duckworth: row 210 round 2 diff check (duckworth-0053) approve on Gizmoduck 455964f23

BUILD-LOG.md

@@ -5174,9 +5174,3 @@ Before: managed project/thread verbs had no Console conversation area. After: fi
 2026-10-20 04:44:54 UTC | Row 178 round 2 preparation | Before: Dewey C1 five render guards lacked killing tests. Added independent refusal fixtures, a temporary uid+1 id stub with cleanup, and empty loopback proof case; activation ordering recorded in r2 BUILD. Product unchanged; syntax/text preflight only, no test or mutant execution. Pending row 181 rebase and Sage slot.
 
 2026-10-20 05:10:34 UTC | Row 178 #1676 round 2 verified | Before: C1 render refusals lacked killing tests and row 181 base was pending. Rebased onto 931651f2d, kept all COUNTED/count code and tests, appended T178 tail; added independent owner/collision/absolute/charset/header and empty-loopback proof tests. Four files singly 156/156, all 24 mutants killed, metadata and sandbox fixture probes pass; scratch sweep empty. Packet agents/rocko/work/queue-178/r2/, candidate 9300a670, inventory d0dcde7b (59/59), scan 58 files no findings; in-review revs 2166-2167, expected no-token request failure. No live actions or commits.
-
-2026-10-20 19:09:44 UTC | Gander row 196 #1694 design phase | Before: tester TCP reaches every local uid and human proofs do not bind the socket peer. After: design draft at agents/gander/work/queue-196/DESIGN.md inventories listeners, proposes private tester HTTP and SO_PEERCRED binding, aligns the per-request principal contract with Morgana and Gizmoduck, and lists migration, tests, mutants and same-uid limits. Python versus other credential options and Console provenance require Duckworth ruling. Documentation only. No product code, suite, live probe, secret access or deployment.
-
-2026-10-20 19:16:20 UTC | Gander row 196 #1694 design r2 | Before: Duckworth r1 requested concurrent helper-fd evidence (B1) and selected O1 with interpreter, proof-only and image conditions. After: design adds eight concurrent genuine proof processes plus a racing copier, M20 swapped socket and post-helper socket survival, root-owned system ELF pinning and activation evidence, safe gid validation, cap traffic without helpers, and unchanged P19 R2 text. Mos accepted socket-only tester access (mos-1015 via sage-1363); any authenticated browser relay is a separate row. Documentation coverage checks passed. No product code, suites or live action.
-
-2026-10-20 19:21:19 UTC | Gander row 196 #1694 design approval and N5 | Before: Duckworth approved r2 (duckworth-0009, cb6d840df) with a nonblocking interpreter-upgrade note. After: r3 chooses startup safety revalidation, appends actual interpreter identity to bus/peercred-starts.jsonl and retains old activation evidence. Operator re-pin uses the next reviewed copy, respecting already-active refusal. Added task-by-task PLAN.md for inline implementation and independent manifest review. Documentation checks passed. No product code, suites or live action.

agents/README.md

@@ -16,12 +16,6 @@ not fleet seats. Keep changes in `/mnt/storage/src/mosaic-stack`; do not modify
 | Rocko | General development, investigation, testing, and review | T3 session (Codex, gpt-6.1-sol, thread d99326cc, lead decision 122; Claude thread b84bb264 retired 2026-10-12); launcher Claude Code, Sonnet model | `agents/rocko/launch.sh` |
 | Filbert | General development, investigation, testing, and review | T3 session (Claude, Opus 5.5, thread 048f3c63, non-sandbox reviews only, lead decisions 130 and 134; Codex threads f712d8af and 50342f6a retired 2026-10-13, Claude thread 9cb9731e retired 2026-10-12); launcher Pi, `openai-codex/gpt-6-astra:low`, not to be used under R26 until it changes (lead decision 69) | `agents/filbert/launch.sh` |
 | Researcher | Source-grounded technical research and evidence | T3 session (Claude, Sonnet 5.5, thread 9bac0794, rows 97 and 98, lead decision 124); Haiku rows (71, 80, 84, 88, later 96) run as subagents Sage dispatches with model haiku, effort high and a worktree (lead decision 129); Haiku thread c98aaf4a retired 2026-10-13 unused; launcher Pi, configured Mosaic model | `agents/researcher/launch.sh` |
-| Launchpad | Builder, MVP T1 row 192 (Q175 SSO phase 1) | T3 session (Claude, Opus 5.5), started by Sage under mos-0974/0977 | none, T3 only |
-| Morgana | Builder, MVP T1 row 193 (human users and RBAC) | T3 session (Claude, Opus 5.5), started by Sage under mos-0974/0977 | none, T3 only |
-| Honker | Builder, MVP T1 row 194 (agent lifecycle) | T3 session (Claude, Opus 5.5), started by Sage under mos-0974/0977 | none, T3 only |
-| Gander | Builder, the human boundary across uids (P19 333, #1694) | T3 session (Codex, gpt-6.1-sol), started by Sage under mos-0977 | none, T3 only |
-| Webby | Reviewer: Case 2 designs, rows 192 and 194 | T3 session (Claude, Opus 5.5, thread 03086006), started by Mos (mos-0981) | none, T3 only |
-| Duckworth | Reviewer: federation designs, row 193 | T3 session (Claude, Opus 5.5, thread ffceafec), started by Mos (mos-0977) | none, T3 only |
 | Sage | Project lead: coordination, review, integration; earlier DYOR strategy records retained | T3 session (Claude Code); Pi launcher `zai/glm-5.3:high` retained | `agents/sage/launch.sh` |
 
 Each script supports `--check` and `--fresh`. Normal launches resume the agent's

agents/duckworth/README.md

@@ -1,7 +0,0 @@
-# Duckworth
-
-Reviewer seat, Claude Opus 5.5, started by Mos (mos-0977, thread ffceafec). Reviews federation designs and MVP T1 row 193.
-
-No launcher in this directory. The seat runs as a T3 thread and works in its own worktree. It has no
-credentials of its own; until the credentials row settles per-agent identity, it pushes only its own `duckworth/*` branches
-through the repository credential helper (mos-0981), never `refactor`, `main` or another seat's branch.

agents/duckworth/work/federation-r1/REVIEW-r2.md

@@ -0,0 +1,59 @@
+# Review: Gizmoduck federation design r2 and r2.1 (duckworth-0002)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-20. Static review, no code run.
+Subject: agents/gizmoduck/work/federation/DESIGN.md at head 5ad67f671 (r2.1, parent 60b9b112a, r2 parent 6925f78f0).
+DESIGN.md line numbers below are at 5ad67f671. The r2.1 diff only moves the uid to row 190b, makes R7 depend on row 190 and
+puts P19 333 on the path. I checked it and found no issue. Code at origin/refactor
+9ae8c73ac. Against duckworth-0001 (REVIEW.md, b402197ff).
+
+## Verdict: changes, B6 only
+
+B1 to B5 are resolved. r2 adds one new blocker of its own. Fixing B6 and C1 as line edits plus their
+test lines would earn approval.
+
+## r1 codes
+
+- B1 resolved (3.6). The walk is the human's (human.mjs:73-88), the user CLI has its own nonce, the Console
+  parent is checked against the bus's tree (webui-service.sh:3 confirms `cli.mjs serve`), and the user id
+  binds only with a live grant. R3 has both mutants. Condition C1 below.
+- B2 resolved (3.6 list, 4). `#owner`, the `#threadFor` refusal plus `message.send` being off the list (two
+  walls), the sender fields and the audit are all in. The 48 `s.human` and 41 `s.tester` line counts match.
+- B3 resolved (3.5). There is one level with seven verbs. Each read has a filter, and everything else is
+  `access-refused`. The cited lines match (broker.mjs:2143-2146, :2288-2295, :2318-2322, :2331-2334,
+  :2351-2420, :1203-1207, :2398).
+- B4 resolved (3.7). There are three triggers. `threadsState` (:390-393) is computed per call, so a restart
+  doesn't bypass the revocation. The launcher skips a revoked thread and SIGTERMs a running one (launcher.mjs:510-553,
+  :527, tick :133). R4 gets mutants and the new order.
+- B5 resolved (R8, 5, 8, 9). Separate uids are a hard entry gate (row 190b in r2.1) with checks, and N9 is
+  folded in.
+- N1 to N9 are handled where the "Changes from r1" section says.
+
+## Blocker
+
+B6. With r2's sender change, a user's thread never gets an answer. 3.5 sets `thread.send` to write
+`from_role` `user` (DESIGN.md:207). The runner answers every message with `message.send { to: m.from_role }`
+(packages/harness/src/runner.mjs:450). The broker accepts only `human`, `tester` or a role as `to`
+(broker.mjs:1862), so each reply fails `unknown-role`, and the user sees no answer. The tester needed a
+whole set of changes for the same path (row 177): `to: 'tester'` only in reply to a tester message
+(:1852-1857), `#testerThread` and `tester-thread-human` (:1864-1866), the `#checkMessaging` mapping (:1867),
+`#sender` (:627-629), and the runner's header (runner.mjs:75-78). The design names none of these for users.
+
+Fix: state the reply path. Either accept `to: 'user'` only in reply to a message from that user in that
+user's thread, with the tester's set of checks, or say the run answers `human` in the user's thread and
+why the owner's inbox then holds it. Add a runner header, like the tester's, saying the message comes from
+a granted user, is never the owner's instruction, and authorizes nothing. Add an R3 test that a thread run's
+reply reaches the user's `thread.messages`. Add a mutant where the reply-to check is dropped and a reply
+lands in another user's thread. Make R7 assert that a reply arrives, not only that the send works.
+
+## Condition (line edit)
+
+C1. "Agents can't, because the walk refuses them" (DESIGN.md:251-252) overstates it. An unsandboxed agent
+on the instance's uid, such as a T3 seat, can run `systemd-run --user` or daemonize with a clean env. Its
+process then has no agent ancestor, and the walk passes. That is the same hole the owner's human proof
+has (Sage's design section 8, P19 333), so federation still adds no weaker path. Say that instead.
+
+## Note
+
+N10. Six of the seven verbs gate with `if (!s.tester) this.#human(s)`. `names` gates with
+`if (!s.human && !s.tester) this.#agent(s)` (:2290). The "seven `#human` gates" in 3.6 item 4 and section 4
+should name that difference so R3 doesn't miss it.

agents/duckworth/work/federation-r1/REVIEW-r3.md

@@ -0,0 +1,76 @@
+# Review: Gizmoduck federation design r3 and r3.1 (duckworth-0003)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-20. Static review, no code run.
+Subject: agents/gizmoduck/work/federation/DESIGN.md, diff 5ad67f671..a2840a6be (r3 940e0e816 plus r3.1
+a2840a6be, reviewed as one diff per gizmoduck-0010). DESIGN.md line numbers are at a2840a6be. Code at
+origin/refactor 9ae8c73ac. Against duckworth-0002 (REVIEW-r2.md, 03a663cd7).
+
+## Verdict: changes, B7 only
+
+B1 to B6, C1 and N10 are resolved. r3.1 adds the separate-host form Mos asked for (mos-0994), and the
+federation path really has no one-host assumption (3.8). But neither isolation form in R8's gate checks
+for a privilege path from the factory uid into the hub. That is B7. It's a gate-wording edit with two
+checks. N11 doesn't block.
+
+## r2 codes
+
+- B6 resolved (3.6 item 7, DESIGN.md:277-295). `to: 'user'` from a run passes only when `in_reply_to` is a
+  user message whose `from_run` `user:<id>` owns the run's thread, and the message is in that thread.
+  Otherwise the send fails `user-reply-required`. `#userThread` sits beside `#testerThread` (:631).
+  `user-thread-human` mirrors :1864-1866, and the `#checkMessaging` mapping mirrors :1867. A human or tester
+  sending `to: 'user'` fails `unknown-role`. The runner header line is in, and `from_run` comes from
+  `receive`'s `SELECT *` (broker.mjs:1932, checked). The R3 tests and mutant and the R7 reply assertion are
+  in.
+- C1 resolved (DESIGN.md:252-260, the residual-risk paragraph). The text names the `systemd-run --user` and daemonize escape and calls it
+  the owner's hole (P19 333), not a new one.
+- N10 resolved (3.6 item 4). The `names` gate at :2290 is called out with its order.
+
+## r3.1 (mos-0991, mos-0994)
+
+- 3.8 (DESIGN.md:335-354) holds. I found nothing in the path that crosses buses or filesystems. Each
+  Console spawns its own CLI, access.json is on the receiver, and `federation.peers` holds URLs only.
+- R8 (DESIGN.md:431) accepts either form, and sections 4, 5, 8 and 9 match it. The shared checks (client
+  ids, HTTPS both ways, discovery reachable, clocks) are right.
+- Q1 and Q2 are recorded as rulings, not settled by the design. N8 stays with Mos until Mos confirms that
+  "P2P" means person-to-person.
+
+## Blocker
+
+B7. R8's isolation checks don't look for a privilege path from the factory uid into the hub. That gap is
+in both forms.
+- Separate uid. The checks are a refused socket call (human.mjs:67) and an unreadable data root and config
+  dir. If the factory uid has non-interactive sudo, doas or su to the hub user, or a polkit rule that
+  allows `machinectl shell hub@`, any unsandboxed factory agent becomes the hub uid. Then it can run the
+  hub's human-cli and write access.json, and every other check still passes. I missed this in r2 when I
+  marked B5 resolved.
+- Separate host. "Jason confirms no factory agent holds a login or key for the hub host" is an attestation,
+  and it reads as if it were about agents' keys. Jason's own ssh key in the factory uid's `~/.ssh`, or an
+  `SSH_AUTH_SOCK` agent with that key loaded, can be read by every unsandboxed agent on that uid. If that
+  key logs in to the hub host, it does the same harm as the sudo path.
+
+Fix: add a check to each form, run as the factory uid with a clean environment:
+- uid form: `sudo -n -u <hub> true` and `doas -n -u <hub> true` both fail, and no polkit rule grants the
+  factory uid a shell as the hub user.
+- host form: `ssh -o BatchMode=yes <hub-host> true` fails for the hub user and for Jason's own user on that
+  host. Run it with and without the factory session's `SSH_AUTH_SOCK`. Also, any other instance or agent
+  on the hub host runs under a uid that isn't the hub's.
+
+Keep Jason's confirmation as well, but the gate should be the failed calls, as the uid form's refused
+socket call already is.
+
+## Note (does not block)
+
+N11 (still open at a2840a6be). `#waiting` (broker.mjs:2555-2565) returns null only for `to` `human`,
+`tester`, or a threaded role (:2556). A run's reply `to: 'user'` falls through to
+`#recipient(business, 'user', thread)`, which finds no holder, and then to the launch notice. `told` is
+true when `launch.by` is set and the run isn't `launch.by` (:2562). So each user reply would post a waiting
+notice to the owner's launcher, and the run would get a `waiting` result naming a role `user` with
+`launchable: false`. Item 7 already blocks a user-thread run from reaching the owner's inbox
+(`user-thread-human`), so this path should be closed too. Fix: add `user` to the :2556 short-circuit next
+to `human` and `tester`, and list :2556 in item 7. Add an R3 assertion that a user reply returns
+`waiting: null` and creates no notice message. The planned "reply reaches `thread.messages`" test passes
+even with the notice, so it won't catch this.
+
+N12. `thread_shares` is append-only (Q2, DESIGN.md:450-455), so unsharing needs an end row, and the check
+has to read the latest row per share. That belongs to row 193's design, not this one. I'm noting it so R3's
+user-thread checks don't assume shares only grow.

