Artifact 9783c36c99b635cf18abbb7c0c7a39aea62cb23702717b1bc4bc252ad7300511:
- File
patterns/stage.md
— part of check-in
[ad2e6d5e59]
at
2026-10-31 12:26:52
on branch agent-tools
— Staging is mechanical: a session sends patterns/stage.md as a run with a check-in, and the node stages it into the release root's staged/
Intent: the maintainer, 2026-10-31, asked how a session could stage and chose "mechanical" (ollama forum 1bb1562f37: "yes, please."). A session's sandbox writes only its workspace, so it could not stage; now none needs to, and accept stays the maintainer's.
Expression: a run value, $$releases$$, names the release root the node runs from (src/ocx/launch.cr, src/ocx/steps.cr). r-senders.json may list sandbox.read_write paths, written with values, that a run from a user holding R alone may write besides its workspace; src/ocx/bounds.cr fills and checks them, and the tree's r-senders.json lists "$$releases$$/staged". A run with no files step may still name a check-in with `of`, given to its process as $$checkout$$ (src/ocx/commands/create.cr, src/ocx/messages/run.cr). patterns/stage.md is the stage run: its own directory, then sh that clones the server anonymously, opens the check-in, builds ocx2 and runs `ocx2 stage` with --root $$releases$$, its sandbox writing only its workspace and $$releases$$/staged. stage itself writes nothing in the release root outside staged/. USAGE.md, docs/protocol-v1.md and HISTORY.md say so.
Review: Codex wrote it from the reviewer's plan; its first pass stopped, rightly, because a clone step needs a password step, which R-sent runs never take, and the plan was changed to an anonymous clone in the run's own command. The reviewer renamed the pattern's process user from codex-task to stage-task. It only takes effect on a node once a release holding it is accepted, so the first such release is staged by hand.
Demonstrates: spec/ocx/steps_spec.cr, spec/ocx/create_spec.cr, spec/ocx/decisions_spec.cr and spec/ocx/release_commands_spec.cr: bounds allow $$releases$$/staged when r-senders.json lists it and refuse another path, $$releases$$ is filled, and stage writes only under staged/. crystal run ci.cr green: 591 examples, coverage 100%. (user: ollama-session size: 1900) [more...]
0000: 41 20 73 65 73 73 69 6f 6e 20 63 6f 6d 6d 69 74 A session commit
0010: 73 20 61 6e 64 20 70 75 73 68 65 73 20 74 68 65 s and pushes the
0020: 20 63 68 65 63 6b 2d 69 6e 20 74 6f 20 73 74 61 check-in to sta
0030: 67 65 2c 20 74 68 65 6e 20 73 65 6e 64 73 20 74 ge, then sends t
0040: 68 69 73 20 72 75 6e 20 66 72 6f 6d 20 69 74 73 his run from its
0050: 20 63 6c 6f 6e 65 20 61 73 20 69 74 73 20 6f 77 clone as its ow
0060: 6e 20 75 73 65 72 20 68 6f 6c 64 69 6e 67 20 60 n user holding `
0070: 52 60 3a 20 60 6f 63 78 32 20 63 72 65 61 74 65 R`: `ocx2 create
0080: 20 22 73 74 61 67 65 20 43 48 45 43 4b 49 4e 22 "stage CHECKIN"
0090: 20 2d 2d 70 61 74 74 65 72 6e 20 55 52 4c 20 2d --pattern URL -
00a0: 2d 6e 6f 64 65 20 4e 4f 44 45 20 2d 2d 74 6f 20 -node NODE --to
00b0: 50 4f 53 54 20 2d 2d 6f 66 20 43 48 45 43 4b 49 POST --of CHECKI
00c0: 4e 60 2e 20 55 52 4c 20 69 73 20 74 68 69 73 20 N`. URL is this
00d0: 66 69 6c 65 27 73 20 63 6f 6e 74 65 6e 74 2d 61 file's content-a
00e0: 64 64 72 65 73 73 65 64 20 72 61 77 20 55 52 4c ddressed raw URL
00f0: 20 61 66 74 65 72 20 69 74 20 69 73 20 70 75 62 after it is pub
0100: 6c 69 73 68 65 64 20 61 73 20 61 20 74 65 63 68 lished as a tech
0110: 2d 6e 6f 74 65 20 61 74 74 61 63 68 6d 65 6e 74 -note attachment
0120: 2c 20 61 73 20 66 6f 72 20 74 68 65 20 43 6f 64 , as for the Cod
0130: 65 78 20 74 61 73 6b 20 70 61 74 74 65 72 6e 2e ex task pattern.
