From ea24e7890f5787ebe479bee45d8fc901306a982f Mon Sep 17 00:00:00 2001 From: jochen Date: Tue, 13 Oct 2026 02:41:26 +0200 Subject: [PATCH] Register R340: a verb set what every agent session obeys (hq issue 340) Issue 340 is a core issue and resolves with a replay; the test lives in mesh-controller and is proved against the commit before #172. --- replays/register.go | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/replays/register.go b/replays/register.go index f404812..eeffaeb 100644 --- a/replays/register.go +++ b/replays/register.go @@ -468,6 +468,22 @@ var Register = []Replay{ "whose module does not declare the seat's paths is refused naming each", Package: "./internal/catalogue", Test: "TestReplay412", Files: []string{"internal/catalogue/replay412_test.go"}, Home: "mesh-controller", HomeRef: "3bdab29a5a0ed0f15cbfdb4738a321f968ac9467"}, + // A verb set what every agent session obeys (2026-10-09): the agent's module keeps the managed settings and tool + // servers every Claude Code session on a node obeys in a mergeable file, and the settings verb took any key for it + // from any caller, so an agent could plant a SessionStart hook in the operator's sessions on every node; an + // identity provider's empty runtime configuration took a url of the caller's the same way. The fix's own tests + // read what the fix added, so the replay is a test of its own in the controller, written with only what it had + // before — a mesh, a registered manifest, an assignment, the settings verb run as a verb and as the terminal runs + // it, the inventory's layer — laid over the commit before. Needs a store: MESH_TEST_POSTGRES. Fix is the merge of + // its pull request (mesh-controller #172); Home is the commit that added the replay, reachable once its pull + // request merges. + {ID: "R340", Issue: 340, Kind: InRepository, Repository: "mesh-controller", Fix: "4d60628f37530c23c072011a697e6014de14b3f6", + What: "the settings verb took a SessionStart hook in the agent module's managed settings, a tool server of the " + + "caller's, and a url for an identity provider's empty runtime configuration, from any caller of the mesh's verbs", + Asserts: "through a verb, any change to the layer of a module with a mergeable file not marked trusted: false is " + + "refused as the controller's terminal's and leaves the layer as it was; at the terminal it is taken", + Package: "./cmd/mesh-controller", Test: "TestReplay340", Files: []string{"cmd/mesh-controller/replay340_test.go"}, + Home: "mesh-controller", HomeRef: "e44c726a38125ade30a6d70cee9873a4e2ea6ac2"}, } // Find is the replay of that id, or of that issue. -- 2.54.0