agents: Dewey row 136 build packet, approvals bind to the role instance and thread (#1630)

Candidate manifest 38b0d3cda5b7f69a0a4c60fc0434c66ba8cc8e7b834fcb865383dd2ee6d711e8 on e37d6e583.
Owner's gate 22:25:05Z-22:29:11Z exit 0; mutants 4 of 4 killed.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

agents/dewey/work/queue-136/BUILD.md

@@ -0,0 +1,124 @@
+# Row 136 (#1630): approvals bind to the decision and the role instance, not the run
+
+Builder: Dewey. Reviewer: Filbert. Gate owner: Sage.
+Brief: docs/plans/2026-10-15_q167-north-star-rows.md, the row 136 section (e37d6e583).
+Assignment: sage-0380. Slot: sage-0387. Rulings in sage-0387 are recorded below.
+
+Base: e37d6e5836737614f4b9542a07165b8bf6401aa7 (base.txt). The candidate is build.patch on that
+base, and candidate-manifest.sha256 lists every changed path with its sha256. repro.sh applies
+the patch to a fresh detached worktree and checks the digests; it printed DIGESTS_OK.
+
+## The change
+
+packages/bus/src/broker.mjs, inside the scope the brief gives (#checkAuthority and the supersede
+check):
+
+- **`#raisedThread(d)`, new.** It returns the thread the raising run claimed, or null. A run is
+  bound to one thread for its life and claims it before it can raise, so the latest claim row for
+  `holder_run = d.raised_by_run` is that thread. A non-thread run has no thread claims, so it gets
+  null, which matches its `s.thread` of null.
+- **#checkAuthority.** `d.raised_by_run !== s.run` becomes `this.#raisedThread(d) !== s.thread`.
+  `d.raised_by_role !== s.role` stays, as do the class, action, context and target checks. The
+  approval is now bound to the business (`#decision` was already business-scoped), the role
+  instance, the thread when there was one, and the decision. Any run of that instance can consume
+  it while it holds its claim (`#agent` still requires that).
+- **Supersede** in decision.raise. `old.raised_by_run !== s.run` becomes
+  `old.raised_by_role !== s.role || this.#raisedThread(old) !== s.thread`. The `#closed` check
+  stays. The role check is new here because the run check used to imply it.
+- **Single use.** No code change. #consumeAuthority already refuses `decision-consumed` once any
+  `action.allowed` row (other than the raise's context event) exists for the decision, whichever
+  run wrote it, inside the caller's transaction.
+- **role.revoke** still requires the target's holder run recorded at the raise. Unchanged.
+- No schema step. The binding reads thread_claims, which row 121 already has.
+
+### Choice: strict thread equality
+
+A thread instance's decision raised before row 121 has no thread claim, so `#raisedThread` gives
+null, and every run of a thread instance has a non-null `s.thread`. Such a decision is not
+consumable by any thread run. I chose this over treating null as "any thread", which would fail
+open. It is no regression: before this row those decisions were bound to their raising run,
+which has ended. The README says so.
+
+## Tests
+
+- **approval-binding.test.mjs, new, 5 tests**, one per brief case:
+  1. Approve, end the run, close and reopen the store with a new Broker; a new run of the same
+     instance consumes it. A second use by that run and by a third run refuses
+     `decision-consumed`, and the count of `action.allowed` stays 1.
+  2. Another instance of the same definition (coder2) refuses `decision-mismatch` and consumes
+     nothing; the raising run can still use it.
+  3. A run of the same thread instance in another thread refuses `decision-mismatch`; after the
+     first run ends, a new run in the same thread consumes it once.
+  4. A later run of the same instance supersedes; the old decision gets `withdrawn`. Superseding it
+     again refuses (closed). Another instance refuses `supersede-refused` and withdraws nothing.
+  5. Thread supersede: a run in another thread refuses and withdraws nothing; a later run in the
+     same thread supersedes.
+
+### Changed expectations (sage-0387: right, name them here)
+
+Both asserted the old run binding that the brief replaces.
+
+- **broker.test.mjs:287**, in "authority never transfers between action, run, target, unresolved or
+  replaced role holder". A new run `r2` of the same coder instance, holding the claim after
+  `role.release`, used to refuse `decision-mismatch`. It now consumes the decision. The title
+  drops "run" and adds "a later run of the instance keeps it". The other checks in that test
+  (action, target, unresolved, replaced holder for role.revoke) are unchanged.
+- **single-use.test.mjs**, "another run cannot consume an approval..." becomes "another run of the
+  same instance consumes an approval once; a failed check leaves it usable". run2 with the wrong
+  target refuses `decision-mismatch` and consumes nothing, run2 then consumes it, and run1 gets
+  `decision-consumed` afterwards. So it still checks that a refused check doesn't consume, and it
+  now checks single use across runs.
+
+### Other packages
+
+webui's bus-browser supersede test and cli's app.test fixture supersede and consume from the
+raising run, which still works. Both pass in the gate.
+
+## Follow-ups (not in this row)
+
+- **decision.withdraw is still run-bound** (`d.raised_by_run !== s.run` refuses `not-resolver`,
+  broker.mjs about line 1131). A later run of the instance can supersede an open decision but not
+  withdraw it. The brief limits this row to #checkAuthority and the supersede check, and
+  sage-0387 keeps it out of 136. Recorded on #1630.
+- **The close message's thread lookup** (broker.mjs about line 1172) runs the same query as
+  `#raisedThread`. It could call the helper. Outside the files' scope for this row, so I left it.
+
+## Receipts
+
+Slot granted by Sage in sage-0387 (22:24:54Z). Released at 22:29Z with "slot clear".
+
+- **Single files** on the candidate before the slot, all 0 fail and 0 skipped: approval-binding
+  5, single-use 12, broker 16, decision-route 5, decision-close 8, decisions 7, agents 11,
+  messaging 13, threads 14, message-citation 3, end-launch 7.
+- **Mutants**, 2026-10-15T22:23:02Z to 22:23:12Z: 4 of 4 killed, source restored. See MUTANTS.md.
+- **Gate**, gate.sh from ~/dewey-scratch/r136, 2026-10-15T22:25:05Z to 22:29:11Z, exit 0
+  (gate-run.log, logs under gate/). Every package that imports the bus, then every
+  scripts/test-*.sh, as land-work.sh runs them:
+
+  | Step | Result |
+  |---|---|
+  | bus | 219 pass, 0 fail |
+  | cli | 203 pass, 0 fail |
+  | harness | 90 pass, 0 fail |
+  | plugins | 21 pass, 0 fail |
+  | seat | 135 pass, 0 fail |
+  | tasks | 97 pass, 0 fail |
+  | webui | 112 pass, 0 fail |
+  | test-auth | 15 passed, 0 failed |
+  | test-conductor | 17 passed, 0 failed |
+  | test-config | 24 passed, 0 failed |
+  | test-discord | 78 passed, 0 failed |
+  | test-extension-package | 18 passed, 0 failed |
+  | test-foundation | 44 passed, 0 failed |
+  | test-land-work | 84 passed, 0 failed |
+  | test-queue | 28 passed, 0 failed |
+  | test-release | 14 passed, 0 failed |
+  | test-task | 98 passed, 0 failed |
+
+  No recurrence of flakes #258, #261, #262 or #263. The packages that don't import the bus
+  (business, control-board, conversation, discord, ledger, mosaic, runs) are left to Sage's full
+  gate. test-queue.sh runs packages/queue's tests.
+- **Base check** (sage-0387): no commit in e37d6e583..193ae70c6 (HEAD at 22:29Z) touches a
+  manifest path. Row 145 (task 305) changes broker.mjs; if it lands first, I rebase and rerun.
+- **Candidate:** candidate-manifest.sha256, sha256
+  38b0d3cda5b7f69a0a4c60fc0434c66ba8cc8e7b834fcb865383dd2ee6d711e8, 5 files.

agents/dewey/work/queue-136/MUTANTS.md

@@ -0,0 +1,26 @@
+# Row 136 (#1630) mutants
+
+One mutant per new check, plus one for the role check that the run check used to back up.
+mutants.py applies each to packages/bus/src/broker.mjs in ~/dewey-scratch/r136/wt and runs
+approval-binding, single-use and broker tests (33 tests). It restores the file afterwards, and
+the run ended with `restored True`.
+
+There is no separate control step in the harness. The control is the single-file runs on the
+unmutated candidate before it, all 0 fail: approval-binding 5, single-use 12, broker 16.
+
+Run 2026-10-15T22:23:02Z to 22:23:12Z. Logs in mutants/, console in mutants-run.log.
+
+| Mutant | Fault | Result | Killed by |
+|---|---|---|---|
+| M1-authority-thread | #checkAuthority drops `#raisedThread(d) !== s.thread` | KILLED, 1 of 33 failed | approval-binding: a thread approval is consumed only by a run holding the same thread |
+| M2-supersede-role | supersede drops `old.raised_by_role !== s.role` | KILLED, 1 of 33 failed | approval-binding: a later run of the same instance supersedes an open decision; another instance cannot |
+| M3-supersede-thread | supersede drops `#raisedThread(old) !== s.thread` | KILLED, 1 of 33 failed | approval-binding: a thread decision is superseded only from the same thread |
+| M4-authority-role | #checkAuthority drops `d.raised_by_role !== s.role` | KILLED, 1 of 33 failed | approval-binding: another instance of the same definition cannot consume an approval |
+
+M4's check is not new. Before this row the run check also refused another instance, so the
+role check had no test of its own. Now it is the only thing between coder2 and coder's approval,
+so I added the mutant to show a test holds it.
+
+Single use needs no new check. #consumeAuthority already refuses `decision-consumed` once an
+`action.allowed` row exists for the decision, whichever run wrote it. The restart test and the
+single-use test cover it across runs.

agents/dewey/work/queue-136/base.txt

@@ -0,0 +1 @@
+e37d6e5836737614f4b9542a07165b8bf6401aa7

agents/dewey/work/queue-136/build.patch

@@ -0,0 +1,335 @@
+diff --git a/packages/bus/README.md b/packages/bus/README.md
+index 26220494f..07194b81b 100644
+--- a/packages/bus/README.md
++++ b/packages/bus/README.md
+@@ -298,7 +298,16 @@ The options come first, so a bad option list refuses `invalid-options` even when
+ An option that isn't an object with exactly `key` and `text` refuses `invalid-request`, like any other malformed argument.
+ 
+ Authorization requires the resolved option identified by `approvalChoice`
+-(default `yes`, which must exist), the same raiser role/run, action and target.
++(default `yes`, which must exist), the same raiser role instance, action and
++target. Row 136 (#1630): the approval binds to the decision, the business and
++the role instance (`raised_by_role`, the key in the business's `roles` map),
++not to the run that raised it, so it outlives a restart and any run of that
++instance holding its claim may consume it. A decision raised by a thread run
++binds to that run's thread too: only a run holding the same thread consumes
++it, and a decision a thread instance raised before row 121 matches no thread
++run. Another instance, or the same instance in another thread, refuses
++`decision-mismatch`. `role.revoke` still requires the target's holder run
++recorded at the raise.
+ Inbox projections expose `{action,target,approvalChoice}` as `authorization`:
+ **S4 must display this context when offering resolution**, not infer approval
+ from recommendation or option position. Any other option is a refusal, even if
+@@ -307,8 +316,8 @@ including cross-role approval (lead decision 64). `authorize`, `message.send`
+ and `role.revoke` share one authority-and-consumption helper. Each caller keeps
+ the consumption check, `action.allowed` event and any broker-owned effect in one
+ transaction.
+-A later use through any of those paths, including after restart, refuses with
+-`decision-consumed`. The `decision.raise` context event does not consume approval.
++A later use through any of those paths, by any run and including after
++restart, refuses with `decision-consumed`. The `decision.raise` context event does not consume approval.
+ A failed transaction rolls consumption back. A mismatch between the decision's
+ recorded class and current policy refuses with `decision-mismatch` before use,
+ in either direction. Within-role `authorize` calls without a decision retain
+@@ -326,7 +335,10 @@ authority and the full matching, resolution and single-use checks still apply.
+ A consumed approval is not an exactly-once external service operation receipt;
+ an uncertain external outcome must not be retried with that approval. S3/S6
+ must implement their own external-operation identity and uncertain-outcome
+-handling. Raising/superseding and resolving are transactional.
++handling. Raising/superseding and resolving are transactional. `supersedes` names an
++open decision raised by the same role instance, in the same thread when it was
++raised in one, by this run or an earlier one; otherwise the raise refuses
++`supersede-refused` and withdraws nothing.
+ 
+ ### Decision close messages (row 115, #1609)
+ 
+@@ -348,7 +360,7 @@ where `<by>` is the close's `decision_events.by` (the human's name or the
+ closing run). A close with a note adds `Note: <note>` on its own line.
+ 
+ No message goes out for `decision.seen`, for the raising run's own withdraw, for
+-a supersede (also the raising run's withdraw), or for a within-role decision,
++a supersede (a withdraw by the raising role instance), or for a within-role decision,
+ which closes inside `decision.raise`. `message.receive` gives a human close's
+ message the close's `human.input` answer event as its `request`, so the role's
+ turn cites it as it cites a human instruction; a role close's `request` is
+diff --git a/packages/bus/src/broker.mjs b/packages/bus/src/broker.mjs
+index 49c51cd8e..5e5765e1b 100644
+--- a/packages/bus/src/broker.mjs
++++ b/packages/bus/src/broker.mjs
+@@ -480,6 +480,18 @@ export class Broker {
+     if (!d) fail('decision-not-found');
+     return d;
+   }
++  // Row 136 (#1630): the thread a decision was raised in, the one its raising run claimed, or
++  // null. A run is bound to one thread for its life and claimed it before it could raise. A
++  // decision a thread instance raised before row 121 has no claim, so no thread run matches it.
++  #raisedThread(d) {
++    return (
++      this.#store.get(
++        "SELECT thread FROM thread_claims WHERE business=? AND holder_run=? AND op='claim' ORDER BY seq DESC LIMIT 1",
++        d.business,
++        d.raised_by_run,
++      )?.thread ?? null
++    );
++  }
+   #decisionView(d) {
+     const row = this.#store.get(
+       "SELECT body FROM events WHERE business=? AND kind='action.allowed' AND json_extract(body,'$.operation')='decision.raise' AND json_extract(body,'$.decision')=? ORDER BY seq LIMIT 1",
+@@ -593,11 +605,13 @@ export class Broker {
+       d.id,
+     );
+     const context = evidence ? JSON.parse(evidence.body) : null;
++    // Row 136 (#1630): bound to the role instance and its thread, not the run, so an approval
++    // outlives a restart. Single use is #consumeAuthority's.
+     if (
+       d.class !== cls ||
+       d.action !== action ||
+       d.raised_by_role !== s.role ||
+-      d.raised_by_run !== s.run ||
++      this.#raisedThread(d) !== s.thread ||
+       !context ||
+       context.target !== target
+     )
+@@ -1041,7 +1055,9 @@ export class Broker {
+         if (cls !== 'within-role') this.#checkMessaging(s.business, route, s.role, 'decision-route-refused');
+         if (a.supersedes) {
+           const old = this.#decision(s, a.supersedes);
+-          if (old.raised_by_run !== s.run || this.#closed(old.id)) fail('supersede-refused');
++          // Row 136: the same role instance and thread as #checkAuthority's, so a later run supersedes.
++          if (old.raised_by_role !== s.role || this.#raisedThread(old) !== s.thread || this.#closed(old.id))
++            fail('supersede-refused');
+           this.#store.run(
+             'INSERT INTO decision_events(decision,at,op,by) VALUES(?,?,?,?)',
+             old.id,
+diff --git a/packages/bus/tests/approval-binding.test.mjs b/packages/bus/tests/approval-binding.test.mjs
+new file mode 100644
+index 000000000..f52e8bf2b
+--- /dev/null
++++ b/packages/bus/tests/approval-binding.test.mjs
+@@ -0,0 +1,168 @@
++import test from 'node:test';
++import assert from 'node:assert/strict';
++import { mkdtempSync, rmSync } from 'node:fs';
++import { tmpdir } from 'node:os';
++import { join } from 'node:path';
++import { Store } from '../src/store.mjs';
++import { Broker } from '../src/broker.mjs';
++
++// Row 136 (#1630): an approval binds to the decision, the business and the role instance, plus
++// the thread when the raising run held one, not to the run that raised it. coder and coder2 are
++// two instances of one definition; assistant is a thread instance.
++const businesses = {
++  demo: {
++    id: 'demo',
++    human: 'jason',
++    arbiters: { technical: 'pm', delivery: 'pm' },
++    roles: {
++      coder: { definition: 'coder', authority: { withinRole: [], crossRole: [] } },
++      coder2: { definition: 'coder', authority: { withinRole: [], crossRole: [] } },
++      pm: { definition: 'pm', authority: { withinRole: [], crossRole: [] } },
++      assistant: { definition: 'assistant', authority: { withinRole: ['message.send'], crossRole: [] } },
++    },
++    definitions: { coder: {}, pm: {}, assistant: {} },
++  },
++};
++
++function setup(t) {
++  const root = mkdtempSync(join(tmpdir(), 'bus-binding-'));
++  let store, b;
++  const caps = {};
++  const ctx = {
++    get b() {
++      return b;
++    },
++    get store() {
++      return store;
++    },
++    caps,
++    call: (who, verb, args = {}) => b.request(caps[who], { verb, args }),
++    open() {
++      store = new Store(root);
++      b = new Broker({ store, businesses });
++      caps.human = b.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });
++    },
++    // A run of `role` that holds its claim; `thread` for the assistant.
++    run(name, role, thread) {
++      caps[name] = b.bindLaunch({ business: 'demo', role, run: name, harness: 'pi', ...(thread ? { thread } : {}) });
++      ctx.call(name, 'role.claim');
++      return caps[name];
++    },
++    end: (name) => b.endLaunch({ business: 'demo', run: name, reason: 'exited' }),
++    // A gated decision, so it routes to the human.
++    raise: (who, extra = {}) =>
++      ctx.call(who, 'decision.raise', {
++        action: 'deploy',
++        target: 'release1',
++        question: 'Ship release1?',
++        options: [
++          { key: 'yes', text: 'Yes' },
++          { key: 'no', text: 'No' },
++        ],
++        recommendation: 'yes',
++        blocking: false,
++        ...extra,
++      }),
++    approve: (d) => ctx.call('human', 'decision.resolve', { id: d.id, choice: 'yes' }),
++    use: (who, d) => b.authorize(caps[who], 'deploy', { decision: d.id, target: 'release1' }),
++    used: (d) =>
++      store.get(
++        "SELECT count(*) AS n FROM events WHERE kind='action.allowed' AND json_extract(body,'$.decision')=? AND json_extract(body,'$.operation') IS NOT 'decision.raise'",
++        d.id,
++      ).n,
++    ops: (d) => store.all('SELECT op FROM decision_events WHERE decision=? ORDER BY seq', d.id).map((r) => r.op),
++  };
++  ctx.open();
++  t.after(() => {
++    store.close();
++    rmSync(root, { recursive: true, force: true });
++  });
++  return ctx;
++}
++
++// Two assistant threads in one project.
++function threads(f) {
++  const project = f.call('human', 'project.create', { name: 'stack work' }).id;
++  const A = f.call('human', 'thread.create', { project, name: 'alpha' }).id;
++  const B = f.call('human', 'thread.create', { project, name: 'beta' }).id;
++  return { A, B };
++}
++
++test('REQ-DEC an approval outlives its run and a broker restart; a new run of the instance consumes it once', (t) => {
++  const f = setup(t);
++  f.run('run1', 'coder');
++  const d = f.raise('run1');
++  f.approve(d);
++  f.end('run1');
++  f.store.close();
++  f.open();
++  f.run('run2', 'coder');
++  assert.deepEqual(f.use('run2', d), { class: 'gated', decision: d.id });
++  assert.equal(f.used(d), 1);
++  // Once: neither the consuming run nor a later one uses it again.
++  assert.throws(() => f.use('run2', d), { code: 'decision-consumed' });
++  f.end('run2');
++  f.run('run3', 'coder');
++  assert.throws(() => f.use('run3', d), { code: 'decision-consumed' });
++  assert.equal(f.used(d), 1);
++});
++
++test('REQ-DEC another instance of the same definition cannot consume an approval, and its refusal consumes nothing', (t) => {
++  const f = setup(t);
++  f.run('run1', 'coder');
++  const d = f.raise('run1');
++  f.approve(d);
++  f.run('other', 'coder2');
++  assert.throws(() => f.use('other', d), { code: 'decision-mismatch' });
++  assert.equal(f.used(d), 0);
++  f.use('run1', d);
++  assert.equal(f.used(d), 1);
++});
++
++test('REQ-DEC REQ-THREAD-1 a thread approval is consumed only by a run holding the same thread', (t) => {
++  const f = setup(t);
++  const { A, B } = threads(f);
++  f.run('a1', 'assistant', A);
++  f.run('b1', 'assistant', B);
++  const d = f.raise('a1');
++  f.approve(d);
++  // The same instance in another thread.
++  assert.throws(() => f.use('b1', d), { code: 'decision-mismatch' });
++  assert.equal(f.used(d), 0);
++  f.end('a1');
++  f.run('a2', 'assistant', A);
++  f.use('a2', d);
++  assert.equal(f.used(d), 1);
++  assert.throws(() => f.use('a2', d), { code: 'decision-consumed' });
++});
++
++test('REQ-DEC a later run of the same instance supersedes an open decision; another instance cannot', (t) => {
++  const f = setup(t);
++  f.run('run1', 'coder');
++  const old = f.raise('run1');
++  f.end('run1');
++  f.run('run2', 'coder');
++  const replacement = f.raise('run2', { supersedes: old.id, question: 'Ship release1 tonight?' });
++  assert.equal(replacement.supersedes, old.id);
++  assert.deepEqual(f.ops(old), ['withdrawn']);
++  // The old decision is closed now, so superseding it again refuses.
++  assert.throws(() => f.raise('run2', { supersedes: old.id }), { code: 'supersede-refused' });
++  f.run('other', 'coder2');
++  assert.throws(() => f.raise('other', { supersedes: replacement.id }), { code: 'supersede-refused' });
++  assert.deepEqual(f.ops(replacement), []);
++  assert.equal(f.store.get('SELECT count(*) AS n FROM decisions').n, 2);
++});
++
++test('REQ-DEC REQ-THREAD-1 a thread decision is superseded only from the same thread', (t) => {
++  const f = setup(t);
++  const { A, B } = threads(f);
++  f.run('a1', 'assistant', A);
++  f.run('b1', 'assistant', B);
++  const old = f.raise('a1');
++  assert.throws(() => f.raise('b1', { supersedes: old.id }), { code: 'supersede-refused' });
++  assert.deepEqual(f.ops(old), []);
++  f.end('a1');
++  f.run('a2', 'assistant', A);
++  f.raise('a2', { supersedes: old.id });
++  assert.deepEqual(f.ops(old), ['withdrawn']);
++});
+diff --git a/packages/bus/tests/broker.test.mjs b/packages/bus/tests/broker.test.mjs
+index cf2e269bd..6e5beea08 100644
+--- a/packages/bus/tests/broker.test.mjs
++++ b/packages/bus/tests/broker.test.mjs
+@@ -271,7 +271,7 @@ test('business isolation includes inherited object names and cross-business mess
+   );
+   assert.deepEqual(call(b, caps[1], 'trail', { subject: d.id }), []);
+ });
+-test('authority never transfers between action, run, target, unresolved or replaced role holder', (t) => {
++test('authority never transfers between action, target, unresolved or replaced role holder; a later run of the instance keeps it', (t) => {
+   const { b, agent, human } = setup(t),
+     c = agent('coder'),
+     p = agent('pm');
+@@ -284,7 +284,8 @@ test('authority never transfers between action, run, target, unresolved or repla
+   call(b, c, 'role.release');
+   const c2 = agent('coder', 'r2');
+   call(b, c2, 'role.claim');
+-  assert.throws(() => b.authorize(c2, 'deploy', { target: 'v1', decision: d.id }), /decision-mismatch/);
++  // Row 136 (#1630): the approval binds to the instance, not the run (approval-binding.test.mjs).
++  assert.equal(b.authorize(c2, 'deploy', { target: 'v1', decision: d.id }).decision, d.id);
+   const revoke = raise(b, c2, 'role.revoke', { target: 'pm' });
+   call(b, human, 'decision.resolve', { id: revoke.id, choice: 'yes' });
+   call(b, p, 'role.release');
+diff --git a/packages/bus/tests/single-use.test.mjs b/packages/bus/tests/single-use.test.mjs
+index 65e36292d..1ca595a79 100644
+--- a/packages/bus/tests/single-use.test.mjs
++++ b/packages/bus/tests/single-use.test.mjs
+@@ -104,21 +104,23 @@ test('gated approval authorizes once, survives store reopen, and fresh approval
+   f.use(fresh);
+   assert.equal(f.count(fresh), 1);
+ });
+-test('another run cannot consume an approval; a failed check leaves it usable', (t) => {
++// Row 136 (#1630): an approval binds to the role instance, so another run of it consumes it once.
++test('another run of the same instance consumes an approval once; a failed check leaves it usable', (t) => {
+   const f = fixture(t),
+     d = f.approve(),
+     other = f.bind('run2');
+   f.call(f.cap, 'role.release');
+   f.call(other, 'role.claim');
+-  assert.throws(() => f.use(d, other), /decision-mismatch/);
+-  assert.equal(f.count(d), 0);
+-  f.call(other, 'role.release');
+-  f.call(f.cap, 'role.claim');
+   assert.throws(
+-    () => f.b.authorize(f.cap, 'deploy', { decision: d.id, target: 'other' }),
++    () => f.b.authorize(other, 'deploy', { decision: d.id, target: 'other' }),
+     /decision-mismatch/,
+   );
+-  f.use(d);
++  assert.equal(f.count(d), 0);
++  f.use(d, other);
++  assert.equal(f.count(d), 1);
++  f.call(other, 'role.release');
++  f.call(f.cap, 'role.claim');
++  assert.throws(() => f.use(d), /decision-consumed/);
+   assert.equal(f.count(d), 1);
+ });
+ test('two scheduled callers have exactly one grant and one consumed refusal', async (t) => {

