launchpad: row 255 design, M1 conditions from mos-1666 item 3 in section 1 and P1

BUILD-LOG.md

@@ -5583,3 +5583,5 @@ claim. Receipts and limitations in agents/lena/work/queue-296/BUILD.md and run-r
 
 2026-10-24 — Magica row329 R2 (#1827): B1 ASCII-only management key fix verified with complete-tree refusals and positive auth control; package66/66,30bus readers261/261,49CLI readers726/726,config55/55, no required skip/failure. N1 corrects R1 bus total to1019; N3 stale-lock guidance and N4 34-code inventory corrected. Two over-selected file runs are recorded separately, with no F7 inference; cause unknown/Vikunja625. Old502 test/helper files byte-identical, slot returned to Sage. Evidence agents/magica/work/queue-329/BUILD.md.
 2026-10-24T23:37:46Z | Sage | Row 329 (#1827, P1 pinned model proxy, Magica) LANDED 61ebf2c34, pushed 23:31:27Z 10-24. Before: refactor at 669cdf42c. After: Magica's 4 commits (94cde633e, c65fb34ee, d1f6f2b19, 61ebf2c34) cherry-picked onto 669cdf42c, diff vs the gated tree limited to drift paths, range-diff in scratch. Gate: one unchanged full landing gate in /mnt/storage/scratch/sage-r329l/wt (gate.sh 8b4978887 c8a9bcf94), started 23:08:12Z at load 14.35, GATE GREEN 23:29:14Z at load 8.67, no rerun, no test or timeout edit (mos-1634). Host note: two Codex workers cleaned T3 worktrees from about 23:14Z (mos-1639, Vikunja 632). Approvals: Dewey r2 c31643 rev 4047, Boyd r2 c31642 rev 4048. #1827 comment 31650, closed. Vikunja 237 comment 1109 (stays open for P2-P7); C4 P10 red filed as Vikunja 631. Queue: note rev 4063, done rev 4064, committed b24d917ec. DEFERRED: N2 and R2-N1 bound to row 331, N1 bound to P7. Overlap: row 284 (packages/bus/src/broker.mjs) and row 157 (scripts/mosaic-config.mjs) rebase onto 61ebf2c34 before their gates.
+2026-10-25T00:15:48Z | Sage | Row 284 (#1789, C2-05c library.get scope, Della) LANDED ce0b6ed41, pushed 00:09:52Z 10-25. Before: refactor at 9e2689dff (row 329 landing docs). After: fast-forward to Della's 7 rebased commits 78b932feb..ce0b6ed41; 8 paths, manifest-r4 de505cfd matches the landed tree. Gate: one unchanged full landing gate in /mnt/storage/scratch/sage-r284l/wt (the 329 gate.sh with D and the compose project renamed), started 23:51:19Z at load 1.62, GATE GREEN 00:09:04Z at load 5.20, no rerun, no test or timeout edit. Counts: bus 1020/0, business 283/0, cli 999 pass 1 allowed skip (FED R7), harness 177/0, library 156/0, seat 218/0, webui 458/0, every scripts/test-*.sh rc 0; queue 34 and task 87/93 skips are the standing ones. Della's whole-file runs on ce0b6ed41: library-lookups 12/0, library-tools 5/0, query 34/0. Approval: Webby round 2 delta c31654 rev 4070 (round 1 rev 4062). Overlap sweep: rows 13, 157, 309, gyro/row310 and fethry/row332-p1 clean. #1789 comment 31655, closed. No Vikunja task for the row. Queue: note rev 4071, done rev 4072, committed 7c8dc2033. DEFERRED: Webby N1 (whole-tree listing per get) bound to the next library read-path row; N2 needs nothing; N3 is this gate.
+2026-10-25T00:18:35Z | Sage | Follow-up tasks for mos-1647 item 3 (Q109): Vikunja 633 (P7 cutover, CLIProxyAPI 8.0.42 startup Grok-npm and antigravity version refreshes, from row 332 isolated runs) and 634 (row 284 Webby N1, library get lists the whole tree). DEFERRED gains the 633 entry and the 634 number for row 284 N1. Filing script and receipt in agents/sage/work/vikunja-setup/.

