Untested: record R7 reload ordering and slot boundaries (#1802)

Quackerjack stops row 296 here. BUILD.md holds the verified reads, the proposed
harness design, the open decisions for Lena, and the R2 learning that R7 depends on.
No test or code changes in this commit.

BUILD-LOG.md

@@ -5412,6 +5412,9 @@ Row 299 (573, #1806, Gander, Filbert): before, the P10 band test timed a fault r
 
 2026-10-23T17:32:37Z | Gyro sage-3544 fenton-0016 N1/N2 delta | Before: W7 Gate/final real-conversion list omit the W8 build-order cross-reference and W8 human-view filtering cites agent settings. After: both locations explicitly put W8 landing before human opening as mos-1470 build order, not acceptance; comment/tracked-deletion links are not current story links and never appear in the human Connections view regardless of agent settings. New commit atop approved 5af060fb5, no amend. Static diff and append-only checks pass. Docs only, no repo Node/tests/live action. Fenton checks only this delta.
 
-2026-10-23 | Boyd | Row 298 (#1804, Q228), before implementation completion | Took over Megavolt 7a141269c on boyd/row298 at 45dca69f6 under mos-1496/1502. Approved D1-D6 govern human-only grants.scope.set, empty fallback, in-scope close/evidence and spend recheck. All inherited code UNTESTED; no Node/tests until Sage CLEAR. Plan and static gaps recorded in agents/boyd/work/queue-298/BUILD.md; no live grant or credential access.
+## 2026-10-23 — Lena, row 296 / #1802 FED R7 start
 
-2026-10-23 | Boyd | Row 298 (#1804, Q228), targeted verification | On sage-3642 T1 lane B, five whole files serial: business scope 7/0, bus scope 14/0, scope runtime 1/0, CLI scope 4/0, project runtime 3/0 (29/0, no skips). Initial bus fixture typo recorded and corrected. M1-M10 killed by named assertions, source restored and final files green. Dewey dewey-0933 positive control and notes addressed; manifest and evidence in agents/boyd/work/queue-298/BUILD.md. Full package/script gate remains Sage's. No live scope set.
+Before: R4 and R6 landed in base 45dca69f6; no scratch two-instance acceptance script.
+Plan: preserve Quackerjack handoff c6ab9bdc9, add isolated script/CLI test harness with real
+Console proof in transient user services, map assertions and two mutants for Filbert.
+Untested: all Node/tests and shared gate wait for Sage CLEAR; no production or live state changes.

agents/boyd/work/queue-298/BUILD.md

@@ -1,233 +0,0 @@
-# Row 298 (#1804, Q228): chief-of-staff grant scope
-
-Owner Boyd (48a3ae38), reviewer Dewey. Branch `boyd/row298`, base `45dca69f6`.
-Assignment: mos-1496/Q245. Handoff: Megavolt megavolt-0203, local `7a141269c`;
-cherry-picked as `4de3cec27` (design) and `7cea739de` (UNTESTED code).
-Brief: `docs/plans/2026-10-23_mvp-readiness-rows.md`, chief-of-staff grant scope.
-Megavolt's original design remains in `agents/megavolt/work/queue-298/BUILD.md`.
-
-## Authority and accepted design
-
-Sage sage-3594, restated in sage-3612: launch.grantScope, lenient read with empty
-fallback, strict human-only write. No general organization setter may write it.
-Per-method agents/projects or agents/hosts/commands; host-enroll never in scope.
-Host command arrays match whole tokens and exact lengths. `grants.scope.set`
-from the human CLI is Approve; no Console page or chief-raised scope change.
-Mos mos-1496/1502 requires the same human-shell guard as `mosaic access`.
-The broker closes an in-scope request via scope and writes grant.scope.used;
-missing evidence must refuse execution. Narrowing before spend fails
-scope-changed. Empty scope ships; only Jason sets the live value (Q188).
-
-No credential files read, no live grants, no deployment, no queue writes. Push
-only boyd/*, additive commits, no amend/force-push or attribution trailers.
-Sage owns queue, shared test slot and landing. No Node/tests before CLEAR.
-
-## Implementation plan and ledger
-
-Using writing-plans and executing-plans inline; the approved brief and D1-D6
-are the spec. This packet is the requested plan/tracking location.
-
-- [x] Read brief, roster, implementation and handoff; register session.
-- [x] Bring Megavolt's two commits onto Boyd's branch without changing history.
-- [x] Add independent CLI tests in `packages/cli/tests/grants-scope.test.mjs`:
-  scope read/set requests; agent-marker rejection before stdin/transport;
-  --tester rejection; missing revision, malformed/empty/oversize input.
-- [x] Strengthen new business/bus grant-scope tests for exact commands,
-  scope evidence binding, host-enroll exclusion and spent scope-changed.
-- [ ] On Sage CLEAR, observe targeted failures before fixes; fix inherited
-  implementation using the existing human proof and grant executors.
-- [ ] Update bus/CLI docs, append BUILD-LOG before/after evidence, manifest.
-- [ ] On Sage CLEAR run touched suites; record exact results and mutants.
-- [ ] Commit UNTESTED until verified; push boyd/row298 only when slot permits;
-  report to Sage and Dewey, cc Mos for pushes/blockers. Dewey reviews manifest.
-
-Pre-flight interfaces: business checkGrantScope/grantScopeOf/grantInScope feed
-the instance writer and broker. Runtime supplies a fresh scope from the org
-file and routes the human setter to the same organization writer. CLI callFor
-supplies refuseInsideAgent and humanTransport. The grant executors consume the
-broker's immutable close/evidence. Tests use scratch files/fake Gitea only.
-
-Review focus: exact argv length, stale scope before spend, forged/missing scope
-evidence, malformed fallback, and CLI agent ancestry. Tests must cover each.
-
-Static findings before any Boyd Node/test run:
-
-- Handoff introduced commandPrefixes beyond the accepted D2 shape, allowing
-  trailing args. Remove it; only exact command arrays are authorized.
-- scope.used carries a digest without validating it, and no org revision.
-  Bind evidence to the canonical scope snapshot and grant/close sequence;
-  preserve historical grants when scope is later changed, recheck at spend.
-- Gitea recheck throws inside the spend transaction and rolls back spend on
-  scope-changed. Preserve spend and log failure for that case (D6).
-- The optional giteaStart?. assertion always passes when the API is absent;
-  use the real runGiteaGrant entry point. Fake Gitea tokens() does exist.
-
-## Existing test changes (mos-1272)
-
-Approved by Mos mos-1510 via Sage sage-3624; edited exactly as approved:
-
-| File | Actual numstat | Reason |
-| --- | --- | --- |
-| packages/bus/tests/project-runtime.test.mjs | +1 / -1 | Vocabulary import pin adds grantScopeOf and grantInScope. |
-
-Other test work is confined to row 298's new files. No pre-existing CLI tests
-will change. Record final numstat here before review.
-
-## Human proof and organization ownership
-
-CLI: `packages/cli/src/cli.mjs` callFor runs refuseInsideAgent before constructing
-humanTransport, as `accessCommand` does. The setter takes no --tester flag.
-`packages/bus/src/human.mjs` verifyHuman checks the nonce, CLI path and every
-ancestor's markers/argv; `bindHuman` and #human in broker.mjs require the
-business human, via cli, outsideAgent true. Tests will pin this chain's caller
-refusal. The scope receipt records by/via/outsideAgent and old/new sha256.
-
-Org file: `packages/business/src/organization.mjs` regular() requires a regular,
-non-symlink file owned by the process uid and not writable by group/other;
-write() uses revision checks, locked durable receipts and atomic rename.
-The OS owner uid can edit it directly; the agent sandbox does not mount the
-user's config (`packages/seat/src/sandbox.mjs`). This is the existing cooperative
-human/process boundary, not a hostile same-uid isolation claim.
-
-Chief enrollment: broker instances.set calls #human and #mayHuman before
-add/change; credential issue/delete use #requestCredential's human gate.
-launch.by is an organization-file setting, excluded from general setters;
-only that chief may auto-approve within scope. Additional chief instances
-remain on the per-grant human approval path.
-
-## Validation
-
-UNTESTED. No Boyd Node/test run yet; waiting for Sage CLEAR.
-M1: bypass in-scope check. M2: bypass invalid-value fallback. M3: remove human
-setter guard. M4: drop grant.scope.used. All need named failing tests on gate.
-
-## Session correction
-
-The initial SESSIONS entry labels startup 19:13Z; startup was approximately
-19:08Z. Message header timestamps in boyd-0001 through 0004 were estimates;
-use T3's receipt timestamps as authoritative. Subsequent reports use date -u.
-
-## Departures from Megavolt 7a141269c (Sage sage-3624)
-
-1. Removed commandPrefixes; host scope commands match exact token arrays only.
-2. grantScope callback now supplies one organization read `{value,revision}`.
-   grant.scope.used includes that revision, canonical scope snapshot and digest;
-   #approvedGrant validates the digest, shape, method, agent and close sequence.
-   It uses the immutable snapshot so later narrowing doesn't revoke issued grants.
-3. Gitea scope-changed is caught inside the spend transaction and logs a terminal
-   failure without rolling back its spend. Other recheck failures keep their
-   existing behavior. Host already catches recheck failures after spending.
-
-Additional handoff corrections: replaced optional nonexistent giteaStart with
-runGiteaGrant; added successful host executor/revoke and enrollment-exclusion
-coverage; added real runtime writer coverage and independent CLI guard tests.
-
-Sage scheduled push at 19:41Z with MOSAIC_GITEA_CREDENTIAL_FILE unset, then T1
-lane B around 19:47Z (after explicit CLEAR), four new files whole and serial,
-hard stop 20:00Z. Fethry lane A is disjoint. No test was run early. Production
-corrections are marked UNTESTED under that slot mandate; baseline regression
-checks against the inherited implementation will run only on CLEAR.
-
-## Candidate preparation (before T1)
-
-The three static corrections, CLI/runtime coverage and docs are prepared but
-UNTESTED. `git diff --check` is clean. The approved import-pin edit is exactly
-1 addition / 1 deletion. M1-M4 are encoded in mutants.py (not run). No Node,
-https git, full suite or webui build has run in Boyd's worktree.
-
-Review package: product/test/documentation files in MANIFEST.sha256, excluding
-append-only project logs and the preserved predecessor packet. The manifest
-identifies exact bytes for Dewey; each later product change regenerates it and
-requires a review delta. Existing tests changed: only project-runtime, 1/1.
-
-## Dewey static review dewey-0933
-
-N1: Added a positive control to the malformed-evidence fixture. A valid event
-must pass scope authorization and reach decision-mismatch on the deliberately
-absent definition binding; invalid events remain not-authorized. No spend.
-N2: Additional named mutants cover spend recheck, exact argv length, Gitea spend
-rollback, launch.by eligibility and accepting any evidence row (results below).
-N3: At spend only grant scope membership is rechecked, not whether the raising
-chief is still launch.by. This implements sage-3594 Q5; changing the launcher
-later does not by itself invalidate a pending scope-approved request.
-N4: The scope shortcut returns the closed decision view to the chief without
-sending a separate close message; documented in the bus verb table.
-N5: grant.scope is logged after the organization file commit in a separate bus
-transaction. A crash between them leaves durable changes.jsonl as the receipt,
-as with other organization writers. The setter does not claim cross-store
-atomicity.
-
-## T1 lane B results (sage-3642, 2026-10-23 19:23Z–19:29Z)
-
-TMPDIR: `/mnt/storage/scratch/tmp/boyd298-4bzr6fn7`. Each whole file ran serially
-as `timeout -k 10 180 node --test --test-concurrency=1 FILE`, TMPDIR set to that
-scratch directory. Final restored candidate results:
-
-| Whole file | Pass | Fail | Skip |
-| --- | ---: | ---: | ---: |
-| business/tests/grant-scope.test.mjs | 7 | 0 | 0 |
-| bus/tests/grant-scope.test.mjs | 14 | 0 | 0 |
-| bus/tests/grant-scope-runtime.test.mjs | 1 | 0 | 0 |
-| cli/tests/grants-scope.test.mjs | 4 | 0 | 0 |
-| bus/tests/project-runtime.test.mjs | 3 | 0 | 0 |
-
-29/0/0 total. `final-1.log` through `final-5.log` hold the final output. The
-runtime's reload-needs-restart notice is expected: the fixture's boot document
-has fewer credential references than its organization document, as in the
-existing instances runtime tests. No credential contents are loaded from the
-real user config.
-
-Initial run: business 7/0; bus 13/1 due to Boyd's test typo, an out-of-scope
-`opts` reference in the missing-scope assertion. Corrected only that new-test
-line, then bus 14/0 and the remaining files green. Dewey N1 positive control
-was added and the whole bus file passed again; final rerun above followed all
-mutants. No production code changed during this test window.
-
-Mutants: all whole files, serial, with timeout -k 10 and the same TMPDIR.
-`mutants.py --sage-clear sage-3642 --logs SCRATCH/review-mutants --deadline
-2026-10-23T19:38:00+00:00` restores exact original source after each run.
-M1/M2/M3/M4 are brief/Sage mutants; M5–M10 cover review focus and dewey-0933.
-Each exited 1 with named assertion failures, no loader/syntax kill.
-
-| Mutant | Change | Pass/fail | Named killer |
-| --- | --- | --- | --- |
-| M1 | skip raise scope check | 11/3 | bus out-of-scope Gitea waits; empty/bad scope waits; host argv exclusion |
-| M2 | skip invalid-value fallback | 5/2 | business missing/bad scope fallback; bad file scope fallback |
-| M3 | remove #human from scope verb | 13/1 | bus Q3 caller refusals |
-| M4 | drop grant.scope.used write | 9/5 | bus Q4 protected evidence assertion; four executor waits also fail |
-| M5 | skip scope digest check | 13/1 | bus Q4 bad evidence: decision-mismatch instead of not-authorized |
-| M6 | rethrow narrowing, rolling spend back | 13/1 | bus Q5 Gitea spent assertion |
-| M7 | same without length check | 6/1 | business Q2 shorter command prefix exclusion |
-| M8 | no-op #scopeRecheck | 12/2 | bus Q5 Gitea and host scope-changed outcomes |
-| M9 | remove launch.by check | 13/1 | bus Q6 second chief stays open |
-| M10 | accept any matched scope evidence row | 13/1 | bus Q4 bad evidence, with positive control |
-
-Mutation log sha256 (under scratch/review-mutants):
-
-```text
-55e9973af5fca0088963e2ca11fd81b2fb46dfead813a577c0e0aad2d6269b68  M1.log
-abd1b784eff5ae1333a7b47085d3e199cad6d27a00e2584edf0b62417ad4c888  M2.log
-1a56085e548d1e244f0f88fe12a45f77c162375880794f9ef88b241ed3a1704d  M3.log
-9c120f3f7128488edaf8bfd6d41bae712e69e76da4195a0d4dc0e8336b02038f  M4.log
-1bba88a3752823454acdaa51abde6aad66fdd5488801b4aceda02a3b42c8123d  M5.log
-a4ce3cacca9f7ea56b8cdfd503c76173a8e4ff1d8a7ec07032c93f0b51aa60d8  M6.log
-acecd5afc93d68d96d713f8a9a2dc08351831a0b7360a13b4e30a572ad4167bf  M7.log
-fce7fa505ccf4f2d4190bd03c209fd19f1cf2770d3ae1246a3bd03697594019e  M8.log
-a830a7964890dd04a2dcc7a932a1502f1dea06419a1eae6b91a85f7878dc5681  M9.log
-38ce3e7f69f6c6ffe10133397465d52538a930a830f76256a8b9280f8df78e4b  M10.log
-```
-
-Full touched-package suites and every scripts/test-*.sh remain for Sage's full gate; this CLEAR authorized only the five whole files. Candidate remains
-marked Untested for the full gate. No queue row has been changed by Boyd.
-
-## Dewey final delta review (dewey-0935, 2026-10-23 19:31:55Z)
-
-Dewey reviewed 574ece13c..bcd93dc08 with local git only, no Node: CLEAN,
-nothing blocks. Verified all 13 manifest entries, exact package-file coverage,
-project-runtime 1/1, M5-M10 mutation sites, all ten mutation log hashes and
-counts, named assertion kills without loader/syntax errors, final five logs
-29/0/0, and N1-N5 coverage. No production code delta in this review range.
-
-Formal Gitea APPROVE on #1804 and queue record wait on the row 291 hold release
-and Sage's go. Sage's touched-package and every scripts/test-*.sh gate remains
-required. Boyd has released lane B and has no running test processes.

agents/boyd/work/queue-298/MANIFEST.sha256

@@ -1,13 +0,0 @@
-612488b705853e75e6f8952e41552526f4d07dd297d7619d608d434ed75121d6  packages/bus/README.md
-3677f403104c121d53eb50b874de7a5d8d22e038faac52a5ea5bad449d0d409c  packages/bus/src/broker.mjs
-2e0ade9233404439cd4a629245600878da960f1126e7299aa2ccfb3aff86d784  packages/bus/src/runtime.mjs
-e7065db949cacfd4679a1031eebf5cde09ed196ce85612e8400ae563f02a0f18  packages/bus/tests/grant-scope-runtime.test.mjs
-4030cf584481a1db12d9e6f744015c48fdebd468335d065ead3e90180858d366  packages/bus/tests/grant-scope.test.mjs
-bc432d8d430433b9d84c00883584dc53d4b27afb5e93f739fe3ca28e80f01efa  packages/bus/tests/project-runtime.test.mjs
-84d6dd15d5ca2926d8f7a34548c70c3e7a3c58e692f0b009414f1af35cb096cc  packages/business/src/business.mjs
-1ac106522c8a115cb9479f2a6c5591fb9c77d138bbe93d2df10b6c4295645d0e  packages/business/src/instance-settings.mjs
-fed4177325f65a2b9823a40a9c35c01d60c0520e3ff40b4574c3cf2c29cc096b  packages/business/src/vocabulary.mjs
-b7f96e45b9ffca2a7ebc18dc446f0adcaac72d3900f098c60157cf6cbf1bfc13  packages/business/tests/grant-scope.test.mjs
-60fc267b7f8f9e83eeb0d0207c8abdef68d554f32b08d508e98dbf59b442a366  packages/cli/README.md
-b586907ca8f351f60dc19ec2683df75d2d70ddb12955d09fb14560c9d3bed3dc  packages/cli/src/grants.mjs
-fb7c30b31facd887b03ff02dd6734d48a815978481b33bb21ec48604a51c5ff5  packages/cli/tests/grants-scope.test.mjs

agents/boyd/work/queue-298/mutants.py

@@ -1,105 +0,0 @@
-#!/usr/bin/env python3
-"""Row 298 mutants. Run only with Sage's explicit CLEAR in Boyd's slot.
-
-Each mutation is applied to this worktree, runs one whole new test file,
-then restores the exact original bytes, including after an interruption.
-Logs go to a caller-supplied scratch directory, never the repository root.
-"""
-import argparse
-import datetime
-import pathlib
-import subprocess
-
-ROOT = pathlib.Path(__file__).resolve().parents[4]
-BROKER = ROOT / 'packages/bus/src/broker.mjs'
-VOCABULARY = ROOT / 'packages/business/src/vocabulary.mjs'
-BUS_TEST = 'packages/bus/tests/grant-scope.test.mjs'
-BUSINESS_TEST = 'packages/business/tests/grant-scope.test.mjs'
-
-
-def replace_once(source, old, new):
-    if source.count(old) != 1:
-        raise RuntimeError(f'expected exactly one mutant site, found {source.count(old)}')
-    return source.replace(old, new, 1)
-
-
-def mutate(name, source):
-    if name == 'M1':
-        return replace_once(source,
-            'if (!raise?.grant || !grantInScope(scope, raise.grant)) return view;',
-            'if (!raise?.grant) return view;')
-    if name == 'M2':
-        return replace_once(source,
-            'return scope === null ? { scope: GRANT_SCOPE_EMPTY, fallback: true } : { scope, fallback: false };',
-            'return { scope: scope ?? value, fallback: false };')
-    if name == 'M3':
-        return replace_once(source,
-            '  #grantScopeVerb(s, verb, a) {\n    this.#human(s);',
-            '  #grantScopeVerb(s, verb, a) {')
-    if name == 'M4':
-        old = """    this.#grantEvent(s.business, {
-      action: 'grant.scope.used', grantDecision: d.id, decisionSeq: seq, method: raise.grant.method,
-      agent: raise.grant.agent, scope, revision, scopeSha256: sha256(JSON.stringify(scope)),
-    }, d.id);"""
-        return replace_once(source, old, '    // MUTANT: scope evidence omitted.')
-    if name == 'M5':
-        return replace_once(source,
-            "evidence.agent === grant.agent && evidence.scopeSha256 === sha256(JSON.stringify(checked.scope)) &&",
-            "evidence.agent === grant.agent &&")
-    if name == 'M6':
-        start = source.index("        checked = this.#store.transaction(() => {\n          const consumed = this.#consumeGrant")
-        end = source.index('\n      } catch (e) {', start)
-        return source[:start] + "        checked = this.#store.transaction(() => this.#giteaRecheck(business, decision, this.#consumeGrant(business, decision, 'gitea')));" + source[end:]
-    if name == 'M7':
-        return replace_once(source,
-            'const same = (a, b) => a.length === b.length && a.every((x, i) => x === b[i]);',
-            'const same = (a, b) => a.every((x, i) => x === b[i]);')
-    if name == 'M8':
-        return replace_once(source,
-            "    if (this.#closed(decision)?.via === 'scope' && !grantInScope(this.#scopeNow(business).scope, g)) fail('scope-changed');",
-            "    // MUTANT: no spend-time scope recheck.")
-    if name == 'M9':
-        return replace_once(source,
-            '    if (s.role !== this.#business(s.business).launch?.by) return view;',
-            '    // MUTANT: any chief instance can use scope.')
-    if name == 'M10':
-        start = source.index('    const evidence = JSON.parse(row.body);', source.index('  #scopeUsed('))
-        end = source.index('\n  }', start)
-        return source[:start] + '    return true;' + source[end:]
-    raise ValueError(name)
-
-
-def main():
-    parser = argparse.ArgumentParser(description=__doc__)
-    parser.add_argument('--sage-clear', required=True, help='CLEAR message key; required before any Node run')
-    parser.add_argument('--logs', type=pathlib.Path, required=True)
-    parser.add_argument('--mutant', choices=['M1', 'M2', 'M3', 'M4', 'M5', 'M6', 'M7', 'M8', 'M9', 'M10', 'all'], default='all')
-    parser.add_argument('--deadline', default='2026-10-23T19:38:00+00:00')
-    args = parser.parse_args()
-    deadline = datetime.datetime.fromisoformat(args.deadline)
-    args.logs.mkdir(parents=True, exist_ok=True)
-    names = ['M1', 'M2', 'M3', 'M4', 'M5', 'M6', 'M7', 'M8', 'M9', 'M10'] if args.mutant == 'all' else [args.mutant]
-    for name in names:
-        remaining = (deadline - datetime.datetime.now(datetime.timezone.utc)).total_seconds()
-        if remaining <= 15:
-            raise RuntimeError('Sage slot deadline reached; no new test run')
-        path, test = (VOCABULARY, BUSINESS_TEST) if name in ['M2', 'M7'] else (BROKER, BUS_TEST)
-        original = path.read_bytes()
-        mutated = mutate(name, original.decode())
-        log = args.logs / f'{name}.log'
-        try:
-            path.write_text(mutated)
-            with log.open('w') as output:
-                result = subprocess.run(['timeout', '-k', '10', str(int(min(180, remaining - 13))), 'node', '--test', '--test-concurrency=1', test],
-                    cwd=ROOT, stdout=output, stderr=subprocess.STDOUT,
-                    timeout=min(195, remaining - 1), check=False)
-            print(f'{name}: exit={result.returncode} log={log}', flush=True)
-        finally:
-            path.write_bytes(original)
-        # Exit 1 needs human inspection of the failing test names; errors are not kills.
-        if result.returncode == 0:
-            raise RuntimeError(f'{name} survived')
-
-
-if __name__ == '__main__':
-    main()