0140: 20 54 68 65 20 6e 6f 64 65 20 63 6c 6f 6e 65 73 The node clones
0150: 20 61 6e 6f 6e 79 6d 6f 75 73 6c 79 2c 20 6f 70 anonymously, op
0160: 65 6e 73 20 43 48 45 43 4b 49 4e 2c 20 62 75 69 ens CHECKIN, bui
0170: 6c 64 73 20 61 6e 64 20 73 74 61 67 65 73 20 69 lds and stages i
0180: 74 20 75 6e 64 65 72 20 69 74 73 20 72 65 6c 65 t under its rele
0190: 61 73 65 20 72 6f 6f 74 27 73 20 60 73 74 61 67 ase root's `stag
01a0: 65 64 2f 60 2e 20 54 68 65 20 6d 61 69 6e 74 61 ed/`. The mainta
01b0: 69 6e 65 72 20 61 63 63 65 70 74 73 20 69 74 20 iner accepts it
01c0: 66 72 6f 6d 20 74 68 65 20 70 61 67 65 2e 0a 0a from the page...
01d0: 60 60 60 6a 73 6f 6e 0a 7b 0a 20 20 22 77 6f 72 ```json.{. "wor
01e0: 6b 73 70 61 63 65 22 3a 20 5b 0a 20 20 20 20 7b kspace": [. {
01f0: 0a 20 20 20 20 20 20 22 73 74 65 70 22 3a 20 22 . "step": "
0200: 64 69 72 65 63 74 6f 72 79 22 2c 0a 20 20 20 20 directory",.
0210: 20 20 22 61 74 22 3a 20 22 24 24 72 6f 6f 74 24 "at": "$$root$
0220: 24 2f 24 24 75 73 65 72 24 24 2f 70 72 6f 6a 65 $/$$user$$/proje
0230: 63 74 73 2f 24 24 70 72 6f 6a 65 63 74 24 24 2f cts/$$project$$/
0240: 24 24 72 75 6e 24 24 22 2c 0a 20 20 20 20 20 20 $$run$$",.
0250: 22 72 65 6d 6f 76 65 5f 6f 6e 22 3a 20 22 73 61 "remove_on": "sa
0260: 76 65 64 22 0a 20 20 20 20 7d 0a 20 20 5d 2c 0a ved". }. ],.
0270: 20 20 22 73 61 6e 64 62 6f 78 22 3a 20 7b 0a 20 "sandbox": {.
0280: 20 20 20 22 75 69 64 22 3a 20 31 30 30 30 2c 0a "uid": 1000,.
0290: 20 20 20 20 22 67 69 64 22 3a 20 31 30 30 30 2c "gid": 1000,
02a0: 0a 20 20 20 20 22 63 61 70 61 62 69 6c 69 74 69 . "capabiliti
02b0: 65 73 22 3a 20 5b 5d 2c 0a 20 20 20 20 22 6e 65 es": [],. "ne
02c0: 74 77 6f 72 6b 22 3a 20 74 72 75 65 2c 0a 20 20 twork": true,.