agents/dewey/work/queue-136/candidate-manifest.sha256

@@ -0,0 +1,5 @@
+ecb2ff7e2ad6fb030f13908cb2cf4fabbd8debd6009e36d4b24568915c46b296  packages/bus/README.md
+c4e163f848193ad3df110dce726ea03f8df871845a7ef34cc990c064e479bb9a  packages/bus/src/broker.mjs
+c403818db86f55cf9380e87dc76c1a341f3252b204a53c9754ba1fc2f3aed7a4  packages/bus/tests/approval-binding.test.mjs
+4510347422fb79b96e60f00a140b429e0f5874e37723effc4f0f77d9f11cc600  packages/bus/tests/broker.test.mjs
+2ed2f117dcdd319f5a759531d3e7d396c29683dce39a2b7c59e18c29317f8adf  packages/bus/tests/single-use.test.mjs

agents/dewey/work/queue-136/gate-run.log

@@ -0,0 +1,18 @@
+pkg-bus start=2026-10-15T22:25:05Z end=2026-10-15T22:25:15Z rc=0 tests=219 pass=219 fail=0 skipped=0 
+pkg-cli start=2026-10-15T22:25:15Z end=2026-10-15T22:25:37Z rc=0 tests=203 pass=203 fail=0 skipped=0 
+pkg-harness start=2026-10-15T22:25:37Z end=2026-10-15T22:25:49Z rc=0 tests=90 pass=90 fail=0 skipped=0 
+pkg-plugins start=2026-10-15T22:25:49Z end=2026-10-15T22:25:50Z rc=0 tests=21 pass=21 fail=0 skipped=0 
+pkg-seat start=2026-10-15T22:25:50Z end=2026-10-15T22:25:55Z rc=0 tests=135 pass=135 fail=0 skipped=0 
+pkg-tasks start=2026-10-15T22:25:55Z end=2026-10-15T22:26:00Z rc=0 tests=97 pass=97 fail=0 skipped=0 
+pkg-webui start=2026-10-15T22:26:00Z end=2026-10-15T22:26:55Z rc=0 tests=112 pass=112 fail=0 skipped=0 
+test-auth start=2026-10-15T22:26:55Z end=2026-10-15T22:26:55Z rc=0
+test-conductor start=2026-10-15T22:26:55Z end=2026-10-15T22:27:00Z rc=0
+test-config start=2026-10-15T22:27:00Z end=2026-10-15T22:27:01Z rc=0
+test-discord start=2026-10-15T22:27:01Z end=2026-10-15T22:27:08Z rc=0
+test-extension-package start=2026-10-15T22:27:08Z end=2026-10-15T22:27:10Z rc=0
+test-foundation start=2026-10-15T22:27:10Z end=2026-10-15T22:27:48Z rc=0
+test-land-work start=2026-10-15T22:27:48Z end=2026-10-15T22:27:59Z rc=0
+test-queue start=2026-10-15T22:27:59Z end=2026-10-15T22:28:31Z rc=0
+test-release start=2026-10-15T22:28:31Z end=2026-10-15T22:28:42Z rc=0
+test-task start=2026-10-15T22:28:42Z end=2026-10-15T22:29:11Z rc=0
+GATE_EXIT=0

agents/dewey/work/queue-136/gate.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+# Row 136 owner's gate (sage-0380): the bus suite, the packages that import it, and every
+# scripts/test-*.sh, on e37d6e583 plus build.patch. One log per step under gate/.
+set -uo pipefail
+WT=${1:-$HOME/dewey-scratch/r136/wt}
+OUT=$(cd "$(dirname "$0")" && pwd)/gate
+mkdir -p "$OUT"
+export TMPDIR=$HOME/dewey-scratch/tmp
+status=0
+for p in bus cli harness plugins seat tasks webui; do
+  start=$(date -u +%FT%TZ)
+  (cd "$WT/packages/$p" && node --test tests/*.test.mjs) >"$OUT/pkg-$p.log" 2>&1
+  rc=$?
+  counts=$(grep -E '^ℹ (tests|pass|fail|skipped) ' "$OUT/pkg-$p.log" | awk '{printf "%s=%s ", $2, $3}')
+  echo "pkg-$p start=$start end=$(date -u +%FT%TZ) rc=$rc $counts"
+  [ "$rc" -eq 0 ] || status=1
+done
+for s in "$WT"/scripts/test-*.sh; do
+  n=$(basename "$s" .sh)
+  start=$(date -u +%FT%TZ)
+  (cd "$WT" && bash "scripts/$n.sh") >"$OUT/$n.log" 2>&1
+  rc=$?
+  echo "$n start=$start end=$(date -u +%FT%TZ) rc=$rc"
+  [ "$rc" -eq 0 ] || status=1
+done
+exit $status