agents/launchpad/work/queue-255/DESIGN.md

@@ -0,0 +1,402 @@
+# Row 255 design: a bundled Pocket ID for users with no OIDC provider (Q203, Gitea #1760, Vikunja 458)
+
+Launchpad, draft 1, 2026-10-25, on `launchpad/row255` off refactor 78b69e1e6. Brief
+`docs/plans/2026-10-21_bundled-pocket-id.md` (blob 26f34400). Reviewer Webby. Sage checks it against Q203, O6,
+REQ-WEB-2 and REQ-INST-1. REQ-INST-2 (PRD 1.10) is post-v1 (mos-1204), and so is everything here.
+
+This is a design only. Nothing here installs, downloads or starts Pocket ID. It changes nothing on .53, .54 or
+dragon-lin, which keeps Authentik.
+
+## Sources
+
+- Q203 and O6 as the brief quotes them. PRD `docs/prd/mosaic-stack.md` REQ-WEB-2 (:902), REQ-INST-1 (:1509),
+  REQ-INST-2 (:1513) and REQ-INST-3 (:1528). Lead decision 44 items 5 and 6
+  (`docs/plans/2026-09-26_lead-decisions.md:655-663`).
+- The Q175 design `agents/sage/work/q175-sso/DESIGN.md` sections 4 and 10, and the code row 192 landed:
+  `packages/webui/src/sso-config.mjs` (the `console.sso` shape), `packages/webui/src/sso.mjs` (the slot read,
+  the discovery checks at :105-118, the client at :147-148, the callback at :133, the post-logout URI at :332).
+- Researcher's note `agents/researcher/work/2026-10-04_vikunja-pocketid.md` part 2 (v2.17.0).
+- A fresh read of upstream on 2026-10-25, from release metadata and source text only: no binary was fetched or
+  run. The latest stable release is **v2.19.1** (2026-10-22). Source paths below are under
+  `backend/internal/` at tag v2.19.1 in `github.com/pocket-id/pocket-id`, marked "P". Releases v2.18.0,
+  v2.19.0 and v2.19.1 are not marked breaking.
+
+## What the Console already needs from any provider
+
+This design keeps the Console's sign-in and start checks exactly as row 192 built them. Pocket ID becomes one
+`console.sso.providers` entry, the same shape any compliant OP uses (Q175 section 4, "Several providers"). The
+Console gets no new sign-in path, no password and no proxy-header identity (O6, REQ-WEB-2, REQ-INST-2). The
+facts that drive the rest of the design:
+
+- `publicOrigin` and every `issuer` must be https (`sso-config.mjs` `httpsURL`). A plain-http Pocket ID can't
+  be a provider at all.
+- Each provider needs 1 to 64 `subjects`. A `console.sso` with no subject refuses to load. So the first
+  person's subject has to exist before the Console starts with `--sso` (section 5).
+- The client authenticates with `client_secret_basic` (`sso.mjs:148`), so the client is confidential.
+- The slot is `<configDir>/secrets/mosaic-stack/<slot>`: a regular file, owned by the Console's uid, mode
+  with no group or other bits, and outside the repo and every stack copy (`readSlot`).
+- `config.json` is user-authored. bootstrap.sh creates it and nothing overwrites it (canon invariant 2, Q175
+  section 4). This matters for sections 1 and 5.
+
+## 1. The choice
+
+The installer is REQ-INST-3's install command (Vikunja #432; today `stack-upgrade.sh` and the per-case
+install scripts). It takes one sign-in option per instance:
+
+- `--oidc existing`. The user points the Console at one or more OIDC providers they already have. Nothing
+  is installed. The user writes `console.sso` themselves, as Q175 step 4 does today. The installer writes
+  nothing into `console.sso`; it prints the entry shape and the two URIs to register
+  (`<publicOrigin>/auth/callback`, `<publicOrigin>/auth/signed-out`).
+- `--oidc bundled`. The stack installs Pocket ID as an install component (section 2), and
+  `console.sso.providers` holds exactly one entry, `id: "pocket-id"`, whose `issuer` is the component's
+  origin.
+- No option keeps today's behaviour: no `console.sso`, and the Console runs without `--sso`.
+
+How the bundled choice is recorded. REQ-INST-1 lets a component be switched on "in the organization file
+or system config". It has to be the system config. The organization file can be written by agents through
+`organizationWriter`, which is the reason Q175 B1 put `console.sso` in config.json, and the same reason
+holds for a component that issues the Console's identities. So config.json gets one new optional key:
+
+```json
+"components": {
+  "pocket-id": {
+    "release": "v2.19.1",
+    "origin": "https://id.example.internal",
+    "port": 1411
+  }
+}
+```
+
+The loader (`scripts/mosaic-config.mjs`) checks the shape: `release` is a `vX.Y.Z` tag, and the component script refuses one that
+differs from the pin file (section 2), `origin` is an https origin, `port` is 1024 to 65535. It also cross-checks: when
+`components["pocket-id"]` is present, `console.sso` must have exactly one provider, `id` `pocket-id`,
+`issuer` equal to `origin`. A config with `console.sso` providers and no `components` is the existing
+choice and loads as today.
+
+**M1, approved by Mos with three conditions (mos-1666 item 3).** `components` is a new top-level config key.
+The loader refuses unknown keys today, so this is a config schema change. The conditions:
+
+1. **Rollback trap.** A copy older than P1 refuses a config that has the key, the same trap Q175 section 4
+   names for `console.sso`. P1 documents the order. On a rollback past P1, first take `components` out of
+   config.json (restore the backup made before the key went in), then roll back the pointer. The STATE check
+   after the rollback reads config.json and confirms the key is absent.
+2. **Strict inside the key.** The loader refuses any name under `components` other than `pocket-id`, and any
+   field under `pocket-id` other than `release`, `origin` and `port`. Each refusal names the key path and
+   quotes no value, as `checkConsole` does.
+3. **test-config.sh cases:**
+   - a valid `components` loads;
+   - a malformed one fails, naming the bad key path;
+   - a config without `components` loads;
+   - the cross-check refuses a `console.sso` whose provider doesn't match `origin`.
+
+What each choice writes into `console.sso` is in section 5. For the bundled choice, Pocket ID is the only
+providers entry. The design keeps it that way because REQ-INST-2 says "the Console's one providers entry".
+A user who later adds an existing provider moves to `--oidc existing` and removes the component (section 2).
+
+## 2. The component, against REQ-INST-1
+
+**Pinned.** A Pocket ID release is a set of raw binaries plus `checksums.txt` (sha256). From v2.16.0 there is
+an SPDX SBOM per binary, and the release workflow attests `checksums.txt` through Sigstore (`actions/attest`
+in `.github/workflows/release.yml`). The repo holds one pin file,
+`scripts/pocket-id-pins.sh`, sourced the way `scripts/case1-pins.sh` is: the tag, and for each supported platform (linux amd64 and arm64 to
+start) the asset name and its sha256. The build row copies the sha256 from `checksums.txt` at the tag and
+records the `gh attestation verify` output for each asset as its evidence. The pin is checked by hand at
+build time, not trusted at install time. No Pocket ID source and no binary goes in the repo. The binary is
+not in any image either, since the container install comes after v1 (REQ-INST-3).
+
+Recommended pin: v2.19.1, the current release. The build row checks it again, because Pocket ID ships a