02d0: 20 20 22 6f 77 6e 5f 73 65 73 73 69 6f 6e 22 3a "own_session":
02e0: 20 74 72 75 65 2c 0a 20 20 20 20 22 65 6e 64 73 true,. "ends
02f0: 5f 77 69 74 68 5f 6e 6f 64 65 22 3a 20 74 72 75 _with_node": tru
0300: 65 2c 0a 20 20 20 20 22 72 65 61 64 5f 6f 6e 6c e,. "read_onl
0310: 79 22 3a 20 5b 0a 20 20 20 20 20 20 22 2f 75 73 y": [. "/us
0320: 72 22 2c 20 22 2f 62 69 6e 22 2c 20 22 2f 73 62 r", "/bin", "/sb
0330: 69 6e 22 2c 20 22 2f 6c 69 62 22 2c 20 22 2f 6c in", "/lib", "/l
0340: 69 62 36 34 22 2c 0a 20 20 20 20 20 20 22 2f 65 ib64",. "/e
0350: 74 63 2f 72 65 73 6f 6c 76 2e 63 6f 6e 66 22 2c tc/resolv.conf",
0360: 20 22 2f 65 74 63 2f 68 6f 73 74 73 22 2c 20 22 "/etc/hosts", "
0370: 2f 65 74 63 2f 6e 73 73 77 69 74 63 68 2e 63 6f /etc/nsswitch.co
0380: 6e 66 22 2c 20 22 2f 65 74 63 2f 73 73 6c 2f 63 nf", "/etc/ssl/c
0390: 65 72 74 73 22 0a 20 20 20 20 5d 2c 0a 20 20 20 erts". ],.
03a0: 20 22 72 65 61 64 5f 77 72 69 74 65 22 3a 20 5b "read_write": [
03b0: 22 24 24 77 6f 72 6b 73 70 61 63 65 24 24 22 2c "$$workspace$$",
03c0: 20 22 24 24 72 65 6c 65 61 73 65 73 24 24 2f 73 "$$releases$$/s
03d0: 74 61 67 65 64 22 5d 2c 0a 20 20 20 20 22 68 6f taged"],. "ho
03e0: 6d 65 73 22 3a 20 5b 5d 2c 0a 20 20 20 20 22 66 mes": [],. "f
03f0: 69 6c 65 73 22 3a 20 5b 0a 20 20 20 20 20 20 7b iles": [. {
0400: 0a 20 20 20 20 20 20 20 20 22 61 74 22 3a 20 22 . "at": "
0410: 2f 65 74 63 2f 70 61 73 73 77 64 22 2c 0a 20 20 /etc/passwd",.
0420: 20 20 20 20 20 20 22 74 65 78 74 22 3a 20 22 24 "text": "$
0430: 24 75 73 65 72 24 24 3a 78 3a 31 30 30 30 3a 31 $user$$:x:1000:1
0440: 30 30 30 3a 3a 24 24 77 6f 72 6b 73 70 61 63 65 000::$$workspace
0450: 24 24 3a 2f 62 69 6e 2f 73 68 5c 6e 22 0a 20 20 $$:/bin/sh\n".
0460: 20 20 20 20 7d 0a 20 20 20 20 5d 2c 0a 20 20 20 }. ],.
0470: 20 22 70 72 6f 63 22 3a 20 22 2f 70 72 6f 63 22 "proc": "/proc"
0480: 2c 0a 20 20 20 20 22 64 65 76 22 3a 20 22 2f 64 ,. "dev": "/d
0490: 65 76 22 2c 0a 20 20 20 20 22 74 6d 70 22 3a 20 ev",. "tmp":
04a0: 22 2f 74 6d 70 22 0a 20 20 7d 2c 0a 20 20 22 6c "/tmp". },. "l
04b0: 69 6d 69 74 73 22 3a 20 7b 0a 20 20 20 20 22 77 imits": {. "w
04c0: 61 6c 6c 22 3a 20 22 32 68 22 2c 0a 20 20 20 20 all": "2h",.
04d0: 22 63 70 75 22 3a 20 33 36 30 30 2c 0a 20 20 20 "cpu": 3600,.
04e0: 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 35 31 "processes": 51
04f0: 32 2c 0a 20 20 20 20 22 66 69 6c 65 73 22 3a 20 2,. "files":
0500: 22 32 35 36 4d 22 0a 20 20 7d 2c 0a 20 20 22 70 "256M". },. "p
0510: 72 6f 63 65 73 73 22 3a 20 7b 0a 20 20 20 20 22 rocess": {. "
0520: 75 73 65 72 22 3a 20 22 73 74 61 67 65 2d 74 61 user": "stage-ta
0530: 73 6b 22 2c 0a 20 20 20 20 22 63 6f 6d 6d 61 6e sk",. "comman
0540: 64 22 3a 20 5b 0a 20 20 20 20 20 20 22 2f 62 69 d": [. "/bi
0550: 6e 2f 73 68 22 2c 20 22 2d 63 22 2c 0a 20 20 20 n/sh", "-c",.