agents/dewey/work/queue-136/gate/pkg-bus.log

@@ -0,0 +1,227 @@
+✔ agents: a held role with nothing on the bus is idle; a role session gets the claim rows unchanged (138.515419ms)
+✔ agents: working counts what the holder received and has not read; routed alone is not working (212.493953ms)
+✔ agents: input needed is the role's open decisions routed to the human, gated first, then oldest (326.065736ms)
+✔ agents: working wins over waiting, and Input needed still shows (180.101978ms)
+✔ agents: a new holder doesn't inherit what the last one left unread; decisions stay with the role (199.289423ms)
+✔ agents: state reads only its own business, even for a run name both use (197.077884ms)
+✔ agents: a message the holder released unread is stranded; the next holder gets nothing and cannot read it (200.862426ms)
+✔ agents: a message the holder read is not stranded; one the current holder has not read is not listed (229.799222ms)
+✔ agents: stranded is oldest first and capped at 50 for a role (902.470072ms)
+✔ agents: stranded is per role and per business (333.241448ms)
+✔ agents: a message routed to a held role and not yet received is not stranded (139.951633ms)
+✔ REQ-DEC an approval outlives its run and a broker restart; a new run of the instance consumes it once (287.402748ms)
+✔ REQ-DEC another instance of the same definition cannot consume an approval, and its refusal consumes nothing (189.250317ms)
+✔ REQ-DEC REQ-THREAD-1 a thread approval is consumed only by a run holding the same thread (262.938197ms)
+✔ REQ-DEC a later run of the same instance supersedes an open decision; another instance cannot (261.841906ms)
+✔ REQ-DEC REQ-THREAD-1 a thread decision is superseded only from the same thread (259.237881ms)
+✔ launch identity is stamped, payload identity is refused and stale holder cannot send (170.404057ms)
+✔ decision classes route from policy; gated resolution is human-only, choice and target must match (265.918194ms)
+✔ claim exclusion, holder release, gated revoke and rerouting to a new holder are atomic (275.983107ms)
+✔ launch events require a human CLI capability; generic emit cannot forge authority events (196.700693ms)
+✔ within-role decisions close atomically and invalid options or blocking omissions refuse (181.637676ms)
+✔ a recommendation that is not exactly one option key refuses invalid-recommendation after the options (276.427425ms)
+✔ observer capabilities read human inbox but cannot mutate or forge launch identity (187.446083ms)
+✔ task action subjects and linked decision trail are complete and ordered (215.959474ms)
+✔ launch binding is durable and reconnecting requires the identical trusted record (129.317607ms)
+✔ business isolation includes inherited object names and cross-business message references (188.032929ms)
+✔ authority never transfers between action, target, unresolved or replaced role holder; a later run of the instance keeps it (308.503397ms)
+✔ task projection uses schema current view, skipping earlier and equal-start polls (167.40807ms)
+✔ revocation permanently bars the old run from reclaiming first, including after broker restart (206.096566ms)
+✔ empty message references refuse before storage; refusal-evidence failure stays a typed error (155.54157ms)
+✔ both arbiters require human resolution when their cross-role route is themselves (246.413258ms)
+✔ the shipped coder role raises task.reassign as gated to the human; task.scope.change stays cross-role (176.198769ms)
+✔ S1 adapter takes resolved limits and refs, rejects mismatched instance, never mutates input (2.420322ms)
+✔ REQ-COS-1, REQ-ROLE-2: the chief of staff ends a run with a reason and no decision, and the reason is logged (249.82108ms)
+✔ REQ-ROLE-2: a role without role.end still needs a resolved decision to revoke (330.557663ms)
+✔ REQ-ROLE-2: storage accepts a revoke with a reason or a decision and aborts one with neither (252.570456ms)
+✔ REQ-ROLE-2: the chief of staff may still cite a decision, and a decision alone is the old path (228.692674ms)
+✔ REQ-ROLE-2: a role without role.end still ends a run through a resolved decision, which is recorded and has no reason (254.841989ms)
+✔ REQ-ROLE-2: a reason is required, bounded, and never sent with a decision (299.116008ms)
+✔ REQ-COS-1: the chief of staff cannot end its own run or the assistant's through role.end (278.299154ms)
+✔ REQ-LIMIT-1, REQ-COS-1: organization.set from the chief of staff reaches the shared writer, named as the actor (227.017693ms)
+✔ REQ-LIMIT-1, REQ-COS-1: a refused organization.set logs action.refused and no action.allowed, like a refused limits.set (321.989483ms)
+✔ REQ-LIMIT-1: organization.set is refused for every caller whose role file lacks organization.change (308.503711ms)
+✔ REQ-LIMIT-1: the chief of staff is logged as allowed, and organization.set takes only the human's keys (397.523635ms)
+✔ REQ-ROLE-3, REQ-LIMIT-1: a chief-of-staff change is validated, written and logged like a human's; an invalid one is refused (503.002646ms)
+✔ REQ-ROLE-2, REQ-COS-1: the 3c→3d migration lets the chief of staff end a held role with a reason; neither is still refused (786.108548ms)
+✔ comment cursors isolate businesses, move only forward and remain append-only (132.693959ms)
+✔ only trusted sync writes validated cursors; events and cursor share rollback (136.98513ms)
+✔ explicit 3b copy migration preserves evidence and opens as 3e; normal startup never migrates (836.787843ms)
+✔ migration refuses active writers and drifted legacy schemas, with no partial upgrade (1565.974287ms)
+✔ named migration registry chains 3b through 3e to a fixture-only future version in order (803.817557ms)
+✔ migration refuses mismatched source metadata without changing schema or evidence (728.631772ms)
+✔ offline command migrates only the supplied fixture root and reports usage errors (778.118216ms)
+✔ credentials gives human and reader sessions service, account, role, date and state, and nothing else (89.154307ms)
+✔ credentials refuses a role session and any argument (183.561557ms)
+✔ credentials reads the status on each request, and a broker without one lists none (221.813534ms)
+✔ the broker process answers credentials without a token, path or variable in its output, log or store (197.518484ms)
+✔ only validated broker references load; returned data and exceptions cannot expose a known token (3.651159ms)
+✔ bad file modes, symlinks, repository/data paths, malformed tokens and missing dates refuse (7.077089ms)
+✔ expiry refuses use and env references never become client data (0.860734ms)
+✔ S1 parsed service refs work, service mismatch refuses, Gitea rotation due is a warning state (1.73115ms)
+✔ opaque tokens shorter than 16 characters refuse before use (0.395411ms)
+✔ a human resolve sends the raising role one message from the human, and its request is the answer (247.314393ms)
+✔ a cross-role decision resolved by its arbiter comes from that role and run, with no request (236.870855ms)
+✔ a human withdraw sends one message with the note (235.791428ms)
+✔ a human seen before the close leaves the request on the close's answer, not the seen (295.191938ms)
+✔ the raising run's withdraw, a supersede, a within-role raise and seen send nothing (289.157272ms)
+✔ refused closes send nothing: invalid-choice, decision-closed, not-resolver (295.25024ms)
+✔ a raising role nobody holds at the close gets the message on the next claim (300.038779ms)
+✔ a human DECISION send keeps its own instruction as the request, not a close's answer (262.895322ms)
+✔ a cross-role raise whose arbiter the raiser does not hear from is refused and stores nothing (306.595891ms)
+✔ a gated raise by a role that does not hear from the human is refused and stores nothing (285.146646ms)
+✔ a route the raiser hears from is allowed, checked from the route to the raiser (344.783618ms)
+✔ a refused supersede withdraws nothing (304.252559ms)
+✔ the assistant's within-role and gated raises still work (302.098572ms)
+✔ roles lists open decisions routed to a role, and never the human inbox (219.980582ms)
+✔ recent lists closed decisions of every route, newest close first, with how each closed (291.589709ms)
+✔ recent gives the closing event as closed when the decision was seen first (292.100842ms)
+✔ recent stops at RECENT rows (833.608412ms)
+✔ every row is what trail already gives the same session for that id (280.886498ms)
+✔ a role session can't list decisions, so it can't read another role's open decisions (409.828081ms)
+✔ decisions is a read: one business, strict arguments, nothing written (387.545663ms)
+✔ endLaunch writes session.ended, releases the run claim and kills its capabilities (137.049441ms)
+✔ endLaunch refuses an unknown run, a second end and a rebind of the ended run (146.683374ms)
+✔ a restarted broker refuses to rebind an ended run; a refused rebind leaves the run unbound (154.04619ms)
+✔ endLaunch leaves a claim another run took alone (171.261336ms)
+✔ refuse records action.refused against the caller with the code only (133.161351ms)
+✔ launches off refuses role.launch with launch-revoked until launches on (203.454482ms)
+✔ broker process: launch ops authorize role.launch, record refusals and end runs (334.040407ms)
+✔ human proof binds CLI entry, process start and nonce; agents and incomplete ancestry refuse (1.749407ms)
+✔ process reader gets own kernel identity without exposing environment values (0.658701ms)
+✔ EACCES ancestor environments skip only markers; commands and registered launches still refuse (0.953138ms)
+✔ real pid 1 remains inspectable when its environment is protected (0.297176ms)
+✔ limits binds actor from human proof and rejects role, reader, tester and forged actor (191.469593ms)
+✔ runtime wires verified human settings to the actual shared file writer and actor receipt (282.417684ms)
+✔ uncertain organization receipts leave bus startup and reads alone but refuse writes until reconciled (419.213835ms)
+✔ within-role sends cite an open gated launch decision without spending it or naming it in grants (210.15109ms)
+✔ missing and foreign-business citations refuse and roll back message and grant (183.585621ms)
+✔ cross-role sends still need a matching resolved decision and consume it once (252.667455ms)
+✔ messages pages all human messages newest first without writes; read state is history (2635.575573ms)
+✔ messages refuses role callers, invalid paging and cursors outside this human feed (274.306793ms)
+✔ views messages passes only its paging arguments through (0.275376ms)
+✔ messages isolates businesses even with a valid foreign cursor (176.218623ms)
+✔ the assistant sends to the user and to the chief of staff only (329.847764ms)
+✔ an assistant send to any other role, or to the tester, is refused and logged (372.480952ms)
+✔ only the user and the chief of staff may send to the assistant; the tester is refused by default (375.78039ms)
+✔ REQ-ASSIST-2 REQ-THREAD-1 thread.send to an instance that does not hear from the user is refused and stores nothing (307.512788ms)
+✔ a sender-side list alone refuses a send to a role that has no list (348.909025ms)
+✔ a target-side list alone refuses a send from a role that has no list (363.530242ms)
+✔ the sender list is checked before the target list (305.339018ms)
+✔ roles without the field behave exactly as before (413.176813ms)
+✔ a business with no role definitions at all is unlimited (323.061204ms)
+✔ a malformed messaging field refuses at boot (106.808094ms)
+✔ the assistant's review.request to a reviewer is refused and logged, even with an approved decision (331.568478ms)
+✔ a review.verdict to the assistant from a role outside its receiveFrom is refused and logged (354.523638ms)
+✔ review requests and verdicts between roles without the field are unchanged (286.756284ms)
+✔ broker process binds trusted launches, offers reader capabilities, refuses human mutation, closes cleanly (198.378725ms)
+✔ startup token refusal returns safe code without value or partial listening broker (45.980995ms)
+✔ loaded fixture token is absent from socket replies and SQLite, including refusal evidence (199.621508ms)
+✔ killed broker leaves an explicit stale lock; another process cannot silently reclaim it (209.398078ms)
+✔ trusted host registers later launches; socket clients never have a registration verb (201.278193ms)
+✔ runtime excludes declared project roots even when host supplies no repoRoots (66.799086ms)
+✔ a refused launch binding leaves the broker and existing capabilities alive; bad protocol stops it (190.527878ms)
+✔ a reply is listed for human and reader sessions, and its delivery rows are unchanged (248.787646ms)
+✔ the reply still reaches the human message.receive (mosaic talk) after the Console showed it (197.979684ms)
+✔ a message with no reply gives an empty list (170.2456ms)
+✔ replies come oldest first and stop at REPLIES (778.106792ms)
+✔ an id that names no message in the business refuses message-not-found, and the refusal is recorded (315.06676ms)
+✔ strict arguments; a role session gets human-required (360.475571ms)
+✔ views passes replies through as one call with the id (0.244447ms)
+✔ requirements returns the committed list to a holding role session, and no one else (225.067515ms)
+✔ the PM's prd.approve with no task, when no id fits, reaches the human's Inbox (153.570086ms)
+✔ the PM's non-blocking role.revoke with no task reaches the human's Inbox (179.680573ms)
+✔ a push is recorded as the action.allowed for git.push.working on the task, and only the host records one (250.218889ms)
+✔ review.request names the latest pushed commit and sends the reviewer a REVIEW-REQUEST (242.354141ms)
+✔ review.request says which run holds the reviewer role, or null, and a null request waits for a claim (324.102564ms)
+✔ review.request refuses a commit that isn't the latest push, a non-reviewer and a role without the action (391.761803ms)
+✔ reviewFetch answers only the addressed reviewer, for the request it cites (246.928257ms)
+✔ review.verdict answers one request once, to the role that asked (295.773499ms)
+✔ task.close on a pushed task needs an approve verdict for the latest push (375.145815ms)
+✔ a refusal the host decided is filed on the task it names, and only a task ref counts (260.309342ms)
+✔ v3b prototype refusals, views and append-only mutations (1508.206484ms)
+✔ gated approval authorizes once, survives store reopen, and fresh approval works (276.308156ms)
+✔ another run of the same instance consumes an approval once; a failed check leaves it usable (220.131276ms)
+✔ two scheduled callers have exactly one grant and one consumed refusal (167.282342ms)
+✔ failed commit rolls consumption back; cross-role consumes and within-role stays reusable (325.497319ms)
+✔ class drift gated to cross-role refuses before consumption (236.043856ms)
+✔ class drift cross-role to gated refuses before consumption (228.395695ms)
+✔ class drift gated to within-role refuses before consumption (220.617632ms)
+✔ class drift cross-role to within-role refuses before consumption (264.631576ms)
+✔ class drift within-role to gated refuses before consumption (204.047117ms)
+✔ class drift within-role to cross-role refuses before consumption (199.88861ms)
+✔ message.send consumes approval and prevents a later send or authorize (208.400938ms)
+✔ role.revoke consumes approval and prevents a later revoke or authorize (235.832741ms)
+✔ a business that never switched launches reads allowed with no time and no event (129.351533ms)
+✔ launches revoked and then restored read allowed, with the restore time and event id (168.096417ms)
+✔ a task closed on the tracker leaves the open list, and total counts the open ones (159.032242ms)
+✔ a tombstone is not open (150.106332ms)
+✔ the open list stops at the cap and says so; total still counts every open task (129.505045ms)
+✔ a role and a reader session read state; arguments, and an unbound cap, refuse (158.715239ms)
+✔ a human session reads the same state, with the same cap (145.430169ms)
+✔ reading state writes nothing: every table keeps its row count (157.042603ms)
+✔ creates private WAL store and excludes a second writer until explicit close (156.466015ms)
+✔ rollback is atomic and schema metadata is checked against trusted DDL, not just itself (185.251081ms)
+✔ existing empty database and symlink runtime directory refuse, never initialize over damage (197.034168ms)
+✔ crash during a transaction recovers no partial event after explicit fixture-only lock removal (184.815496ms)
+✔ writer refuses mixed at/read_at forms atomically, even through trusted SQL helpers (102.912209ms)
+✔ async transactions refuse before invoking their function (91.180787ms)
+✔ the session default fits under the reply cap and pages to the end with next (302.285691ms)
+✔ the short form: no description, assignees by role, every listed key (243.520326ms)
+✔ each filter, alone and together, and total counts every match (364.637018ms)
+✔ task_ref reads one task in full, as the whole board has it (285.860001ms)
+✔ no arguments is the read the Console and mosaic make, unchanged (237.680858ms)
+✔ an unknown argument or a bad value refuses invalid-request (936.009127ms)
+✔ tasks rows carry priority and requirement for every session that reads tasks (308.897693ms)
+✔ the read model rebuilds from the ledger: a reopened bus and each trail give the same values (327.112401ms)
+✔ an empty business and one with snapshots but no task.created read cleanly (121.069171ms)
+✔ recordTask keeps sync reads and a role write apart (172.587958ms)
+✔ read_at must be one canonical UTC format, so the projection compares strings safely (96.54448ms)
+✔ a bad entry refuses the whole record (108.798303ms)
+✔ taskView reads the projection for one business (136.127066ms)
+✔ requestTask hands only a holder and a task verb to the handler, and records refusals (252.252523ms)
+✔ the server sends task verbs to the adapter with its own timeout; other verbs stay synchronous (409.393576ms)
+✔ without an adapter the server refuses every task verb (194.263923ms)
+✔ the runtime refuses an invalid adapter and closes a valid one (206.120329ms)
+✔ the process loads the S3 adapter from plain-data trackers (269.161623ms)
+✔ the tester binds only when the business sets bus.tester to exactly true (792.251353ms)
+✔ a business may not name a role tester, so the tester address is never a role (226.902073ms)
+✔ every verb outside the tester list refuses tester-refused and is recorded against the tester (503.817005ms)
+✔ a tester message is from tester, starts [mos test], and writes no human.input or authority (207.43536ms)
+✔ a role answers a tester only in reply to a tester message, and the answer never reaches the human (255.114904ms)
+✔ the tester reads the human views a reader reads (152.687598ms)
+✔ tester proof binds its own CLI, start time and nonce, refuses a managed run and allows an agent (1.035577ms)
+✔ neither CLI's nonce proves the other: each proof is bound to its own CLI and nonce variable (0.327136ms)
+✔ testerNonce reads only the tester's variable and gives null on any read error (0.195628ms)
+✔ an envelope carries exactly one of cap, human and tester; no tester authenticator refuses (98.026315ms)
+✔ tester-cli.mjs binds through the runtime when the switch is on, and refuses off or under a run marker (814.880519ms)
+✔ REQ-THREAD-1 REQ-ORG-2: the 3d→3e migration adds the thread tables and leaves messages from before threads as written (939.740262ms)
+✔ REQ-THREAD-1: a 3d bus with a changed schema is refused and keeps its version and tables (722.914454ms)
+✔ REQ-THREAD-1: the offline command prints the kept-message counts before the ready line (731.129029ms)
+✔ REQ-ROLE-2 REQ-THREAD-1: one holder per thread, through the broker and the trigger (334.818531ms)
+✔ REQ-ROLE-2 REQ-THREAD-1: the 3e triggers refuse writes that skip the broker (1053.346779ms)
+✔ REQ-MSG-1: a message to or from the assistant names its thread, or is refused (338.139644ms)
+✔ REQ-MSG-1: the chief of staff's reply comes back to the thread that sent the work (2937.59434ms)
+✔ REQ-MSG-1: a reply can't carry one thread instance's thread to another thread instance (98.623875ms)
+✔ REQ-THREAD-1 REQ-USER-2: one thread's messages never reach another thread's holder (153.672559ms)
+✔ REQ-LAUNCH-1: a message to a thread with no holder waits, and the next holder gets it (174.227893ms)
+✔ REQ-THREAD-2 REQ-LAUNCH-1: threadIdle releases only a thread with nothing waiting, and only for its holder (179.747028ms)
+✔ REQ-THREAD-2 REQ-LAUNCH-1: a message delivered to a run that ended unread doesn't hold up the next holder (153.778996ms)
+✔ REQ-ROLE-2 REQ-THREAD-1: an approved role.revoke never reaches a thread run, and the thread stays held (139.489465ms)
+✔ REQ-USER-2: the human verbs refuse another owner's thread (186.249776ms)
+✔ REQ-THREAD-1: thread.create refuses when the business has no thread instance or more than one (103.58344ms)
+✔ REQ-ORG-2: projects and threads are named once, and the repo names a business project (143.604254ms)
+✔ REQ-THREAD-2: thread.messages returns the thread's history in pages and writes nothing (491.385042ms)
+✔ socket capability stamps launch identity; shared views use wire, no SQL client (155.589237ms)
+✔ two wire claims serialize; a lost reply never automatically retries (176.569833ms)
+✔ malformed, oversized and identity-forging envelopes refuse without echoing input (111.741436ms)
+✔ client preserves UTF-8 when a response divides a multibyte character (11.606644ms)
+✔ committed mutation followed by dropped reply reports unknown and is never retried (136.756468ms)
+ℹ tests 219
+ℹ suites 0
+ℹ pass 219
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 9450.000148