+minor every one to four weeks. Upgrading is a pin file change in a reviewed commit.
+
+**Fetched and checked.** `scripts/component-pocket-id.sh fetch` downloads the pinned asset for the host's
+platform over https into a new 0700 staging directory, computes its sha256, and compares it with the pin.
+On a mismatch it deletes the file and refuses with `pocket-id-digest-mismatch`, naming the expected value
+and the computed one. On a match it installs the binary read-only (0555) at
+`<dataRoot>/components/pocket-id/bin/pocket-id-<tag>`. The fetch is the only network step, and the user
+runs it at install. Tests never run it against the network (section 9).
+
+**Runs.** A systemd user unit, `mosaic-pocket-id.service` (`mosaic-pocket-id-NAME.service` for a named
+instance, as row 190 names the bus and webui units), as the instance's user:
+
+- `ExecStart=<dataRoot>/components/pocket-id/bin/pocket-id-<tag>`.
+- `WorkingDirectory=<dataRoot>/components/pocket-id/run`, a directory the unit owns, so Pocket ID's habit of
+  reading `.env` from the working directory reads nothing we didn't write. The build row checks there is no
+  `.env` there at start.
+- Environment, all from the rendered unit:
+  - `APP_URL=<origin>` and `HOST=127.0.0.1` (P `common/env_config.go`: HOST defaults to `0.0.0.0`).
+  - `PORT=<port>`.
+  - `DB_CONNECTION_STRING` and `UPLOAD_PATH` as absolute paths under `<dataRoot>/components/pocket-id/data/`
+    (P defaults are `data/pocket-id.db` and `data/uploads`, relative to the working directory).
+  - `ALLOW_USER_SIGNUPS=disabled` and `ALLOW_INSECURE_CALLBACK_URLS=false`.
+  - `EMAIL_ONE_TIME_ACCESS_AS_UNAUTHENTICATED_ENABLED=false` and `..._AS_ADMIN_ENABLED=false`.
+  - The `OUTBOUND_ALLOWED_HOSTS_*` allowlists set empty (added in 2.19.0).
+  - No `TRUST_PROXY` unless section 6's proxy step sets it to the proxy's address.
+- `ENCRYPTION_KEY` (mandatory since v2.0, at least 16 bytes) never goes in the unit text. It lives in slot
+  `<configDir>/secrets/mosaic-stack/pocket-id-encryption-key`, 0600. The component script generates it from
+  `/dev/urandom` straight into the file and never prints it. The unit passes it with
+  `LoadCredential=` and `ENCRYPTION_KEY_FILE=%d/...`. The build row confirms `ENCRYPTION_KEY_FILE` at the pinned
+  tag; if it isn't there, it refuses rather than putting the key in `Environment=`.
+- The unit never carries `STATIC_API_KEY`. That key exists only during the enroll run (section 4).
+
+The data directory holds the SQLite database, Pocket ID's signing key (stored encrypted with
+`ENCRYPTION_KEY`), and the passkey registrations. It is 0700. Agent sandboxes bind only an allowlist
+(`packages/seat/src/sandbox.mjs`), and `<dataRoot>/components/` is not on it. The build row adds a sandbox
+test that pins that.
+
+**Health-checked.** `GET http://127.0.0.1:<port>/healthz` returns 204 (P `controller/healthz_controller.go`).
+`component-pocket-id.sh status` reports the unit state, the binary tag against the pin, the binary's sha256
+against the pin, and the health result. The Console's own `/healthz` already shows `sso: { "pocket-id": ready
+| unreachable | refused }` from its discovery retries, so an operator sees the provider from either side.
+
+**Removable.** `component-pocket-id.sh remove` refuses while `console.sso` still names `pocket-id`, so the
+Console can't be left pointing at a provider that's gone. Once the user has taken the entry out (or moved to
+`--oidc existing`), the script stops and removes the unit, then moves the data directory to
+`<dataRoot>/components/pocket-id.removed-<utc>` with a receipt line in `<dataRoot>/state/components.log`
+(append-only). It never deletes the passkey database outright. Deleting the moved directory and the
+encryption key slot is a separate `purge` verb that names both paths and needs `--yes`. Removing the
+`components` key from config.json is the user's edit.
+
+## 3. The Q175 start checks against the bundled instance
+
+The Console checks are unchanged. Here is each one against Pocket ID, and the setting it needs:
+
+| Check (row 192) | Pocket ID v2.19.1 | Default that fails | Fix |
+|---|---|---|---|
+| `issuer` is https (loader) | issuer = `APP_URL` exactly (P `controller/well_known_controller.go`) | `APP_URL` defaults to `http://localhost:1411` | `APP_URL=<https origin>`, section 6 |
+| discovery `issuer` equals config `issuer` | equal when `APP_URL` has no trailing slash; Pocket ID refuses a path | none | config `issuer` = `origin`, no trailing slash; the loader cross-check compares them |
+| `id_token_signing_alg_values_supported` overlaps `algs` | advertises only the current key's alg. RS256 (RSA-2048) by default (P `service/jwt_service.go`) | none | `algs: ["RS256"]` |
+| `code_challenge_methods_supported` has `S256` | advertises `plain` and `S256` | none | none. The Console always sends S256 (`sso.mjs:221`) |
+| JWKS has a usable key for `algs` | one key at `/.well-known/jwks.json` | none | none. The build row's fake OP pins `use`/`alg`/`kid` as Pocket ID emits them |
+| `end_session_endpoint` is https | `<APP_URL>/api/oidc/end-session` | http, if `APP_URL` is http | same fix as row 1 |
+| `redirect_uri` is registered | exact match first, then wildcard patterns; loopback callbacks match any port (P `utils/callback_url_util.go`) | `ALLOW_INSECURE_CALLBACK_URLS` defaults to true | register exactly `<publicOrigin>/auth/callback`, with no `*`; set `ALLOW_INSECURE_CALLBACK_URLS=false` |
+| post-logout URI | per-client `logoutCallbackURLs`, same matching | none | register exactly `<publicOrigin>/auth/signed-out` |
+| ID token alg in `algs`, `iss` match | as above | none | none |
+
+Two points the Console doesn't check, set on the client anyway:
+
+- `pkceEnabled: true`. Then Pocket ID refuses an authorize request that has no `code_challenge`. Pocket ID has
+  no per-client S256-only setting (P `oidc/provider.go` turns on `plain` for the server). That doesn't relax
+  anything: the Console sends S256 every time, and `plain` stays available only to other clients.
+- `isPublic: false`, which matches `client_secret_basic`.
+
+Key rotation. `pocket-id key-rotate --alg ...` replaces the one signing key (P `cmds/key_rotate.go`). After a
+rotation to another alg, the Console's discovery check refuses on the next restart (no overlap with
+`algs`), and that is the intended fail-closed result. A rotation is a user step that updates `algs` in the
+same edit. The component script never rotates.
+
+## 4. The client, and where its secret goes
+
+The person running the install creates the client through `component-pocket-id.sh enroll`. No agent runs
+this verb. It refuses when any agent marker is in its environment: the `MARKERS` list in
+`packages/bus/src/human.mjs` (`MOSAIC_RUN_ID`, `MOSAIC_BUS_CAP`, `CLAUDECODE` and the rest) that the human
+boundary uses. A test pins the refusal.
+
+Enroll needs admin rights before any person has a passkey. Pocket ID offers two ways to get them, and one of
+them is a hazard:
+
+- `/setup` and its backing `POST /api/signup/setup` are unauthenticated: whoever calls first becomes admin