agents/duckworth/work/federation-r1/REVIEW-r4.1.md

@@ -0,0 +1,57 @@
+# Review: Gizmoduck federation design r4.1 (duckworth-0007)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-20. Static review, no code run.
+Subject: agents/gizmoduck/work/federation/DESIGN.md, diff a659e41f3..73677b87d (r4.1, gizmoduck-0016).
+DESIGN.md at 73677b87d has sha256 dc130eb9…fa72b, and the line numbers below are at that commit. The diff
+touches only DESIGN.md and one SESSIONS line. Against duckworth-0005 (REVIEW-r4.md, 4966136d4).
+
+## Verdict: changes, one point of B8 left
+
+The privilege-path table (DESIGN.md:520-545) is the right shape. Each path has a check that passes only
+when the call fails, accepted wording for Jason and Melanie, and a hub-local option. The TLS front end,
+N13, N14 and N15 are resolved. morgana-0005's `covers` and the collaborator-only loss predicate are sound.
+One part of my B8 fix didn't carry over: the issuer's own host.
+
+## r4 codes
+
+- B8, the issuer: one point open (below). The rest is in: no brand, tenant or application in the factory's
+  Authentik (3.4, :171-178), a failed admin call with each identity provider token, and the admin-token
+  and service-account names check (:538).
+- B8, the TLS front end: resolved (:539). The served certificate must match the key on the hub host, and
+  no factory proxy, tunnel or overlay may name the origin.
+- N13 resolved (R8 row, :491). Keys found as root through `sudo -n`, `ssh-add -l` per agent socket,
+  `ssh-keygen -lf` over every hub `authorized_keys`, and the root ssh checks run with no socket and with
+  each socket found.
+- N14 resolved (:443-450, :487). R3 depends on row 196. The mutants are split between the rows, and the
+  split matches gander-0007 and my row 196 review (duckworth-0006).
+- N15 resolved (DNS row :541, CA row :540).
+
+## Blocker
+
+B8 (one point left). The sign-in provider row's closed form (:538) checks the issuer's admin API and its
+token list, but not the host the issuer runs on. Example: Pocket ID on m-docker0, or on any PVE VM. The
+admin call fails with every token, so the row closes. But root on that host can read the issuer's
+database and signing key, then mint any user's ID token or add a passkey. ops-01's measurements give the
+factory root on every PVE guest today. My r4 fix said "a self-hosted issuer's host passes the same sudo
+and ssh checks as the hub host," and gizmoduck-0016 says the same. The text at 73677b87d doesn't (no
+match for it in the file).
+Fix: add to the closed form that if the issuer isn't on the hub host, its host passes the host-access,
+hypervisor and backups rows as the hub host does. If the issuer is a hosted service, its admin accounts
+pass the same failed-call check. Either case gets one line in the table.
+
+## Notes (do not block)
+
+N16. The dependency note (:544-545) names only TLS. Every closed form whose secret lives on a PVE guest
+is undone while the hypervisor row is open, through memory or disk: the issuer's signing key, the ACME
+account key and, at restore time, the backup key. State it once in general terms: while the hypervisor
+row is accepted, the other rows can only be closed for a hub on hardware outside PVE.
+N17. R4's new test "a grant left at a level other than collaborator counts as a loss" (:488) can't kill
+its mutant in 10-27. R1 refuses any level other than `collaborator` (:484), and a file that fails a rule
+revokes everything (3.5). A viewer grant then ends the run with or without the level filter, so the test
+passes on the mutant too. The test needs the viewer level, which row 193 adds (:555-557). Move the test
+and its mutant to row 193's level change, or have R4 say it waits for that, so the predicate has a real
+test before viewer ships.
+N18. 3.6 still says "The bus checks it with a `verifyUser` that:" (:280-282), right after the new
+sentence saying row 196's `verifyPrincipal` does it. Rename it so R3 doesn't build both.
+N19. Run the TLS row's certificate check through the public route as well as from the LAN. A proxy that
+only the public path goes through won't show in a LAN check.

agents/duckworth/work/federation-r1/REVIEW-r4.10.md

@@ -0,0 +1,47 @@
+# Ack: Gizmoduck federation design r4.10 and r4.11, R8 as a recorded acceptance (duckworth-0034)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-20. Subject: agents/gizmoduck/work/federation/DESIGN.md on
+gizmoduck/federation-design. I read the diff a1daa3c07..3568441ab (r4.10, gizmoduck-0034) and
+3568441ab..b93f098f0 (r4.11, gizmoduck-0036, mos-1063). Each commit touches only DESIGN.md and SESSIONS.md.
+I checked the quotes against DECISIONS.md:1511-1541 in jason-master-restart at 1c378b4, read-only.
+
+## Verdict: ack, both revisions
+
+- R8 is a recorded acceptance, matching mos-1055 and Q183 point 1 ("FED R8 records his acceptance instead
+  of refusing to start"). Every check still runs, its result is recorded with who ran it, and the record
+  keeps measured results and accepted paths apart. That keeps what my earlier rounds asked for: each path is
+  named, and nothing is called closed unless its check passed.
+- The quotes match DECISIONS.md word for word: Q182 at :1517 and :1519, Q183 at :1537, and Q4 at :1541.
+  The hypervisor path is O3, accepted, and the section says plainly that the host form doesn't stop a
+  factory agent using PVE root.
+- The .54 checks now run as localadmin by an agent or Jason, and the record names who ran them. This is
+  sound now that nothing gates on them. #423 step 1 creates localadmin, and that step comes first after my
+  approval (mos-1065).
+- The mos-1042 order is in the R8 "after" column and in its text, and Case 2 go-live doesn't wait on R8.
+- Melanie gets the wording only through Jason (#419), and r4.11 leaves #419 carrying only that.
+
+Your call A: agreed, and Mos ruled the same way (mos-1063). Different client ids, HTTPS reach both ways,
+issuer discovery and clock sync aren't privilege paths. Q182 and Q183 accept access, not a broken setup,
+so those four stay blocking.
+
+Your call B: both corrections are right. With the jason key, a factory agent gets localadmin's NOPASSWD sudo
+on .54 once #423 step 1 runs, and pve root reaches VM 1012's disk and console. So 3.5:304's "the separate
+host keeps other instances' processes from making that write" needs the Q183 exception, as it now has, and
+3.6 can't claim R8 proves no factory login.
+
+r4.11: the stale host lines are gone, and the hub is .54, VM 1012, user `mosaic` (Q181) in 3.8, the R8
+row, section 8 and ruling 3. Using #416 in place of #418 matches the closed issue. Leaving #416 undated is
+right when there's no source.
+
+## Notes (do not block, doc-only)
+
+N1. Section 8 says a path that fails its check "is accepted under Q182 and Q183". Jason's words name
+specific paths: his key stays, agents keep root on pve and PBS and ssh to .53 and .54, and agents run on
+his workstation. A failed check outside those isn't in his words. Examples are a factory host mounting
+hub data, a hub data root on a factory host, another instance or agent on .54, or a provider admin token
+reaching the hub's client. The record should mark such a result "not named in Q182 or Q183". Section 8
+already sends every failed privilege check to Jason through Mos, so this only changes how the record
+labels it.
+N2. The quotes are called verbatim, but two of them are excerpts. Q183's quote leaves out the
+credential-store sentences in the middle of :1537. Q4's leaves out the first two sentences and the last
+three of :1541. Mark each omission with "…".

agents/duckworth/work/federation-r1/REVIEW-r4.4.md

@@ -0,0 +1,58 @@
+# Review: Gizmoduck federation design r4.2 to r4.4 (duckworth-0010)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-20. Static review, no code run.
+Subject: agents/gizmoduck/work/federation/DESIGN.md, diff 73677b87d..b67bc6de9 (d51778391 r4.2, 17d69e660
+r4.3, b67bc6de9 r4.4, gizmoduck-0020). DESIGN.md at b67bc6de9 has sha256 2ca7812d…a713c601, checked. Line
+numbers are at b67bc6de9. Code at origin/refactor 9ae8c73ac. Against duckworth-0007 (REVIEW-r4.1.md,
+b14f11136).
+
+## Verdict: changes, B9 only
+
+B8 is resolved. So are N16 to N19. r4.2's wider "factory" is right, and it makes the gate stricter. B9 is a
+gap I should have caught in r3, when 3.6 item 7 first said a collaborator can't reach the owner's inbox. I
+found it while reviewing row 193 (duckworth-0008, B1).
+
+## r4.1 codes
+
+- B8 resolved (sign-in provider row). An issuer off the hub host must pass the host-access, hypervisor and
+  backups rows against its own host, and a hosted issuer's admin accounts must each pass the failed-call
+  check.
+- N16 resolved (the dependency note under the table). It now covers every secret on a PVE guest.
+- N17 resolved (R4 row). R4 is chained after row 193's viewer level and keeps the downgrade test and its
+  mutant (mos-1019, mos-1020). Row 193 should drop its copy (duckworth-0008 N3).
+- N18 resolved (3.6, the proof paragraph). The section 5 `verifyUser` mention is deliberate, since it says
+  R3 doesn't write one. Accepted.
+- N19 resolved (TLS row).
+
+## r4.2 (mos-1013)
+
+Defining "factory" as every principal outside the hub instance, with checks run on every factory host and
+a path closed only when it passes on all of them, is the right reading. W-jarvis's `jarvis@w-jarvis` key
+having root on `pve` shows why. Keeping the hosts as variables until Mos confirms them is fine for a
+design. R8 can't start with a variable unresolved, because the checks have to run against a named host.
+3.8 now says both cases run as VMs on the PVE node, so for 10-27 the hypervisor row is either O1 or an
+accepted residual. That is already Jason's (#419), and the table says so. Q1 is recorded as Q180.
+
+## Blocker
+
+B9. A user-thread run can still put a decision in the owner's inbox, and 3.6 item 7 says it can't
+(DESIGN.md:344-347). Item 7 copies the tester's `message.send` guard (broker.mjs:1866). It doesn't copy the
+tester's decision guard at :1683, `if (route === 'human' && this.#testerThread(s)) fail('tester-thread-human')`.
+A user-thread run that raises a gated decision with no current spec citation, or any hard wait, gets
+`route === 'human'` (:1677-1679). The decision lands in the owner's `inbox` with the run's free-text
+`question`, `options` and `recommendation`. R3's tests (R3 row) check `to: 'human'` sends only.
+There are two ways to resolve it. One is to refuse it like the tester (`route === 'human' &&
+#userThread(s)` fails `user-thread-human`), so a user thread can't do gated work that needs the owner. The
+other is to allow it on purpose: the run spends the owner's authority, and the owner approving its gated
+actions is governance. Sage has since ruled the second for row 193 (sage-1368, morgana-0008). Row 193 r3
+5.7 makes decisions owner-visible governance and calls the :1683 route intended, leaving any guard to FED.
+Fix: follow that ruling in item 7. Its sentence becomes "can't message the owner", and it says decisions
+do reach the owner's inbox, with the free text they carry, and that a user is told so. Add an R3 test where
+a user-thread gated raise reaches the owner's inbox, and one where a user-thread run's `message.send`
+`to: 'human'` is still refused. If Mos or Jason would rather refuse, the test flips and row 193 changes
+only its inbox row.
+
+## Note (does not block)
+
+N20. The start-order line under the build table (DESIGN.md:510) still says "R4 when R3 and R5 do". R4 now
+also waits for row 193's viewer level.

agents/duckworth/work/federation-r1/REVIEW-r4.5.md

@@ -0,0 +1,27 @@
+# Review: Gizmoduck federation design r4.5 (duckworth-0012)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-20. Static review, no code run.
+Subject: agents/gizmoduck/work/federation/DESIGN.md, diff b67bc6de9..acd5f1f42 (one commit, gizmoduck-0022).
+DESIGN.md at acd5f1f42 has sha256 99f5c4cd…e39cb8ed, checked. The commit also appends one SESSIONS line.
+Against duckworth-0010 (REVIEW-r4.4.md, 4cf3ce232).
+
+## Verdict: approve
+
+B1 to B9 are all resolved. R1, R2 and R5 can go to Sage's queue.
+
+## r4.4 codes
+
+- B9 resolved (3.6 item 7). A user-thread run can't message the owner, and its decisions reach the owner's
+  inbox on purpose (sage-1368, mos-1021, mos-1022). The :1683 guard is deliberately not copied. The R3 row
+  tests both sides: an uncited gated raise reaches the owner's inbox and no other inbox or role, and
+  `message.send` `to: 'human'` is still refused. R6 adds the user notice.
+- N20 resolved (the start-order line under the build table). R4 waits for R3, R5 and row 193's viewer level.
+- R8 now refuses to start while any host variable is unresolved, which answers the r4.4 point on variables.
+
+## Note (does not block)
+
+N21. The R6 notice names decisions only. Row 193 r3 (duckworth-0011, B3) is widening its user sentence to
+"Decisions your thread's agent raises, and records it writes to the project, go to the business owner",
+because a user-thread run with record authority can `record.write` (broker.mjs:1395-1407) and the owner
+reads that with `project.file`. Make the R6 notice match row 193's wording when R6 is built, so the Console
+says one thing.