agents/dewey/work/queue-136/gate/pkg-cli.log

@@ -0,0 +1,213 @@
+✔ every screen and overlay fits 120x36, 80x24 and the narrow layout, row for row (1419.896045ms)
+✔ width counts terminal cells: wide CJK and emoji 2, U+FE0F after a one-cell base 1, marks 0 (118.521716ms)
+✔ broker text is shown, never interpreted: no raw control character or bidi override reaches the terminal (163.288079ms)
+✔ NO_COLOR: no escape codes, except reverse video on the selected row (228.034964ms)
+✔ 1-9 shows the decide flow's own lines and question; only y resolves (181.806516ms)
+✔ the app shows the same decide text as mosaic decide (120.048936ms)
+✔ any key but y or Y at the question answers No; nothing is sent (3085.344464ms)
+✔ below 40x10 the question is hidden, so every key answers it No, y included (Filbert R3) (680.820306ms)
+✔ under 40 columns a tall terminal shows the too-small screen even where the decide box would fit; y sends nothing (Filbert N10) (2076.696894ms)
+✔ a hidden decide box names the way out, and the status line under it does not promise y (Filbert N12) (132.604982ms)
+✔ a throw while answering the question goes to crash, sends nothing and leaves no job pending (223.974113ms)
+✔ type-ahead never answers the question: a paste, keys typed before it is drawn, keys inside askMs (1053.791494ms)
+✔ quitting at the question answers No and sends nothing, armed or not (279.894225ms)
+✔ a timer tick reads nothing under an overlay, never answers the question, and keeps a resolved status (159.192265ms)
+✔ a long question is cut inside the question; the action, target, choice and prompt stay (Dewey B1) (197.78435ms)
+✔ a decide box too big for the terminal says so, and every key answers it No, y included (Dewey B1, round 3) (932.606083ms)
+✔ at every size the decide box shows each line y depends on, or says it is hidden (9422.757934ms)
+✔ outcome unknown: the CLI's sentence, no retry, then the trail or a re-read (195.855067ms)
+✔ refused and failed reads keep the last list, marked stale; a refused decide says refused (376.710526ms)
+✔ help or a detail box cut to fit keeps its last line, Esc included (Dewey) (63.917197ms)
+✔ keys: views, moving, trail of a selection, the command line, help and quit (257.541122ms)
+✔ one option: the status line says Press 1, not 1-1 (142.397513ms)
+✔ no business: the app says so and :business picks one (189.984071ms)
+✔ mosaic with no argument: exit 3 in an agent run, exit 4 with the usage off a terminal, the app on one (1.772688ms)
+✔ scripts/mosaic with no argument reaches the app entry; the seat usage it printed before has not drifted (171.024002ms)
+✔ strings to keep exactly live once, in the decide flow and the transport; the app does not restate them (0.452809ms)
+✔ decide with --note still asks; a No sends nothing (53.807041ms)
+✔ the app's business comes from a live bus host only (0.972675ms)
+✔ runApp leaves the terminal as it found it on q, end of input, SIGTERM, SIGINT, SIGHUP and an error, the first frame's included (6.749309ms)
+✔ draw is pure: same state, same frame (0.746729ms)
+✔ inbox lists only decisions routed to the human, with what approving authorizes and how to decide (150.572296ms)
+✔ decide resolves by id prefix with --yes, and the trail shows it in broker order with the task to follow (142.716738ms)
+✔ decide refuses without a terminal or --yes, on an unknown option and on a short reference (119.218128ms)
+✔ decide prints a declining choice as declining (184.904128ms)
+✔ an unknown outcome is reported once and never resent (117.268658ms)
+✔ a decision closed before the answer arrives exits 2 and points at its trail (113.494594ms)
+✔ a prefix that matches two open decisions exits 2 and resolves neither (104.217133ms)
+✔ without --business a command uses the live host's business, and a stale host.json is not a host (153.265557ms)
+✔ every human command refuses inside an agent run before it touches the bus (112.438213ms)
+✔ usage errors exit 4; no business and no host is a usage error (104.005173ms)
+✔ agents and tasks print through the broker (105.105463ms)
+✔ notify.json: missing, loose, malformed and extra keys refuse; a binding or null passes (1.350385ms)
+✔ bootConfig builds the broker's boot message for one business, with no trackers key when no project names one (79.052928ms)
+✔ trackers come from the tracker.* variables of the one project that names a tracker project (117.276577ms)
+✔ with two projects, the one that sets tracker.project supplies the tracker and the other is no conflict (49.720308ms)
+✔ two projects that each name a tracker project refuse, since the boot shape holds one (43.430999ms)
+✔ a business without tracker.baseUrl gets no trackers entry (32.451058ms)
+✔ an unknown business and a broken system config refuse with exit 3 (65.32177ms)
+✔ follow prints an unsolicited message after plain talk returned (209.326966ms)
+✔ talk --follow continues after reply and prints a later unsolicited message (202.104967ms)
+✔ inbox lists all unread human messages under decisions, does not deliver or read them (3837.533483ms)
+✔ follow refuses agent context and bad arguments (605.669424ms)
+✔ follow Ctrl-C wakes the poll sleep and removes its handler; transport errors also clean up (115.153346ms)
+✔ plain talk leaves the process SIGINT handlers unchanged (149.018134ms)
+✔ empty views say so (3.524726ms)
+✔ the trail keeps the broker's order and names a decision's task without its rows (1.675538ms)
+✔ tasks print the tracker fields the snapshot carries (0.293147ms)
+✔ the review loop: the coder pushes and asks, the reviewer fetches and approves, and the task's trail holds each step (817.490763ms)
+✔ refusals: no action, non-fast-forward, an unknown commit or request, and a push for another task moves only that task's ref (708.72744ms)
+✔ the size cap refuses a push before any byte (418.064067ms)
+✔ a fetch over the cap refuses before any byte reaches the reviewer (576.575253ms)
+✔ the socket refuses a request with no capability, an unknown one, and a bad request line (1412.14103ms)
+✔ a rigged clone runs nothing: hooks, fsmonitor, a filter, a gitlink and a symlinked .git/config leave no marker (1260.46457ms)
+✔ an identity with no role, or of another business, refuses not-a-role and moves no ref (406.663036ms)
+✔ a review of a project the business no longer has refuses unknown-project (826.184957ms)
+✔ past maxActive connections the socket refuses git-busy, and a hung-up connection frees its slot (294.119864ms)
+✔ close() answers host-closing to a connection still sending its request line (380.509292ms)
+✔ a bundle that trickles in refuses body-timeout at its deadline and frees its slot (1081.997586ms)
+✔ a reviewer gone before its bundle was sent is filed fetch-aborted, not as the host's fault (900.520015ms)
+✔ a reviewer that hangs up the moment it has the whole bundle was served, not aborted (718.062209ms)
+✔ send: a close after every byte left is served; one that fails a queued write is fetch-aborted (42.613853ms)
+✔ a bundle with no bytes for bodyIdle refuses body-timeout long before its deadline (655.439203ms)
+✔ send: a close once the loop is past its last chunk is served, and a failed write there is fetch-aborted (24.240543ms)
+✔ letGo waits for an answer to leave for at most its cap, then destroys the socket (302.111981ms)
+✔ a record that fails and can't be undone refuses rollback-failed, which the host logs (525.483596ms)
+✔ the host boots the broker, binds a launch in process, and the notifier DMs a blocking decision exactly once (1013.513796ms)
+✔ a notifier that dies takes the host down with exit 1, so the unit restarts the pair (283.564387ms)
+✔ a second host for the same data root refuses with exit 3 while the first runs (177.812825ms)
+✔ two bus starts racing for one data root leave one host running; the other refuses that a host already runs (617.744777ms)
+✔ a host takes over a host.lock its dead host left, and puts back a live claim that replaced it meanwhile (1.793838ms)
+✔ a host.lock that goes between the check and the read is tried again; one that can't be parsed still refuses as unreadable (0.740797ms)
+✔ a live host's lock stays, however old the file is (0.705384ms)
+✔ a host.lock left by a host killed with SIGKILL doesn't stop the next bus start (866.540778ms)
+✔ while a host boots, a reader sees no host: the human commands still ask for --business, stop and status find none (215.460653ms)
+✔ a host started before host.lock existed, holding only host.json, still refuses a second start, which leaves no lock (27.302307ms)
+✔ a broker fork that throws leaves no host.lock and no host.json (32.974379ms)
+✔ a broker send that throws leaves no host.lock and no host.json (40.669012ms)
+✔ a broker that misses its boot wait leaves no host.lock and no host.json (59.741972ms)
+✔ a notifier fork that throws stops the broker and leaves no host.lock and no host.json (1213.488394ms)
+✔ a notifier send that throws stops the broker and leaves no host.lock and no host.json (339.97686ms)
+✔ a boot reply with no reader for the business refuses with exit 3 naming it, before the notifier starts, and leaves no host.lock and no live broker (180.579209ms)
+✔ a boot reply with no reader for the business refuses with exit 3 naming it, with no notifier, and leaves no host.lock and no live broker (173.477167ms)
+✔ a host.json that can't be written stops both children and leaves no host.lock (267.402852ms)
+✔ an error event on the broker before it replies fails the start at once, and leaves no host.lock and no live child (30.312888ms)
+✔ an error event on the notifier before it replies fails the start at once, and leaves no host.lock and no live child (159.465278ms)
+✔ an error event on the broker while the notifier starts fails the start once the notifier replies (570.414518ms)
+✔ an error event on the broker once the host is up stops the host with exit 1, and leaves no host.lock and no host.json (331.426008ms)
+✔ an error event on the notifier once the host is up stops the host with exit 1, and leaves no host.lock and no host.json (345.408391ms)
+✔ a broker reply that misses the wait breaks the channel: the late reply answers nothing, later requests refuse, the host exits 1 (1252.07798ms)
+✔ a broker reply with another request's id, or none, breaks the channel and the host exits 1 (567.294067ms)
+✔ a broker reply with no request waiting breaks the channel and the host exits 1 (214.996865ms)
+✔ a notifier that refuses stops the broker and the host refuses with exit 3 (228.401462ms)
+✔ a notifier that refuses after the broker died still refuses with exit 3, without a send to the dead broker (213.803455ms)
+✔ a notifier that dies before it replies, after the broker died, still refuses, without a send to the dead broker (170.728122ms)
+✔ a close send that fails with EPIPE after the notifier refuses still gives the notifier's refusal, exit 3 (285.474081ms)
+✔ a close send that fails with EPIPE after the notifier dies unanswered still gives the notifier's error (208.185337ms)
+✔ close() whose stop and close sends fail with EPIPE still finishes, with exit 1 (237.487827ms)
+✔ watchChildren reports a child that died before it was called, and one that dies later (20.971723ms)
+✔ bus stop refuses to signal a live pid that is not a bus host (203.131032ms)
+✔ bus start refuses with exit 3 and the code when the broker refuses to boot; bus status names the lock (255.842247ms)
+✔ bus start refuses with exit 3 without a notifier config (98.926778ms)
+✔ bus start runs until bus stop; status reports it while it runs (764.508436ms)
+✔ bus-service.sh renders the unit and installs it into a given directory (66.793652ms)
+✔ bus-service.sh pins the claude binary, refuses one the unit can't carry, and renders without one (84.021069ms)
+✔ bus-service.sh refuses a directory pin and keeps a symlink default unresolved (16.550974ms)
+✔ bus-service.sh refuses a default claude without the execute bit, or in a PATH dir with a space (10.126546ms)
+✔ each launch rereads limits and model selections; lowered limits keep sessions and log exact hit (60.91717ms)
+✔ bus start --pm: the launcher instance (the chief of staff) runs under its own PID namespace, registered, with a manifest (1428.469106ms)
+✔ the chief of staff launches a coder through its launch tool; the coder answers; refusals name their code (794.18891ms)
+✔ each launch makes sure the workspace has a clone of the project: cloned, fast-forwarded, or fetched and logged (2278.958059ms)
+✔ a project clone that can't be made refuses checkout-failed, from --chief and from a session, with no run and no clone left (398.86547ms)
+✔ a runner that stops at once ends its launch with the runner's reason (351.696168ms)
+✔ a Claude Code launch with no session credential refuses before it starts (187.916924ms)
+✔ a pi launch needs no session credential: pi logs in through its own ENV_ALLOW variables (335.877494ms)
+✔ a runner killed from the host ends its launch as killed, not failed (586.325781ms)
+✔ a missing or failing bwrap refuses sandbox-unavailable before anything starts; there is no unconfined fallback (219.970212ms)
+✔ a real Claude Code coder's shell can't read a stand-in secret or anything else its sandbox doesn't hold (2040.185735ms)
+✔ a host that died hard leaves its sessions to the next host, which kills them and ends their runs so the role can be launched again (898.160099ms)
+✔ a host that died hard leaves its sessions to the next host, which finds one already exited (23) and ends their runs so the role can be launched again (4010.015646ms)
+✔ a malformed sessions.json refuses the host start with exit 3 and stays as it was (179.001442ms)
+✔ an over-long launch request is refused at once, not at the 10 s idle timeout (189.407074ms)
+✔ a launch client that never closes its side doesn't hold the host's close (197.147112ms)
+✔ a runner that ignores SIGTERM is killed when the host closes (1318.481624ms)
+✔ claudeVersion asks MOSAIC_CLAUDE_BIN when set, else claude on PATH (4.567472ms)
+✔ migration needs no bus/config, prints whole converted document, is idempotent and never writes (26.931657ms)
+✔ limits view/set use the human bus transport and pass only the explicit patch (2.3868ms)
+✔ post-119 example and Jason fixture migrate with checked inherited models; wrong or absent config refuses (275.588211ms)
+✔ zoned uses the IANA zone across DST (32.99622ms)
+✔ each open blocking decision is DM'd once, across polls and a restart; non-blocking ones are not (159.679215ms)
+✔ two blocking decisions get two DMs with different nonces (131.77488ms)
+✔ the digest nonce differs per business and per day and fits Discord's 25 characters (0.332908ms)
+✔ a failed DM is journaled, backs off, and is retried until it lands (119.989004ms)
+✔ five definite refusals stop a DM: one gave-up line, one log line, and a restart keeps the count (127.146912ms)
+✔ 429s, 5xx-style unknowns and refusals without a status never count toward the limit (170.288431ms)
+✔ a crash between the fifth refusal and its gave-up line: the next poll appends it and sends nothing (109.865071ms)
+✔ polled every POLL_MS against a permanent 403, a DM is sent at 0, 30, 60, 90 and 120 min and gives up only then (193.901685ms)
+✔ a restart after the second refusal does not send before that refusal's 30 min are up (213.261648ms)
+✔ the digest goes at 08:00 Chicago once a day, with blocking ones marked as DM'd (124.449812ms)
+✔ a late start with no digest for the day sends one at once; an empty inbox gets one line (97.210052ms)
+✔ an inbox read failure is logged and the next poll retries (0.856695ms)
+✔ no Discord id reaches the journal or the log (162.591368ms)
+✔ the journal: a torn tail is copied out and truncated, so an append after it reopens cleanly (31.642519ms)
+✔ the journal: a crash between the copy and the truncate leaves a tail the next open repairs (56.267623ms)
+✔ the journal: a whole file that is one torn line truncates to empty (20.134337ms)
+✔ the journal: a malformed complete line refuses and leaves the file and any torn tail alone (2.704899ms)
+✔ the journal: a loose file mode, a loose directory or a symlinked journal refuses (0.679703ms)
+✔ the journal: a line with a wrong type refuses with exit 3 and names the field (2.007022ms)
+✔ the journal: a symlinked directory refuses and says it is a link (0.347432ms)
+✔ the journal: a dangling directory link, a parent that is a file and a journal that is a directory each refuse with exit 3 (2.067159ms)
+✔ the journal: an append after the file was swapped for a symlink refuses and writes nothing through it (0.394204ms)
+✔ the journal: a directory it cannot write or create refuses with exit 3 and names the path (0.46105ms)
+✔ digest content stays within Discord's 2000 characters (0.270596ms)
+✔ runLoop never overlaps ticks and stops after the one in flight (111.40169ms)
+✔ a human command refused with human-required prints the other-tree line and exits 3 (3.698049ms)
+✔ a --tester command refused with tester-required prints the other-tree line and exits 3 (1.654651ms)
+✔ other exit-3 refusals print no other-tree line (2.575942ms)
+✔ the line names no path (0.165258ms)
+✔ shared copy: npm ci, pushed reachability, readonly/existing copy, webui delegation (604.287445ms)
+✔ wrapper preserves Q81 lease and marker, rejects foreign/symlink; check uses effective roots (443.752145ms)
+✔ bus unit copy/pm pins, install refuses all busy states and failed reads, drop-in refusal (523.571306ms)
+✔ missing package manifest refuses before npm; npm failure removes the unpublished temp copy (294.946378ms)
+✔ real pinned install loads bus and Console; same-copy mosaic talk passes proof, other trees refuse (4477.201791ms)
+✔ bus status reads effective copy/pm/drop-ins without writes; check refuses an overridden ExecStart (542.174253ms)
+✔ drop-ins in either override field and malformed metadata refuse; uninstall also checks --no-reload (235.05386ms)
+✔ install never shows a template name on systemd 261; template drop-ins still refuse (193.442538ms)
+✔ unlisted instance drop-in is found in another unit lookup directory; path discovery errors refuse (451.468149ms)
+✔ inherited mosaic-.service.d override refuses without changing the unit (258.832877ms)
+✔ inherited service.d override refuses without changing the unit (275.045497ms)
+✔ inherited drop-in unreadable directory or file refuses before writing (232.395592ms)
+✔ talk --tester sends a [mos test] message as tester from inside an agent and prints the role's reply (164.621306ms)
+✔ talk --tester refuses text without the [mos test] prefix before any call (109.71625ms)
+✔ the read verbs take --tester inside an agent, and the trail shows the tester as the sender (121.317615ms)
+✔ decide, stop and launches take no --tester (165.193977ms)
+✔ the tester transport runs tester-cli.mjs, and the tester's refusals exit 3 (0.352605ms)
+✔ with no stand-in transport, --tester runs tester-cli.mjs on the data root's socket (0.547635ms)
+✔ REQ-THREAD-2 REQ-LAUNCH-1 REQ-MSG-1 a thread message starts the thread's session, which stops when idle; its history survives the stop and a restart and no other thread sees it (7255.423897ms)
+✔ REQ-THREAD-2 REQ-LAUNCH-1 a running thread counts against its model's limit and an idle-stopped one doesn't (2091.676998ms)
+✔ REQ-THREAD-2 REQ-LAUNCH-1 a turn longer than the idle time isn't stopped, and the thread idles out after it (4519.60608ms)
+✔ REQ-THREAD-2 REQ-LAUNCH-1 a message sent after the idle snapshot keeps the session, which answers it (2836.124129ms)
+✔ REQ-ROLE-2 REQ-LAUNCH-1 a thread held by a run the launcher didn't start gets no second session (110.17538ms)
+✔ REQ-LAUNCH-1 a run that ends without taking its thread's message isn't started again for that message (237.171339ms)
+✔ REQ-THREAD-2 REQ-LAUNCH-1 a thread id that isn't a safe segment, or a thread of a non-thread instance, launches nothing (264.850665ms)
+✔ REQ-THREAD-1 REQ-LAUNCH-1 the chief can't launch the assistant outside a thread (312.949745ms)
+task.close {} answered: invalid-request; fake saw 18 requests, first GET /info 200, GET /projects/1 200, GET /projects/1/views 200
+task.close on a missing task answered: task-not-found; it made GET /tasks/999 404
+✔ bootConfig trackers reach the S3 adapter in the real broker child, which goes ready against a fake Vikunja (455.778622ms)
+✔ the transport writes {business, verb, args} to the child and reads its JSON (56.157382ms)
+✔ a bus code on stderr becomes the exit code; garbage and timeouts are outcome problems (2185.629382ms)
+✔ busExit and refuseInsideAgent (0.468478ms)
+✔ talk sends a REQUEST, prints and reads everything that arrives, and stops at the reply (230.558361ms)
+✔ talk --wait 0 only sends; no reply within --wait exits 1 and says where it will show (1193.437123ms)
+✔ a late reply the Console has listed still reaches the next talk (2212.30265ms)
+✔ talk, stop and launches off/on refuse inside an agent run; bad arguments are usage errors (747.851325ms)
+✔ launches off and on go to the broker and change the business's launch state (280.55988ms)
+✔ launches list reads sessions.json and marks a stale entry; stop reports it and refuses a non-runner (113.677483ms)
+ℹ tests 203
+ℹ suites 0
+ℹ pass 203
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 22170.275012

agents/dewey/work/queue-136/gate/pkg-harness.log

@@ -0,0 +1,98 @@
+✔ sessionModel: agent vars win, then the system's execution settings (15.515147ms)
+✔ a pi bundle: prompt, policy, tools and manifest, 0600 in a 0700 directory (6.201336ms)
+✔ a chief-of-staff bundle lists launch among the bus tools and the manifest's typed tools (2.911536ms)
+✔ a chief-of-staff bundle lists end_run and change_organization as typed and nothing untyped, for either harness (5.248128ms)
+✔ the stop line names end_run for a role.end holder, and every other role keeps today's text (7.615753ms)
+✔ a claude-code bundle adds the wrapped gate hook and the MCP config (1.890228ms)
+✔ the prompt's built-in tools line is the harness's own names, as the manifest lists them (8.501985ms)
+✔ the prompt names the project clones in the workspace, and none when there are none (8.223372ms)
+✔ the prompt explains the review loop to a role with push_working, and reviews to one with fetch_review (7.619348ms)
+✔ a bundle is written once: an existing file refuses (1.529205ms)
+✔ a path with a single quote can't go into the hook command (1.678155ms)
+✔ allow exits 0, a deny exits 2 with the reason on stderr (120.489379ms)
+✔ a missing or wrong policy, or a bad event, exits 2 (85.304262ms)
+✔ the bundle's wrapped command: a missing gate or node still blocks (1100.922739ms)
+✔ claude: typed tools through MCP, the hook blocks, builtins outside --tools don't exist (802.883805ms)
+✔ claude: the hook alone blocks a path outside the workspace (649.468645ms)
+✔ claude: a second turn resumes the first turn's session (757.38111ms)
+✔ claude adapter: --restricted is always passed (5.610295ms)
+✔ claude adapter: MOSAIC_CLAUDE_BIN wins over PATH and must be an absolute executable (17.1785ms)
+✔ claude adapter: a directory pin exits 2 before it runs; a pin with a space runs (6.283462ms)
+✔ claude: CLAUDE.md files and auto-memory don't reach the model; without --restricted they do (766.440538ms)
+✔ claude: a missing hook or MCP file refuses before claude starts (7.213381ms)
+✔ pi: policy tools and typed tools pass, anything else is blocked (3.208239ms)
+✔ claude: builtins map from pi names, typed tools need the mcp prefix (0.89184ms)
+✔ file tool paths must resolve inside the workspace (1.439077ms)
+✔ pi's own path normalisation can't be used to step out (1.3301ms)
+✔ a symlink inside the workspace that points out is outside (0.880861ms)
+✔ a dangling symlink is refused at any depth, in both harnesses (3.166512ms)
+✔ read is checked under every spelling pi's read would open, in both harnesses (20.690253ms)
+✔ other spellings cover directories, dangling links and pi's cwd (1.553123ms)
+✔ a relative path climbs from the workspace's real path, in both harnesses (4.288371ms)
+✔ claude path fields per tool (1.083437ms)
+✔ glob patterns stay inside the workspace (0.904548ms)
+✔ a path that can't be checked is blocked (0.498108ms)
+✔ fetch_review's have lists the working refs before origin's, and no more than HAVE_MAX (215.8767ms)
+✔ fetch_review's have orders the working refs newest first within each clone, one clone after another (127.018481ms)
+✔ a runner git past its time: SIGTERM reaches its process group, and SIGKILL follows after the grace period (1808.978082ms)
+✔ once a signalled runner git has closed, its group gets SIGKILL, so a process that ignored SIGTERM dies too (302.769081ms)
+✔ initialize, ping and tools/list (47.523611ms)
+✔ tools/call goes through the tool socket; a refusal is an isError result (33.482533ms)
+✔ replies are compact JSON; over the cap a tool error names the size and the cap (40.437924ms)
+✔ unknown tools and methods are JSON-RPC errors and never reach the socket (32.416203ms)
+✔ a missing argument is a usage error (27.895304ms)
+✔ pi: typed tools reach the socket, the gate blocks, agent_end writes the marker (380.120314ms)
+✔ pi: a reply over the cap is a tool error naming the size and the cap; list_tasks asks for open tasks (337.665158ms)
+✔ pi: a write through a dangling symlink is blocked, and nothing appears outside (379.997468ms)
+✔ pi: a read is refused when pi would open another spelling outside (347.568034ms)
+✔ pi: a relative path climbs from the real path of a workspace behind a symlink (322.588976ms)
+✔ pi: a relative path climbs from the real path of a dataRoot behind a symlink (308.375878ms)
+✔ pi: a missing extension refuses before any model call (6.446982ms)
+✔ pi: an extension without its configuration fails pi's start (262.269883ms)
+✔ founderCheck: founder variables, then a needed service without a usable token (1.816739ms)
+✔ turnRequest names the sender, class, reply and decision (0.287232ms)
+✔ turnRequest says a tester's message is a test and never Jason's instruction (0.320856ms)
+✔ turnRequest shows the message's own sent time, a day old as well as new (0.209873ms)
+✔ stateBlock names the launch state with its time and event, and the open tasks with the cap (0.347932ms)
+✔ a message becomes a turn, the answer goes back as a RESULT, SIGTERM releases and exits 0 (253.181808ms)
+✔ launches revoked and then restored: the turn's block reads allowed and gives the restore time (279.742435ms)
+✔ a task closed on the tracker is missing from the next turn's open list (345.996312ms)
+✔ a message read a day after it was sent shows the time it was sent (433.963628ms)
+✔ a decision the human resolves becomes a turn citing the decision and the answer (353.090433ms)
+✔ a failed state read fails the turn: no adapter runs, the sender hears why, the message is read (171.032879ms)
+✔ a SIGTERM before the claim stops the runner with exit 0 and no claim (262.823604ms)
+✔ typed tools carry the runner's capability; launch goes to the host's launch socket (509.397976ms)
+✔ end_run and change_organization reach the broker with the tool's arguments, and refusals keep their codes (433.3064ms)
+✔ a RESULT gets no automatic reply; failed turns reply with the reason (1317.830395ms)
+✔ SIGTERM during a turn kills the turn's process group and still exits 0 (182.814915ms)
+✔ founder credentials stop before the claim (20) (189.487124ms)
+✔ a refused claim exits 21; an ended run's capability exits 22 (206.148366ms)
+✔ the launch ending under a running session exits 22 (149.306141ms)
+✔ a broker that stays unreachable exits 23 after brokerRetries polls (242.011752ms)
+✔ a broker that is down at the claim exits 23, not 21 (97.332188ms)
+✔ no capability, or a malformed one, on stdin exits 2 (193.512188ms)
+✔ a missing or malformed policy exits 2 before the claim (139.000549ms)
+✔ the PM gets its task verbs and the reads, and no launch (8.998988ms)
+✔ the chief of staff gets launch, send_message, end_run and change_organization, and no task verbs (2.307529ms)
+✔ end_run sends role and reason, no decision; change_organization sends revision and the organization keys (3.440078ms)
+✔ the organization keys change_organization takes are the broker's ORGANIZATION_KEYS (0.172735ms)
+✔ a role without role.end or organization.change gets neither tool, and each tool follows its own grant (10.173474ms)
+✔ the assistant gets send_message and the reads, no launch (1.513616ms)
+✔ list_requirements reads the requirement ids, for a task.create holder with a tracker (2.163591ms)
+✔ a coder gets no launch, no resolve_decision, and no task tools without a tracker (1.205815ms)
+✔ a coder with a tracker gets its own task tools and no task_reassign (1.028947ms)
+✔ launch only when the business's launch block names the instance as launcher (2.062812ms)
+✔ an action outside the instance's authority has no tool (1.051455ms)
+✔ the review loop: push_working and request_review for the coder, fetch_review and review_verdict for the reviewer, none for the PM (4.080806ms)
+✔ callTool: one JSON line out, the result back, a refusal rejects (10.089535ms)
+✔ list_tasks takes the broker's filters and pages; get_task takes a task_ref (2.264225ms)
+✔ callTool sends list_tasks done false unless the session names done; other tools as given (2.346751ms)
+✔ replyText: compact JSON up to the cap, an error naming the size and the cap over it (0.562529ms)
+ℹ tests 90
+ℹ suites 0
+ℹ pass 90
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 12654.978691

agents/dewey/work/queue-136/gate/pkg-plugins.log

@@ -0,0 +1,29 @@
+✔ REQ-PLUG-1 REQ-LIMIT-4 the registry: usage-source and limit-check at interface version 1, each a list (0.940763ms)
+✔ REQ-PLUG-1 checkPlugins accepts one key per kind, each a list of names, empty included (0.253334ms)
+✔ REQ-PLUG-1 checkPlugins refuses bad shapes, unknown kinds, bad names and duplicates (3.843873ms)
+✔ REQ-PLUG-1 a kind that switches on one module takes one name, not a list (0.151079ms)
+✔ REQ-PLUG-1 checkPlugins reports through the caller's fail callback (0.134195ms)
+✔ REQ-PLUG-1 fixture modules of each kind switch on from a test organization file, no core file changed (7.531175ms)
+✔ REQ-PLUG-1 a name not matching ^[a-z][a-z0-9-]*$ refuses and keeps the old setting (3.479907ms)
+✔ REQ-PLUG-1 a missing module directory or index.mjs refuses and keeps the old setting (3.375056ms)
+✔ REQ-PLUG-1 a symlinked module directory or index.mjs refuses and keeps the old setting (2.423586ms)
+✔ REQ-PLUG-1 a symlinked kind directory refuses and keeps the old setting (2.067919ms)
+✔ REQ-PLUG-1 a symlinked packages/plugins refuses (run with --preserve-symlinks so the path keeps it) (28.523446ms)
+✔ REQ-PLUG-1 index.mjs swapped for a symlink after the lstat checks refuses at the realpath check (2.661863ms)
+✔ REQ-PLUG-1 a path that can't be read refuses as unreadable, is logged and keeps the old setting (2.21331ms)
+✔ REQ-PLUG-1 a path that becomes unreadable after the lstat checks refuses at either realpath (2.429097ms)
+✔ REQ-PLUG-1 a module that fails to load refuses and keeps the old setting (2.989141ms)
+✔ REQ-PLUG-1 a missing export refuses and keeps the old setting (3.268399ms)
+✔ REQ-PLUG-1 a different interface version refuses and keeps the old setting (2.383835ms)
+✔ REQ-PLUG-1 a kind refused on its first load has nothing switched on, and the log names kind and name (1.668534ms)
+✔ REQ-PLUG-1 the setting's shape: unknown kinds refuse alone, a bad whole setting keeps everything (2.894992ms)
+✔ REQ-PLUG-1 loads run one at a time, so the last requested setting wins (103.159336ms)
+✔ REQ-PLUG-1 the loader needs a log callback (1.08774ms)
+ℹ tests 21
+ℹ suites 0
+ℹ pass 21
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 219.030339