agents/lena/work/queue-296/BUILD.md

@@ -0,0 +1,266 @@
+# Row 296: FED R7, scratch two-instance acceptance (#1802)
+
+## Start
+
+- Started 2026-10-23 18:53:27Z, on Sage's sage-3583 (mos-1489).
+- Base: origin/refactor 45dca69f6 (pinned; local copy used, no fetch: fetch runs the credential node script, which
+  is held during Darkwing's re-pin window).
+- Branch: quackerjack/row296 in worktree quackerjack-fed-r5-row296.
+- Brief: docs/plans/2026-10-23_mvp-readiness-rows.md at 45dca69f6, section "Brief: FED R7, scratch two-instance
+  acceptance" (line 77).
+- Constraints from Sage: scratch roots only (mktemp -d under /mnt/storage/scratch/tmp), never ~/.mosaic-dev or
+  the live bus. No push, claim, queue write, node or test run until CLEAR.
+
+## What the brief asks for (summary)
+
+- One script test under scripts/ with its harness in packages/*/tests/, as row 190's tests are.
+- Two configs, two data roots, two Consoles, one fake OP. Consoles start outside agent ancestry in a transient
+  user unit. They never use the live stack's units, ports or sockets. The script removes its units on exit (trap).
+- Test (design section 7 R7 gate): Jason's test identity, granted collaborator on one hub project, signs in,
+  makes a thread, sends to the granted instance, gets the reply in the thread, is refused on another project and
+  on board reads, is revoked, is refused again, and the run ends. The factory shows nothing of the hub.
+- Mutants: grant project list widened to `*`; revocation claim end skipped.
+- Gate: Filbert approves the manifest; the script test and every scripts/test-*.sh green on Sage's gate; no unit,
+  port or socket of the script outlives the run. R8 (live window) stays row 209.
+
+## Open reads before design
+
+- R4 and R6 candidates (the brief says it builds on their combined candidate). Confirm what they expose: the
+  hub sign-in, grant and revocation paths, and the Console's board-read refusal.
+- Row 190's test harness (several instances on one uid): how it starts units and cleans up.
+- Transient user unit support on this host (systemd-run --user), and how the existing tests detect it.
+
+## Status
+
+- 18:53Z: worktree created, brief read. No code yet.
+
+## Handoff 2026-10-23 19:10:09Z (Mos ruling Q245, mos-1503)
+
+Row 296 moves to Lena (Codex seat, thread db27faca-85fb-4ca0-9fc7-78d740d3fa3a, branch lena/row296). Quackerjack
+stops here: no builds, no claim, no queue writes. This design is the handoff; Lena continues it.
+
+Base: 45dca69f6. R4 landed as 2efd127ce (ancestor of the base, checked with merge-base --is-ancestor). R6 landed as
+d3059c2c3 (row 294). R7 is claimable once Darkwing's window ends (Sage, sage-3592).
+
+What I verified by reading (not by running):
+- packages/cli/src/access.mjs:65 reads `system.federation?.peers ?? []` (the R6 seam).
+- packages/bus/src/user-cli.mjs exists at base (the user-cli transport).
+- Row 190's tests (packages/cli/tests/stack-instances.test.mjs, stack-release.test.mjs T56, stack-release-fixture.mjs)
+  drive stand-in units and fixtures. They do not start real transient user units. Not a model for R7's Consoles.
+- Real transient-unit launch pattern: packages/conversation/src/cohort.mjs (`scopeAvailable()` and `ScopeLauncher`,
+  systemd-run --user --scope -p Delegate=yes --unit=...; MANAGER_ENV = XDG_RUNTIME_DIR, DBUS_SESSION_BUS_ADDRESS).
+- Test-only spawn of systemd-run in packages/conversation/tests is the nearest precedent for start/stop cleanup.
+
+What I did NOT verify (so treat as open): the hub sign-in, grant, revocation and board-read paths in R4/R6 code; the
+Console startup flags; whether the fake OP can be a local stand-in; the trap-based unit cleanup.
+
+Design (proposal, not yet checked against code):
+1. scripts/test-federation-acceptance.sh: the entry point. Creates a mktemp -d scratch root under
+   /mnt/storage/scratch/tmp (never ~/.mosaic-dev, never the live bus). trap removes every unit it started and the
+   scratch root. Refuses to run if a transient unit name collides.
+2. Two configs (instance A = hub-side granted seat, instance B = collaborator's home), each with its own
+   MOSAIC_CONFIG, data root and federation.self; federation.peers names the other.
+3. One fake OP: a local stand-in that issues Jason's test identity. Its port and socket are per-run, not the live ones.
+4. Two Consoles, each in its own transient user unit (systemd-run --user --unit=mosaic-r7-<run>-<A|B>); outside agent
+   ancestry; ports picked per run.
+5. Test flow (the R7 gate): identity -> grant on one hub project -> sign in -> thread -> send to granted instance ->
+   reply in thread -> refused on another project -> refused on board reads -> revoke -> refused after revoke -> run
+   ends. Factory output must show nothing of the hub.
+6. Mutants: (a) grant project list widened to `*`, must fail the other-project refusal; (b) revocation claim end
+   skipped, must fail the refusal-after-revoke check.
+
+Unresolved decisions for Lena (I did not decide these):
+- Whether the harness lives in packages/cli/tests (matching row 190) or packages/conversation/tests (matching
+  cohort.mjs). Brief says packages/*/tests/; pick the one that owns the Console start path.
+- Fake OP: in-process HTTP stand-in versus file-backed identity. No preference recorded.
+- Port selection: fixed range per run vs OS-assigned. Brief forbids the live ports; it does not pick a range.
+
+R2 and R5 learning:
+- R2 (row 203, #1701) landed as a4da4e6df. I built it. Relevant to R7: validateFederation in
+  scripts/mosaic-config.mjs rejects unknown keys and bad ids, and test-config.sh has an FED block
+  (expect_fed_refusal). Use federation.self/peers exactly as row 203 validates them.
+  Mutant runner pattern: one textual edit that must occur exactly once, then a named test must fail; restore from git.
+  Name filter gotcha: `node --test --test-name-pattern` skips subtests whose parent does not match; include the
+  parent name (T57 for row 203).
+- R5: I did not build R5 in this session and have no first-hand notes on it. Ask Sage for R5's landing sha and notes.
+
+Status: design written; no code, no test runs, no claim, no push of the test files. Next owner: Lena.
+
+## Lena continuation, 2026-10-23
+
+Owner: Lena, thread db27faca-85fb-4ca0-9fc7-78d740d3fa3a. Branch lena/row296.
+Base remains 45dca69f6. Quackerjack's handoff c6ab9bdc9 preserved by cherry-pick ad84c1e45.
+Issue #1802 exists. Reviewer Filbert. Sage owns queue state, shared test slot and landing.
+Status: Untested. All Node, tests and credential-helper fetch/push held for Sage CLEAR (sage-3615).
+The earlier canonical `queue next lena` read finished with `nothing` and a rendered-view warning;
+no queue state was changed. Lena's owner registration is Sage's action.
+
+### Design decisions sent to Sage (lena-0003)
+
+- Harness under packages/cli/tests, beside row 190's instance proof; shell entry under scripts/.
+- Existing HTTPS fakeOidc helper, its generated scratch CA trusted through NODE_EXTRA_CA_CERTS
+  by each real Console CLI. One fake OP, two client ids; no TLS verification bypass.
+- Kernel-assigned loopback ports (0), discovered from each Console's startup log. Public origins
+  are distinct *.example.test HTTPS names; HTTP requests model the loopback reverse proxy with
+  exact Host and Origin. This proves the Console boundary, not a deployed HTTPS front end (R8).
+- Transient user service units, not scopes: a scope leaves ancestry beneath the caller; the real
+  user proof walks ancestry. Each Console runs the existing cli.mjs serve --sso --send verb.
+- Real startHost broker process and createLauncher. Only the harness adapter is a test stand-in,
+  as in thread-revoke.test.mjs. A real sandboxed run replies through the broker.
+- Scratch-only setup and access grant/revoke use real human CLI transport from a transient service.
+  No injected principal verifier, direct bindHuman/bindUser, or simulated user transport.
+- Every service has a unique per-run prefix and is recorded before launch. Shell EXIT/INT/TERM
+  traps stop only these services, wait for collection and verify socket and port closure.
+- Claim-end assertion reads append-only claim history independently of the launcher's final
+  shutdown so the claim-end mutant cannot be hidden by endLaunch's cleanup.
+
+### Implementation plan
+
+Goal: an executable scratch proof of federation section 7's R7 gate, without live state.
+Architecture: shell lifecycle owner, Node test driver, test-only host fixture, existing real Console CLI.
+Tech: Bash, Node ESM/node:test, systemd user transient services, existing fake OP and bwrap adapter.
+Spec: docs/plans/2026-10-23_mvp-readiness-rows.md, FED R7, plus preserved handoff above.
+
+Constraints: scratch only under /mnt/storage/scratch/tmp; no live units/ports/sockets/configs or
+credential reads; no production behavior/policy changes; no old test edits without Mos via Sage.
+
+Review focus: partial startup cleanup; signals; unit name collision; mismatched hub/factory sessions;
+claim end versus process exit. Each must have explicit assertions or a negative cleanup exercise.
+
+- [ ] Write acceptance driver assertions: Jason test sub binds as collaborator (owner is another
+  fixture identity), one allowed project/instance, thread send and correlated RESULT, private
+  project creation/read refused, board reads refused, factory has no hub objects, revoke denies
+  session and re-login, claim history records access-revoked and runner ends.
+- [ ] Write shell lifecycle: scratch HOME/TMPDIR, unique unit ledger, bounded command timeout,
+  traps stop/collect only this run's units, verify recorded sockets and ports no longer listen.
+- [ ] Write host fixture using startHost(bootConfig), createLauncher with fakeHarnesses and the
+  existing thread adapter. Prepare two named configs through bootstrap before fixture edits;
+  supply only generated test client slots. Setup/grant/revoke through real human transport.
+- [ ] On Sage CLEAR run only the new script, fix failures in new files and record exact results.
+- [ ] Prepare explicit once-only mutant patches: R5 projects widened to ['*']; R4 #claimEnd call
+  skipped. On Sage CLEAR prove each gives an assertion failure, restore bytes in finally.
+- [ ] Publish manifest (paths, hashes, assertion mapping, old-test numstat), request Filbert review,
+  push additive commits to lena/row296 only. Sage runs shared suites and gate and lands the row.
+
+Pre-existing test changes: none (numstat: empty).
+
+### Source inspection corrections before first execution
+
+- The real webui chat is channel-gated. Scratch businesses enable only harness pi and channel webui;
+  the loader fixture re-exports the unchanged webui channel. The adapter replacement is exactly
+  fakeHarnesses' pi.adapter export; no product file gains a fixture branch.
+- startHost creates a real broker child and a real Unix proof socket; it is hosted in the test
+  driver. The two Console services run the exact same-tree webui CLI, which is required by
+  verifyPrincipal. Human setup runs the exact same-tree human-cli through humanTransport.
+- The earlier in-process host proposal did not need a separate host fixture: startHost exposes
+  the production launcher API directly, so the only helper file is federation-human.mjs.
+- Read-only SQLite inspects claim evidence while the broker remains the sole writer. The test
+  also checks the registered runner and engine pids/start times are gone after revocation.
+- `--kill-after-start` kills the test process after both services have listened; Node teardown
+  hooks cannot run. The shell trap owns service cleanup independently. This is an expected-red
+  exercise; acceptance requires its kill marker, nonzero exit and successful cleanup line.
+- Main driver environment is a whitelist (PATH, scratch HOME/TMPDIR, systemd manager transport,
+  R7 run ids). Console/human services use env -i. No host preload or credential env is carried.
+- No Node or test has run. Bash syntax and git diff --check passed during preparation.
+
+### Binding design correction: sage-3625, 2026-10-23 19:17:35Z
+
+Sage rejected the transient-unit approach: "no transient systemd user units used to satisfy the
+human proof"; such a unit makes the ancestry walk miss the development agent, and creates host
+state under mos-1438. This direction replaces the brief/handoff's unit requirement for this build.
+No unit was created by the superseded draft, and no Node/test execution occurred.
+
+Current design, replacing the earlier proposals above:
+
+- Consoles are ordinary spawned child processes in their own process groups; no systemd commands,
+  units, user manager or manager environment are involved.
+- Test-only federation-host.mjs follows channel-fixture.mjs's mock.module pattern. It re-exports
+  real readProcess and replaces verifyHuman's readProcess argument with real process fields plus
+  ppid=1. This is explicitly a stand-in for Jason's shell, NOT a real ancestry acceptance proof.
+  Real pid/uid/startTime/nonce/path checks still run; verifyPrincipal still checks the Console's
+  actual direct parent path for user calls. No product source receives this override.
+- Each fixture host runs real startBroker and createLauncher. Its local host API is the existing
+  thread-revoke.test.mjs pattern, with only the pi adapter replaced via fakeHarnesses.
+- Setup/grant/revoke are plain children using real CLI wrappers against that fixture proof seam.
+- Shell records each detached group's leader pid and start time, checks both before signalling,
+  and verifies no live group member, TCP listener or Unix listener remains. Killed-driver mode
+  bypasses every Node teardown hook and still leaves cleanup to the shell trap.
+- Read-only claim evidence and actual runner/engine exit remain independent assertions.
+- Gate limitation: this proves the revised scratch integration, not real outside-agent ancestry,
+  transient unit cleanup, TLS proxy deployment or live federation. R8 remains row 209.
+- R5 landing found in git log: ddfb29af7 (#1700).
+- Targeted Node/tests remain held. Sage permits the first lena/row296 push in the 19:41Z gap,
+  with MOSAIC_GITEA_CREDENTIAL_FILE unset. 226 and 283 have earlier slots.
+
+Current files: shell entry; federation-acceptance.test.mjs; fixtures/federation-host.mjs and
+fixtures/federation-human.mjs; this BUILD; mutant runner; manifest; append-only logs; preserved
+Quackerjack BUILD at ad84c1e45. No pre-existing test modification (numstat empty).
+
+### First candidate, 2026-10-23
+
+Implementation is prepared under sage-3625, not yet executed. Static checks: Bash parser accepts
+scripts/test-federation-acceptance.sh; Python ast.parse accepts mutants.py; git diff --check clean.
+No test outcome is claimed. The root node_modules links the existing canonical install so the
+future targeted run needs no install or network. No webui editor build is involved.
+
+M1 now requires the user project-list leak assertion (`R7 ungranted project must not appear`),
+so it proves exposure through the actual Console transport rather than only inspecting grant
+configuration. The private-project thread-create refusal and exact grant-list check follow it.
+M2 requires `R7 revoke must end the claim as access-revoked` before any host teardown.
+
+Sage opened the push gap early in sage-3644 (19:23:04Z). The first candidate is committed as
+Untested, for push only to lena/row296 with MOSAIC_GITEA_CREDENTIAL_FILE unset. Node, acceptance,
+negative cleanup exercise and mutants still wait for the test slot. Full suites/gate are Sage's.
+
+### Filbert static review, filbert-296-first-push-static, 19:28:51Z
+
+Review pinned f06a1f78c against 45dca69f6. Filbert verified all nine manifest hashes from Git
+objects, no product/pre-existing test changes, no systemd calls, fixture-only ancestry override,
+real path/uid/startTime/nonce checks, group ledger identity checks and child-only CA trust.
+He ran nothing. The verdict remains pending execution and gate evidence.
+
+- C1 confirmed by inspection: subprocess.run(timeout=280) kills the shell on timeout and can
+  bypass its trap, while the shell's own deadline plus cleanup can exceed 280 seconds. Removed
+  the outer Python timeout (the simpler alternative Filbert explicitly allowed). Python now
+  waits for the shell's bounded run and EXIT/TERM cleanup. Source restoration remains in finally.
+- N1 retained limitation: a SIGKILL between spawn and the pid/startTime ledger append can leave
+  an unrecorded group. The killed-driver exercise begins after both Consoles are recorded and
+  does not cover that gap. Cleanup claims apply to recorded groups; no universal crash-proof
+  process creation claim is made.
+- N2 addressed before the mutant run: the named readonly claim-history assertion now runs after
+  revoke and before waiting for the run's end. A skipped #claimEnd therefore cannot first fail
+  the run-end wait. The final latest-op check still runs after engine/runner exit. If M2 instead
+  fails an earlier condition, its runner must say NOT KILLED; diagnose the first failure on the
+  same pinned candidate, retain the intended assertion, and rerun on Sage CLEAR. Never accept a
+  timeout or change the mutant's expected assertion merely to mark it killed.
+- N3 deferred cosmetic fixture detail: wrap() returns fn(value) without await, so async rejection
+  skips its code mapping. This is not an authorization or cleanup change; the rejection still
+  propagates, and no verdict relies on that fixture mapping.
+- N4: corrected the exact-grant assertion's indentation in the new test.
+- N5: prepare() first calls bootstrap --instance, then overwrites that bootstrap-generated
+  config inside the unique disposable scratch HOME with fixture Console/provider settings.
+  This is fixture-only setup, not a product/bootstrap overwrite path or a live-config operation.
+  There remains one selected config per scratch instance, with the same marked data root.
+
+Still Untested. No Node, acceptance, mutant, negative cleanup or CLI suite run. Static validation
+only; execution waits for Sage's test window. Follow-up push needs a currently authorized gap.
+
+### Push receipt and N2 ordering proof, 2026-10-23 19:31Z
+
+Sage sage-3659 authorized push before 19:38Z. e855f82e1846f094927c3de69aea1a801253736a
+was pushed to origin/lena/row296 with MOSAIC_GITEA_CREDENTIAL_FILE unset. No Node/tests ran.
+
+N2, filbert-296-c1-ack: this path is synchronous after a successful reload. accessCommand awaits
+reload at access.mjs:289; reload awaits the access.reload transport at :297. broker.mjs:4645
+calls #revokeLost before constructing its reply. #revokeLost (:1025–1034) calls #claimEnd inside
+Store.transaction, which executes COMMIT before returning (store.mjs:282–302). server.mjs:160–161
+calls broker.request and then writes the response. Therefore the claim record is committed before
+the successful CLI call returns; no asynchronous sweep is required for this assertion. A refused
+reload can be reported by the CLI with exit 0, but then immediate revocation evidence is absent
+and this test must fail; that is not a race the test should hide. No polling change is needed.
+
+T3 package comparison (sage-3659): the four planned runs execute only the new dedicated
+federation-acceptance.test.mjs and its fixture host/human children. They do not execute stack-copy,
+stack-release or the whole CLI suite. Existing helpers are imported; no old test module is run.
+Asked Researcher to confirm against row216. Full CLI suite remains a later Sage gate requirement,
+outside the targeted T3 command list. All test resources are unique scratch state.