+  (P `usersignup/service.go`). Sandboxed agents share the host's network namespace (`sandbox.mjs` unshares
+  user, pid and ipc, not net), so any agent could reach a loopback Pocket ID and take that first admin.
+- `STATIC_API_KEY` is a fixed admin key with no expiry (P `apikey/service.go`). It doesn't count as
+  completing setup, so `/setup` stays open while it's set.
+
+So enroll never lets the real unit serve before an admin person exists. It runs the pinned binary once in a
+**private network namespace** (`unshare --user --net`, or `bwrap --unshare-net` with the binary and data
+directory bound), where only enroll's own loopback can reach it:
+
+1. Generate a one-run static key into a 0600 temp file in a new 0700 directory, and start Pocket ID inside
+   the namespace with `STATIC_API_KEY_FILE` pointing at it, plus the unit's environment.
+2. Wait for `/healthz` 204.
+3. Create the admin user, `POST /api/users` with `isAdmin: true` and the username and email given with
+   `--admin-user` and `--admin-email`. Keep the returned `id`. That is the OIDC `sub` (P
+   `oidc/claims_service.go` uses `user.ID`, a UUIDv4 set at creation, so it's stable).
+4. Create the Console client: client id `mosaic-console-<instance>`, callback and logout URLs exactly as in
+   section 3, `pkceEnabled: true`, `isPublic: false`. Supply the secret instead of letting Pocket ID
+   generate it. Enroll generates 48 random bytes, base64url, and writes them straight to slot
+   `<configDir>/secrets/mosaic-stack/console-sso-pocket-id` (0600, `O_CREAT|O_EXCL`, not a symlink). It sends
+   the same bytes in the create body over the namespace's loopback (`dto/oidc_dto.go` accepts a supplied
+   secret of 16 or more characters). The value is never printed, logged or put in an argv, and a test pins
+   that it appears in no output.
+5. Mint a one-time access token for the admin, `POST /api/users/<id>/one-time-access-token`.
+6. Stop the namespaced process, then shred and remove the static key file. The real unit has never had a
+   static key, so no admin key survives enroll.
+7. Start the real unit and wait for `/healthz` 204.
+8. Print the sign-in link `<origin>/lc/<token>` to the user's terminal (section 5), and the `console.sso`
+   entry (section 5).
+
+The build row confirms each route and body against the pinned tag's source before it writes the client (the
+upstream read for this design didn't trace the create-client route). If any of steps 1 to 7 fails, enroll
+stops the process, removes the static key, leaves no slot file it created, and refuses with the step name.
+
+The secret never enters the repo or an image. It sits in two places only: the slot file and Pocket ID's
+database (stored as a hash). The Console's `readSlot` reads it as it does any provider's.
+
+## 5. The first person, and their subject in `console.sso`
+
+Pocket ID is passkey-only for people (REQ-INST-2). The installing user enrolls like this:
+
+1. Enroll prints `<origin>/lc/<token>`. The token is valid for one hour and is a credential, so it goes only
+   to the terminal of the person who ran enroll. It goes in no log and no file.
+2. The user opens it in a browser that can reach `origin` (section 6). Pocket ID signs them in and asks them
+   to add a passkey. Without one they can't sign in again. If the hour passes, `pocket-id
+   one-time-access-token <username>` (P `cmds/one_time_access_token.go`), run by the user against the data
+   directory, prints a new link. `component-pocket-id.sh relink` wraps that call.
+3. Enroll already has the subject, the `id` from step 3 of section 4. It doesn't wait for a sign-in or read a
+   `subject-unknown` log line.
+
+How the subject gets into `console.sso`. config.json is user-authored and never auto-written. Two ways
+to respect that; I recommend the first:
+
+- **R1 (recommended).** Enroll prints the full entry and writes nothing:
+
+  ```json
+  "console": { "sso": { "publicOrigin": "<publicOrigin>", "providers": [ {
+    "id": "pocket-id", "issuer": "<origin>", "clientId": "mosaic-console-<instance>",
+    "clientSecret": { "slot": "console-sso-pocket-id" }, "algs": ["RS256"],
+    "subjects": [ { "sub": "<id>", "name": "<admin-user>" } ] } ] } },
+  "components": { "pocket-id": { "release": "<tag>", "origin": "<origin>", "port": <port> } }
+  ```
+
+  The user pastes it into config.json, as with Q175 step 4. Rerunning `scripts/bootstrap.sh` (or
+  `--instance NAME`) then validates it through the loader, including the section 1 cross-check, and writes
+  nothing. Nothing changes in invariant 2.
+- **R2 (rejected, Sage sage-4401: R1 chosen).** `enroll --write-config` would write those two keys itself, with a backup of config.json first, and
+  refuse if `console` or `components` were already present. That would be the first tool to modify an
+  existing config.json, against canon invariant 2's "never overwritten" practice. Not built.
+
+Whose subject. Enroll creates one person, the one running it, and only that subject goes in the entry. On
+Jason's instances, only his subject goes into `console.sso` (mos-1197). Further people are added with
+Pocket ID's admin UI (a user plus a one-time link), and their subjects go into `console.sso` by the user's
+edit, never by an agent. Pocket ID users who aren't in `subjects` can sign in to Pocket ID, but the Console
+refuses them `subject-unknown`, so REQ-WEB-2's "must map to an authorized human" holds.
+
+## 6. Reach: origin, TLS and proxy
+
+WebAuthn takes its RP id from `APP_URL`'s host name, and its allowed origin is `APP_URL`
+(P `webauthn/module.go`). Browsers allow passkeys only on a secure origin. The Console also needs https for
+both `publicOrigin` and `issuer`. Pocket ID serves plain http, and I found no TLS listener setting in its
+environment config. So:
+
+- Pocket ID always binds `127.0.0.1:<port>`. That is the default, and the component never binds anything
+  else (`HOST=127.0.0.1`; the status verb refuses a unit whose `HOST` differs).
+- `origin` is an https origin served by a TLS front that the user already has for the Console. The Console
+  needs one anyway, since `publicOrigin` is https. Pocket ID goes behind the same front under **its own host
+  name**, for example `id.<console host>`. Pocket ID doesn't support a path prefix (`APP_URL` must have no
+  path). A separate host name also keeps Pocket ID's cookies apart from the Console's
+  `__Host-mosaic_*` cookies; the two share cookies if they sit on one host name on different ports.
+- The front reaches Pocket ID on loopback, so the front has to run on the same host. If it doesn't, Pocket
+  ID would need a non-loopback bind, and that is a `network.expose` hard wait (REQ-WAIT-1), not a component
+  option.
+- `TRUST_PROXY` is set to the front's address only, never `true`.
+- The Console fetches discovery and JWKS from `issuer` over https from the server side, so the Console's
+  node has to trust the front's certificate. A public CA does that. A private CA needs
+  `NODE_EXTRA_CA_CERTS` in the Console unit, which the build row adds as a render flag.
+
+These steps are the user's, and on Jason's hosts they are Jason's, because each one changes who can reach
