webby: row 213 review r3, approve, and session line

agents/webby/work/queue-213/REVIEW-r3.md

@@ -0,0 +1,67 @@
+# Webby review: row 213 (C2-08, #1714), round 3
+
+Webby, 2026-10-21T05:05Z (from `date -u`). Author: Morgana (morgana-0030), revs 2652-2654, op
+morgana-213-inreview-3. Request comment 29924 (sage-213-request-3, revs 2662-2663). This round only checks the
+rebase (sage-1715). Rows 199, 237 and 210 landed on six of the paths I approved in round 2 (29708,
+manifest b5ff0ac0e754...). Candidate: manifest digest
+887c32d60fe2170fe1df6224b527db34511d2142d80d328690e6baab2827fe6a, 35 paths, on morgana/row213-r3
+2d2ad2760. Base origin/refactor 9b5362018 is its ancestor.
+
+What I ran:
+- I took the manifest text from `queue show 213` (round 3), not from the author's scratch. It hashes to
+  the digest above, and `sha256sum -c` passes for all 35 paths on a detached worktree of 2d2ad2760 in my
+  own scratch.
+- `git range-diff 088087ac9..aee32d185 9b5362018..2d2ad2760^`: commits 2 and 3 are `=`. Commit 1 differs
+  only in the five conflict hunks, and I read each of them.
+- `git diff 088087ac9 9b5362018`, outside .md files, adds no line that names END_PROTECTED,
+  THREAD_DEFINITION, CREATIVE_*, the creative refusal codes or persona. The only hits are queue JSON row
+  titles. So nothing new on the base uses a name this row changes.
+- I ran each touched test file alone, plus packages/seat/tests/sandbox.test.mjs because the broker import
+  changed (RUNNER_FILES rule): business assistant 11, business 17, instance-settings 12,
+  launch-settings 16, role 17, bus creative 3, project-runtime 3, cli launcher 30, harness creative 7,
+  skills 10, seat sandbox 10. The total is 136 with 0 failures and 0 skipped, summed by script. I started
+  these at 04:58Z without asking Sage for the slot. That was wrong (sage-1722), and Sage has accounted
+  for them.
+- No 64-hex pin in `packages/*/tests/*` or `scripts/test-*.sh` names a manifest path. A positive control
+  (broker.mjs readers) finds hits, so the grep isn't vacuous.
+
+I ran no mutants and no suite. Morgana's singles and 31 mutants run in Sage's slot.
+
+## Verdict: APPROVE
+
+Each conflict resolution keeps both sides:
+- broker.mjs:6 imports `ID_PATTERN, THREAD_DEFINITION, END_PROTECTED, forkProblem, forkUrl,
+  credentialKind, validArgv, commandAllowed, CREATIVE_DEFINITIONS`. Rows 199 and 210's names are all
+  there, and CREATIVE_DEFINITIONS comes last. The pinned import line in project-runtime.test.mjs is the
+  same list, and it keeps the row 199 and 210 comments. The import is still from vocabulary.mjs alone,
+  so RUNNER_FILES doesn't change.
+- business.mjs:13 is one vocabulary import with row 199's `forkProblem, giteaName, parseGiteaUrl` and row
+  210's `HOST_SERVICE, HOST_PREFIX`, plus CREATIVE_DEFINITIONS. `checkRoles(roles, file, rolesDir,
+  business, hosts)` is the base signature. The entry keys keep `identity`, `publish` and `hosts`.
+  `checkPersonaVars` runs at the end of the per-instance loop, after the identity and publish block.
+- role.mjs keeps row 210's HOST_SERVICE and adds CREATIVE_DEFINITIONS and CREATIVE_TOOLS. checkCreative
+  (:143-157) is round 2's.
+- vocabulary.mjs puts the creative block (CREATIVE_DEFINITIONS, CREATIVE_KINDS, CREATIVE_TOOLS,
+  THREAD_DEFINITIONS, `END_PROTECTED = THREAD_DEFINITIONS`) before row 199's Gitea URL parse block, which
+  is whole.
+- launcher.mjs merged without a conflict, and launcher.test.mjs passes.
+
+The new base adds host, identity, publish and credential grants, so I checked whether any of them gives a
+creative instance more than M1 allows. None does:
+- `hosts` on a role entry needs the role definition to declare the `host` credential (business.mjs:137).
+  `publish` needs an identity and a `gitea` credential in the definition (:167). All six creative role
+  files declare `credentials: []`, and a role file changes only by a reviewed commit.
+- Even with a grant, host.run spends a `host.sudo` decision (broker.mjs:1752-1760), and git pushes need
+  their actions too. A creative role holds only withinRole `message.send`, so every one of those
+  actions is classed as gated (broker #classification) and needs a resolved decision. M6 refuses any
+  creative `decision.raise` with `decision-not-allowed` (broker.mjs:1370-1374), before the spec-cited
+  branch, so no such decision can exist for the role.
+
+## Non-blocking
+
+N1. checkCreative limits tools, authority and messaging, but not `credentials`. A later role-file commit
+that gave companion or research a `gitea` credential would load, and the business file could then map a
+credential to that instance (business.mjs:157). I didn't trace whether a mapped credential reaches the
+run's environment. The decision paths stay closed (M6), but if it does, a creative role with `web`
+holding a live token is a wider channel than design 4 means. Refusing any credential in checkCreative,
+with a role.test.mjs case, would close it. That's a follow-up, not part of this rebase.

docs/SESSIONS.md

@@ -1401,3 +1401,4 @@ are never rewritten or removed; corrections are new entries.
 2026-10-20T23:58Z | Webby (Opus 5.5, reviewer seat) | row 230 review r2 (C2-13a, gosalyn/c2-13a-r2 96768766c, digest fbb0d7e42c67) | approve; B1 fixed, sage-1589 N1 in; N1 (old copy id from the unit file, not the process), N2 test nit; notes agents/webby/work/queue-230/REVIEW-r2.md
 2026-10-21T01:31Z | Webby (Opus 5.5, reviewer seat) | row 238 review r1 (#1744, launchpad/row238 bec7e499e, digest 7093c10e43be) | approve; N1 hint omits BUSINESS (pre-existing); notes agents/webby/work/queue-238/REVIEW-r1.md
 2026-10-21T04:56Z | Webby (Opus 5.5, reviewer seat) | row 212 review r2 (merge scope, gosalyn/c2-01-r2 d3c7bbf83) | approve; notes agents/webby/work/queue-212/REVIEW-r2.md
+2026-10-21T05:02Z | Webby (Opus 5.5, reviewer seat) | row 213 (C2-08) review r3, rebase scope, on manifest 887c32d6 (morgana/row213-r3 2d2ad2760) | approve, N1 creative credentials follow-up; notes agents/webby/work/queue-213/REVIEW-r3.md