agents/duckworth/work/federation-r1/REVIEW-r4.6.md

@@ -0,0 +1,14 @@
+# Review: Gizmoduck federation design r4.6 (duckworth-0019)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-20. Static review, no code run.
+Subject: agents/gizmoduck/work/federation/DESIGN.md, diff acd5f1f42..1b32e65e3 (one commit, gizmoduck-0025).
+DESIGN.md at 1b32e65e3 has sha256 ebd7a291…8d678c14, checked. The commit also appends one SESSIONS line.
+
+## Verdict: approve
+
+- N21 resolved. 3.6 item 7 and the R6 row carry row 193 r5's sentence (e2d161e2e, 5.7), word for word. R6
+  tests that the notice equals it exactly.
+- The start-order line now matches the section 7 table. R1 starts now, R5 lands after R1, and R2 and R6
+  wait on Sage's #412 phase 1.
+
+The host variables still wait on Jason's Q2, and R8 refuses to start until they're resolved.

agents/duckworth/work/federation-r1/REVIEW-r4.7.md

@@ -0,0 +1,24 @@
+# Review: Gizmoduck federation design r4.7 (duckworth-0020)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-20. Static review, no code run.
+Subject: agents/gizmoduck/work/federation/DESIGN.md, diff 1b32e65e3..2d3c3cfbd (one commit, gizmoduck-0026).
+DESIGN.md at 2d3c3cfbd has sha256 9f9791c1…80e74647, checked. The commit also appends one SESSIONS line.
+
+## Verdict: approve
+
+The host variables are replaced with Q181's hosts (mos-1030). Case 1 is W-jarvis, 10.1.1.53, VM 1008. The
+hub is W-Melanie-OC, 10.1.1.54, VM 1012. Case 1 and the Hermes agents are now one factory host, as the r4.2
+rule required. R8's ssh check names 10.1.1.54 and the hub user `mosaic`. With no variables left, dropping
+the unresolved-variable clause is correct.
+
+## Note (does not block)
+
+N22. R8 states the `mosaic` user's properties (no sudo, no groups, no keys) as facts. They come from ops-01's
+tightening plan (#421), which hasn't run and needs my review and Jason's yes. Make them R8 checks on
+10.1.1.54, run as root there, each one passing only on the stated value:
+- `sudo -l -U mosaic` grants nothing.
+- `id mosaic` shows only its own group.
+- `~mosaic/.ssh/authorized_keys` is absent or empty.
+- No file under /etc/sudoers.d names it.
+
+Once that plan runs, the gate shows the result instead of restating it.

agents/duckworth/work/federation-r1/REVIEW-r4.8.md

@@ -0,0 +1,11 @@
+# Review: Gizmoduck federation design r4.8 (duckworth-0021)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-20. Static review, no code run.
+Subject: agents/gizmoduck/work/federation/DESIGN.md, diff 2d3c3cfbd..eb651aa68 (one commit, gizmoduck-0027).
+DESIGN.md at eb651aa68 has sha256 dc0b7a82…a9fa2f0c, checked. The commit also appends one SESSIONS line.
+
+## Verdict: approve
+
+N22 is resolved. R8 now checks the `mosaic` user's limits on 10.1.1.54 as root, rather than assuming #421's
+plan already ran. All four checks are in, each must pass, and they match duckworth-0020. Nothing else
+changed.

agents/duckworth/work/federation-r1/REVIEW-r4.md

@@ -0,0 +1,93 @@
+# Review: Gizmoduck federation design r4 (duckworth-0005)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-20. Static review, no code run.
+Subject: agents/gizmoduck/work/federation/DESIGN.md, diff a2840a6be..a659e41f3 (r4). 04a6112be holds only a
+SESSIONS line, as Gizmoduck said in gizmoduck-0013. History isn't rewritten. DESIGN.md line numbers are at
+a659e41f3. Code at origin/refactor 9ae8c73ac. Against duckworth-0003 (REVIEW-r3.md, 45cbe5896) and
+duckworth-0004 (message to Mos, recorded below).
+
+## Verdict: changes, B8 only
+
+B7, N11 and N12 are resolved. The hypervisor path is written as a Jason decision with options, as agreed
+in mos-1003. B8 is new, and I should have raised it in r1. The host form proves the factory can't log in
+to the hub host, but the hub also trusts its identity provider and its TLS front end. Today the factory
+can administer at least the first.
+
+## duckworth-0004, recorded
+
+Mos asked whether the hypervisor path could be a named residual (mos-0997). My answer was no, not on Mos's
+ruling alone: root on a PVE node defeats the host form the same way the sudo path did. I asked that it
+be closed before 10-27, or that Jason decide it. Closing it means hardware outside the cluster, or a
+cluster VM with factory root, token rights, storage reads and PBS reads all removed. LUKS alone doesn't
+close it. Mos agreed and took it to Jason (mos-1003, Vikunja #419). r4 section 8 (DESIGN.md:466-481) says
+exactly that.
+
+## r3 codes
+
+- B7 resolved (R8, DESIGN.md:452). Host form only, per mos-0996. Each check runs as the factory uid under
+  `env -i` and passes only if the call fails. Jason's attestation stays but isn't the gate. "The hub host
+  runs no other instance or agent" is in.
+- The sudo judgment call (gizmoduck-0013) is accepted. `sudo -n` succeeds on dragon-lin and stays (mos-0996
+  point 1), so taken literally the gate could never pass. The answer is to treat the factory as root on its
+  own host, and Gizmoduck's wording does that: ssh as root must fail, and no hub `authorized_keys` key may
+  have its private half on the factory host. See N13 for making that second check runnable.
+- N11 resolved (3.6 item 7, R3 row DESIGN.md:448).
+- N12 resolved (section 9 Q2).
+
+## Blocker
+
+B8. The hub's identity provider and TLS front end are in its trust base, and R8 checks neither.
+- Identity provider. The hub's Console accepts any ID token with a valid signature from its configured
+  issuer (3.3, DESIGN.md:158-161). If the hub uses the factory's Authentik (DESIGN.md:160, :362-363),
+  whoever administers that Authentik decides who signs in to the hub. That includes Melanie's owner session
+  and every `(provider, sub)` grant. They can impersonate a user, reset a password, or repoint the hub
+  application's redirect URI. Factory agents hold an Authentik API token. ops-01 has used the jarvis
+  Authentik token to change providers and apps (jason-master-restart DECISIONS.md:142, :554). Authentik runs
+  on m-docker0 (:591). A factory agent that can read that token, or reach m-docker0, can sign in to the hub
+  as anyone. The sudo, ssh and hypervisor checks don't touch that path.
+- TLS front end. If the hub's public route goes through a proxy, tunnel or Argo overlay that factory agents
+  run, that proxy sees session cookies, authorization codes and every request in clear text (DESIGN.md:114,
+  :452 "hub proxy route").
+
+Fix: add both to R8's gate, with the same failed-call style where a call exists.
+- Issuer. The hub's `console.sso` trusts only an issuer that no factory credential can administer. One way
+  is a separate provider on or for the hub. The design already allows Pocket ID (DESIGN.md:160-161), and
+  Jason can be listed there. If the factory's Authentik is kept, that's a #419-class decision for Jason:
+  either remove the factory's admin tokens for it, or accept it as a stated residual with Melanie told.
+  Check: with each Authentik token the factory uid can read, an admin API call against the hub's issuer
+  fails. A self-hosted issuer's host passes the same sudo and ssh checks as the hub host.
+- Front end. TLS for the hub origin terminates on the hub host, or on a proxy that factory agents can't
+  administer. Check: the hub's certificate key and proxy config aren't on any host or cluster the factory
+  can reach, by the same ssh and hypervisor tests.
+
+## Rulings for Mos (mos-1007)
+
+1. Sudo deviation: yes, it closes the sudo part of B7 for a separate host, once N13 makes the key check a
+   procedure. Passwordless sudo means the factory uid is root on dragon-lin. So the question isn't whether
+   it can become root, it's whether root on dragon-lin reaches the hub. The two checks answer that for
+   ssh. Root on dragon-lin can also read every other credential on that host: Authentik tokens, PVE keys,
+   proxy and DNS credentials. Those paths are B8, #419 and N15, not B7.
+2. Identity-provider path (mos-1006): it isn't in a659e41f3 yet. B8 is the same finding, and I'll check
+   Gizmoduck's wording on the next diff against B8's fix. Mos's two forms are right, with three limits:
+   - A separate brand, tenant or application inside the same Authentik instance doesn't count. Whoever
+     administers the instance administers all of them.
+   - "No such credential on the factory side" has to cover every token the factory uid can read as root,
+     not only the jarvis token, and it needs a failed admin call as the check, not an inventory alone.
+   - B8 also covers the TLS front end. mos-1006 doesn't, and it needs the same treatment.
+
+## Notes (do not block)
+
+N13. "No key whose private half is on the factory host" needs a procedure, or it's an attestation. Run as
+root through `sudo -n` on the factory host: fingerprint every private key under every home and `/root`,
+plus every key loaded in any reachable `SSH_AUTH_SOCK`. Then compare against the `ssh-keygen -lf` output for
+every `authorized_keys` on the hub host, root included. Also run the root ssh check once with each agent
+socket found, not only root's own environment.
+
+N14. Row 196 replaces `verifyUser` (DESIGN.md:407-411), but the R3 row still builds `verifyUser`, and its
+only dependency is R1 (DESIGN.md:448). Make R3 depend on row 196, and change the R3 row to consume
+`verifyPrincipal` for the `user` kind. The walk mutants either stay in R3 as consumer tests or move to row
+196's gate. Say which, so neither row drops them.
+
+N15. If factory agents control DNS for the hub origin's zone, they can point the name elsewhere and get a
+certificate for it. A CAA record and a DNS zone the factory can't edit narrow that. It's less direct than
+B8 because users would have to be sent there, so it's a note for section 8.

agents/duckworth/work/federation-r1/REVIEW.md

@@ -0,0 +1,91 @@
+# Review: Gizmoduck federation design r1 (duckworth-0001)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-20. Static review, no code run.
+Subject: agents/gizmoduck/work/federation/DESIGN.md at 6925f78f0 (blob 0f4570d478f5), branch
+gizmoduck/federation-design. Code at origin/refactor 9ae8c73ac. Sage's Q175 design read at d55d86bb0.
+Binding inputs: CONSTITUTION, SYSTEM, TARGET 2026-10-20 addendum, DECISIONS Q175-Q178, GAP-MAP, PLAN.
+
+## Verdict: changes, B1-B5
+
+The direction is right. The receiving Console verifies the person (Q175), the broker enforces the grant,
+and the access file sits outside the agent-writable business file. Five gaps stop it from meeting criteria
+1, 2 and 5 as written.
+
+## Blockers
+
+B1. The bus takes the user's identity from the caller. `user-cli.mjs` carries `{ business, user }` and is
+"proven the way tester-cli.mjs is" (DESIGN.md:171-172). The tester proof shows only that some process runs
+the tester CLI. It allows agent binaries and agent markers by design (packages/bus/src/tester.mjs:5-9, :57).
+The `user` field is whatever that process says. Any T3 seat or agent shell on the hub's uid can bind as any
+granted user. That is a forwarded identity, which Q175 rules out. Fix: use the human proof's walk, which
+refuses agent binaries (packages/bus/src/human.mjs:83-88). Bind the user CLI to the Console's tree, the
+way #225 binds human-cli. State the residual risk in the design, as Sage's design section 8 does. Add an R3
+mutant where the user CLI is run from an agent-marked parent and accepted.
+
+B2. "No new ownership code" (DESIGN.md:180-181) is false. `#owner` returns `'tester'` or `s.human`
+(packages/bus/src/broker.mjs:364-366), which is undefined for a user. The reply-chain path checks ownership
+for the tester only (`#testerOwns`, broker.mjs:352-355, called from `#threadFor` at :337 and :342), and
+`#threadFor` special-cases `s.human` only (:326). A user principal needs explicit handling in all three.
+Without it, a `message.send` with `in_reply_to` can land in another user's thread. Fix: name the changes
+in 3.6. Add an R3 test and mutant for a reply-chain send into another user's thread, or keep
+`message.send` off every level's list and state that.
+
+B3. The level verb lists are never enumerated, and the Console reads are business-wide. "Read the board"
+for a viewer (DESIGN.md:162) means `usage`, `limits`, `inbox`, `tasks`, `agents`, `trail`, `decisions`,
+`credentials` and `messages` (packages/bus/src/views.mjs:3-13). The broker serves these per business, not
+per project or instance (broker.mjs:2144, :2174, :2195, :2217). A project-scoped grant would therefore show
+Melanie's own messages, decisions, trail and usage to a viewer. Fix: list the exact verbs for each level, and
+for each read verb state the filter: granted projects, granted instances, own threads. Otherwise refuse the
+verb. The R3 gate needs a leak test per allowed read verb, plus a mutant that drops the filter.
+
+B4. Revoking a grant doesn't reliably end runs (criterion 2).
+- (a) No trigger. The broker re-reads access.json only when a request arrives (DESIGN.md:174-176). Runs end
+  only "on a revision where a user loses a grant" (:193-194). A hand edit, which :167 allows, fires nothing
+  until the next request. Expiry (:156) never makes a revision at all, so an expired user's runs never end.
+- (b) Ending a claim stops the run only "at its next bus call" (broker.mjs:2273-2275), so a turn already in
+  flight keeps working.
+- (c) The launcher starts a thread again when it has pending messages and no holder (packages/cli/src/launcher.mjs:533),
+  launched as the business human (:542). Its `startedFor` guard lives in memory and clears on restart. A
+  revoked user's queued message can therefore start a fresh run.
+
+Fix: the launch check refuses a thread whose `user:<id>` owner has no live grant. Define the trigger:
+R5 calls a bus verb, plus a check at each launch and on a timer for expiry and hand edits. Say whether the
+runner gets SIGTERM. The R4 gate should cover a hand edit, an expiry, and a pending message followed by a
+launcher restart, each with a mutant. R4 depends on whatever row provides the trigger, so fix the order.
+
+B5. On one uid, Melanie's hub isn't isolated from Jason's factory (criterion 5). The design says so
+(DESIGN.md:223-227, :274-275), but it leaves the fix as a question (Q3, :284) and R8 doesn't depend on it
+(:264). With one uid, any factory agent can read the hub's data root and write its access.json. It can also
+run the hub's human-cli and act as the hub owner. Sage's design section 8 states the same limit for the bus
+human proof. Grants don't matter while that holds. Fix: make a separate uid per instance (config dir and data
+root 0700) a precondition of R8, with a check. A process on the factory's uid must be refused by the hub's
+proof (`p.uid !== process.getuid()`, human.mjs:67) and must be unable to read the hub data root. If Jason
+accepts running on one uid for 10-27, record that as his decision through Mos, since it changes a security
+boundary.
+
+## Notes (do not block)
+
+N1. The v1 claims hold. The OIDs are at ca.service.ts:22-24, the guard reads the TLS peer cert at
+federation-auth.guard.ts:93-106, and main.ts:50-53 builds the adapter with no TLS. `requestCert` appears
+only in a guard comment (:36). The line count is about 4,470 non-spec lines (9,198 with tests), not
+"about 4,100". The verdict stands: none of the code is reusable.
+N2. The other cited lines match: config.mjs:19, runtime.mjs:140 and :169, requirements.json:61,
+business.mjs:160, broker.mjs:298-306, 356-362, 367-378, 526-538, 596-609, 763-799, webui bus.mjs:1-9 and
+:27-31, mosaic-config.mjs:112-116, organization.mjs:83, bus-service.sh:200. One error: business.mjs:24
+(DESIGN.md:220) is a comment. `configDir` is at :25-28.
+N3. R1 is marked "depends on none", yet it validates against `console.sso` providers and `federation.peers`.
+Pass both in as arguments so R1 stays pure.
+N4. "Human-only" in R5 is cosmetic while one uid holds (B5). A direct file write bypasses both the CLI and
+the receipt. Say so.
+N5. Run the same file checks on access.json that Sage's loader runs on the secret slot: refuse a symlink,
+a non-regular file, another owner, and group or other write.
+N6. A granted instance runs with its full role authority, launched as the business human (launcher.mjs:542).
+`instances` is the real capability limit of a grant, so the grant docs should say that.
+N7. `console.sso` sits in config.json, so removing a provider takes effect only after a Console restart.
+:195-196 implies it takes effect on the next request.
+N8. Scope: the slice amounts to T1.3's multi-user access, plus `home` and peer labels. It meets "shared
+access between disparate instances" in the sense of people signing in to the other instance.
+"Federation is configurable" is met only through grants and labels. Moving agent-to-agent traffic past
+10-27 (Q1) narrows a requirement Jason gave verbatim, so Mos should put it to Jason, not settle it alone.
+N9. Audience binding (3.3) relies on the factory and the hub having distinct client ids at the provider.
+Add a line to R8's checklist that confirms the two client ids differ.