+the Console or Pocket ID, or who the host trusts:
+- J1: the DNS name for `origin`;
+- J2: the certificate for it, or a private CA and its trust in the browser and in `NODE_EXTRA_CA_CERTS`;
+- J3: the TLS front's route from `origin` to `127.0.0.1:<port>` (a Traefik change on Jason's hosts);
+- J4: any listener off loopback.
+
+The component checks and refuses; it never does them itself. With none of them done, Pocket ID runs on
+loopback with an https `APP_URL` that nothing serves yet. Enroll's step 2 health probe goes straight to
+`127.0.0.1`, so enroll still works. The person can't add a passkey until J1 to J3 are done.
+
+## 7. Agents
+
+Unchanged. Agents keep their per-role service tokens (lead decision 44 item 6, REQ-INST-2). Pocket ID issues
+nothing an agent uses. The Console client is the only client enroll creates. No API, no client-credentials
+grant and no admin API key exist after enroll. Residuals, stated plainly:
+
+- Agents can reach `127.0.0.1:<port>`, because the sandbox shares the host network. What they can reach there
+  is the public sign-in pages, discovery and JWKS. Signup is disabled, email codes are off, `/setup` is
+  closed because an admin exists, and there is no static key. A test of the rendered unit pins all four
+  settings.
+- The data directory and the two slots are outside every sandbox bind (section 2).
+- A seat that ran as the same OS user outside a sandbox could read the data directory. The Console's
+  existing slot has the same exposure; this design adds no new class of it.
+
+## 8. Instances
+
+One Pocket ID per named instance, never shared:
+
+- Each instance has one system config (row 190), and `components` and `console.sso` live in it. A shared
+  Pocket ID would make one instance's config depend on a unit, a data directory and an encryption key that
+  belong to another instance's config and data root.
+- Unit names, ports, data directory, slots and removal are all per instance (`mosaic-pocket-id-NAME`,
+  `<dataRoot of NAME>/components/pocket-id`), so removing one instance's component can't break another's
+  sign-in.
+- Each instance needs its own `origin` (section 6), so passkeys are per instance too. A person enrolls once
+  per instance.
+- An instance that wants to use another instance's Pocket ID can still do it with `--oidc existing`. Then it
+  is just an OIDC provider, with its own client registered by that instance's owner. Nothing special-cases it.
+
+Two instances on one host each need their own `port`. The loader can't see other instances' configs, so
+`component-pocket-id.sh` refuses at fetch and enroll when the port is already bound on loopback.
+
+## 9. Tests, stand-ins only
+
+No test downloads or starts a real Pocket ID, and no test touches auth.diversecanvas.com,
+mosaic.woltje.com or 127.0.0.1:7332. The stand-ins:
+
+- **Fake Pocket ID OP**, a node server like row 192's fake OP, shaped from v2.19.1:
+  - the discovery fields `well_known_controller.go` emits (issuer = origin, `plain` and `S256`,
+    `end_session_endpoint` at `/api/oidc/end-session`, the three auth methods);
+  - one RS256 JWK at `/.well-known/jwks.json`;
+  - a token endpoint that takes only `client_secret_basic`;
+  - `/healthz` 204.
+
+  The Console starts against it under `--sso` with the section 5 entry, with no check changed. Negative
+  cases:
+  - an http issuer refuses at load;
+  - an ES256-only JWKS against `algs: ["RS256"]` refuses at discovery;
+  - an issuer with a trailing slash refuses on the cross-check.
+- **Fake admin API** on the same stand-in: `POST /api/users`, the client create, the one-time token, and a
+  static-key check. Enroll runs against it with the binary replaced by a stub script that serves the stand-in.
+  The tests pin:
+  - the namespace argv;
+  - the slot file's mode and `O_EXCL`;
+  - that the secret appears in no stdout, stderr or argv;
+  - the static key file gone after success and after a failure at each step;
+  - the refusal under an agent marker in the environment.
+- **Fetch**: a local file served by a test https server (self-signed, trusted only by the test) with a
+  matching pin, a mismatched pin and a truncated file.
+- **Unit render**: the environment table in section 2. `HOST=127.0.0.1`, no `STATIC_API_KEY`, no
+  `ENCRYPTION_KEY` value in the text, and `ALLOW_USER_SIGNUPS=disabled`.
+- **Loader**: test-config.sh cases for the `components` key and the cross-check, and the copy-rollback note.
+- **Sandbox**: `<dataRoot>/components/` is in no bind list.
+
+## 10. Build rows, in landing order
+
+All are post-v1 (REQ-INST-2). Each row has Webby or Sage's named reviewer and its own gate. None of them
+runs on .53, .54 or dragon-lin, and none installs Pocket ID on any host.
+
+1. **P1, loader key.** `components["pocket-id"]` in `mosaic-config.mjs`, strict inside the key, and the
+   cross-check against `console.sso` (section 1, M1 conditions from mos-1666 item 3). P1 also writes the
+   rollback order into `docs/TOOLS.md` beside Q175's: remove `components` (restore the backup) before the
+   pointer goes back, and the post-rollback STATE check confirms the key is absent from config.json. Gate:
+   test-config.sh green with the four M1 cases.
+2. **P2, pin and fetch.** `scripts/pocket-id-pins.sh` with the build-time sha256 and the
+   attestation evidence, and `component-pocket-id.sh fetch|verify`. Gate: the fetch tests against the local
+   stand-in; the evidence file shows `gh attestation verify` output for each pinned asset.
+3. **P3, unit.** The unit template, `render|install|status|remove|purge`, and the encryption key slot. Gate:
+   the render and remove tests, and the sandbox bind test.
+4. **P4, enroll.** The namespaced bootstrap, the client, the subject, `relink`, and printing the entry (R1),
+   (R2 rejected). Gate: the enroll tests in section 9, and a secret-leak grep over every test log.
+5. **P5, Console against the fake Pocket ID.** The section 9 fake-OP start tests, and the
+   `NODE_EXTRA_CA_CERTS` render flag for the Console unit. Gate: the webui suite, with no change to
+   `sso.mjs` checks (a diff of `sso.mjs` and `sso-config.mjs` against the base shows none).
+6. **P6, installer option.** `--oidc existing|bundled` on REQ-INST-3's install command, calling P2 to P4 in
+   order, and the docs: `docs/TOOLS.md`, the host run sheet's J1 to J4 steps. Gate: the installer's own
+   suite against the stubs; the docs list J1 to J4 as the user's steps.
+
+## Open items for review
+
+- M1 approved by Mos with three conditions (mos-1666 item 3), written into section 1 and P1.
+- M2 dropped: Sage chose R1 and rejected R2 (sage-4401).
+- **Q1 (Webby):** the private network namespace for enroll (section 4). The other option is to start the
+  real unit and race `/setup`, which I think is unsafe while agents share the host network.
+- **Q2 (Webby):** one-providers-entry for the bundled choice (section 1). REQ-INST-2's wording reads that
+  way. Mixing a bundled Pocket ID with existing providers would need Sage's ruling.
+- Not covered: Pocket ID for Vikunja or Gitea people sign-in (the Researcher note's part 3), and
+  client-credentials between Mosaic services. Neither is in Q203.

