9.0 KiB
Row 122 / #1616 — round 2
Base: 0afbd818e (contains row119 94e41ae29 and its roles). Detached candidate:
/mnt/storage/src/mosaic-stack-rocko-122-r2. Source is uncommitted; no push,
live unit/organization/Settings action or system-config write is authorized.
Sage sage-0269 governs this round, including F3 and recovery rulings. Filbert's
round1 verdict is #1616 comment28537. Round2 reopened at queue rev1248.
Changes from round 1 and per-path merge (F1)
All nine overlaps were inspected against row119. Six had textual conflicts; three applied without conflict and were checked by hand. Both rows' intent stays:
| Overlap path | Row119 kept | Row122 kept / merge |
|---|---|---|
| packages/business/examples/mosaic-stack.example.json | chief and assistant (holder mos), launch.by chief | Six explicit model-table selections, exact provider/model table and editable four/four limits |
| packages/business/README.md | Chief/assistant duties, chief-only role.launch, PM gated | New schema example and shared write path; initial human entry distinguished from later human Settings writes; write-time recovery wording |
| packages/business/tests/business.test.mjs | Chief instance, launch.by chief, role authority refusals | Exact schema assertions, zero/unset/large limit values, invalid table/count refusal |
| packages/business/tests/chief-of-staff.test.mjs | Approved role.launch authority, contract pins and launch.by PM refusal | Valid new-shape launch block and launchDoc(INSTANCE) expectation instead of old max |
| packages/business/tests/helpers.mjs | Chief instance without credentials/tracker and default chief launcher | launchDoc table and exact test limits (2/4 fixture values, not policy ceilings) |
| packages/business/tests/resolve.test.mjs | Chief launch authority and PM gated checks / provenance | Model-table entry for the overridden agent-model selector |
| packages/cli/tests/launcher.test.mjs | Actual chief startup, chief launch tool, PM cannot launch, existing lifecycle/checkouts | Exact provider counters and zero model cap; first actual chief launch now also starts over uncertain receipt evidence |
| packages/harness/tests/pi-session.test.mjs | Parameterized chief/PM tool authority and selected instance | Probe-model table entry attached to the selected instance |
| packages/webui/tests/reads.test.mjs | Chief within-role, PM gated, chief launcher | Exact limits/model-table assertions, external model path redaction and Settings projection |
The additional assistant.test.mjs compatibility edit retains its refusal of assistant as launch.by using a valid new-shape block, so an old-schema error cannot accidentally satisfy that authority check. The first gate found one old chief launch-object assertion; its failure log is retained and the complete gate restarted after the assertion/assistant fixture update.
F2 / F3: complete mapping and verified inheritance
The shipped map includes all six role instances: chief, assistant, pm, cto and reviewer select Anthropic opus; coder stays on Anthropic sonnet, per Sage's known Jason-file facts. The raw row119 example inherits for all six roles; its separate regression mapping selects opus throughout against an Anthropic Opus fixture system. Sage confirmed this distinction in sage-0273.
The CLI test reads the exact 94e41ae29 example from git, fills placeholder IDs
and dates, and passes a fixture copy of this base's roles/ (byte-identical to
94e41ae29's role files) as --roles-dir. It migrates that inherited example,
then a Jason-shaped variant with the four known explicit selections plus
inherited chief/assistant. Both outputs validate under the post122 validator.
The assistant holder and chief launcher are pinned. Wrong assistant Sonnet
against an Opus system, wrong inherited provider, and missing/invalid system
config refuse with organization bytes and mtime unchanged. Successful runs also
leave config bytes and mtime unchanged.
For every inherited instance, migrate reads execution.provider/execution.model through loadSystem + systemVars, the existing config path and validator. The mapping must preserve both values exactly. The launchable family comparison uses that real previous model. Explicit role models retain their exact external model and use the supplied provider data; fully explicit input needs no config read. No bus is needed. No write helper or --write exists (decision145).
MIGRATION.md and jason-migration.patch.json now describe the combined window: Jason first adds row119's chief/assistant entries (assistant holder mos), with Researcher's proposed explicit claude-code / claude-opus-5-5 / high vars, and launch.by chief. He then runs migrate from the reviewed new copy, installs its complete output, then the re-pin follows. Sage supplies first-chief-session instructions separately. Assistant's model remains ordinary mapping data, which Jason can change with a correct table entry; no special case in code.
