diff --git a/agents/darkwing/work/queue-195/BUILD.md b/agents/darkwing/work/queue-195/BUILD.md index bb6d60665..5d1b0fde1 100644 --- a/agents/darkwing/work/queue-195/BUILD.md +++ b/agents/darkwing/work/queue-195/BUILD.md @@ -157,5 +157,5 @@ TMPDIR. This file's results are a doc-only commit on top of the build, so nothin Deviation 6 says the node F9 runs is root's own. At 37171f65b the script didn't check that. F9 ran `--node` as root before F10's path check, so the header's "root itself only reads" was false (Duckworth's N1, `agents/duckworth/work/row195/REVIEW-m1.md` at 6afcee2a5). A host installed as designed -was safe, because `case2-unit.sh` refused a non-root-owned `--node`. The fix and its tests are in -`FOLLOWUP.md` next to this file. +was safe, because `case2-unit.sh` refused a non-root-owned `--node`. Row 245 carries the fix and its +tests: `agents/darkwing/work/queue-245/BUILD.md`. diff --git a/agents/darkwing/work/queue-195/FOLLOWUP.md b/agents/darkwing/work/queue-245/BUILD.md similarity index 63% rename from agents/darkwing/work/queue-195/FOLLOWUP.md rename to agents/darkwing/work/queue-245/BUILD.md index 50ffc2f2a..fd79a21ca 100644 --- a/agents/darkwing/work/queue-195/FOLLOWUP.md +++ b/agents/darkwing/work/queue-245/BUILD.md @@ -1,8 +1,13 @@ -# Row 195 follow-up: Duckworth's N1-N3 on `scripts/case1-accept.sh` +# Row 245 build: Duckworth's N1-N3 on `scripts/case1-accept.sh` (row 195 follow-up) Duckworth approved row 195's manifest round 1 (duckworth-0088, `agents/duckworth/work/row195/REVIEW-m1.md` -at 6afcee2a5) with three notes that don't block. Sage asked for this follow-up in sage-1876 and opens the -row after 195 lands. The branch is `darkwing/row195-n1`, on 37171f65b. +at 6afcee2a5) with three notes that don't block. Row 195's code landed as b65014647, and the notes are in +`docs/plans/DEFERRED.md` (d6cff0cdd). Row 245 carries them: brief `docs/plans/2026-10-20_hub-own-uid.md` ยง +"Row 195 follow-up" at 62ddc96cc, owner Darkwing, reviewer Duckworth, gate owner Sage (sage-1923). + +The branch is `darkwing/row245`, on 62ddc96cc. Its first commit is a cherry-pick of `darkwing/row195-n1` +1e3c4767c, which was written on 37171f65b and never run. The script, test and TOOLS.md blobs are the same +as in 1e3c4767c, and none of those paths changed between 37171f65b and 62ddc96cc. ## What changes @@ -16,8 +21,10 @@ took the path check, plus one more: evidence. I didn't run the parse through `AS_USER`. That would hand a check about a root file to the stack's user, -and a process running as `mosaic` could change what that node prints. Rechecking ownership costs one -loop and doesn't depend on how the host was installed. +and a process running as `mosaic` shares that node's uid. Whether it could change what node prints then +turns on the host's ptrace setting, and the root-only check doesn't depend on that. Sage agreed in +sage-1877. Rechecking ownership costs one loop and doesn't depend on +how the host was installed. N2. The header (:9-15) and the `docs/TOOLS.md` entry now list what root runs: `systemctl show` and `is-enabled` (F1, P11), `curl` on the loopback healthz (F2), `sudo -l` (P1, P3), `sudo -u jarvis bwrap @@ -27,9 +34,9 @@ N3. F6 matched `--claude` by prefix, so `/opt/mosaic-stack/claude-/../claud path check. F6 now fails on any `..` segment, before it runs `--version`. F10 compares for equality, so it needed no change. -BUILD.md gets a correction entry for deviation 6. DESIGN.md is unchanged. Gosalyn's Q4 answer makes the -"either works" wording at `DESIGN.md:336-338` stale, but an approved design changes only with Sage's -authorization, so it's left for Sage to rule on. +Row 195's BUILD.md gets a correction entry for deviation 6. Row 195's DESIGN.md is unchanged. Its "either +works" wording at `DESIGN.md:336-338` is superseded by gosalyn-0087 (root writes `dev.args` at W10), and +it stays in place: an approved design isn't edited (sage-1877). ## Tests @@ -57,8 +64,10 @@ The twelve from row 195 still apply, unchanged. These four are new, each one exa | 15 | `not_root_only` checks only the file, not the directories above it | F9 won't run (writable `bin/`) | | 16 | F6 accepts a `..` segment | F6 stub, path and `..` | +The brief's gate asks for a mutant for each of N1 and N3. Mutants 13-15 are N1's, and 16 is N3's. + ## Slot plan -Same shape as row 195's steps, on the follow-up's tip: the single test file, then the sixteen mutants, -then the gate (the cli suite and every `scripts/test-*.sh`), each behind the busy checks and chained -with `&&`. The scripts are ready in `/mnt/storage/scratch/darkwing-195n-out/`. +Same shape as row 195's steps, on this row's tip: the single test file, then the sixteen mutants, then +the gate (the cli suite and every `scripts/test-*.sh`), each behind the busy checks and chained with +`&&`. The scripts are in `/mnt/storage/scratch/darkwing-245-out/`. None has run.