agents/duckworth/work/prd17/REVIEW-r1.md

@@ -0,0 +1,51 @@
+# Review: Honker PRD 1.7 draft, REQ-CRED-3 host access through the credential store (duckworth-0038)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-20. Subject: agents/honker/work/queue-194/PRD-1.7-DRAFT.md at
+0bb1a3bd0 on honker/row194, sha256 0236dee8…40fd (checked), diff +32 -4 over 69544f342, per sage-1428
+item 2. I checked the quotes against DECISIONS.md:1533-1571 in jason-master-restart at 1c368ff (read only),
+and the cited requirements against docs/prd/mosaic-stack.md at 0bb1a3bd0.
+
+## Verdict: changes, B1 and B2
+
+What holds:
+- The Q183 quote (draft :47-53) matches DECISIONS.md:1537 word for word, from "I will still want" to "I am a
+  happy man." It leaves out the first and last sentences, and "in part" says so.
+- The Q184 quote "Q5: by 10.27" matches :1558. The due date 2026-10-27 is Mos's reading at :1568, and the
+  draft uses it only as the #424 due date.
+- "Not every agent gets a grant" and "An agent without a grant for that host is refused" rest on "not all
+  agents will need to have that access" and "The system will enforce access to the credentials".
+- "The agent never sees the key or any other secret value" is already PRD law. REQ-CRED-1 keeps tokens out
+  of an agent's environment and files, and REQ-VAR-2 lets only the broker read a secret's contents. Citing
+  both is right.
+
+## Blockers
+
+B1. REQ-CRED-3 (draft :113-114) says the stack "then does the ssh and the sudo for the agent", and landing
+item 5 (:30) says "the stack's ssh and sudo for a granted agent". Jason didn't say that. He said the
+credential "works as some sort of variable for the agent to call" and that "the system will enforce access
+to the credentials". Running the ssh on the agent's behalf is one design. Lending the agent a signing socket
+that never exposes the key is another, and both meet REQ-CRED-1. Which one it is belongs to the #424 design
+(row 210, Gizmoduck), which I review. Fix: state the outcome and the enforcement only. For example: "The
+agent asks for the host credential by name. The stack checks that a grant exists for that agent and that
+host before the credential is used. The agent never sees the key or any other secret value." Change item 5
+to "adds the host credential grant check and the host access it allows (REQ-CRED-3, Vikunja #424)".
+
+B2. The last sentence of REQ-CRED-3 (:116), "Jason grants one through a reviewed role or config change",
+answers the open point that the note at :151-153 says Q183 leaves open. The note says both "Q183 doesn't
+say who grants" and "The text leaves it as Jason through a reviewed role or config change", so the
+requirement invents the answer the note calls open. Fix: in the requirement, say it is open. For example:
+"Who grants a host credential, and how, is set by the #424 design, which Jason approves." Reword the note to
+match. If Sage wants a floor that already exists in the PRD, "a grant changes only through a reviewed
+commit (REQ-ROLE-1)" is sourced, but "Jason grants" is not.
+
+## Notes (do not block)
+
+N1. Jason's words name "infra agent(s) on my .53 instance". REQ-CRED-3 is general, which is fine because
+the grant gates it. The source bullet carries the scope, so nothing is lost.
+N2. Jason's outcome is NOPASSWD sudo. REQ-CRED-3 says only "with sudo". That's fine if the design keeps
+sudo passwords out of the agent's hands too, which REQ-CRED-1 already requires of any secret. The design
+review checks it.
+N3. "Jason through Mos (mos-1067), DECISIONS Q183" (:47): Jason said it in Mos's thread 38bc4c81, and Mos
+recorded it. "Recorded by Mos" would be more exact than "through Mos". Doc-only.
+
+A round with only B1 and B2 changed gets a diff check, not a full re-read. Sage's cutoff is 23:00Z.

agents/duckworth/work/prd17/REVIEW-r2.md

@@ -0,0 +1,19 @@
+# Review: Honker PRD 1.7 draft r2, REQ-CRED-3, diff check (duckworth-0039)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-20. Subject: agents/honker/work/queue-194/PRD-1.7-DRAFT.md at
+11cb0423b on honker/row194, sha256 e896746d…8647 (checked), per honker-0019. 11cb0423b is a fast-forward
+of 0bb1a3bd0, and the diff touches that one file only, +12 -11. I read the diff only, as REVIEW-r1 said I
+would.
+
+## Verdict: approve
+
+- B1 resolved. REQ-CRED-3 states the check, "before the credential is used", and no longer says how the
+  stack reaches the host. Item 5 reads "the host access it allows". The new note says the #424 design
+  picks the path.
+- B2 resolved. The requirement now says who grants, and how, is set by the #424 design, which Jason
+  approves. The open-point note matches it and no longer names a granter.
+- The build line (row 210, #1707, Gizmoduck, on top of row 199) is Sage's routing (sage-1430). It is a
+  reviewer note, not PRD text.
+- Nothing outside B1, B2 and those notes changed. The quotes I checked in r1 are untouched.
+
+N1 to N3 from r1 stay as notes.

agents/duckworth/work/q180/REVIEW-r2.md

@@ -0,0 +1,107 @@
+# Review: ops-01 Q180 tightening plan r2 (duckworth-0023)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-20. Static review of the document. I ran nothing on pve, PBS, .53 or
+.54. The PVE and PBS permission rules below come from ops-01's reading of the local schemas and source, and
+I didn't re-check them.
+Subject: /mnt/storage/scratch/tmp/mosvk/q180-tightening-plan.md, written 19:31:42Z, sha256 1084aa15…585f
+(checked), Vikunja #421. Mos asked for four checks (mos-1025), and ops-01 asked five questions. Both are
+answered at the end. Cross-checked against FED R8 at eb651aa68.
+
+## Verdict: changes, B1 to B5
+
+The diagnosis in §0 is right and the order is right: §1 first, because one key that both Jason and the
+factory use opens root everywhere. Removing sudo entirely, instead of moving to a sudo password, is right
+for accounts that run agents. Five gaps block it.
+
+## Blockers
+
+B1. Lockout (Mos check 1). The plan relies on "nothing if 1a holds" and an open console session. Neither is
+proven before the step that depends on it.
+- Before 1d, and before each of 2a to 2c, Jason logs in with the new key from a fresh session to each account
+  that step leaves him: root on pve, root on PBS, and localadmin on .53 and .54, plus a `sudo -v` there. The
+  step runs only after he has.
+- Say whether localadmin's sudo takes a password. The `sudo` group asks for one by default, and localadmin
+  has none today. If it's NOPASSWD, say so on purpose.
+- The rollbacks for 2a to 2c say "console in". A cloud-init image usually has root locked. So a console login
+  on .53 and .54 needs a local password that only Jason holds, tested through the pve console before 2c.
+- Jason's pve web login (root@pam or his own user) is the fallback for all of the above. Confirm it works
+  and that no factory-readable file holds it.
+
+B2. Where the new key lives. Two things decide it.
+- FED R8 fingerprints every private key under every home on every factory host, dragon-lin included. The
+  gate fails if any of them matches an `authorized_keys` on the hub host.
+- localadmin on .54 trusts Jason's new key.
+
+So the new key, or a FIDO key handle file, can't sit under any home on dragon-lin, and R8 would fail if it
+did. A FIDO key used from dragon-lin also lets any factory process in Jason's agent socket ask for a touch.
+The plan should say "a key on another machine" and drop the dragon-lin FIDO option. After this, Jason admins
+.54 from a machine that isn't a factory host, or through the pve console.
+
+B3. Group removal doesn't reach processes already running (2a, 2b). Supplementary groups are fixed when a
+process starts. Hermes's 12 user units, openclaw-gateway and the others keep `docker`, `lxd` and `sudo`
+until jarvis's user manager restarts. melanie's two gateways are the same.
+- After the change, restart `user@<uid>.service` for each account, or end every process the account has.
+  Then show that no process of that uid lists the removed gids (`Groups:` in /proc/<pid>/status).
+- List any uid 0 process started from a jarvis or melanie session through sudo (by loginuid), and end it.
+- Losing the `docker` group doesn't close a Docker API on TCP, or a container that mounts docker.sock behind
+  a UI jarvis can reach. Check both on .53, by name only.
+
+B4. Cloud-init order (Mos check 3). Yes, cloud-init can rewrite sudoers. A change to a VM's cloud-init
+settings on pve regenerates its config drive. A new instance id makes per-instance modules run again at the
+next boot, and those write `90-cloud-init-users` and the keys back. 1012 has a boot scheduled at
+2026-10-21T09:00Z (§5). The order has to be:
+1. In the guest: remove `90-cloud-init-users` and create `/etc/cloud/cloud-init.disabled`.
+2. Then on pve: clear `sshkeys`, and on 1012 clear `ciuser` too if it isn't needed.
+
+The plan has these the other way round. Also check after the 09:00 boot that `90-cloud-init-users` is still
+gone.
+
+B5. Paths the plan leaves unaccounted for (Mos check 4). The plan inventories ssh keys only. These other
+paths can reach the hub VM, its backups or its issuer. Each one needs to be either closed here or listed as
+open with an owner, so R8's table can name it.
+- PVE and PBS accounts: `pveum user list`, token and ACL lists, and the same on PBS. Any account or token
+  whose secret is factory-readable (dragon-lin, .53, a Hermes profile) is a path.
+- PBS `root@pam!pve-backup`, which has Admin on `/`. Where is its secret? Remove it unless something needs it.
+- Rollback copies (§4). The 1e rollback restores the pve→PBS password file "from the copy". Copies of
+  secrets and of sshd or sudo files have to stay on the host they came from, root-only (for example
+  `/root/q180-rollback/`). They can't go under `~/.config/mosaic-dev/` on dragon-lin, which the factory can
+  read.
+- Storage backing. Say where 1012's disks and the PBS datastore physically live. If either is on TrueNAS or
+  other network storage, then root or a share on that storage reads the guest disk or the backup chunks,
+  around every PVE and PBS check. The `jwoltje@truenas` key and the "tank" migration point that way.
+- The two step-ca containers on .53, which is a factory host. Say what they sign. If they sign anything the
+  hub or its sign-in provider trusts, they are the R8 "certificate authority" item.
+- The hub's sign-in issuer: which host runs it and who can admin it. The plan doesn't name it.
+
+## Notes (do not block)
+
+N1. OpsAudit (§1.1) has to be two roles. A role brings all its privileges to every path it's granted on.
+One role holding `Sys.Audit` and `VM.Audit` granted on `/vms` would open monitor `info`. Use one role
+(`Sys.Audit`, `Datastore.Audit`, `Pool.Audit`) on `/nodes` and `/storage`, and a second role (`VM.Audit`
+only) on `/vms`. Add three endpoints to the table, with what each one shows for 1012:
+`nodes/{node}/report`, other users' task logs (`tasks/{upid}/log`) and the VM firewall log. Check whether
+1012 sits in a pool with an ACL, since that is a second grant path to the VM.
+N2. Melanie's Hermes on .54 conflicts with FED R8 ("the hub host runs no other instance or agent"). R8
+can't pass until those gateways leave .54. Also, all 11 melanie logins came from dragon-lin with the jason
+key, so after 2b Melanie has no ssh into .54 at all. Say whether that's intended.
+N3. The 1b watch fails every hour until it's switched to the API. Switch it in the same step, or silence the
+row for the change window, so the failure doesn't train people to ignore that row.
+
+## Answers
+
+Mos (mos-1025):
+1. Lockout: possible as written. B1 closes it, and B2 decides where Jason admins from.
+2. PVEAuditor and DatastoreAudit on 1012: the §1.1 and §1.2 tables are consistent with what I know of
+   PVE 9 and PBS 3. Monitor `info` is the one inside-guest leak, and N1's two-role split closes it. Config
+   and listings show metadata only, with cipassword masked.
+3. Cloud-init can rewrite sudoers: yes. B4.
+4. Remaining factory paths: yes, the B5 list. The factory key and jarvis@w-jarvis are closed by §1 and §2.
+   Accounts, tokens, storage, the CA and the issuer aren't covered yet.
+
+ops-01:
+1. §0: agreed, and §1 first.
+2. §1.1: N1. Nothing else from inside a guest that I can name. B5's storage item is the larger leak.
+3. §1.2: agree with deferring encryption, on the three conditions plus B5. That means no factory reach to
+   the datastore's backing storage, and no factory-readable PBS credential, including `pve-backup`.
+4. §2: agree, with B1, B3 and B4.
+5. §6: Jason's call. I agree that Q180 has to override Q172 on these four hosts, or the hub has no boundary.

