Stream/os

.task/os/gate-internal-dashboard-routing-on-complete-access-config/current.json

@@ -0,0 +1,19 @@
+{
+  "area": "os",
+  "stream": "stream/os",
+  "taskBranch": "task/os/gate-internal-dashboard-routing-on-complete-access-config",
+  "baseBranch": "stream/os",
+  "sourceBranch": "stream/os",
+  "startFrom": "stream",
+  "prNumber": 2149,
+  "prUrl": "https://github.com/consuelohq/opensaas/pull/2149",
+  "githubPrUrl": "https://github.com/consuelohq/opensaas/pull/2149",
+  "graphitePrUrl": "https://app.graphite.com/github/pr/consuelohq/opensaas/2149/gate-internal-dashboard-routing-on-complete-access-config",
+  "taskPrUrl": "https://github.com/consuelohq/opensaas/pull/2149",
+  "taskGraphitePrUrl": "https://app.graphite.com/github/pr/consuelohq/opensaas/2149/gate-internal-dashboard-routing-on-complete-access-config",
+  "worktreePath": "/private/var/folders/vl/1zvhm0bj28d1dbvbcb12b39r0000gn/T/opensaas-worktrees/task-os-gate-internal-dashboard-routing-on-complete-access-config",
+  "taskSession": "tsk_be4cc7cc41f5",
+  "tmuxSession": "opensaas-os-gate-internal-dashboard-routing-on-complete-acce-be4cc7cc",
+  "sessionPath": "/private/var/folders/vl/1zvhm0bj28d1dbvbcb12b39r0000gn/T/opensaas-worktrees/task-os-gate-internal-dashboard-routing-on-complete-access-config/.task/os/gate-internal-dashboard-routing-on-complete-access-config/session.json",
+  "createdAt": "2026-08-16T22:29:43.195Z"
+}

.task/os/gate-internal-dashboard-routing-on-complete-access-config/session.json

@@ -0,0 +1,15 @@
+{
+  "taskSession": "tsk_be4cc7cc41f5",
+  "tmuxSession": "opensaas-os-gate-internal-dashboard-routing-on-complete-acce-be4cc7cc",
+  "area": "os",
+  "stream": "stream/os",
+  "taskBranch": "task/os/gate-internal-dashboard-routing-on-complete-access-config",
+  "branch": "task/os/gate-internal-dashboard-routing-on-complete-access-config",
+  "worktreePath": "/private/var/folders/vl/1zvhm0bj28d1dbvbcb12b39r0000gn/T/opensaas-worktrees/task-os-gate-internal-dashboard-routing-on-complete-access-config",
+  "worktree": "/private/var/folders/vl/1zvhm0bj28d1dbvbcb12b39r0000gn/T/opensaas-worktrees/task-os-gate-internal-dashboard-routing-on-complete-access-config",
+  "prNumber": 2149,
+  "prUrl": "https://github.com/consuelohq/opensaas/pull/2149",
+  "createdAt": "2026-08-16T22:29:43.194Z",
+  "tmuxCreated": true,
+  "sessionPath": "/private/var/folders/vl/1zvhm0bj28d1dbvbcb12b39r0000gn/T/opensaas-worktrees/task-os-gate-internal-dashboard-routing-on-complete-access-config/.task/os/gate-internal-dashboard-routing-on-complete-access-config/session.json"
+}