agents/dewey/work/queue-136/gate/pkg-seat.log

@@ -0,0 +1,148 @@
+✔ a first launch clones the root at its branch, with the root's path as origin (41.017258ms)
+✔ the clone is not at its place until git clone has finished (22.231067ms)
+✔ a later launch fast-forwards a clean clone after a commit to the root, then finds it current (64.49775ms)
+✔ a clone ahead of the root keeps its commits and counts as current (41.516828ms)
+▶ a dirty clone and one on another branch are fetched, and nothing but refs/remotes moves
+  ✔ a modified file (46.50362ms)
+  ✔ an untracked file (53.068417ms)
+  ✔ a staged file (56.564493ms)
+  ✔ another branch (51.862587ms)
+  ✔ a detached HEAD (49.413296ms)
+✔ a dirty clone and one on another branch are fetched, and nothing but refs/remotes moves (258.58827ms)
+✔ a diverged clone gets the fetch into refs/remotes and is kept, not-fast-forward (47.337553ms)
+▶ a clone kept before the branch check, or for a failed status, gets no fetch
+  ✔ not-a-clone (25.412779ms)
+  ✔ hooks-present (27.910528ms)
+  ✔ submodule (32.577796ms)
+  ✔ config-changed (29.129616ms)
+  ✔ root-unreadable (30.782694ms)
+  ✔ root-detached (34.647494ms)
+  ✔ status-failed, on the root's branch and clean (35.359779ms)
+  ✔ status-failed, dirty (38.644971ms)
+✔ a clone kept before the branch check, or for a failed status, gets no fetch (255.827321ms)
+✔ a dirty clone whose fetch fails is kept, fetch-failed, exactly as it was (45.867989ms)
+✔ every git call the host makes, for a new clone and an existing one, carries maintenance.auto=false and gc.auto=0 (44.66646ms)
+✔ a clone with loose objects enough for gc --auto gets no maintenance or gc from the fetch and the merge (75.245821ms)
+▶ a clone with user.name or user.email in its config is kept, and git runs nothing in it
+  ✔ user.name (27.934617ms)
+  ✔ user.email (27.40496ms)
+✔ a clone with user.name or user.email in its config is kept, and git runs nothing in it (55.856227ms)
+✔ a commit git can't read after the fast-forward is null (48.112305ms)
+✔ a new clone whose commit can't be read refuses the launch and leaves nothing behind (21.95256ms)
+▶ a clone the session rigged is kept, and git runs nothing and writes nothing outside it
+  ✔ core.fsmonitor (36.654414ms)
+  ✔ core.hooksPath (37.032913ms)
+  ✔ a hook file (33.688632ms)
+  ✔ include.path (31.678653ms)
+  ✔ includeIf (32.483318ms)
+  ✔ a filter driver (33.036272ms)
+  ✔ origin moved (36.767738ms)
+  ✔ a second origin url (35.54038ms)
+  ✔ the origin url twice, both the root (33.166911ms)
+  ✔ an ext:: origin (33.444417ms)
+  ✔ a branch tracking another remote (32.309438ms)
+  ✔ a branch merging a tag (33.877766ms)
+  ✔ a fetch line onto local branches (33.423529ms)
+  ✔ no origin (34.016411ms)
+  ✔ a config file over the size cap (33.355922ms)
+  ✔ config a symlink to /dev/zero (36.002042ms)
+  ✔ the clone a symlink to the bait (30.709654ms)
+  ✔ the clone a file (29.916729ms)
+  ✔ the clone a plain directory (31.095688ms)
+  ✔ .git a gitdir: file (33.380948ms)
+  ✔ .git a symlink (32.844798ms)
+  ✔ .git/logs a symlink (34.762091ms)
+  ✔ .git/refs/heads a symlink (32.14184ms)
+  ✔ .git/objects a symlink (31.772532ms)
+  ✔ a reflog hard-linked to a file outside (34.948186ms)
+  ✔ HEAD a fifo (35.922143ms)
+  ✔ a commondir file (33.478628ms)
+  ✔ an alternates file (37.03031ms)
+  ✔ a gitlink staged, no .gitmodules (61.503652ms)
+  ✔ a gitlink and .gitmodules staged (46.961656ms)
+  ✔ a gitlink to a repository with its own gitlink (51.551845ms)
+  ✔ a gitlink and .gitmodules committed (46.97183ms)
+  ✔ a gitlink and submodule.active in config (46.082695ms)
+  ✔ a .git/modules with no gitlink (37.966651ms)
+✔ a clone the session rigged is kept, and git runs nothing and writes nothing outside it (1239.959685ms)
+▶ a root that can't be cloned refuses with the project id and leaves nothing behind
+  ✔ missing (10.221691ms)
+  ✔ not a repository (9.833975ms)
+  ✔ a plain directory inside another repository (14.786546ms)
+  ✔ unreadable (9.960428ms)
+  ✔ on no branch (12.147238ms)
+  ✔ missing an object (16.72792ms)
+✔ a root that can't be cloned refuses with the project id and leaves nothing behind (74.512844ms)
+✔ a clone whose root is on no branch, or gone, is kept and named (29.959776ms)
+✔ no credential or forge remote of the root reaches a clone (49.671549ms)
+✔ every project in the business file gets its own clone at its own branch (35.262889ms)
+✔ a clone past its time gets SIGTERM and refuses the launch, with nothing left in the workspace (513.504787ms)
+✔ a clone that ignores SIGTERM gets SIGKILL once the grace period is over (1016.936333ms)
+✔ a timeout signals git's process group, so a process git started dies with it (516.155072ms)
+✔ once a signalled git has closed, its group gets SIGKILL, so a process that ignored SIGTERM dies too (516.386559ms)
+✔ RUNNER_FILES is exactly what the runner and the harness sources it starts import (2.340283ms)
+✔ sandboxProblem names a missing bwrap and a bwrap that fails (9.129757ms)
+✔ every bind says why; the bundle and session file stay read-only over the run directory (1.272462ms)
+✔ REQ-THREAD-2 a thread store binds its session directory and Claude transcripts, and nothing more (0.776042ms)
+✔ the host's git socket is bound only when given, read-only and before the writable binds (0.641492ms)
+✔ the git identity is the instance's, at <instance>@<business>.mosaic.invalid, and sandboxArgv refuses without it (1.023058ms)
+✔ a confined session's shell reaches its own workspace and run directory and nothing of the founder's or another session's (1766.224706ms)
+✔ a bind that exposes a stand-in, or a missing workspace bind, fails the matching check (2549.324762ms)
+✔ a confined session that runs tester-cli.mjs is refused as tester, and the same shim outside the sandbox binds (286.574672ms)
+✔ resolveSeat: by name under --repo resolves the repo layout (1.214851ms)
+✔ resolveSeat: by path resolves the fleet layout (0.318277ms)
+✔ resolveSeat: refusals for missing dir, missing launch.sh, non-executable launch.sh, invalid name, and unknown layout (0.697995ms)
+✔ tmuxContext: outside tmux, default socket, custom socket, and exec failure (0.639318ms)
+✔ makeRegistration produces a record that validates; each shape violation throws SeatError (0.787492ms)
+✔ writeRegistration/readRegistration: round trip, permissions, absence, and malformed records (1.245396ms)
+✔ updateTask: changes task, taskSetBy and updatedAt only, and refuses appropriately (1.105856ms)
+✔ CLI launch: registers, execs the fake launch script, and passes args through (28.063664ms)
+✔ CLI launch: --harness lands in the record (27.542436ms)
+✔ CLI launch: the launch script's own exit code passes through (28.657836ms)
+✔ CLI launch: relaunching a seat rewrites the one registration record (54.359824ms)
+✔ CLI launch: omitting --task records an empty string, not null (28.494242ms)
+✔ CLI seat task: updates only the task after a launch, and refuses on an unlaunched seat (83.801211ms)
+✔ CLI refusals: no args, unknown flag, missing config, already-registered env, and exec failure (148.107008ms)
+✔ samePath: equal paths, symlinked dirs, distinct dirs, and non-strings (0.433086ms)
+✔ resolveSetBy: explicit --by wins over the environment; absent or empty environment gives unknown; invalid explicit or environment values refuse with exit 4 (0.649384ms)
+✔ validateRegistration/readRegistration: taskSetBy is optional; a record without it (written before #1511) still loads unchanged; an invalid one is refused; the version does not change (0.742117ms)
+✔ updateTask: records setBy, preserves startedAt and every unrelated field, upgrades an old record in place only when the task is set, and replaces a previous attribution (0.876022ms)
+✔ CLI seat task: --by beats MOSAIC_AGENT_NAME, the environment beats nothing, empty environment is unknown, invalid --by or environment refuses with exit 4 and leaves the record byte for byte (261.032398ms)
+✔ REQ-LIMIT-1: family substring matching is no longer exported (0.771225ms)
+✔ sessionEnv passes only the allowlist, the repo's bin on PATH, and the run id (0.674137ms)
+✔ sessionExit gives a runner's signal death back as the signal; a session credential is one whole set of nonempty variables (0.243921ms)
+✔ newRun: short ids, 0700 directories, and a refusal when the socket path won't fit (1.529992ms)
+✔ session file and launch log: 0600, the session file written once (1.012902ms)
+✔ endReason maps the runner's exit codes; a signal is killed (0.133749ms)
+✔ Registry mirrors to sessions.json; readSessions marks live entries; bad files refuse (1.193584ms)
+✔ REQ-THREAD-1 Registry.running keys a thread run by business, instance and thread (0.576982ms)
+✔ REQ-THREAD-2 REQ-LAUNCH-1 threadStore checks both segments before the join and refuses an unsafe directory (1.378242ms)
+✔ stopSession refuses an unknown run, reports a stale one, and won't signal a pid that isn't a runner (1.459543ms)
+✔ a session runs in its sandbox as pid 1 of its namespace, claims, answers, and stops on mosaic stop (355.791668ms)
+✔ workRef and validBranch take only what a ref name can hold (1.080408ms)
+✔ a push lands as the task's work ref, a fast-forward lands after it, and main is the root's (148.507706ms)
+✔ a rewritten branch refuses non-fast-forward and the work ref stays (129.378891ms)
+✔ a branch with no history in common with main refuses unrelated-history (84.561967ms)
+✔ a bundle that needs commits the working repository lacks refuses missing-prerequisite (42.47898ms)
+✔ main is fetched from the root again before each push, so a clone of a newer root pushes (148.710467ms)
+✔ a root moved back after the clone leaves the push's base unknown: missing-prerequisite (95.997158ms)
+✔ a commit with a broken object refuses invalid-bundle, and only because fsck is on (87.233732ms)
+✔ only a v2 bundle with the named branch is read (44.126269ms)
+✔ a branch named main, or named for another task, moves only this task's work ref (100.538877ms)
+✔ a record that throws moves the work ref back, or removes a new one (141.435462ms)
+✔ a work ref that can't go back refuses rollback-failed, naming the ref and the commit (412.996816ms)
+✔ a root that can't be read refuses root-unreadable (27.9364ms)
+✔ a git past its time gets SIGTERM, leaves no ref lock, and the next push lands (2161.232629ms)
+✔ a git that ignores SIGTERM gets SIGKILL once the grace period is over (1028.855752ms)
+✔ a working repository path that isn't a directory refuses (23.699991ms)
+✔ review bundles a pushed commit as refs/mosaic/review, leaving out what the reviewer has (110.728895ms)
+✔ review of a project with no working repository refuses unknown-commit (12.524197ms)
+✔ the runner's git tools hold the host's limits and branch rule (1.214061ms)
+ℹ tests 135
+ℹ suites 0
+ℹ pass 135
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 5070.773625

agents/dewey/work/queue-136/gate/pkg-tasks.log

@@ -0,0 +1,105 @@
+✔ the boot config is checked before anything starts (87.940602ms)
+✔ a business with no tracker entry refuses task verbs (128.52315ms)
+✔ credential.expiring and .expired are recorded once per instance (220.349678ms)
+✔ a token file that changes on disk records credential.changed (111.714628ms)
+✔ autostart polls, reconciles and retries a startup the tracker was down for (120.349935ms)
+✔ a refusal a restart must clear is not retried by the poll (101.062524ms)
+✔ a poll that fires while two are queued is dropped (95.676971ms)
+✔ close waits for a running verb and refuses one that has not started (209.161073ms)
+✔ stopped bus resumes an empty task cursor after a long outage, exactly once (167.937432ms)
+✔ persisted IDs avoid replay, exclude bots and bound rows to observed new comments (210.876981ms)
+✔ commit followed by crash before cache advance neither loses nor duplicates a comment (146.530385ms)
+✔ failed event insert rolls back cursor and a retry still emits the comment once (131.897211ms)
+✔ initial cursor accepts a comment within the stated one-minute clock skew margin (118.446482ms)
+✔ the bundled Vikunja is the pinned upstream image the runbook names (1.263004ms)
+✔ every published port is on 127.0.0.1, and no secret is in the file (0.454788ms)
+✔ the committed table loads frozen; its verbs are the broker task verbs (1.59569ms)
+✔ a write names a verb the table has as its own key, not one it inherits (0.582513ms)
+✔ the schema refuses any other shape (2.197667ms)
+✔ the Field table in the slice 1 plan names the verbs each field is written by (0.630934ms)
+✔ each verb refuses, asks for a decision and writes as the table and the role files say (1158.885621ms)
+✔ the list holds the PRD's requirement ids, in its order, at its version (2.106249ms)
+✔ the committed list loads frozen (2.192912ms)
+✔ the schema refuses any other shape (4.46215ms)
+✔ the fake answers each route with the statuses and shapes Vikunja v2.7.0 sent (356.60433ms)
+✔ the project list holds recorded project objects in the recorded list envelope (90.692536ms)
+✔ the recorded task bodies pass the checks S3 applies to every read (0.474294ms)
+✔ the client works against the fake over real HTTP with the platform fetch (242.214752ms)
+✔ a correct install starts, and the first reconcile records tasks that already exist (128.402937ms)
+✔ verbs refuse while a business is starting and after startup refused it (139.321453ms)
+✔ startup refuses a token that can do more than its role needs (383.963572ms)
+✔ startup refuses an unsupported version and flags an untested one (269.688301ms)
+✔ startup refuses a board that the runbook did not install (343.709919ms)
+✔ startup refuses a project the sync bot cannot read (83.852197ms)
+✔ startup refuses a configured label the pm bot cannot see (88.163613ms)
+✔ startup refuses an expired credential and a missing sync credential (164.956808ms)
+✔ an unreachable tracker refuses with tracker-unavailable (89.859531ms)
+✔ an edit in the UI is recorded once, with the fields that changed (206.558208ms)
+✔ a move between open buckets is seen on the board, though updated does not change (186.078556ms)
+✔ a person's comment is counted and a bot's is not (269.236201ms)
+✔ the hourly reconcile catches a comment through comment_count (211.659868ms)
+✔ a task closed in the UI leaves the open view with its done bucket (358.858641ms)
+✔ a task that leaves the board is recorded as deleted, moved or out of reach (248.566577ms)
+✔ a poll that read before a verb wrote does not overwrite the verb (157.029651ms)
+✔ a tracker fault during a tick is reported and the next tick catches up (156.620769ms)
+✔ a malformed answer refuses the tick with tracker-shape (129.835765ms)
+✔ no token value reaches the database, the log or a refusal (272.573359ms)
+✔ the first look at a task counts only comments inside the window (151.119859ms)
+✔ with descendants off the adapter reads no project list and no child, as in v0 (130.174869ms)
+✔ a three-level tree is read per project, and a project outside it is not (127.234129ms)
+✔ a watch-only child keeps the business ready, and a failed child read refuses as transient (214.1212ms)
+✔ a root without the installed buckets refuses with descendants on (105.317207ms)
+✔ the project list refuses without read_all, and skips archived projects and saved filters (191.916883ms)
+✔ descendants must be true or false (84.669063ms)
+✔ a move inside the tree is a moved tombstone plus a snapshot under the new ref (168.009355ms)
+✔ a child made after startup joins the tree at the next reconcile (149.884206ms)
+✔ a child that leaves the tree has its tasks recorded missing, and the ledger keeps their history (158.093261ms)
+✔ a child deleted or hidden between reconciles drops out at the next tick, and the root still refuses (197.437994ms)
+✔ a reconcile that fails keeps the previous tree (124.995ms)
+✔ a closed task the cursor missed takes its own project's done bucket (114.978843ms)
+✔ closed tasks read at startup take their own project's done bucket (92.634247ms)
+✔ a closed task the cursor returns takes its own project's done bucket (126.262294ms)
+✔ a task moved out of a child that leaves the tree at the same time is moved, not no-access (122.7754ms)
+✔ a task in a bucket outside the five keeps its raw bucket id (106.528396ms)
+✔ bucket 0 on a watch-only task never becomes a bucket or a state (189.01004ms)
+✔ a child whose kanban view is deleted still refuses the tick, and the reconcile reads it watch-only (140.48436ms)
+✔ a child dropped at a tick comes back at the next reconcile once the bot reads it again (127.232128ms)
+✔ task.create needs a recorded human request and a requirement id (193.78368ms)
+✔ task.create takes only an approved requirement id (208.410586ms)
+✔ task.create cites the request a received message carries, not the message's id (181.880609ms)
+✔ only labels named in the business file can be written (207.902065ms)
+✔ task.schedule sets and clears a due date and relations (264.648721ms)
+✔ assign and reassign move the role bots and record task.assigned (285.093614ms)
+✔ task.update.assigned is for the assignee and records task.state (290.258866ms)
+✔ a wrong expected digest records task.conflict and writes nothing (175.994078ms)
+✔ a cross-role verb needs a resolved decision, used once (214.84097ms)
+✔ task.close needs a verdict; after it every verb refuses with task-done (229.347628ms)
+✔ a task with pushed work closes only citing an approve verdict for its latest push, and a refusal writes nothing (250.101837ms)
+✔ a lost answer is settled by a re-read and never retried (199.084241ms)
+✔ a create whose answer is lost is reported uncertain, and the poll finds the task (111.415899ms)
+✔ a task the sync bot cannot read refuses and records nothing (94.311083ms)
+✔ verbs and polls for one business run one at a time (166.577936ms)
+✔ a due date with milliseconds is written to the second (156.64966ms)
+✔ every write landed and the final read failed: the verb succeeds and records what it wrote (150.652338ms)
+✔ some writes landed and the final read failed: write-uncertain, and nothing is recorded (77.773187ms)
+✔ a create whose final read fails succeeds and records task.created (88.548924ms)
+✔ an edit between the last write and the final read shows as external on the next poll (105.492766ms)
+✔ task.created is recorded when a later label write fails (74.915656ms)
+✔ every verb acts in an installed child, on the child's own board (261.682411ms)
+✔ task.create refuses a project outside the tree, a watch-only one and one that is not an id (156.840459ms)
+✔ with descendants off, task.create takes only the root project (72.252663ms)
+✔ a verb on a watch-only task, or a relation to one, refuses with project-not-installed (126.368645ms)
+✔ a related task is read before authority: in another project than its ref names, task-moved; missing, task-not-found (151.114987ms)
+✔ a task moved to another project of the tree refuses its old ref with task-moved and takes its new one (100.297579ms)
+✔ a verb and a create in the child record the final read of the child's board (97.456533ms)
+✔ a create in the child whose final read fails records the child's todo bucket (101.713181ms)
+✔ a lost answer in the child is settled by a re-read of the child's board (125.890029ms)
+✔ every related task is read before authority, not only the first (100.080626ms)
+ℹ tests 97
+ℹ suites 0
+ℹ pass 97
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 5245.870166

