55 lines
3.4 KiB
Markdown
55 lines
3.4 KiB
Markdown
# Instance processing control
|
|
|
|
The durable switch is `<dataRoot>/control/processing.json`, using the root resolved
|
|
by the existing system configuration loader. All businesses in that root share
|
|
one switch; separate roots remain independent. No package selects an instance by
|
|
business name or systemd unit name.
|
|
|
|
A human runs `mosaic halt [--business ID]`, `mosaic processing status --json` and
|
|
`mosaic resume [--business ID]`. The business chooses the human proof context.
|
|
Halt publishes state before waiting for stops. Resume checks the displayed
|
|
generation and refuses while a stop is unresolved. Neither agents nor tester
|
|
sessions can change the switch. CLI channel settings cannot disable recovery.
|
|
|
|
The bus remains available for reads and human management. Managed processing,
|
|
new sessions, task containers, tracker activity and outbound notification stop.
|
|
Native diagnostic/development seats remain available. A remote request already
|
|
accepted cannot be undone: its completion or unknown outcome remains evidence.
|
|
No task is automatically retried on resume.
|
|
|
|
The trusted host explicitly initializes the first off document. Once control/
|
|
exists, a missing, malformed, unsafe or oversized state refuses work. Recovery
|
|
is halt, then resume; unsafe parent ownership/path boundaries require operator
|
|
repair. Never delete the file to clear a halt. State publication uses exclusive
|
|
temporary files, fsync and atomic rename. Run evidence remains write-once.
|
|
|
|
Runtime receipts bind generated ids to the canonical root, boot id and process
|
|
start ticks or inspected container id and labels. Stops begin concurrently,
|
|
TERM first, then KILL after five seconds, with two seconds for observation.
|
|
Unknown remains unknown and prevents resume. Stop receipts are write-once and
|
|
mirrored into reserved bus actions. An interrupted Docker CLI is not evidence
|
|
that its container stopped; a container that cannot be inspected stays unknown.
|
|
|
|
Legacy worker containers mount the host-owned `control/` parent read-only so
|
|
atomic replacement of `processing.json` remains visible to final admission.
|
|
Source-produced contents are `processing.json`, transient `.state-*` files,
|
|
and the `runtimes/`, `stops/`, and `run-stops/` metadata trees (including their
|
|
transient `.receipt-*` files); no control socket is produced there. The typed
|
|
launcher also mounts selected task/mission/user/role inputs read-only and only
|
|
the selected workspace/session read-write; it never mounts the data-root root,
|
|
evidence outside the current run, unselected run directories or the `bus/`
|
|
broker socket. Session forks are bounded at 16 MiB and copied from a no-follow,
|
|
owner/type-checked descriptor into the current run before that snapshot alone is
|
|
mounted. Legacy selected workspace/session names can still collide with managed
|
|
business parents or `discord-*` sessions; dedicated legacy namespaces or
|
|
explicit managed-name refusals require a separate migration. The image
|
|
entrypoint uses the shared strict reader and admission generation. A row-191
|
|
upgrade must stop old processing before the first trusted initialization and
|
|
align the image, bus and copy in a separately approved window. Nothing in a code
|
|
build performs that activation.
|
|
|
|
The Console status and persistent halted banner work read-only. The controls
|
|
require the existing authenticated human write path and `--send`; during Q175's
|
|
interim the UI explains that the instance CLI is the working path. No write
|
|
exception or alternate authentication scheme is introduced.
|