0a5e703a70
All checks were successful
ci/woodpecker/pr/ci Pipeline was successful
Fold the Mos-elevated #797 Runtime-Ledger survival sentinel into #791 PR1 and
harden the .txt-format parity test per the accepted-format conditions.
- framework-manifest.txt: annotate the existing fleet/run/** operator carve-out
to name the #797 ledger (fleet/run/sessions/) so it reads as load-bearing.
The glob already matches the #797 spec exactly — no location divergence.
- HARD GATE (test-upgrade-manifest-guard.sh): seed a populated ledger
(events.ndjson journal + ledger.json projection, 0600 under 0700) as an
operator sentinel; assert byte-identical + mtime-unchanged + dir-perms
unchanged after a keep-mode upgrade. Relabel the prune check as the explicit
negative control. 48 -> 58 checks.
- Parity (manifest-parity.spec.ts): add format-edge fixtures driven through
BOTH resolvers via MANIFEST_FILE — comments/blanks/whitespace, duplicate and
overlapping globs (deny-wins), section/glob-ordering independence, and an
explicit UNKNOWN->operator negative probe; add ledger probe paths.
- manifest.spec.ts: isolate the carve-out's load-bearing value with a resolver
red->green — under a hypothetical fleet/** framework glob, the ledger is
pruned WITHOUT the fleet/run/** carve-out and protected WITH it (deny-wins).
Gates: typecheck, lint, format:check green; mosaic vitest 1069 passed;
HARD GATE 58/58; migration 21/21. Commits forward on 34e55d4a (no rebase).
Part of #791
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
86 lines
3.2 KiB
Plaintext
86 lines
3.2 KiB
Plaintext
# Mosaic framework path-ownership manifest — SSOT for the updater.
|
|
#
|
|
# This single file is the source of truth consumed by BOTH the bash installer
|
|
# (packages/mosaic/framework/install.sh) and the TypeScript config adapter
|
|
# (packages/mosaic/src/config/file-adapter.ts). A parity test asserts both
|
|
# paths resolve the same ownership from this file, so the two can never drift
|
|
# (the failure mode that #631 patched by hand in two places).
|
|
#
|
|
# Format: one glob per line, relative to the mosaic home (~/.config/mosaic).
|
|
# - Lines starting with '#' and blank lines are ignored.
|
|
# - '[framework]' / '[operator]' switch the active section.
|
|
# - '**' matches any depth; '*' matches within a single path segment.
|
|
#
|
|
# Ownership resolution for a path P (deny-wins / fail-safe):
|
|
# 1. P matches an [operator] glob -> operator-owned.
|
|
# 2. else P matches a [framework] glob -> framework-owned.
|
|
# 3. else (matches neither) -> OPERATOR-OWNED BY DEFAULT.
|
|
#
|
|
# Rule 3 is the root-cause fix for #791: a path the manifest authors never
|
|
# anticipated is protected because UNKNOWN defaults to operator. The updater
|
|
# may only ever create/overwrite framework-owned paths, and may only prune a
|
|
# framework-owned path that lives inside a shipped framework subtree and is
|
|
# absent from the current framework source (a genuinely retired file).
|
|
# Operator-owned and unknown paths are structurally unreachable by pruning.
|
|
|
|
[framework]
|
|
# Top-level framework contract files (also reconciled from defaults/ on upgrade).
|
|
CONSTITUTION.md
|
|
AGENTS.md
|
|
STANDARDS.md
|
|
# Shipped framework subtrees — pruning is scoped to these roots.
|
|
adapters/**
|
|
constitution/**
|
|
CONTRIBUTING.md
|
|
defaults/**
|
|
examples/**
|
|
guides/**
|
|
install.sh
|
|
install.ps1
|
|
LICENSE
|
|
profiles/**
|
|
runtime/**
|
|
systemd/**
|
|
templates/**
|
|
tools/**
|
|
# Fleet: only the framework-seeded fleet subtrees are framework-owned.
|
|
fleet/README.md
|
|
fleet/examples/**
|
|
fleet/profiles/**
|
|
fleet/roles/**
|
|
fleet/roster.schema.json
|
|
fleet/services/**
|
|
# The manifest itself is framework-owned.
|
|
framework-manifest.txt
|
|
|
|
[operator]
|
|
# Identity / user-seeded contract files — generated by the wizard or seeded
|
|
# once from defaults/, then owned by the operator. Never overwritten on upgrade.
|
|
SOUL.md
|
|
USER.md
|
|
TOOLS.md
|
|
# Local overlays (tighten-only) authored by the operator.
|
|
*.local.md
|
|
# Operator-owned trees the updater must never write over or prune.
|
|
agents/**
|
|
policy/**
|
|
memory/**
|
|
sources/**
|
|
credentials/**
|
|
# Secret-bearing operator file INSIDE the framework-owned tools/ subtree.
|
|
# Listed explicitly so the deny-wins rule carves it out of tools/**.
|
|
tools/_lib/credentials.json
|
|
# Operator-owned fleet state (roster SSOT, per-agent env, heartbeats, backlog,
|
|
# persona overrides). Losing these silently downgrades a running fleet (#791).
|
|
fleet/roster.yaml
|
|
fleet/roster.json
|
|
fleet/agents/**
|
|
# Runtime state, incl. the #797 Runtime Session Ledger at fleet/run/sessions/
|
|
# (events.ndjson journal + ledger.json projection). This carve-out is the
|
|
# mechanism that makes the ledger upgrade-safe: an upgrade that wiped it would
|
|
# defeat its reason to exist. The HARD GATE (test-upgrade-manifest-guard.sh)
|
|
# proves a populated ledger survives byte-identical + mtime-unchanged.
|
|
fleet/run/**
|
|
fleet/backlog/**
|
|
fleet/roles.local/**
|