.task/os/gate-internal-dashboard-routing-on-complete-access-config/workpad.md

@@ -0,0 +1,86 @@
+# gate internal dashboard routing on complete access config
+
+branch: `task/os/gate-internal-dashboard-routing-on-complete-access-config`
+stream: `stream/os`
+pr: https://app.graphite.com/github/pr/consuelohq/opensaas/2149/gate-internal-dashboard-routing-on-complete-access-config
+github pr: https://github.com/consuelohq/opensaas/pull/2149
+started: 2026-08-16
+
+## acceptance criteria
+
+- [ ] Define explicit task acceptance criteria before coding.
+
+## plan
+
+1. Read the relevant code and update this plan before editing.
+
+## current status
+
+- Task started. Update this before publish.
+
+## files changed
+
+- none yet
+
+## workspace-owned: files changed
+
+- none yet
+
+## workspace-owned: activity log
+
+- 2026-08-16 22:29:59 fs.write: `.task/os/gate-internal-dashboard-routing-on-complete-access-config/workpad.md`
+- 2026-08-16 22:32:10 fs.write: `.task/os/gate-internal-dashboard-routing-on-complete-access-config/workpad.md`
+
+## workspace-owned: validation evidence
+
+- 2026-08-16 22:32:26 `verify`: passed — OK
+
+## key decisions
+
+- none yet
+
+## notes for ko
+
+- none yet
+
+## improvements noticed
+
+- none yet
+
+## issues and recovery
+
+- none yet
+
+---
+
+## publish checklist
+
+```bash
+bun run task:push -- --message "type(os): description" --changed
+bun run task:pr
+bun run task:finish
+```
+
+## Test-first contract
+
+behavior under test: when the internal dashboard has no Access configuration, its shared-host paths must fall through to normal workspace routing instead of returning dashboard 401/403; complete configuration enables dashboard interception; partial configuration fails closed without falling through.
+existing local pattern: install-control-plane docs state Access prerequisites must be satisfied before enabling the internal dashboard; the edge Worker already receives the three optional authorization bindings.
+new or changed tests: add edge integration coverage for absent, complete, and partial dashboard Access configuration; remove unconditional deployment-secret requirements so a disabled dashboard does not block restoring the shared workspace Worker.
+focused red command: cd packages/os && bun vitest run tests/internal-dashboard-integration.test.ts tests/cloudflare-worker-release-readiness.test.ts
+expected red failure: absent dashboard bindings still intercept `/` and `/users`; release readiness currently treats an optional disabled dashboard as a hard deployment failure.
+no-test waiver: not applicable
+
+- 2026-08-16 22:29:59 append: `.task/os/gate-internal-dashboard-routing-on-complete-access-config/workpad.md`
+
+## Implementation and verification
+
+- Added explicit dashboard Access states: disabled when all three bindings are absent, configured only when all three are present (or a test authorizer is injected), and partial otherwise.
+- Disabled state falls through to canonical workspace routing, so an incomplete dashboard rollout cannot seize `/`, `/users`, or other shared-host routes.
+- Partial state returns `workspace_auth_unavailable` 503 before dashboard data or handlers run.
+- Configured state preserves workspace-session validation, HTML login redirect, and Cloudflare Access operator authorization.
+- Removed the unconditional dashboard secret requirement from Worker deployment readiness because absence now means safely disabled; the existing core edge secrets remain mandatory.
+- Red: focused suites failed 3 assertions (disabled route received 403 instead of fallthrough 404, partial config received 403 instead of 503, optional-disabled deploy was rejected).
+- Green: `internal-dashboard-integration`, `install-control-plane-cloudflare`, and `cloudflare-worker-release-readiness` passed 14/14.
+- Green: `yarn nx run consuelo-os:typecheck` passed.
+
+- 2026-08-16 22:32:10 append: `.task/os/gate-internal-dashboard-routing-on-complete-access-config/workpad.md`

