plans: machine grant rows a (#1740, schema 3i-3j) and b (#1741) briefs from design r6 f9039682e; 193b2 moves to schema 3j-3k after row a

docs/plans/2026-10-20_host-credentials.md

@@ -68,3 +68,42 @@ Tests use scratch sshd fixtures on 127.0.0.1 or fakes, never a real host.
 Duckworth approves DESIGN.md, then the manifest. The bus, business and cli suites and every
 `scripts/test-*.sh` are green on Sage's gate, and the mutants are killed (one per refusal, plus one that leaks
 the key into the agent's output and one that skips the host key pin).
+
+## Machine grant row a: enrollment, store records and migration 3i-3j
+
+Sage, 2026-10-20, for Vikunja P19 #436 (#436a), mos-1141 and mos-1143. Owner Gizmoduck, reviewer Duckworth,
+gate owner Sage. The design is `agents/gizmoduck/work/machine-grant/DESIGN.md` r6 at f9039682e on
+`gizmoduck/machine-grant-design`, which Duckworth approved for code once row 210 lands (duckworth-0063,
+mos-1141). It is not reopened here. Section 12 Q-S4 defines the split. Estimate 1.5 days. Gitea #1740.
+
+Row a ships enrollment as the approved request (section 3), the four `tools/host` files, the store records
+and their migration `3i-3j.sql` (section 5), `host.run` reading the records, and `hosts status`. It also
+moves row 210's tests onto the store. Every grant name is under `grant.*` behind one guard, as
+`action.allowed` bodies (mos-1144, gizmoduck-0086, duckworth-0065 O1). No agent creates a grant (Q188).
+
+Order and timing:
+- It builds on row 210's landing, after row 199 (mos-1135, mos-1137).
+- This row owns `SCHEMA_VERSION` 3j. Any other row with a schema step goes 3j to 3k or later and rebases
+  onto this row's landing (row 206, 193b2).
+- It lands by 10-25 and before the .53 and .54 installs (mos-1134, mos-1145). Sage flags a slip past 10-25
+  to Mos. Live on dragon-lin comes in the one 10-24 window with rows 190, 199 and 210, as an agent-run
+  `--migrate` under Q173, backup first (mos-1145 line 9). The run sheet strips row 210's `hosts` keys and
+  role grants from the business file before that re-pin (design r5 N9).
+- It needs the PRD 1.8 line before landing (Q-S4).
+
+Gate: Duckworth approves the manifest. The bus, business and cli suites and every `scripts/test-*.sh` are
+green on Sage's gate. The design's section 10 tests and mutants for row a pass, the migration test included.
+
+## Machine grant row b: raise binding, executor, reconcile and revoke
+
+Same owner, reviewer, gate owner and design as row a. Estimate 1.75 days. Chained on row a's landing.
+Gitea #1741.
+
+Row b ships the raise binding, the executor (section 5), reconcile, and revoke with the `hosts.revoke`
+verb and its marker (section 6), plus row 210's per-call decision as manual mode (section 7). After step
+5 commits, the executor ignores an abort, and both undo paths update only an existing record (r6 C1, X3,
+X5). At start, after the grant reconcile, the bus unlinks every `host.<id>` key file that has no
+`host_grants` record (r6 N1, G27). It adds no schema step. If it needs one, Sage re-briefs it first and
+assigns the next free step (row 206 holds 3j to 3k).
+
+Gate: as row a, with section 10's row b tests and mutants, G27, G28 and the upsert mutant included.

docs/plans/2026-10-20_human-users-build.md

@@ -42,10 +42,11 @@ and mutants 1, 3, 6, 10, 11 and 12 from section 8.
 Gate: Duckworth approves the manifest. The bus suite and every `scripts/test-*.sh` are green on Sage's gate,
 and the mutants are killed.
 
-## Brief: 193b2, thread shares (schema 3j)
+## Brief: 193b2, thread shares (schema 3k)
 
 Chained on 193b1. `thread_shares`, the share verbs, the share rules of `#readable` and `#threadRead`, and the
-section 5.5 share filters. Schema 3i to 3j. The table is append-only, and row 181's restore guard and
+section 5.5 share filters. Schema 3j to 3k (Sage, 2026-10-20: machine grant row a owns 3i to 3j, so
+this row builds on row a's landing). The table is append-only, and row 181's restore guard and
 `COUNTED` include it. Bus tests for shares and the migration, and mutants 2, 4, 7, 8 and 9 from section 8.
 Going live needs a `--migrate` window with Jason. Sage takes it to Mos when this row is near.