duckworth: row 234 early code read (duckworth-0081) changes on Gizmoduck f4de24d39

2026-10-20 22:44:58 -05:00
parent 088ea2f960
commit 88402c25ee
2 changed files with 93 additions and 0 deletions
@@ -0,0 +1,92 @@
+# Row 234 early code read (duckworth-0081)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-21. Asked in gizmoduck-0101, before the formal request. Candidate
+code `gizmoduck/row234` f4de24d39 on 8fede5fc6 (39 files, +2953/-187). Brief:
+`docs/plans/2026-10-20_host-credentials.md` "Machine grant row a", whose gate needs "the design's section
+10 tests and mutants for row a". Design r6 f9039682e, section 7 fa5658941. This is not the manifest
+verdict. That one comes after Sage's A1 to A23 run.
+
+## Verdict: changes, 3 blockers
+
+BUILD.md:68-69 lists G6, G10, G18 and G20 among row a's tests. The brief's gate requires them, so each
+missing case blocks.
+
+- B1. G10 has no test (r6:818). No row a test starts a second enrollment for a spent decision and gets
+  `decision-consumed`. None shows `#consumeGrant` (`broker.mjs:678`, `#spent` at :681) refusing an
+  unresolved or an agent-resolved decision. A8 (`grant-enroll.test.mjs:250`) uses two decisions, so it
+  tests `host-enrolled`, not this. The only `decision-consumed` assert near hosts is `host-run.test.mjs:250`,
+  which covers row 210's host.run. The direct way is to call the executor or `reconcileGrants` twice for
+  one resolved decision, and once each for an open decision and an agent-resolved fixture.
+- B2. G18 has no test (r6:826). The code path exists: `host-grant.mjs:207-211` calls `runHost` with the
+  pinned keys, and `host-run.mjs:197` refuses `host-key-mismatch` on ssh exit 255. But
+  `grant-enroll.test.mjs:333-356` uses a fake check that never throws that code, and
+  `host-tools.test.mjs` tests only the writer, mosaic-keys, sudoers and sshd. A test needs to show that a
+  wrong pin refuses `host-key-mismatch`, runs nothing, and leaves the record `pending-install` with no
+  `grant.host.checked`. The fake check can throw the BusError for the broker half. The runHost half can
+  reuse the host-run.test.mjs ssh stand-in that gives :290 its `host-key-mismatch`.
+- B3. G6 and G20 are partly tested.
+  - G6 (r6:814): the no is tested (A4, :231), and so are the tester, pm and chief resolves (A3, :237).
+    The withdraw and the arbiter resolve have no case. A withdraw of an open `host-enroll` decision must
+    start nothing.
+  - G20 (r6:828): the chief reaches `ready` (:341) and the tester gets past the role check to
+    `host-changed` (:355). The human's `hosts.check` is never called. It must reach `ready` through
+    `#hostsCaller`'s `#human` leg.
+
+## Notes (no block)
+
+- N1. A3 (`grant-enroll.test.mjs:237`) can't reach `#approvedGrant`'s via and by checks, because every
+  resolve it tries is refused first. The M3 fixtures in `host-run.test.mjs` cover those checks, so
+  nothing is untested. The test name reads as more than it shows.
+- N2. `mosaic-keys-write:255-266`: `main` catches `Refused` and `OSError`. A `sudo -l` timeout raises
+  `subprocess.TimeoutExpired`, which escapes, so the writer exits with a traceback and logs nothing.
+  Catching it as `refused user-sudo` keeps every refusal in syslog.
+- N3. `host-grant.mjs:86,106`: a keyscan that exits nonzero, such as an unreachable host, resolves with
+  no lines, so the raise refuses `host-key-mismatch`. The comment says a scan that can't run refuses
+  `host-failed`. That holds only for a spawn error. G17 doesn't decide which code is right. Worth one line
+  in BUILD.md or the comment.
