From 07fddf56f42ab243fd347c45454fa72e620a80f9 Mon Sep 17 00:00:00 2001 From: Jason Woltje Date: Tue, 20 Oct 2026 20:29:08 -0500 Subject: [PATCH] duckworth: PRD 1.7 and 1.8 landing review (duckworth-0075) approve on Honker 46c8adaeb --- .../work/prd18/REVIEW-landing-17-18.md | 59 +++++++++++++++++++ docs/SESSIONS.md | 1 + 2 files changed, 60 insertions(+) create mode 100644 agents/duckworth/work/prd18/REVIEW-landing-17-18.md diff --git a/agents/duckworth/work/prd18/REVIEW-landing-17-18.md b/agents/duckworth/work/prd18/REVIEW-landing-17-18.md new file mode 100644 index 000000000..bd64de3f4 --- /dev/null +++ b/agents/duckworth/work/prd18/REVIEW-landing-17-18.md @@ -0,0 +1,59 @@ +# Review: PRD 1.7 and 1.8 landing (duckworth-0075) + +Reviewer Duckworth (Opus 5.5), 2026-10-21. Asked in sage-1636 and sage-1641. Subject: +`honker/prd-17-18` 46c8adaeb, parent 011d41ba6, 4 files. Checked: +- `docs/prd/mosaic-stack.md`: 1196 lines, sha256 a5bba06c…4fc6209f3. +- Sources: 1.7 is `PRD-1.7-DRAFT.md` at 9ba31b5b3, sha256 e896746d…1d328647. 1.8 is r7 at 82df17347, + sha256 de079281…727440cd. +- refactor 816d48b03 hasn't touched the four paths since 011d41ba6. + +## Verdict: approve, no change to what any requirement allows or forbids + +1. Every word of each requirement matches its source. A script took each quoted block of both drafts, + collapsed the whitespace and checked each item for one contiguous match in the landed file. All 42 + items match, including every sub-bullet, the CRED-1 and WAIT-3 appends and the risks bullet. The only + two misses are the status sentences, where the drafts had a `` placeholder. + I read the whole diff (8 hunks), and no added line comes from anywhere but the drafts or the five + deviations below. +2. The deviations are layout and approval record only: + - The status field goes from 1.6 to 1.8. The 1.6 landing bumped this same field in place + (63c82f1c4). + - The 1.7 status cites decision d52febb5 (prd.approve, yes). DECISIONS:1611 confirms decision 21 + was resolved yes by jason at 2026-10-20T20:36:47Z on the 9ba31b5b3 file. + - The 1.8 status says Jason approved it in T3 through Mos (Q192). Its source bullet quotes + DECISIONS:1765 exactly, and the Q191 source bullet quotes :1745 ("Q13: that looks better") + exactly. + - COS-3's 1.7 block sits after ASSIST-3, the last item of the 1.2 list, so the 1.2 items keep + their heading. + - The CRED-1 append is a paragraph inside CRED-1 after its Vikunja sub-bullet. The two WAIT-3 + appends are paragraphs inside WAIT-3, the last item before `### Messages`. + - TRUST sits after DEC-6, the last Decisions item. CRED-4 and GRANT-1 to 4 sit after CRED-3. + LAND-2 sits after LAND-1. The risks bullet ends that list. +3. The ten ids are COS-3, CRED-3, CRED-4, GRANT-1 to 4, TRUST-1, TRUST-2 and LAND-2. Each appears in + the PRD as a `- **REQ-X-N.**` bullet and in `requirements.json` with the same id and in the same + order. `tasks/tests/requirements.test.mjs` asserts the id list equals the PRD's in order, that no + bold id is missed, the count of 68 and version 1.8, and that the status line names that version. +4. The titles don't change what any requirement allows or forbids. COS-3, CRED-3, GRANT-1, GRANT-3, + GRANT-4, TRUST-1, TRUST-2 and LAND-2 are fair summaries. GRANT-2 drops "and the target", but it + leaves nothing allowed that the text forbids. On CRED-4 see N1. +5. Pins. The tasks test moves 58 to 68, '1.6' to '1.8', and the `twice` index to [68]. Bus + `requirements.test.mjs:48` moves 58 to 68. No other test pins the count or the version. No test or + script pins a hash of the PRD or `requirements.json` (0 hits, control 11). + `requirements.json` is in `scripts/stack-copy.sh:30` and `cli stack-copy.test.mjs:37` as a path + only. + +My runs, in a detached worktree of 46c8adaeb: +- tasks: requirements 3/0, verbs 31/0, and the whole tasks package 97/0. +- bus: requirements 3/0. + +## Notes (do not block) + +N1. The CRED-4 title, "...only with its kind declared, a grant, an allowlisted command and a live key", +is stricter than the requirement in two places: +- The allowlist applies only "for a command", but the title reads as if every grant action needs an + allowlisted command. A Gitea token use has none. +- "live key" drops "or token". +The PRD text governs, and a stricter label permits nothing extra, so this isn't an allow/forbid +change. Agents do read the titles through the bus `requirements` verb, though. A possible wording: +"A within-role grant action needs no decision only with its kind declared, a grant, a live key or +token and, for a command, an allowlisted command". Sage's call. diff --git a/docs/SESSIONS.md b/docs/SESSIONS.md index 08179a94a..56886164f 100644 --- a/docs/SESSIONS.md +++ b/docs/SESSIONS.md @@ -1428,3 +1428,4 @@ are never rewritten or removed; corrections are new entries. 2026-10-21T01:14Z | Duckworth (Opus 5.5) | PRD 1.8 r7 scoped check (duckworth-0072) on honker/prd18-r7 47c2cb33c, sage-1624/1627 | passes the scope, no findings, citations true at 011d41ba6 | 2026-10-21T01:18Z | Duckworth (Opus 5.5) | PRD 1.8 r7 + follow-up scoped check (duckworth-0073), Honker 762a6711f..82df17347, sage-1632/1633 | passes the scope, no findings, four mos-1152 edits exact, includes 0072 | 2026-10-21T01:26Z | Duckworth (Opus 5.5) | row 194 b3 N1 delta scoped check (duckworth-0074), Honker a61a49a51..86889c59e, sage-1634 | N1 met, no findings; row 210 r2 approve recorded rev 2592 | +2026-10-21T01:29Z | Duckworth (Opus 5.5) | PRD 1.7+1.8 landing review (duckworth-0075), Honker 46c8adaeb on 011d41ba6, sage-1636/1641 | approve, 42 items word-exact, no allow/forbid change, N1 CRED-4 title |