darkwing: row 83 round 1 review packet, approve, comment 27721 (#1576)

Co-Authored-By: Claude Opus 5.5 <[email protected]>

agents/darkwing/work/queue-83-review/r1/identity.txt

@@ -0,0 +1,15 @@
+start 2026-10-12T04:03:22Z
+same: render 
+same: render --port 7340
+same: render --business mosaic
+same: render --board http://127.0.0.1:7331
+same: render --public-host console.example.com --auth-header X-authentik-username --allow-user jason.woltje
+same: render --port 7340 --business mosaic.dev_1 --board http://127.0.0.1:7331 --public-host console.example.com --auth-header X-authentik-username --allow-user jason.woltje
+same: render --public-host console.example.com --auth-header X-authentik-username --allow-user --send
+same: render --public-host console.example.com --auth-header X-authentik-username
+same: render --allow-user jason
+same: render --port 99999
+same: render --allow-user jason --public-host bad/host --auth-header X
+11 lists, 0 differ
+ExecStart=NODE CLI serve --port 7332 --public-host console.example.com --auth-header X-authentik-username --allow-user jason.woltje --send
+end 2026-10-12T04:03:23Z

agents/darkwing/work/queue-83-review/r1/mutants.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# Darkwing row 83 round 1 mutants: single-site edits to the candidate in a
+# detached worktree of d13b9300 with build.patch applied by `git apply
+# --index`. Each mutant edits one site with mut.mjs, runs the candidate's
+# service.test.mjs and restores the file from the worktree index.
+# Usage: mutants.sh WORKTREE
+set -u
+WT="$1"
+MUT="$(cd "$(dirname "$0")/../../queue-59-review/r1" && pwd)/mut.mjs"
+S=scripts/webui-service.sh
+cd "$WT" || exit 1
+
+m() { # name file from to
+    local name="$1" file="$2" from="$3" to="$4"
+    if ! node "$MUT" "$file" "$from" "$to"; then echo "$name BAD-SITE"; return; fi
+    if (cd packages/webui && node --test tests/service.test.mjs > "$TMPDIR/$name.out" 2>&1); then
+        echo "$name SURVIVED"
+    else
+        echo "$name killed: $(grep -E '^✖ ' "$TMPDIR/$name.out" | grep -v 'failing tests' | sort -u | sed 's/ ([0-9.]*ms)$//' | tr '\n' ';')"
+    fi
+    git checkout -q -- "$file"
+}
+
+# install creates the unit directory before render can refuse.
+m install-mkdir-first $S $'    unit="$(render)" || exit 1\n    mkdir -p "$UNIT_DIR"\n' $'    mkdir -p "$UNIT_DIR"\n    unit="$(render)" || exit 1\n'
+# install goes on after a refused render.
+m install-refusal-continues $S $'    unit="$(render)" || exit 1\n' $'    unit="$(render)" || true\n'
+# the install message drops Mos (decision 102).
+m msg-no-mos $S 'starts and restarts it, or Mos under lead decision 102 (sends then enter the' 'starts and restarts it under lead decision 94 (sends then enter the'
+# the usage text doesn't name --send.
+m usage-no-send $S '--allow-user ID [--send]]"' '--allow-user ID]"'
+# status prints the send line before it checks a unit exists.
+m status-send-before-unit-check $S $'    if [ ! -f "$target" ]; then\n        echo "healthz: not checked; no unit at $target"' $'    grep -q \'^ExecStart=.* --allow-user [^ ][^ ]* --send$\' "$target" 2>/dev/null && echo "send: on (--send; human messages to roles)" || echo "send: off (read-only)"\n    if [ ! -f "$target" ]; then\n        echo "healthz: not checked; no unit at $target"'
+# status reads the template instead of the installed unit.
+m status-reads-template $S $'--send$\' "$target"; then' $'--send$\' "$TEMPLATE"; then'
+# the --send check runs only once the preview set is complete (inside the block).
+m send-check-inside-block $S $'    [ "$SEND" = 0 ] || [ "$preview" -eq 3 ] || die "--send needs the preview mode (--public-host, --auth-header and --allow-user)"\n    if [ "$preview" -ne 0 ]; then\n        [ "$preview" -eq 3 ] || die "--public-host, --auth-header and --allow-user go together: all three or none"\n' $'    if [ "$preview" -ne 0 ]; then\n        [ "$preview" -eq 3 ] || die "--public-host, --auth-header and --allow-user go together: all three or none"\n        [ "$SEND" = 0 ] || [ "$preview" -eq 3 ] || die "--send needs the preview mode (--public-host, --auth-header and --allow-user)"\n'
+# the append moves inside the preview block (equivalent: the check guarantees it).
+m send-append-inside-block $S $'        flags="$flags --public-host $PUBLIC_HOST --auth-header $AUTH_HEADER --allow-user $ALLOW_USER"\n    fi\n    [ "$SEND" = 0 ] || flags="$flags --send"\n' $'        flags="$flags --public-host $PUBLIC_HOST --auth-header $AUTH_HEADER --allow-user $ALLOW_USER"\n        [ "$SEND" = 0 ] || flags="$flags --send"\n    fi\n'