agents/duckworth/work/q180/REVIEW-r3.md

@@ -0,0 +1,70 @@
+# Review: ops-01 Q180 tightening plan r3 (duckworth-0028)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-20. I reviewed the document only and ran nothing on pve, PBS, .53 or .54.
+Subject: /mnt/storage/scratch/tmp/mosvk/q180-tightening-plan.md, sha256 cd7165bf…0bc3fce (checked), Vikunja
+#421. Checked against duckworth-0023 (REVIEW-r2.md, 523a6bddf) and mos-1041 as ops-01 relays it.
+
+## Verdict: changes, B6
+
+B1 to B5 are resolved, and so are N1 to N3:
+- B1: the Jason checklist does what B1 asked. It adds a fresh login with the new key on every remaining
+  account before 1d, 2a, 2b and 2c. It adds a console password tested through noVNC, and a pve web login
+  from the non-factory machine only. That last one is Mos's N4, and the browser-profile reason is right.
+  localadmin's sudo takes a password.
+- B2: the new key never touches a factory host, and the FIDO-on-dragon-lin option is gone.
+- B3: after the change, each account restarts its user manager and runs terminate-user. A /proc `Groups:`
+  count must then be 0. uid 0 processes are found by loginuid. The Docker TCP and socket-mount checks were
+  read at 19:39Z and get re-read right before 2a.
+- B4: the order is guest first, then pve, and is checked at the next boot. The 09:00Z boot of 1012 gets a
+  meta dump before and after, an instance-id comparison and hashes.
+- B5: §1.4 closes each path or gives it an owner. The hub's sign-in issuer is open, and Sage owns it. The
+  plan says that the row has to be filled before the plan is complete. That meets B5. It also means R8
+  can't pass until the row is filled.
+- N1: two roles, and no pools. Your `nodes/pve/report` finding (Report.pm dumps guest configs raw, so the
+  `cipassword` hash comes through `Sys.Audit`) is a good catch. Step 1a2, done before `OpsAuditHost` is
+  granted, is the right fix.
+- N2 and N3: done.
+
+## Blocker
+
+B6. Root access already granted isn't undone by removing it. This is new in r3, and it is my miss in r2.
+For a long time, factory processes had root on all four hosts:
+- the jason key, which is dragon-lin's key, on pve, PBS and root on .53 and .54
+- jarvis@w-jarvis on pve, 1416 Hermes logins
+- NOPASSWD sudo for jarvis and melanie
+
+The plan removes these paths, but anything a factory process left behind as root survives that. Examples:
+- another file in sudoers.d
+- a key in a different user's `authorized_keys`, or in `/etc/pve/priv/authorized_keys`
+- a uid 0 line in `/etc/passwd`
+- a root cron entry or systemd unit
+- a setuid binary, `ld.so.preload`, or a PAM or sshd drop-in
+The hub (.54) is the host where R8 needs this ruled out. The plan needs one of these, before 2b, with an
+owner:
+- (a) A read-only sweep on pve, PBS, .53 and .54, reported by name, owner, mode and hash only:
+  - every file in `/etc/sudoers.d` and `/etc/sudoers`
+  - every `authorized_keys` file on the host, found with `sshd -T`'s `authorizedkeysfile`, plus any
+    `authorizedkeyscommand`
+  - uid 0 and gid 0 accounts in `/etc/passwd`
+  - root and system crontabs and `/etc/cron.*`
+  - units in `/etc/systemd/system` and `/etc/systemd/user` that no package owns
+  - setuid and setgid files that no package owns, and `dpkg -V` failures for sudo, openssh, pam and
+    systemd
+  - `/etc/ld.so.preload`, and drop-ins under `/etc/pam.d` and `/etc/ssh/sshd_config.d`
+
+  Jason reviews anything unexpected, and the sweep runs again after §2.
+- (b) Rebuild 1012 from a clean image instead of cleaning it in place. That fits N2 too, since Melanie's
+  Hermes has to leave the hub anyway.
+
+## Notes (do not block)
+
+N4. localadmin's password has to exist at 1a. 1a creates localadmin with sudo by password, and the
+checklist runs `sudo -v` there before 2a. But the console-password line says "before 2c". Jason sets the
+password himself with `passwd localadmin` in the pve console when 1a runs. It never goes through a factory
+session or script. The noVNC test can stay before 2c, or move up to 1a.
+N5. Before `OpsAuditHost` is granted, run `pvereport` once as root on pve. Count the matches for password,
+secret, token, key and `BEGIN` lines, and print counts only. That checks your by-filename reading of
+Report.pm against this PVE build.
+N6. On pve, `/root/.ssh/authorized_keys` is a link to `/etc/pve/priv/authorized_keys`, which the cluster
+filesystem holds. Edit that file, copy that file, and say so in 1d. Then check that `pvecm updatecerts` (or
+an upgrade) doesn't add back anything other than root@pve.

agents/duckworth/work/q183/REVIEW-r4.md

@@ -0,0 +1,80 @@
+# Review: ops-01 #423 VM tightening r4, steps 1 to 3 (duckworth-0032)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-20. I reviewed the document only and ran nothing on pve, .53 or .54.
+Subject: /mnt/storage/scratch/tmp/mosvk/q183-vm-tightening-r4.md, sha256 03cd1075…cbc05f (checked), 122
+lines, Vikunja #423. This is ops-01's 20:00:49Z amendment of eadff6b6. I read eadff6b6 in full. In the
+amendment, lines 1-49 (§0 to §3) are the same apart from the §0 step-ca correction at :20, and §8 is new.
+Checked against the mos-1054 remap of my r2 items, my mos-1060 carry item and mos-1062 (step 4 is on hold
+per mos-1061, and step 5 waits for Bean and Chet). Per mos-1065, step 1 runs first after approval.
+
+## Verdict: changes on steps 1 to 3, B1 only
+
+Step 1 and step 3 can run as written once B1 is in the text. If r5 changes only B1 and any notes ops-01
+takes, I will check the diff and approve it without a full re-read.
+
+What holds:
+- mos-1060 carry: met. NOPASSWD comes from its own `50-localadmin` (0440, `visudo -cf` then `visudo -c`),
+  localadmin is made with `useradd`, and neither `90-cloud-init-users` nor a cloud-init `users:` block is
+  involved. The §3 post-boot check covers the `50-localadmin` hash.
+- B1 (r2) as remapped: one lockout check, `ssh localadmin@<vm> sudo -n true`, before any removal and again
+  before each later step (:30).
+- B4 (r2): `cloud-init.disabled` in the guest first, then the field deletes on pve, then a meta dump and an
+  instance-id and hash check at the next planned boot (:44-46). Deleting fields will change the config
+  Proxmox renders, so a new instance-id is expected. With cloud-init already disabled it does nothing,
+  which is why this order is the right one.
+- B5 (r2) as remapped: in-VM paths and the 1008/1012 cloud-init fields only (:5).
+- Rollback copies stay root-only on the host they came from (:8).
+
+## Blocker
+
+B1. Step 2's verify can't tell whether `PermitRootLogin no` took effect (:36-37). sshd keeps the first value
+it reads for a keyword. Ubuntu's and Debian 12's `sshd_config` put `Include /etc/ssh/sshd_config.d/*.conf`
+at the top, and drop-ins load in lexical order. §0 records `PermitRootLogin without-password` but not where
+it is set. If it is in a drop-in that sorts before `60-q183.conf` (`50-cloud-init.conf` is a common one),
+that value wins and `60-q183.conf` does nothing. `sshd -t` only checks syntax. `ssh root@<vm>` is refused
+either way, because the key is gone, so the stated verify passes in both cases.
+Fix, in step 2's verify:
+- `sshd -T -C user=root,host=x,addr=127.0.0.1 | grep -i '^permitrootlogin'` prints `permitrootlogin no`.
+  If it doesn't, find the earlier setting, then rename the drop-in to sort first or edit the setting itself.
+- From the same `sshd -T`, read `authorizedkeysfile`, and confirm that every file it names under `/root`
+  holds no key (`.ssh/authorized_keys2` is in the default list). Report counts only.
+
+## Notes (do not block)
+
+N1. Step 1 `useradd` does not make a home directory without `-m`, and the default shell may be `/bin/sh`.
+Write `useradd -m -s /bin/bash localadmin`. `~/.ssh` should be 0700 and `authorized_keys` 0600, both owned
+by localadmin, or `StrictModes` refuses the key. The lockout check would catch either, but it's cheaper to
+get it right the first time.
+N2. Step 1 copies "the jason key" from root's file (:29). Copy only that key line, matched by fingerprint,
+without any options in front of it. Cloud-init's `disable_root` writes a `command="echo 'Please login as
+…'"` prefix into root's file. If that prefix is copied, every localadmin login runs it. The lockout check
+would fail closed on it.
+N3. Write the sudoers file to a temp path, run `visudo -cf` on it, then `install -m 0440 -o root -g root` it
+into place, then `visudo -c`. A file that fails the check never sits in `/etc/sudoers.d`, where a syntax
+error makes sudo refuse to run.
+N4. Before step 2, check whether anything logs in as root by key on a schedule. Count `Accepted publickey
+for root` lines in the ssh journal for the last 14 days, by source address. Report counts only. A
+scheduled job like that would break at step 2 and nobody would notice until it fails.
+N5. The step 2 rollback names the pve console as a way in (:40). A console login needs an account with a
+password, and none is planned (B1 was remapped to the key check). The real fallback is pve root. Before
+step 2, check `qm agent <vmid> ping` for 1008 and 1012. If the guest agent answers, `qm guest exec` is the
+way in. If not, say the fallback is a rescue boot.
+N6. Add to the §3 post-boot check: `ssh localadmin@<vm> sudo -n true` = 0, and the VM's address is
+unchanged. Disabling cloud-init leaves the rendered netplan in place, but this check proves it.
+N7. Step 3 rollback (:49): `qm set --cipassword` takes plaintext and hashes it, and `--sshkeys` takes a key
+file. Neither can take the values saved in the conf. Restore those lines by writing them back into
+`/etc/pve/qemu-server/<vmid>.conf` from the root-only copy.
+
+## Your questions
+
+(a) Yes, the statement is accurate. One more thing should be stated: pve root reaches every guest's disk
+and `qm guest exec`. So for a process running as jarvis on .53, the jarvis key is root over 1008 and 1012
+too, through pve. What §4 narrows is mistakes made inside .53, not an attacker with the jarvis key. Q183
+point c and R8 record that this is accepted, so this doesn't block.
+(b) Agreed. localadmin holds NOPASSWD sudo with the same key, so taking the jason key out of jarvis's or
+melanie's file narrows nothing.
+(c) On step 4 I'll give my verdict later, per mos-1062. mos-1061 holds it until Case 1 is live on .53 and
+the sudo and docker flows have another path. That covers the step-ca stacks.
+I have not reviewed steps 4 and 5 in this round. §6 is unchanged from r3.
+One count for when step 4 comes back: §8 (:121) says 20 sudo uses, but 9 + 12 = 21, and the per-command
+list adds up to 18. Recount them before step 4's review.

agents/duckworth/work/q183/REVIEW-r5-step4-scripts-r2.md

@@ -0,0 +1,64 @@
+# Review: ops-01 #423 step 4 scripts, revised, C1 to C4 check (duckworth-0048)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-20. I read the scripts and ran nothing on pve or .53. Subject,
+per ops-01's REVIEW-REQUEST, in /mnt/storage/scratch/tmp/mosvk/o423/ (sha256 prefixes checked):
+- step4.sh 5aea3856fdd48d27, 46 lines
+- check4.sh 8f49a40937948be6, 46 lines
+- containers.sh 837bb7a439e58f14 (new), 33 lines
+- postboot.sh 0f2f510bbaba09e0 (unchanged)
+- boot-session.md f0645604f4483cbb
+
+I read all five in full. I had already read postboot.sh in full for duckworth-0046, whose C3 rests on its
+:36-38. This round I read it again.
+
+## Verdict: C1 to C4 met. The optional block may run once C5 is fixed
+
+C1. step4.sh :14 aborts before any change if `/etc/cloud/cloud-init.disabled` is missing. In 0 and 0',
+anything other than a dry-run result of exactly fail=1 is a stop. If step 3.1 hasn't run on 1008, it runs
+first. postboot.sh :41-42 checks the file and `cloud-init status` again after the boot.
+
+C2.
+- After the change, step4.sh :41 matches the refusal line "User jarvis is not allowed to run sudo".
+- After the boot, check4.sh :29 matches the same line again, and :30 requires `/etc/sudoers.d` to be
+  exactly `50-localadmin README`.
+- ops-01 checked the line format against `nobody` on .53.
+- `sudo -n true` refused is kept as an extra line, not the proof.
+
+C3, including Mos's addition.
+- step4.sh :16-20 compares the current hashes and addresses with the step 3 baseline before any change,
+  and aborts with the names that differ. So drift in `50-localadmin` or `01-q183.conf` can't become the new
+  baseline.
+- The new baseline (:44) is written after the change and records `90-cloud-init-users` as absent.
+- postboot.sh :36-38 reports a DIFF if the file reappears.
+
+C4.
+- containers.sh save records names and restart policies before the shutdown, and refuses an empty save.
+- compare reports each saved name that isn't running and requires homeassistant, esphome and
+  mosaic-gw-valkey. check4.sh :45 counts compare's DIFF lines as failures.
+- start uses `ssh -n`, and compare reads its list from a here-string, so neither loop eats its input.
+- The plain 1008 path calls save and compare too (boot-session :23 and :29).
+
+N1, from duckworth-0046: the fallback order in 1' is now `qm guest exec`, then the console, then the offline
+edit. `qm guest exec 1008 -- /bin/true` was tested. The rollback line names `qm guest exec` too.
+
+## Condition
+
+C5. boot-session.md's optional block, line 2, still names the old shas: step4.sh 0ab0f36e…, check4.sh
+408325f5…. Its dry-run line says fail=8. Change the line to the reviewed shas, step4.sh 5aea3856…, check4.sh
+8f49a409… and containers.sh 837bb7a4…, with the fail=10 dry run. Then 0' runs `sha256sum` on the three
+scripts and stops on any mismatch. That way the scripts that run are the ones reviewed here. It's a doc
+line, so it doesn't come back to me. Report the sha check's result with the step's output.
+
+## Notes (do not block)
+
+N1. step4.sh exits 0 even when `groups_left` isn't 0 or `jarvis_not_allowed` isn't 1. It only prints them,
+and 1' relies on the operator reading the Expect line. An `exit 1` on either, after the changes and
+before the baseline is written, would make 1' stop by itself before the shutdown. The rollback is already
+written by then.
+N2. step4.sh creates the rb dir (:8) before its prechecks, so an abort leaves an empty
+`step4-<ts>` dir behind. That's harmless, but use the newest dir with a `rollback.sh` in 3' and in any
+rollback, not just the newest dir.
+N3. The two step-ca containers are in a restart loop. Between attempts, `docker ps` may not list them, so
+compare can report a step-ca DIFF that comes from the loop, not from the boot. If the only DIFF lines are
+step-ca, run compare again after a minute before treating it as a failure. Don't `start` them, because
+they were looping before.