agents/lena/work/queue-296/MANIFEST.md

@@ -0,0 +1,67 @@
+# Row 296 / #1802 — C1 follow-up candidate (Untested)
+
+Base: 45dca69f6. Branch: lena/row296. Reviewer: Filbert. Gate owner: Sage.
+Handoff: c6ab9bdc9 preserved as ad84c1e45, including
+agents/quackerjack/work/queue-296/BUILD.md. Every changed path is in MANIFEST.sha256,
+except this manifest and the checksum file itself. No product file or pre-existing test changed.
+Pre-existing test numstat: empty. BUILD-LOG.md and docs/SESSIONS.md are append-only additions.
+
+Binding ruling: sage-3625 replaces the brief's transient-unit start with plain child Consoles and
+explicit test stand-ins. **This candidate does not prove genuine outside-agent ancestry.**
+It creates no transient systemd unit and makes no systemd CLI call. R8 remains row 209.
+
+## What is real, and what is a stand-in
+
+- Two configs created by bootstrap --instance hub/factory, two marked data roots, real Console
+  cli.mjs serve --sso --send, real broker runtime and launcher, real path-bound human-cli and
+  user-cli wrappers, real access loader, CLI writes/reload, grant filters and revocation.
+- One existing HTTPS fakeOidc server, two issuer/client identities. Its generated CA is trusted
+  only through NODE_EXTRA_CA_CERTS in this test's child environment, never any trust store.
+- federation-host.mjs replaces verifyHuman's readProcess argument with actual process fields plus
+  ppid=1, exactly the test pattern Sage named. This stands in for Jason's shell on setup,
+  grant/revoke and both Consoles' transports. The actual Console parent/path check remains.
+  There is no product parameter, environment switch or altered verifier default.
+- fakeHarnesses replaces only the pi harness adapter() with a scratch shell invoking the existing
+  thread-adapter.mjs. The existing webui channel is re-exported unchanged. No network model runs.
+- Public HTTPS origins are modelled through HTTP loopback requests with matching Host/Origin;
+  reverse-proxy TLS deployment is outside this scratch proof.
+
+## Acceptance map
+
+All checks live in `FED R7 scratch two-instance acceptance` in
+packages/cli/tests/federation-acceptance.test.mjs.
+
+| Requirement | Assertion/evidence |
+| --- | --- |
+| Isolated instances | different config paths/data roots/ports; scratch HOME/TMPDIR; two named markers from bootstrap; port 0, forbidden live ports 7330–7332 checked |
+| Jason is collaborator, not owner | owner melanie; access user jason-test, home factory, fake sub jason-test-sub; hub /api/config user=true |
+| One project, one granted instance | actual access grant CLI, projects=[shared], instances=[assistant]; user project list contains shared only |
+| Thread and reply | create thread on shared, POST message, correlated RESULT with in_reply_to=sent.id, from_role=assistant, to_role=user, body contains question |
+| Other project refused | private project absent from listing; create on private returns 403 access-refused |
+| Board reads refused | /api/board, /api/bus/inbox and /api/bus/tasks return 403 owner-only |
+| Factory sees no hub objects | Jason sub refused at factory; factory owner sees factory-only project and no threads; hub cookie gets 401 at factory |
+| Revoke takes effect | actual access revoke CLI; existing hub session 401 and re-login 403 |
+| Claim and process ended | live run before revoke; end log exitCode=0; no registered sessions; engine and runner pid/startTime gone; readonly claim history has revoke/access-revoked before the process-end wait, latest op=revoke afterward |
+| Normal cleanup | EXIT trap terminates only recorded pid/startTime-checked groups; checks no live group member, no recorded TCP/Unix listener, no other scratch Unix listener, removes scratch directory/socket files |
+| Killed-driver cleanup | --kill-after-start prints both-Consoles-started marker then SIGKILLs test driver; shell performs the same independent cleanup; expected nonzero run with successful cleanup line |
+
+## Verification commands (held for Sage CLEAR)
+
+- scripts/test-federation-acceptance.sh — must exit 0, one acceptance test passes, cleanup line present.
+- scripts/test-federation-acceptance.sh --kill-after-start — must exit nonzero, print the explicit
+  interruption marker and `R7 cleanup: no child groups, ports or sockets remain; no units created`.
+- python3 agents/lena/work/queue-296/mutants.py M1 — once-only R5 grant projects -> ['*']; must fail
+  `R7 ungranted project must not appear` and verify cleanup, then restore original source bytes. Python relies on the shell's own run deadline and cleanup; no outer killing timeout.
+- python3 agents/lena/work/queue-296/mutants.py M2 — once-only R4 claim end omitted; must fail
+  `R7 revoke must end the claim as access-revoked` before shutdown, verify cleanup and restore bytes.
+- Sage's gate: the new script plus every scripts/test-*.sh; full applicable suites per Sage's slot.
+
+Status: no Node, acceptance or mutant run. Static Bash syntax, Python parsing and diff checks only.
+The script never silently skips a missing tool/sandbox/provider: prerequisites fail the acceptance.
+Ordinary CLI suites skip the dedicated test until invoked by its owning script.
+
+Static-review follow-up: filbert-296-first-push-static. C1 removes Python's outer timeout so it
+cannot SIGKILL the shell before EXIT cleanup. N2 moves the named claim-history assertion before
+the process-end wait. N1's spawn-to-ledger SIGKILL gap is retained and documented in BUILD.md;
+--kill-after-start exercises the fully recorded groups. N3 remains a cosmetic fixture limitation.
+N4 indentation corrected. N5 scratch-bootstrap config overwrite is explicitly fixture-only.

agents/lena/work/queue-296/MANIFEST.sha256

@@ -0,0 +1,9 @@
+6e0193ba91cbd20edd3acfbc57ae9af2f016e6d2c3587b434a9085b3a02c493c  BUILD-LOG.md
+72029331a22f33433ad14ff08fe8b24d59f79e784009b12fd9c5b74c9e524f13  docs/SESSIONS.md
+87239327014c49abbe130c17881bb48e13d96545bf9f3e09b6f4aed46e11453b  agents/quackerjack/work/queue-296/BUILD.md
+6f32d7e5e0c2c1ee086949a68b176a9d1fefb8ad0df562f5ce72b0c01d21e7a0  agents/lena/work/queue-296/BUILD.md
+bd6e9fd9e3f7aa0ee6702401776ef7bd3e39562059a11b87aaaf2a427904381b  agents/lena/work/queue-296/mutants.py
+89a15e62aa6f951596b764993afeff7e33eeaa3a4f45d31599eba7d27a4000ad  packages/cli/tests/federation-acceptance.test.mjs
+86b76565f5afe9efdd076ef61cc54e40c447d235f77b95818d0d601ce036effa  packages/cli/tests/fixtures/federation-host.mjs
+b12a9bad4be083f2439c3363738b9763fa0061228f84d501a385ade48fea90e4  packages/cli/tests/fixtures/federation-human.mjs
+4008361f062a2f21b6075c500060196e10a48351fd7d95b25d681f36b4fa801a  scripts/test-federation-acceptance.sh

agents/lena/work/queue-296/mutants.py

@@ -0,0 +1,51 @@
+#!/usr/bin/env python3
+"""R7 mutants. Run only on Sage CLEAR in Lena's isolated candidate.
+
+Every replacement must occur once. Product bytes are restored even on timeout
+or failure. A killed mutant must contain the named assertion in the script's
+output; startup errors and timeout alone are not evidence. The shell owns its
+own timeout and EXIT/TERM cleanup. Do not put a killing Python timeout around it.
+"""
+from pathlib import Path
+import subprocess
+import sys
+
+repo = Path(__file__).resolve().parents[4]
+mutants = {
+    'M1': (
+        'packages/cli/src/access.mjs',
+        'projects: resolveProjects(list(parsed.values["--projects"]), rows),',
+        'projects: ["*"],',
+        'R7 ungranted project must not appear',
+    ),
+    'M2': (
+        'packages/bus/src/broker.mjs',
+        "this.#claimEnd({ business: t.business }, h, 'revoke', null, 'access-revoked', by);",
+        "/* R7 mutant: skip ending the revoked claim */",
+        'R7 revoke must end the claim as access-revoked',
+    ),
+}
+if len(sys.argv) != 2 or sys.argv[1] not in mutants:
+    raise SystemExit('usage: mutants.py M1|M2')
+name = sys.argv[1]
+file, before, after, assertion = mutants[name]
+path = repo / file
+original = path.read_bytes()
+text = original.decode()
+if text.count(before) != 1:
+    raise SystemExit(f'{name}: anchor count {text.count(before)}, expected 1')
+try:
+    path.write_text(text.replace(before, after))
+    result = subprocess.run(['scripts/test-federation-acceptance.sh'], cwd=repo,
+                            stdout=subprocess.PIPE, stderr=subprocess.STDOUT,
+                            text=True)
+    print(result.stdout, end='')
+    if result.returncode == 0 or assertion not in result.stdout:
+        raise SystemExit(f'{name}: NOT KILLED by expected assertion')
+    if 'R7 cleanup: no child groups, ports or sockets remain; no units created' not in result.stdout:
+        raise SystemExit(f'{name}: cleanup not verified')
+    print(f'{name}: KILLED by {assertion}')
+finally:
+    path.write_bytes(original)
+    if path.read_bytes() != original:
+        raise SystemExit(f'{name}: restore failed')

agents/megavolt/work/queue-298/BUILD.md

@@ -1,92 +0,0 @@
-# Row 298 (#1804, Q228): the chief-of-staff grant scope
-
-Owner Megavolt, reviewer Dewey. Assigned in sage-3584 (mos-1489), 2026-10-23 18:53Z.
-Base: origin/refactor 45dca69f6. Branch: megavolt/row298.
-Brief: docs/plans/2026-10-23_mvp-readiness-rows.md, "Brief: the chief-of-staff grant scope (Q228)".
-Decision: DECISIONS Q228 (jason-master-restart DECISIONS.md:2278). It replaces Mos's Q190 reading.
-
-## What exists at 45dca69f6 (broker.mjs)
-
-- Raise: `#raiseGrant` (:2558) is chief-only (`grant-chief-only`) and binds a grant body per method:
-  gitea `#giteaGrantBinding` (:2665), host `#hostGrantBinding` (:2599), or host-enroll `enrollBinding`.
-  The decision goes through `#dispatch(..., 'decision.raise', ...)`, routed to the human.
-- Approval: `#approvedGrant` (:1525) returns the binding only for a credential.mint routed to the
-  human and closed with `approvalChoice` by the business's human, via 'cli', or via 'console' with
-  the broker's own human.input (row 252).
-- Start: decision.resolve (:5653-5659) runs `#approvedGrant` after the close and, once the transaction
-  commits, starts `#runEnrollment`, `#runHostGrant` or `#startGitea` with setImmediate.
-- Spend and records: each executor calls `#consumeGrant` and writes the 236 records (grant.call,
-  grant.result, grant.step, grant.applied or grant.failed, gitea_grants or host_grants). Revoke
-  goes through grants.revoke and hosts.revoke, as before.
-- Human-only settings: `#human(s)` (cli, outsideAgent) plus `#mayHuman`, as in veto.set (:4713).
-  The organization file is checked whole by business.mjs `checkLaunch`, and a bad file refuses
-  every read.
-
-## Proposed design (waits on Sage's rulings, Q1-Q6 below)
-
-D1. Storage. The scope gets its own key, `launch.grantScope`, in the organization file. The
-    whole-file check doesn't refuse on it. A separate reader, `grantScope(document)`, returns the
-    parsed scope or, when the key is missing or bad, the empty scope `{}`, plus a `fallback` flag.
-    A bad value can't break every organization read, and it falls back to "everything needs
-    Approve", which is the fail-closed direction. (Q1)
-D2. Shape. `{ gitea?: { agents: [id], projects: [id] }, host?: { agents: [id], hosts: [id],
-    commands: [[argv prefix]] } }`. A request is in scope only if its method has an entry, its agent
-    is listed, and every target is listed: each gitea project, the host, and each command prefix
-    equal to a listed prefix. host-enroll is never in scope, because it adds a host to the registry.
-    (Q2)
-D3. Writer. A new verb, `grants.scope.set { revision, scope }`, CLI-only for the human: `#human(s)`,
-    then `#mayHuman`, with the verb added to LIFECYCLE_HUMAN_VERBS. The tester, the reader and every
-    agent are refused. organization.set's ORGANIZATION_KEYS don't include it, so the chief's tool
-    never reaches it, the same way instances.set and veto.set stay human-only. The write validates
-    strictly and refuses a bad value; only the read falls back. Receipt: `grants.scope` with the old
-    and new sha256. `grants.scope` reads the value for the human, the tester and the chief. (Q3)
-D4. In-scope raise. Inside the raise transaction, `#raiseGrant` checks the binding against the scope
-    and, if it's in scope, closes the new decision at once: op resolved, choice approvalChoice, by
-    `grant-scope`, via `scope`. It writes a `grant.scope.used` event carrying the scope sha256 and
-    revision. `#approvedGrant` accepts via 'scope' only when that event exists for the close's seq
-    and its sha256 matches the scope as read in the same transaction. After the commit, the same
-    setImmediate starts the same executor, so 236's spend, records and revoke are unchanged. The
-    decision is closed before any inbox read, so no inbox item ever shows. (Q4)
-D5. Out-of-scope raise: unchanged. The decision stays open, routed to the human, for the Console
-    and CLI Approve.
-D6. Executor recheck. At the spend, `#consumeGrant` reruns the scope check for a via-'scope'
-    approval. If the scope changed between raise and run and the grant is now out of scope, it
-    fails with `grant.failed scope-changed` and the grant is spent. (Q5)
-
-## Open questions for Sage
-
-Q1. Storage: `launch.grantScope` in the organization file with a lenient reader (D1), or a separate
-    file under the business directory?
-Q2. Shape: is per-method agent, project, host and command lists right? Should host-enroll stay
-    out of scope always?
-Q3. "A scope change needs Approve": is the human's CLI verb itself the Approve (D3)? Or must the
-    chief also be able to raise a scope change that Jason approves in the inbox (a new decision
-    action, more code)? I recommend D3 alone. Should Console get a scope page in this row? I
-    propose no.
-Q4. Recording an in-scope grant as a broker close via 'scope' with a scope event (D4), versus a
-    decision that is never raised (a new table). D4 keeps 236's records and revoke unchanged.
-Q5. Scope narrowed between raise and run: fail scope-changed (D6), or honor the raise-time check?
-Q6. Chief enrollment ("Jason's Approve stays for the chief of staff's enrollment"): I read this
-    as the chief's own instance and credentials, which the human's instances.set and the
-    credential lifecycle already cover. So nothing new is needed in this row. Agree?
-
-## Tests (access by brief; all on scratch stores, fake Gitea, fake host)
-
-T1 agent, chief and tester callers of grants.scope.set are refused, and organization.set with
-   grantScope is refused. T2 a bad or missing grantScope falls back to empty and the grant waits.
-T3 an in-scope gitea request issues with no open decision and no inbox item, and writes the 236
-   records. T4 the same for a host request. T5 out of scope by agent, by project, or by command
-   waits for Approve. T6 host-enroll always waits. T7 a scope change by the human's CLI writes a
-   receipt; a scope change by any other path is refused. T8 an in-scope grant is logged and revoked
-   with grants.revoke or hosts.revoke. T9 scope narrowed before run gives scope-changed.
-
-## Mutants (brief)
-
-M1 the scope check skipped (every chief raise auto-closes): killed by T5 and T6.
-M2 the fallback skipped (a bad value is used as-is or throws): killed by T2.
-M3 the `#human` check removed from grants.scope.set: killed by T1.
-
-## Holds
-
-Darkwing holds the slot: no push, no claim, no queue write, no node and no test run until Sage
-says so. Q188: no agent creates a grant; tests use scratch stores only.

agents/quackerjack/work/queue-296/BUILD.md

@@ -0,0 +1,87 @@
+# Row 296: FED R7, scratch two-instance acceptance (#1802)
+
+## Start
+
+- Started 2026-10-23 18:53:27Z, on Sage's sage-3583 (mos-1489).
+- Base: origin/refactor 45dca69f6 (pinned; local copy used, no fetch: fetch runs the credential node script, which
+  is held during Darkwing's re-pin window).
+- Branch: quackerjack/row296 in worktree quackerjack-fed-r5-row296.
+- Brief: docs/plans/2026-10-23_mvp-readiness-rows.md at 45dca69f6, section "Brief: FED R7, scratch two-instance
+  acceptance" (line 77).
+- Constraints from Sage: scratch roots only (mktemp -d under /mnt/storage/scratch/tmp), never ~/.mosaic-dev or
+  the live bus. No push, claim, queue write, node or test run until CLEAR.
+
+## What the brief asks for (summary)
+
+- One script test under scripts/ with its harness in packages/*/tests/, as row 190's tests are.
+- Two configs, two data roots, two Consoles, one fake OP. Consoles start outside agent ancestry in a transient
+  user unit. They never use the live stack's units, ports or sockets. The script removes its units on exit (trap).
+- Test (design section 7 R7 gate): Jason's test identity, granted collaborator on one hub project, signs in,
+  makes a thread, sends to the granted instance, gets the reply in the thread, is refused on another project and
+  on board reads, is revoked, is refused again, and the run ends. The factory shows nothing of the hub.
+- Mutants: grant project list widened to `*`; revocation claim end skipped.
+- Gate: Filbert approves the manifest; the script test and every scripts/test-*.sh green on Sage's gate; no unit,
+  port or socket of the script outlives the run. R8 (live window) stays row 209.
+
+## Open reads before design
+
+- R4 and R6 candidates (the brief says it builds on their combined candidate). Confirm what they expose: the
+  hub sign-in, grant and revocation paths, and the Console's board-read refusal.
+- Row 190's test harness (several instances on one uid): how it starts units and cleans up.
+- Transient user unit support on this host (systemd-run --user), and how the existing tests detect it.
+
+## Status
+
+- 18:53Z: worktree created, brief read. No code yet.
+
+## Handoff 2026-10-23 19:10:09Z (Mos ruling Q245, mos-1503)
+
+Row 296 moves to Lena (Codex seat, thread db27faca-85fb-4ca0-9fc7-78d740d3fa3a, branch lena/row296). Quackerjack
+stops here: no builds, no claim, no queue writes. This design is the handoff; Lena continues it.
+
+Base: 45dca69f6. R4 landed as 2efd127ce (ancestor of the base, checked with merge-base --is-ancestor). R6 landed as
+d3059c2c3 (row 294). R7 is claimable once Darkwing's window ends (Sage, sage-3592).
+
+What I verified by reading (not by running):
+- packages/cli/src/access.mjs:65 reads `system.federation?.peers ?? []` (the R6 seam).
+- packages/bus/src/user-cli.mjs exists at base (the user-cli transport).
+- Row 190's tests (packages/cli/tests/stack-instances.test.mjs, stack-release.test.mjs T56, stack-release-fixture.mjs)
+  drive stand-in units and fixtures. They do not start real transient user units. Not a model for R7's Consoles.
+- Real transient-unit launch pattern: packages/conversation/src/cohort.mjs (`scopeAvailable()` and `ScopeLauncher`,
+  systemd-run --user --scope -p Delegate=yes --unit=...; MANAGER_ENV = XDG_RUNTIME_DIR, DBUS_SESSION_BUS_ADDRESS).
+- Test-only spawn of systemd-run in packages/conversation/tests is the nearest precedent for start/stop cleanup.
+
+What I did NOT verify (so treat as open): the hub sign-in, grant, revocation and board-read paths in R4/R6 code; the
+Console startup flags; whether the fake OP can be a local stand-in; the trap-based unit cleanup.
+
+Design (proposal, not yet checked against code):
+1. scripts/test-federation-acceptance.sh: the entry point. Creates a mktemp -d scratch root under
+   /mnt/storage/scratch/tmp (never ~/.mosaic-dev, never the live bus). trap removes every unit it started and the
+   scratch root. Refuses to run if a transient unit name collides.
+2. Two configs (instance A = hub-side granted seat, instance B = collaborator's home), each with its own
+   MOSAIC_CONFIG, data root and federation.self; federation.peers names the other.
+3. One fake OP: a local stand-in that issues Jason's test identity. Its port and socket are per-run, not the live ones.
+4. Two Consoles, each in its own transient user unit (systemd-run --user --unit=mosaic-r7-<run>-<A|B>); outside agent
+   ancestry; ports picked per run.
+5. Test flow (the R7 gate): identity -> grant on one hub project -> sign in -> thread -> send to granted instance ->
+   reply in thread -> refused on another project -> refused on board reads -> revoke -> refused after revoke -> run
+   ends. Factory output must show nothing of the hub.
+6. Mutants: (a) grant project list widened to `*`, must fail the other-project refusal; (b) revocation claim end
+   skipped, must fail the refusal-after-revoke check.
+
+Unresolved decisions for Lena (I did not decide these):
+- Whether the harness lives in packages/cli/tests (matching row 190) or packages/conversation/tests (matching
+  cohort.mjs). Brief says packages/*/tests/; pick the one that owns the Console start path.
+- Fake OP: in-process HTTP stand-in versus file-backed identity. No preference recorded.
+- Port selection: fixed range per run vs OS-assigned. Brief forbids the live ports; it does not pick a range.
+
+R2 and R5 learning:
+- R2 (row 203, #1701) landed as a4da4e6df. I built it. Relevant to R7: validateFederation in
+  scripts/mosaic-config.mjs rejects unknown keys and bad ids, and test-config.sh has an FED block
+  (expect_fed_refusal). Use federation.self/peers exactly as row 203 validates them.
+  Mutant runner pattern: one textual edit that must occur exactly once, then a named test must fail; restore from git.
+  Name filter gotcha: `node --test --test-name-pattern` skips subtests whose parent does not match; include the
+  parent name (T57 for row 203).
+- R5: I did not build R5 in this session and have no first-hand notes on it. Ask Sage for R5's landing sha and notes.
+
+Status: design written; no code, no test runs, no claim, no push of the test files. Next owner: Lena.

