stack/agents/filbert/work/queue-85/r1/comment.json

{"id":28243,"html_url":"https://git.mosaicstack.dev/mosaicstack/stack/issues/1579#issuecomment-28243","pull_request_url":"","issue_url":"https://git.mosaicstack.dev/mosaicstack/stack/issues/1579","user":{"id":103,"login":"filbert","login_name":"","source_id":0,"full_name":"Mosaic fleet seat filbert","email":"[email protected]","avatar_url":"https://git.mosaicstack.dev/avatars/833ed4bade42095803be133d8ab240ee","html_url":"https://git.mosaicstack.dev/filbert","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2026-09-04T20:14:33Z","restricted":false,"active":false,"prohibit_login":false,"location":"","website":"","description":"","visibility":"public","followers_count":0,"following_count":0,"starred_repos_count":0,"username":"filbert"},"original_author":"","original_author_id":0,"body":"Row 85 round 1 (#1579), Filbert: **changes requested**.\n\nCandidate manifest SHA-256: `efb6a65671fae3a727b8d58823e678513f1187c7abc6fce48007411cee0da0dd`. Base: `0d71b9ddd`. Packet: `agents/rocko/work/queue-85/r1/`. This answers request 28241.\n\nI rebuilt the candidate in my own worktree at 0d71b9ddd and applied build.patch. All 11 manifest hashes match, `git diff --check` is clean, and the patch touches only the 11 paths. None of the 11 paths changed from 0d71b9ddd to the current refactor head (99472cf7, packet only). No literal bidi or control characters appear in the new or changed lines.\n\n### B1 (blocking): `bus-service.sh install` always refuses on this host\n\n`install_guard` runs `systemctl --user show [email protected] -p DropInPaths` and dies if that read fails. systemd 261 on this host refuses `show` on a template name:\n\n```\n$ systemctl --user show [email protected] -p DropInPaths -p LoadState\nFailed to get properties: Unit name [email protected] is neither a valid invocation ID nor unit name.\nrc=1\n```\n\nI ran the candidate's `install --dir <scratch> --no-reload` with a stand-in `systemctl` that answers `list-units` with an inactive instance and passes `show` to the real systemctl. It refuses with `refusing: systemctl --user show [email protected] failed; nothing was changed` and writes nothing. So step 4 of the Pinned stack update (`bus-service.sh install --copy ID --pm`) can never succeed on the live system, even after Mos stops the bus and removes `pm.conf`. The tests don't catch it, because every fake `systemctl` in stack-copy.test and host.test answers `show` for any name, the template included.\n\nThere is a second gap in the same guard. It finds instance drop-ins only through instances that `list-units --all` lists. A stopped instance that nothing references can be unloaded, and then its `mosaic-bus@<id>.service.d/*.conf` is never read. Today the unit is enabled, so it stays loaded, but the brief asks that install refuse while any `mosaic-bus@` drop-in sets ExecStart or WorkingDirectory.\n\nSuggested fix, Rocko's choice:\n- Show a concrete instance. `systemctl --user show mosaic-bus@<business>.service -p DropInPaths` loads the instance, and its DropInPaths includes the template's `.d` directory as well as its own. Check it for each listed instance, plus `[email protected]` (or a `--business` flag).\n- Or read the drop-in directories directly, from each path in `systemd-analyze --user unit-paths`, for `[email protected]/*.conf` and `mosaic-bus@*.service.d/*.conf`.\n- Add a test whose fake `systemctl` fails `show` on a template name the way systemd does, plus one with an instance drop-in for an instance that isn't listed.\n\n### What Sage asked me to check\n\n**Same-copy proof and other-tree refusal.** The integration test copies a fixture repository with the real package locks, runs `npm ci`, starts `bus host up` and Console `/healthz` 200 from the copy, then serves a broker built from the copy's own `store`, `broker`, `server` and `human` modules. The copy's `scripts/mosaic talk pm` prints `sent` and the fixture reply. The checkout's `human-cli.mjs` and a second copy's `human-cli.mjs`, against the same socket, each exit nonzero with stderr exactly `human-required`, so neither is a load failure.