rocko
4bdc7e0e86
Unify halt and fire cancellation by verified run identity with durable first-owner receipts and shared deadlines. Integrate the instance control with the current host, library and tester-socket paths. Focused nine-file evidence is 62 passing tests; broad suites, mutants and review remain pending.
43 lines
2.5 KiB
Markdown
43 lines
2.5 KiB
Markdown
# Instance processing control
|
|
|
|
The durable switch is `<dataRoot>/control/processing.json`, using the root resolved
|
|
by the existing system configuration loader. All businesses in that root share
|
|
one switch; separate roots remain independent. No package selects an instance by
|
|
business name or systemd unit name.
|
|
|
|
A human runs `mosaic halt [--business ID]`, `mosaic processing status --json` and
|
|
`mosaic resume [--business ID]`. The business chooses the human proof context.
|
|
Halt publishes state before waiting for stops. Resume checks the displayed
|
|
generation and refuses while a stop is unresolved. Neither agents nor tester
|
|
sessions can change the switch. CLI channel settings cannot disable recovery.
|
|
|
|
The bus remains available for reads and human management. Managed processing,
|
|
new sessions, task containers, tracker activity and outbound notification stop.
|
|
Native diagnostic/development seats remain available. A remote request already
|
|
accepted cannot be undone: its completion or unknown outcome remains evidence.
|
|
No task is automatically retried on resume.
|
|
|
|
The trusted host explicitly initializes the first off document. Once control/
|
|
exists, a missing, malformed, unsafe or oversized state refuses work. Recovery
|
|
is halt, then resume; unsafe parent ownership/path boundaries require operator
|
|
repair. Never delete the file to clear a halt. State publication uses exclusive
|
|
temporary files, fsync and atomic rename. Run evidence remains write-once.
|
|
|
|
Runtime receipts bind generated ids to the canonical root, boot id and process
|
|
start ticks or inspected container id and labels. Stops begin concurrently,
|
|
TERM first, then KILL after five seconds, with two seconds for observation.
|
|
Unknown remains unknown and prevents resume. Stop receipts are write-once and
|
|
mirrored into reserved bus actions. An interrupted Docker CLI is not evidence
|
|
that its container stopped; a container that cannot be inspected stays unknown.
|
|
|
|
Task containers mount the whole control directory read-only, below the existing
|
|
root mount. The image entrypoint uses the shared strict reader and admission
|
|
generation. A row-191 upgrade must stop old processing before the first trusted
|
|
initialization and align the image, bus and copy in a separately approved window.
|
|
Nothing in a code build performs that activation.
|
|
|
|
The Console status and persistent halted banner work read-only. The controls
|
|
require the existing authenticated human write path and `--send`; during Q175's
|
|
interim the UI explains that the instance CLI is the working path. No write
|
|
exception or alternate authentication scheme is introduced.
|