docs/SESSIONS.md

@@ -1593,7 +1593,4 @@ are never rewritten or removed; corrections are new entries.
 2026-10-23T17:48:43Z | Scrooge (629b6cd3) | Row 252 Console inbox Approve and Deny (#1753) | Rebased onto 306 landing as 580037105 (range-diff all =), slot run bus 907/0 webui 410/0 cli 943/0, in-review revs 3608/3609, Webby r1 APPROVE, J1-J19 specs to Sage; Sage landed 45ea3fa0d (done rev 3616). Part 1 mutant results were never in BUILD.md; they went to Sage by T3 (scrooge-0252-mutant-specs).
 2026-10-23 | Sage (1ef1e4f8) | Rows 308 and 252 landings, 571 Connections design amendment, Vikunja 597 | 308 (PRD 1.17, #1815) landed 30e6bb680 and 252 (#1753) landed 45ea3fa0d (replay of 580037105 onto 30e6bb680, range-diff all =), each after a full gate on the landed tree (252 also J1-J19, J11c and J18 equivalent); Gyro's 571 amendment (Fenton APPROVE) landed e8bb13df8; Vikunja 570, 435 and 597 done, canonical webui esbuild 0.28.2; queue revs 3589-3616 committed 59f013247
 2026-10-23 | Sage (1ef1e4f8) | Vikunja 571 W build rows; rows 13, 42, 257 and 289 check | Filed the design's ten W rows as queue rows 309-318 (revs 3617-3626, owners set to unassigned 3627-3636, queue commit 293b42fee pushed); Vikunja 571 done (comment 994). Row 13's candidate fd72d2689 is on refactor, gate is Monday's row 7 ledger run; 42 paused under mos-1184; 257 post-v1; 289 waits on 214 and 288. Slot released 17:56Z.
-
-2026-10-23T19:13:00Z | Boyd (48a3ae38, Codex gpt-6.1-sol) | Row 298 (#1804, Q228) takeover from Megavolt under mos-1496 | Started on boyd/row298 at 45dca69f6; reading brief, D1-D6 and human-shell proof; awaiting Megavolt handoff. No Node/tests before Sage CLEAR, no queue writes.
-
-2026-10-23T19:29:00Z | Boyd (48a3ae38) | Row 298 (#1804) targeted T1 lane B | Five whole files 29/0/0, ten mutants killed, source restored; reviewer delta prepared. Earlier startup timestamp corrected in Boyd BUILD.md. Full gate and queue/landing remain Sage's.
+- 2026-10-23 — lena (Codex, db27faca): row 296 / #1802 FED R7; recovered Quackerjack design on lena/row296, inspecting acceptance paths; Node/tests held pending Sage CLEAR, no live changes.

packages/bus/README.md

@@ -226,8 +226,6 @@ an operator inspect content and delivery evidence after an uncertain result.
 | `hosts.remove` | `{host}`; the human or the tester. Deletes the record, writes `grant.host.removed` and removes the installer key. A `host_grants` record for the host is `host-in-use`, a guarded event naming a host line left on the host `host-line-left`. |
 | `hosts.revoke` | `{agent,host,reason}`; the human, the business's assistant, or the tester when `bus.tester` is exactly `true` (row 235, #1741, r6 section 6). Anyone else gets `revoke-refused`. The tester check reads `bus.tester` again at the call, `tester-dev-only`. One transaction deletes the `host_grants` record and writes `grant.revoked` with `hostLine:"pending"`. With no await between, the key leaves memory and its file goes, and a `host.run` or executor in flight aborts. Then `remove <user> <tag>` runs on the host and `grant.revoke.closed` records `hostLine:"removed"` or `hostLineLeft`. A revoke with no record still runs, with `granted:false`. Returns `{agent,host,tag,granted,keyFile,hostLine or hostLineLeft}`. A restart with a pending marker runs the remove once the bus is up; `hosts.status` lists its tag under `revoking`. |
 | `hosts.sweep` | `{host}`; the human or the tester (r6 X3). Runs `list <user>` and removes each listed tag this business recorded for the host in a `grant.step` or `grant.revoked` that no live grant holds. Another business's line and an unrecorded `mosaic-` line stay. Writes `grant.host.swept {host,removed,left}`; `hostLineLeft` then counts from it. Returns `{host,removed,hostLineLeft}`. |
-| `grants.scope` | `{}`; the proven human CLI only (row 298, #1804, Q228). Returns the organization revision, effective scope and fallback flag. `launch.grantScope` missing or invalid covers nothing. |
-| `grants.scope.set` | `{revision,scope}`; the proven human CLI only, itself Approve for the scope change. Agents, testers, readers and Console caps refuse. Strict scope shape; optimistic organization revision, durable organization receipt, and `grant.scope` with human proof and old/new scope digests. General organization setters cannot write this setting. Scope matches per-method agent and every project, or agent/host and exact command arrays; host enrollment is excluded. In-scope requests by `launch.by` close via `scope` with protected `grant.scope.used` evidence, and run the existing grant executor without per-grant Approve. The raise returns the closed decision view to the chief; this shortcut sends no separate decision-close message. Outside scope waits as before. Scope narrowing before spend fails `scope-changed`; every issued grant keeps its records and revoke path. Empty default ships; the live value is Jason's to set. |
 | `grants.status` | `{service:"gitea"}`; the human, the tester or the chief (row 236, #1742, #436b r5). The admin slot's url, account and rotate-by date with `rotationDue`, `adminTokenLeft`, the `gitea_users` and `gitea_grants` records, approved decisions not yet run (`spentAtNextStart`), grants `running` or `settlePending`, agents held as `tokenUnknown`, the `serviceLeft` entries a sweep retries, and revokes still `revoking`. No token. |
 | `grants.run` | `{decision}`; the human only. Starts the Gitea executor of a `credential.mint` decision with a gitea grant the human said yes to, as the yes itself does (X1). Step 0's refusals come back with no record: `not-authorized`, `decision-consumed`, `grant-token-unknown`, `grant-busy`, `gitea-not-configured`. Returns `{decision,agent,started:true}`; the outcome is a `grant.applied` or `grant.failed` and a notice. |
 | `grants.revoke` | `{service:"gitea",agent,reason}`; the human, the business's assistant, or the tester when `bus.tester` is exactly `true`. The token leaves memory and its file goes, an executor in flight aborts, then one transaction deletes the `gitea_grants` record and writes `grant.revoked` with the token ids to delete. The deletes run with the admin token after C1 to C4, and `grant.revoke.closed` records `serviceLeft`, a list. `credentials.revoke AGENT gitea` and `credentials.delete` do the same for a stack-made user; delete also deletes every token of the user and sets `prohibit_login` (fire). |

packages/bus/src/broker.mjs

@@ -4,7 +4,7 @@ import { initializeControl, processingStatus } from '../../processing-control/sr
 import { NAME as HARNESS_NAME } from '../../plugins/src/kinds.mjs';
 import { loadRequirements } from '../../tasks/src/requirements.mjs';
 import { MERGE, LandingRefusal, readLanding } from './landing.mjs';
-import { ID_PATTERN, THREAD_DEFINITIONS, END_PROTECTED, forkProblem, forkUrl, credentialKind, validArgv, commandAllowed, HOST_ID, CREATIVE_DEFINITIONS, unhireableAction, giteaName, parseGiteaUrl, covers, grantScopeOf, grantInScope } from '../../business/src/vocabulary.mjs';
+import { ID_PATTERN, THREAD_DEFINITIONS, END_PROTECTED, forkProblem, forkUrl, credentialKind, validArgv, commandAllowed, HOST_ID, CREATIVE_DEFINITIONS, unhireableAction, giteaName, parseGiteaUrl, covers } from '../../business/src/vocabulary.mjs';
 
 // Kept closed while S1 lands; its vocabulary is the integration authority.
 export const ACTIONS = Object.freeze([
@@ -290,9 +290,6 @@ export function writeGrantEvent(store, at, business, body, subject = null) {
   );
   return eid;
 }
-// Row 298 (#1804, Q228): the by of a close the chief's grant scope makes, with via 'scope'. No session
-// closes as it, and #approvedGrant takes it only with the grant.scope.used record of that close.
-const SCOPE_BY = 'grant-scope';
 export const HOSTS_VERBS = Object.freeze(['hosts.status', 'hosts.check', 'hosts.remove', 'hosts.revoke', 'hosts.sweep']);
 // Row 236 (#1742, #436b r5): the Gitea grant path's verbs. run and admin.* are the human's alone.
 export const GRANTS_VERBS = Object.freeze([
@@ -415,7 +412,6 @@ export class Broker {
   #revokeUndo = [];
   #testerOn;
   #roleFile;
-  #grantScope;
   // Row 236 (#436b): giteaGrant and giteaKeys from gitea-grant.mjs, or null, and the remote halves of
   // section 5's restart rows and of revokes a restart cut short, for reconcileGitea.
   #giteaGrant;
@@ -443,12 +439,11 @@ export class Broker {
   #clock = 0;
   #processing;
   // credentialStatus is the runtime's metadata-only Credentials.status(); the broker never gets use().
-  constructor({ store, businesses, secretCheck = () => {}, credentialStatus = () => [], organization = null, project = null, library = null, usage = null, limits = null, harnessOn = null, credentialVerbs = null, hostGrant = null, hostKeys = null, processing = null, testerOn = null, grantScope = null, roleFile = null, giteaGrant = null, giteaKeys = null, access = null, accessStamp = null, compactions = null }) {
+  constructor({ store, businesses, secretCheck = () => {}, credentialStatus = () => [], organization = null, project = null, library = null, usage = null, limits = null, harnessOn = null, credentialVerbs = null, hostGrant = null, hostKeys = null, processing = null, testerOn = null, roleFile = null, giteaGrant = null, giteaKeys = null, access = null, accessStamp = null, compactions = null }) {
     if (!object(businesses) || !Object.keys(businesses).length) fail('invalid-business');
     // Row 194 b15 (sage-2501): the function-argument checks come before anything reads the store.
     if (harnessOn !== null && typeof harnessOn !== 'function') throw new TypeError('harnessOn must be a function');
     if (testerOn !== null && typeof testerOn !== 'function') throw new TypeError('testerOn must be a function');
-    if (grantScope !== null && typeof grantScope !== 'function') throw new TypeError('grantScope must be a function');
     if (roleFile !== null && typeof roleFile !== 'function') throw new TypeError('roleFile must be a function');
     if (access !== null && typeof access !== 'function') throw new TypeError('access must be a function');
     if (accessStamp !== null && typeof accessStamp !== 'function') throw new TypeError('accessStamp must be a function');
@@ -486,9 +481,6 @@ export class Broker {
     // sets bus.tester to exactly true; the bus runtime reads it live, so a hand edit counts at the next
     // tester lifecycle call and at the take. Without it the broker's own copy decides.
     this.#testerOn = testerOn ?? ((business) => this.#business(business).vars?.['bus.tester'] === true);
-    // Row 298 (#1804, Q228): grantScope(business) reads {value, revision} atomically from the
-    // organization file. Without a configured reader no scope can authorize a grant.
-    this.#grantScope = grantScope ?? (() => ({ value: undefined, revision: null }));
     // Row 194 (#1692, D2.3): roleFile(name) loads role definition `name` from the roles directory as it
     // stands, for the hire checks. Without it a hire refuses not-configured.
     this.#roleFile = roleFile;
@@ -1535,78 +1527,12 @@ export class Broker {
     const raise = this.#raised(business, decision);
     if (d?.action !== 'credential.mint' || d.route_to !== 'human' || !raise?.grant) return null;
     const r = this.#closed(decision);
-    if (r?.op !== 'resolved' || r.choice !== raise.approvalChoice) return null;
-    // Row 298 (#1804, Q228, sage-3594 Q4): a scope close counts only with its own grant.scope.used,
-    // which only #scopeClose writes, under the grant actor.
-    if (r.via === 'scope') return r.by === SCOPE_BY && this.#scopeUsed(business, decision, r.seq, raise.grant) ? raise.grant : null;
-    if (r.by !== this.#business(business).human) return null;
+    if (r?.op !== 'resolved' || r.choice !== raise.approvalChoice || r.by !== this.#business(business).human) return null;
     // Row 252 (#1753, design section 3, J14): a console close counts only with its own human.input,
     // which only the broker writes (recordEvent reserves the kind).
     if (!(r.via === 'console' ? this.#consoleInput(business, decision, r) : r.via === 'cli')) return null;
     return raise.grant;
   }
-  // Row 298: the grant.scope.used record of scope close seq. Gitea and host grants only.
-  #scopeUsed(business, decision, seq, grant) {
-    if (grant.method !== 'gitea' && grant.method !== 'host') return false;
-    const row = this.#store.get(
-      `SELECT body FROM events WHERE business=? AND ${GRANT_EVIDENCE} AND json_extract(body,'$.action')='grant.scope.used'
-       AND json_extract(body,'$.grantDecision')=? AND json_extract(body,'$.decisionSeq')=? AND json_extract(body,'$.method')=? LIMIT 1`,
-      business, decision, seq, grant.method,
-    );
-    if (!row) return false;
-    const evidence = JSON.parse(row.body);
-    const checked = grantScopeOf(evidence.scope);
-    // Verify the immutable raise-time snapshot, not today's scope: scope changes do not
-    // invalidate already issued grants. The executor rechecks today's scope before spend.
-    return !checked.fallback && typeof evidence.revision === 'string' && /^[a-f0-9]{64}$/.test(evidence.revision) &&
-      evidence.agent === grant.agent && evidence.scopeSha256 === sha256(JSON.stringify(checked.scope)) &&
-      grantInScope(checked.scope, grant);
-  }
-  // Row 298: the live organization snapshot. Missing/bad scope covers nothing. An unreadable
-  // organization file or missing revision cannot authorize a scope close either.
-  #scopeNow(business) {
-    try {
-      const snapshot = this.#grantScope(business);
-      return { ...grantScopeOf(snapshot?.value), revision: snapshot?.revision ?? null };
-    } catch {
-      return { ...grantScopeOf(undefined), revision: null };
-    }
-  }
-
-  // Row 298 (D4, sage-3594 Q2/Q4): after a gitea or host raise, in its transaction. When the raiser is
-  // launch.by, the decision went to the human and the grant is inside the scope, the broker closes it
-  // with the approval choice, via 'scope', writes grant.scope.used and starts the executor, as the
-  // human's Approve does. The spend, the records and the revoke are row 236's and 235's, unchanged.
-  // Anything else is left in the inbox. launch.by is a hand edit, so a chief-of-staff instance the
-  // tester or an instances.set adds never raises in scope (Q6).
-  #scopeClose(s, view) {
-    if (s.role !== this.#business(s.business).launch?.by) return view;
-    const d = this.#store.get('SELECT id,route_to FROM decisions WHERE business=? AND id=?', s.business, view.id);
-    if (d?.route_to !== 'human' || this.#closed(d.id)) return view;
-    const raise = this.#raised(s.business, d.id);
-    const { scope, revision } = this.#scopeNow(s.business);
-    if (typeof revision !== 'string' || !/^[a-f0-9]{64}$/.test(revision)) return view;
-    if (!raise?.grant || !grantInScope(scope, raise.grant)) return view;
-    const seq = Number(
-      this.#store.run(
-        'INSERT INTO decision_events(decision,at,op,by,choice,note,via) VALUES(?,?,?,?,?,?,?)',
-        d.id, this.#now(), 'resolved', SCOPE_BY, raise.approvalChoice, null, 'scope',
-      ).lastInsertRowid,
-    );
-    this.#grantEvent(s.business, {
-      action: 'grant.scope.used', grantDecision: d.id, decisionSeq: seq, method: raise.grant.method,
-      agent: raise.grant.agent, scope, revision, scopeSha256: sha256(JSON.stringify(scope)),
-    }, d.id);
-    // As the resolve's: each executor rechecks all of this itself, so a rollback starts nothing.
-    if (raise.grant.method === 'host') setImmediate(() => this.#runHostGrant(s.business, d.id));
-    if (raise.grant.method === 'gitea') setImmediate(() => this.#startGitea(s.business, d.id));
-    return this.#decisionView(this.#decision(s, d.id));
-  }
-  // Row 298 (D6, sage-3594 Q5): at the spend, a scope close needs its grant still inside the scope.
-  // A narrowed scope ends it scope-changed, and the human's Approve is the way back.
-  #scopeRecheck(business, decision, g) {
-    if (this.#closed(decision)?.via === 'scope' && !grantInScope(this.#scopeNow(business).scope, g)) fail('scope-changed');
-  }
   // Row 252: the console answer's human.input for close row r. Same decision, same seq, same choice,
   // no role or run, and a three-string owner subject.
   #consoleInput(business, decision, r) {
@@ -1839,7 +1765,6 @@ export class Broker {
   }
   // r6 X2 step 1's checks after the spend, R4's binding again. Throws the code that ends the grant.
   #hostGrantRecheck(business, decision, g) {
-    this.#scopeRecheck(business, decision, g);
     if (!this.#hostGrant || !this.#hostKeys) fail('host-not-configured');
     const definition = this.#hostDefinition(business, g.agent);
     if (this.#hostGrant.definitionSha256(definition) !== g.definitionSha256) fail('decision-mismatch');
@@ -2640,7 +2565,7 @@ export class Broker {
         if (!this.#giteaGrant) fail('gitea-not-configured');
         const g = this.#giteaGrant.giteaGrantCheck(a.grant, this.#now().slice(0, 10));
         return this.#store.transaction(() => {
-          const result = this.#scopeClose(s, this.#dispatch(s, 'decision.raise', a, null, this.#giteaGrantBinding(s.business, g)));
+          const result = this.#dispatch(s, 'decision.raise', a, null, this.#giteaGrantBinding(s.business, g));
           this.#secretCheck(result);
           return result;
         });
@@ -2649,7 +2574,7 @@ export class Broker {
       if (a.grant?.method === 'host') {
         const g = this.#hostGrant.hostGrantCheck(a.grant, this.#now().slice(0, 10));
         return this.#store.transaction(() => {
-          const result = this.#scopeClose(s, this.#dispatch(s, 'decision.raise', a, null, this.#hostGrantBinding(s.business, g)));
+          const result = this.#dispatch(s, 'decision.raise', a, null, this.#hostGrantBinding(s.business, g));
           this.#secretCheck(result);
           return result;
         });
@@ -2771,7 +2696,6 @@ export class Broker {
   }
   // Section 4 step 1's checks after the spend. Throws the code that ends the grant.
   #giteaRecheck(business, decision, g) {
-    this.#scopeRecheck(business, decision, g);
     const { b, role, definition } = this.#giteaRole(business, g.agent);
     if (this.#giteaGrant.definitionSha256(definition) !== g.definitionSha256) fail('decision-mismatch');
     if (this.#giteaGrant.identitySha256(role, b.projects) !== g.identitySha256) fail('decision-mismatch');
@@ -2922,22 +2846,10 @@ export class Broker {
         } catch {}
         return code;
       }
-      // Step 1, one transaction: spend and recheck. scope-changed ends spent (D6);
-      // other refusals retain the existing rollback behavior.
+      // Step 1, one transaction: the spend and the rechecks. A refusal rolls the spend back.
       let checked;
       try {
-        checked = this.#store.transaction(() => {
-          const consumed = this.#consumeGrant(business, decision, 'gitea');
-          try {
-            return this.#giteaRecheck(business, decision, consumed);
-          } catch (e) {
-            // D6: scope narrowing is a terminal, spent failure. Other recheck
-            // refusals retain row 236's transaction/rollback behavior.
-            if (!(e instanceof BusError) || e.code !== 'scope-changed') throw e;
-            this.#giteaFailed(business, decision, agent, e.code);
-            return { scopeChanged: true };
-          }
-        });
+        checked = this.#store.transaction(() => this.#giteaRecheck(business, decision, this.#consumeGrant(business, decision, 'gitea')));
       } catch (e) {
         const code = e instanceof BusError ? e.code : 'gitea-failed';
         if (code !== 'not-authorized' && code !== 'decision-consumed') {
@@ -2947,7 +2859,6 @@ export class Broker {
         }
         return code;
       }
-      if (checked.scopeChanged) return 'scope-changed';
       return await this.#giteaSteps(business, decision, g, signal, log, api, meta, checked, stop);
     } finally {
       this.#giteaKeys.release(business, agent, signal);
@@ -4758,8 +4669,6 @@ export class Broker {
       if (CREDENTIAL_VERBS.includes(request.verb)) return this.#requestCredential(s, request.verb, structuredClone(args));
       if (request.verb === 'instance.hire' || request.verb === 'instance.fire')
         return this.#chiefLifecycle(s, request.verb, structuredClone(args));
-      if (request.verb === 'grants.scope' || request.verb === 'grants.scope.set')
-        return this.#grantScopeVerb(s, request.verb, structuredClone(args));
       if (["limits", "limits.set", "organization.set", "organization.revision", "plugins", "plugins.set", "instances", "instances.set", "routes", "routes.set", "veto.set"].includes(request.verb)) {
         // Row 123 (#1617, REQ-COS-1, REQ-LIMIT-1): organization.set is limits.set for a role whose
         // file lists organization.change. It takes the same keys, runs the same write path and
@@ -4857,34 +4766,6 @@ export class Broker {
       throw this.#refused(s, e, request);
     }
   }
-  // Row 298 (#1804, Q228, sage-3594 Q3): the chief's grant scope, read and written by the human at the
-  // cli alone, and the write is the human's Approve of the change. #human is the one check, so an
-  // agent, the chief, the tester and a reader refuse human-required (the Console's cap never gets
-  // here). bindHuman binds only the business's human. The writer is the organization writer's
-  // grantScope; ORGANIZATION_KEYS doesn't name grantScope, so organization.set and limits.set can't
-  // write it. Outside the store transaction, as the organization branch.
-  #grantScopeVerb(s, verb, a) {
-    this.#human(s);
-    if (!this.#organization) fail('not-configured');
-    if (verb === 'grants.scope') keys(a, []);
-    else keys(a, ['revision', 'scope'], ['revision', 'scope']);
-    let result;
-    try {
-      result = this.#organization(s.business, verb, a, s.human);
-    } catch (e) {
-      this.#organizationFail(e, verb);
-    }
-    this.#secretCheck(result);
-    // The change's record: the human proof bindHuman checked, and the old and new scopes' sha256.
-    // The writer's changes.jsonl entry holds the values.
-    if (verb === 'grants.scope.set')
-      this.#store.transaction(() => this.#grantEvent(s.business, {
-        action: 'grant.scope', by: s.human, via: s.via, outsideAgent: s.outsideAgent === true,
-        oldSha256: sha256(JSON.stringify(result.old)), newSha256: sha256(JSON.stringify(result.scope)),
-        transaction: result.transaction ?? null,
-      }));
-    return result;
-  }
   // Row 199 (#1697, design section 6). The token of an issue comes in args from the human's stdin; the
   // secret check above has refused one the bus already holds, a refusal records its code alone, and
   // nothing returned carries it. Outside the store transaction, as the organization branch.