.task/os/repair-runtime-retention-and-watchdog-recovery/current.json

@@ -0,0 +1,19 @@
+{
+  "area": "os",
+  "stream": "stream/os",
+  "taskBranch": "task/os/repair-runtime-retention-and-watchdog-recovery",
+  "baseBranch": "stream/os",
+  "sourceBranch": "stream/os",
+  "startFrom": "stream",
+  "prNumber": 2150,
+  "prUrl": "https://github.com/consuelohq/opensaas/pull/2150",
+  "githubPrUrl": "https://github.com/consuelohq/opensaas/pull/2150",
+  "graphitePrUrl": "https://app.graphite.com/github/pr/consuelohq/opensaas/2150/repair-runtime-retention-and-watchdog-recovery",
+  "taskPrUrl": "https://github.com/consuelohq/opensaas/pull/2150",
+  "taskGraphitePrUrl": "https://app.graphite.com/github/pr/consuelohq/opensaas/2150/repair-runtime-retention-and-watchdog-recovery",
+  "worktreePath": "/private/var/folders/vl/1zvhm0bj28d1dbvbcb12b39r0000gn/T/opensaas-worktrees/task-os-repair-runtime-retention-and-watchdog-recovery",
+  "taskSession": "tsk_af28ff74214b",
+  "tmuxSession": "opensaas-os-repair-runtime-retention-and-watchdog-recovery-af28ff74",
+  "sessionPath": "/private/var/folders/vl/1zvhm0bj28d1dbvbcb12b39r0000gn/T/opensaas-worktrees/task-os-repair-runtime-retention-and-watchdog-recovery/.task/os/repair-runtime-retention-and-watchdog-recovery/session.json",
+  "createdAt": "2026-08-16T22:46:56.311Z"
+}

.task/os/repair-runtime-retention-and-watchdog-recovery/session.json

@@ -0,0 +1,15 @@
+{
+  "taskSession": "tsk_af28ff74214b",
+  "tmuxSession": "opensaas-os-repair-runtime-retention-and-watchdog-recovery-af28ff74",
+  "area": "os",
+  "stream": "stream/os",
+  "taskBranch": "task/os/repair-runtime-retention-and-watchdog-recovery",
+  "branch": "task/os/repair-runtime-retention-and-watchdog-recovery",
+  "worktreePath": "/private/var/folders/vl/1zvhm0bj28d1dbvbcb12b39r0000gn/T/opensaas-worktrees/task-os-repair-runtime-retention-and-watchdog-recovery",
+  "worktree": "/private/var/folders/vl/1zvhm0bj28d1dbvbcb12b39r0000gn/T/opensaas-worktrees/task-os-repair-runtime-retention-and-watchdog-recovery",
+  "prNumber": 2150,
+  "prUrl": "https://github.com/consuelohq/opensaas/pull/2150",
+  "createdAt": "2026-08-16T22:46:56.310Z",
+  "tmuxCreated": true,
+  "sessionPath": "/private/var/folders/vl/1zvhm0bj28d1dbvbcb12b39r0000gn/T/opensaas-worktrees/task-os-repair-runtime-retention-and-watchdog-recovery/.task/os/repair-runtime-retention-and-watchdog-recovery/session.json"
+}