+- N4. In the run, `#enrollFailed` writes `grant.failed` with no tag. `reconcileGrants` does tag it. If
+  section 7 leaves the tag optional this is fine. Otherwise the two should match.
+- N5. `read_conf(host, 'privileged')` refuses when the file is missing (`mosaic-keys-write:136-138`). The
+  #433 run sheet should say to create an empty, root-owned `/etc/mosaic-keys/privileged`.
+- N6. `#hostAccess` binding the grant's agent and host (`broker.mjs:692`) goes beyond X4. I agree with
+  it. It narrows and refuses nothing X4 allows.
+- N7. `isHostKind` (`business/src/resolve.mjs:92`) can't be reached and stays, as BUILD.md records. No
+  objection.
+
+## Checked, no finding
+
+- `#approvedGrant`, `#consumeGrant`, `#runEnrollment`'s two transactions and their catch, and
+  `reconcileGrants` for both the spent-unfinished and the open decision. `#openGrantDecisions` uses the
+  unfiltered `#spent`. That is sound while no verb consumes `credential.mint`.
+- `#raiseGrant` order, with the enroll block appended before the 4096 cap (M1, :165).
+- `hosts.remove` order (host-unknown, host-in-use, host-line-left, then delete, event, unenroll last), and
+  `hosts.check` with its host-changed recheck in the transaction.
+- 3i-3j.sql: hosts and host_grants keys, CHECKs, the FK, and the `events_grant_actor` trigger. The trigger
+  cases are in `grant-migration.test.mjs:134`.
+- The writer's dir, lock, user-file and tmp handling (G25, `host-tools.test.mjs:225`).
+- Hash pins: there is no 64-hex pin in `packages/*/tests/*` or `scripts/test-*.sh` on a changed path. The
+  one basename hit, `channel-proof.test.mjs:12` for `bus/src/human-cli.mjs`, is a file this row doesn't
+  change. The control found pins in account-, comment-migration and channel-proof.
+- RUNNER_FILES rule (sage-1619): the broker adds the `HOST_ID` import. I ran seat sandbox.test.mjs and
+  bus project-runtime.test.mjs (below).
+
+## My runs
+
+Single files in a detached worktree of f4de24d39, pass/fail:
+
+| file | result |
+| --- | --- |
+| bus grant-enroll | 20/0 |
+| bus host-run | 23/0 |
+| bus host-tools | 6/0 |
+| bus grant-migration | 5/0 |
+| bus hard-waits | 13/0 |
+| bus project-runtime | 3/0 |
+| bus credentials | 5/0 |
+| bus chief-of-staff | 18/0 |
+| bus account-, comment-, name-, spec-, thread-, usage-migration | 3/0, 5/0, 1/0, 1/0, 3/0, 1/0 |
+| business hosts | 4/0 |
+| cli hosts | 5/0 |
+| seat sandbox | 7/3, the same environmental failure I get on base commits in this session |
+
+I ran no suite and no mutant. Those are slot work.
@@ -1434,3 +1434,4 @@ are never rewritten or removed; corrections are new entries.
 2026-10-21T01:59Z | Duckworth (Opus 5.5) | row 210 queue round 3 rebase check on Gizmoduck 0485384e9 (duckworth-0078) | approve, no findings |
 2026-10-21T03:01Z | Duckworth (Opus 5.5) | row 234 early check of BUILD.md split and name map on Gizmoduck 2aa54a67a (duckworth-0079) | split and map stand, G21 fixture ok on F1-F4, moves M1-M4, N1 mutant split |
 2026-10-21T03:03Z | Duckworth (Opus 5.5) | row 241 round 1 on Megavolt 3e3ed303e (duckworth-0080) | approve, no findings |
+2026-10-21T03:44Z | Duckworth (Opus 5.5) | row 234 early code read on Gizmoduck f4de24d39 (duckworth-0081) | changes: B1 G10, B2 G18, B3 G6 withdraw/arbiter and G20 human leg untested, N1-N7 |