Jason's edit and the re-pin happen in one window Mos runs, with the PM run idle.
F4 / F5: comments and reviewable code
Corrected business.mjs's obsolete never-writes comment; removed vocabulary.mjs's obsolete family ceiling comment. Reformatted organization.mjs and only the new limits block in broker.mjs, plus the new launch/migration/settings helpers, CLI limits handler and Settings POST handler. Organization and all four business helpers have no lines over 120 characters. Lock/revision/publication behavior remains pinned by the original mutants; recovery changes are separately tested. Broker constructor existing lines and message.send are untouched beyond r1's organization argument/member. No broker edit beyond round1 scope was needed, so Researcher's row120 constructor/send work remains separate.
Recovery ruling: uncertainty gates writes only
Removed bus-start recovery. Organization reads validate the whole file and do not inspect/repair receipts. Atomic publication leaves either old or new whole bytes; normal launch checks still re-read and validate the document. A write holds the existing lock, reconciles prepared receipts by hashes and refuses uncertain/torn evidence. An operator-reconciled fixture can then write again. The runtime integration test starts a bus over uncertain evidence, reads its valid document, proves limits.set refuses without changing it, reconciles the fixture and proves a later write succeeds. The actual sandbox launcher test starts the first chief over uncertain evidence too. No live process is involved.
Full gate and mutants
Sage sage-0274 granted the slot. busy.py returned CLEAR with exit0, chained with && to the gate. The gate runs all 13 node packages outside queue (ledger direct), and every scripts/test-*.sh; queue's shell runs all its node tests. Each package serializes test files. DOCKER_HOST=unix:///nonexistent.sock except release/task, where it is unset for that run only. No daemon/socket/volume change. Worktree network cleanup and a cwd/path-scoped node/chromium sweep follow all runners. Two recurrences of the same known flake stop the run and are reported to Sage.
Full gate: 23/23 steps passed. All node cases below passed with zero skips or failures. Gate commands/exits are in gate/results.json; first assertion failure is retained separately and is not a known flake. No known flake recurred.
| Node package | Passed |
|---|---|
| business | 86 |
| bus | 159 |
| seat | 132 |
| harness | 84 |
| cli | 195 |
| webui (browser form included) | 112 |
| control-board | 124 |
| conversation | 182 |
| ledger (direct) | 86 |
| tasks | 92 |
| runs | 43 |
| mosaic | 69 |
| discord | 183 |
| Shell suite | Passed |
|---|---|
| auth | 15 |
| conductor | 17 |
| config | 24 |
| discord | 78 (+183 embedded node cases) |
| extension-package | 18 |
| foundation | 44 |
| land-work | 84 |
| queue | 28 (+156 node cases) |
| release | 14 |
| task | 98 |
DOCKER_HOST was unset only for release and task; all Docker cases ran. Every other suite and all mutants used unix:///nonexistent.sock. The queue suite intentionally omits its two canonical-only live verify/render checks in this detached worktree. No other cases were skipped.
38/38 mutants killed, with no syntax/import kills or timeouts. Original33 checks are retained over the reformatted sites; five new faults cover inherited exact model, inherited provider, required validated config, no recovery at startup, and uncertainty gating writes. See MUTANTS.md and per-site logs. Every mutant used its own process group; timeout kills the entire group and is a failure, never a kill. Candidate44/44 hashes and reverse patch check pass.
The post-run cwd/path-scoped node/chromium sweep was empty before and after. Removed mosaic-stack-rocko-122-r2_default successfully. All runners exited, and slot clear was sent to Sage at 2026-10-15 01:33:50 UTC. No further tests.
Candidate manifest SHA256: 00b84e311475f97ced0d9a9599fba23a28442971ed15d8d489d9422d84a8812e (44 repo-root paths). Source stays uncommitted; build.patch reverse-check and every candidate hash match the frozen worktree.
Public/ landing requires Mos's go (123); live use requires a separate re-pin (109).