.task/os/repair-runtime-retention-and-watchdog-recovery/workpad.md

@@ -0,0 +1,154 @@
+# Repair runtime retention and watchdog recovery
+
+branch: `task/os/repair-runtime-retention-and-watchdog-recovery`
+stream: `stream/os`
+pr: https://app.graphite.com/github/pr/consuelohq/opensaas/2150/repair-runtime-retention-and-watchdog-recovery
+github pr: https://github.com/consuelohq/opensaas/pull/2150
+started: 2026-08-16
+
+## acceptance criteria
+
+- [x] Remove corrupt, obsolete runtime releases without weakening verification for current, previous, pinned, or content-base releases.
+- [x] Exclude worktrees and vendor trees from both semantic index implementations while retaining existing generated-output exclusions.
+- [x] Install an integrity-checked `consuelo-os` Bun clone before persisting daemon runtime paths.
+- [x] Smoke-test one isolated worker without contending with the already-running supervisor.
+- [x] Let the watchdog fall back to bounded launchd recovery only when canonical rolling recovery rejects an unhealthy pool.
+- [x] Complete the focused suite and typecheck/verification gates.
+- [ ] Publish the task.
+
+## plan
+
+1. Reproduce each retention, index, installer, and watchdog regression with a focused red test.
+2. Implement the smallest bounded fixes and validate a live named-executable cutover.
+3. Run the focused and package-level gates, inspect the final diff, and publish to `stream/os`.
+
+## current status
+
+- Implementation and verification are complete. Publish remains.
+
+## files changed
+
+- `packages/os/scripts/bootstrap.sh`
+- `packages/os/scripts/install-system-daemons.sh`
+- `packages/os/scripts/lib/index/indexer.js`
+- `packages/os/scripts/lib/lifecycle/retention.ts`
+- `packages/os/scripts/start-consuelo-daemon.sh`
+- `packages/os/scripts/workspace-watchdog.sh`
+- `packages/os/tests/index-path-exclusions.test.ts`
+- `packages/os/tests/installer-runtime-dependencies.test.ts`
+- `packages/os/tests/lifecycle-retention-uninstall.test.ts`
+- `packages/os/tests/system-daemon-reliability.test.ts`
+- `packages/workspace/scripts/lib/index/indexer.js`
+- `packages/workspace/tests/index-path-exclusions.test.js`
+
+## workspace-owned: files changed
+
+- none yet
+
+## workspace-owned: activity log
+
+- 2026-08-16 22:47:14 fs.write: `.task/os/repair-runtime-retention-and-watchdog-recovery/workpad.md`
+- 2026-08-16 23:09:59 fs.write: `.task/os/repair-runtime-retention-and-watchdog-recovery/workpad.md`
+- 2026-08-16 23:11:47 fs.write: `.task/os/repair-runtime-retention-and-watchdog-recovery/workpad.md`
+
+## workspace-owned: validation evidence
+
+- Retention regression: red on corrupt obsolete bundle digest; green after classifying only unprotected obsolete releases for deletion.
+- Index path regressions: red on `vendor` and nested worktree paths; green for both mirrored indexers.
+- Named executable regression: red on missing `ensure_named_bun_runtime`; green after APFS clone/copy, byte comparison, and atomic replacement.
+- Installer stage regression: red on missing single-worker mode; green plus live smoke worker `/ready` on port 10851 while the production supervisor remained active.
+- Watchdog fallback regression: red with no launchd recovery after canonical CLI failure; green with a bounded `kickstart` fallback.
+- Live node: ports 46321 and 46322 run as `consuelo-os`; Caddy 46320, both worker readiness endpoints, and pooled health are green.
+- Live watchdog: `StartInterval=30`, last exit code 0, and idle `not running` state between successful probes.
+- Full lifecycle retention/uninstall suite: 21/21 passing after bringing its signed-bundle fixture up to the current recovery-capability contract.
+- Full daemon reliability and index slices: 16/16 passing; installer named-runtime and isolated-stage regressions passing.
+- `yarn nx run consuelo-os:typecheck`: passing.
+- `git diff --check` and `bash -n` for every changed shell entrypoint: passing.
+- `yarn nx run consuelo-os:test` cannot enter the package because Yarn does not recognize `packages/os` in this temporary worktree. Direct Vitest execution is used for the affected suites.
+- The installer suite's 10 unrelated dry-run fixture failures reproduce unchanged from `HEAD` in an isolated archive; this repair adds two passing tests and does not add installer failures.
+
+## key decisions
+
+- Retention continues to fail closed for every protected release; only canonical, unprotected obsolete release directories can bypass strict verification on their way to deletion.
+- The installer stages `server/main.ts` as one supervised smoke worker so it does not open the singleton lifecycle endpoint or reuse the production pool snapshot.
+- Normal CLI restart remains rolling and non-destructive. Only the already-thresholded watchdog recovery path may use launchd kickstart after rolling recovery returns non-zero.
+- The process-name change reuses Bun's existing embedded signature through an APFS clone/copy; no application bundle or paid Apple signing membership is required.
+
+## notes for ko
+
+- The historical watchdog failures followed SQLite `unable to open database file` errors under critical disk pressure. The pool was already non-ready, so rolling replacement correctly refused it; the watchdog lacked the final launchd recovery step.
+