agents/duckworth/work/q183/REVIEW-r5-step4-scripts-r3.md

@@ -0,0 +1,25 @@
+# Check: ops-01 #423 step 4, N1 and N2 diff and C5 (duckworth-0049)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-20. I read the files and ran nothing on pve or .53. Subject, from
+ops-01's FYI after duckworth-0048, in /mnt/storage/scratch/tmp/mosvk/o423/ (sha256 checked):
+- step4.sh cc16d38401e5792e, 47 lines, read in full
+- boot-session.md ed44ec81b74361cf, sha and N3 lines read
+- check4.sh 8f49a409, containers.sh 837bb7a4 and postboot.sh 0f2f510b are unchanged from duckworth-0048
+
+Mos checked the same diff in mos-1095 and cleared the block. This is my own read, so the record shows it.
+
+## Verdict: the diff holds, and so does duckworth-0048
+
+- N2. `install -d -m 0700 "$rb"` is at :20, after the localadmin check (:8), the C1 guard (:13) and the C3
+  comparison (:15-19). An abort at any of them leaves no step4 dir.
+- N1. :47 exits 1 with "do not shut down" unless `groups_left` is 0, the refusal line matched,
+  `90-cloud-init-users` is gone and `/etc/sudoers.d` is exactly `50-localadmin README`. An `A && B || {}`
+  list doesn't trip `set -e`, so the message prints. By then rollback.sh is written (:25-34).
+- C5. boot-session.md :33-34 names all four reviewed shas and the fail=10 dry run. :39 makes 0' a sha256sum
+  gate that stops on any mismatch.
+- N3 is at :29 and :63 for both 1008 paths.
+
+## Note (does not block)
+
+N1. If :47 fails, `baseline.txt` (:44) already holds the failed state. Nothing reads it because the step
+stops before the shutdown, but a rerun after a fix writes a new `step4-<ts>` dir. Use that one for 3'.

agents/duckworth/work/q183/REVIEW-r5-step4-scripts.md

@@ -0,0 +1,59 @@
+# Review: ops-01 #423 step 4 scripts against duckworth-0045 C1 to C4 (duckworth-0046)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-20. I read the scripts and ran nothing on pve or .53. Subject,
+from ops-01's FYI, in /mnt/storage/scratch/tmp/mosvk/o423/ (sha256 checked):
+- step4.sh 0ab0f36e…902a, 36 lines
+- check4.sh 408325f5…ac754, 41 lines
+- postboot.sh 0f2f510b…7de5, 48 lines
+- boot-session.md 048c9bfa…1d21, the OPTIONAL 1008 block at lines 27-48
+
+## Verdict: approve the optional block once C2 and C4 are in the scripts
+
+ops-01's two departures are the ones I approved in duckworth-0045. The full stop and start replaces
+user@1000's restart, and postboot.sh reads a baseline written after the change.
+
+What holds:
+- step4.sh refuses to start without localadmin's NOPASSWD grant (:9). It copies the sudoers file and the
+  group list root-only before changing anything, and writes rollback.sh with the removed groups fixed at
+  write time (:15-24). It removes only the groups jarvis is in (:13), without a `grep -q` under pipefail.
+- 1' checks localadmin over ssh again before the shutdown, and stops there if that fails.
+- check4.sh covers 4.4 (uid-1000 pids holding the four gids, :12-18), 4.5 (uid-0 with loginuid 1000,
+  listed, :19-24), the 14 units, and localadmin sudo, with jarvis's sudo and docker refused.
+
+C1, met by the 0' dry run. postboot.sh :41-42 fails on a missing `cloud-init.disabled` or a status other
+than `disabled`. The 1008 dry run's expected result is fail=1 (sshkeys only), so a missing disable file
+would show as fail=2. ops-01 must treat any dry-run result other than the expected fail=1 as a stop.
+A one-line guard at the top of step4.sh, aborting when `/etc/cloud/cloud-init.disabled` is absent, would
+make that hold even if the dry run is skipped. That's optional.
+
+C3, met. The step 4 baseline records `absent  /etc/sudoers.d/90-cloud-init-users` (:33). If the file came
+back, postboot.sh :36-38 would see a sha line where the baseline has `absent` and report DIFF.
+
+## Still open
+
+C2, partly met. step4.sh :29-30 checks groups and `sudo -l -U jarvis`, but only before the boot.
+check4.sh, after the boot, checks groups, the one sudoers file and `visudo -c`. It doesn't run
+`sudo -l -U jarvis`, and it doesn't list `/etc/sudoers.d`. A new file there under another name wouldn't
+be caught, because the baseline names only two files. Add to check4.sh's root block:
+- `sudo -l -U jarvis` must print "is not allowed to run sudo". Match that line. Don't count
+  "may run the following" lines, because a `sudo -l` that errors (stderr to /dev/null) also counts 0. The
+  same applies to step4.sh :30.
+- `ls -A /etc/sudoers.d` must list exactly README and 50-localadmin.
+
+C4, not met. Neither check4.sh nor the block records the running containers. boot-session.md :48 says
+homeassistant, esphome, valkey and step-ca "keep running", but a reboot restarts dockerd. Only containers
+with a restart policy come back. Add to 0': as localadmin, record the names of the running containers
+(`sudo docker ps --format '{{.Names}}'`, sorted, into the rb dir or on dragon-lin). Add to check4.sh: the
+same list after the boot, compared to the saved one, with names only. A container missing after the boot is
+a DIFF, and localadmin starts it. This applies to the 1008 boot without step 4 too, since that's the same
+reboot.
+
+## Notes (do not block)
+
+N1. The FYI and 1' give the fallback after step4.sh as Jason at the console, then pve root offline. On
+1008 there is a tested step between them: the 1008 guest agent answers, so pve root can run
+`qm guest exec 1008 -- /root/q183-rollback/step4-<ts>/rollback.sh` (my duckworth-0035 N5 and N8). Name it
+second, ahead of the console.
+N2. check4.sh :34 asks `systemctl --user is-active` over a jarvis ssh login. That works with linger (the
+dry run got 14 of 14). It's also the one place in check4.sh that needs jarvis's own login. That's fine
+because jarvis's authorized_keys stays (§4).

agents/duckworth/work/q183/REVIEW-r5-step4.md

@@ -0,0 +1,64 @@
+# Review: ops-01 #423 VM tightening r5, step 4 (.53 jarvis sudo and groups) (duckworth-0045)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-20. I reviewed the document only and ran nothing on pve or .53.
+- Subject: /mnt/storage/scratch/tmp/mosvk/q183-vm-tightening-r5.md, sha256 4cbdc48e…f380 (checked). It's
+  the same file I approved for steps 1 to 3 in duckworth-0035.
+- Scope: §4, the §8 pre-check result, and mos-1092's timing: make the changes, then shut 1008 down and
+  boot it in Jason's boot session, then run the B3 checks, the step 6 verify and postboot.sh.
+- postboot.sh wasn't sent to me, so I haven't read it. C3 covers what it has to expect.
+
+## Verdict: approve step 4 with C1 to C4
+
+The step is sound. §8 shows no Hermes config, unit, cron, hook or script, and no root unit or crontab,
+that relies on jarvis's sudo, docker or lxd. The skill text that mentions them is instructions, not
+callers. 18 sudo uses in 30 days, none tied to a unit, fit an interactive habit, not a dependency. What
+breaks is listed (sudo and docker flows, compose management moving to localadmin). When step 4 is done,
+jarvis has no local path to root, so row 195's P5 can be marked closed. jarvis's `id_ed25519` reach to
+pve stays and is P4, accepted under Q183.
+
+Mos's question: the reboot can stand in for B3's restart, and I don't want the explicit restart as well.
+A shutdown ends every jarvis process, including sessions outside user@1000 and any uid-0 process with
+loginuid 1000, so it covers both `systemctl restart [email protected]` and `loginctl terminate-user`.
+Linger brings user@1000 back at boot with the group list from the new /etc/group. The groups check (4.4)
+and the leftover-root check (4.5) still run after the boot, as mos-1092 says, and they are the proof. The
+reboot isn't. Keep the gap between the group change and the shutdown short, because running jarvis
+processes keep the docker gid until they end.
+
+## Conditions
+
+C1. Step 3's `/etc/cloud/cloud-init.disabled` must be in place on 1008 before this boot. If it isn't,
+and 1008 boots with a new instance-id, cloud-init's users module runs again, writes
+`90-cloud-init-users` back and gives jarvis NOPASSWD sudo again. If step 3 hasn't run on 1008 by then, run
+3.1 first in the same session. It's approved and has no restart of its own.
+
+C2. The verify has to check the stored state, not only a running shell. `sudo -n true` failing as jarvis
+also happens when a grant exists but asks for a password. Add, as localadmin:
+- `sudo -l -U jarvis` reports that jarvis may not run sudo,
+- `id -nG jarvis` lists none of sudo, docker, lxd or adm,
+- `/etc/sudoers.d` holds only README and `50-localadmin`, and `visudo -c` passes.
+Report names and results only.
+
+C3. Since step 4 runs before this boot, the post-boot check for 1008 has to expect
+`90-cloud-init-users` absent and `50-localadmin` and `01-q183.conf` unchanged. Fix that expectation in
+postboot.sh before the boot. If it was written against the pre-step-4 hashes, it reports a false change.
+If it treats "absent" as a pass either way, it would also pass a file that came back. The file has to be
+absent, and its reappearance has to be a failure.
+
+C4. A reboot restarts dockerd, which the user@1000 restart didn't. Before the shutdown, record the names
+of running containers as localadmin (homeassistant, esphome and valkey per §8). After the boot, confirm
+those three are running again, and start any that has no restart policy through localadmin. Add it to the
+step 6 verify, with names and states only. The step-ca loop and the exited stacks stay as they are.
+
+## Notes (do not block)
+
+N1. Rollback under the reboot plan is: restore `90-cloud-init-users` from the root-only copy, run
+`usermod -aG`, then either restart user@1000 or reboot. Once step 4 is done, jarvis's sudo is no longer a
+way back in (my duckworth-0035 N8). The paths are localadmin and then `qm guest exec`, which works because
+the 1008 agent ping is ok. Re-run the §1 lockout check right before the shutdown, as §1 requires.
+N2. The adm group gives jarvis read access to `/var/log` files. 2 of the 18 sudo uses were `journalctl`.
+jarvis keeps its own user journal. A Hermes flow that reads system logs would fail, and §8 shows none.
+N3. Downtime is now the whole boot for the Hermes units and the home automation containers, not only the
+user units. Record the shutdown time and each unit's `ActiveEnterTimestamp` as 4.3 already does.
+N4. This moves step 4 ahead of the Case 1 install, where the row 195 brief had it waiting until Case 1 is
+live. That's Mos's call, and it's the safer order, because `/srv/mosaic` never exists while jarvis can
+read it. Row 195's design should change P5's evidence to "closed at #423 step 4" when this is done.

agents/duckworth/work/q183/REVIEW-r5.md

@@ -0,0 +1,45 @@
+# Review: ops-01 #423 VM tightening r5, steps 1 to 3, diff-only (duckworth-0035)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-20. I reviewed the document only and ran nothing on pve, .53 or .54.
+- Subject: /mnt/storage/scratch/tmp/mosvk/q183-vm-tightening-r5.md, sha256 4cbdc48e…f380 (checked).
+- Base: q183-vm-tightening-r4.final.md, sha256 03cd1075…cbc05f (checked, the version I reviewed in
+  duckworth-0032).
+- Diff: q183-r4-to-r5.diff, sha256 15326e32…4e70 (checked). It is identical to my own `diff -u` of the
+  two files, so nothing outside the diff changed.
+
+## Verdict: approve steps 1 to 3 on 4cbdc48e
+
+- B1 resolved.
+  - The drop-in is `01-q183.conf`, so it sorts ahead of `60-cloudimg-settings.conf` and any cloud-init
+    drop-in.
+  - §0 records the facts the fix depends on: Include is at line 12, `sshd_config` has no
+    `PermitRootLogin` line, and the effective value is `without-password` today.
+  - The verify reads `sshd -T` for `permitrootlogin no`, and gets a key count of 0 for every
+    `authorizedkeysfile` path under /root. `ssh root@` refused is labelled "not proof".
+- N1 to N3 and N6 are taken as written. N2 is better than I asked. The key line comes from jarvis's or
+  melanie's file, matched by fingerprint against dragon-lin's public key, with no options. Root's file is
+  never used, because it carries the `command=` prefix.
+- N4: 0 root key logins in 14 days on both VMs, counted again right before step 2.
+- N5: 1008 falls back to `qm guest exec`. 1012's fallback is named and untested. See N8.
+- N7: the conf lines are restored from the root-only copy, without `qm set`.
+- Answer (a) is in §0.
+- Recount: 2 + 7 + 9 = 18, and the per-command list also sums to 18, over a fixed UTC window. The cause
+  of the earlier numbers is stated.
+
+Condition: this approval covers step 1 as written in r5. The gate line says step 1 "follows" the #424
+credential-store design if that design arrives first. If #424 changes how localadmin's key or sudo is
+held, the changed step 1 comes back to me as a diff before it runs.
+
+## Notes (do not block)
+
+N8. Step 2 doesn't touch jarvis's or melanie's sudo. Until §4 and §5 run, `ssh [email protected] sudo` and
+`ssh [email protected] sudo` are still a tested way back in. That makes them the first fallback on both VMs,
+ahead of the guest agent and the rescue boot. Name them in step 2's rollback. If 1012 ever needs more, a
+better fallback than `init=/bin/bash` is pve root editing the stopped VM's disk offline. That doesn't
+depend on catching a GRUB menu that cloud images usually hide.
+N9. Root's key already carries a forced `command=`, so root key login only prints a message today.
+Step 2 is still right: it removes the key and sets the policy, so a later edit of root's file can't
+reopen root login.
+N10. The §6 unit-file rule (webby-0025) is sound. Root renders or copies the unit in, root-owned, with
+fixed-value checks, and no unit source sits under /srv/mosaic. I'll review it with Gosalyn's design and
+the Case 2 step that runs it.

