mosaicstack/stack
25
0 Fork 1
Code Issues 404 Pull Requests 13 Packages Projects Releases 15 Wiki Activity
Files
f6c
stack/agents/honker/work/queue-239/BUILD.md
T

12 KiB
Raw Permalink Blame History

Row 239 (#1745) build notes (append only)

2026-10-22 b1 (Honker)

Design d1 5da5f28f6 was approved by Duckworth with C1 and C2 and no blockers (duckworth-0165, note agents/duckworth/work/row239/REVIEW-design-d1.md). The code is on honker/row239 from aca16404c. No test has run yet: every run waits for Sage's CLEAR.

Duckworth's conditions and answers

  • C1 (option a): outcome-unknown-revoked is in the Console's OPEN list (webui bus.mjs), so sendOutcome answers it as outcome-unknown with sent: 'unknown' and never "Nothing changed". T6 covers it and M3f is its mutant.
  • C2: write() sets revoked = true after beforeWrite() returns, and a catch around the whole withLock(...) call marks the error. So a throw from the lock's release in its finally is marked as well. This is structural and has no test, as Duckworth said.
  • Q1: beforeWrite runs after both validations. Q2: two codes. Q3: M2 removes the :188 check (now organization.mjs:195).

Notes N1-N5

  • N1: beforeWrite must not write the same business, because it would find its own lock and refuse organization-busy. This is said in the comments on write() and commit(). Today's revokes (the bus's credential revoke) write no business file.
  • N2: the lock is held across the revoke. A fire or a delete now keeps other writers of that business out for as long as the revoke takes. They refuse organization-busy, as they do for any held lock.
  • N3: a revoke that fails partway (some tokens revoked, then credential-revoke-failed) behaves as today. The error carries no revoked mark, because beforeWrite didn't return, and nothing is written. This row doesn't change that.
  • N4: a delete closed with outcome-unknown-revoked exits 3 in the CLI, as every closed refusal does. Exit 1 (transport EXIT) applies only to a direct verb answer.
  • N5: I grepped for "before the write" and similar comments. The ones left (lifecycle-revoke.test:2, instance-settings:56, cli instances.mjs:53, serve.mjs:365) are still true and are unchanged. T21 in bus lifecycle-revoke.test:173 is unchanged.

Differences from the design

  • The business tests are in lifecycle-settings.test.mjs, not instance-settings.test.mjs. The fire tests and their fixture already live there. The fixture now returns dir and rolesDir too.
  • T3 covers T3b (the delete) in the same test, looping over fire and delete. It also checks that a revoke throwing credential-revoke-failed carries no mark and writes nothing.
  • T4b is the plain-code check. The design's "T4b, outcome-unknown-revoked for an fs-style error" is in T4, which checks EIO with and without the mark for both a fire and a delete.
  • The bus test's fake org gets deleteError, thrown from its instances.set branch, so T4 can drive a delete.
  • transport.test gets one assertion, busExit("outcome-unknown-revoked") === 1, for M3g.
  • A latent Console text: a direct (not closed-request) revision-conflict-revoked answer in the Console would still get " Nothing changed." appended, because only OPEN codes skip it. That sentence is true there: the file is unchanged. No direct human path gives this code today, since a delete reaches the Console as a closed request's refusal.
  • The Console's STATUS entry for outcome-unknown-revoked (503) can't be reached while the code is in OPEN. It stays for symmetry with the CLI and is harmless.