packages/bus/src/runtime.mjs

@@ -323,8 +323,6 @@ export async function startBroker({
         if(verb==='instances')return instances.read(id,actor);
         // Row 65 (mos-0840): the Console's routing table.
         if(verb==='routes')return settings.routes(id);
-        // Row 298 (#1804, Q228): the chief's grant scope as the file stands, the fallback shown.
-        if(verb==='grants.scope')return instances.grantScopeRead(id);
         // Row 194 (#1692, V5): a delete's checks at the verb, with no write and no reload.
         if(verb==='instances.check')return instances.checkDelete(id,args.instance,actor);
         // Row 194 b6 (webby-0094 B1): a fire's checks against the file, before step A.
@@ -336,8 +334,6 @@ export async function startBroker({
         else if(verb==='plugins.set')result=plugins.set(id,args,actor);
         // Row 194 (#1692, V6): the human's keep and noHire lists, through the instance writer.
         else if(verb==='veto.set')result=instances.veto(id,args,actor);
-        // Row 298: the human's grant scope, through the instance writer.
-        else if(verb==='grants.scope.set')result=instances.grantScope(id,args,actor);
         // Row 194 (D2.1, D2.2): the chief's hire and fire, with the reason in the change context.
         else if(verb==='instance.hire')result=instances.hire(id,args,{actor,context});
         else if(verb==='instance.fire')result=instances.fire(id,{name:args.name},{actor,context});
@@ -369,13 +365,6 @@ export async function startBroker({
           return false;
         }
       },
-      // Row 298 (#1804, Q228): one read binds launch.grantScope to the organization revision.
-      // A missing organization reader or unreadable file cannot authorize an automatic grant.
-      grantScope: (id) => {
-        if (!settings) return { value: undefined, revision: null };
-        const { document, revision } = instances.writer.read(id);
-        return { value: document.launch?.grantScope, revision };
-      },
       // Row 194 (#1692, D4.1, B8): bus.tester as the file sets it now; an unreadable file is off.
       testerOn: (id) => {
         try {

packages/bus/tests/grant-scope-runtime.test.mjs

@@ -1,40 +0,0 @@
-// Row 298: the real runtime routes the human scope verb to the durable
-// organization writer. Everything lives under a scratch config/data root.
-import test from 'node:test';
-import assert from 'node:assert/strict';
-import { mkdirSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { startBroker } from '../src/runtime.mjs';
-import { businessDoc, rolesCopy, systemFor, writeJson } from '../../business/tests/helpers.mjs';
-
-// Break caught: missing runtime setter routing or losing the organization receipt.
-test('row 298 runtime: human scope approval writes the file and organization history at the supplied revision', async t => {
-  const root = mkdtempSync(join(tmpdir(), 'scope-runtime-'));
-  let runtime;
-  t.after(async () => { await runtime?.close(); rmSync(root, { recursive: true, force: true }); });
-  const rolesDir = rolesCopy(root);
-  const file = writeJson(join(root, 'businesses/demo.json'), businessDoc(root, 'demo'));
-  mkdirSync(join(root, 'data'), { mode: 0o700 });
-  runtime = await startBroker({ dataRoot: join(root, 'data'),
-    businesses: { demo: { id: 'demo', human: 'jason', arbiters: { technical: 'coder', delivery: 'coder' },
-      roles: { coder: { authority: { withinRole: [], crossRole: [] } } } } },
-    organization: { dir: root, rolesDir, system: systemFor(root) },
-  });
-  const human = runtime.broker.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });
-  const call = (verb, args = {}) => runtime.broker.request(human, { verb, args });
-  const before = call('grants.scope');
-  assert.deepEqual(before.scope, {});
-  const scope = { gitea: { agents: ['coder'], projects: ['stack'] } };
-  const saved = call('grants.scope.set', { revision: before.revision, scope });
-  assert.deepEqual(JSON.parse(readFileSync(file, 'utf8')).launch.grantScope, scope);
-  assert.deepEqual(call('grants.scope').scope, scope);
-  assert.notEqual(saved.revision, before.revision);
-  const entries = readFileSync(join(root, 'businesses/.history/demo/changes.jsonl'), 'utf8').trim().split('\n').map(JSON.parse);
-  assert.equal(entries.at(-1).state, 'committed');
-  assert.equal(entries.at(-1).actor, 'jason');
-  assert.equal(entries.at(-1).changes[0].path, 'launch.grantScope');
-  const bytes = readFileSync(file, 'utf8');
-  assert.throws(() => call('grants.scope.set', { revision: before.revision, scope: {} }), e => e.code === 'revision-conflict');
-  assert.equal(readFileSync(file, 'utf8'), bytes);
-});

packages/bus/tests/grant-scope.test.mjs

@@ -1,359 +0,0 @@
-// Row 298 (#1804, Q228): the chief of staff's grant scope at the broker. The human's grants.scope and
-// grants.scope.set (sage-3594 Q3), the in-scope close via 'scope' with grant.scope.used (Q4), the
-// spend recheck's scope-changed (Q5), and the out-of-scope raise that still waits for the human.
-// Gitea grants run against the fake Gitea in fake-gitea-api.mjs on 127.0.0.1; host grants stop at the
-// spend, as no host key store is configured, and nothing connects to a host. Every token is a fake the
-// fake made and none is printed. The organization writer is a fake here; the real one is
-// packages/business/tests/grant-scope.test.mjs.
-import test from 'node:test';
-import assert from 'node:assert/strict';
-import { createHash } from 'node:crypto';
-import { mkdirSync, mkdtempSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { Broker, GRANT_EVIDENCE, writeGrantEvent } from '../src/broker.mjs';
-import { Credentials } from '../src/credentials.mjs';
-import { giteaGrant, giteaKeys } from '../src/gitea-grant.mjs';
-import { hostGrant, grantKeys, fingerprint } from '../src/host-grant.mjs';
-import { Store } from '../src/store.mjs';
-import { checkGrantScope, grantScopeOf } from '../../business/src/vocabulary.mjs';
-import { fakeGiteaApi } from './fake-gitea-api.mjs';
-import { hostRecord, grantDecision } from './host-fixtures.mjs';
-
-const USER = 'demo-coder';
-const ENTRY = { address: '192.0.2.10', port: 22, user: 'jarvis', hostKeys: ['ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHostKeyForTests'] };
-const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
-const sha256 = (x) => createHash('sha256').update(x).digest('hex');
-const dayFrom = (n) => new Date(Date.now() + n * 86400000).toISOString().slice(0, 10);
-const options = [{ key: 'yes', text: 'Yes' }, { key: 'no', text: 'No' }];
-const none = { authority: { withinRole: ['message.send'], crossRole: [] } };
-const DEFINITIONS = {
-  'chief-of-staff': { roleVersion: 2, credentials: [] },
-  pm: { roleVersion: 2, credentials: [] },
-  coder: { roleVersion: 2, credentials: [{ service: 'gitea' }] },
-  ops: { roleVersion: 2, credentials: [{ service: 'host' }] },
-};
-const GITEA = { gitea: { agents: ['coder'], projects: ['app'] } };
-const HOST = { host: { agents: ['ops'], hosts: ['web1'], commands: [['systemctl', 'status', 'nginx']] } };
-const REVISION = 'a'.repeat(64);
-async function until(fn, ms = 10000) {
-  const end = Date.now() + ms;
-  while (!fn()) {
-    if (Date.now() > end) throw new Error('timed out');
-    await sleep(20);
-  }
-}
-const rejects = (p, code) => assert.rejects(Promise.resolve().then(p), (e) => (assert.equal(e.code, code), true));
-
-// opts.scope: the value grantScope answers, or a function called at each read.
-async function setup(t, opts = {}) {
-  const dir = mkdtempSync(join(tmpdir(), 'g298-'));
-  t.after(() => rmSync(dir, { recursive: true, force: true }));
-  const gitea = await fakeGiteaApi(t, join(dir, 'tls'));
-  gitea.addUser('acme');
-  gitea.addRepo('acme', 'app');
-  gitea.addRepo('acme', 'lib');
-  const configDir = join(dir, 'cfg');
-  mkdirSync(configDir, { mode: 0o700 });
-  const storeRoot = join(configDir, 'secrets', 'agents');
-  mkdirSync(join(dir, 'data'), { mode: 0o700 });
-  const store = new Store(join(dir, 'data'));
-  const credentials = new Credentials({ references: {}, storeRoot, dataRoot: join(dir, 'data') });
-  t.after(() => {
-    credentials.close();
-    store.close();
-  });
-  const business = {
-    id: 'demo',
-    human: 'jason',
-    arbiters: { technical: 'pm', delivery: 'pm' },
-    roles: {
-      chief: { definition: 'chief-of-staff', ...none },
-      // A second chief-of-staff instance, as an instances.set or the tester could add. It isn't launch.by.
-      chief2: { definition: 'chief-of-staff', ...none },
-      pm: { definition: 'pm', ...none },
-      coder: { definition: 'coder', ...none, identity: { name: 'Coder', email: '[email protected]', gitea: { url: gitea.url, user: USER } }, publish: ['app', 'lib'] },
-      ops: { definition: 'ops', ...none },
-    },
-    definitions: structuredClone(DEFINITIONS),
-    projects: Object.fromEntries(['app', 'lib'].map((p) => [p, { remote: `${gitea.url}/acme/${p}` }])),
-    launch: { by: 'chief', instances: ['pm', 'coder', 'ops'] },
-    vars: { 'bus.tester': true },
-  };
-  const grantApi = giteaGrant({ configDir, ca: gitea.ca, timeoutMs: 5000 });
-  grantApi.writeAdmin('demo', gitea.adminToken, { url: gitea.url, account: 'mosaic-grant', rotateBy: dayFrom(60), setAt: '2026-10-21T00:00:00.000Z' });
-  // The fake organization writer: the scope in a box, checked as the real writer checks it.
-  const box = { value: opts.scope };
-  const orgCalls = [];
-  const organization = (id, verb, args, actor) => {
-    orgCalls.push([verb, actor]);
-    if (verb === 'grants.scope') return { business: id, revision: REVISION, ...grantScopeOf(box.value) };
-    if (verb === 'grants.scope.set') {
-      const scope = checkGrantScope(args.scope);
-      if (scope === null) throw Object.assign(new Error('scope is not a grant scope'), { code: 'invalid-request' });
-      const old = grantScopeOf(box.value).scope;
-      box.value = scope;
-      return { business: id, scope, old, transaction: 'tx-298' };
-    }
-    return { revision: REVISION };
-  };
-  // Keep the real key generation/store/records; replace only remote host calls.
-  const hostLines = new Set();
-  const hostApi = {
-    ...hostGrant({ configDir, runRoot: join(configDir, 'secrets', 'run') }),
-    keyscan: async () => ENTRY.hostKeys,
-    install: async (_business, _host, _record, tag) => { hostLines.add(tag); },
-    verify: async () => {},
-    remove: async (_business, _host, _record, tag) => { hostLines.delete(tag); },
-  };
-  const broker = new Broker({
-    store,
-    businesses: { demo: business },
-    secretCheck: (value) => credentials.assertClean(value),
-    giteaGrant: grantApi,
-    giteaKeys: giteaKeys({ credentials, storeRoot }),
-    hostGrant: hostApi,
-    hostKeys: opts.hostKeys ? grantKeys({ credentials, storeRoot }) : null,
-    organization,
-    grantScope: () => ({ value: typeof box.value === 'function' ? box.value() : box.value, revision: Object.hasOwn(opts, 'revision') ? opts.revision : REVISION }),
-  });
-  const caps = {};
-  for (const role of ['chief', 'chief2', 'pm', 'ops']) {
-    caps[role] = broker.bindLaunch({ business: 'demo', role, run: role + '-run', harness: 'pi', address: role });
-    broker.request(caps[role], { verb: 'role.claim' });
-  }
-  caps.human = broker.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });
-  caps.tester = broker.bindTester({ business: 'demo' });
-  caps.reader = broker.bindReader({ business: 'demo' });
-  caps.console = broker.bindConsole({ business: 'demo', human: 'jason', subject: { provider: 'p', iss: 'https://idp.example.test', sub: 's' } });
-  hostRecord(store, { host: 'web1', entry: ENTRY });
-  const call = (who, verb, args = {}) => broker.request(caps[who], { verb, args });
-  const raiseGitea = (over = {}, who = 'chief') =>
-    call(who, 'decision.raise', {
-      action: 'credential.mint', question: 'Grant coder Gitea?', options, recommendation: 'yes', blocking: false,
-      grant: { method: 'gitea', agent: 'coder', target: { projects: ['app'] }, rotateBy: dayFrom(30), ...over },
-    });
-  const raiseHost = (over = {}, who = 'chief') =>
-    call(who, 'decision.raise', {
-      action: 'credential.mint', question: 'Grant ops web1?', options, recommendation: 'yes', blocking: false,
-      grant: { method: 'host', agent: 'ops', host: 'web1', commands: [['systemctl', 'status', 'nginx']], rotateBy: dayFrom(30), ...over },
-    });
-  const grantEvents = () =>
-    store.all(`SELECT body FROM events WHERE business='demo' AND ${GRANT_EVIDENCE} ORDER BY seq`).map((e) => JSON.parse(e.body));
-  const ended = (decision) => grantEvents().findLast((e) => e.grantDecision === decision && ['grant.applied', 'grant.failed'].includes(e.action));
-  const closes = (decision) => store.all('SELECT * FROM decision_events WHERE decision=? ORDER BY seq', decision);
-  const spent = (decision) => grantEvents().filter((e) => e.decision === decision && e.operation?.startsWith('grant.')).map((e) => e.operation);
-  const record = () => store.get("SELECT * FROM gitea_grants WHERE business='demo' AND agent='coder'");
-  return { store, broker, caps, box, orgCalls, call, raiseGitea, raiseHost, grantEvents, ended, closes, spent, record, gitea, hostLines };
-}
-
-test('row 298 (Q3): only the human at the cli reads or sets the scope; agents, the tester, a reader and the Console refuse', async (t) => {
-  const f = await setup(t);
-  for (const verb of ['grants.scope', 'grants.scope.set']) {
-    const args = verb === 'grants.scope' ? {} : { revision: REVISION, scope: GITEA };
-    for (const who of ['chief', 'chief2', 'pm', 'tester']) await rejects(() => f.call(who, verb, args), 'human-required');
-    await rejects(() => f.call('reader', verb, args), 'read-only');
-    await rejects(() => f.call('console', verb, args), 'human-required');
-  }
-  assert.deepEqual(f.orgCalls, []);
-  assert.equal(f.box.value, undefined);
-  assert.deepEqual(f.grantEvents().filter((e) => e.action === 'grant.scope'), []);
-});
-
-test('row 298 (Q1): organization.set and limits.set refuse a grantScope key, and nothing is written', async (t) => {
-  const f = await setup(t);
-  await rejects(() => f.call('human', 'limits.set', { revision: REVISION, grantScope: GITEA }), 'invalid-request');
-  await rejects(() => f.call('chief', 'organization.set', { revision: REVISION, grantScope: GITEA }), 'invalid-request');
-  assert.deepEqual(f.orgCalls, []);
-  assert.equal(f.box.value, undefined);
-});
-
-test('row 298 (Q3): the human verb writes the scope and a grant.scope record with the human proof and both sha256', async (t) => {
-  const f = await setup(t);
-  assert.deepEqual(await f.call('human', 'grants.scope'), { business: 'demo', revision: REVISION, scope: {}, fallback: false });
-  const r = await f.call('human', 'grants.scope.set', { revision: REVISION, scope: GITEA });
-  assert.deepEqual(r.scope, GITEA);
-  assert.deepEqual(f.orgCalls, [['grants.scope', 'jason'], ['grants.scope.set', 'jason']]);
-  const changes = f.grantEvents().filter((e) => e.action === 'grant.scope');
-  assert.deepEqual(changes, [{
-    action: 'grant.scope', by: 'jason', via: 'cli', outsideAgent: true,
-    oldSha256: sha256(JSON.stringify({})), newSha256: sha256(JSON.stringify(GITEA)), transaction: 'tx-298',
-  }]);
-  await rejects(() => f.call('human', 'grants.scope.set', { revision: REVISION, scope: { gitea: {} } }), 'invalid-request');
-  await rejects(() => f.call('human', 'grants.scope.set', { revision: REVISION }), 'invalid-request');
-  await rejects(() => f.call('human', 'grants.scope.set', { revision: REVISION, scope: {}, extra: 1 }), 'invalid-request');
-  assert.equal(f.grantEvents().filter((e) => e.action === 'grant.scope').length, 1);
-});
-
-test('row 298 (Q4): an in-scope Gitea grant is issued with no inbox item, logged with 236 records, and revocable', async (t) => {
-  const f = await setup(t, { scope: GITEA });
-  const d = await f.raiseGitea();
-  const [close] = f.closes(d.id);
-  assert.deepEqual([close.op, close.by, close.choice, close.via], ['resolved', 'grant-scope', 'yes', 'scope']);
-  assert.ok(f.grantEvents().some(e => e.action === 'grant.scope.used' && e.grantDecision === d.id), 'scope close must have protected evidence');
-  const inbox = await f.call('human', 'inbox');
-  assert.ok(!JSON.stringify(inbox).includes(d.id), 'the decision is not in the human inbox');
-  await until(() => f.ended(d.id));
-  await f.broker.giteaIdle();
-  assert.equal(f.ended(d.id).action, 'grant.applied');
-  const used = f.grantEvents().find((e) => e.action === 'grant.scope.used');
-  assert.deepEqual(used, {
-    action: 'grant.scope.used', grantDecision: d.id, decisionSeq: close.seq, method: 'gitea', agent: 'coder', scope: GITEA, revision: REVISION, scopeSha256: sha256(JSON.stringify(GITEA)),
-  });
-  assert.deepEqual(f.spent(d.id), ['grant.gitea']);
-  assert.equal(f.record().decision, d.id);
-  // The spend is row 236's: a second start finds it consumed.
-  assert.equal(await f.broker.runGiteaGrant('demo', d.id), 'decision-consumed');
-  const out = await f.call('human', 'grants.revoke', { service: 'gitea', agent: 'coder', reason: 'test' });
-  assert.deepEqual(out.serviceLeft, []);
-  assert.ok(f.grantEvents().some((e) => e.action === 'grant.revoked' && e.agent === 'coder'));
-  assert.equal(f.record(), undefined);
-});
-
-test('row 298: an out-of-scope Gitea grant waits for the human, whose Approve still issues it', async (t) => {
-  const f = await setup(t, { scope: GITEA });
-  const d = await f.raiseGitea({ target: { projects: ['app', 'lib'] } });
-  assert.deepEqual(f.closes(d.id), []);
-  assert.ok(JSON.stringify(await f.call('human', 'inbox')).includes(d.id));
-  assert.deepEqual(f.grantEvents().filter((e) => e.action === 'grant.scope.used'), []);
-  await f.call('human', 'decision.resolve', { id: d.id, choice: 'yes' });
-  await until(() => f.ended(d.id));
-  await f.broker.giteaIdle();
-  assert.equal(f.ended(d.id).action, 'grant.applied');
-});
-
-test('row 298: with no scope, a bad scope or an unreadable file, an in-scope-looking grant waits', async (t) => {
-  const bad = { gitea: { agents: ['coder'], projects: ['app'], note: 'not a key' } };
-  for (const scope of [undefined, bad, () => { throw new Error('unreadable'); }]) {
-    const f = await setup(t, { scope });
-    const d = await f.raiseGitea();
-    assert.deepEqual(f.closes(d.id), [], String(scope));
-    assert.deepEqual(f.grantEvents().filter((e) => e.action === 'grant.scope.used'), []);
-  }
-});
-
-test('row 298 (Q6): a chief-of-staff instance that is not launch.by never raises in scope', async (t) => {
-  const f = await setup(t, { scope: GITEA });
-  const d = await f.raiseGitea({}, 'chief2');
-  assert.deepEqual(f.closes(d.id), []);
-});
-
-test('row 298 (Q5): a scope narrowed between the raise and the spend ends the grant scope-changed', async (t) => {
-  let reads = 0;
-  const f = await setup(t, { scope: () => (reads++ === 0 ? GITEA : {}) });
-  const d = await f.raiseGitea();
-  assert.equal(f.closes(d.id)[0].via, 'scope');
-  await until(() => f.ended(d.id));
-  await f.broker.giteaIdle();
-  assert.deepEqual([f.ended(d.id).action, f.ended(d.id).code], ['grant.failed', 'scope-changed']);
-  assert.equal(f.record(), undefined);
-  assert.deepEqual(f.gitea.tokens(USER) ?? [], []);
-  assert.deepEqual(f.spent(d.id), ['grant.gitea']);
-  assert.equal(await f.broker.runGiteaGrant('demo', d.id), 'decision-consumed');
-});
-
-test('row 298 (Q2): an in-scope host grant is spent with no Approve; ls never covers lsblk, nor a scope command extra arguments', async (t) => {
-  const scope = { host: { agents: ['ops'], hosts: ['web1'], commands: [['ls'], ['systemctl', 'status', 'nginx']] } };
-  const f = await setup(t, { scope });
-  const d = await f.raiseHost();
-  assert.equal(f.closes(d.id)[0].via, 'scope');
-  await until(() => f.ended(d.id));
-  // The spend is row 235's. No host key store is configured, so the recheck after it ends here.
-  assert.deepEqual(f.spent(d.id), ['grant.host']);
-  assert.deepEqual([f.ended(d.id).action, f.ended(d.id).code], ['grant.failed', 'host-not-configured']);
-  for (const commands of [[['lsblk']], [['ls', '-l']], [['systemctl', 'restart']]]) {
-    const w = await f.raiseHost({ commands });
-    assert.deepEqual(f.closes(w.id), [], JSON.stringify(commands));
-  }
-});
-
-test('row 298 (Q5): a host scope narrowed before the spend ends scope-changed', async (t) => {
-  let reads = 0;
-  const f = await setup(t, { scope: () => (reads++ === 0 ? HOST : {}) });
-  const d = await f.raiseHost();
-  assert.equal(f.closes(d.id)[0].via, 'scope');
-  await until(() => f.ended(d.id));
-  assert.deepEqual([f.ended(d.id).action, f.ended(d.id).code], ['grant.failed', 'scope-changed']);
-  assert.deepEqual(f.spent(d.id), ['grant.host']);
-});
-
-// Break caught: accepting scope closes with no evidence or unbound evidence.
-test('row 298 Q4: missing scope evidence or a bad scope digest cannot authorize execution', async (t) => {
-  const f = await setup(t, { scope: GITEA });
-  const good = { scope: GITEA, scopeSha256: sha256(JSON.stringify(GITEA)), revision: REVISION };
-  for (const evidence of [
-    null,
-    { ...good, scopeSha256: '0'.repeat(64) },
-    { ...good, revision: null },
-    { ...good, scope: { gitea: 'all' } },
-    { ...good, agent: 'other' },
-    { ...good, method: 'host' },
-    { ...good, decisionSeq: 999999 },
-  ]) {
-    const grant = { method: 'gitea', agent: 'coder', target: { projects: ['app'] }, rotateBy: dayFrom(30) };
-    const id = grantDecision(f.store, { grant, close: { op: 'resolved', by: 'grant-scope', choice: 'yes', via: 'scope' } });
-    if (evidence) writeGrantEvent(f.store, new Date().toISOString(), 'demo', {
-      action: 'grant.scope.used', grantDecision: id, decisionSeq: f.closes(id)[0].seq,
-      method: 'gitea', agent: 'coder', ...evidence,
-    }, id);
-    assert.equal(await f.broker.runGiteaGrant('demo', id), 'not-authorized');
-    assert.deepEqual(f.spent(id), []);
-    assert.equal(f.record(), undefined);
-  }
-  // Positive control: the same fixture with valid scope evidence reaches the
-  // next grant check. Its intentionally absent definition binding refuses there.
-  const id = grantDecision(f.store, {
-    grant: { method: 'gitea', agent: 'coder', target: { projects: ['app'] }, rotateBy: dayFrom(30) },
-    close: { op: 'resolved', by: 'grant-scope', choice: 'yes', via: 'scope' },
-  });
-  writeGrantEvent(f.store, new Date().toISOString(), 'demo', {
-    action: 'grant.scope.used', grantDecision: id, decisionSeq: f.closes(id)[0].seq,
-    method: 'gitea', agent: 'coder', ...good,
-  }, id);
-  assert.equal(await f.broker.runGiteaGrant('demo', id), 'decision-mismatch');
-  assert.deepEqual(f.spent(id), []);
-  assert.equal(f.record(), undefined);
-});
-
-// Break caught: host grants bypassing records or losing the ordinary revoke path.
-test('row 298 T4/T8: an in-scope host grant issues, records and revokes through the existing executor', async (t) => {
-  const f = await setup(t, { scope: HOST, hostKeys: true });
-  const d = await f.raiseHost();
-  assert.equal(f.closes(d.id)[0].via, 'scope');
-  assert.ok(!JSON.stringify(await f.call('human', 'inbox')).includes(d.id));
-  await until(() => f.ended(d.id));
-  await f.broker.grantsIdle();
-  assert.equal(f.ended(d.id).action, 'grant.applied');
-  assert.equal(f.store.get("SELECT decision FROM host_grants WHERE agent='ops'").decision, d.id);
-  assert.equal(f.hostLines.size, 1);
-  await f.call('human', 'grants.scope.set', { revision: REVISION, scope: {} });
-  // Historical approval still passes #hostAccess after scope is narrowed;
-  // only the absent command executor refuses this call, before any sudo decision.
-  await rejects(() => f.broker.requestHost(f.caps.ops,
-    { verb: 'host.run', args: { host: 'web1', argv: ['systemctl', 'status', 'nginx'] } }, null), 'host-not-configured');
-  await f.call('human', 'hosts.revoke', { agent: 'ops', host: 'web1', reason: 'test' });
-  assert.equal(f.store.get("SELECT decision FROM host_grants WHERE agent='ops'"), undefined);
-  assert.equal(f.hostLines.size, 0);
-  assert.ok(f.grantEvents().some(e => e.action === 'grant.revoked' && e.agent === 'ops'));
-});
-
-// Break caught: a new host enrollment entering the scope shortcut.
-test('row 298 T6: host enrollment stays open for human Approve even with both methods in scope', async (t) => {
-  const f = await setup(t, { scope: { ...GITEA, ...HOST } });
-  const d = await f.call('chief', 'decision.raise', {
-    action: 'credential.mint', question: 'Enroll host?', options, recommendation: 'yes', blocking: false,
-    grant: { method: 'host-enroll', host: 'web2', address: ENTRY.address, port: ENTRY.port,
-      user: ENTRY.user, sudo: true, fingerprints: ENTRY.hostKeys.map(fingerprint) },
-  });
-  assert.deepEqual(f.closes(d.id), []);
-  assert.ok(JSON.stringify(await f.call('human', 'inbox')).includes(d.id));
-  assert.deepEqual(f.grantEvents().filter(e => e.action === 'grant.scope.used'), []);
-});
-
-// Break caught: using a scope without a verifiable organization revision.
-test('row 298: scope without an organization revision never closes automatically', async (t) => {
-  const f = await setup(t, { scope: GITEA, revision: null });
-  const d = await f.raiseGitea();
-  assert.deepEqual(f.closes(d.id), []);
-  assert.deepEqual(f.spent(d.id), []);
-});