agents/sage/work/vikunja-setup/file-1025-followups.mjs

@@ -0,0 +1,71 @@
+// Sage, 2026-10-25: files two follow-ups as P19 tasks (mos-1647 item 3, Q109): the CLIProxyAPI startup version refreshes
+// seen in row 332's isolated runs (a P7 cutover item) and Webby's row 284 N1 (library read path). No relation, labels,
+// assignees, due dates or bucket moves. Sage's own key (bot user 13); the sync key reads back. Refuses if a title exists.
+// Prints no secret.
+// Usage: node file-1025-followups.mjs https://tasks.woltje.com SAGE_TOKEN_FILE SYNC_TOKEN_FILE OUT_JSON
+import { readFileSync, writeFileSync, existsSync } from "node:fs";
+const [ORIGIN, KEY, SYNC, OUT] = process.argv.slice(2);
+if (!/^https:\/\/tasks\.woltje\.com$/.test(ORIGIN)) throw new Error("tasks.woltje.com only");
+if (!OUT || existsSync(OUT)) throw new Error("OUT_JSON missing or exists; refusing");
+const PROJECT = 19;
+const SIG = "Created by Sage (T3 1ef1e4f8) with Sage's own key (bot user 13).";
+const esc = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+const ps = (sig, xs) => xs.map((x) => `<p>${esc(x)}</p>`).join("") + `<p>${esc(sig)}</p>`;
+const TASKS = [
+  {
+    title: "Stack P7 cutover: CLIProxyAPI 8.0.42 makes outbound version-refresh calls at startup (Grok CLI via npm, antigravity)",
+    description: ps(SIG, [
+      "Filed by Mos's ruling mos-1647 item 3. Seen by Fethry in row 332 (P3) isolated runs on 2026-10-24, pinned CLIProxyAPI 8.0.42 (commit bc064340, PIN binary sha256 74661f8c), run under unshare -rn with only lo, empty HOME and auth, panel auto-update disabled.",
+      "At startup the binary logged xai_version.go:96 'failed to fetch latest Grok CLI version from npm' for https://registry.npmjs.org/@xai-official/grok/latest (network unreachable inside the namespace), then xai_version.go:79 'periodic Grok CLI version refresh started (interval=3h0m0s)'. It also logged antigravity_version.go:71 'periodic antigravity version refresh started (interval=3h0m0s)'. Evidence: origin/fethry/row332-p1 agents/fethry/work/queue-332/BUILD.md:251-252 and evidence/offline.txt.",
+      "On the live host these calls would leave the machine every 3 hours, which P1's loopback-only design doesn't account for. The proxy kept working with the fallback version, so the failure is harmless to requests.",
+      "Needed before or at P7 cutover, with Jason present: find whether 8.0.42 has a config switch for these refreshes; if so set it in P1's initial config with a test, otherwise decide deliberately to allow or block the egress (unit-level network policy) and record the choice in P7's receipt. Also recorded in docs/plans/DEFERRED.md. Umbrella: 237.",
+    ]),
+  },
+  {
+    title: "Stack: library get lists the whole served tree per read (row 284 N1, Webby)",
+    description: ps(SIG, [
+      "Filed by Mos's ruling mos-1647 item 3. Webby's round 1 note N1 on row 284 (#1789, landed ce0b6ed41 on 2026-10-25), carried in c31654. Not a correctness issue.",
+      "Each read that resolves one file walks the whole served tree with listTree (git ls-tree -r -l) and then finds the one entry: packages/library/src/mirror.mjs:257 and packages/library/src/query.mjs:142, both via packages/library/src/reader.mjs:28. On a large library that is one full tree listing per read.",
+      "Fix options: git rev-parse <commit>:<path> for the one oid, or a per-commit listing cache. listTree also bounds and checks the tree and its object IDs, so a replacement must keep those checks.",
+      "Bound to the next row that edits the library read path: that row measures a get on a library of realistic size and records the choice in its BUILD.md. Also recorded in docs/plans/DEFERRED.md.",
+    ]),
+  },
+];
+const key = readFileSync(KEY, "utf8").trim(), sync = readFileSync(SYNC, "utf8").trim();
+async function api(method, path, body, auth) {
+  const r = await fetch(ORIGIN + path, { method, headers: { Authorization: `Bearer ${auth}`, "Content-Type": "application/json" }, body: body === undefined ? undefined : JSON.stringify(body), redirect: "error" });
+  const t = await r.text(); let json = null; try { json = JSON.parse(t); } catch {}
+  return { status: r.status, json };
+}
+const list = (j) => j?.items ?? (Array.isArray(j) ? j : []);
+async function existing() {
+  const out = [];
+  for (let page = 1; page < 20; page++) {
+    const r = await api("GET", `/api/v2/projects/${PROJECT}/tasks?per_page=50&page=${page}`, undefined, sync);
+    if (r.status !== 200) throw new Error(`list tasks: ${r.status}`);
+    out.push(...list(r.json));
+    if (list(r.json).length < 50) return out;
+  }
+  throw new Error("more than 19 pages");
+}
+const rec = { at: new Date().toISOString(), project: PROJECT, created: null, problems: [] };
+const save = () => {
+  const out = JSON.stringify(rec, null, 1) + "\n";
+  if (out.includes(key) || out.includes(sync)) throw new Error("secret in the record; not written");
+  writeFileSync(OUT, out);
+};
+const have = await existing();
+for (const T of TASKS) if (have.some((t) => t.title === T.title)) throw new Error("title exists; refusing");
+writeFileSync(OUT, "", { flag: "wx" });
+rec.created = [];
+for (const T of TASKS) {
+  const r = await api("PUT", `/api/v1/projects/${PROJECT}/tasks`, { title: T.title, description: T.description }, key);
+  const c = { status: r.status, id: r.json?.id ?? null };
+  rec.created.push(c);
+  if (r.status >= 300 || !Number.isSafeInteger(r.json?.id)) { rec.problems.push(`create: ${r.status} ${r.json?.message ?? ""}`); continue; }
+  const back = await api("GET", `/api/v2/tasks/${r.json.id}`, undefined, sync);
+  Object.assign(c, { readBack: back.status, done: back.json?.done });
+  if (back.status !== 200 || back.json?.title !== T.title || back.json?.done) rec.problems.push(`read-back differs for ${r.json.id}`);
+}
+save();
+console.log(JSON.stringify(rec));

agents/sage/work/vikunja-setup/followups-filed-2026-10-25.json

@@ -0,0 +1,19 @@
+{
+ "at": "2026-10-25T00:18:17.480Z",
+ "project": 19,
+ "created": [
+  {
+   "status": 201,
+   "id": 633,
+   "readBack": 200,
+   "done": false
+  },
+  {
+   "status": 201,
+   "id": 634,
+   "readBack": 200,
+   "done": false
+  }
+ ],
+ "problems": []
+}

docs/SESSIONS.md

@@ -1693,3 +1693,4 @@ are never rewritten or removed; corrections are new entries.
 2026-10-24 | magica | row329 round2 #1827 | In-progress rev4031; B1 ASCII-only key fix/new inventory tests and N1/N3/N4 docs, cleared reader verification running, old tests byte-identical.
 2026-10-24 | magica | row329 R2 #1827 | ASCII management-key fix and docs verified: package66/66,bus readers261/261,CLI readers726/726,config55/55; no required failures/skips, slot returned. Preparing authorized ff review candidate; old tests unchanged.
 2026-10-24 | Sage 1ef1e4f8 | row329 landing #1827 (mos-1634) | Gate GREEN 23:29:14Z unchanged, landed 61ebf2c34 pushed 23:31:27Z; #1827 closed c31650; queue note 4063, done 4064 (b24d917ec); DEFERRED N2/R2-N1 to 331, N1 to P7; Vikunja 631 filed, 237 c1109; 284 and 157 must rebase.
+2026-10-25 | Sage 1ef1e4f8 | row284 landing #1789 | Gate GREEN 00:09:04Z unchanged, landed ce0b6ed41 pushed 00:09:52Z; #1789 closed c31655; queue note 4071, done 4072 (7c8dc2033); DEFERRED Webby N1 to the next library read-path row; row 332 PROXY_CODEX_API ruled openai-responses (sage-4331), P3 holds for row 331.

