From 299eea267cdc20a2001a300818bbca38e7cd7472 Mon Sep 17 00:00:00 2001 From: Jason Woltje Date: Sat, 24 Oct 2026 23:04:48 -0500 Subject: [PATCH] duckworth: row 309 (W1 #1823) static landing read on b10711603, provenance independently matched, B1 test pins host Node v26.8.1, C1 no named mutants, C2 mos-1573 hold; row 193 e2d161e2e blob = duckworth-0018 approve (duckworth-0303) --- agents/duckworth/work/row193/RECORD-r5.md | 7 ++ agents/duckworth/work/row309/EARLY-LOOK.md | 78 ++++++++++++++++++++++ 2 files changed, 85 insertions(+) create mode 100644 agents/duckworth/work/row193/RECORD-r5.md create mode 100644 agents/duckworth/work/row309/EARLY-LOOK.md diff --git a/agents/duckworth/work/row193/RECORD-r5.md b/agents/duckworth/work/row193/RECORD-r5.md new file mode 100644 index 000000000..ddb1b03b7 --- /dev/null +++ b/agents/duckworth/work/row193/RECORD-r5.md @@ -0,0 +1,7 @@ +# Row 193 record check (duckworth-0303) + +Reviewer Duckworth (Opus 5.5), 2026-10-25. Static, no code run. +Candidate e2d161e2e (Morgana in-review round 1, rev 4078 at my read). The commit touches only +agents/morgana/work/queue-193/DESIGN.md (+11/-5). That blob is bd44050fc, sha256 +dd7fcb419ed8510e9d8d74b569183386d0942af8b68eecc0bbb5e182e677b523. It is the blob I approved in +duckworth-0018 (REVIEW-r5.md, dd7fcb41…b523). The verdict carries: approve, citing duckworth-0018. diff --git a/agents/duckworth/work/row309/EARLY-LOOK.md b/agents/duckworth/work/row309/EARLY-LOOK.md new file mode 100644 index 000000000..84ae88659 --- /dev/null +++ b/agents/duckworth/work/row309/EARLY-LOOK.md @@ -0,0 +1,78 @@ +# Row 309 (571 W1, #1823) landing review, static read (duckworth-0303) + +Reviewer Duckworth (Opus 5.5), 2026-10-25. Not the author. Static: git show/diff only, no +test run, nothing read from Glomgold's worktree or scratch. Formal verdict waits for Sage's +request on the rebased landing candidate. + +Subject: origin/glomgold/row309 b10711603 (one commit), base d16958bcf. 45 paths, all added, +all inside W1's owned paths plus agents/glomgold/work/queue-309/. + +## Drift + +d16958bcf is an ancestor of refactor 78b69e1e6, 147 commits behind. No path overlap. The +base-to-tip changes under packages/webui are chat.css, chat.js and four tests. None of them +enumerates src/public: granted-user.test.mjs:324 and shell.test.mjs read named files only. +`git merge-tree` of 78b69e1e6 and b10711603 is clean. + +## Provenance and license (brief W1, D22) + +- I fetched the pinned mirror ZIP independently into my own scratch directory. It is 10,775,600 + bytes with sha256 cbda5ea6…6ab59, matching D22. +- All 18 vendored wordnet/ files are byte-identical to the ZIP entries and to their + PROVENANCE.json bytes and sha256. The sums are 36,353,991 total and 35,435,978 lookup, + matching D22. +- third_party/thesaurus/LICENSE and src/public/thesaurus/LICENSE equal the upstream LICENSE. + NOTICE and README say Princeton terms, not MIT or Apache. +- PROVENANCE.json hashes to e5a799a6, matching BUILD.json and PROVENANCE_SHA256 + (build-thesaurus.mjs:9). +- All 7 shipped outputs match BUILD.json bytes and sha256. Both converter hashes match + BUILD.json inputs. +- The 147,306 vs 147,278 headword gap is recorded in BUILD.json, the manifest and the README + as sage-3972. I take that ruling as relayed. + +## Refusals + +The converter checks the provenance pin, the inventory, per-file hashes, byte totals, +LICENSE equality and the NOTICE text (:21-40). Then it parses the record grammar with ASCII +checks (:41-110), checks pointer targets (:129), checks the counts against EXPECTED (:132) +and checks that the index matches the data (:133). It writes nothing before all of these +pass (:155). The importer checks the archive hash and the provenance pin and validates every +entry before writing. It refuses an existing destination and cleans up on a failed write. +No runtime, route, CSP or worker change is in the diff. + +## Findings + +B1. The data test fails on any Node other than v26.8.1. build-thesaurus.mjs:147 writes +`tools.node: process.version` into the build info. thesaurus-data.test.mjs:33 deepEquals the +fresh info against the committed editor-data/BUILD.json, which says "v26.8.1". Any host Node +upgrade, or a gate on a host with another Node, turns the webui suite red with no data change. +The README (:30) states a >=24 baseline. Fix: keep the run's Node out of the compared +object (record it separately, or drop it from the test's comparison) and leave the byte and +hash comparisons as they are. Today's host runs v26.8.1, so Glomgold's 7/7 and 425/425 don't +show this. + +C1 (gate). The queue gate says "named mutants killed". BUILD.md names no mutants, and G1 +doesn't name any. Reading the test statically, these guards have no test that reaches them, +so a mutant removing any of them survives: +- the NOTICE attribution check (:38); +- the reverse index check (:100); +- the pointer-target check (:129); +- the counts-vs-EXPECTED refusal (:132). Test 2 asserts the literal counts, which catches a + converter change, but not removal of the refusal; +- the normalized/index match (:133). +Sage should name the mutants for the gate, or rule that none are required for a data row. +At minimum I'd want the pointer-target and reverse-index checks covered, since "malformed +record refuses the build" is the brief's acceptance. + +C2 (gate, not mine to decide). BUILD.md cites landing hold mos-1573: nothing lands until +Jason decides on about 58 MB of permanent history (Vikunja 618). I found no ruling on refactor. +Sage should confirm that hold is cleared before the landing gate. + +## Notes + +N1. Offsets of 10000000 and above are integer-like keys, so JSON.stringify emits them before +zero-padded keys. The output is deterministic and the index carries the order, but a consumer +must not rely on synsets key order. +N2. THESAURUS_ARCHIVE gates the round-trip test (skipped otherwise). Glomgold's final logs +show it ran with 0 skips. Sage's gate should set it too, or the run silently drops the one +check that ties the vendored text to the archive.