+## improvements noticed
+
+- none yet
+
+## issues and recovery
+
+- The canonical daemon installer smoke test initially failed because it started a second supervisor against the live worker-pool snapshot. The new single-worker stage mode removes that conflict.
+- Codex could boot out but not bootstrap the GUI LaunchAgent from its app sandbox. Ko reloaded the validated plist once from Terminal; the connector and both named workers recovered.
+
+---
+
+## publish checklist
+
+```bash
+bun run task:push -- --message "type(os): description" --changed
+bun run task:pr
+bun run task:finish
+```
+
+## Test-first contract
+
+behavior under test: runtime retention accepts a verified installed release whose directory name uses the canonical sha256-<digest> form, then removes all releases except current and previous; watchdog restart paths converge without a permanent lock or stopped LaunchAgent.
+existing local pattern: inspect lifecycle engine retention validation and adjacent focused tests before editing.
+new or changed tests: add a focused regression reproducing the installed-directory digest mismatch and the expected two-release keep set; add watchdog coverage only if the bug is in repository logic rather than current launchd state.
+focused red command: to be selected from the nearest lifecycle test target after inspection.
+expected red failure: retention rejects the canonical installed release or preserves obsolete releases because identity comparison uses incompatible digest forms.
+no-test waiver: not applicable.
+
+- 2026-08-16 22:47:14 append: `.task/os/repair-runtime-retention-and-watchdog-recovery/workpad.md`
+
+- 2026-08-16 22:49:59 apply-patch: `packages/os/tests/lifecycle-retention-uninstall.test.ts`
+- 2026-08-16 22:51:31 apply-patch: `packages/os/tests/lifecycle-retention-uninstall.test.ts`
+- 2026-08-16 22:52:10 apply-patch: `packages/os/scripts/lib/lifecycle/retention.ts`
+- 2026-08-16 22:52:19 apply-patch: `packages/os/tests/lifecycle-retention-uninstall.test.ts`
+## Semantic index path policy contract
+
+behavior under test: the mirrored workspace and OS semantic indexers reject vendor trees and nested worktree roots, while continuing to index ordinary source files; existing exclusions already cover node_modules, dist/build/out, caches, generated output, coverage, and task metadata.
+existing local pattern: both indexers export isIndexablePath and keep a mirrored EXCLUDE_DIRS set.
+new or changed tests: add focused path-policy tests for both package copies.
+focused red command: yarn vitest run packages/workspace/tests/index-path-exclusions.test.js packages/os/tests/index-path-exclusions.test.ts
+expected red failure: vendor and worktrees paths are currently accepted.
+no-test waiver: not applicable.
+
+- 2026-08-16 23:09:59 append: `.task/os/repair-runtime-retention-and-watchdog-recovery/workpad.md`
+
+- 2026-08-16 23:10:18 apply-patch: `packages/workspace/tests/index-path-exclusions.test.js`
+- 2026-08-16 23:10:18 apply-patch: `packages/os/tests/index-path-exclusions.test.ts`
+- 2026-08-16 23:10:34 apply-patch: `packages/workspace/scripts/lib/index/indexer.js`
+- 2026-08-16 23:10:34 apply-patch: `packages/os/scripts/lib/index/indexer.js`
+## Named service executable contract
+
+behavior under test: macOS bootstrap atomically materializes an integrity-checked Bun clone at $CONSUELO_HOME/bin/consuelo-os and persists it as BUN_BIN before daemon generation, so supervisor and worker process names are Consuelo-owned without requiring app signing.
+existing local pattern: Windows already copies Bun into the Consuelo bin directory and verifies source/destination SHA-256 before service registration.
+new or changed tests: extend installer runtime dependency contract with named executable, APFS clone fallback, byte comparison, atomic replacement, and ordering assertions.
+focused red command: yarn vitest run packages/os/tests/installer-runtime-dependencies.test.ts -t 'named Consuelo service executable'
+expected red failure: bootstrap does not yet contain ensure_named_bun_runtime or the consuelo-os target.
+no-test waiver: not applicable.
+
+- 2026-08-16 23:11:47 append: `.task/os/repair-runtime-retention-and-watchdog-recovery/workpad.md`
+
+- 2026-08-16 23:14:04 apply-patch: `packages/os/tests/installer-runtime-dependencies.test.ts`
+- 2026-08-16 23:15:06 apply-patch: `packages/os/scripts/bootstrap.sh`
+- 2026-08-16 23:28:22 apply-patch: `packages/os/tests/installer-runtime-dependencies.test.ts`
+- 2026-08-16 23:28:42 apply-patch: `packages/os/scripts/start-consuelo-daemon.sh`
+- 2026-08-16 23:28:42 apply-patch: `packages/os/scripts/install-system-daemons.sh`
+- 2026-08-16 23:31:55 apply-patch: `packages/os/tests/system-daemon-reliability.test.ts`
+- 2026-08-16 23:32:15 apply-patch: `packages/os/scripts/workspace-watchdog.sh`
+
+- 2026-08-16 23:33:04 apply-patch: `.task/os/repair-runtime-retention-and-watchdog-recovery/workpad.md`
+- 2026-08-16 23:36:21 apply-patch: `packages/os/tests/lifecycle-retention-uninstall.test.ts`
+- 2026-08-16 23:36:55 apply-patch: `packages/os/tests/lifecycle-retention-uninstall.test.ts`
+- 2026-08-16 23:38:29 apply-patch: `packages/os/tests/facade/__snapshots__/facade.test.ts.snap`
+
+- 2026-08-16 23:38:48 apply-patch: `.task/os/repair-runtime-retention-and-watchdog-recovery/workpad.md`