docs/plans/DEFERRED.md

@@ -796,3 +796,27 @@ Sage, for Dewey's round 1 N1 on row 329 (c31639). The acceptance netns had only
 but never saw the real binary refuse a non-loopback client.
 Bound to P7: at cutover, with Jason present, confirm the listener is on 127.0.0.1 only (`ss -ltnp`), and
 record it in P7's receipt.
+
+## Row 284 N1: library.get lists the whole served tree per read
+
+Sage, for Webby's round 1 N1 on row 284 (c31654 carries it forward). Each library get runs `listTree`
+(`git ls-tree -r -l`) over the whole served tree to find one blob oid. On a large library that is one full
+tree listing per read. `git rev-parse <commit>:<path>`, or a per-commit cache, would avoid it. Not a
+correctness issue. Bound to the next row that edits the library read path; that row measures a get on a
+library of realistic size and records the choice in its BUILD.md.
+
+## Row 284 N1: Vikunja task
+
+Sage, for mos-1647 item 3 (Q109). The row 284 N1 entry above is tracked as Vikunja 634. No open task
+covered the library read path.
+
+## Row 332 finding: CLIProxyAPI startup version refreshes reach outside the host
+
+Sage, for Fethry's row 332 isolated runs (2026-10-24, pinned 8.0.42, `unshare -rn` with only `lo`). At
+startup the binary tried `https://registry.npmjs.org/@xai-official/grok/latest` (xai_version.go:96, blocked
+by the namespace) and then started a 3-hour Grok CLI version refresh and a 3-hour antigravity version
+refresh. The proxy kept serving with its fallback version. Evidence: origin/fethry/row332-p1
+`agents/fethry/work/queue-332/BUILD.md`:251-252 and `evidence/offline.txt`. Bound to P7: before or at
+cutover, find a config switch that turns these off and set it in P1's initial config with a test, or
+decide on purpose to allow or block that egress and record it in P7's receipt. Tracked as Vikunja 633
+(umbrella 237).

docs/plans/QUEUE.md

@@ -33,7 +33,7 @@ Gaps found while working go to `docs/plans/DEFERRED.md`, not here.
 
 <!-- mosaic-queue:begin -->
 
-Generated from `docs/plans/queue.json` revision 4064 by `queue render`. Do not edit between the markers; change the queue with `scripts/mosaic queue`.
+Generated from `docs/plans/queue.json` revision 4072 by `queue render`. Do not edit between the markers; change the queue with `scripts/mosaic queue`.
 
 | # | Piece | Owner | Issues | State | After | Gate | Brief | Note |
 |---|---|---|---|---|---|---|---|---|
@@ -320,7 +320,7 @@ Generated from `docs/plans/queue.json` revision 4064 by `queue render`. Do not e
 | 281 | A fire or a delete revokes the instance's host and Gitea grants (194/236 follow-up, MVP, mos-1271) | megavolt; reviewers dewey | #1786 | done | 236 done | Dewey approves the design, then the manifest. Bus, business, cli and every touched test file run whole, plus the Docker gitea-grant test and every scripts/test-*.sh, green on Sage's gate. M1-M4 killed. Lands before .53 Case 1 hires a granted instance. Red goes to Sage, then Mos. (sage) | `docs/plans/2026-10-22_fire-revokes-grants.md` § Brief: no grant outlives its instance | LANDED e479521d3 ff on 385a7194c (17 commits, manifest b73d4c81). Slot on 7979fb41e green: bus 819, business 231, cli 837, dewey-bus 76 with gitea-grant-docker run, shells green under 3x limits, M1-M22 killed. M1 hang fixed in b4a (mos-1273). Skips: test-task row 244 live-provider pair, test-queue canonical root. DEFERRED: N1 host-unknown hint verb, N2 fire tool text, to the follow-up row. Dewey APPROVE c30614. |
 | 282 | PRD REQ-LIB-6 rewritten to Q223 and Q226 (mos-1320 item 8) | gosalyn; reviewers webby | #1787 | done | — | Webby approves against the ruling. requirements.test.mjs and every scripts/test-*.sh that reads the PRD or requirements.json are green on Sage's gate. Jason gets a report. (sage) | `docs/plans/2026-10-20_case2-rows.md` § PRD REQ-LIB-6 rewritten to Q223 and Q226 (mos-1320 item 8) | Landed 647424442 on 86a665bdf: 1841f7d4e and 6b5b06819 rebased, patch-ids equal (4e50b4b6, 16a7a02f), range-diff =, tree 4f30ed10a = Gosalyn's gated trial tree. Webby APPROVE rev 3308 c30764 on 6b5b06819. Gate 19:06Z on the tip tree: bus+tasks requirements and tasks verbs 37/0/0, 0 skips; no scripts/test-*.sh reads the PRD (control ok). PRD 1.15. 1.16 is row 291, waits for Jason. |
 | 283 | Case 2 C2-01d supporting folders, the supporting scope, the editor field and supportingPath (M12) | honker; reviewers webby | #1788 | done | 268 done, 282 done | Webby approves the manifest. The library and business suites are green on Sage's gate, along with every scripts/test-*.sh. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-01d supporting folders, the supporting scope, the editor field and supportingPath (M12) | LANDED 8d2856ee3 (replay of 0bf308dba onto 59226f878, 13 patch-ids equal) plus DEFERRED N1 93694c518. Webby APPROVE r1 c31338 rev 3677, r2 c31342 rev 3683 (mos-1528 G1 mapping.test:52). Sage full gate GREEN 20:37:16Z: all package suites but queue plus every scripts/test-*.sh, 0 fail, library 98/0, webui npm ci, editor build required. supporting.test first-run red placed (mos-1272, 54d9e07bb). #1788 closed c31358. Live unchanged 45dca69f6. |
-| 284 | Case 2 C2-05c the supporting scope and blob in the lookups | della; reviewers webby | #1789 | in-review, round 1, request posted | 224 done, 283 done | Dewey approves the manifest. Library, bus and harness suites and every scripts/test-*.sh green on Sage's gate. Grep packages/*/tests for the scope enum pin and ['canon', 'playground'] before in-review; update each. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-05c the supporting scope and blob in the lookups (sage-2833) | — |
+| 284 | Case 2 C2-05c the supporting scope and blob in the lookups | della; reviewers webby | #1789 | done | 224 done, 283 done | Dewey approves the manifest. Library, bus and harness suites and every scripts/test-*.sh green on Sage's gate. Grep packages/*/tests for the scope enum pin and ['canon', 'playground'] before in-review; update each. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-05c the supporting scope and blob in the lookups (sage-2833) | LANDED ce0b6ed41 (fast-forward of Della r4 on 9e2689dff), pushed 00:09:52Z 10-25. Sage gate GREEN 00:09:04Z on ce0b6ed41: every package suite but queue (cli 999/0 + allowed FED R7 skip) and every scripts/test-*.sh rc 0. Webby APPROVE r2 c31654 rev 4070 on manifest-r4 de505cfd; landed tree matches. Della whole-file runs 51/0. #1789 closed with c31655. |
 | 285 | Case 2 C2-08b role changes for agent writes and the chief's read grant | magica; reviewers poe, webby | #1790 | done | 213 done, 291 done | Webby approves the manifest. Business suite, test-config.sh and every scripts/test-*.sh green on Sage's gate. Grep for CREATIVE_KINDS and 64-hex pins of changed role files. Sage checks it against mos-1309 item 5. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-08b role changes for agent writes and the chief's read grant (mos-1309 item 5) | LANDED 1f3d0350f 13:33:42Z: candidate 2e4503dc7 (14 commits) cherry-picked onto 25874bc86. Logs kept both sides; otherwise the tree equals the candidate except on 7 base paths. Poe c31568 rev 3919, Webby c31569 rev 3920. Sage gate GREEN 13:28:46Z with its own npm ci: 4236 package tests, 0 fail, 1 allowed FED R7 skip; 12 scripts rc 0. No CREATIVE_KINDS, no role-file hash pins. Roles match mos-1309 item 5. 286 rebases as r5. |
 | 286 | Case 2 C2-03b push and per-seat credentials for the library mirror (with R4, mos-1323) | rockerduck; reviewers boyd, dewey | #1791 | done | 222 done | Dewey approves the manifest. Library and bus suites and every scripts/test-*.sh green on Sage's gate, mutant killed. A search of the run output for the fixture token finds nothing. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-03b push and per-seat credentials for the library mirror | LANDED 5d7801dc1 14:37:02Z: r6 75f6d56b1 (19 commits) picked onto d55944edb; logs kept both sides, code equals the candidate. Boyd c31587 rev 3942, Dewey c31588 rev 3943 (r2 c31584/c31585). Sage gate GREEN 14:36:42Z, own npm ci: 4251 tests, 0 fail, 1 allowed FED R7 skip; 12 scripts rc 0; fixture values in 0 of 29 outputs; B285-M1 kills T7/T9. r6 shortened two fixtures after push-check STOP secrets (sage-4112). Chief seed per sage-4100. |
 | 287 | Case 2 C2-21 the grant executor for a library project | steelbeak; reviewers boyd, dewey | #1792 | done | 226 done, 285 done | Dewey approves the manifest. Bus suite, Gitea Docker test, install test and every scripts/test-*.sh green on Sage's gate. A search of the run output for the fixture admin and seat tokens finds nothing. (sage) | `docs/plans/2026-10-20_case2-rows.md` § C2-21 the grant executor for a library project | LANDED 0e935776e 16:12:35Z 10-24 (cand c2338ed58 + a5370b198 on 9b6345466). Boyd APPROVE c31602 rev 3967, Dewey APPROVE c31603 rev 3968. Sage gate GREEN 16:11:38Z: bus 998/0 (Gitea Docker F-A/F-B + X-G3, minted 4 hits 0), business 283/0, cli 989 +1 allowed FED R7 skip, webui 442/0, 12 scripts rc 0. F-C negative record-only follow-up. Dewey N1-N3 non-blocking. #1792 closed c31606. No P19 task. |