agents/darkwing/work/queue-83-review/r1/mutants.txt

@@ -0,0 +1,15 @@
+start 2026-10-12T04:02:59Z
+install-mkdir-first killed: ✖ install into --dir with --no-reload writes the file whole, then reports unchanged;✖ --send without the whole preview set is refused and writes nothing;
+install-refusal-continues killed: ✖ install into --dir with --no-reload writes the file whole, then reports unchanged;✖ --send without the whole preview set is refused and writes nothing;
+msg-no-mos killed: ✖ install --send into --dir with --no-reload writes the sending unit, and status says whether it sends;
+usage-no-send SURVIVED
+status-send-before-unit-check killed: ✖ install --send into --dir with --no-reload writes the sending unit, and status says whether it sends;
+status-reads-template killed: ✖ install --send into --dir with --no-reload writes the sending unit, and status says whether it sends;
+send-check-inside-block killed: ✖ --send without the whole preview set is refused and writes nothing;
+send-append-inside-block SURVIVED
+end 2026-10-12T04:03:09Z
+?? node_modules (my symlink)
+scripts/webui-service.sh: OK
+packages/webui/tests/service.test.mjs: OK
+packages/webui/README.md: OK
+docs/TOOLS.md: OK

agents/darkwing/work/queue-83-review/r1/tests-light.txt

@@ -0,0 +1,20 @@
+start 2026-10-12T04:01:50Z node v26.8.1 tree d13b9300+build.patch (manifest f764cd9e)
+== service
+ℹ pass 15
+ℹ fail 0
+== serve
+ℹ pass 4
+ℹ fail 0
+== send
+ℹ pass 13
+ℹ fail 0
+== shell
+ℹ pass 5
+ℹ fail 0
+== bus
+ℹ pass 9
+ℹ fail 0
+== preview
+ℹ pass 11
+ℹ fail 0
+end 2026-10-12T04:02:12Z

