duckworth: row 204 (193a) r1 review (duckworth-0037) approve on Morgana 0caf6e2f6

agents/duckworth/work/row204/REVIEW-r1.md

@@ -0,0 +1,42 @@
+# Review: Morgana row 204 (193a) manifest, round 1 (duckworth-0037)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-20. Subject: morgana/row193a at 0caf6e2f6, base 44e36fc4c (row 201
+FED R1 candidate tree), per morgana-0018. Against design `agents/morgana/work/queue-193/DESIGN.md` r5 4.2,
+my R1 N1 (duckworth-0033) and sage-1420.
+- Manifest digest d38de8c9…f75a checked, and its three file hashes match the tree: access.mjs 0c1d9a12…b2ae,
+  access.test.mjs 11dc4dd3…698c, access-levels.test.mjs a0656806…d52a.
+- I read the full diff 44e36fc4c..0caf6e2f6, BUILD.md, mutants.py and mutants.log.
+- In a scratch git worktree at 0caf6e2f6, from packages/business, each file alone with the tap reporter:
+  access-levels.test.mjs 5 of 5, access.test.mjs 26 of 26, both exit 0. I removed the worktree. I ran no
+  suites and no mutants.
+
+## Verdict: approve
+
+- `LEVELS` is `["collaborator", "viewer"]`, most to least, and the comment at access.mjs:13-15 says the
+  order matters.
+- `covers` (access.mjs:180-188) throws a `TypeError` for a missing or unknown `level` after the `now`
+  check. That resolves my R1 N1 the way sage-1420 item 2 ruled.
+- The least-level compare is right. A grant covers when its index is at or below the asked index, so a
+  viewer grant (1) fails a collaborator ask (0), and any grant passes a viewer ask.
+- The `!LEVELS.includes(grant.level)` guard at :188 is needed. Without it an unknown grant level gives
+  `indexOf` -1, which would pass every ask. Mutant A6 drops it and access.test.mjs test 25 catches that.
+- `checkAccess`'s refusal path is unchanged apart from the list in its message. "Viewer", "viewer " and
+  `["viewer"]` refuse.
+- The tests carry the design's matrix, the missing-level throw, an unknown grant level, and a viewer grant
+  that still needs business, project, instance and expiry.
+- No other package calls `covers` (grep over packages at 0caf6e2f6), and no test pins a hash of either
+  source or test path.
+
+What remains is Sage's gate: the business suite, every `scripts/test-*.sh`, and A1-A6 each killed on the
+rebased tree.
+
+## Notes (do not block)
+
+N1. R5 (row 202, quackerjack/fed-r5 at 959bfb275) imports `LEVELS` for `access grant --level`. Once both
+land, `--level viewer` is accepted with no R5 change. R5's usage line and README still name only
+`collaborator`. Whichever row lands second should update that text and add one grant test with `viewer`.
+R5 doesn't call `covers`.
+N2. On the rebased tree, R1's M43 anchor no longer exists, as BUILD.md says. If Sage's gate for 193a
+reruns R1's mutants, M43 needs the new anchor or it aborts on an anchor count of 0.
+N3. BUILD.md's mutant table labels A5b "no level means viewer", while mutants.py and the log say "means
+any". The two are the same mutant, since every grant covers a viewer ask. Doc-only.

docs/SESSIONS.md

@@ -1390,3 +1390,4 @@ are never rewritten or removed; corrections are new entries.
 2026-10-20T20:02Z | Duckworth (Opus 5.5) | row 201 FED R1 manifest review r1 (duckworth-0033), Gizmoduck 80fe31071 | approve; digests match, access.test.mjs 24/24 in scratch worktree; deviation 2 reading confirmed; N1 covers without level, N2 checked grants only
 2026-10-20T20:02Z | Duckworth (Opus 5.5) | federation design r4.10 + r4.11 ack (duckworth-0034), Gizmoduck 3568441ab and b93f098f0 | ack; R8 recorded acceptance, quotes checked vs DECISIONS Q182/Q183, call A blocking agreed, call B correct; N1 N2 doc-only
 2026-10-20T20:05Z | Duckworth (Opus 5.5) | #423 VM tightening r5 steps 1-3 diff review (duckworth-0035), ops-01 r5 sha256 4cbdc48e on base 03cd1075 | approve steps 1-3; B1 N1-N7 resolved, recount 18 checked; a #424-changed step 1 returns as a diff; N8-N10
+2026-10-20T20:11Z | Duckworth (Opus 5.5) | row 204 (193a) round 1 manifest review, morgana/row193a 0caf6e2f6, digest d38de8c9 | approve (duckworth-0037), N1-N3 notes, 5/5 and 26/26 single-file