What changed

  • packages/business/src/organization.mjs: write() takes beforeWrite, runs it under the lock after the revision check and both validations, and marks any later error revoked. The body is reindented inside the try.
  • packages/business/src/instance-settings.mjs: instanceSettings takes an optional writer. commit() passes beforeWrite to writer.write instead of calling it. The early check stays, and its comment is rewritten.
  • packages/bus/src/broker.mjs: #organizationFail maps a marked error to revision-conflict-revoked or outcome-unknown-revoked before the existing mappings. #fireJob's notice adds "Its credential tokens may already be revoked." for a -revoked code.
  • packages/bus/src/runtime.mjs: comment only.
  • packages/cli/src/instances.mjs: two REASONS entries. packages/cli/src/transport.mjs: EXIT outcome-unknown-revoked 1.
  • packages/webui/src/serve.mjs: two AGENT_REASONS entries. packages/webui/src/bus.mjs: OPEN entry and two STATUS entries.
  • Tests:
    • business lifecycle-settings.test: "row 239 T1", "row 239 T2", "row 239 T3".
    • bus fire-revokes-grants.test: "row 239 T4", "row 239 T4b".
    • cli instances.test: "row 239 T5 CLI". cli transport.test: one assertion in "busExit and refuseInsideAgent".
    • webui agents.test: "row 239 T6".
    • bus channel-proof.test re-pins packages/cli/src/transport.mjs (662642a8...) and packages/webui/src/bus.mjs (1eba9774...), with a comment on each. Neither changes a proof or the transport. The design's file list missed this. The pin grep found it before the first run.

Mutants for the gate (exact-once replacements)

  • M1 (instance-settings.mjs, beforeWrite before the lock): replace const receipt = writer.write(business, next, { revision, actor, context, beforeWrite }); with if (beforeWrite) beforeWrite();\n const receipt = writer.write(business, next, { revision, actor, context });. The kill is lifecycle-settings "row 239 T1" (the revoke spy has a call).
  • M2 (organization.mjs, the fire refusal dropped): delete the line if (revision !== before) fail("revision-conflict", "organization revision changed; read again");. The kill is "row 239 T1" (the write lands over the hand edit).
  • M3a (organization.mjs, the mark dropped): if (revoked && e instanceof Error) e.revoked = true; becomes void revoked;. The kills are "row 239 T2" and "row 239 T3" (business). T4 drives the mark through a fake org, so it doesn't see M3a.
  • M3b (broker.mjs): delete the line if (e.revoked) fail(e.code === "revision-conflict" ? "revision-conflict-revoked" : "outcome-unknown-revoked");. The kill is fire-revokes-grants "row 239 T4".
  • M3c (cli instances.mjs): delete the five lines from "revision-conflict-revoked": "the business file through "business file again with \mosaic business instances` before trying again",`. The kill is instances.test "row 239 T5 CLI".
  • M3d (webui serve.mjs): delete the two lines starting 'revision-conflict-revoked': 'the business file and 'outcome-unknown-revoked': 'the agent\'s tokens. The kill is agents.test "row 239 T6".
  • M3e (broker.mjs): const tokens = code.endsWith('-revoked') ? ' Its credential tokens may already be revoked.' : ''; becomes const tokens = '';. The kill is "row 239 T4".
  • M3f (webui bus.mjs, C1): the OPEN line loses , 'outcome-unknown-revoked'. The kill is "row 239 T6" (the launch POST answers 503 outcome-unknown, sent unknown).
  • M3g (cli transport.mjs): delete the line "outcome-unknown-revoked": 1,. The kill is transport.test "busExit and refuseInsideAgent".

A kill counts only as a failed assertion in the named test, not a load error or a different test.

Gate plan (mos-1275 timeouts)

  • My row 256 gate (2026-10-22 10:34Z, same machine) took 590s for the cli package, 57s for webui and 38s for test-foundation, the longest shell script.
  • Packages: timeout -k 10 1800 per package (3x the cli run).
  • Each scripts/test-*.sh: timeout -k 10 300 (more than 3x the 38s longest).
  • Single files and mutants: timeout -k 10 600 per file run (cli instances.test whole is the longest single file).
  • Order on Sage's CLEAR: the touched test files whole (business lifecycle-settings, bus fire-revokes-grants and channel-proof, cli instances and transport, webui agents), then M1-M3g, then the full gate.
  • Before the in-review move: grep packages/*/tests for the changed comment and error text and for 64-hex pins on the changed files, and drift-check BASE..refactor against them.

