row 202: manifest for Duckworth review (FED R5)

agents/quackerjack/work/queue-202/MANIFEST.md

@@ -0,0 +1,35 @@
+# Row 202 manifest: FED R5, mosaic access list, grant, revoke
+
+Commit: 030809e15 on quackerjack/fed-r5 (base: R1 at 80fe31071, merged; 44e36fc4c on top, pyc only).
+Owner Quackerjack, reviewer Duckworth, gate owner Sage. Brief: docs/plans/2026-10-20_federation-r1-r2-r5.md, Brief: FED R5.
+
+## Files (sha256 of the blob at 030809e15)
+
+```
+42958364617e7c0f0daac7a487cf68c74753f3a141b2daa80f8a1e5ede1ef03a  packages/cli/src/access.mjs
+19981c6d46a2c3e1490fdbe017d948ea8f980ececa4a7917716852eebdfdab92  packages/cli/src/cli.mjs
+e5cd9158e1c65280c5c35d4c83aee7739b3308ddc853b1bc4575cfb121fc2f5e  packages/cli/tests/access.test.mjs
+57091e13a0e7e7789af6e34645cf9624075dd98c41afb7ee3e539ada00c5134d  packages/cli/README.md
+aeddef32c28c883eedf166bcac96d1e6828b71c862e683977e097706339baf86  scripts/mosaic
+2d7f1595d1070443a5afaf665259d7e7428f407f74e75378d500317b6aa2bdb3  agents/quackerjack/work/queue-202/BUILD.md
+```
+
+## Interface used from R1 (80fe31071)
+
+checkAccess(doc, { providers, peers, businesses, ssoSubjects }), loadBusiness, accessFilePath is not used (the CLI takes configDir), covers is not used by R5. BusinessError is caught and re-thrown as exit 2.
+
+## Named in review
+
+- Human proof: one project.list call (proveHuman, access.mjs). Gate: packages/bus/src/broker.mjs:2319 (project.list case) and :377 (#human).
+- Lock: <configDir>/access.json.lock, 0600, pid stamp, stale reclaim on ESRCH, see BUILD.md.
+- Pinned bus behavior: failed proof reads as outcome-unknown (client.mjs:32-33). Outside R5.
+- Context: accessContextFor; peers [] until row 203; subjects flattened from console.sso.providers[].subjects.
+
+## Tests and mutants
+
+- packages/cli/tests/access.test.mjs: 18 tests, single file green on 030809e15.
+- Mutant list M1-M10 in BUILD.md, run on Sage's go. Known gap: atomic-rename failure is not tested (BUILD.md).
+
+## Not in this row
+
+R2 peers, R4 access.reload, row 192 checkConsole, cli suite and scripts/test-*.sh (Sage's gate).