From d46b6d6ef6ce762d67b021b0add25e70d0b2634d Mon Sep 17 00:00:00 2001 From: Jason Woltje Date: Thu, 22 Oct 2026 13:47:42 -0500 Subject: [PATCH] Row 286 C2-03b: sage-2928 rulings (sh helper, chief by roles definition, departure noted) --- agents/ludwig/work/queue-286/BUILD.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/agents/ludwig/work/queue-286/BUILD.md b/agents/ludwig/work/queue-286/BUILD.md index f57f2dda2..1406d2941 100644 --- a/agents/ludwig/work/queue-286/BUILD.md +++ b/agents/ludwig/work/queue-286/BUILD.md @@ -157,3 +157,17 @@ N2: `[remote rejected]`, a hook refusal, is `library-push-failed`, not a race. O neither, so it doesn't match. N3: `fetchCredential` reads the store, so it is the bus's choice function, not a pure one. + +## Rulings sage-2928 + +- Q1: Dewey's fix, in sh. On dragon-lin `/bin/sh` is bash, and GNU coreutils stat 9.11 gives + `stat -L -c '%d:%i %u %a %s %F' /dev/fd/3` on an open fd. Checked at 18:47Z with a scratch file, not + the repo. The helper runs as git's child in the bus process, not under bwrap. T5b stages the swap with + the PATH stat shim. If a run shows the swap can't be staged reliably, BUILD.md names M2, which drops the + fd compare, and it gets killed. +- Q2: chief by `roles[*].definition === 'chief-of-staff'`. The blanket refusal applies only with no such + entry. Departure from the brief's "an install that runs before C2-21 still syncs", accepted in + sage-2928: it refuses rather than widens, and every install enrolls the chief at initial configuration + (F40, Q226). The refusal's message names the fix: "add the chief of staff, or grant the library + through C2-21". +- N1: as above.