stack/agents/rockerduck/work/queue-334/BUILD.md

Row 334 — Case 2 proxy unit (#1832)

Design at 78b69e1e6 (2026-10-25)

Scope: mos-1616 ruling 1, P1 item 7 only. No template, runner, PIN, user-unit path, config/secret access, or live unit changes.

Current references: case2-unit.sh template seams 44-45, defaults 54-57, render 435, check_unit 489, render checks 548-551, re-install 553-573, active-state capture 576-580, writes/start/report 583-610. case2-install.sh Next: 231. P1 instance.sh PROXY_UNIT 86; bus-service.sh dependency insertion 93. P1 template ExecStart 13; run.mjs validates config 11-13 and calls startVerifiedProxy 14; runner.mjs refuses proxy-not-configured 8, verifyInstall 9; settings.mjs verifyInstall 23-30 refuses proxy-install-invalid for a hash mismatch. run.mjs catches that and exits 3. P1 item 7 is rows doc 86-90; row209 entry check 2 remains 32-36.

Add bare --proxy and CASE2_PROXY_TEMPLATE. Render P1's unmodified template with copy, PATH, node and deleted CONFIG_ENV; add User/Group plus bus's four hardening lines, no capabilities or EnvironmentFile. check_unit proxy uses exact node + copy/packages/model-proxy/src/run.mjs, NoNewPrivileges=yes, and every common refusal. Restrict CLAUDE_ENV expectation and capabilities to their existing bus/webui kinds. Insert bus Wants/After immediately after Description exactly as P1 does, only with --proxy. No-proxy output remains byte identical.

Re-install checks all selected units against render modulo copy id and compares every installed copy id. Existing proxy without --proxy refuses before writes, including a dangling symlink. No deletion. Enable all selected units, then start proxy, bus, Console. Capture/report already-running proxy with the others and name all three in restart-together guidance. Change only case2-install.sh's closing Next: to tell root to add --proxy when the config has a proxy section.

Tests first, unrun until Sage CLEAR: byte-identical non-proxy renders; proxy content and exact dependencies; each common/proxy check_unit refusal by message; rendered ExecStart wrong-PIN refusal proxy-install-invalid rc 3; three-unit re-install and mixed copies including proxy-only mismatch; installed proxy without flag preserves files; start order and failures; already-running report; install Next: guidance. Named mutants: remove bus After=; direct binary ExecStart bypassing run.mjs. Whole-file run list will be derived from static imports before any run; case1-accept stays off.

P2 is not present on this base (row331 still in progress); inspect landed P2 refusal code before final handoff. No flag/config false-positive check: P1 startVerifiedProxy refuses proxy-not-configured, run.mjs exits 3.

Slot / session

No tests run. CLEAR pending from Sage. Canonical queue start initially refused: lock held by magica-331-start since 03:57:01.839Z. Same operation will be retried after a minute; no lock manipulation.

Correction to line references above: row209 entry check 2 is 29-33; run.mjs config validation 8-10, runner call 11, refusal exit status 18. case2-unit.sh is byte-identical to brief base 58b2bbb3a (sha256 4ca8769134d83ee391bcc73af5bd042b9e2b161cac22821d29fcca710a9afad4). P1 paths named above have no diff between 86cb5c221 and 78b69e1e6. Own-worktree root npm ci --ignore-scripts --no-audit --no-fund: rc 0, 128 packages. No tests invoked.

Sage sage-4346 accepts design, authorizes writing RED tests then code while holding all runs until CLEAR. Tests were written first, then implementation; no RED run has occurred. Installed proxy without --proxy explicitly refuses and preserves bytes; dangling symlink also refuses, never deletes. P2 code remains pending until row331 lands. Both wrong-flag P1 runner paths covered.

Import-manifest correction: expanded traversal to include multiline import and export-from edges (the business/library barrel modules). Closure is 53 local modules; only the same two test entrypoints occur. The run list is unchanged; this is source inspection, no tests executed.

Queue start completed: rockerduck-334-start rev4079, row334 briefed→in-progress. git diff --check passed. Implementation, tests and import manifest prepared; no tests, commits or pushes performed. Verification awaits Sage's CLEAR; no live host/instance access occurred.

RED run authorized by sage-4387, 2026-10-25 04:21Z

Whole files, sequential, with each corresponding script temporarily restored from 78b69e1e6 and its implementation restored by EXIT trap afterwards:

• case2-unit.test.mjs: rc1, 81 tests, 48 pass, 33 fail, 0 skips; TMPDIR=/mnt/storage/scratch/tmp/QD3vp5, nice=19, 77995.928687 ms. All 47 old tests pass; new no-proxy byte equality passes. 32 new failures encounter baseline unsupported --proxy usage rc4; dangling installed proxy symlink case gets rc0 rather than refusal because baseline ignores it.
• case2-install.test.mjs: rc1, 28 tests, 27 pass, 1 fail, 0 skips; TMPDIR=/mnt/storage/scratch/tmp/YAGfKJ, nice=19, 10016.247032 ms. All old tests pass. New Next: guidance assertion fails because baseline lacks add --proxy when the config has a proxy section.

