row 234 (#1740): G10 row for a cli yes by a non-human, and mutant A3b on the by check alone (duckworth-0083 N8)

agents/gizmoduck/work/queue-234/BUILD.md

@@ -108,6 +108,7 @@ Row a, killed on this row's tree:
 | A1 | drop the chief check |
 | A2 | start the executor on a `credential.mint` with no `grant` |
 | A3 | start it on an arbiter resolve |
+| A3b | start it on a `cli` yes by someone other than the human (duckworth-0083 N8) |
 | A4 | start it on `no` |
 | A5 | skip the keyscan compare |
 | A6 | compare only one key |

packages/bus/tests/grant-enroll.test.mjs

@@ -279,10 +279,16 @@ test('G10 (duckworth-0081 B1): a second start for a spent decision refuses decis
   assert.equal(await f.broker.runEnrollment('demo', open.id), 'not-authorized');
   f.store.run('INSERT INTO decision_events(decision,at,op,by,choice,via) VALUES(?,?,?,?,?,?)', open.id, new Date().toISOString(), 'resolved', 'chief', 'yes', 'broker');
   assert.equal(await f.broker.runEnrollment('demo', open.id), 'not-authorized');
+  // A cli yes by someone other than the human, so the by check alone refuses it (duckworth-0083 N8, A3b).
+  const other = await f.raise({ host: 'web3' });
+  f.store.run('INSERT INTO decision_events(decision,at,op,by,choice,via) VALUES(?,?,?,?,?,?)', other.id, new Date().toISOString(), 'resolved', 'chief', 'yes', 'cli');
+  assert.equal(await f.broker.runEnrollment('demo', other.id), 'not-authorized');
   assert.deepEqual(f.broker.reconcileGrants(), []);
   assert.deepEqual(f.grantEvents(), before.events);
   assert.equal(f.hostRow('web2'), undefined);
   assert.equal(existsSync(f.keyFile('web2')), false);
+  assert.equal(f.hostRow('web3'), undefined);
+  assert.equal(existsSync(f.keyFile('web3')), false);
 });
 
 test('A8, S1: two approved enrollments for one host: the second ends host-enrolled and the pin stays', async (t) => {