jason.woltjeandClaude Opus 5.5
d1629d610d
After a DNS rebind, a web page could read /api/board and POST /api/reply, which pastes into a live seat pane. foreignRequest() now runs first and returns 403 for a non-loopback Host, a wrong port, userinfo or a path in Host, or any Origin other than http://<Host>. A missing Origin still passes, which covers the WebUI proxy. Dewey authored it; Rocko approved de9ff942 (review 5a12f08e) with one low wording finding, now fixed in the notes. Co-Authored-By: Claude Opus 5.5 <[email protected]>
Mosaic Stack development team
These are interactive host development agents working in the canonical
checkout. They do not create managed fleet registrations or change role policy.
Sage leads the project and coordinates assignments, review, and integration
(Jason's ruling, 2026-09-26). Development sessions run in T3 for now.
For the current bootstrap phase, direct coding, review and research use Darkwing,
Dewey, Filbert, Rocko, Researcher and further seats Jason launches from this repository's agents/ directory,
not fleet seats. Keep changes in /mnt/storage/src/mosaic-stack; do not modify
~/.mosaic launchers/provisioning or migrate/stop live fleet processes.
| Agent | Responsibility | Runtime | Launch from repository root |
|---|---|---|---|
| Darkwing | Hands-on engineering; collaborating seat under Sage | Pi, configured Mosaic model | agents/darkwing/launch.sh |
| Dewey | Frontend design, UX, accessibility, and UI implementation | Pi, configured Mosaic model | agents/dewey/launch.sh |
| Rocko | General development, investigation, testing, and review | Claude Code, Sonnet model | agents/rocko/launch.sh |
| Filbert | General development, investigation, testing, and review | Pi, openai-codex/gpt-6-astra:low |
agents/filbert/launch.sh |
| Researcher | Source-grounded technical research and evidence | Pi, configured Mosaic model | agents/researcher/launch.sh |
| Sage | Project lead: coordination, review, integration; earlier DYOR strategy records retained | T3 session (Claude Code); Pi launcher zai/glm-5.3:high retained |
agents/sage/launch.sh |
Each script supports --check and --fresh. Normal launches resume the agent's
own conversation; a first launch starts one. See each agent's README for
context inputs, authentication, and recovery details. Launch scripts can also
be invoked by absolute path from any directory. No assignment or model request
is submitted by the launcher itself.
The shared Pi helper supports --provider NAME, --model ID, and
--thinking LEVEL as per-launch overrides of the validated system defaults.
Filbert's wrapper appends the required provider, model and thinking flags so
its launch configuration remains fixed, including on resume. Use Filbert's
wrapper to select that configuration; a direct shared-helper invocation uses
its own supplied flags or the system defaults.
All agents follow repository governance and current user direction. Team leadership does not add deployment or push authority. Coordinate overlapping work with Sage and preserve other sessions' changes.
Before 2026-09-26 Sage worked only on DYOR strategy and sat outside the
development queue. Jason then made Sage the project lead and Darkwing a
collaborating seat. A separate fleet Sage seat under ~/.mosaic is being
decommissioned; it does not speak for this seat. Whether the DYOR strategy work
continues is Jason's call. Joe retains DYOR engineering.