Every failure and cause is listed in red-results.txt; full plain-text outputs in red-unit.log and red-install.log. Absolute node/test paths used. Implementation restored, git diff --check clean. No old-test red, rerun, assertion change, GREEN or mutant run. P2 check still pending row331. Slot returned to Sage; GREEN and mutants await separate CLEAR.

Sage sage-4390 accepts clean RED and explicitly authorizes committing and pushing this candidate to rockerduck/row334 before GREEN. No force push. GREEN and mutants remain held for a separate CLEAR after row331 lands; then rebase onto landed P2 and check its missing-flag refusal code.

Mos1961 targeted execution — 2026-10-26

Authority: integrate onto refactor09a847ed, preserve old RED, two whole files serial plus bounded named mutants/restoration. No push, borrowed posting, live operations or review dispatch. All reviewers Codex; parent arranges actual new review. Full package/global gate remains Sage's.

Integration: first attempted merge retained both append-only log sides but merge-continue was refused by the queue guard for incoming queue files. Diagnosed scripts/git-hooks/pre-commit and packages/queue/README.md's merge/rebase protocol; aborted merge, rebased normally without disabling or overriding any hook. Only BUILD-LOG.md and SESSIONS.md conflicted; retained current refactor log plus all candidate additions. Integrated source commit c4bba5d2a3 on exact base 09a847edaa. Old candidate bd5720662 stays on origin/rockerduck/row334; no push performed. Original RED files retain identical bytes (cleanup.txt records their hashes).

Resources: before runs, no other node --test process found, memory available 29270 MiB, swap free 85176 MiB, memory PSI full avg10 0.28. Own-worktree npm ci --ignore-scripts --no-audit --no-fund rc0, nice19. Fresh shell-mktemp short TMPDIR, private HOME/XDG_CONFIG_HOME and explicit private MOSAIC_CONFIG per run. No real config/keys/units accessed. Absolute node/test/TAP paths. Existing per-command and per-test deadlines preserved. Import/export-from graph refreshed in green-imports.txt (56 local modules, only case2-unit.test.mjs and case2-install.test.mjs as test entrypoints). Sage-owned case2-precheck.sh and case1-accept.test.mjs unchanged, not run. Only closing Next: line changed in case2-install.sh.

Measured serial runs (raw TAP beside this file):

• green-unit.tap: rc0, 81/81 pass, zero skips, 78022.489026 ms.
• green-install.tap: rc0, 28/28 pass, zero skips, 8298.345458 ms.
• mutant-after.tap: rc1, selected test 1 fail, zero skips, 259.619391 ms. Removed only bus After= insertion; expected dependency assertion killed it.
• mutant-exec.tap: rc1, selected test 1 fail, zero skips, 237.081878 ms. Changed proxy template ExecStart to direct binary; exact ExecStart check refused, selected content/start-order test killed it. Template restored.
• restored.tap: rc0, 2/2 pass, zero skips, 569.147722 ms, content/start-order plus rendered ExecStart PIN/no-proxy refusals after both restorations. Each bounded mutant/restoration command had timeout -k10 60; no timeout hit. Each TAP header records private paths and measured nice19. No unexpected red, assertion relaxation, deadline change or blind retry. Mutation diffs and mutated-source hashes retained, source restored by EXIT traps.

P2 dependency correction: product362893d043ff96fdd35f18e326cce683db031471 landed in refactor; queue331 is tracking-only per Mos1915/#436, not a product blocker. Landed packages/bus/src/model-keys.mjs:161 and :167 refuse proxy-down on connection/client failure; :168 refuses non2xx as proxy-key-refused. P1 runner still refuses proxy-not-configured with exit3 when no proxy section exists. The rendered runner test now passes both wrong-PIN proxy-install-invalid exit3 and missing-proxy exit3 checks. This is temp-root test/source evidence; live .53/.54 behavior UNVERIFIED.

Restoration: every green-source.sha256 pin matches after mutants, including P1 template and PIN. Cleanup: all five logged test HOME/config/TMPDIR roots removed; no node --test process remains at 22:42:35Z. Test fixture cleanup completed. Temporary source backup copies were retained outside repository. Raw evidence hashes in green-evidence.sha256. SLOTBACK: targeted work complete; source ready for parent-arranged Codex review. Full package/global landing gate and live install acceptance are not claimed.