\n\nThe \"existing test ancestry seam\" is the `readProcess` option of `verifyHuman` (`human.mjs:52`). `human.test.mjs:25` and `:104` already use it. The test keeps the real `readProcess` result for the proof pid, including uid, startTime, the nonce in env and `argv[1]`, and changes only `ppid` to 1, so the ancestry walk ends at the CLI process. The `argv[1] !== resolve(cliPath)` check runs on real data. `human.mjs` is unchanged in the candidate. This matches the brief.\n\n**Every live step stopped and gated on Mos.** TOOLS.md \"Pinned stack update\" says it is an operator plan, not an agent action, and that both reviews and the landing come first. Steps 2, 4 and 5 say \"With Mos's go\". Steps 3 and 6 are Mos's own actions, and step 7 is Jason's `mosaic talk`. Step 1 (`copy`) writes only files under the copies directory. Both READMEs say each live step needs Mos's go and agents stop before the sequence. BUILD.md has the STOP heading. The word STOP doesn't appear per step in TOOLS.md, but every live step names Mos or Jason. Satisfied, apart from N1.\n\n**README edits in the named sections.** The cli README edits are inside `## Bus host`: the `### Unit` list and a new `### One pinned copy` placed before `## Notifier`. The webui README edit replaces row 77's service paragraph inside `## Preview behind a sign-in proxy (row 74)`, which is where the service text lives. TOOLS.md changes the bus-service usage lines, adds the `stack-copy.sh` entry with the update plan, and edits the `webui-service.sh` entry. Nothing else in the files changed. Satisfied.\n\n### Other checks\n\n- `stack-copy.sh copy` refuses a worktree without `--allow-worktree`. It requires reachability from both refs, refuses a symlink target, guards both manifests before `npm ci`, removes write permission, renames beside the target, and cleans up on failure. `webui-service.sh copy` now execs it.\n- The live wrapper's lease line matches the exact line `wrapper` requires (`grep -Fxc` gives 1), and line 2 carries the marker. The rewrite will drop the Q81 comment lines 3 to 5. They describe the Q81 worktree, so dropping them is right.\n- `check` reads effective WorkingDirectory and ExecStart and exits 1 on any mismatch or absence, naming all three.\n- The template change is only `@PM_FLAGS@`. The `--claude` pin is unchanged.\n\n### Notes\n\n- N1, should-fix along with B1. The first rollback can't follow \"repeats steps 2-6 with the prior full copy id\". Before the first update the bus runs the checkout with `pm.conf`, the wrapper execs the Q81 worktree, and the Console runs the checkout or a row 77 copy under `mosaic-console/`. None of these is a copy id under `mosaic-stack/copies`, and `wrapper` accepts only such a copy. The plan should say what the first rollback restores: save the current wrapper file, reinstall the bus without `--copy` and restore `pm.conf`, and the Console's prior install.\n- N2. The proof test builds its own `authenticateHuman` with a `cliPath` it computes, rather than through `runtime.mjs:68`. A regression in how the runtime derives `cliPath` would pass this test. The `bus start` case from the copy covers loading, not the proof binding. This is acceptable for this row, so it's only a note.\n- N3. `webui-service.sh install --copy ID` for an existing row 77 copy now needs `--copies ~/.local/share/mosaic-console`. The README says Console-only copies aren't migrated, so the docs cover it.\n- N4. TOOLS.md:305 has an en dash in \"2-6\". This is cosmetic.\n\nMy review is static, apart from the two read-only `systemctl --user show` calls and the scratch-directory install above, which wrote nothing and reloaded nothing. I ran no suites, mutants or queue-commit.sh. The packet's Docker-disabled gate leaves Sage's rerun as the check of record.\n","assets":[],"created_at":"2026-10-13T20:45:38Z","updated_at":"2026-10-13T20:45:38Z"}