duckworth: row 205 manifest review (duckworth-0117) approve on Morgana ce6a96ad6
This commit is contained in:
jason.woltje committed
1 parent
ad3f9f31c0
commit
02069f3148
2 files changed
+67
No files matched your search
@@ -0,0 +1,66 @@
|
||||
# Row 205 (193b1a, #1703) manifest review (duckworth-0117)
|
||||
|
||||
- Reviewer: Duckworth (Opus 5.5), 2026-10-22.
|
||||
- Request: sage-2474 (04:57:24Z).
|
||||
- Candidate: ce6a96ad6153a0a7a689e6d9d0f625b55eb86b51 on morgana/row205-0fa7, base 0fa7bf421 (the current origin/refactor tip). Three commits: f751505ad design, 59f708ca2 build, ce6a96ad6 r2.
|
||||
- Method: git reads only. Nothing ran. The run evidence is Morgana's slot205 log and Sage's gate, as reported in sage-2474.
|
||||
|
||||
## Verdict: approve ce6a96ad6, manifest digest 858463b1. No blockers.
|
||||
|
||||
I sign the r2 test diff in message-filter.test.mjs (mos-1262): the `put()` event body at :40, which the :125 and :128 checks depend on, and the claims item at :175-179.
|
||||
|
||||
## Checks
|
||||
|
||||
- **Manifest.** The four-path manifest I rebuilt from the candidate blobs hashes to 858463b1f3c9…bcbe1, the digest Sage stated:
|
||||
- BUILD.md 81f2ff2f…
|
||||
- DESIGN.md 100c18bc…
|
||||
- broker.mjs 261c0f7d…
|
||||
- message-filter.test.mjs 96c1f224…
|
||||
- **Scope.** `git diff 0fa7bf421 ce6a96ad6` touches only those four paths. broker.mjs is +37/−1, and r2 doesn't change it (sage-2430).
|
||||
- **Rule (design 3.1, row 193 5.7).** `#hiddenMessage` (broker.mjs:555-562) hides a message when its thread owner starts with `user:`, isn't `#owner(s)`, and `#readable` is false. `#readable` (:565) returns false until 193b2. Human and tester threads are never hidden, so row 177 is unchanged. A reader has no owner, so every user thread is hidden from it.
|
||||
- **trail (:3938-4037).**
|
||||
- A hidden subject returns `[]`. An unknown id also returns `[]`, so the answer doesn't confirm the id exists. That follows 5.7's reason over its code (design question 3).
|
||||
- After collection, the drop loop removes hidden messages, their deliveries, and events whose subject is a hidden message. That covers all three ways `#trail` reaches a message: by id, by `decision`, and through `task.created` → `human.input` → `body.message`.
|
||||
- **replies (:3676-3692).**
|
||||
- A hidden id fails `message-not-found`, the same as an unknown id.
|
||||
- The filter is in the SQL (`NOT EXISTS … substr(t.owner,1,5)='user:' AND t.owner IS NOT ?`), so `LIMIT` applies after it and a page still fills.
|
||||
- The parameter `#owner(s) || null` makes a reader's clause hide every user thread, which matches the JS rule.
|
||||
- **Other message reads.** `thread.messages` goes through `#thread` (:541), which refuses a thread the caller doesn't own. `message.read` needs `to_role` to be the caller. The human mailbox reads `to_role='human'` only. None of these reach another user's thread messages, so 205a's two verbs are the whole read surface 5.7 names.
|
||||
|
||||
## The signed test diff (r2)
|
||||
|
||||
- **put() at :40.**
|
||||
- `#trail` reaches events on a decision by `subject = d` or `json_extract(body,'$.decision') = d` (:3967-3973).
|
||||
- r1 wrote every event body as `{}`. That left the shown message's event out of reach, so r1's "its event shows" check failed (sage-2428). It also made "no hidden event" vacuous, because the hidden event was never collected.
|
||||
- r2 writes `{decision}` when the message has one. Both events are now collected, and the drop loop must remove one and keep the other. So :125 is a real positive and :128 is a real negative.
|
||||
- Messages without a decision still get `{}`, so the other tests' fixtures are unchanged.
|
||||
- **Claims at :175-179.**
|
||||
- A thread run's `role.claim` writes `thread_claims`, and `agents` reads `role_claims` only. So no owner verb shows a thread claim, and that gap predates 205.
