and alone. The first 13 ran on 1a228f395 (the code under test is the
|
|
same at 9538e0fc8); thread-shares reran on the fix.
|
|
|
|
| File | Pass/fail |
|
|
|---|---|
|
|
| thread-shares | 16/0 on 9538e0fc8 (15/1 before the fix) |
|
|
| schema | 1/0 |
|
|
| sessions | 7/0 |
|
|
| user-principal | 22/0 |
|
|
| account-migration | 3/0 |
|
|
| chief-of-staff | 42/0 |
|
|
| comment-migration | 5/0 |
|
|
| gitea-migration | 5/0 |
|
|
| grant-migration | 6/0 |
|
|
| name-migration | 1/0 |
|
|
| spec-migration | 1/0 |
|
|
| thread-migration | 3/0 |
|
|
| usage-migration | 1/0 |
|
|
| cli stack-release.test | 218/0, 580 s |
|
|
|
|
- Mutants on 9538e0fc8 (19:28Z). Each is one exact edit on a copy of the tree (the edit must
|
|
match once), running thread-shares.test.mjs. All are killed on ERR_ASSERTION in the named test:
|
|
|
|
| Mutant | Result | Failing tests | Assertion message |
|
|
|---|---|---|---|
|
|
| M2 | 14/2 | "mutant 2" and the `*` test | |
|
|
| M3 | 15/1 | "mutant 3" | "removed" |
|
|
| M4 | 14/2 | "mutant 4" and the trail test | "human" |
|
|
| M7 | 15/1 | the first test | "thread.send" |
|
|
| M8 | 15/1 | "mutant 8" | "user:carol" |
|
|
| M9 | 14/2 | the first test and "a share target is..." | "thread.share" |
|
|
| Q2 probe | 15/1 | "only a human principal" | "agent after" |
|
|
|
|
- Suites on 9538e0fc8, 19:28:23Z to 19:40:25Z, all rc=0:
|
|
|
|
| Suite | Pass/fail |
|
|
|---|---|
|
|
| bus | 850/0 |
|
|
| cli | 869/0 |
|
|
| test-auth | 15/0 |
|
|
| test-conductor | 17/0 |
|
|
| test-config | 31/0 |
|
|
| test-discord | 81/0 |
|
|
| test-extension-package | 18/0 |
|
|
| test-foundation | 44/0 |
|
|
| test-land-work | 86/0 |
|
|
| test-queue | 156/0 |
|
|
| test-release | 14/0 |
|
|
| test-task | 91/0 |
|
|
|
|
The skip lines are by design. test-queue skips "verify and render --check" because the worktree
|
|
isn't the canonical root. test-task skips the "live provider cases" twice (row 244: no provider
|
|
call in the gate). No Docker group skipped.
|
|
- Result: GREEN.
|