row 285: webby-0178 early read, drop the stale creative publish comment and name the example's test readers (#1790)

agents/scrooge/work/queue-285/BUILD.md

@@ -80,7 +80,10 @@ The file form also works: `{ "gitea": { "file": "<configDir>/secrets/<business>/
 
 A git grep of scripts, templates, src, tools and packages outside tests found two repo files that write a business file with a chief. Both get the gitea file reference:
 
-- `packages/business/examples/mosaic-stack.example.json:114`, the chief entry. No test reads this file.
+- `packages/business/examples/mosaic-stack.example.json:114`, the chief entry. Two test files read it (corrected after webby-0178 B2):
+  - `packages/business/tests/business.test.mjs:256`, "the shipped example refuses as written and validates once filled in". It replaces `/home/you` with its tmp root and checks the role list and the sync token path. The chief's new file ref goes through the same replacement.
+  - `packages/cli/tests/stack-release-fixture.mjs:351` (EXAMPLE, through `biz()`). It fills botId and the dates but keeps the `/home/you` token paths, as it already does for the other roles' refs. Its readers are stack-release.test, stack-release-external.test and stack-upgrade.test.
+  - All four test files run whole at the gate.
 - `packages/business/README.md:174`, the chief example line, plus the prose at :163 and :183 that said the chief holds no credentials.
 
 No script, template or case installer writes a chief or creative instance. `scripts/case1-accept.sh` only talks to `chief`.
@@ -115,11 +118,12 @@ Webby (webby-0174) passes each item only with Mos's ruling key next to it.
    - APPROVED.credentials (:24). Old: `[]`. New: `[{service: "gitea", scopes: ["read:repository", "read:user"]}]`.
    - The resolved-record test (:90). Old: `{}`. New: `{gitea: {service: "gitea", file: <root>/secrets/chief-of-staff-gitea.token, rotateBy: FAR_DATE}}`.
    - :155. Old name: "the instance takes no credential references and no tracker", expecting "(none; got gitea)". New name: "the instance takes only the gitea credential reference and no tracker", adding a vikunja ref and expecting "(gitea; got gitea, vikunja)". The tracker refusal is unchanged.
-2. **`packages/business/tests/role.test.mjs`** (mos-1332 item 2, accepted).
+2. **`packages/business/tests/role.test.mjs`** (mos-1332 item 2, accepted). checkCreative checks the service and not the scopes (webby-0178 N1). The scopes are pinned by the load test, which deepEquals each of the six creative role files' credentials to `[{service: "gitea", scopes: ["read:user", "write:repository"]}]`, so a widened scope in any one file is red.
    - The six-creative-roles load test now pins withinRole `[message.send, library.write]` and credentials `[{gitea, [read:user, write:repository]}]` exactly. Old: `[message.send]` and `[]`.
    - The M1 block checked record.write and one crossRole case. It now loops over every routed action outside CREATIVE_ACTIONS, keeps the crossRole refusal, and adds the vikunja and host credential refusals. The refusal text changes from "may hold only withinRole message.send" to "may hold only withinRole message.send and library.write".
 3. **`packages/business/tests/agent-identity.test.mjs:49-50` (N10)** (mos-1332 item 3, option (b) widened to the creative definitions). N10 is unchanged.
    - Fence in business.mjs near :166: a chief-of-staff or CREATIVE_DEFINITIONS instance with `publish` refuses with `<at>.publish needs identity and a gitea definition (<definition> never publishes)`.
+   - The literal "chief-of-staff" follows mos-1332's wording. business/src exports no chief constant (STAFF_TO is broker.mjs:240), so I left it as is (webby-0178 N2, optional).
    - Wording: the message starts with the N10 text, so the :50 regex still matches, and the reason follows in parentheses.
    - Design line: on refactor today, a chief or creative instance with identity and publish refuses at load because neither definition declares gitea. After 285 both declare gitea for the library alone, so the fence keeps today's refusal and adds no new policy. #giteaRole refuses both at raise (mos-1163 for the creative ones, sage-2921 for the chief).
    - Grep of `packages/*/tests/*` for "needs identity and a gitea definition": only agent-identity.test :47, :48 and :50, plus the two new tests. No other reader.
@@ -185,6 +189,7 @@ Docs:
 
 - `git grep CREATIVE_KINDS -- packages roles scripts` is empty. Checked locally.
 - Grep the tests for `gitea-not-declared`, and for 64-hex pins on broker.mjs and each changed role file.
+- Run business.test, stack-release.test, stack-release-external.test and stack-upgrade.test whole, since they read the example json (webby-0178 B2).
 - Run each fixture-importing suite whole: the business suite, the bus suite, the cli suite, `scripts/test-config.sh` and every `scripts/test-*.sh`, with TMPDIR under /mnt/storage/scratch/tmp.
 - Sage confirms the result against mos-1309 item 5.
 

packages/business/tests/business.test.mjs

@@ -308,8 +308,6 @@ test("row 285: a chief or creative instance without credentials.gitea refuses at
   }
 });
 
-// Row 285 (C2-08b, brief): a creative instance may carry identity and publish, under the rules at
-// business.mjs:155-166, which the grant path reads. The grant itself still refuses it (#giteaRole).
 // Row 285 (mos-1332 item 3): a creative instance holds gitea and may hold an identity, but publish
 // still refuses at load with the N10 text, as before its definition declared gitea.
 test("row 285: a creative instance with gitea, identity and publish refuses at load", () => {