34e55d4a2e
All checks were successful
ci/woodpecker/pr/ci Pipeline was successful
Invert the framework updater from a denylist ("framework owns everything unless
preserved") to an explicit allow-list manifest ("operator owns everything unless
framework"). A path the manifest never anticipated resolves to operator-owned by
the fail-safe default, so it is structurally unreachable by any write or prune.
Root cause (#791): `mosaic update` re-seeds via `install.sh` keep-mode, whose
`rsync -a --delete` + hand-maintained PRESERVE_PATHS denylist wiped operator
paths the denylist forgot (agents/*.conf, policy/*.md, *.local.md, harvester
SOP, tools/_lib/credentials.json, unanticipated fleet files).
- framework-manifest.txt: single SSOT ([framework]/[operator], deny-wins,
UNKNOWN=>operator fail-safe), read by BOTH installers.
- src/framework/manifest.ts: pure resolver (parse/matchGlob/resolveOwnership/
frameworkSubtreeRoots/planPrune) — the testable seam.
- tools/_lib/manifest.sh: bash resolver (compiled globs, fork-free hot path),
sourced by install.sh; parity-tested against the TS resolver.
- install.sh keep mode is now manifest-driven (no --delete): overlay-copy
framework files, scoped-prune only retired framework files inside shipped
subtrees. Operator + unknown paths are never written or deleted.
- file-ops.syncDirectory gains an isOperatorOwned guard; file-adapter derives it
from the shared manifest, replacing the drifted hardcoded preservePaths.
Tests (TDD, red->green):
- HARD GATE test-upgrade-manifest-guard.sh: 10 operator sentinels (incl. an
unanticipated one) survive a keep-mode reseed byte-identical + mtime-unchanged;
retired framework file pruned; secret value absent from output. RED 31 fail on
the old installer -> GREEN 48 pass. Wired merge-blocking into CI.
- manifest-parity.spec.ts (§6.1): bash<->TS agree on 34 paths + subtree roots.
- manifest.spec.ts: 18 tests incl. planPrune property test + shipped-tree
completeness (§6.2).
- test-install-migration.sh F6 flipped: an unanticipated operator fleet file now
MUST survive keep-mode reseed.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
81 lines
2.8 KiB
Plaintext
81 lines
2.8 KiB
Plaintext
# Mosaic framework path-ownership manifest — SSOT for the updater.
|
|
#
|
|
# This single file is the source of truth consumed by BOTH the bash installer
|
|
# (packages/mosaic/framework/install.sh) and the TypeScript config adapter
|
|
# (packages/mosaic/src/config/file-adapter.ts). A parity test asserts both
|
|
# paths resolve the same ownership from this file, so the two can never drift
|
|
# (the failure mode that #631 patched by hand in two places).
|
|
#
|
|
# Format: one glob per line, relative to the mosaic home (~/.config/mosaic).
|
|
# - Lines starting with '#' and blank lines are ignored.
|
|
# - '[framework]' / '[operator]' switch the active section.
|
|
# - '**' matches any depth; '*' matches within a single path segment.
|
|
#
|
|
# Ownership resolution for a path P (deny-wins / fail-safe):
|
|
# 1. P matches an [operator] glob -> operator-owned.
|
|
# 2. else P matches a [framework] glob -> framework-owned.
|
|
# 3. else (matches neither) -> OPERATOR-OWNED BY DEFAULT.
|
|
#
|
|
# Rule 3 is the root-cause fix for #791: a path the manifest authors never
|
|
# anticipated is protected because UNKNOWN defaults to operator. The updater
|
|
# may only ever create/overwrite framework-owned paths, and may only prune a
|
|
# framework-owned path that lives inside a shipped framework subtree and is
|
|
# absent from the current framework source (a genuinely retired file).
|
|
# Operator-owned and unknown paths are structurally unreachable by pruning.
|
|
|
|
[framework]
|
|
# Top-level framework contract files (also reconciled from defaults/ on upgrade).
|
|
CONSTITUTION.md
|
|
AGENTS.md
|
|
STANDARDS.md
|
|
# Shipped framework subtrees — pruning is scoped to these roots.
|
|
adapters/**
|
|
constitution/**
|
|
CONTRIBUTING.md
|
|
defaults/**
|
|
examples/**
|
|
guides/**
|
|
install.sh
|
|
install.ps1
|
|
LICENSE
|
|
profiles/**
|
|
runtime/**
|
|
systemd/**
|
|
templates/**
|
|
tools/**
|
|
# Fleet: only the framework-seeded fleet subtrees are framework-owned.
|
|
fleet/README.md
|
|
fleet/examples/**
|
|
fleet/profiles/**
|
|
fleet/roles/**
|
|
fleet/roster.schema.json
|
|
fleet/services/**
|
|
# The manifest itself is framework-owned.
|
|
framework-manifest.txt
|
|
|
|
[operator]
|
|
# Identity / user-seeded contract files — generated by the wizard or seeded
|
|
# once from defaults/, then owned by the operator. Never overwritten on upgrade.
|
|
SOUL.md
|
|
USER.md
|
|
TOOLS.md
|
|
# Local overlays (tighten-only) authored by the operator.
|
|
*.local.md
|
|
# Operator-owned trees the updater must never write over or prune.
|
|
agents/**
|
|
policy/**
|
|
memory/**
|
|
sources/**
|
|
credentials/**
|
|
# Secret-bearing operator file INSIDE the framework-owned tools/ subtree.
|
|
# Listed explicitly so the deny-wins rule carves it out of tools/**.
|
|
tools/_lib/credentials.json
|
|
# Operator-owned fleet state (roster SSOT, per-agent env, heartbeats, backlog,
|
|
# persona overrides). Losing these silently downgrades a running fleet (#791).
|
|
fleet/roster.yaml
|
|
fleet/roster.json
|
|
fleet/agents/**
|
|
fleet/run/**
|
|
fleet/backlog/**
|
|
fleet/roles.local/**
|