agents/dewey/work/queue-136/gate/pkg-webui.log

@@ -0,0 +1,122 @@
+✔ the Board: held roles with no machine sessions, a claim with no address, the toggle kept across a reload, and Message addressed to the role (7355.376553ms)
+✔ a redirect answer on a Board read, a bus read, a conversation read, a board POST, a module read and a send signs the page out: one line, nothing stale, no further reads (7774.290446ms)
+✔ browser edge states: loading, empty, malformed, stale, hostile/long values, in-flight reply and appearance fallback (5380.764912ms)
+Rendered contrast: {"failures":[],"count":330,"lowest":4.504658476260286}
+✔ served Console browser: real board fixtures, keyboard, drafts, receipts, themes, 320px and failures (6949.159967ms)
+✔ the README says a refused field table names the file or the key at fault, never a path (1.458201ms)
+✔ S5 pages in a browser: real broker rows, inert text, Copy, routes, failures, layout and no writes (8185.401739ms)
+✔ bus routes serve the four reads from the reader view, unescaped JSON for the page to escape (339.591811ms)
+✔ decisions route serves the roles and recent lists from the reader view (640.91881ms)
+✔ credentials route serves the broker credential status from the reader view (426.970071ms)
+✔ replies route serves the replies to one message from the reader view (1762.801165ms)
+✔ bus routes are GET-only, have no write verb, and keep the same-origin checks (75.233819ms)
+✔ bus refusals map to statuses and never carry a path or a stack (35.076452ms)
+✔ humanCall speaks the human transport protocol without blocking the server (1697.718778ms)
+✔ busReader takes --business, else the live bus host, else refuses (251.824418ms)
+✔ humanCall kills a transport that runs past its timeout (617.838645ms)
+✔ serve refuses a --business value that is not a business id (233.988605ms)
+✔ conversation view: full history, collapsed tools, hidden thinking, inert hostile content, malformed and reconcile markers (6280.494619ms)
+✔ conversation view: a fork keeps the open branch, says so, and opens the new one on request (3268.493352ms)
+✔ conversation view: a newer session with no readable history keeps the marker (2860.710772ms)
+✔ conversation view: seats without history say so and offer no reply (2862.571761ms)
+✔ Discord row through real board/WebUI: independent brake/liveness, no Reply, literal content (5957.167768ms)
+✔ return flow through the conversation view: send, tool call, delayed result, peer message, exact long answers, relaunch (54061.88046ms)
+✔ messages HTTP read pages and preserves metadata; bad arguments refuse before a read; other reads unchanged (341.575419ms)
+✔ Console Messages lists late unsolicited messages on polling with sender class time read state and trail; nav count includes beyond the page; reads never deliver (12636.390327ms)
+✔ Messages nav count polls on Tasks and Board and clears on a Board refusal; messages 403 refuses local pages (3692.3355ms)
+✔ copy writes the Console paths at the full id, read-only, and leaves an existing copy alone (2914.410292ms)
+✔ copy refuses a commit off refactor, an unknown one, a worktree and a bad copies directory (9810.090888ms)
+✔ copy writes nothing when an archived path is missing at the commit (2025.128849ms)
+✔ a copy that loses the rename race leaves no read-only temp directory behind (581.286629ms)
+✔ a copy whose rename fails with no target refuses, writes no copy and leaves no temp directory (405.311649ms)
+✔ a copy that meets a target holding files says exists: and moves nothing into it (448.292102ms)
+✔ a copy that meets an empty target directory replaces it by rename, not by moving into it (385.729677ms)
+✔ serve runs from a copy: /healthz 200, the config check, roles and RELEASE from the copy, the queue from --checkout (978.425346ms)
+✔ serve refuses a --checkout that is not an absolute directory path (216.465855ms)
+✔ consoleReads runs the queue read under queueRoot and reads RELEASE under root (55.432721ms)
+✔ preview options are all three or none, and each is checked (10.331214ms)
+✔ the CLI refuses a partial or invalid preview flag set at start (1859.596235ms)
+✔ the CLI with all three flags serves the preview mode (277.901947ms)
+✔ a request for the public name needs the header equal to the user id, else 401 and nothing read (28.246938ms)
+✔ the header name matches without regard to case, and the value compare is exact (6.975833ms)
+✔ the public name with the header reads the bus views, and the Host and Origin are checked first (56.232488ms)
+✔ in preview mode every write answers 403 read-only, from the public name and loopback, and reaches nothing (54.427533ms)
+✔ loopback requests are unchanged in preview mode, and the bus views work with the board down (16.356965ms)
+✔ a proxy that rewrites Host to the loopback port gets 403 on its first request, whatever the user (53.575566ms)
+✔ a repeated Host is 400 before any other check, in preview mode and without it (13.792655ms)
+✔ without the preview flags the public name is refused and writes still reach the board (9.7994ms)
+✔ redactor: config, dataRoot, any absolute path, Discord ids and the JSON parser quote (2.246185ms)
+✔ credential state from the date alone, as the bus states it (0.316479ms)
+✔ queue: rows, one row, ids and methods, notes; no path or id from a row (1295.986915ms)
+✔ queue: a refused read fails closed with the store's text, redacted (1619.152348ms)
+✔ queue: a store that fails to load, or a child that dies, gives a fixed message with no path or stack (5419.470364ms)
+✔ business: names, vars on the allowlist, authority, credential metadata only (15.845323ms)
+✔ business: missing or invalid file refuses with the module's text, redacted (47.413156ms)
+✔ business without --business: the live bus host, else no-bus-host; no system config: not-configured (12.992699ms)
+✔ settings: release, board, loopback address, notifier binding name only (902.572128ms)
+✔ task fields: the committed table with no reads configured, GET only; a bad table refuses with no path (56.709509ms)
+✔ both presentations replace old activity with relaunch notice, label retained history, then resume after new activity (6817.893ms)
+✔ reported return flow and relative Age: reply sent from the inspector, then the new answer appears there without manual refresh (23599.014378ms)
+✔ the send box: held roles, the draft and caret across a refresh, each receipt, one POST per Send, and the trail link; the board Reply on a 4xx and a 5xx (7471.414357ms)
+✔ a sent receipt lists its replies as the page refreshes, oldest first and capped, and marks none delivered or read (13995.228456ms)
+✔ startServer takes send only as a function and only with the preview mode (7.070053ms)
+✔ the CLI refuses --send without the preview flags, and without a configured bus (522.25841ms)
+✔ the CLI with --send and a configured bus sends through the human transport and logs one line (161.172702ms)
+✔ without --send the route is read-only like every other write, and config says no send (12.931336ms)
+✔ with --send every other write is still 403 read-only, and nothing reaches the board or bus (12.901546ms)
+✔ config says send only on the public name with --send on (3.318563ms)
+✔ a send without the signed-in user is 401 and is neither sent nor logged, loopback included (7.146277ms)
+✔ each request check refuses before anything is sent, and logs the refusal without the body (19.918249ms)
+✔ a send passes exactly to, body and in_reply_to, answers the id, and logs it (5.205792ms)
+✔ a crafted role name cannot forge a log line (3.345765ms)
+✔ a bus refusal is not sent, with its status; an outcome the bus could not confirm is unknown and never retried (8.011631ms)
+✔ through the human transport the request is exactly the business, message.send and the keys (102.766874ms)
+✔ against a real broker: the message is written once as a human send, and its refusals map (2991.491791ms)
+✔ loopback host and board origin fail closed (6.271063ms)
+✔ real board fixture passes through WebUI; assets and isolated seen/reply work (432.18549ms)
+✔ proxy preserves exact request bytes, status and receipt, rejects forms and malformed JSON, never follows redirect (40.061132ms)
+✔ unreachable board reports URL; CLI rejects unsupported options (345.599151ms)
+✔ render prints the unit without the preview flags (9.809534ms)
+✔ render carries every serve flag, the preview set included (6.509516ms)
+✔ a partial preview set is refused (16.918555ms)
+✔ a value the unit cannot carry is refused, for every flag (258.006976ms)
+✔ the rendered unit names none of the human proof agent markers and sets no agent variable (23.130793ms)
+✔ install into --dir with --no-reload writes the file whole, then reports unchanged (122.404795ms)
+✔ install without --no-reload runs daemon-reload and nothing that starts the unit (112.673872ms)
+✔ uninstall refuses while the unit is running, with or without --no-reload, and removes it once it is not (379.171612ms)
+✔ status prints the unit state and GET /healthz on the installed port (354.393545ms)
+✔ usage: an unknown verb or flag, and start or enable, exit 4 (129.579593ms)
+✔ without --send, render is the template with its placeholders filled, byte for byte (33.696517ms)
+✔ render --send with the preview set ends ExecStart with --send and changes nothing else (63.104009ms)
+✔ --send without the whole preview set is refused and writes nothing (217.52138ms)
+✔ install --send into --dir with --no-reload writes the sending unit, and status says whether it sends (596.261217ms)
+✔ uninstall and status take no --send (95.507406ms)
+✔ install refuses while the unit is running, in any state but inactive or failed, and changes nothing (651.663571ms)
+✔ when the state read fails, install and uninstall refuse with one line and change nothing (101.485475ms)
+✔ install needs --copy naming a copy that exists, and refuses outside the canonical checkout without --allow-worktree (101.504626ms)
+✔ install refuses unless the bus unit runs from the same copy, naming both paths, and changes nothing (356.573537ms)
+✔ render --copy runs the copy and reads the queue in the checkout; without --copy the unit is unchanged (23.151363ms)
+✔ the uid header takes only an Authentik uid; the username header still takes a username (457.296172ms)
+✔ a preview value cannot start with - or . (27.70672ms)
+✔ status names the copy and whether refactor has moved past it, and says when the unit runs from no copy (490.23388ms)
+✔ Settings form shows every scope and held role; gated save, exact payload, retained draft and no automatic retry (3504.577441ms)
+2026-10-15T22:26:07.197Z settings user="jason" changed
+✔ REQ-WEB-1 signed-in same-origin Settings write reaches exactly one human operation (20.086587ms)
+✔ REQ-WEB-1 Settings writes require enabled send, named Host, identity, exact Origin and same-origin Fetch Metadata (9.985869ms)
+✔ REQ-WEB-1 Settings validates JSON, size, revision and strict writable keys before broker call (7.259979ms)
+✔ tokens.css and icons.svg are byte copies of docs/design (1.505893ms)
+✔ JetBrains Mono files match the digests in their sources file, with the OFL text (2.407254ms)
+✔ shipped strings are unchanged, and the web keeps its write boundary (3.106295ms)
+✔ shell in a browser: System default, seeded states, 400px, focus and the Ctrl+K palette (7373.857217ms)
+✔ five states on Board, Inbox, Tasks, Agents and Trail (3414.857628ms)
+✔ Queue, Business and Settings in their five states, with no move button (4676.669132ms)
+✔ seeded secrets, Discord ids and paths reach no response and no page; business refusals in the module's words (3737.086888ms)
+✔ the server log names no config path when the system config refuses (315.843625ms)
+ℹ tests 112
+ℹ suites 0
+ℹ pass 112
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 54400.764414

agents/dewey/work/queue-136/gate/test-auth.log

@@ -0,0 +1,17 @@
+OK    status with missing harness credential exits 3 and still lists accounts
+OK    status reports harness credential (read-only) + mosaic accounts
+OK    api key material never reaches output
+OK    oauth token material never reaches output
+OK    unparseable credential file exits 2
+OK    symlinked credential file exits 4
+OK    env-side credential names reported
+OK    env var values never reach output
+OK    accounts without an accounts dir reports none and creates nothing
+OK    accounts lists files and marks the active one
+OK    loose account perms flagged in listing
+OK    agent --auth with missing account file refuses (exit 4)
+OK    agent --auth with non-0600 account file refuses
+OK    agent --auth with invalid account name refuses
+OK    auth.sh without valid config refuses
+
+selftest: 15 passed, 0 failed

agents/dewey/work/queue-136/gate/test-conductor.log

@@ -0,0 +1,55 @@
+Note: switching to 'e37d6e5836737614f4b9542a07165b8bf6401aa7'.
+
+You are in 'detached HEAD' state. You can look around, make experimental
+changes and commit them, and you can discard any commits you make in this
+state without impacting any branches by switching back to a branch.
+
+If you want to create a new branch to retain commits you create, you may
+do so (now or later) by using -c with the switch command. Example:
+
+  git switch -c <new-branch-name>
+
+Or undo this operation with:
+
+  git switch -
+
+Turn off this advice by setting config variable advice.detachedHead to false
+
+Not currently on any branch.
+nothing to commit, working tree clean
+Note: switching to 'e37d6e5836737614f4b9542a07165b8bf6401aa7'.
+
+You are in 'detached HEAD' state. You can look around, make experimental
+changes and commit them, and you can discard any commits you make in this
+state without impacting any branches by switching back to a branch.
+
+If you want to create a new branch to retain commits you create, you may
+do so (now or later) by using -c with the switch command. Example:
+
+  git switch -c <new-branch-name>
+
+Or undo this operation with:
+
+  git switch -
+
+Turn off this advice by setting config variable advice.detachedHead to false
+
+OK    dry-run: allowed change, exit 0, nothing committed (exit 0)
+OK    dry-run committed nothing
+OK    apply: allowed change exits 0 (exit 0)
+OK    apply: attribution in commit subject
+OK    apply: target tree clean after commit
+OK    disallowed path refused (exit 1)
+OK    disallowed path: target untouched
+OK    syntax gate refused broken .mjs (exit 1)
+OK    syntax gate: target untouched
+OK    suite failure refused (exit 1)
+OK    suite failure: target reverted to clean
+OK    disabled policy refused (exit 2)
+OK    disabled policy: target untouched
+OK    failed run refused (exit 1)
+OK    failed run: target untouched
+OK    missing run exits 4 (exit 4)
+OK    invalid policy exits 2 (exit 2)
+
+selftest: 17 passed, 0 failed

agents/dewey/work/queue-136/gate/test-config.log

@@ -0,0 +1,26 @@
+OK    absent adapter defaults to pi
+OK    adapter mock validates (exit 0)
+OK    unsupported adapter exits 2 (exit 2)
+OK    env exports adapter
+OK    bootstrap creates default when absent (exit 0)
+OK    bootstrap wrote config file
+OK    bootstrap is idempotent on existing config (exit 0)
+OK    bootstrap did not rewrite existing config
+OK    validate missing config exits 3 (exit 3)
+OK    malformed JSON exits 2 (exit 2)
+OK    unsupported configVersion exits 2 (exit 2)
+OK    unknown top-level key exits 2 (exit 2)
+OK    unknown execution key exits 2 (exit 2)
+OK    unsupported backend exits 2 (exit 2)
+OK    unsupported environment exits 2 (exit 2)
+OK    relative dataRoot exits 2 (exit 2)
+OK    non-canonical dataRoot exits 2 (exit 2)
+OK    filesystem root dataRoot exits 2 (exit 2)
+OK    home directory dataRoot exits 2 (exit 2)
+OK    dataRoot containing config dir exits 2 (exit 2)
+OK    control character in provider exits 2 (exit 2)
+OK    symlinked config file exits 2 (exit 2)
+OK    env exports resolve correctly
+OK    failed validation modified nothing
+
+selftest: 24 passed, 0 failed

agents/dewey/work/queue-136/gate/test-discord.log

@@ -0,0 +1,82 @@
+toolchain: node v26.8.1
+
+OK    syntax: packages/discord/src/approvals.mjs
+OK    syntax: packages/discord/src/authorize.mjs
+OK    syntax: packages/discord/src/binding.mjs
+OK    syntax: packages/discord/src/cli.mjs
+OK    syntax: packages/discord/src/connector.mjs
+OK    syntax: packages/discord/src/context.mjs
+OK    syntax: packages/discord/src/engine-pi.mjs
+OK    syntax: packages/discord/src/errors.mjs
+OK    syntax: packages/discord/src/gateway.mjs
+OK    syntax: packages/discord/src/git.mjs
+OK    syntax: packages/discord/src/journal.mjs
+OK    syntax: packages/discord/src/notify.mjs
+OK    syntax: packages/discord/src/rest.mjs
+OK    syntax: packages/discord/src/setspark.mjs
+OK    syntax: packages/discord/src/tools.mjs
+OK    syntax: packages/discord/src/web.mjs
+OK    syntax: packages/discord/bin/git-credential.mjs
+OK    syntax: packages/discord/extension/tools.mjs
+OK    syntax: packages/discord/tests/approvals.test.mjs
+OK    syntax: packages/discord/tests/authorize.test.mjs
+OK    syntax: packages/discord/tests/binding.test.mjs
+OK    syntax: packages/discord/tests/connector.test.mjs
+OK    syntax: packages/discord/tests/context.test.mjs
+OK    syntax: packages/discord/tests/copy-service.test.mjs
+OK    syntax: packages/discord/tests/engine.test.mjs
+OK    syntax: packages/discord/tests/fake-pi.mjs
+OK    syntax: packages/discord/tests/gateway.test.mjs
+OK    syntax: packages/discord/tests/git.test.mjs
+OK    syntax: packages/discord/tests/helpers.mjs
+OK    syntax: packages/discord/tests/journal.test.mjs
+OK    syntax: packages/discord/tests/notify.test.mjs
+OK    syntax: packages/discord/tests/offline-check.test.mjs
+OK    syntax: packages/discord/tests/recover.test.mjs
+OK    syntax: packages/discord/tests/rest.test.mjs
+OK    syntax: packages/discord/tests/setspark.test.mjs
+OK    syntax: packages/discord/tests/tools.test.mjs
+OK    syntax: packages/discord/tests/web.test.mjs
+OK    syntax: packages/discord/fixtures/claim-worker.mjs
+OK    syntax: packages/discord/fixtures/legacy-owner-worker.mjs
+OK    syntax: scripts/discord.sh
+OK    syntax: scripts/discord-service.sh
+OK    packages/discord declares no dependencies
+OK    no bot-token-shaped string in packages/discord
+OK    fixture binding uses placeholder ids only
+OK    fixture binding validates
+OK    real pi with the extension exposes exactly list_dir, read_file, search and no built-in tool
+OK    real pi with a writable root exposes exactly the three reads plus write_file and edit_file, and writes nothing at start
+OK    real pi with a web key exposes the three reads plus web_fetch and web_search, and no write tool without a writable root
+OK    real pi with a git root exposes the reads, writes and the four git verbs, commits nothing at start, and never shows the token
+OK    real pi with protocol vault adds reserve_id to the git verbs
+OK    real pi with a setspark key exposes the reads and the eight record verbs, no counters, and never shows the key
+OK    real pi refuses a git key on a read-only root (fail closed)
+OK    real pi with the pilot flags (--no-tools) exposes no tool at all
+OK    real pi exits non-zero without MOSAIC_DISCORD_TOOLS: no session, no tools (fail closed)
+OK    a failing nested test fails the run under a parent runner's NODE_TEST_CONTEXT
+OK    node --test packages/discord/tests/ (ℹ pass 183)
+OK    scripts/discord.sh --help exits 0
+OK    scripts/discord.sh check without a binding exits 4
+OK    scripts/discord.sh recover without a binding exits 4
+OK    scripts/discord.sh reload without a binding exits 4
+OK    scripts/discord-service.sh without a command exits 4
+OK    service unit renders with the repository path, a supervised run as the main process, exit 3 never retried, and reload as SIGHUP
+OK    service install writes the rendered unit (0644) and leaves no temp file
+OK    service install a second time reports unchanged
+OK    systemd-analyze verify accepts the rendered unit
+OK    service uninstall removes the unit file
+OK    service install with an unknown flag exits 4
+OK    service install with USER unset finishes and names the account for lingering
+OK    pinned render runs copy CLI with copy cwd/repo and no checkout executable
+OK    pinned install writes the rendered unit in a temporary unit directory
+OK    pinned install refuses short prerequisite and writes no unit
+OK    pinned install refuses missing prerequisite and writes no unit
+OK    pinned install refuses cli prerequisite and writes no unit
+OK    pinned install refuses pi prerequisite and writes no unit
+OK    status names the copy from fake systemctl effective cwd
+OK    checkout install explicitly recommends --copy
+OK    wrapper check --offline passes local fixture and makes no network call
+OK    wrapper run --offline refuses usage
+
+discord suite: 78 passed, 0 failed