agents/duckworth/work/row193/REVIEW-r3.md

@@ -0,0 +1,45 @@
+# Review: Morgana row 193 design r3 (duckworth-0011)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-20. Static review, no code run.
+Subject: agents/morgana/work/queue-193/DESIGN.md, diff 19c015741..76f4605e1 (one commit, morgana-0008).
+DESIGN.md at 76f4605e1 has sha256 e61500d9…8859, checked. Line numbers are at 76f4605e1. Code read at
+53bb59462. Against duckworth-0008 (REVIEW.md, aa7f082bf).
+
+## Verdict: changes, B3 only
+
+B1 and B2 are resolved and N1 to N4 are done. B3 is a small gap in the new 5.7 table, which B1 asked to
+list every read: the project file reads are missing, and they carry a user-thread run's output to the owner.
+
+## r2 codes
+
+- B1 resolved (5.7, :279-327). Option (a) is taken and stated plainly: messages are private, governance is
+  not. The table covers the reader list at broker.mjs:1303 and the owner's board reads. The governance pin
+  test (:405-407) shows a user-thread decision in the owner's `decisions recent` and `inbox`, with message
+  bodies still hidden. The :1683 route is named as intended. Gizmoduck's FED r4.5 (acd5f1f42, gizmoduck-0022)
+  now keeps it, with an R3 test and an R6 notice, so the two designs agree.
+- B2 resolved (5.7 :322-324, section 9 :440-451). The message filter is in 193b1 with `#readable`
+  owner-only, and 193b2 adds only the share exception. No order of FED R8 and 193b2 can put a user thread
+  live unfiltered. Mutants 11 and 12 are tested under 193b1 (:408-413).
+- N1 done (:383-384). N2 done (:6-7). N3 done (5.6 :277, section 8 :393, mutant 5 :429): R4 owns the
+  level-loss test and mutant. N4 done (5.2, :205-207).
+
+## Blocker
+
+B3. The table at :289-302 says it lists every read an owner or reader session has, but it leaves out
+`project.files` and `project.file` (broker.mjs:1441-1450, human and tester). A user-thread run acts with
+the owner's role authority, so where that role holds record authority it can `record.write` into the
+project repository (broker.mjs:1395-1407). The owner then reads that record with `project.file`. Under
+option (a) this is governance and visible, which is fine. But the table omits it, and the user-facing
+sentence at :306 names only decisions. A user who reads "Decisions your thread's agent raises go to the
+business owner" would assume records the agent writes stay private.
+Fix: add a `project.files`, `project.file` row (records a run writes, governance, visible) and widen the
+sentence to "Decisions your thread's agent raises, and records it writes to the project, go to the business
+owner." Also list `message.receive` and `message.read` on the `messages` row (:296). They filter on
+`to_role='human'` too (broker.mjs:1931-1936, :1953), so they're private for the same reason. Gizmoduck's R6
+notice should match the widened sentence (I'm telling Gizmoduck in duckworth-0012).
+
+## Note (does not block)
+
+N5. The paragraph at :308-311 still says FED may add a guard at :1683 and that the `inbox` row would then
+change. FED r4.5 has settled this: no guard, as Mos ruled (mos-1021, mos-1022). Cite r4.5 and drop the
+conditional.

agents/duckworth/work/row193/REVIEW-r4.md

@@ -0,0 +1,18 @@
+# Review: Morgana row 193 design r4 (duckworth-0014)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-20. Static review, no code run.
+Subject: agents/morgana/work/queue-193/DESIGN.md, diff 76f4605e1..edc794933 (one commit, morgana-0009).
+DESIGN.md at edc794933 has sha256 c18d27b0…b613a, checked. Against duckworth-0011 (REVIEW-r3.md, 912b1d325).
+
+## Verdict: approve
+
+## r3 codes
+
+- B3 resolved (5.7 table and sentence). The `project.files` and `project.file` row is in, marked
+  governance, visible. `message.receive` and `message.read` are on the `messages` row. The user sentence
+  names records, and the governance pin test checks that a run's `record.write` shows in the owner's
+  `project.file`.
+- N5 done. The gated-raise paragraph cites FED r4.5 (acd5f1f42) and drops the conditional. It matches what
+  I approved in duckworth-0012.
+
+FED R6's notice should use this sentence (duckworth-0012 N21).

agents/duckworth/work/row193/REVIEW-r5.md

@@ -0,0 +1,11 @@
+# Review: Morgana row 193 design r5 (duckworth-0018)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-20. Static review, no code run.
+Subject: agents/morgana/work/queue-193/DESIGN.md, diff edc794933..e2d161e2e (one commit, morgana-0011).
+DESIGN.md at e2d161e2e has sha256 dd7fcb41…b523, checked. Doc-only.
+
+## Verdict: approve
+
+The 5.7 sentence now names every governance read the table marks visible: decisions, inbox, `agents`
+(claims), `tasks` and `project.file`. The governance pin checks each one, so the sentence and the test
+can't drift apart. FED r4.6 uses the same sentence word for word (duckworth-0019).

agents/duckworth/work/row193/REVIEW.md

@@ -0,0 +1,72 @@
+# Review: Morgana row 193 design r2, many humans per business (duckworth-0008)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-20. Static review, no code run.
+Subject: agents/morgana/work/queue-193/DESIGN.md at 19c015741 on morgana/row193 (sha256 f1283e310d65…5d10,
+checked), base 53bb59462, Gitea #1691. r2 supersedes 5d15979e0 (morgana-0006), and I reviewed r2 whole.
+Code read at 53bb59462. Federation design read at 73677b87d (r4.1). gizmoduck-0020 says `covers` is unchanged
+through r4.4.
+
+## Verdict: changes, B1 and B2
+
+The model is sound. There's one store for users and grants, the role is the grant's level, and one
+verifier (row 196) mints every principal. Shares never widen a grant, and the latest row per
+`(thread, target)` decides. Two things block. 5.7 promises more privacy from the owner than the bus gives.
+And the build order can put user threads live before the filters that keep them private.
+
+## Rulings asked in morgana-0004
+
+1. `thread_shares` deviation (5.1): approved. F1 to F3 hold. A share is a runtime act by a non-owner
+   principal, and access.json is owner-written config whose loader revokes everything on any error. An
+   append-only bus table gated by `covers` is the right home. N12 is met (5.2, :207-208).
+2. Roles owner, collaborator, viewer (4.1-4.3): approved. Viewer creates, opens and sends nothing, so it
+   never drives an instance. The per-role verb table refuses everything not listed.
+3. The R4 predicate: settled in FED. `covers` with `level: 'collaborator'` is FED R4's. See N3 for who owns
+   the downgrade test.
+4. "Private" stated plainly (5.7): not yet, see B1.
+5. H1-H5 (section 6): consistent with row 196 as I reviewed it (duckworth-0006). Users have no CLI path,
+   and the verifier returns no role.
+6. Schema 3j, the `--migrate` window and the split (7, 9): approved, subject to B2.
+
+## Blockers
+
+B1. 5.7 says a user's thread is private from the owner at the bus boundary (:284-286), and it filters
+only `trail` and `replies`. A run in a user's thread acts with the owner's role authority (F10), and
+several owner and reader reads show what it does:
+- `decisions {list: 'roles' | 'recent'}` (broker.mjs:2174-2192) and `inbox` (:2150-2157) return whole
+  decision rows: `question`, `options` and `recommendation` are free text the run writes (schema.sql:46-61).
+  The `decisions` table has no thread column, so no filter can catch these by `message_threads`.
+- FED 3.6 item 7 stops a user-thread run from messaging `to: 'human'`, but doesn't name the decision route
+  at :1683. That is the tester's guard for a decision routed to the human (`tester-thread-human`). Without
+  it, a user-thread run's gated raise lands in the owner's inbox. I'm raising this with Gizmoduck as well.
+- `agents` and `tasks` show the run's claims and the Vikunja work it touches.
+Fix: pick one, and say it in 5.7.
+- (a) Keep these owner-visible on purpose. The run spends the owner's authority, so its decisions and task
+  writes are the owner's governance. Then 5.7 says plainly that the user's messages are private, and the
+  run's decisions, tasks and claims are not. Add a test that pins it: a user-thread run's decision shows
+  in the owner's `decisions recent`.
+- (b) Filter them too. That needs a thread link on decisions, which is more schema, and it hides
+  governance from the owner.
+I recommend (a). Either way, 5.7 has to list every owner and reader read and say which side of the line
+it's on.
+
+B2. The 5.7 filters land in 193b2 with schema 3j (:414). 9 says nothing is exposed before that, because
+"FED R8 is later" (:420-421). Nothing enforces that order. FED R8 is the 10-27 live window, and 193b2
+waits for a `--migrate` window Sage hasn't scheduled. If R8 goes first, the owner can read every user
+message through `trail` and `replies`.
+Fix: move the hiding filter to 193b1. Without shares, `#readable` is false for anyone but the thread's
+owner, so b1 hides every message in another user's thread, and needs no schema. 193b2 then only adds the
+share exception. Mutants 11 and 12 move with it. The alternative is an R8 entry-gate line saying R8 waits
+for 193b2, and Gizmoduck would have to carry that.
+
+## Notes (do not block)
+
+N1. Section 7 still says "193a and 193c have no schema change ... 193b carries 3j" (:355-356). After the
+split, 193b1 has no schema change either, and 193b2 carries 3j.
+N2. The header lists FED r3.1 (a2840a6be) as read (:6-7), but coverage now comes from r4.1 and later.
+Update the citation so the build seat reads the right FED.
+N3. The downgrade test and mutant 5 are claimed by both rows. 5.6 and section 8 put them in 193b1
+(:274-275, :365-366, :399), and FED r4.4 keeps them in R4, which depends on row 193's viewer level (mos-1020,
+gizmoduck-0020). Name one owner, so the mutant isn't run twice or dropped by both.
+N4. `thread.share` with `to` set to the business human's name: if the business file's `human` is later
+renamed, old share rows name a stale target. Nothing renames the human today. One line in 5.2 saying a
+share to a name that is no longer the human is void would close it.

agents/duckworth/work/row195/REVIEW-r1.md

@@ -0,0 +1,96 @@
+# Review: Darkwing row 195 DESIGN r2, the Case 1 install on 10.1.1.53 (duckworth-0047)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-20. My first review of this design. Darkwing asked for r2 in place
+of r1.
+- Subject: darkwing/row195 at 818b79696, `agents/darkwing/work/queue-195/DESIGN.md`, blob fcbb4aa9b5,
+  sha256 329a5458…a28ea (checked), 196 lines. Its parent is on origin/refactor.
+- Brief: `docs/plans/2026-10-20_hub-own-uid.md` at f24f2cd40, blob 45be7f09afc1. Rulings sage-1451.
+- I read the whole design and the brief. I checked these citations at 818b79696:
+  - `launcher.mjs:310`, `sandboxProblem({ bwrap })` before every role launch
+  - `broker.mjs:245`, a human named `tester` refuses
+  - `webui/src/serve.mjs:466-470`, the default host is 127.0.0.1, non-loopback refuses, and the tester
+    listener is 127.0.0.1 only
+  - `serve.mjs:611`, `/healthz`
+  - the control board's default `127.0.0.1:7331`
+  - `stack-release.sh`, the systemctl, backup and gate lines cited in B1
+- I ran nothing on .53 and nothing on dragon-lin's live state.
+
+## Verdict: changes, B1 only
+
+What holds:
+- §0's host facts are what the rest of the design needs, and they were read only, as the brief allows.
+- §1 gives a reason for every input: `dev` and its paths, a per-user node so Hermes's node is left alone,
+  claude pinned through `MOSAIC_CLAUDE_BIN`, and the tester ports. The step table names a runner and a path
+  for each step. The root steps go through ops-01. The `mosaic` steps use `sudo -u mosaic -H`, with no key
+  and no login shell for `mosaic`. The root-owned checkout outside `/srv/mosaic` for `case2-unit.sh`
+  matches the §6 unit-file rule (webby-0025, my duckworth-0035 N10).
+- §2 gives every difference from Case 2 a reason. Keeping the Discord check is right, because one bot token
+  shouldn't feed two connectors. Asking for `--profile` over a copied script follows the brief.
+- §3 follows Q185 and the Q173 secrets rule. The credential is made in the window, never copied from
+  dragon-lin, never printed, and only its name is counted. pi stays off until #383.
+- §5 implements the brief's acceptance contract: one line per path with a mark, `unnamed` for "not named
+  in Q182 or Q183", and a non-zero exit only on an F check. Each of F1 to F4 has a check you can run. F2
+  follows sage-1451 Q3. The test plan uses a fake root and fake tools, so nothing reaches .53.
+- §6 states the rulings as Sage gave them.
+
+## Blocker
+
+B1. §4 doesn't yet say how a re-pin, a rollback or a backup runs on .53. It names the problem (:108-111)
+and leaves the fix to the build (:113-115, "I'll size that in the build and name it in the manifest"),
+but §7 doesn't name it. The brief makes re-pin, rollback and backup, and who runs each, part of the
+design. Three concrete gaps:
+
+1. The health gate and the in-run rollback have no owner. `stack-release.sh` activate is health-gated, and
+   it puts the old stack back in the same run when the gate fails (:2-4, `rollback_in_run` :561-583). That
+   all goes through `systemctl --user` (:178, :436-453, :474, :554). §4 splits the activate into a `mosaic`
+   half (copy, pointer, backup) and a root half (`case2-unit.sh`, restart). Nothing then says who runs the
+   `/healthz` gate after root's restart, or who puts the old copy back if the gate fails. It doesn't say
+   whether the activation log gets an `ok` or `gate-failed` line either. That log is what the §4 rollback
+   reads ("the previous distinct copy, from the activation log").
+2. The backup is of a running store. In §4's order, `mosaic` takes the tar (:122-124) while the unit is
+   still up, because only root can stop it. `backup_store` (:369-392) copies `bus.sqlite` only after the
+   bus has stopped, with no -wal or -shm, and checks `stopped` again afterwards (row 185). A tar of a live
+   SQLite store isn't a consistent backup. The tar also lands in `/srv/mosaic/backups/` rather than
+   `$DATA/backups/stack/<activation>`, so `rollback --restore ACTIVATION` and row 181's restore guard can't
+   find it.
+3. There's no file for the change. Whatever does the `mosaic` half is either a new `stack-release.sh` mode
+   or a Case 1 script, and either way the manifest has to list it with tests. A `stack-release.sh` change
+   touches the re-pin tool dragon-lin uses, so its tests must also show dragon-lin's path is unchanged.
+
+Fix: write the .53 activate as one ordered list, with a runner for each step:
+- root stops the unit
+- `mosaic` takes `backup_store`'s stopped-store backup under `$DATA/backups/stack/`, writes the copy and
+  the pointer, and logs the attempt
+- root renders the unit and starts it
+- the gate runs on `/healthz`, with its runner named
+- on a gate failure, the same window runs the same steps with the previous copy, and logs `gate-failed`
+  then the rollback result
+Name the script and the mode in §7, with their tests. Say whether it's a `stack-release.sh` mode (for
+example a `--units external` flag that skips every `systemctl --user` call and leaves the stop and start to
+the caller) or a new script. Rollback is the same list aimed at the previous distinct copy. If the order
+needs a C2-13 change as well, add it to the copy-id request to Gosalyn, so Case 2 gets the same answer.
+
+## Notes (do not block)
+
+N1. P5 will be closed sooner than §5 expects. Mos has moved #423 step 4 ahead of the Case 1 install
+(mos-1092, my duckworth-0045 and duckworth-0046), so `/srv/mosaic` won't exist while jarvis can still
+sudo. After step 4, P5's evidence is "closed at #423 step 4". Then tighten P6 (:159): `sudo` with
+`localadmin` alone, and no members of `docker` or `lxd`, is `closed`. Any other member, jarvis included,
+is `unnamed`. As written, jarvis in `docker` passes P6 as `closed`.
+N2. P1 (:154) and any `sudo -l -U` check should match the "is not allowed to run sudo" line. Counting grant
+lines reads a failed `sudo -l` as "grants nothing" (the same finding as duckworth-0046 C2).
+N3. F3 (:147) should name the commands, since the tester listener on 7333 is the web listener and the CLI
+reaches the bus another way. I read it as, run as `mosaic` through `sudo -u mosaic -H`:
+`mosaic talk chief "<marker>" --tester`, then `mosaic follow --tester` until a reply arrives, with a
+300 s limit (cli.mjs:52-53). If the check goes through 7333 instead, name the header or proof it uses.
+N4. The node download (:57) is checked against `SHASUMS256.txt` from the same server. Check the release's
+signed `SHASUMS256.txt.asc` against the node release keys, or pin the tarball's sha256 in the run sheet.
+Otherwise the check only catches a corrupt download.
+N5. claude under `~/.local/bin` updates itself unless `DISABLE_AUTOUPDATER=1` is set. The harness sets it
+for its own sessions (`harness/tests/claude-session.test.mjs:56`). Say which version is pinned, and say
+that no other process on .53 running as `mosaic` starts claude without that variable, so the path
+`MOSAIC_CLAUDE_BIN` names stays at the reviewed version.
+N6. The §4 tar excludes `secrets/`, which is right. Say in the run sheet that a restore leaves
+`claude-session.env` in place and doesn't need a new credential.
+
+A round that changes only §4, §7 and any notes taken gets a diff check, not a full re-read.

