From 171480e6e80ea470885badf2d9b5c379dcf478d8 Mon Sep 17 00:00:00 2001 From: Jason Woltje Date: Thu, 22 Oct 2026 03:50:45 -0500 Subject: [PATCH] webby: row 256 design d1 review, and session line --- .../webby/work/queue-256/REVIEW-design-d1.md | 96 +++++++++++++++++++ docs/SESSIONS.md | 1 + 2 files changed, 97 insertions(+) create mode 100644 agents/webby/work/queue-256/REVIEW-design-d1.md diff --git a/agents/webby/work/queue-256/REVIEW-design-d1.md b/agents/webby/work/queue-256/REVIEW-design-d1.md new file mode 100644 index 000000000..121fef89a --- /dev/null +++ b/agents/webby/work/queue-256/REVIEW-design-d1.md @@ -0,0 +1,96 @@ +# Row 256 (#1761) design draft 1 review (Webby, webby-0122) + +Candidate: agents/honker/work/queue-256/DESIGN.md at c3e0bd9db on honker/row256 (sha256 62f93ce9), +base be2b008cc. Brief: docs/plans/2026-10-21_creative-delete-human.md. Line numbers are from be2b008cc. +I ran nothing. This was a read against the code at the base. + +Verdict: the shape is accepted with one required change (R1). The answers to the two questions are below. + +## What I checked + +- `protectedRefusal` matches the brief's three cases. + - A creative definition passes for `document.human` only. + - Any other actor gets `organization-creative-human-only`, the code `creativeHumanOnly` uses + (launch-settings.mjs:13-17). + - A non-creative END_PROTECTED definition gets `organization-definition-refused` for every actor. + - It mirrors `closed` at instance-settings.mjs:80. +- The actor reaches every path the design lists. + - At the verb, broker.mjs:2843 passes `s.human` to `instances.check`. For a human session + `s.human` is `b.human` (broker.mjs:904). It is `false` for role and tester sessions + (:834, :912). + - The launcher pass, lifecycleDelete at broker.mjs:2327, passes `r.by`. That is `#owner(s)` + (:603, :708-710), which returns `s.human` for the human. + - runtime.mjs:283 is the only place that drops the actor today. runtime.mjs:279 `instances` drops + it too, which matters for the listing. The broker's read already sets `"tester"` or `s.human` + (broker.mjs:2627). + - So the broker needs no logic change, as the design says. lifecycle-verbs.test.mjs:335 already + pins `'jason'` as the launcher pass's actor. +- No delete bypasses the bus. + - The Console's POST /api/instances goes through `instancesWrite` (serve.mjs:677-680). + - The tester's op delete is refused `tester-refused` at the verb (broker.mjs:2595) before + `#deleteRequest`. + - The chief's session has `human: false` and no organization.set path to instances.set + (:2585, :2589-2590). +- `endProtected` has one consumer in src, agents.js:46. Every internal `read()` has the actor to + hand. + - commit's listing at :405 gets `{ actor }`. + - fire's listing at :338 has the chief's actor. + - A `read(business)` with no actor gives `true` for a creative entry, so the default refuses. +- The persona choice holds. A retired name can't be added again (instance-settings.mjs:219), so a + later add can't inherit the file. + +## R1 (required): T4 builds a business file the validator refuses + +T4 puts a creative instance in `launch.keep`. business.mjs:208 refuses that file: "keep names X, +whose definition ... can't be kept". The veto writer refuses it too (instance-settings.mjs:284). + +The test would pass, because set op delete runs `planDelete` before `commit` validates. But it +pins a state no valid file reaches. + +The other named references can't hold a creative instance either: +- An arbiter can't declare messaging lists (business.mjs:251-255). +- `launch.by` needs `role.launch` (:181-183). + +The later check a creative delete can really reach is deletedDocument's last-listed refusal +(instance-settings.mjs:64-66). Use that: bean as the only `launch.instances` name. The human's +delete then refuses the BusinessError rather than `organization-creative-human-only`. That still +proves protectedRefusal passed and the later checks ran. Keep T1 for the success path. + +## Answers + +1. **Keep the `endProtected` name.** agents.js:46 is its only reader, and that reader means "don't + offer Delete", which is exactly the per-viewer value. A rename churns five fixtures for no change + in behavior. + - Rewrite the comment at instance-settings.mjs:28-31: "no one deletes one yet (sage-2164, + DEFERRED)" stops being true. + - Rewrite the agents.js:45 comment too. + - T5 should also pin `read(business)` with no actor as `true`. +2. **Put the bus test in creative.test.mjs.** Its `runtime()` (creative.test.mjs:93-127) is a real + `startBroker` with the business writer, the human, the tester, the chief and bean. + - instances-verb.test.mjs uses a recording stub writer (:29, :107), apart from one coder-only + runtime test (:62-68). + - lifecycle-verbs.test.mjs's writer is a stub too. + - A stub can't show the actor reaching protectedRefusal, so T6 has to run on the real writer. + +## Notes (non-blocking) + +- **N1.** The design says M1 is "killed by T2 and T6". Through the bus, no non-human actor reaches + the writer's delete. + - The tester is refused at broker.mjs:2595. + - The chief gets `human-required` at :2585. + - So only T2 kills M1. Correct the claim, and pin the chief's code in T6 as `human-required`, not + the creative code. +- **N2.** Neither listed mutant covers the threading itself. I recommend an M4: runtime.mjs:283 + drops the actor, or `set` op delete stops passing it to `planDelete`. The human's real-writer + delete then refuses `organization-creative-human-only`, and T6 kills it. That's cheap, and it + guards the part of the change the brief names first. +- **N3.** The DEFERRED.md:387 closing line is fine. Fire stays refused by REQ-COS-3, per the brief's + item 2. + +## At the manifest round + +- R1 and the answers are applied. +- T5 pins the no-actor read. +- T6 runs on creative.test's real runtime: the take, then lifecycleDelete commits with `r.by`. +- M1-M3 are killed on a green base, plus M4 if Honker takes N2. +- The broker diff is comments only. diff --git a/docs/SESSIONS.md b/docs/SESSIONS.md index 1e873bd07..9a6f5c982 100644 --- a/docs/SESSIONS.md +++ b/docs/SESSIONS.md @@ -1460,3 +1460,4 @@ are never rewritten or removed; corrections are new entries. 2026-10-22T06:14Z | Webby (Opus 5.5, reviewer seat) | row 194 b16 9cdc47d04 carry check on 279 carry ceadad993 | APPROVE carry; 16 =, patch-id equal; 279 ownStop loop reaches S6, so the whole rerun is required and M52/M55/M55-deadline anchors must be rechecked 2026-10-22T08:02Z | Webby (Opus 5.5, reviewer seat) | row 194 b17 3f451772d carry check | APPROVE carried (16 =, patch-id 64303253f8e6, manifest 29f131ab) 2026-10-22T08:07Z | Webby (Opus 5.5, reviewer seat) | row 194 b18 fd6dd327c carry check | APPROVE carried (16 =, patch-id 64303253f8e6, manifest 29f131ab) +2026-10-22T08:50Z | Webby (Opus 5.5, reviewer seat) | row 256 design d1 c3e0bd9db review | shape accepted, R1 (T4 invalid keep fixture), N1-N3; endProtected keeps its name, bus test in creative.test.mjs