agents/dewey/work/queue-136/gate/test-extension-package.log

@@ -0,0 +1,21 @@
+OK    initial ordinary-file install
+OK    installed tree matches canonical source
+OK    installed tree has no symlinks
+OK    check detects installation drift
+OK    sync refuses to overwrite installation drift
+OK    check detects an extra destination file
+OK    check detects an extra destination directory
+OK    check rejects a destination symlink
+OK    sync accepts a canonical source update
+OK    updated installation matches canonical source
+scripts/test-extension-package.sh: line 14: 962333 Killed                     "$@" > /dev/null 2>&1
+OK    forced interruption kills the replacing process
+OK    next invocation recovers old consistent installation
+OK    interrupted replacement rolled back
+OK    sync succeeds after interruption recovery
+OK    unlocked stale lock file does not block
+OK    active lock refuses a concurrent sync
+OK    source symlink fails closed
+OK    nested second entrypoint fails closed
+
+extension package selftest: 18 passed, 0 failed

agents/dewey/work/queue-136/gate/test-foundation.log

@@ -0,0 +1,53 @@
+toolchain: node v26.8.1, python 3.12.8, jsonschema 4.26.0
+
+OK    syntax: scripts/foundation-inspect.mjs
+OK    syntax: scripts/foundation/strict-json.mjs
+OK    syntax: scripts/foundation/canonical.mjs
+OK    syntax: scripts/foundation/resolve.mjs
+OK    syntax: scripts/foundation/validate-record.mjs
+OK    syntax: scripts/foundation/fixtures/build-fixtures.mjs
+OK    syntax: scripts/foundation/canonical.test.mjs
+OK    syntax: scripts/foundation/cli.test.mjs
+OK    syntax: scripts/foundation/fixtures.test.mjs
+OK    syntax: scripts/foundation/resolve.test.mjs
+OK    syntax: scripts/foundation/strict-json.test.mjs
+OK    syntax: scripts/foundation/verify-schema.py (ast only; no bytecode written)
+OK    fixture generator runs
+OK    checked-in fixtures/bundles equal a fresh generation
+OK    checked-in fixtures/raw equal a fresh generation
+OK    checked-in fixtures/index.json equal a fresh generation
+OK    checked-in demo bundles equal a fresh generation
+OK    a failing nested test fails the run under a parent runner's NODE_TEST_CONTEXT
+OK    node --test scripts/foundation/ (ℹ pass 80)
+OK    differential schema oracle: PASS: differential schema oracle (finite corpus; compatibility evidence, not equivalence proof)
+      platform witness: strftime('%Y') for year 999 -> '999' (pinned checker refuses years 0001..0999)
+      node v26.8.1; corpus 1568 records (38 pinned fixtures, 478 unique bundle records, 1052 typeCase/mutation/lexical cases)
+      schema column: agree-valid 540, agree-invalid 991, DISAGREEMENTS 0; strict-only (parser-bound) cases: 27; unsupported-kind records not schema-assessed by the inspector: 10
+      profile column (schema-valid records only): profile-valid 510, profile-invalid 30
+      profile refusals asserted: 30 schema-agreed-valid records refused only by the strict typed-string profile (rule profile-pattern-mismatch), 12 declared by name; 73 named probes verified against declared schema/profile columns
+OK    oracle: zero schema-column disagreements with the pinned checker
+OK    oracle: strict-only profile refusals are counted and asserted
+OK    demo: permitted read preview exits 0 (exit 0)
+OK    demo: permitted file.change preview exits 0 (exit 0)
+OK    demo: assignment.change proposal is unresolved (exit 3) (exit 3)
+OK    demo: revoked registration is refused (exit 3) (exit 3)
+OK    demo: message is not authority (exit 3) (exit 3)
+OK    usage: no arguments exits 2 (exit 2)
+OK    io: missing file exits 4 (exit 4)
+OK    io: directory exits 4 (exit 4)
+OK    io: symlink exits 4 (O_NOFOLLOW) (exit 4)
+OK    bound: oversize fixture exits 2 (exit 2)
+OK    profile: one final LF in a typed selection id is refused before admission (exit 2) (exit 2)
+OK    profile: two final LFs fail the schema pattern itself (exit 2) (exit 2)
+OK    profile: escaped newlines in free-form text stay allowed (exit 0) (exit 0)
+OK    profile refusal is invalid-request/profile-pattern-mismatch with selection and operation withheld, value not echoed
+OK    text output starts with the disclaimer
+OK    json output is valid JSON with result allowed and exactly the charter §7 fields
+OK    json golden matches byte-for-byte
+OK    sandboxed bundle run (env -i, PATH=/nonexistent) produced the unresolved proposal
+OK    sandbox inventory (path/type/size/mode/uid/gid/inode/mtime/sha256) unchanged by runs
+OK    canary never printed (bundle run and credential-file run)
+OK    a non-bundle JSON file is refused at the shape gate, not read into output
+OK    no field of the non-bundle file is echoed
+
+selftest: 44 passed, 0 failed

agents/dewey/work/queue-136/gate/test-land-work.log

@@ -0,0 +1,86 @@
+OK    args: exit 2, target-branch
+OK    args: exit 2, target-branch
+OK    args: exit 4
+OK    args: exit 4
+OK    args: exit 4
+OK    --base next refuses before the config is read (got 2)
+OK    a missing system config exits 3 (got 3)
+OK    nobus: exit 3
+OK    schema-table: exit 2, bus-schema
+OK    schema-meta: exit 2, bus-schema
+OK    openBus opens the database read-only
+OK    other-business: exit 2, decision-not-found
+OK    no-raise: exit 2, decision-not-found
+OK    not-a-merge: exit 2, not-a-merge
+OK    open: exit 2, not-resolved
+OK    withdrawn: exit 2, not-resolved
+OK    by-agent: exit 2, not-human
+OK    via-webui: exit 2, not-human
+OK    no-answer: exit 2, not-human
+OK    answer-role: exit 2, not-human
+OK    answer-run: exit 2, not-human
+OK    answer-choice: exit 2, not-human
+OK    two-answers: exit 2, not-human
+OK    chose-no: exit 2, not-merge-option
+OK    two-refs: exit 2, work-ref
+OK    bad-ref: exit 2, work-ref
+OK    task-ref-disagrees: exit 2, work-ref
+OK    raise-task-disagrees: exit 2, work-ref
+OK    target-main: exit 2, target-branch
+OK    superseded-question: exit 2, superseded
+OK    superseded-task: exit 2, superseded
+OK    superseded-by: exit 2, superseded
+OK    no-verdict: exit 2, no-verdict
+OK    changes-later: exit 2, not-approved
+OK    short-commit: exit 2, not-approved
+OK    wrong-task-body: exit 2, not-approved
+OK    args: exit 2, decision-not-found
+OK    earlier-merge: exit 0
+OK    ref-moved: exit 2, ref-moved
+OK    root-top: exit 2, root-file
+OK    root-newdir: exit 2, root-file
+OK    root-src: exit 2, root-file
+OK    unrelated: exit 2, base-conflict
+OK    empty: exit 2, base-conflict
+OK    an empty reviewed diff says so
+OK    dirty-changed: exit 2, checkout-dirty
+OK    dirty-staged: exit 2, checkout-dirty
+OK    dirty-untracked: exit 2, checkout-dirty
+OK    conflict: exit 2, base-conflict
+OK    a refusal after the worktree is added leaves no worktree or scratch
+OK    cleanup looks for the worktree's Docker network
+OK    dirty-during: exit 2, checkout-dirty
+OK    a reviewed path dirtied during the gate moves no ref
+OK    drift: exit 2, patch-drift
+OK    patch-drift leaves no worktree or scratch
+OK    gate-pkg: exit 2, gate-failed
+OK    gate-failed names the failing step's log, and it exists
+OK    gate-failed leaves no worktree or scratch
+OK    gate-script: exit 2, gate-failed
+OK    a failing scripts/test-*.sh fails the gate
+OK    a failed gate moves no ref
+OK    nomods: exit 4
+OK    a target without node_modules leaves no worktree or scratch
+OK    moved: exit 2, base-moved
+OK    base-moved keeps the base where it moved to
+OK    dry: exit 0
+OK    --dry-run writes no ref
+OK    --dry-run prints the commit with --subject and --attribution
+OK    --dry-run runs the gate
+OK    --dry-run leaves no worktree or scratch
+OK    land: exit 0
+OK    the landing is one commit on the old base
+OK    its diff is the reviewed diff by patch-id
+OK    its tree is the dry run's
+OK    the message has the option's subject, the citations and the attribution last
+OK    it prints the line for the PM
+OK    the checked-out base has the reviewed paths and keeps the unrelated edit
+OK    only refs/heads/refactor exists in the target
+OK    the work ref is unchanged
+OK    the bus database is unchanged
+OK    the gate ran each package suite but queue, and each scripts/test-*.sh
+OK    the landing leaves no worktree or scratch
+OK    the target's node_modules is still there, with its contents
+OK    the worktree's Docker network is removed
+---
+land-work selftests: 84 passed, 0 failed

agents/dewey/work/queue-136/gate/test-queue.log

@@ -0,0 +1,36 @@
+toolchain: node v26.8.1, git version 2.55.0
+
+OK    syntax: packages/queue/src/cli.mjs
+OK    syntax: packages/queue/src/errors.mjs
+OK    syntax: packages/queue/src/io.mjs
+OK    syntax: packages/queue/src/lock.mjs
+OK    syntax: packages/queue/src/queue.mjs
+OK    syntax: packages/queue/src/review.mjs
+OK    syntax: packages/queue/src/store.mjs
+OK    syntax: packages/queue/tests/commit.test.mjs
+OK    syntax: packages/queue/tests/data.test.mjs
+OK    syntax: packages/queue/tests/dispatch.test.mjs
+OK    syntax: packages/queue/tests/gate-owner.test.mjs
+OK    syntax: packages/queue/tests/helpers.mjs
+OK    syntax: packages/queue/tests/lock.test.mjs
+OK    syntax: packages/queue/tests/migration.test.mjs
+OK    syntax: packages/queue/tests/review.test.mjs
+OK    syntax: packages/queue/tests/store.test.mjs
+OK    syntax: packages/queue/tests/write.test.mjs
+OK    syntax: packages/queue/tests/fixtures/fake-gitea.mjs
+OK    syntax: packages/queue/tests/fixtures/kill-at.mjs
+OK    syntax: packages/queue/tests/fixtures/lock-child.mjs
+OK    syntax: packages/queue/tests/fixtures/mosaic-pre-a2.sh
+OK    syntax: scripts/queue-commit.sh
+OK    syntax: scripts/git-hooks/pre-commit
+OK    syntax: scripts/mosaic
+OK    queue-commit.sh, the guard and scripts/mosaic are executable
+OK    packages/queue declares no dependencies
+ℹ tests 156
+ℹ pass 156
+ℹ fail 0
+OK    node --test packages/queue/tests/
+OK    scripts/mosaic queue help
+skip  queue verify and render --check: this checkout (/home/jwoltje/dewey-scratch/r136/wt) is not the queue's canonical root (/mnt/storage/src/mosaic-stack)
+
+queue suite: 28 passed, 0 failed

agents/dewey/work/queue-136/gate/test-release.log

@@ -0,0 +1,16 @@
+OK    valid RELEASE resolves (exit 0)
+OK    invalid RELEASE exits 1 (exit 1)
+OK    missing RELEASE exits 1 (exit 1)
+OK    valid RELEASE leaves image tag consistent with version
+OK    status safe on empty state (exit 0)
+OK    status created no pointer
+OK    fault-injected activation refuses (exit 1)
+OK    refused activation wrote no pointer
+OK    refusal logged exactly once with valid fields
+OK    healthy activation succeeds (exit 0)
+OK    pointer written with valid fields
+OK    repeat activation succeeds (log grows) (exit 0)
+OK    log is append-only across activations
+OK    rollback without previous refuses (exit 1)
+
+selftest: 14 passed, 0 failed

agents/dewey/work/queue-136/gate/test-task.log

@@ -0,0 +1,101 @@
+OK    valid task validates (exit 0)
+OK    unknown task key exits 2 (exit 2)
+OK    unsupported taskVersion exits 2 (exit 2)
+OK    invalid task id exits 2 (exit 2)
+OK    empty prompt exits 2 (exit 2)
+OK    NUL in expectExact exits 2 (exit 2)
+OK    out-of-range timeout exits 2 (exit 2)
+OK    missing mission file exits 4 (exit 4)
+OK    task with valid mission validates (exit 0)
+OK    invalid mission exits 2 (exit 2)
+OK    validate missing task exits 4 (exit 4)
+OK    validation does not modify the task file
+OK    prune dry-run exits 0 (exit 0)
+OK    dry-run deleted nothing
+OK    prune --keep=2 --yes removes oldest (exit 0)
+OK    kept exactly 2 newest runs
+OK    newest run kept, oldest pruned
+OK    append-only receipt written (3 entries)
+OK    sessions/workspaces untouched by prune
+OK    prune with invalid keep exits 4 (exit 4)
+OK    mock adapter: gate passes on matching mock response (exit 0)
+OK    mock adapter: expect-mismatch recorded (exit 1)
+OK    mismatch reason recorded
+OK    unknown adapter fails closed (exit 1)
+OK    mission task runs via mock adapter (exit 0)
+OK    mission section injected into generated prompt
+OK    retry of mission run succeeds (exit 0)
+OK    retriedFrom lineage recorded
+OK    mission section present after retry (relative path resolved)
+OK    retry of missing run exits 4 (exit 4)
+OK    skill install bundled ms-tools (exit 0)
+OK    installed to skills-available
+OK    double install refuses (exit 1)
+OK    activate enables skill (exit 0)
+OK    enabled dir populated
+OK    uninstall while enabled refuses (exit 1)
+OK    deactivate moves back to available (exit 0)
+OK    uninstall removes from available (exit 0)
+OK    seat with enabled skill launches
+OK    skill path delivered to adapter
+OK    shipped researcher contract resolves (ceiling + network)
+OK    resolve-role refuses a non-role document (conductor policy) (exit 2)
+OK    resolve-role refuses name/filename mismatch (exit 2)
+OK    resolve-role refuses unknown network declaration (exit 2)
+OK    resolve-role refuses duplicate role tool (exit 2)
+OK    resolve-role refuses unsupported tool (exit 2)
+OK    resolve-role refuses missing contract file (exit 4)
+OK    version 1 role prints no contract line
+OK    shipped version 2 roles resolve with their contracts (pm, cto, coder, reviewer)
+OK    resolve-role accepts a minimal version 2 role (exit 0)
+OK    resolve-role refuses an action outside the vocabulary (exit 2)
+OK    resolve-role refuses a gated-only action in a role file (exit 2)
+OK    resolve-role refuses a Vikunja verb no role may hold (exit 2)
+OK    resolve-role refuses a version 2 role whose contract is missing (exit 2)
+OK    resolve-role refuses a contract that is a symbolic link (exit 2)
+OK    seat launches under role ceiling
+OK    role ceiling narrows seat tools (read,write,bash -> read,bash)
+OK    narrowing recorded loudly
+OK    missing role contract refuses launch (exit 2)
+OK    missing-contract refusal names the role
+OK    empty ceiling intersection -> tool-free seat
+OK    tool-free outcome recorded loudly
+OK    overridden agents dir without seat definition refuses (exit 4)
+OK    seat-resolution refusal names the seat
+OK    policy: mission only -> mission tools
+OK    policy: task only -> task tools
+OK    policy: both -> intersection (task narrowed)
+OK    policy: empty intersection -> tool-free
+OK    invalid mission capabilities rejected (exit 2)
+mosaic-task: unsupported mission tool: "sudo" (supported: read, write, edit, bash, grep, find, ls)
+OK    task run with user layer present (exit 0)
+OK    user context dispatched into generated prompt
+OK    workspace+tools task runs via mock (exit 0)
+OK    workspace path + tools delivered to adapter
+OK    persistent workspace created on host
+OK    plain task still runs (no workspace/tools) (exit 0)
+OK    workspace var present but empty when absent
+OK    tools empty when absent
+OK    unknown tool exits 2 (exit 2)
+OK    workspace traversal exits 2 (exit 2)
+OK    live hello task succeeds with exact marker
+OK    result.json written in run dir
+OK    result.json contents are correct
+OK    wrong expectExact fails with exit 1 (reason: expect-mismatch)
+OK    each run gets a distinct run dir (no clobber)
+OK    list shows both runs
+OK    fork base: teach succeeds (exit 0)
+OK    fork child recalls ancestor context (exit 0)
+OK    forked child recalled ancestor code word
+OK    ancestor session untouched by fork
+OK    child session dir has its own branch file
+OK    onboard without name exits 4 (non-interactive) (exit 4)
+OK    onboard --name renders profile (exit 0)
+OK    profile written
+OK    canon structure: required filled, optional placeholdered
+OK    canon sections present
+OK    user recall run succeeds
+OK    recalled user name (response: Jason)
+OK    no agent identity on headless run
+
+selftest: 98 passed, 0 failed

agents/dewey/work/queue-136/mutants-run.log

@@ -0,0 +1,5 @@
+M1-authority-thread KILLED rc=1 | ✖ REQ-DEC REQ-THREAD-1 a thread approval is consumed only by a run holding the same thread (170.040126ms)
+M2-supersede-role KILLED rc=1 | ✖ REQ-DEC a later run of the same instance supersedes an open decision; another instance cannot (170.418785ms)
+M3-supersede-thread KILLED rc=1 | ✖ REQ-DEC REQ-THREAD-1 a thread decision is superseded only from the same thread (179.041639ms)
+M4-authority-role KILLED rc=1 | ✖ REQ-DEC another instance of the same definition cannot consume an approval, and its refusal consumes nothing (149.001666ms)
+restored True

agents/dewey/work/queue-136/mutants.py

@@ -0,0 +1,24 @@
+import subprocess, sys, os, shutil
+W=os.path.expanduser('~/dewey-scratch/r136/wt')
+src=os.path.join(W,'packages/bus/src/broker.mjs')
+orig=open(src).read()
+shutil.copy(src, os.path.expanduser('~/dewey-scratch/r136/mut/broker.orig.mjs'))
+M={
+ 'M1-authority-thread': ("      this.#raisedThread(d) !== s.thread ||\n", ""),
+ 'M2-supersede-role': ("if (old.raised_by_role !== s.role || this.#raisedThread(old)", "if (this.#raisedThread(old)"),
+ 'M3-supersede-thread': (" || this.#raisedThread(old) !== s.thread || this.#closed(old.id))", " || this.#closed(old.id))"),
+ 'M4-authority-role': ("      d.raised_by_role !== s.role ||\n      this.#raisedThread(d)", "      this.#raisedThread(d)"),
+}
+files=['packages/bus/tests/approval-binding.test.mjs','packages/bus/tests/single-use.test.mjs','packages/bus/tests/broker.test.mjs']
+env=dict(os.environ, TMPDIR=os.path.expanduser('~/dewey-scratch/tmp'))
+try:
+  for name,(a,b) in M.items():
+    assert orig.count(a)==1, name
+    open(src,'w').write(orig.replace(a,b))
+    r=subprocess.run(['node','--test',*files],cwd=W,env=env,capture_output=True,text=True,timeout=300)
+    fails=[l for l in r.stdout.splitlines() if l.startswith('✖') and 'failing tests' not in l]
+    print(name, 'KILLED' if r.returncode!=0 else 'SURVIVED', 'rc=%d'%r.returncode, '| '+' | '.join(sorted(set(fails)))[:400])
+    open(os.path.expanduser(f'~/dewey-scratch/r136/mut/{name}.log'),'w').write(r.stdout+r.stderr)
+finally:
+  open(src,'w').write(orig)
+print('restored', open(src).read()==orig)