.task/os/restore-internal-dashboard-browser-auth-handoff/current.json

@@ -0,0 +1,19 @@
+{
+  "area": "os",
+  "stream": "stream/os",
+  "taskBranch": "task/os/restore-internal-dashboard-browser-auth-handoff",
+  "baseBranch": "stream/os",
+  "sourceBranch": "stream/os",
+  "startFrom": "stream",
+  "prNumber": 2147,
+  "prUrl": "https://github.com/consuelohq/opensaas/pull/2147",
+  "githubPrUrl": "https://github.com/consuelohq/opensaas/pull/2147",
+  "graphitePrUrl": "https://app.graphite.com/github/pr/consuelohq/opensaas/2147/restore-internal-dashboard-browser-auth-handoff",
+  "taskPrUrl": "https://github.com/consuelohq/opensaas/pull/2147",
+  "taskGraphitePrUrl": "https://app.graphite.com/github/pr/consuelohq/opensaas/2147/restore-internal-dashboard-browser-auth-handoff",
+  "worktreePath": "/private/var/folders/vl/1zvhm0bj28d1dbvbcb12b39r0000gn/T/opensaas-worktrees/task-os-restore-internal-dashboard-browser-auth-handoff",
+  "taskSession": "tsk_fdaa1f3e0fdd",
+  "tmuxSession": "opensaas-os-restore-internal-dashboard-browser-auth-handoff-fdaa1f3e",
+  "sessionPath": "/private/var/folders/vl/1zvhm0bj28d1dbvbcb12b39r0000gn/T/opensaas-worktrees/task-os-restore-internal-dashboard-browser-auth-handoff/.task/os/restore-internal-dashboard-browser-auth-handoff/session.json",
+  "createdAt": "2026-08-16T22:16:27.043Z"
+}