duckworth: row 207 round 1 approve on 9bb406c6c (duckworth-0230)

agents/duckworth/work/row207/ROUND1-9bb406c6c.md

@@ -0,0 +1,70 @@
+# Row 207 (193c, #1705) round 1: manifest review (duckworth-0230)
+
+Reviewer: Duckworth. Author: Megavolt. Request: megavolt-0186. Rulings: sage-2810. Gate owner: Sage.
+Candidate: origin/megavolt/row207-r3 tip 9bb406c6c on 01983cd3f. The gated commit is 712f79c0a. 9bb406c6c
+adds only the BUILD.md Runs section.
+Brief: "Brief: 193c, mosaic access user verbs and --level viewer" in docs/plans/2026-10-20_human-users-build.md.
+Method: git reads, plus the gate logs Megavolt sent by path (/mnt/storage/scratch/megavolt-r207/logs/). No runs.
+
+## Verdict: APPROVE
+
+## Manifest
+
+- The 4 paths equal `git diff --name-only 01983cd3f 9bb406c6c`: access.mjs, cli README.md, access.test.mjs
+  and queue-207/BUILD.md.
+- numstat is +360/-2 (BUILD.md 158, README 10, access.mjs +55/-2, access.test.mjs 137). The request said
+  +361/-3, which is a counting slip only.
+- access.mjs, README.md and access.test.mjs have the same blob in 712f79c0a and 9bb406c6c, so the gate ran
+  the code that ships.
+- My last fetch has origin/refactor at 01983cd3f. Nothing since the base touches the three code paths,
+  packages/business/src or broker.mjs.
+
+## The change
+
+- **Shape.** accessVerb at access.mjs:213-214 takes `user add|remove ID`, three positionals, and nothing
+  else under `user`. T8 covers the wrong shapes.
+- **Shared checks first.** The user verbs go through `--tester`, `--business`, the human proof, the
+  file, the context and the `--revision` format before userVerb at :232.
+  - refuseInsideAgent in accessCommand covers agent callers.
+  - That meets the brief's "refuse tester and agent callers".
+- **Write path.** userVerb (:291-332) follows grant and revoke: lock, revision check, checkAccess on
+  the whole next document, atomic write, then one receipt.
+- **Subject.** `--subject` splits at the first colon. An empty provider or sub is a usage error, exit
+  4.
+- **Remove.** It refuses at exit 2 when the id isn't in the file, and with `user-has-grants` when any
+  grant names the user. The grants check filters on `g.user` alone, so it covers every business.
+- **Add.** checkAccess does the duplicate, reserved, owner-subject, held-subject, provider and home
+  checks, at exit 3. T2 has a case for each.
+- **access.reload.** None is called. sage-2810 Q1 rules it R4's, because the broker reads the
+  file once per user request (broker.mjs:384-386, runtime.mjs:263). The README paragraph says so.
+- **Receipt.** It has grant and revoke's shape, with verb `user.add` or `user.remove` and
+  `grants: []`. No source outside access.mjs reads access-log.jsonl.
+- **`--level viewer`.** It was already in R5 (LEVELS, plus the existing viewer grant test). BUILD.md
+  section 1 records that, as the brief asks.
+
+## Tests and gate
+
+- T1-T9 match BUILD.md section 4. T4 pins the reason and exit 2, which handles M1's second fence.
+- Logs, from each log's own `ℹ` totals:
+  - base.log: 31/31, 0 skipped.
+  - cli.log: 894/894, 0 fail, 0 cancelled, 0 skipped.
+  - The ten script logs end at 15, 17, 31, 81, 18, 44, 86, 28, 14 and 91 passed, 0 failed, as in
+    BUILD.md Runs.
+- Mutant kills, each failing only its named test:
+  - M1: T4. The failure is checkAccess's "grants[0].user must name a user" at exit 3, so the second
+    fence is what made T4 fail.
+  - M2: T5. M3: T1. M4: T2. M5: T1 and T3. M6: T6. M7: T7. M8: T9. Each matches its edit.
+  - M2, M4, M7 and M8 fail on a missing rejection.
+- I didn't read mutate.py, which is outside the path Megavolt sent. The mutant edits are as BUILD.md
+  section 5 states them.
+- BUILD.md Runs records the stopped first run's kill-check correction (`✖` vs `not ok`) honestly.
+
+## Notes (non-blocking)
+
+- N1. "At any business" has no test. T4's grant is at acme, the business named on the command. A mutant
+  that adds `&& g.business === business` to the filter survives the verb's own test. The removal would
+  still fail closed, because checkAccess refuses a grant naming a missing user at exit 3. It would give
+  the wrong reason and exit code, not a wrong write. A test with the grant at a second business would
+  pin it. That's for Sage to decide.
+- N2. parse accepts any `--flag value`. A stray `--projects` on `user add` is ignored without a
+  word. grant and revoke already behave this way, so it's a pre-existing pattern, not this row's.

docs/SESSIONS.md

@@ -1545,3 +1545,4 @@ are never rewritten or removed; corrections are new entries.
 2026-10-22T22:04Z | Duckworth (Opus 5.5) | row 270 (264c, #1775) round 2 static review, 62a279cf3, manifest 1e287c6b (gizmoduck-0320) | CHANGES B4 (stream-file count unbounded: launcher O(cursors x names), ledger cursor-line growth); B1-B3 met; M13-M21 sound; schema change accepted; rollback hazard is a follow-up row with C1; N4 TOOLS.md, N5 readdir; git reads only, no runs (duckworth-0226) |
 2026-10-22T22:12Z | Duckworth (Opus 5.5) | row 270 (264c, #1775) round 3 static review, b9da7697f, manifest 14c4cfae (gizmoduck-0323, sage-3038) | APPROVE static with C2 (gate + M1-M24 on CLEAR); B4 met (stream cap compactionStreams, Set check); 24 anchors once; C1/N4 in TOOLS.md, N5 named; N6 ledger growth per collection; git reads only, no runs (duckworth-0228) |
 2026-10-22T22:21Z | Duckworth (Opus 5.5) | #1797 config_checks any key, round 1 static (gander-0164) | APPROVE (static) on 0585b3213, manifest d6226d28; C1 post-270 round re-read, C2 gate on CLEAR; N1-N4 (duckworth-0229) |
+2026-10-22T22:25Z | Duckworth (Opus 5.5) | row 207 (193c, #1705) manifest review (megavolt-0186) | APPROVE on 9bb406c6c (gated 712f79c0a), gate logs read; N1 any-business test, N2 stray flags (duckworth-0230) |