packages/bus/tests/project-runtime.test.mjs

@@ -33,7 +33,7 @@ test('Broker keeps the sandbox client import closure: only the listed imports, n
     // Row 236 (#1742, #436b) reads giteaName and parseGiteaUrl for the Gitea grant path.
     // FED R3 r5 (row 274, #414) reads covers, a user's grant check, from it.
     // Row 219 reads THREAD_DEFINITIONS from the same vocabulary for creative thread admission.
-    "import { ID_PATTERN, THREAD_DEFINITIONS, END_PROTECTED, forkProblem, forkUrl, credentialKind, validArgv, commandAllowed, HOST_ID, CREATIVE_DEFINITIONS, unhireableAction, giteaName, parseGiteaUrl, covers, grantScopeOf, grantInScope } from '../../business/src/vocabulary.mjs';",
+    "import { ID_PATTERN, THREAD_DEFINITIONS, END_PROTECTED, forkProblem, forkUrl, credentialKind, validArgv, commandAllowed, HOST_ID, CREATIVE_DEFINITIONS, unhireableAction, giteaName, parseGiteaUrl, covers } from '../../business/src/vocabulary.mjs';",
   ]);
   assert.doesNotMatch(source, /\bimport\s*\(/);
   assert.doesNotMatch(readFileSync(new URL('../src/landing.mjs', import.meta.url), 'utf8'), /\bimport\b/);

packages/business/src/business.mjs

@@ -175,7 +175,7 @@ function checkLaunch(launch, roles, definitions, file) {
   const where = `${file} launch`;
   requireObject(launch, where);
   if (Object.hasOwn(launch,"max")) refuse(`${where}.max needs migration: mosaic limits migrate --file FILE --models FILE`);
-  rejectUnknownKeys(launch, ["by", "instances", "models", "limits", "threadIdleSeconds", "account", "keep", "noHire", "grantScope"], where);
+  rejectUnknownKeys(launch, ["by", "instances", "models", "limits", "threadIdleSeconds", "account", "keep", "noHire"], where);
   requireId(launch.by, `${where}.by`);
   if (!Object.hasOwn(roles, launch.by)) refuse(`${where}.by names ${launch.by}, which the business file doesn't declare`);
   const launcher = definitions[roles[launch.by].definition];
@@ -212,9 +212,6 @@ function checkLaunch(launch, roles, definitions, file) {
   return {
     by: launch.by, instances, models, limits, threadIdleSeconds, ...(account ? { account } : {}),
     ...(keep ? { keep } : {}), ...(noHire ? { noHire } : {}),
-    // Row 298 (#1804, Q228): the chief's grant scope passes through unchecked. A bad value must not
-    // refuse the whole file; the broker's reader (grantScopeOf) falls back to the empty scope instead.
-    ...(launch.grantScope !== undefined ? { grantScope: structuredClone(launch.grantScope) } : {}),
   };
 }
 

packages/business/src/instance-settings.mjs

@@ -14,12 +14,11 @@ import { resolveInstance } from "./resolve.mjs";
 import { loadRole } from "./role.mjs";
 import { refuse } from "./errors.mjs";
 import { isPlainObject, canonicalJson } from "./util.mjs";
-import { CREATIVE_DEFINITIONS, END_PROTECTED, HOST_SERVICE, ID_PATTERN, checkGrantScope, grantScopeOf } from "./vocabulary.mjs";
+import { CREATIVE_DEFINITIONS, END_PROTECTED, HOST_SERVICE, ID_PATTERN } from "./vocabulary.mjs";
 
 const SET_KEYS = ["revision", "instance", "op", "definition", "vars", "launch", "tracker"];
 const VETO_KEYS = ["revision", "op", "name"];
 const VETO_OPS = ["keep", "unkeep", "nohire", "hire"];
-const SCOPE_KEYS = ["revision", "scope"];
 const id = value => typeof value === "string" && ID_PATTERN.test(value);
 const revisionOk = value => typeof value === "string" && /^[a-f0-9]{64}$/.test(value);
 // Row 194 (D2.2, N3): the vars a hire may set, the ones the chief can already set on an instance.
@@ -303,32 +302,6 @@ export function instanceSettings({ dir, rolesDir, system, levels = () => null, r
     return commit(business, old, next, { revision: args.revision, actor });
   }
 
-  // Row 298 (#1804, Q228): the chief's grant scope as the file stands. scope is the one the broker
-  // applies, so a bad value reads as {} with fallback true.
-  function grantScopeRead(business) {
-    const { document, revision } = writer.read(business);
-    if (!document.launch) throw new OrganizationError("organization-launch-not-configured");
-    return { business, revision, ...grantScopeOf(document.launch.grantScope) };
-  }
-
-  // Row 298: args { revision, scope }. Human-only at the broker (grants.scope.set), and the only
-  // writer of launch.grantScope: SET_KEYS and the organization.set keys don't name it. The scope is
-  // checked strictly here; {} removes the key. old is what the broker applied before the write,
-  // the fallback included.
-  function grantScope(business, args, actor) {
-    if (!isPlainObject(args) || Object.keys(args).some(key => !SCOPE_KEYS.includes(key))) throw new OrganizationError("invalid-request");
-    if (!revisionOk(args.revision)) throw new OrganizationError("invalid-request");
-    const scope = checkGrantScope(args.scope);
-    if (scope === null) throw new OrganizationError("invalid-request", "scope is not a grant scope");
-    const old = writer.read(business).document;
-    if (!old.launch) throw new OrganizationError("organization-launch-not-configured");
-    const next = structuredClone(old);
-    if (Object.keys(scope).length === 0) delete next.launch.grantScope;
-    else next.launch.grantScope = scope;
-    const before = grantScopeOf(old.launch.grantScope).scope;
-    return { ...commit(business, old, next, { revision: args.revision, actor }), scope, old: before };
-  }
-
   // Row 194 (#1692, D2.2): the chief's hire, after the broker's identity, grant, allowlist and
   // hireable checks. args { name, definition, vars? }. A new name is added and listed. A fired name
   // (declared, not listed) is listed again only with its own definition and no vars. The writer
@@ -446,5 +419,5 @@ export function instanceSettings({ dir, rolesDir, system, levels = () => null, r
     return { ...read(business, actor), transaction: receipt.transaction, restart: false };
   }
 
-  return { writer, read, set, checkDelete, checkFire, veto, hire, fire, grantScope, grantScopeRead };
+  return { writer, read, set, checkDelete, checkFire, veto, hire, fire };
 }

packages/business/src/vocabulary.mjs

@@ -299,73 +299,3 @@ export function covers(grant, { business, project, instance }, now, { level } =
   if (!LEVELS.includes(grant.level) || LEVELS.indexOf(grant.level) > LEVELS.indexOf(level)) return false;
   return true;
 }
-
-// Row 298 (#1804, Q228): the chief of staff's grant scope, launch.grantScope in the organization
-// file. Only the human writes it (grants.scope.set). A Gitea or host grant the enrolled chief raises
-// inside it is issued with no per-grant Approve; anything else waits for the human as before. The
-// broker and the writer read these, and they live here because the session sandbox mounts this file
-// (seat/src/sandbox.mjs RUNNER_FILES) and the runner loads broker.mjs.
-//
-// Shape: { gitea?: { agents, projects }, host?: { agents, hosts, commands } }.
-// Each list is distinct and nonempty. A commands entry covers a requested prefix equal to it,
-// token for token and with equal length. No entry matches part of a token, so
-// ["ls"] never covers ["lsblk"]. Enrollment (host-enroll) is never in scope. {} is the empty scope.
-export const GRANT_SCOPE_EMPTY = Object.freeze({});
-const SCOPE_IDS = (value) =>
-  Array.isArray(value) && value.length > 0 && value.length <= 256 &&
-  value.every((x) => typeof x === "string" && ID_PATTERN.test(x)) && new Set(value).size === value.length;
-const SCOPE_ARGVS = (value) =>
-  Array.isArray(value) && value.length > 0 && value.length <= 256 && value.every(validArgv) &&
-  new Set(value.map((argv) => JSON.stringify(argv))).size === value.length;
-const SCOPE_PLAIN = (value) => typeof value === "object" && value !== null && !Array.isArray(value) && Object.getPrototypeOf(value) === Object.prototype;
-
-// The scope, rebuilt in a fixed key order so JSON.stringify of it is stable, or null when the value
-// isn't one. The writer refuses null; the readers fall back (grantScopeOf).
-export function checkGrantScope(value) {
-  if (!SCOPE_PLAIN(value) || Object.keys(value).some((k) => k !== "gitea" && k !== "host")) return null;
-  const out = {};
-  if (value.gitea !== undefined) {
-    const g = value.gitea;
-    if (!SCOPE_PLAIN(g) || Object.keys(g).some((k) => k !== "agents" && k !== "projects")) return null;
-    if (!SCOPE_IDS(g.agents) || !SCOPE_IDS(g.projects)) return null;
-    out.gitea = { agents: [...g.agents], projects: [...g.projects] };
-  }
-  if (value.host !== undefined) {
-    const h = value.host;
-    if (!SCOPE_PLAIN(h) || Object.keys(h).some((k) => !["agents", "hosts", "commands"].includes(k))) return null;
-    if (!SCOPE_IDS(h.agents) || !Array.isArray(h.hosts) || !h.hosts.every((x) => typeof x === "string" && HOST_ID.test(x)) || !SCOPE_IDS(h.hosts)) return null;
-    if (!SCOPE_ARGVS(h.commands)) return null;
-    out.host = {
-      agents: [...h.agents], hosts: [...h.hosts],
-      commands: h.commands.map((argv) => [...argv]),
-    };
-  }
-  return out;
-}
-
-// What the readers use: a missing key is the empty scope, and a bad value falls back to it, with
-// fallback true. The empty scope puts every grant in front of the human, so a bad value fails closed.
-export function grantScopeOf(value) {
-  if (value === undefined) return { scope: GRANT_SCOPE_EMPTY, fallback: false };
-  const scope = checkGrantScope(value);
-  return scope === null ? { scope: GRANT_SCOPE_EMPTY, fallback: true } : { scope, fallback: false };
-}
-
-// Whether a raise's grant body is inside a checked scope. Only gitea and host bodies can be.
-export function grantInScope(scope, body) {
-  if (body?.method === "gitea") {
-    const g = scope.gitea;
-    return Boolean(g) && g.agents.includes(body.agent) &&
-      Array.isArray(body.target?.projects) && body.target.projects.length > 0 &&
-      body.target.projects.every((p) => g.projects.includes(p));
-  }
-  if (body?.method === "host") {
-    const h = scope.host;
-    const same = (a, b) => a.length === b.length && a.every((x, i) => x === b[i]);
-    return Boolean(h) && h.agents.includes(body.agent) && h.hosts.includes(body.host) &&
-      Array.isArray(body.commands) && body.commands.length > 0 &&
-      body.commands.every((argv) =>
-        h.commands.some((c) => same(argv, c)));
-  }
-  return false;
-}