2026-10-22 r2 rebase (Honker)

  • Duckworth approved b1 b0c28366f statically, with no blockers (duckworth-0168). On N1 (endsWith('-revoked') would also match access-revoked, which can't reach a fire job today), the check stays as it is, so the approved candidate doesn't change before the gate (honker-0163).
  • Rows 253 (48e450ce8) and 275 landed. b1 is rebased onto refactor 94c33a43c as honker/row239-r2. The push branch honker/row239 isn't rewritten.
  • Drift between aca16404c and 94c33a43c on the 15 paths: only packages/bus/src/broker.mjs, where row 275 changes the viewer verbs. Neither of row 239's two hunks (#fireJob and #organizationFail) moves in meaning. The rebase applied with no conflict. The two pinned files (cli transport.mjs, webui bus.mjs) and channel-proof.test have no upstream change, so the b1 pins stand.
  • Each M1-M3g replacement string still matches exactly once.
  • The touched test files run whole again on the new base, in the slot (the rebase rule).

2026-10-23 r3 rebase (Honker, sage-3730)

  • r2 (70c6e3772) is rebased onto refactor 93694c518 as honker/row239-r3. honker/row239-r2 isn't rewritten.
  • Between 94c33a43c and 93694c518, five of the 16 paths changed upstream: bus broker.mjs and runtime.mjs, channel-proof.test, and webui bus.mjs and serve.mjs. Every file merged on its own except channel-proof.test, where row 301 (59f0e44f4, mos-1449) re-pinned webui bus.mjs for the user transport fold. The merged pin keeps row 301's comment and row 239's, and takes sha256 e3f52172…1c2a89 of the merged bus.mjs. The transport.mjs pin (662642a8…6e55b) still matches the file.
  • Row 239's hunks in broker.mjs (#fireJob, #organizationFail), runtime.mjs (the revoke comment), bus.mjs (OPEN, STATUS) and serve.mjs are unchanged apart from their position. The range-diff shows only the channel-proof pin and the hunk context moved.
  • Each M1-M3g replacement string still matches exactly once. M3f's target is the whole OPEN line, since , 'outcome-unknown-revoked' also appears in the STATUS line.
  • No 64-hex pin in packages/*/tests or scripts names a changed file except channel-proof.test.
  • On the CLEAR (sage-3730): the touched files whole, then M1-M3g, then the counts here. Sage runs the full gate on the replay at landing.

2026-10-23 r4 replay and the slot run (Honker, sage-3773 CLEAR)

  • On the CLEAR, refactor was 546366f4a (row 320 landed at 094124b4e). None of the 16 manifest paths changed between 93694c518 and 546366f4a. Upstream did change library src/index.mjs, which bus runtime.mjs imports, and business src/index.mjs, which the cli imports, so the run was on a replay onto 546366f4a rather than on r3's base. That replay is honker/row239-r4 0cae2dad5. The range-diff of r3 against r4 is four = lines with equal patch-ids, so duckworth-0292's read of r3 applies to r4. r3 isn't rewritten.

  • The run was on 0cae2dad5 with a clean tree, TMPDIR under /mnt/storage/scratch/tmp, 22:01:27Z-22:01:52Z.

  • The touched files, run whole: business lifecycle-settings 12/12, bus fire-revokes-grants 24/24, bus channel-proof 2/2, cli instances 15/15, cli transport 3/3, webui agents 9/9. That's 65/65 with 0 skipped, and no first-run red.

  • Mutants: 9 of 9 killed. Each was applied exactly once, and each made its named test fail as an assertion:

    • M1 lifecycle: 3 fail (T1, T2, T3).
    • M2: T1.
    • M3a: T2 and T3.
    • M3b fire-revokes-grants: T4.
    • M3c instances: T5 CLI.
    • M3d agents: T6.
    • M3e: T4.
    • M3f agents: T6.
    • M3g transport: "busExit and refuseInsideAgent".

    T4b passed under M3b and M3e. Every restore matched the HEAD blob by sha256, and the tree was clean after the run.

  • No full gate (sage-3730): Sage runs it on the replay at landing.

Reference in new issue View Git Blame Copy Permalink