Artifact 9783c36c99b635cf18abbb7c0c7a39aea62cb23702717b1bc4bc252ad7300511:

• File patterns/stage.md — part of check-in [ad2e6d5e59] at 2026-10-31 12:26:52 on branch agent-tools — Staging is mechanical: a session sends patterns/stage.md as a run with a check-in, and the node stages it into the release root's staged/

  Intent: the maintainer, 2026-10-31, asked how a session could stage and chose "mechanical" (ollama forum 1bb1562f37: "yes, please."). A session's sandbox writes only its workspace, so it could not stage; now none needs to, and accept stays the maintainer's.

  Expression: a run value, $$releases$$, names the release root the node runs from (src/ocx/launch.cr, src/ocx/steps.cr). r-senders.json may list sandbox.read_write paths, written with values, that a run from a user holding R alone may write besides its workspace; src/ocx/bounds.cr fills and checks them, and the tree's r-senders.json lists "$$releases$$/staged". A run with no files step may still name a check-in with `of`, given to its process as $$checkout$$ (src/ocx/commands/create.cr, src/ocx/messages/run.cr). patterns/stage.md is the stage run: its own directory, then sh that clones the server anonymously, opens the check-in, builds ocx2 and runs `ocx2 stage` with --root $$releases$$, its sandbox writing only its workspace and $$releases$$/staged. stage itself writes nothing in the release root outside staged/. USAGE.md, docs/protocol-v1.md and HISTORY.md say so.

  Review: Codex wrote it from the reviewer's plan; its first pass stopped, rightly, because a clone step needs a password step, which R-sent runs never take, and the plan was changed to an anonymous clone in the run's own command. The reviewer renamed the pattern's process user from codex-task to stage-task. It only takes effect on a node once a release holding it is accepted, so the first such release is staged by hand.

  Demonstrates: spec/ocx/steps_spec.cr, spec/ocx/create_spec.cr, spec/ocx/decisions_spec.cr and spec/ocx/release_commands_spec.cr: bounds allow $$releases$$/staged when r-senders.json lists it and refuse another path, $$releases$$ is filled, and stage writes only under staged/. crystal run ci.cr green: 591 examples, coverage 100%. (user: ollama-session size: 1900) [more...]

{
  "workspace": [
    {
      "step": "directory",
      "at": "$$root$$/$$user$$/projects/$$project$$/$$run$$",
      "remove_on": "saved"
    }
  ],
  "sandbox": {
    "uid": 1000,
    "gid": 1000,
    "capabilities": [],
    "network": true,
    "own_session": true,
    "ends_with_node": true,
    "read_only": [
      "/usr", "/bin", "/sbin", "/lib", "/lib64",
      "/etc/resolv.conf", "/etc/hosts", "/etc/nsswitch.conf", "/etc/ssl/certs"
    ],
    "read_write": ["$$workspace$$", "$$releases$$/staged"],
    "homes": [],
    "files": [
      {
        "at": "/etc/passwd",
        "text": "$$user$$:x:1000:1000::$$workspace$$:/bin/sh\n"
      }
    ],
    "proc": "/proc",
    "dev": "/dev",
    "tmp": "/tmp"
  },
  "limits": {
    "wall": "2h",
    "cpu": 3600,
    "processes": 512,
    "files": "256M"
  },
  "process": {
    "user": "stage-task",
    "command": [
      "/bin/sh", "-c",
      "fossil clone $$server$$ $$workspace$$/clone.fossil && mkdir $$workspace$$/tree && fossil open $$workspace$$/clone.fossil $$checkout$$ --chdir $$workspace$$/tree --nosync && cd $$workspace$$/tree && nice -n 19 shards build ocx2 && nice -n 19 ionice -c3 bin/ocx2 stage $$workspace$$/tree --root $$releases$$"
    ],
    "cwd": "$$workspace$$",
    "keep": {"stderr": "4K", "stdout": "4K", "stdout_when": "always"},
    "env": {"HOME": "$$workspace$$", "USER": "$$user$$", "PATH": "/usr/local/bin:/usr/bin:/bin"}
  }
}