packages/business/tests/grant-scope.test.mjs

@@ -1,124 +0,0 @@
-// Row 298 (#1804, Q228): the chief of staff's grant scope, launch.grantScope. The shape check, the
-// readers' fallback, the match rules (sage-3594 Q2) and the one writer. The broker's verbs, the
-// in-scope close and the executors are bus tests (packages/bus/tests/grant-scope.test.mjs).
-import test, { after } from "node:test";
-import assert from "node:assert/strict";
-import { readFileSync, rmSync } from "node:fs";
-import { join } from "node:path";
-import { instanceSettings } from "../src/instance-settings.mjs";
-import { launchSettings } from "../src/launch-settings.mjs";
-import { loadBusiness } from "../src/business.mjs";
-import { checkGrantScope, grantInScope, grantScopeOf } from "../src/vocabulary.mjs";
-import { businessDoc, rolesCopy, systemFor, tmp, writeJson } from "./helpers.mjs";
-
-const roots = [];
-after(() => roots.forEach(root => rmSync(root, { recursive: true, force: true })));
-
-const GITEA = { gitea: { agents: ["coder"], projects: ["app", "lib"] } };
-const HOST = { host: { agents: ["ops"], hosts: ["web1"], commands: [["systemctl", "status", "nginx"], ["ls"]] } };
-const gitea = (over = {}) => ({ method: "gitea", agent: "coder", target: { projects: ["app"] }, ...over });
-const host = (commands, over = {}) => ({ method: "host", agent: "ops", host: "web1", commands, ...over });
-
-function fixture(mutate) {
-  const root = tmp();
-  roots.push(root);
-  const rolesDir = rolesCopy(root);
-  const doc = businessDoc(root, "acme");
-  mutate?.(doc);
-  const dir = join(root, "config");
-  const file = writeJson(join(dir, "businesses", "acme.json"), doc);
-  const settings = instanceSettings({ dir, rolesDir, system: systemFor(root) });
-  const limits = launchSettings({ dir, rolesDir, system: systemFor(root) });
-  const onDisk = () => JSON.parse(readFileSync(file, "utf8"));
-  const log = () => readFileSync(settings.writer.logFile("acme"), "utf8").trim().split("\n").map(line => JSON.parse(line));
-  const revision = () => settings.read("acme").revision;
-  return { root, dir, rolesDir, file, settings, limits, onDisk, log, revision };
-}
-
-test("row 298: checkGrantScope takes the D2 shape and refuses anything else", () => {
-  assert.deepEqual(checkGrantScope({}), {});
-  assert.deepEqual(checkGrantScope(GITEA), GITEA);
-  assert.deepEqual(checkGrantScope(HOST), HOST);
-  assert.deepEqual(checkGrantScope({ host: { agents: ["ops"], hosts: ["web1"], commands: [["uptime"]] } }).host.commands, [["uptime"]]);
-  for (const bad of [
-    null, [], "x", { other: {} }, { gitea: [] }, { gitea: { agents: ["coder"] } }, { gitea: { agents: [], projects: ["app"] } },
-    { gitea: { agents: ["coder", "coder"], projects: ["app"] } }, { gitea: { agents: ["Coder"], projects: ["app"] } },
-    { gitea: { agents: ["coder"], projects: ["app"], extra: 1 } }, { host: { agents: ["ops"], hosts: ["web1"] } },
-    { host: { agents: ["ops"], hosts: ["web_1"], commands: [["ls"]] } }, { host: { agents: ["ops"], hosts: ["web1"], commands: [[]] } },
-    { host: { agents: ["ops"], hosts: ["web1"], commands: [["ls"], ["ls"]] } }, { host: { agents: ["ops"], hosts: ["web1"], commands: [["bin/ls"]] } },
-    { host: { agents: ["ops"], hosts: ["web1"], commandPrefixes: [["ls"]] } }, { "host-enroll": {} },
-  ])
-    assert.equal(checkGrantScope(bad), null, JSON.stringify(bad));
-});
-
-test("row 298: a missing scope is empty and a bad one falls back to empty, which covers nothing", () => {
-  assert.deepEqual(grantScopeOf(undefined), { scope: {}, fallback: false });
-  assert.deepEqual(grantScopeOf(GITEA), { scope: GITEA, fallback: false });
-  const bad = { gitea: { agents: ["coder"], projects: ["app"], extra: true } };
-  assert.deepEqual(grantScopeOf(bad), { scope: {}, fallback: true });
-  assert.equal(grantInScope(grantScopeOf(bad).scope, gitea()), false);
-  assert.equal(grantInScope({}, gitea()), false);
-  assert.equal(grantInScope({}, host([["ls"]])), false);
-});
-
-test("row 298: a Gitea grant is in scope only when its agent and every project are listed", () => {
-  assert.equal(grantInScope(GITEA, gitea()), true);
-  assert.equal(grantInScope(GITEA, gitea({ target: { projects: ["app", "lib"] } })), true);
-  assert.equal(grantInScope(GITEA, gitea({ target: { projects: ["app", "old"] } })), false);
-  assert.equal(grantInScope(GITEA, gitea({ agent: "research" })), false);
-  assert.equal(grantInScope(GITEA, gitea({ target: { projects: [] } })), false);
-  assert.equal(grantInScope(HOST, gitea()), false);
-});
-
-test("row 298 (sage-3594 Q2): host commands match whole argv tokens, and enrollment is never in scope", () => {
-  assert.equal(grantInScope(HOST, host([["systemctl", "status", "nginx"]])), true);
-  // A commands entry covers only itself: no extra trailing arguments, no shorter prefix.
-  assert.equal(grantInScope(HOST, host([["systemctl", "status", "nginx", "--now"]])), false);
-  assert.equal(grantInScope(HOST, host([["systemctl", "status"]])), false);
-  // No scope entry permits extending the requested command prefix.
-  assert.equal(grantInScope(HOST, host([["ls"]])), true);
-  assert.equal(grantInScope(HOST, host([["ls", "-l", "/var"]])), false);
-  assert.equal(grantInScope(HOST, host([["lsblk"]])), false);
-  assert.equal(grantInScope(HOST, host([["ls"], ["lsblk"]])), false);
-  assert.equal(grantInScope(HOST, host([["ls"]], { host: "web2" })), false);
-  assert.equal(grantInScope(HOST, host([["ls"]], { agent: "coder" })), false);
-  assert.equal(grantInScope(HOST, { method: "host-enroll", host: "web1" }), false);
-  assert.equal(grantInScope({ ...HOST, "host-enroll": true }, { method: "host-enroll", host: "web1" }), false);
-});
-
-test("row 298: a bad grantScope in the file still loads, and the read shows the fallback", () => {
-  const f = fixture(doc => { doc.launch.grantScope = { gitea: "everything" }; });
-  const business = loadBusiness("acme", { dir: f.dir, rolesDir: f.rolesDir });
-  assert.deepEqual(business.launch.grantScope, { gitea: "everything" });
-  assert.deepEqual(f.settings.grantScopeRead("acme"), { business: "acme", revision: f.revision(), scope: {}, fallback: true });
-});
-
-test("row 298: the writer checks the scope, logs the change and removes the key for {}", () => {
-  const f = fixture();
-  assert.deepEqual(f.settings.grantScopeRead("acme").scope, {});
-  const r = f.settings.grantScope("acme", { revision: f.revision(), scope: GITEA }, "jason");
-  assert.deepEqual(r.scope, GITEA);
-  assert.deepEqual(r.old, {});
-  assert.ok(typeof r.transaction === "string" && r.transaction.length > 0);
-  assert.deepEqual(f.onDisk().launch.grantScope, GITEA);
-  assert.equal(f.log().at(-1).actor, "jason");
-  const back = f.settings.grantScope("acme", { revision: f.revision(), scope: {} }, "jason");
-  assert.deepEqual(back.old, GITEA);
-  assert.equal(Object.hasOwn(f.onDisk().launch, "grantScope"), false);
-  const bytes = readFileSync(f.file, "utf8");
-  assert.throws(() => f.settings.grantScope("acme", { revision: f.revision(), scope: { gitea: {} } }, "jason"), e => e.code === "invalid-request");
-  assert.throws(() => f.settings.grantScope("acme", { revision: f.revision(), scope: GITEA, extra: 1 }, "jason"), e => e.code === "invalid-request");
-  assert.throws(() => f.settings.grantScope("acme", { revision: "0".repeat(64), scope: GITEA }, "jason"), e => e.code === "revision-conflict");
-  assert.throws(() => f.settings.grantScope("acme", { revision: f.revision(), scope: {} }, "jason"), e => e.code === "organization-no-change");
-  assert.equal(readFileSync(f.file, "utf8"), bytes);
-});
-
-test("row 298 (sage-3594 Q1): the general writers can't write grantScope", () => {
-  const f = fixture();
-  const bytes = readFileSync(f.file, "utf8");
-  assert.throws(() => f.limits.set("acme", { revision: f.revision(), grantScope: GITEA }, "jason"));
-  assert.throws(() => f.limits.set("acme", { revision: f.revision(), grantScope: GITEA }, "chief-of-staff.chief"));
-  assert.throws(() => f.settings.set("acme", { revision: f.revision(), instance: "coder", op: "change", grantScope: GITEA }, "jason"), e => e.code === "invalid-request");
-  assert.throws(() => f.settings.veto("acme", { revision: f.revision(), op: "keep", name: "coder", grantScope: GITEA }, "jason"), e => e.code === "invalid-request");
-  assert.equal(readFileSync(f.file, "utf8"), bytes);
-});

packages/cli/README.md

@@ -1080,37 +1080,6 @@ reads the admin token on stdin, never argv; `admin rotate gitea --rotate-by DATE
 gitea --finish` and `admin remove gitea` keep the slot. run and admin are the human's alone. Nothing
 prints a token. A usage error exits 4 and a bus refusal 2.
 