0560: 20 20 20 22 66 6f 73 73 69 6c 20 63 6c 6f 6e 65 "fossil clone
0570: 20 24 24 73 65 72 76 65 72 24 24 20 24 24 77 6f $$server$$ $$wo
0580: 72 6b 73 70 61 63 65 24 24 2f 63 6c 6f 6e 65 2e rkspace$$/clone.
0590: 66 6f 73 73 69 6c 20 26 26 20 6d 6b 64 69 72 20 fossil && mkdir
05a0: 24 24 77 6f 72 6b 73 70 61 63 65 24 24 2f 74 72 $$workspace$$/tr
05b0: 65 65 20 26 26 20 66 6f 73 73 69 6c 20 6f 70 65 ee && fossil ope
05c0: 6e 20 24 24 77 6f 72 6b 73 70 61 63 65 24 24 2f n $$workspace$$/
05d0: 63 6c 6f 6e 65 2e 66 6f 73 73 69 6c 20 24 24 63 clone.fossil $$c
05e0: 68 65 63 6b 6f 75 74 24 24 20 2d 2d 63 68 64 69 heckout$$ --chdi
05f0: 72 20 24 24 77 6f 72 6b 73 70 61 63 65 24 24 2f r $$workspace$$/
0600: 74 72 65 65 20 2d 2d 6e 6f 73 79 6e 63 20 26 26 tree --nosync &&
0610: 20 63 64 20 24 24 77 6f 72 6b 73 70 61 63 65 24 cd $$workspace$
0620: 24 2f 74 72 65 65 20 26 26 20 6e 69 63 65 20 2d $/tree && nice -
0630: 6e 20 31 39 20 73 68 61 72 64 73 20 62 75 69 6c n 19 shards buil
0640: 64 20 6f 63 78 32 20 26 26 20 6e 69 63 65 20 2d d ocx2 && nice -
0650: 6e 20 31 39 20 69 6f 6e 69 63 65 20 2d 63 33 20 n 19 ionice -c3
0660: 62 69 6e 2f 6f 63 78 32 20 73 74 61 67 65 20 24 bin/ocx2 stage $
0670: 24 77 6f 72 6b 73 70 61 63 65 24 24 2f 74 72 65 $workspace$$/tre
0680: 65 20 2d 2d 72 6f 6f 74 20 24 24 72 65 6c 65 61 e --root $$relea
0690: 73 65 73 24 24 22 0a 20 20 20 20 5d 2c 0a 20 20 ses$$". ],.
06a0: 20 20 22 63 77 64 22 3a 20 22 24 24 77 6f 72 6b "cwd": "$$work
06b0: 73 70 61 63 65 24 24 22 2c 0a 20 20 20 20 22 6b space$$",. "k
06c0: 65 65 70 22 3a 20 7b 22 73 74 64 65 72 72 22 3a eep": {"stderr":
06d0: 20 22 34 4b 22 2c 20 22 73 74 64 6f 75 74 22 3a "4K", "stdout":
06e0: 20 22 34 4b 22 2c 20 22 73 74 64 6f 75 74 5f 77 "4K", "stdout_w
06f0: 68 65 6e 22 3a 20 22 61 6c 77 61 79 73 22 7d 2c hen": "always"},
0700: 0a 20 20 20 20 22 65 6e 76 22 3a 20 7b 22 48 4f . "env": {"HO
0710: 4d 45 22 3a 20 22 24 24 77 6f 72 6b 73 70 61 63 ME": "$$workspac
0720: 65 24 24 22 2c 20 22 55 53 45 52 22 3a 20 22 24 e$$", "USER": "$
0730: 24 75 73 65 72 24 24 22 2c 20 22 50 41 54 48 22 $user$$", "PATH"
0740: 3a 20 22 2f 75 73 72 2f 6c 6f 63 61 6c 2f 62 69 : "/usr/local/bi
0750: 6e 3a 2f 75 73 72 2f 62 69 6e 3a 2f 62 69 6e 22 n:/usr/bin:/bin"
0760: 7d 0a 20 20 7d 0a 7d 0a 60 60 60 0a }. }.}.```.