|
||||
- The pin now checks through `threadsState` that the claim is recorded with holder `assistant-run`. This is ruling sage-2430 (a).
|
||||
- It proves the filter leaves claims alone. It doesn't prove the owner can see them. The comment says so, and #1782 moves the check to an owner verb.
|
||||
- Accepted as ruled. The PRD :1084 owner-sees-claims promise stays open until #1782 lands, and that has to happen before any user thread goes live.
|
||||
|
||||
## Mutants vs tests
|
||||
|
||||
Each design 3.5 mutant has a test that should kill it. Morgana's slot205 log reports all five killed.
|
||||
|
||||
| Mutant | Change | Killing test |
|
||||
| --- | --- | --- |
|
||||
| M1 | `#readable` true | trail returns rows for the hidden id (:88-95), and the pin's `[]` (:188) |
|
||||
| M11 | the drop loop removes nothing | :126-128, since the decision path now collects the hidden message and event |
|
||||
| M12 | the NOT EXISTS clause removed | the page-fill test (:133-139) |
|
||||
| M13 | trail fails instead of `[]` | the hidden vs unknown equality (:93-94) |
|
||||
| M14 | replies returns `[]` | the `message-not-found` code check (:106) |
|
||||
|
||||
## Notes (don't block)
|
||||
|
||||
- N1. In `#trail`, the `runs` set (:4005) is built before the hidden drop. A hidden message's event that was collected through a decision still adds its `actor_run` (`user:alice` in the fixture) to `runs`. That pulls that run's `session.launched`/`session.ended` events and `role_claims` onto the trail. No body leaks, and nothing writes a `user:` run's session events before R3. For 205b or R3: build `runs` after the drop, or state in 5.7 that a user's session events are governance.
|
||||
- N2. The hide rule now exists twice: once in `#hiddenMessage` and once in the replies SQL. The replies comment (:3683-3684) says 193b2 adds the share exception to the SQL too. 193b2's brief should name both sites, and have a test where a share makes one message readable through both trail and replies.
|
||||
- N3. `thread.messages` on another user's thread answers `thread-not-owned`, not `thread-not-found` (`#thread`, :544-545). That confirms the thread exists. This predates row 177 and is outside 5.7's message scope. 205b's viewer work could align it with the unknown-id answer.
|
||||
- N4. #1782 carries the PRD :1084 owner-sees-claims promise. It must land before the first user thread goes live, as BUILD.md r2 says.
|
||||
|
||||
## Next
|
||||
|
||||
1. Morgana makes the in-review move.
|
||||
2. Sage posts this note and names a gap. I record approve on ce6a96ad6 then.
|
||||
3. Row 205 lands with the four manifest paths.
|
||||
@@ -1457,3 +1457,4 @@ are never rewritten or removed; corrections are new entries.
|
||||
2026-10-22T02:21Z | Duckworth (Opus 5.5) | row 253 C4 delta static look on Gander 761893dac (duckworth-0113) | approve: B1 fork-free read and post-pass-1 budget closed, M1 BUILD-LOG unpinned, manifest 34d52cc5 verified; notes N5-N7 |
|
||||
2026-10-22T02:25Z | Duckworth (Opus 5.5) | row 253 integration check on Gander 8b8f8d781 over 378a76b85 (duckworth-0114) | clean: manifest 34d52cc5 blobs equal 9e916c454, BUILD-LOG and DEFERRED pure appends with upstream prefix intact; gate candidate approved |
|
||||
2026-10-22T04:53Z | Duckworth (Opus 5.5) | row 253 re-integration check on Gander 8de88458d over 0fa7bf421 (duckworth-0116) | clean: manifest 24b6a01b, six blobs equal 8b8f8d781, README row253 hunks unchanged, no upstream lines removed; N9 sandbox.mjs import drift covered by whole-file run; gate candidate approved |
|
||||
2026-10-22T05:01Z | Duckworth (Opus 5.5) | row 205 (193b1a, #1703) manifest review on Morgana ce6a96ad6, digest 858463b1, signs r2 test diff (mos-1262) (duckworth-0117) | approve, N1-N4 notes |
|
||||
Reference in new issue
Block a user