-`mosaic grants scope --business ID` reads the chief of staff's effective scope,
-its organization revision, and whether a bad value fell back to empty (Q228,
-row 298). `mosaic grants scope set --business ID --revision REV` reads scope JSON
-from stdin. This human-shell command is Approve for the scope change; it refuses
-agent callers through the same guard and human transport as `mosaic access`.
-Neither command accepts `--tester`. No Console page or chief-raised scope-change
-request exists. A stale revision refuses; malformed scope input writes nothing.
-
-The setting is `launch.grantScope` in the business organization file. It defaults
-to `{}`, which covers nothing; a missing or invalid value has the same effect.
-Only Jason sets the live value. The supported shapes are:
-
-```json
-{
-  "gitea": { "agents": ["coder"], "projects": ["app"] },
-  "host": { "agents": ["ops"], "hosts": ["web1"], "commands": [["systemctl", "status", "nginx"]] }
-}
-```
-
-Either method may be omitted. All lists are distinct and nonempty. Every target
-project, agent, host and command must be listed for its method. Command arrays
-match token for token with equal lengths: `["ls"]` covers neither `["lsblk"]`
-nor `["ls", "-l"]`. Host enrollment always needs per-grant Approve.
-An in-scope request from the enrolled chief is closed and issued by the protected
-grant executor without an inbox approval; other requests wait for Approve.
-All grants retain their records and revoke path. Narrowing the scope before a
-grant is spent fails that grant with `scope-changed`; existing issued grants
-remain revocable. Setting `{}` removes the setting and restores per-grant Approve.
-Scope changes have organization receipts and a `grant.scope` event with the
-human proof and old/new digests; each automatic approval has `grant.scope.used`.
-
 ## Access (FED R5, #414)
 
 ```

packages/cli/src/grants.mjs

@@ -2,20 +2,16 @@
 // starts the executor of a decision the human said yes to, and admin set, rotate and remove keep the
 // admin slot; those are the human's alone. status is the human's, the tester's or the chief's; revoke
 // and sweep the human's or, with --tester, the tester's. admin set reads the admin token on stdin, never
-// argv, and nothing here prints a token: the answers carry ids and names only. Row 298 (#1804, Q228):
-// scope reads the chief of staff's grant scope and scope set writes it from JSON on stdin; both are
-// the human's, and the set is the human's Approve of the change.
+// argv, and nothing here prints a token: the answers carry ids and names only.
 import { CliError } from "./errors.mjs";
 
 export const GRANTS_USAGE =
   "mosaic grants status gitea [--json] [--tester] [--business ID] | run DECISION [--business ID] | " +
   "revoke AGENT gitea --reason R [--tester] [--business ID] | sweep gitea [--tester] [--business ID] | " +
   "admin set gitea --url URL --account NAME --rotate-by DATE [--business ID] | " +
-  "admin rotate gitea --rotate-by DATE | admin rotate gitea --finish | admin remove gitea | " +
-  "scope [--business ID] | scope set --revision REV [--business ID] (the scope JSON on stdin)";
+  "admin rotate gitea --rotate-by DATE | admin rotate gitea --finish | admin remove gitea";
 const MAX_TOKEN = 16384;
-const MAX_SCOPE = 65536;
-const VALUES = ["--business", "--reason", "--url", "--account", "--rotate-by", "--revision"];
+const VALUES = ["--business", "--reason", "--url", "--account", "--rotate-by"];
 
 function parse(args) {
   const out = { positional: [], flags: new Set(), values: {} };
@@ -44,21 +40,6 @@ async function readToken(stdin) {
   return text;
 }
 
-// Row 298: the whole of stdin, one JSON scope. {} is the empty scope.
-async function readScope(stdin) {
-  let text = "";
-  for await (const chunk of stdin) {
-    text += chunk;
-    if (text.length > MAX_SCOPE) throw new CliError("refused: the scope on stdin is too long", 2);
-  }
-  if (!text.trim()) throw new CliError("refused: no scope on stdin; pipe the scope JSON, {} for none", 4);
-  try {
-    return JSON.parse(text);
-  } catch {
-    throw new CliError("refused: the scope on stdin is not JSON", 4);
-  }
-}
-
 // Each shape: the positional count after the verb, the flags and values it takes and needs.
 const SHAPES = {
   status: { n: 1, flags: ["--json", "--tester"], need: [], may: ["--business"] },
@@ -68,8 +49,6 @@ const SHAPES = {
   "admin set": { n: 1, flags: [], need: ["--url", "--account", "--rotate-by"], may: ["--business"] },
   "admin rotate": { n: 1, flags: ["--finish"], need: [], may: ["--rotate-by", "--business"] },
   "admin remove": { n: 1, flags: [], need: [], may: ["--business"] },
-  scope: { n: 0, flags: [], need: [], may: ["--business"] },
-  "scope set": { n: 0, flags: [], need: ["--revision"], may: ["--business"] },
 };
 
 const lines = (s) => {
@@ -92,9 +71,6 @@ export async function grantsCommand(args, io, callFor) {
   if (verb === "admin") {
     verb = `admin ${rest[0] ?? ""}`;
     rest = rest.slice(1);
-  } else if (verb === "scope" && rest[0] === "set") {
-    verb = "scope set";
-    rest = rest.slice(1);
   }
   // Own keys only, so `constructor` is a usage error, not a verb.
   const shape = Object.hasOwn(SHAPES, verb ?? "") ? SHAPES[verb] : null;
@@ -103,7 +79,7 @@ export async function grantsCommand(args, io, callFor) {
     [...parsed.flags].some((f) => !shape.flags.includes(f)) ||
     Object.keys(parsed.values).some((v) => !shape.need.includes(v) && !shape.may.includes(v)) ||
     shape.need.some((v) => !Object.hasOwn(parsed.values, v)) ||
-    (verb !== "run" && verb !== "scope" && verb !== "scope set" && rest.at(-1) !== "gitea") ||
+    (verb !== "run" && rest.at(-1) !== "gitea") ||
     (verb === "admin rotate" && parsed.flags.has("--finish") === Object.hasOwn(parsed.values, "--rotate-by"))
   )
     throw new CliError(GRANTS_USAGE, 4);
@@ -117,8 +93,6 @@ export async function grantsCommand(args, io, callFor) {
     else if (verb === "sweep") request = ["grants.sweep", { service: "gitea" }];
     else if (verb === "admin set")
       request = ["grants.admin.set", { service: "gitea", url: v["--url"], account: v["--account"], rotateBy: v["--rotate-by"], token: await readToken(io.stdin) }];
-    else if (verb === "scope") request = ["grants.scope", {}];
-    else if (verb === "scope set") request = ["grants.scope.set", { revision: v["--revision"], scope: await readScope(io.stdin) }];
     else if (verb === "admin rotate")
       request = ["grants.admin.rotate", parsed.flags.has("--finish") ? { service: "gitea", finish: true } : { service: "gitea", rotateBy: v["--rotate-by"] }];
     else request = ["grants.admin.remove", { service: "gitea" }];

packages/cli/tests/federation-acceptance.test.mjs

@@ -0,0 +1,234 @@
+// FED R7 / #1802. Run through scripts/test-federation-acceptance.sh: it owns
+// the child process groups and scratch lifetime. Ordinary CLI suites skip it.
+// sage-3625: federation-host.mjs supplies a labelled readProcess ancestry
+// stand-in for setup, grant/revoke and both Console transports. This is NOT
+// a genuine outside-agent human proof. Product transports/grant checks stay real.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { spawn, spawnSync } from 'node:child_process';
+import { closeSync, cpSync, existsSync, mkdirSync, openSync, readFileSync, writeFileSync } from 'node:fs';
+import { request } from 'node:http';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { businessDoc, launchDoc, writeJson } from '../../business/tests/helpers.mjs';
+import { REPO_SKILLS } from '../../harness/tests/helpers.mjs';
+import { DatabaseSync } from 'node:sqlite';
+import { SESSION_COOKIE } from '../../webui/src/sso.mjs';
+import { fakeOidc } from '../../webui/tests/helpers/fake-oidc.mjs';
+import { socketPath, REPO } from '../src/config.mjs';
+import { startTimeOf } from '../src/host.mjs';
+import { launchLogFile, readSessions } from '../../seat/src/session.mjs';
+
+const root = process.env.MOSAIC_R7_ROOT;
+const helper = fileURLToPath(new URL('./fixtures/federation-human.mjs', import.meta.url));
+const adapterModule = fileURLToPath(new URL('./fixtures/thread-adapter.mjs', import.meta.url));
+const webCli = join(REPO, 'packages/webui/src/cli.mjs');
+const cli = join(REPO, 'packages/cli/src/cli.mjs');
+const pause = ms => new Promise(r => setTimeout(r, ms));
+const json = path => JSON.parse(readFileSync(path, 'utf8'));
+
+function run(cmd, args, options = {}) {
+  const r = spawnSync(cmd, args, { encoding: 'utf8', timeout: 30000, ...options });
+  assert.equal(r.status, 0, `${cmd} ${args.join(' ')}: ${r.stderr ?? ''} ${r.error?.message ?? ''}`);
+  return r.stdout;
+}
+async function until(read, label, ms = 20000) {
+  const end = Date.now() + ms;
+  while (Date.now() < end) {
+    const value = await read();
+    if (value) return value;
+    await pause(50);
+  }
+  assert.fail(`R7 assertion: ${label}`);
+}
+
+function http(instance, path, { cookie, body, method = body === undefined ? 'GET' : 'POST' } = {}) {
+  return new Promise((resolve, reject) => {
+    const text = body === undefined ? undefined : JSON.stringify(body);
+    const headers = { host: new URL(instance.origin).host };
+    if (cookie) headers.cookie = cookie;
+    if (text !== undefined) Object.assign(headers, { origin: instance.origin, 'sec-fetch-site': 'same-origin', 'content-type': 'application/json', 'content-length': Buffer.byteLength(text) });
+    const req = request({ host: '127.0.0.1', port: instance.port, path, method, headers, timeout: 5000 }, res => {
+      let data = '';
+      res.on('data', c => data += c);
+      res.on('end', () => resolve({ status: res.statusCode, headers: res.headers, body: data && String(res.headers['content-type']).startsWith('application/json') ? JSON.parse(data) : data }));
+    });
+    req.on('error', reject);
+    req.on('timeout', () => req.destroy(new Error('R7 HTTP timeout')));
+    req.end(text);
+  });
+}
+let serial = 0;
+function child(instance, label, command) {
+  const log = join(root, `${instance.name}-${label}.log`);
+  const fd = openSync(log, 'a', 0o600);
+  let proc;
+  try { proc = spawn(command[0], command.slice(1), { detached: true, env: instance.env, stdio: ['ignore', fd, fd] }); }
+  finally { closeSync(fd); }
+  proc.on('error', e => { console.error(`R7 child ${label}: ${e.message}`); });
+  assert.ok(proc.pid, `R7 ${label} spawned`);
+  const start = startTimeOf(proc.pid);
+  assert.ok(start, `R7 ${label} start time recorded`);
+  // EXIT trap owns the detached group even if Node's test driver is killed.
+  writeFileSync(join(root, 'groups'), `${proc.pid} ${start}\n`, { flag: 'a' });
+  proc.unref();
+  return { log, proc };
+}
+// Jason-shell ancestry stand-in is in the fixture host; transport/path are real.
+function human(instance, verb, args = {}) {
+  const out = join(root, `human-${++serial}.json`);
+  run(process.execPath, [helper, socketPath(instance.dataRoot), instance.name, verb, JSON.stringify(args), out], { env: instance.env });
+  return json(out);
+}
+// R5/R4 CLI with that same labelled fixture proof, never a live human shell.
+function access(instance, args) {
+  return run(process.execPath, [cli, 'access', ...args, '--business', instance.name], { env: instance.env });
+}
+
+function prepare(name, iss, ca) {
+  const home = process.env.HOME;
+  const env = { HOME: home, PATH: process.env.PATH, TMPDIR: process.env.TMPDIR };
+  run(join(REPO, 'scripts/bootstrap.sh'), ['--instance', name], { env });
+  const config = join(home, '.config', `mosaic-${name}`, 'config.json');
+  const system = json(config), dataRoot = system.dataRoot, configDir = dirname(config);
+  const fixtureRoot = join(root, name);
+  mkdirSync(fixtureRoot, { recursive: true });
+  const doc = businessDoc(fixtureRoot, name);
+  doc.human = 'melanie';
+  doc.plugins = { harness: ['pi'], channel: ['webui'] };
+  doc.roles.chief.vars = { harness: 'pi', model: 'claude-opus-5-5', thinking: 'high' };
+  doc.roles.assistant = { definition: 'assistant', vars: { harness: 'pi', model: 'claude-sonnet-5-5', thinking: 'high' } };
+  doc.launch = launchDoc('chief', ['coder', 'assistant'], { opus: 1, sonnet: 2 });
+  doc.launch.threadIdleSeconds = 3600;
+  for (const role of Object.values(doc.roles)) role.vars = { harness: 'pi', model: 'glm-5.3-flash', thinking: 'high', ...role.vars };
+  writeJson(join(configDir, 'businesses', `${name}.json`), doc);
+  const origin = `https://${name}.example.test`;
+  system.console = { sso: { publicOrigin: origin, providers: [{ id: 'test-op', issuer: iss.issuer, clientId: iss.clientId,
+    clientSecret: { slot: name }, algs: ['RS256'], subjects: [{ sub: 'owner-sub', name: 'melanie' }] }] } };
+  system.federation = { self: name, peers: [{ id: name === 'hub' ? 'factory' : 'hub', origin: `https://${name === 'hub' ? 'factory' : 'hub'}.example.test`, label: name === 'hub' ? 'Factory' : 'Hub' }] };
+  writeJson(config, system);
+  writeJson(join(configDir, 'access.json'), { accessVersion: 1, revision: 1, users: [], grants: [] });
+  // Generated fake OP material only; never copies a host slot or credential.
+  writeJson(join(configDir, 'secrets/mosaic-stack', name), iss.clientSecret);
+  cpSync(REPO_SKILLS, join(dataRoot, 'skills-enabled'), { recursive: true });
+  const projectRoot = doc.projects.stack.root;
+  const gitEnv = { ...env, GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: '/dev/null' };
+  const git = (...args) => run('git', ['-c', 'user.name=R7 fixture', '-c', '[email protected]', '-C', projectRoot, ...args], { env: gitEnv });
+  git('init', '-q', '-b', 'main');
+  writeFileSync(join(projectRoot, 'file.txt'), `${name} fixture\n`);
+  git('add', 'file.txt'); git('commit', '-q', '-m', 'scratch fixture');
+  const adapter = join(fixtureRoot, 'adapter.sh');
+  writeFileSync(adapter, `exec '${process.execPath}' '${adapterModule}'\n`);
+  return { name, origin, configDir, dataRoot, adapter, env: { ...env, MOSAIC_CONFIG: config, NODE_EXTRA_CA_CERTS: ca }, port: null };
+}
+
+async function signIn(instance, op, iss, sub) {
+  const start = await http(instance, '/auth/login');
+  assert.equal(start.status, 303, JSON.stringify(start.body));
+  const location = new URL(start.headers.location);
+  const { code } = op.grant(iss, location.href, { sub });
+  const cookie = start.headers['set-cookie'][0].split(';')[0];
+  const result = await http(instance, `/auth/callback?${new URLSearchParams({ code, state: location.searchParams.get('state') })}`, { cookie });
+  const session = (result.headers['set-cookie'] ?? []).find(c => c.startsWith(`${SESSION_COOKIE}=`) && !c.includes('Max-Age=0'))?.split(';')[0];
+  return { ...result, cookie: session };
+}
+const logs = i => existsSync(launchLogFile(i.dataRoot, i.name)) ? readFileSync(launchLogFile(i.dataRoot, i.name), 'utf8').trim().split('\n').filter(Boolean).map(JSON.parse) : [];
+
+function claimHistory(instance, run) {
+  const store = new DatabaseSync(join(instance.dataRoot, 'bus/bus.sqlite'), { readOnly: true });
+  try { return store.prepare('SELECT op, reason FROM thread_claims WHERE holder_run=? ORDER BY seq').all(run); }
+  finally { store.close(); }
+}
+
+test('FED R7 scratch two-instance acceptance', { skip: !root && 'run scripts/test-federation-acceptance.sh', timeout: 180000 }, async t => {
+  const op = await fakeOidc();
+  t.after(() => op.close());
+  const hubIssuer = op.issuer('hub'), factoryIssuer = op.issuer('factory');
+  assert.notEqual(hubIssuer.clientId, factoryIssuer.clientId);
+  const ca = join(root, 'fake-op-ca.pem'); writeFileSync(ca, op.cert);
+  assert.ok(![7330, 7331, 7332].includes(Number(new URL(op.base).port)));
+  writeFileSync(join(root, 'ports'), `${new URL(op.base).port}\n`, { flag: 'a' });
+  const hub = prepare('hub', hubIssuer, ca), factory = prepare('factory', factoryIssuer, ca);
+  assert.notEqual(hub.dataRoot, factory.dataRoot);
+  assert.notEqual(hub.env.MOSAIC_CONFIG, factory.env.MOSAIC_CONFIG);
+  for (const i of [hub, factory]) {
+    const ready = join(root, `${i.name}-host.ready`);
+    const host = child(i, 'host', [process.execPath, '--experimental-test-module-mocks',
+      fileURLToPath(new URL('./fixtures/federation-host.mjs', import.meta.url)), i.name, i.adapter, ready]);
+    await until(() => existsSync(ready), `${i.name} fixture host ready; ${host.log}`);
+    writeFileSync(join(root, 'sockets'), `${socketPath(i.dataRoot)}\n`, { flag: 'a' });
+  }
+  const shared = human(hub, 'project.create', { name: 'hub-shared', repo: 'stack' }).id;
+  const privateProject = human(hub, 'project.create', { name: 'hub-private' }).id;
+  human(factory, 'project.create', { name: 'factory-only' });
+  access(hub, ['user', 'add', 'jason-test', '--home', 'factory', '--subject', 'test-op:jason-test-sub', '--revision', '1']);
+  access(hub, ['grant', '--user', 'jason-test', '--projects', shared, '--instances', 'assistant', '--level', 'collaborator', '--revision', '2']);
+  for (const i of [hub, factory]) {
+    const { log } = child(i, 'console', [process.execPath, webCli, 'serve', '--port', '0', '--business', i.name, '--board', 'http://127.0.0.1:1', '--sso', '--send']);
+    i.port = Number(await until(() => existsSync(log) && readFileSync(log, 'utf8').match(/Mosaic Console: http:\/\/127\.0\.0\.1:(\d+)\//)?.[1], `${i.name} Console started`));
+    assert.ok(![7330, 7331, 7332].includes(i.port));
+    writeFileSync(join(root, 'ports'), `${i.port}\n`, { flag: 'a' });
+  }
+  assert.notEqual(hub.port, factory.port);
+  if (process.env.MOSAIC_R7_INTERRUPT === '1') {
+    console.log('R7 interruption: both Consoles started; killing test driver');
+    process.kill(process.pid, 'SIGKILL');
+    await pause(60000);
+  }
+  const signed = await signIn(hub, op, hubIssuer, 'jason-test-sub');
+  assert.equal(signed.status, 303, JSON.stringify(signed.body)); assert.ok(signed.cookie);
+  const cookie = signed.cookie;
+  const config = await http(hub, '/api/config', { cookie });
+  assert.equal(config.status, 200); assert.equal(config.body.user, true);
+  const projects = await http(hub, '/api/chat/projects', { cookie });
+  assert.equal(projects.status, 200, JSON.stringify(projects.body));
+  assert.deepEqual(projects.body.rows.map(p => p.id), [shared], 'R7 ungranted project must not appear');
+  const created = await http(hub, '/api/chat/threads', { cookie, body: { project: shared, instance: 'assistant', name: 'Jason scratch thread' } });
+  assert.equal(created.status, 200, JSON.stringify(created.body));
+  const thread = created.body.id;
+  const sent = await http(hub, `/api/chat/threads/${thread}/messages`, { cookie, body: { body: 'R7 scratch question' } });
+  assert.equal(sent.status, 200, JSON.stringify(sent.body));
+  const reply = await until(async () => {
+    const r = await http(hub, `/api/chat/threads/${thread}/messages`, { cookie });
+    assert.equal(r.status, 200, JSON.stringify(r.body));
+    return r.body.rows.find(m => m.class === 'RESULT' && m.in_reply_to === sent.body.id);
+  }, 'granted instance replies in Jason thread');
+  assert.equal(reply.from_role, 'assistant'); assert.equal(reply.to_role, 'user');
+  assert.match(reply.body, /R7 scratch question/);
+  const refused = await http(hub, '/api/chat/threads', { cookie, body: { project: privateProject, instance: 'assistant', name: 'must refuse' } });
+  assert.equal(refused.status, 403); assert.equal(refused.body.error, 'access-refused');
+  assert.deepEqual(json(join(hub.configDir, 'access.json')).grants[0].projects, [shared], 'R7 grant must name exactly one project');
+  for (const path of ['/api/board', '/api/bus/inbox', '/api/bus/tasks']) {
+    const r = await http(hub, path, { cookie });
+    assert.equal(r.status, 403, path); assert.equal(r.body.error, 'owner-only', path);
+  }
+  const factoryLogin = await signIn(factory, op, factoryIssuer, 'jason-test-sub');
+  assert.equal(factoryLogin.status, 403); assert.equal(factoryLogin.cookie, undefined);
+  const factoryOwner = await signIn(factory, op, factoryIssuer, 'owner-sub');
+  assert.equal(factoryOwner.status, 303); assert.ok(factoryOwner.cookie);
+  const factoryProjects = await http(factory, '/api/chat/projects', { cookie: factoryOwner.cookie });
+  assert.equal(factoryProjects.status, 200);
+  assert.deepEqual(factoryProjects.body.rows.map(p => p.name), ['factory-only']);
+  const factoryThreads = await http(factory, '/api/chat/threads', { cookie: factoryOwner.cookie });
+  assert.equal(factoryThreads.status, 200); assert.deepEqual(factoryThreads.body.rows, []);
+  const hubCookieAtFactory = await http(factory, '/api/chat/projects', { cookie });
+  assert.equal(hubCookieAtFactory.status, 401);
+  const [launch] = logs(hub).filter(e => e.event === 'launch' && e.thread === thread);
+  assert.ok(launch, 'R7 sandboxed run launched');
+  const liveRun = readSessions(hub.dataRoot).find(s => s.run === launch.run);
+  assert.ok(liveRun, 'R7 run remains live before revoke');
+  access(hub, ['revoke', '--user', 'jason-test', '--revision', '3']);
+  const after = await http(hub, '/api/chat/projects', { cookie });
+  assert.equal(after.status, 401); assert.equal(after.body.error, 'sign-in required');
+  assert.equal((await signIn(hub, op, hubIssuer, 'jason-test-sub')).status, 403);
+  // Pin the claim before waiting for process exit: a missing broker revocation
+  // must fail this assertion, even if it also prevents the runner from ending.
+  assert.ok(claimHistory(hub, launch.run).some(r => r.op === 'revoke' && r.reason === 'access-revoked'),
+    'R7 revoke must end the claim as access-revoked');
+  const ended = await until(() => logs(hub).find(e => e.event === 'end' && e.run === launch.run), 'revoked run ended');
+  assert.equal(ended.exitCode, 0, JSON.stringify(ended));
+  assert.deepEqual(readSessions(hub.dataRoot), []);
+  await until(() => startTimeOf(liveRun.pid) !== liveRun.startTime && startTimeOf(liveRun.runnerPid) !== liveRun.runnerStartTime, 'revoked engine and runner processes gone');
+  assert.equal(claimHistory(hub, launch.run).at(-1).op, 'revoke', 'R7 shutdown must not replace missing revocation with release');
+  assert.deepEqual(human(factory, 'thread.list'), []);
+});

packages/cli/tests/fixtures/federation-host.mjs

@@ -0,0 +1,67 @@
+// FED R7 fixture, sage-3625: the ancestry walk is a stand-in for Jason's
+// shell. Keep this override in a test-only process, never in product code.
+// As channel-fixture.mjs, real pid/uid/argv/startTime/nonce checks remain;
+// verifyHuman sees ppid=1 instead of walking the development agent's tree.
+import { mock } from 'node:test';
+const humanUrl = new URL('../../../bus/src/human.mjs', import.meta.url).href;
+const real = await import(humanUrl);
+mock.module(humanUrl, { namedExports: {
+  readProcess: real.readProcess,
+  verifyHuman: (proof, options) => real.verifyHuman(proof, {
+    ...options, readProcess: pid => ({ ...real.readProcess(pid), ppid: 1 }),
+  }),
+} });
+const { startBroker } = await import('../../../bus/src/runtime.mjs');
+const { BusError } = await import('../../../bus/src/broker.mjs');
+const { loadSystem, bootConfig } = await import('../../src/config.mjs');
+const { createLauncher } = await import('../../src/launcher.mjs');
+const { fakeHarnesses } = await import('../helpers.mjs');
+const { writeFileSync } = await import('node:fs');
+const [business, adapter, ready] = process.argv.slice(2);
+const system = loadSystem();
+const runtime = await startBroker(bootConfig({ system, businessId: business }));
+const hooks = [], cleanups = [];
+const ops = {
+  identity: m => runtime.identity(m.cap),
+  authorizeLaunch: m => runtime.authorizeLaunch(m.cap, m.instance),
+  refuse: m => runtime.refuse(m.cap, m.code, m.subject),
+  endLaunch: m => runtime.endLaunch(m.record),
+  credentialStatus: m => runtime.credentialStatus(m.business, m.role),
+  threadsState: m => runtime.threadsState(m.business),
+  threadIdle: m => runtime.threadIdle(m.record),
+  mayLaunch: m => runtime.mayLaunch(m),
+  landHeld: m => runtime.landHeld(m.record),
+  landHolders: m => runtime.landHolders(m.business),
+  landRelease: m => runtime.landRelease(m.record),
+  sessionClears: m => runtime.sessionClears(m.business),
+  lifecycleRequests: m => runtime.lifecycleRequests(m.business),
+};
+const wrap = fn => async value => {
+  try { return fn(value); }
+  catch (e) { throw Object.assign(new Error(e.message), { code: e instanceof BusError ? e.code : 'fixture-host-refused' }); }
+};
+const host = {
+  business, path: runtime.path, dataRoot: system.dataRoot,
+  op: wrap(m => { if (!Object.hasOwn(ops, m.op)) throw new BusError('invalid-host-request'); return ops[m.op](m); }),
+  bindLaunch: wrap(record => runtime.bindLaunch(record)),
+  beforeClose: fn => void hooks.push(fn),
+};
+const launcher = createLauncher({ host, system,
+  makeLoader: await fakeHarnesses({ after: fn => cleanups.push(fn) }, { pi: adapter }, write => write('channel', 'webui',
+    `export * from ${JSON.stringify(new URL('../../../plugins/channel/webui/index.mjs', import.meta.url).href)};`)),
+  readOnly: [new URL('./thread-adapter.mjs', import.meta.url).pathname],
+  harnessVersion: '0.85.1', sessionDefaults: { pollInterval: 600000 }, threadTickMs: 100,
+});
+let closing = false;
+async function close() {
+  if (closing) return;
+  closing = true;
+  for (const fn of hooks) await fn(0);
+  await runtime.close();
+  for (const fn of cleanups) await fn();
+  process.exit(0);
+}
+process.once('SIGTERM', close);
+process.once('SIGINT', close);
+await launcher.listen();
+writeFileSync(ready, 'ready\n', { mode: 0o600 });

packages/cli/tests/fixtures/federation-human.mjs

@@ -0,0 +1,7 @@
+// R7 fixture: actual human-cli path with the fixture host's labelled ancestry override.
+// This stands in for Jason's shell (sage-3625); it does not prove real human ancestry.
+import { writeFileSync } from 'node:fs';
+import { humanTransport } from '../../src/transport.mjs';
+const [socket, business, verb, args, out] = process.argv.slice(2);
+const result = await humanTransport({ socket, business })(verb, JSON.parse(args));
+writeFileSync(out, JSON.stringify(result), { mode: 0o600 });

packages/cli/tests/grants-scope.test.mjs

@@ -1,74 +0,0 @@
-// Row 298/Q228: the real CLI parser and human-shell refusal. Transport is a
-// recorder; no socket, config, credential or live grant is accessed.
-import test from "node:test";
-import assert from "node:assert/strict";
-import { main } from "../src/cli.mjs";
-import { humanEnv, io } from "./helpers.mjs";
-
-const AGENT_MARKERS = ["MOSAIC_BUS_CAP", "MOSAIC_RUN_ID", "MOSAIC_AGENT_RUN", "CLAUDECODE", "CLAUDE_CODE_ENTRYPOINT", "CODEX_THREAD_ID", "PI_AGENT_DIR"];
-const REVISION = "a".repeat(64);
-const SCOPE = { gitea: { agents: ["coder"], projects: ["app"] } };
-const READ = ["grants", "scope", "--business", "acme"];
-const SET = ["grants", "scope", "set", "--business", "acme", "--revision", REVISION];
-function setup(env = humanEnv(), stdin = JSON.stringify(SCOPE)) {
-  const x = io(env);
-  x.stdin.end(stdin);
-  const calls = [];
-  const deps = {
-    system: { dataRoot: "/nonexistent" },
-    transport: (business) => async (verb, args) => {
-      calls.push({ business, verb, args });
-      return { revision: REVISION, scope: SCOPE, fallback: false };
-    },
-    testerTransport: () => async () => { throw new Error("tester transport must never run"); },
-  };
-  return { x, calls, deps };
-}
-
-// Break caught: dropping scope dispatch or misrouting the writer's revision.
-test("row 298 CLI: scope reads and scope set sends JSON and the observed revision", async () => {
-  const f = setup();
-  await main(READ, f.x, f.deps);
-  assert.deepEqual(f.calls, [{ business: "acme", verb: "grants.scope", args: {} }]);
-  assert.deepEqual(JSON.parse(f.x.out.text), { revision: REVISION, scope: SCOPE, fallback: false });
-  const w = setup();
-  await main(SET, w.x, w.deps);
-  assert.deepEqual(w.calls, [{ business: "acme", verb: "grants.scope.set", args: { revision: REVISION, scope: SCOPE } }]);
-  const empty = setup(humanEnv(), "{}");
-  await main(SET, empty.x, empty.deps);
-  assert.deepEqual(empty.calls[0].args.scope, {});
-});
-
-// Break caught: a new grants path bypassing access's refuseInsideAgent guard.
-test("row 298 CLI: every access agent marker refuses scope set before transport", async () => {
-  for (const marker of AGENT_MARKERS) {
-    const f = setup({ ...humanEnv(), [marker]: "agent" });
-    await assert.rejects(main(SET, f.x, f.deps), (e) => e.exitCode === 3 && /human shell/.test(e.message), marker);
-    assert.deepEqual(f.calls, []);
-    assert.equal(f.x.out.text, "");
-  }
-});
-
-// Break caught: --tester selecting a nonhuman transport for this approval.
-test("row 298 CLI: --tester cannot read or change the scope", async () => {
-  for (const args of [READ, SET]) {
-    const f = setup();
-    await assert.rejects(main([...args, "--tester"], f.x, f.deps), (e) => e.exitCode === 4);
-    assert.deepEqual(f.calls, []);
-  }
-});
-
-// Break caught: a missing revision or invalid stdin being sent as an approval.
-test("row 298 CLI: missing revision and empty, invalid or oversized JSON refuse without a call", async () => {
-  for (const [args, input, code] of [
-    [SET.slice(0, -2), "{}", 4],
-    [SET, "", 4],
-    [SET, "   \n", 4],
-    [SET, "{bad", 4],
-    [SET, " ".repeat(65537), 2],
-  ]) {
-    const f = setup(humanEnv(), input);
-    await assert.rejects(main(args, f.x, f.deps), (e) => e.exitCode === code);
-    assert.deepEqual(f.calls, []);
-  }
-});

scripts/test-federation-acceptance.sh

@@ -0,0 +1,111 @@
+#!/usr/bin/env bash
+# FED R7 / #1802. Scratch acceptance with labelled ancestry stand-in (sage-3625).
+# No systemd units. All children run in owned process groups, removed on exit.
+set -euo pipefail
+R7_INTERRUPT=0
+case "${1:-}" in
+  '') ;;
+  --kill-after-start) R7_INTERRUPT=1 ;;
+  *) echo 'usage: scripts/test-federation-acceptance.sh [--kill-after-start]' >&2; exit 2 ;;
+esac
+[ "$#" -le 1 ] || exit 2
+for R7_TOOL in ss rg timeout node ps awk; do
+  command -v "$R7_TOOL" >/dev/null || { echo "R7 requires $R7_TOOL" >&2; exit 1; }
+done
+cd "$(dirname "${BASH_SOURCE[0]}")/.."
+R7_ROOT="$(mktemp -d /mnt/storage/scratch/tmp/r7.XXXXXXXX)"
+mkdir -p "$R7_ROOT/home" "$R7_ROOT/tmp"
+touch "$R7_ROOT/groups" "$R7_ROOT/ports" "$R7_ROOT/sockets"
+
+cleanup() {
+  local result=$? pid start raw port socket listeners cleanup_failed=0 attempt
+  local -a fields
+  trap - EXIT INT TERM
+  if [ -n "${R7_DRIVER:-}" ]; then
+    kill -TERM "$R7_DRIVER" 2>/dev/null || true
+    wait "$R7_DRIVER" 2>/dev/null || true
+  fi
+  # A detached child is its group's leader. Confirm pid/start time/group before
+  # signalling only groups in this run's ledger; never a live stack process.
+  while read -r pid start; do
+    [ -n "$pid" ] || continue
+    if [ -r "/proc/$pid/stat" ]; then
+      raw="$(cat "/proc/$pid/stat")"
+      read -r -a fields <<< "${raw##*) }"
+      if [ "${fields[19]}" != "$start" ] || [ "${fields[2]}" != "$pid" ]; then
+        echo "R7 cleanup failed: group identity changed: $pid" >&2
+        result=1; cleanup_failed=1
+        continue
+      fi
+      kill -TERM -- "-$pid" 2>/dev/null || true
+      for ((attempt=0; attempt<800; attempt++)); do
+        ps -eo pgid=,stat= | awk -v g="$pid" '$1==g && $2 !~ /^Z/ {found=1} END {exit !found}' || break
+        sleep 0.05
+      done
+      kill -KILL -- "-$pid" 2>/dev/null || true
+      for ((attempt=0; attempt<40; attempt++)); do
+        ps -eo pgid=,stat= | awk -v g="$pid" '$1==g && $2 !~ /^Z/ {found=1} END {exit !found}' || break
+        sleep 0.05
+      done
+    fi
+    # Zombies hold no tools/listeners and are reaped by their parent. The test
+    # requires no live member of an owned group, including orphan descendants.
+    if ps -eo pgid=,stat= | awk -v g="$pid" '$1==g && $2 !~ /^Z/ {found=1} END {exit !found}'; then
+      echo "R7 cleanup failed: group $pid still has a live process" >&2
+      result=1; cleanup_failed=1
+    fi
+  done < "$R7_ROOT/groups"
+  while IFS= read -r port; do
+    [ -n "$port" ] || continue
+    if ! listeners="$(ss -H -ltn "sport = :$port")"; then
+      echo "R7 cleanup failed: cannot inspect port $port" >&2
+      result=1; cleanup_failed=1
+    elif [ -n "$listeners" ]; then
+      echo "R7 cleanup failed: port $port still listens" >&2
+      result=1; cleanup_failed=1
+    fi
+  done < "$R7_ROOT/ports"
+  while IFS= read -r socket; do
+    [ -n "$socket" ] || continue
+    if ! listeners="$(ss -H -lx)"; then
+      echo "R7 cleanup failed: cannot inspect socket $socket" >&2
+      result=1; cleanup_failed=1
+    elif printf '%s\n' "$listeners" | rg -F -- "$socket" >/dev/null; then
+      echo "R7 cleanup failed: socket $socket still listens" >&2
+      result=1; cleanup_failed=1
+    fi
+  done < "$R7_ROOT/sockets"
+  if listeners="$(ss -H -lx)"; then
+    if printf '%s\n' "$listeners" | rg -F -- "$R7_ROOT/" >/dev/null; then
+      echo 'R7 cleanup failed: another scratch Unix listener remains' >&2
+      result=1; cleanup_failed=1
+    fi
+  else
+    result=1; cleanup_failed=1
+  fi
+  if [ "$result" -ne 0 ]; then
+    for raw in "$R7_ROOT"/*.log; do
+      [ -f "$raw" ] || continue
+      echo "R7 diagnostic: ${raw##*/}" >&2
+      tail -40 "$raw" >&2
+    done
+  fi
+  rm -rf -- "$R7_ROOT"
+  if [ -e "$R7_ROOT" ]; then
+    echo 'R7 cleanup failed: scratch directory remains' >&2
+    result=1; cleanup_failed=1
+  fi
+  if [ "$cleanup_failed" -eq 0 ]; then echo 'R7 cleanup: no child groups, ports or sockets remain; no units created'; fi
+  exit "$result"
+}
+trap cleanup EXIT
+trap 'exit 130' INT
+trap 'exit 143' TERM
+# No host configuration, preload hooks, credentials or agent env in fixtures.
+# The ancestry stand-in lives only in federation-host.mjs, per sage-3625.
+timeout -k 10 210 env -i PATH="$PATH" HOME="$R7_ROOT/home" TMPDIR="$R7_ROOT/tmp" \
+  MOSAIC_R7_ROOT="$R7_ROOT" MOSAIC_R7_INTERRUPT="$R7_INTERRUPT" \
+  node --test --test-concurrency=1 packages/cli/tests/federation-acceptance.test.mjs &
+R7_DRIVER=$!
+wait "$R7_DRIVER"
+R7_DRIVER=