agents/dewey/work/queue-136/mutants/M1-authority-thread.log

@@ -0,0 +1,61 @@
+✔ REQ-DEC an approval outlives its run and a broker restart; a new run of the instance consumes it once (213.271854ms)
+✔ REQ-DEC another instance of the same definition cannot consume an approval, and its refusal consumes nothing (142.513261ms)
+✖ REQ-DEC REQ-THREAD-1 a thread approval is consumed only by a run holding the same thread (170.040126ms)
+✔ REQ-DEC a later run of the same instance supersedes an open decision; another instance cannot (197.373664ms)
+✔ REQ-DEC REQ-THREAD-1 a thread decision is superseded only from the same thread (210.890943ms)
+✔ launch identity is stamped, payload identity is refused and stale holder cannot send (127.546508ms)
+✔ decision classes route from policy; gated resolution is human-only, choice and target must match (182.584369ms)
+✔ claim exclusion, holder release, gated revoke and rerouting to a new holder are atomic (217.034486ms)
+✔ launch events require a human CLI capability; generic emit cannot forge authority events (139.126384ms)
+✔ within-role decisions close atomically and invalid options or blocking omissions refuse (146.713234ms)
+✔ a recommendation that is not exactly one option key refuses invalid-recommendation after the options (214.169923ms)
+✔ observer capabilities read human inbox but cannot mutate or forge launch identity (146.794839ms)
+✔ task action subjects and linked decision trail are complete and ordered (141.101403ms)
+✔ launch binding is durable and reconnecting requires the identical trusted record (89.045823ms)
+✔ business isolation includes inherited object names and cross-business message references (145.484541ms)
+✔ authority never transfers between action, target, unresolved or replaced role holder; a later run of the instance keeps it (206.426752ms)
+✔ task projection uses schema current view, skipping earlier and equal-start polls (92.983936ms)
+✔ revocation permanently bars the old run from reclaiming first, including after broker restart (179.111277ms)
+✔ empty message references refuse before storage; refusal-evidence failure stays a typed error (114.253314ms)
+✔ both arbiters require human resolution when their cross-role route is themselves (118.043991ms)
+✔ the shipped coder role raises task.reassign as gated to the human; task.scope.change stays cross-role (81.363914ms)
+✔ gated approval authorizes once, survives store reopen, and fresh approval works (182.383007ms)
+✔ another run of the same instance consumes an approval once; a failed check leaves it usable (175.136957ms)
+✔ two scheduled callers have exactly one grant and one consumed refusal (116.179533ms)
+✔ failed commit rolls consumption back; cross-role consumes and within-role stays reusable (251.442799ms)
+✔ class drift gated to cross-role refuses before consumption (173.97586ms)
+✔ class drift cross-role to gated refuses before consumption (179.867312ms)
+✔ class drift gated to within-role refuses before consumption (207.353546ms)
+✔ class drift cross-role to within-role refuses before consumption (171.245424ms)
+✔ class drift within-role to gated refuses before consumption (154.345566ms)
+✔ class drift within-role to cross-role refuses before consumption (146.158583ms)
+✔ message.send consumes approval and prevents a later send or authorize (177.654716ms)
+✔ role.revoke consumes approval and prevents a later revoke or authorize (212.447713ms)
+ℹ tests 33
+ℹ suites 0
+ℹ pass 32
+ℹ fail 1
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 2403.127913
+
+✖ failing tests:
+
+test at packages/bus/tests/approval-binding.test.mjs:122:1
+✖ REQ-DEC REQ-THREAD-1 a thread approval is consumed only by a run holding the same thread (170.040126ms)
+  AssertionError [ERR_ASSERTION]: Missing expected exception.
+      at TestContext.<anonymous> (file:///home/jwoltje/dewey-scratch/r136/wt/packages/bus/tests/approval-binding.test.mjs:130:10)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
+      at Test.postRun (node:internal/test_runner/test:1542:19)
+      at Test.run (node:internal/test_runner/test:1467:12)
+      at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) {
+    generatedMessage: false,
+    code: 'ERR_ASSERTION',
+    actual: undefined,
+    expected: { code: 'decision-mismatch' },
+    operator: 'throws',
+    diff: 'simple'
+  }

agents/dewey/work/queue-136/mutants/M2-supersede-role.log

@@ -0,0 +1,61 @@
+✔ REQ-DEC an approval outlives its run and a broker restart; a new run of the instance consumes it once (215.999686ms)
+✔ REQ-DEC another instance of the same definition cannot consume an approval, and its refusal consumes nothing (157.973161ms)
+✔ REQ-DEC REQ-THREAD-1 a thread approval is consumed only by a run holding the same thread (210.559909ms)
+✖ REQ-DEC a later run of the same instance supersedes an open decision; another instance cannot (170.418785ms)
+✔ REQ-DEC REQ-THREAD-1 a thread decision is superseded only from the same thread (183.923211ms)
+✔ launch identity is stamped, payload identity is refused and stale holder cannot send (142.635141ms)
+✔ decision classes route from policy; gated resolution is human-only, choice and target must match (208.578905ms)
+✔ claim exclusion, holder release, gated revoke and rerouting to a new holder are atomic (215.973701ms)
+✔ launch events require a human CLI capability; generic emit cannot forge authority events (135.598779ms)
+✔ within-role decisions close atomically and invalid options or blocking omissions refuse (132.321552ms)
+✔ a recommendation that is not exactly one option key refuses invalid-recommendation after the options (183.38219ms)
+✔ observer capabilities read human inbox but cannot mutate or forge launch identity (131.3215ms)
+✔ task action subjects and linked decision trail are complete and ordered (142.826612ms)
+✔ launch binding is durable and reconnecting requires the identical trusted record (75.931675ms)
+✔ business isolation includes inherited object names and cross-business message references (134.965962ms)
+✔ authority never transfers between action, target, unresolved or replaced role holder; a later run of the instance keeps it (221.880927ms)
+✔ task projection uses schema current view, skipping earlier and equal-start polls (99.766974ms)
+✔ revocation permanently bars the old run from reclaiming first, including after broker restart (175.373084ms)
+✔ empty message references refuse before storage; refusal-evidence failure stays a typed error (97.078508ms)
+✔ both arbiters require human resolution when their cross-role route is themselves (118.890461ms)
+✔ the shipped coder role raises task.reassign as gated to the human; task.scope.change stays cross-role (71.25667ms)
+✔ gated approval authorizes once, survives store reopen, and fresh approval works (193.169032ms)
+✔ another run of the same instance consumes an approval once; a failed check leaves it usable (178.86498ms)
+✔ two scheduled callers have exactly one grant and one consumed refusal (132.863905ms)
+✔ failed commit rolls consumption back; cross-role consumes and within-role stays reusable (238.41174ms)
+✔ class drift gated to cross-role refuses before consumption (170.050689ms)
+✔ class drift cross-role to gated refuses before consumption (162.239372ms)
+✔ class drift gated to within-role refuses before consumption (148.447283ms)
+✔ class drift cross-role to within-role refuses before consumption (176.056163ms)
+✔ class drift within-role to gated refuses before consumption (147.305085ms)
+✔ class drift within-role to cross-role refuses before consumption (157.084684ms)
+✔ message.send consumes approval and prevents a later send or authorize (177.017468ms)
+✔ role.revoke consumes approval and prevents a later revoke or authorize (202.400834ms)
+ℹ tests 33
+ℹ suites 0
+ℹ pass 32
+ℹ fail 1
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 2351.575089
+
+✖ failing tests:
+
+test at packages/bus/tests/approval-binding.test.mjs:139:1
+✖ REQ-DEC a later run of the same instance supersedes an open decision; another instance cannot (170.418785ms)
+  AssertionError [ERR_ASSERTION]: Missing expected exception.
+      at TestContext.<anonymous> (file:///home/jwoltje/dewey-scratch/r136/wt/packages/bus/tests/approval-binding.test.mjs:151:10)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
+      at Test.postRun (node:internal/test_runner/test:1542:19)
+      at Test.run (node:internal/test_runner/test:1467:12)
+      at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) {
+    generatedMessage: false,
+    code: 'ERR_ASSERTION',
+    actual: undefined,
+    expected: { code: 'supersede-refused' },
+    operator: 'throws',
+    diff: 'simple'
+  }

agents/dewey/work/queue-136/mutants/M3-supersede-thread.log

@@ -0,0 +1,61 @@
+✔ REQ-DEC an approval outlives its run and a broker restart; a new run of the instance consumes it once (207.389092ms)
+✔ REQ-DEC another instance of the same definition cannot consume an approval, and its refusal consumes nothing (145.139269ms)
+✔ REQ-DEC REQ-THREAD-1 a thread approval is consumed only by a run holding the same thread (192.187754ms)
+✔ REQ-DEC a later run of the same instance supersedes an open decision; another instance cannot (186.663221ms)
+✖ REQ-DEC REQ-THREAD-1 a thread decision is superseded only from the same thread (179.041639ms)
+✔ launch identity is stamped, payload identity is refused and stale holder cannot send (129.664241ms)
+✔ decision classes route from policy; gated resolution is human-only, choice and target must match (199.321024ms)
+✔ claim exclusion, holder release, gated revoke and rerouting to a new holder are atomic (204.339937ms)
+✔ launch events require a human CLI capability; generic emit cannot forge authority events (138.98634ms)
+✔ within-role decisions close atomically and invalid options or blocking omissions refuse (147.796461ms)
+✔ a recommendation that is not exactly one option key refuses invalid-recommendation after the options (215.059753ms)
+✔ observer capabilities read human inbox but cannot mutate or forge launch identity (122.392348ms)
+✔ task action subjects and linked decision trail are complete and ordered (139.45294ms)
+✔ launch binding is durable and reconnecting requires the identical trusted record (79.252704ms)
+✔ business isolation includes inherited object names and cross-business message references (143.822649ms)
+✔ authority never transfers between action, target, unresolved or replaced role holder; a later run of the instance keeps it (202.665767ms)
+✔ task projection uses schema current view, skipping earlier and equal-start polls (111.863839ms)
+✔ revocation permanently bars the old run from reclaiming first, including after broker restart (179.781773ms)
+✔ empty message references refuse before storage; refusal-evidence failure stays a typed error (95.934805ms)
+✔ both arbiters require human resolution when their cross-role route is themselves (103.320401ms)
+✔ the shipped coder role raises task.reassign as gated to the human; task.scope.change stays cross-role (76.002419ms)
+✔ gated approval authorizes once, survives store reopen, and fresh approval works (189.141076ms)
+✔ another run of the same instance consumes an approval once; a failed check leaves it usable (173.647325ms)
+✔ two scheduled callers have exactly one grant and one consumed refusal (118.292ms)
+✔ failed commit rolls consumption back; cross-role consumes and within-role stays reusable (251.212772ms)
+✔ class drift gated to cross-role refuses before consumption (176.113983ms)
+✔ class drift cross-role to gated refuses before consumption (179.348117ms)
+✔ class drift gated to within-role refuses before consumption (153.105522ms)
+✔ class drift cross-role to within-role refuses before consumption (191.044926ms)
+✔ class drift within-role to gated refuses before consumption (136.2847ms)
+✔ class drift within-role to cross-role refuses before consumption (143.335641ms)
+✔ message.send consumes approval and prevents a later send or authorize (169.425837ms)
+✔ role.revoke consumes approval and prevents a later revoke or authorize (210.511904ms)
+ℹ tests 33
+ℹ suites 0
+ℹ pass 32
+ℹ fail 1
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 2358.64249
+
+✖ failing tests:
+
+test at packages/bus/tests/approval-binding.test.mjs:156:1
+✖ REQ-DEC REQ-THREAD-1 a thread decision is superseded only from the same thread (179.041639ms)
+  AssertionError [ERR_ASSERTION]: Missing expected exception.
+      at TestContext.<anonymous> (file:///home/jwoltje/dewey-scratch/r136/wt/packages/bus/tests/approval-binding.test.mjs:162:10)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
+      at Test.postRun (node:internal/test_runner/test:1542:19)
+      at Test.run (node:internal/test_runner/test:1467:12)
+      at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) {
+    generatedMessage: false,
+    code: 'ERR_ASSERTION',
+    actual: undefined,
+    expected: { code: 'supersede-refused' },
+    operator: 'throws',
+    diff: 'simple'
+  }

agents/dewey/work/queue-136/mutants/M4-authority-role.log

@@ -0,0 +1,61 @@
+✔ REQ-DEC an approval outlives its run and a broker restart; a new run of the instance consumes it once (223.739997ms)
+✖ REQ-DEC another instance of the same definition cannot consume an approval, and its refusal consumes nothing (149.001666ms)
+✔ REQ-DEC REQ-THREAD-1 a thread approval is consumed only by a run holding the same thread (209.295442ms)
+✔ REQ-DEC a later run of the same instance supersedes an open decision; another instance cannot (197.100033ms)
+✔ REQ-DEC REQ-THREAD-1 a thread decision is superseded only from the same thread (221.874663ms)
+✔ launch identity is stamped, payload identity is refused and stale holder cannot send (138.657733ms)
+✔ decision classes route from policy; gated resolution is human-only, choice and target must match (212.190531ms)
+✔ claim exclusion, holder release, gated revoke and rerouting to a new holder are atomic (221.873991ms)
+✔ launch events require a human CLI capability; generic emit cannot forge authority events (150.38871ms)
+✔ within-role decisions close atomically and invalid options or blocking omissions refuse (163.056398ms)
+✔ a recommendation that is not exactly one option key refuses invalid-recommendation after the options (213.930772ms)
+✔ observer capabilities read human inbox but cannot mutate or forge launch identity (130.874382ms)
+✔ task action subjects and linked decision trail are complete and ordered (145.184232ms)
+✔ launch binding is durable and reconnecting requires the identical trusted record (84.630916ms)
+✔ business isolation includes inherited object names and cross-business message references (146.176104ms)
+✔ authority never transfers between action, target, unresolved or replaced role holder; a later run of the instance keeps it (230.313738ms)
+✔ task projection uses schema current view, skipping earlier and equal-start polls (113.356839ms)
+✔ revocation permanently bars the old run from reclaiming first, including after broker restart (179.467801ms)
+✔ empty message references refuse before storage; refusal-evidence failure stays a typed error (103.026436ms)
+✔ both arbiters require human resolution when their cross-role route is themselves (108.944715ms)
+✔ the shipped coder role raises task.reassign as gated to the human; task.scope.change stays cross-role (80.289323ms)
+✔ gated approval authorizes once, survives store reopen, and fresh approval works (195.068814ms)
+✔ another run of the same instance consumes an approval once; a failed check leaves it usable (185.163115ms)
+✔ two scheduled callers have exactly one grant and one consumed refusal (125.429455ms)
+✔ failed commit rolls consumption back; cross-role consumes and within-role stays reusable (281.171245ms)
+✔ class drift gated to cross-role refuses before consumption (186.806445ms)
+✔ class drift cross-role to gated refuses before consumption (191.090811ms)
+✔ class drift gated to within-role refuses before consumption (171.14842ms)
+✔ class drift cross-role to within-role refuses before consumption (182.472859ms)
+✔ class drift within-role to gated refuses before consumption (156.146976ms)
+✔ class drift within-role to cross-role refuses before consumption (155.988417ms)
+✔ message.send consumes approval and prevents a later send or authorize (182.683616ms)
+✔ role.revoke consumes approval and prevents a later revoke or authorize (210.487122ms)
+ℹ tests 33
+ℹ suites 0
+ℹ pass 32
+ℹ fail 1
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 2487.886601
+
+✖ failing tests:
+
+test at packages/bus/tests/approval-binding.test.mjs:110:1
+✖ REQ-DEC another instance of the same definition cannot consume an approval, and its refusal consumes nothing (149.001666ms)
+  AssertionError [ERR_ASSERTION]: Missing expected exception.
+      at TestContext.<anonymous> (file:///home/jwoltje/dewey-scratch/r136/wt/packages/bus/tests/approval-binding.test.mjs:116:10)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
+      at Test.postRun (node:internal/test_runner/test:1542:19)
+      at Test.run (node:internal/test_runner/test:1467:12)
+      at async startSubtestAfterBootstrap (node:internal/test_runner/harness:387:3) {
+    generatedMessage: false,
+    code: 'ERR_ASSERTION',
+    actual: undefined,
+    expected: { code: 'decision-mismatch' },
+    operator: 'throws',
+    diff: 'simple'
+  }

agents/dewey/work/queue-136/packet-manifest.sha256

@@ -0,0 +1,31 @@
+96486c839ba6f1c8512a8e3ac172b16eba44cd076d97652a11798e279fa56bc6  ./BUILD.md
+1bebdff0848e9dacd9058feba68df0909cf3521055688783a2e839af1fab36c2  ./MUTANTS.md
+e43ab5963fcb83d7acbc51ab88d0dc94b1fde202bd7a80fd731b103fc163ca26  ./base.txt
+ccb9265e8245b564e1050638c4529659d86e3ac25934d1bbbc9b3d461c4fdf97  ./build.patch
+38b0d3cda5b7f69a0a4c60fc0434c66ba8cc8e7b834fcb865383dd2ee6d711e8  ./candidate-manifest.sha256
+7923b95f7fcb71f9a2bd134b3b774390b7f680a56b535ae60bb75b0bd2f66695  ./gate-run.log
+bcbd59b91295deee20c4abdcf687c56ed146d36a411bb0c8a88f537bc0329d98  ./gate.sh
+de52b77bc78142bb61cf55c03923438d6e7dccf65bb6797a960633b18197cccb  ./gate/pkg-bus.log
+ded2afa4de8cb85d842e615f2988fe43ce4ed1a53f80f1fc7f11b518cc7d0048  ./gate/pkg-cli.log
+946b0cca7733a9eb6fa02606102f1a319c27d795343361fd946af2d805783f1c  ./gate/pkg-harness.log
+53bfe5532d7a0677f46caf1e1f7683c239cf13aee90d5ddbf151199c66a09655  ./gate/pkg-plugins.log
+88f7d6916599858a19a1f470a6f38bab569a1059dd9efc9198e917ccd2178efd  ./gate/pkg-seat.log
+3b7de3729a8749e00a24df4a2510aeeba09adf71376c7254c4d442ffcc0d023a  ./gate/pkg-tasks.log
+79eea9695c9a89c37aeef632faa5b33192b7c5261f1c4c7f5dd08173e1ed2be6  ./gate/pkg-webui.log
+f91fc95a173339137f981e24fbf630acfde957e32c3cd71e28304532083c6a77  ./gate/test-auth.log
+48f2a368e8b2098011fab954ad66fa41d15f8f3dad0ffbb880f1ad57c244320e  ./gate/test-conductor.log
+52d211444489ea729dafc3c9745d4474d9dfd50f41055cbad792424197f04073  ./gate/test-config.log
+87d2e24ce0be7586e31ea1f2c9ce5618b3127515b3c3cd3893f2a0ed899d5822  ./gate/test-discord.log
+5f3c5c8baed4c1d5db925811e77a683e5f6a258b568ff6711b740fa4b852e066  ./gate/test-extension-package.log
+83dfaa21c4e4ad941088efab3f69e87ebd2f6bd3cc72ede938e21dc06da8a34f  ./gate/test-foundation.log
+8e2254aa3e1bb9b205ab72c68273d447c0328c9f156ccba2a46f3a0476468b58  ./gate/test-land-work.log
+508098358a718c7a7fd13991c58d461370f8f3fbf6e84ded452a731df1c2d1f2  ./gate/test-queue.log
+fa832794ee35025fb4559d58d01a270f6bff2eb65e863e9075b797f47fa68545  ./gate/test-release.log
+ccea37f4ffde1f160dcd1a1864988083a645d974e892065c956b338d0f8c853a  ./gate/test-task.log
+2d394f587383f392b19b72f9fc8406151e35e159bb47b1d02bfe18528efcb0db  ./mutants-run.log
+c3fd873bbff1e02d96077cb929cec658fe3ad86aee86623d040e7be5f1c52661  ./mutants.py
+a51885be82ee83dcdc7ac2da3eb99875716743eb0b168b5e590ddeb42a0724fd  ./mutants/M1-authority-thread.log
+3da9b1521bfd02adf26ba9123892b480b21483ece8e96111c49d766baa9c29e7  ./mutants/M2-supersede-role.log
+906c0aeeaa019d5be198aabee682cb8beb642446ea3970305cc55000222c5a49  ./mutants/M3-supersede-thread.log
+8c65488ea979c0fe478f80339bbe5729f3bd4e2cb0082a4e050eaaea18b5cf75  ./mutants/M4-authority-role.log
+fad2c71e750283cfff680cd6b627ccad0298fb9299435695d6499f9595fa59ac  ./repro.sh

agents/dewey/work/queue-136/repro.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+# Row 136: apply build.patch to a detached worktree at base.txt and check the candidate manifest.
+# Usage: repro.sh <canonical checkout> <new worktree path>
+set -euo pipefail
+HERE=$(cd "$(dirname "$0")" && pwd)
+REPO=$1 WT=$2
+git -C "$REPO" worktree add -q --detach "$WT" "$(cat "$HERE/base.txt")"
+git -C "$WT" apply "$HERE/build.patch"
+(cd "$WT" && sha256sum -c --quiet "$HERE/candidate-manifest.sha256") && echo DIGESTS_OK