From dba33aaf60387e9468dfacbb543fd3dd7961714d Mon Sep 17 00:00:00 2001 From: Jason Woltje Date: Tue, 20 Oct 2026 14:54:11 -0500 Subject: [PATCH] webby: Case 2 design r5 review (#416), approve, and session line --- agents/webby/work/case2-r5/REVIEW.md | 21 +++++++++++++++++++++ docs/SESSIONS.md | 1 + 2 files changed, 22 insertions(+) create mode 100644 agents/webby/work/case2-r5/REVIEW.md diff --git a/agents/webby/work/case2-r5/REVIEW.md b/agents/webby/work/case2-r5/REVIEW.md new file mode 100644 index 000000000..4a097ccfd --- /dev/null +++ b/agents/webby/work/case2-r5/REVIEW.md @@ -0,0 +1,21 @@ +# Webby review: Case 2 design r5 (Vikunja #416) + +Webby, 2026-10-20T19:54Z (from `date -u`). Author: Gosalyn. Subject: `agents/gosalyn/work/case2/DESIGN.md` at +e1635308b on gosalyn/case2-design (parent 5fc296e70), blob fd5df75ce635, sha256 9ba4f965...2d22d (verified). +Read as the diff from r4 (my REVIEW at 0597cc198), with the code at 9ae8c73ac. Static review. I ran nothing. + +## Verdict: APPROVE + +- r4 B1 is fixed. Section 4 (DESIGN.md:555-557) says `limits.set` and `organization.set` take the same + keys and reach the same `set()`, and that the check keys on the actor. I re-read + packages/bus/src/broker.mjs:1248-1251 and :1284 at 9ae8c73ac, and they match. The `instances` case + (:565-566) names both verbs. The `models` case (:568-573) now refuses unless the actor is the human, and + its test has her `limits.set` change to Bean's key working next to the chief's refusal. M10 (:665) and + C2-08 (:899) carry the same case. The r3 Changes entry (:44-45) records the correction rather than + deleting the old claim. No stale "agent-only" or "by hand" claim is left (grep). +- r4 N1 is fixed. :535-537 covers the missing file, the check is `[ -r ]`, and C2-08 tests a missing and + an unreadable prompt file. +- r4 N2 is fixed. C2-13 (:905) runs one marker prompt through the host's claude with + `--system-prompt-file` and checks that it replaces the default prompt. + +No new findings. Section 10 step 1 stays on hold per mos-1050. That isn't mine to clear. diff --git a/docs/SESSIONS.md b/docs/SESSIONS.md index 851173858..adce90ff4 100644 --- a/docs/SESSIONS.md +++ b/docs/SESSIONS.md @@ -1378,3 +1378,4 @@ are never rewritten or removed; corrections are new entries. 2026-10-20T19:44:59Z | Webby (Opus 5.5, reviewer seat) | row 198 design rev 5 for Bushroot (#1696, DESIGN.md sha256 1503f764 at 3f71b359b), static | APPROVE, N1 (write, bump, scan order); notes agents/webby/work/queue-198/REVIEW-r5.md 2026-10-20T19:49:56Z | Webby (Opus 5.5, reviewer seat) | row 192 r1 candidate 83b32d8d8 for Launchpad (#1690, manifest 3ad2a73d...badab), static plus a node probe of returnPath | CHANGES: B1 open redirect after sign-in via dot segments (sso.mjs:200-206, :284); N1-N5; notes agents/webby/work/queue-192/REVIEW-r1.md 2026-10-20T19:52:33Z | Webby (Opus 5.5, reviewer seat) | Case 2 design r4 for Gosalyn (#416, 5fc296e70 blob 7c62c40cbbb5), static | CHANGES: B1 human reaches launch.models via limits.set (DESIGN.md:29-30, :545-548), test missing; r3 B1 fixed; N1-N2; row 192 r1 recorded in queue rev 2303 (comment 29553); notes agents/webby/work/case2-r4/REVIEW.md +2026-10-20T19:54:11Z | Webby (Opus 5.5, reviewer seat) | Case 2 design r5 review for Gosalyn (#416, e1635308b), static | APPROVE, r4 B1 N1 N2 fixed; notes agents/webby/work/case2-r5/REVIEW.md