agents/darkwing/work/queue-83-review/review-r1.md

@@ -0,0 +1,129 @@
+# Row 83, the unit script takes --send, round 1 review (Darkwing)
+
+Issue #1576, request comment 27713, packet `agents/dewey/work/queue-83/`
+(commit `e1bf582a`). Brief: `docs/plans/2026-10-12_console-service-send.md`
+(blob `f8d14d70`, rev 630), with lead decisions 101 and 102. Base
+`d13b9300`. Candidate manifest sha256
+`f764cd9e4f8bdcd43c1db387e9408ab0538fb1a63820820806e5b65f93420b66`, 4
+files, matching the request.
+
+Verdict: **approve**. The script refuses `--send` without the whole preview
+set before it writes anything, appends `--send` last when it's allowed, and
+leaves every other render byte for byte as the base. The start wording
+names Jason and Mos as decision 102 says. Nothing blocks. Three small notes,
+and my answers to Dewey's two reviewer points.
+
+## Method
+
+- A detached worktree at `d13b9300` with `git apply --index build.patch`,
+  then `sha256sum -c` on the manifest: 4 OK, and again after the mutants.
+  `git diff --cached --binary d13b9300` there hashes the same as
+  `build.patch` (`18810948…`). No commit from `d13b9300` to `15dcac12`
+  touches the 4 paths.
+- I read the whole patch against the brief, decisions 101 and 102, serve's
+  flag parsing (`packages/webui/src/cli.mjs` 16 to 37) and its allowed-user
+  check (`serve.mjs` 120 and 128).
+- Six WebUI test files, a byte-identity check of my own against the base
+  script, then 8 mutants of my own (`r1/mutants.sh`) aimed at sites
+  Dewey's 15 don't name. Each edits one site with
+  `queue-59-review/r1/mut.mjs`, runs `service.test.mjs` and restores from
+  the worktree index.
+
+Node v26.8.1, `TMPDIR=~/darkwing-scratch/rv83/tmp`.
+
+## The script
+
+**The refusal.** `[ "$SEND" = 0 ] || [ "$preview" -eq 3 ] || die ...` runs
+in `serve_flags` before the value checks, and `install` calls `render`
+before `mkdir`, so a refused install creates nothing and leaves an
+installed unit alone. The message is serve's own (`cli.mjs:37`) with the
+script's prefix. Running the `--send` check before "all three or none" is
+the right order: an operator who asked for sending learns why it was
+refused.
+
+**The append.** `--send` is the last flag, after `--allow-user`. Serve
+treats `--send` as a flag only where a flag is expected; after
+`--allow-user` it's the value (`cli.mjs` 18 to 20). So `--allow-user
+--send` is a read-only Console whose allowed user is the string `--send`,
+and `--allow-user --send --send` sends. The script parses the same way.
+
+**Status.** `^ExecStart=.* --allow-user [^ ][^ ]* --send$` agrees with
+serve in both cases above. I looked for a read-only unit it could still
+read as sending. ` --allow-user ` can only appear as the flag itself: the
+public host and auth header must start with a letter or digit, and no
+value can carry a space. The template's ExecStart is one line
+(`mosaic-webui.service.in:24`). A wrong answer here would also be the
+safe one, since it would say a read-only unit sends.
+
+**Byte identity.** Besides Dewey's 86 argument lists, I rendered 11 with
+the base script and the candidate side by side in the same tree
+(`r1/identity.txt`): no flags, each serve flag alone, decision 101's
+cutover set (`--auth-header X-authentik-username --allow-user
+jason.woltje`), everything together, `--allow-user --send`, and four
+refusals. Output and exit status match on all 11. With `--send`, the
+cutover set renders `... --allow-user jason.woltje --send`.
+
+**The wording.** The header comment, TOOLS.md and the README now say Jason
+starts and restarts the Console, and Mos may under decision 102, with
+sends then entering the trail as Jason. Any other agent starting it works
+around the human proof. The install message says the same more briefly,
+ending "no other agent does". There's still no start, stop or restart
+verb, and `install` changed only its message.
+
+## Tests and mutants
+
+On the candidate, 04:01:50Z to 04:02:12Z on 2026-10-12
+(`r1/tests-light.txt`): `service` 15, `serve` 4, `send` 13, `shell` 5,
+`bus` 9 and `preview` 11, all pass, 0 fail. I didn't run the full gate.
+Dewey's is green, Filbert's was running, and Sage reruns it.
+
+Filbert's gate started shortly before my mutants. Mine were single
+`service.test.mjs` runs, 04:02:59Z to 04:03:09Z, in my own worktree and
+TMPDIR, with nothing shared with their tree.
+
+| Mutant | Edit | Result |
+|---|---|---|
+| `install-mkdir-first` | `mkdir` before `render` | killed: the install test, the refusal test |
+| `install-refusal-continues` | install goes on after a refused render | killed: the install test, the refusal test |
+| `msg-no-mos` | the install message drops Mos | killed: the `install --send` test |
+| `status-send-before-unit-check` | the send line before the unit check | killed: the `install --send` test |
+| `status-reads-template` | status greps the template, not the unit | killed: the `install --send` test |
+| `send-check-inside-block` | the `--send` check inside the preview block | killed: the refusal test |
+| `usage-no-send` | the usage text drops `[--send]` | survives |
+| `send-append-inside-block` | the append inside the preview block | survives, equivalent |
+
+`send-append-inside-block` can't change behaviour, because the check above
+it guarantees the preview set whenever `SEND` is 1. `usage-no-send` is
+note 1.
+
+## Notes
+
+**1. Nothing tests the usage text.** `USAGE` and `--help` now name
+`[--send]`, and Dewey's identity run lists that as an expected
+difference, but no test asserts it. A line in the usage test matching
+`--allow-user ID \[--send\]` would hold it. Cosmetic.
+
+**2. The README service paragraph has one unwrapped line.** Line 106 is
+102 characters: "(lead decisions 62 and 94). Without `--send` the
+unit is read-only. The script takes `--send` (row 83)". It reads fine
+rendered. A follow-up or the landing commit can reflow it.
+
+**3. The install message gives the rule, not the reason.** The brief asks
+each place to say that any other agent starting the Console works around
+the human proof. The install message says "no other agent does". I'm fine
+with the short form in a terminal message, since the header comment it
+points at gives the reason. If Sage wants the brief's words exactly, it's
+one line.
+
+## Dewey's reviewer points
+
+**Allowed users that start with `-`.** I agree it's a follow-up and not
+this row. The status check is sound in the meantime, as above. When it's
+taken up, I'd refuse a leading `-` in both the script and serve's `USER`
+pattern, so the two keep parsing the same way. No real allowed user from
+decision 101, a username or a 64-character hex uid, starts with one.
+
+**The template comment.** Agreed. Changing
+`mosaic-webui.service.in` lines 6 to 9 changes every rendered unit, which
+this row rules out. It belongs with a template change and the render
+tests that pin it, on the follow-up list.