docs/plans/queue.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
   "canonicalRoot": "/mnt/storage/src/mosaic-stack",
-  "revision": 4064,
+  "revision": 4072,
   "rows": [
     {
       "id": 1,
@@ -30162,7 +30162,7 @@
       "closes": [
         1789
       ],
-      "state": "in-review",
+      "state": "done",
       "previousState": null,
       "required": false,
       "requiredSince": null,
@@ -30241,18 +30241,69 @@
                 "candidate": "c403f7e3e4496c8eabfe29cce00582267c6dc5a5140b74fcb4ba4c2ec031ca65"
               }
             ]
+          },
+          {
+            "n": 2,
+            "op": "della-284-r2-review",
+            "by": "della",
+            "at": "2026-10-24T23:43:28.297Z",
+            "issue": 1789,
+            "candidate": {
+              "kind": "manifest",
+              "digest": "de505cfd18c82f66ff6cc5faf00789e81c66d148e07e1972c5d664031ee0f727",
+              "text": "0cf1506f848cc1734e34625f101b60561ecdc8505e33b6a9d16e430b3cb2f68e  agents/della/work/queue-284/BUILD.md\n591a412ed4243288da29c406269ff089a58bbcfcb0a2a0b3536b87bfa2e89eab  packages/bus/src/broker.mjs\n9b974b53c7fde08b795e1a26c75ad1e6dd664fda72b79a656900ec96f1603d03  packages/bus/tests/library-lookups.test.mjs\n145ede2d2f5c9c776cc2a6eb5f48975e96b09e78c495401d5aaae435974496a4  packages/harness/src/tools.mjs\n21e78b4424ae0e8337aaf548e880abf297407301cb0ae41711bd794e99344276  packages/harness/tests/library-tools.test.mjs\nbafe113bee70f17bd249876d6bdd1c08fa051223c2111955e5d5f275bd76bba0  packages/library/src/query.mjs\n766b80f53f4565588ac48bd613f6099b1f7ca1c933994779fe6c6cb9eae23a29  packages/library/tests/query-fixture.mjs\nd99111d1a4f7ca42881ba699cbc55d2dad12f6c75e7b8e1bac44f05c7df56dec  packages/library/tests/query.test.mjs\n"
+            },
+            "request": "comment",
+            "attempts": [
+              {
+                "op": "della-284-r2-review",
+                "by": "della",
+                "at": "2026-10-24T23:43:28.297Z",
+                "state": "failed",
+                "comment": null,
+                "transport": {
+                  "outcome": "failed",
+                  "status": null,
+                  "comment": null,
+                  "detail": "pre-send: the credential or account check failed"
+                },
+                "resolutions": []
+              },
+              {
+                "op": "sage-284-r2-request",
+                "by": "sage",
+                "at": "2026-10-24T23:46:18.731Z",
+                "state": "posted",
+                "comment": 31653,
+                "transport": {
+                  "outcome": "posted",
+                  "status": 201,
+                  "comment": 31653,
+                  "detail": "created"
+                },
+                "resolutions": []
+              }
+            ],
+            "duplicateRisk": false,
+            "receipts": [
+              {
+                "reviewer": "webby",
+                "op": "webby-284-verdict-r2",
+                "at": "2026-10-24T23:48:52.791Z",
+                "verdict": "approve",
+                "comment": 31654,
+                "candidate": "de505cfd18c82f66ff6cc5faf00789e81c66d148e07e1972c5d664031ee0f727"
+              }
+            ]
           }
         ]
       },
-      "claim": {
-        "seat": "della",
-        "op": "della-284-start-1"
-      },
-      "note": null,
+      "claim": null,
+      "note": "LANDED ce0b6ed41 (fast-forward of Della r4 on 9e2689dff), pushed 00:09:52Z 10-25. Sage gate GREEN 00:09:04Z on ce0b6ed41: every package suite but queue (cli 999/0 + allowed FED R7 skip) and every scripts/test-*.sh rc 0. Webby APPROVE r2 c31654 rev 4070 on manifest-r4 de505cfd; landed tree matches. Della whole-file runs 51/0. #1789 closed with c31655.",
       "blockedReason": null,
       "createdAt": "2026-10-22T18:28:04.590Z",
-      "updatedAt": "2026-10-24T23:25:20.620Z",
-      "updatedBy": "webby"
+      "updatedAt": "2026-10-25T00:12:13.878Z",
+      "updatedBy": "sage"
     },
     {
       "id": 285,
@@ -140751,6 +140802,194 @@
         "receipt": "ok sage-329-done-landed rev 4064 row 329 in-review→done round 2"
       },
       "viewSha": "cf64a27b66b579121eb5f4dba03d2b4a3e88ff1aedd95ffe2c3d713591edf8b4"
+    },
+    {
+      "rev": 4065,
+      "op": "della-284-r2-reopen",
+      "verb": "move",
+      "args": {
+        "id": 284,
+        "to": "in-progress",
+        "reason": null,
+        "candidate": null,
+        "evidence": null,
+        "issue": null
+      },
+      "by": "della",
+      "at": "2026-10-24T23:42:25.130Z",
+      "semantics": 2,
+      "result": {
+        "row": 284,
+        "from": "in-review",
+        "to": "in-progress",
+        "round": null,
+        "issue": null,
+        "candidate": null,
+        "receipt": "ok della-284-r2-reopen rev 4065 row 284 in-review→in-progress"
+      },
+      "viewSha": "1ca33a4b5b66adffafabf5096cc182b7dd13cd71cdab6186fba9a0d3974ead96"
+    },
+    {
+      "rev": 4066,
+      "op": "della-284-r2-review",
+      "verb": "move",
+      "args": {
+        "id": 284,
+        "to": "in-review",
+        "reason": null,
+        "candidate": "/mnt/storage/scratch/della-row284-r2-evidence/manifest-r4.txt",
+        "evidence": null,
+        "issue": null
+      },
+      "by": "della",
+      "at": "2026-10-24T23:43:28.297Z",
+      "semantics": 2,
+      "result": {
+        "row": 284,
+        "from": "in-progress",
+        "to": "in-review",
+        "round": 2,
+        "issue": 1789,
+        "candidate": {
+          "kind": "manifest",
+          "digest": "de505cfd18c82f66ff6cc5faf00789e81c66d148e07e1972c5d664031ee0f727",
+          "text": "0cf1506f848cc1734e34625f101b60561ecdc8505e33b6a9d16e430b3cb2f68e  agents/della/work/queue-284/BUILD.md\n591a412ed4243288da29c406269ff089a58bbcfcb0a2a0b3536b87bfa2e89eab  packages/bus/src/broker.mjs\n9b974b53c7fde08b795e1a26c75ad1e6dd664fda72b79a656900ec96f1603d03  packages/bus/tests/library-lookups.test.mjs\n145ede2d2f5c9c776cc2a6eb5f48975e96b09e78c495401d5aaae435974496a4  packages/harness/src/tools.mjs\n21e78b4424ae0e8337aaf548e880abf297407301cb0ae41711bd794e99344276  packages/harness/tests/library-tools.test.mjs\nbafe113bee70f17bd249876d6bdd1c08fa051223c2111955e5d5f275bd76bba0  packages/library/src/query.mjs\n766b80f53f4565588ac48bd613f6099b1f7ca1c933994779fe6c6cb9eae23a29  packages/library/tests/query-fixture.mjs\nd99111d1a4f7ca42881ba699cbc55d2dad12f6c75e7b8e1bac44f05c7df56dec  packages/library/tests/query.test.mjs\n"
+        },
+        "receipt": "ok della-284-r2-review rev 4066 row 284 in-progress→in-review round 2 on #1789; request della-284-r2-review requesting"
+      },
+      "viewSha": "06c4188500095cb6d4a33ed66cf0ca641c422791578fd716de241899f8e6cd9a"
+    },
+    {
+      "rev": 4067,
+      "op": "della-284-r2-review.outcome",
+      "verb": "review-outcome",
+      "args": {
+        "id": 284,
+        "attempt": "della-284-r2-review",
+        "outcome": "failed",
+        "status": null,
+        "comment": null,
+        "detail": "pre-send: the credential or account check failed"
+      },
+      "by": "della",
+      "at": "2026-10-24T23:44:28.236Z",
+      "semantics": 2,
+      "result": {
+        "row": 284,
+        "round": 2,
+        "attempt": "della-284-r2-review",
+        "state": "failed",
+        "receipt": "ok della-284-r2-review.outcome rev 4067 row 284 round 2 request della-284-r2-review failed"
+      },
+      "viewSha": "c5746412794db34382b1445e1cf6653bd9bc5d18ced39eb7530f3d8b85f9dc71"
+    },
+    {
+      "rev": 4068,
+      "op": "sage-284-r2-request",
+      "verb": "review-request",
+      "args": {
+        "id": 284
+      },
+      "by": "sage",
+      "at": "2026-10-24T23:46:18.731Z",
+      "semantics": 2,
+      "result": {
+        "row": 284,
+        "round": 2,
+        "attempt": "sage-284-r2-request",
+        "state": "requesting",
+        "receipt": "ok sage-284-r2-request rev 4068 row 284 round 2 request sage-284-r2-request requesting"
+      },
+      "viewSha": "d88a0b75a5e83fc52e67f38060a10beb206122bd3c7b4c8f6e5abc59ec5db2cd"
+    },
+    {
+      "rev": 4069,
+      "op": "sage-284-r2-request.outcome",
+      "verb": "review-outcome",
+      "args": {
+        "id": 284,
+        "attempt": "sage-284-r2-request",
+        "outcome": "posted",
+        "status": 201,
+        "comment": 31653,
+        "detail": "created"
+      },
+      "by": "sage",
+      "at": "2026-10-24T23:47:19.540Z",
+      "semantics": 2,
+      "result": {
+        "row": 284,
+        "round": 2,
+        "attempt": "sage-284-r2-request",
+        "state": "posted",
+        "receipt": "ok sage-284-r2-request.outcome rev 4069 row 284 round 2 request sage-284-r2-request posted comment 31653"
+      },
+      "viewSha": "afadc7eb51a8de8bc7ea9e231718958e058ad4b34f355396d589e5b90d994ab0"
+    },
+    {
+      "rev": 4070,
+      "op": "webby-284-verdict-r2",
+      "verb": "review-record",
+      "args": {
+        "id": 284,
+        "verdict": "approve",
+        "comment": 31654,
+        "candidate": "de505cfd18c82f66ff6cc5faf00789e81c66d148e07e1972c5d664031ee0f727"
+      },
+      "by": "webby",
+      "at": "2026-10-24T23:48:52.791Z",
+      "semantics": 2,
+      "result": {
+        "row": 284,
+        "round": 2,
+        "verdict": "approve",
+        "receipt": "ok webby-284-verdict-r2 rev 4070 row 284 round 2 approve by webby (comment 31654)"
+      },
+      "viewSha": "fc73cc2acac68aad3f22e65bd531f278572839f3134073aafd3cbf1e495411a3"
+    },
+    {
+      "rev": 4071,
+      "op": "sage-284-note-landed",
+      "verb": "note",
+      "args": {
+        "id": 284,
+        "text": "LANDED ce0b6ed41 (fast-forward of Della r4 on 9e2689dff), pushed 00:09:52Z 10-25. Sage gate GREEN 00:09:04Z on ce0b6ed41: every package suite but queue (cli 999/0 + allowed FED R7 skip) and every scripts/test-*.sh rc 0. Webby APPROVE r2 c31654 rev 4070 on manifest-r4 de505cfd; landed tree matches. Della whole-file runs 51/0. #1789 closed with c31655."
+      },
+      "by": "sage",
+      "at": "2026-10-25T00:11:07.895Z",
+      "semantics": 2,
+      "result": {
+        "row": 284,
+        "field": "note",
+        "receipt": "ok sage-284-note-landed rev 4071 row 284 note"
+      },
+      "viewSha": "c02f6437f45a2ef9181cd3b05d90b331d0468534a294200a55e38dcc316d3ac9"
+    },
+    {
+      "rev": 4072,
+      "op": "sage-284-done-landed",
+      "verb": "move",
+      "args": {
+        "id": 284,
+        "to": "done",
+        "reason": null,
+        "candidate": null,
+        "evidence": null,
+        "issue": null
+      },
+      "by": "sage",
+      "at": "2026-10-25T00:12:13.878Z",
+      "semantics": 2,
+      "result": {
+        "row": 284,
+        "from": "in-review",
+        "to": "done",
+        "round": 2,
+        "issue": null,
+        "candidate": null,
+        "receipt": "ok sage-284-done-landed rev 4072 row 284 in-review→done round 2"
+      },
+      "viewSha": "546679f234a78b2d4582ed5a50b90c7427bf82cf2bd75243eeccad1f5730fa79"
     }
   ]
 }