agents/duckworth/work/row195/REVIEW-r2.md

@@ -0,0 +1,99 @@
+# Review: Darkwing row 195 DESIGN r3, the Case 1 install on 10.1.1.53 (duckworth-0050)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-20. Subject, per Darkwing's request:
+- darkwing/row195 at 9a16d7795, a fast-forward of r2 818b79696. The diff touches DESIGN.md only (+238 -76).
+- `agents/darkwing/work/queue-195/DESIGN.md`, blob 0fea86616b36, sha256 376662a5…e9ee (checked), 196 lines.
+- Sections 1, 4, 5 and 7 changed, so I read the whole file, not only the diff.
+- I checked the `stack-release.sh` lines it cites at 9a16d7795: `interrupted` :146, `from_log` :162,
+  `stopped` :359, `backup_store` :372, `restore_store` :396, `gate_once` :471, `gate` :522,
+  `rollback_in_run` :561, `rollback_failed` :587, `next_activation` :837, `do_adopt` :856, `run_steps`
+  :985, `heldcount` :1074. I also checked `stack-copy.sh:23-30` (`COPY_PATHS` has no `stack-release.sh`).
+- I ran nothing on .53 and nothing on dragon-lin's live state.
+
+## Verdict: changes, B1 and B2
+
+r2's B1 is answered in shape:
+- Section 4 is one ordered list, and each step names its runner.
+- The backup is today's `backup_store` of the stopped store, under `$DATA/backups/stack/<ACT>`.
+- The in-run rollback has one owner, the root command.
+- `--units external` leaves the default path alone, and section 7 tests that with recorded argv and a
+  byte-identical `--plan` fixture.
+- Root never runs code `mosaic` can write except as `mosaic`, and the unit form stays the ruled system unit.
+
+What's left is two hand-offs that the list doesn't close yet.
+
+## Blockers
+
+B1. Root needs two values that only `mosaic`'s data holds, and section 4 says root reads exit codes only
+(:176-177).
+1. The activation id. `next_activation` (:837) makes ACT inside the `mosaic` run at A3. A5, R2 and R4 take
+   `<ACT>` as an argument, and root has no way to get it. A2's failure path runs R4, and at that point no
+   ACT exists yet.
+2. The rollback target. `case1-repin.sh rollback` renders TO in A4, and TO is `from_log previous` (:162).
+   That reads `mosaic`'s log, which root doesn't parse.
+
+Fix, one of:
+- `confirm` and `revert` take no ACT. Each finds the one open activation itself, from `PENDING` or from
+  `interrupted` (:146), and refuses with exit 3 unless there is exactly one.
+- Or root makes ACT and passes it to A3.
+
+For the rollback, the go names TO. Root passes TO to every step. `mosaic`'s A1 plan exits 3 unless TO
+equals `from_log previous`. For A2's failure, say what happens: root starts UNITS again and exits 1,
+with no log line, or with a line A1's plan wrote. Add these to the `case1-repin.test.mjs` cases.
+
+B2. A5's gate isn't the gate dragon-lin runs.
+1. It's one pass. A5 names `gate_once` (:471), but today's gate polls it once a second until `--timeout`
+   runs out (`gate`, :522). A single pass right after `systemctl start` usually fails on `units-inactive`
+   or a `boot status` from before the start, so a healthy activate would roll back. `confirm` has to run
+   `gate` with `--timeout`. `case1-repin.sh` passes the timeout through.
+2. The PM check reads the unit's journal. When the pointer has `pm` set, `gate_once` runs `pm_launched`,
+   which reads `journalctl --user -u "$BUS_UNIT"` (:507). Under a system unit, `mosaic` would read the
+   system journal for `mosaic-stack.service`. 2a makes `mosaic` with `useradd --system`, so its uid is in
+   the system range. journald's default `SplitMode=uid` writes a system user's lines to the system journal,
+   which only root and the `adm`, `systemd-journal` and `wheel` groups can read. P2 rules out any group.
+   So I expect the read to return nothing, and every PM activate to fail with "no launched line since the
+   start". I read this from journald's documented behavior and haven't tested it on .53.
+
+Fix: say whether .53's pointer runs the PM. If it does, name how `confirm` reads the launched line, and
+test it. Options:
+- a regular uid for `mosaic` (no `--system`), so journald gives it its own journal file
+- `launches list` alone in external mode
+- some other read that keeps P2
+
+If it doesn't, say that `confirm` refuses a pointer with `pm` set until this is designed. Either way,
+add a case to `stack-release-external.test.mjs`.
+
+## Notes (do not block)
+
+N1. The AppArmor profile is the form Ubuntu 24.04 uses for chrome and the other browsers it lets create user
+namespaces. `abi <abi/4.0>`, `flags=(unconfined)`, `userns` and the `local/` include are right. Load,
+test and rollback are in order. Its residual is as P9 states. Any local user, jarvis and Hermes included,
+can open a user namespace through `/usr/bin/bwrap`. That user then reaches the kernel surface that the
+sysctl closes for everything else. That's the bypass class Qualys reported for profiles like this
+(2025-03). Marking P9 `unnamed` and sending it to Mos is right.
+
+Before the window, check read-only whether 24.04's apparmor ships `bwrap-userns-restrict` (for example in
+`/usr/share/apparmor/extra-profiles/`). It confines bwrap's children to a profile with no capabilities,
+which narrows P9 to bwrap's own setup. I don't know whether the 4.0.1 package on .53 has it. If it does,
+use it or its pattern, and F5 shows a role session still runs under it.
+
+N2. P5 (:279) can now say what #423 step 4 removes. `step4.sh` takes jarvis out of sudo, docker, lxd and adm
+(my duckworth-0045 and duckworth-0048, ops-01's o423 scripts). After that step, P5 should read `closed`,
+and the check still reports what it finds.
+
+N3. `$RS/PENDING` sits next to the pointer's `pending` field (`P_PENDING`, :128), which means the PM wait
+after `--pm-after-harness`. Use a different name, for example `$RS/AWAITING-CONFIRM`, so the build and
+the log don't mix the two.
+
+N4. A3's "TAKEN restore on failure" and R2's restore use the stopped store. Say in A3 that a `--migrate`
+under `--units external` runs only with UNITS stopped, which A3's `units-running` refusal already
+enforces. The test for that refusal should include the migrate case.
+
+N5. The open UNITS question with Gosalyn decides how many units A2, A4, R1 and R3 handle. The gate needs
+both the bus and the Console. If C2-13 gives one unit that runs only the bus, Case 1 needs a second unit
+from C2-13, not one written here.
+
+Earlier N1-N6 are taken as asked. N5's variable placement waits on the allowlist check, and the manifest
+says which.
+
+A round that changes only section 4, the section 7 cases and these notes gets a diff check.

agents/duckworth/work/row195/REVIEW-r3.md

@@ -0,0 +1,127 @@
+# Review: Darkwing row 195 DESIGN r4, the Case 1 install on 10.1.1.53 (duckworth-0051)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-20. Subject, per Darkwing's request and mos-1098:
+- darkwing/row195 at 0075be358, a fast-forward of r3 9a16d7795. The diff touches DESIGN.md only
+  (+299 -138).
+- `agents/darkwing/work/queue-195/DESIGN.md`, blob 3f8590016b40, sha256 66c64625…e57b (checked), 519 lines.
+- Sections 0, 1, 4, 5, 6 and 7 changed, so I read the whole file.
+
+Cited code I checked at 0075be358:
+- `scripts/stack-release.sh`:
+  - `cd "$(dirname "$0")/.."` at :24, so a `sudo -u mosaic -H` call from `/root` still runs from
+    `mosaic`'s checkout
+  - `refuse` :62-66, `interrupted` :146-157, `from_log` :162, the `--pm` parse :195, `start_both` :451,
+    `gate_once` :471, `pm_launched` :505, `gate` :522, `rollback_in_run`'s log line :572
+  - `rollback_failed` :586-592, `do_pm_on` :1137
+- `packages/seat/src/session.mjs:83-93`: `ENV_ALLOW` has no `DISABLE_AUTOUPDATER`, and nothing comes from
+  `~/.claude`
+- `packages/seat/src/sandbox.mjs`: :1-20, `BWRAP` at :43, the read-only `/etc` at :85
+- `packages/cli/src/launcher.mjs:675`: `launchPm` starts `b.launch.by`
+
+Profile check: I fetched `profiles/apparmor/profiles/extras/bwrap-userns-restrict` at upstream tag v4.0.1
+from gitlab.com/apparmor/apparmor. Its sha256 is `11d39094…64f9`, the hash §0 and §1 pin. I read all of
+it. I ran nothing on .53 and nothing on dragon-lin's live state.
+
+## Verdict: changes, B1 and B2
+
+r3's B1 and B2 are answered as asked:
+- Root's values all come from the go, its own unit files or its own args file. No argv carries an
+  activation id. `--to` is checked against `from_log previous` in A1's plan. A2f has its own row, and
+  root has its own step log.
+- `confirm` runs `gate`, which polls until the timeout. The external PM check reads `launches list`
+  only. It is bound to `launch.by` and to the bus unit's `ActiveEnterTimestamp`, with `stale-start` on
+  top. `pm-on` and `--pm-after-harness` refuse `external-pm`.
+- The managed settings route for `DISABLE_AUTOUPDATER` follows from `ENV_ALLOW` and the sandbox
+  mounts, and F6 backs it.
+- The statoverride, the six-item P9 gate and Mos's reason are as mos-1096 ruled.
+
+## Blockers
+
+B1. The rollback can't find the activation that the failure just logged.
+- `interrupted` (:154) keeps an activation open only while its last line is `started`. Any later line
+  closes it (`else open.delete`).
+- A5's failure logs `result gate-failed code <gate> rollback pending` (:258), and A3's failure logs
+  `result failed code <c> rollback pending` (:256). Either line takes the activation out of the
+  `interrupted` set.
+- R2's `revert` and R4's `confirm --rollback` then require "its activation is the one `interrupted`
+  names" (:241-243). So they refuse `open-activation`, and root exits 2 with UNITS stopped.
+
+The effect: every gate failure, which today brings the old stack back, ends with no stack running.
+
+A3 has a second gap. It writes `AWAITING-UNITS` last (:256). A3 failing between `started` and that
+write leaves zero files, and R2 and R4 refuse on that too.
+
+Fix, either way:
+- No interim result line. The failing `confirm` and A3 leave `started` as the last line, root's step
+  log records the gate code, and R4 writes the activation's one result.
+- Or `interrupted` keeps an activation open while its last line says `rollback pending`, and
+  `from_log` and the guards are checked against that.
+
+Either way, A3 writes `AWAITING-UNITS` right after `started`, before the backup and any migrate.
+
+Add a case to `stack-release-external.test.mjs` that runs the real sequence against one log and one
+state dir: activate, then `confirm` failing, then `revert`, then `confirm --rollback OLD` passing. Add
+the same sequence with A3 failing after `started`. The `case1-repin.test.mjs` fakes don't cover this,
+because they don't run `stack-release.sh`. Add a mutant that restores today's `interrupted` rule.
+
+B2, from mos-1098 item 1. Nobody owns the hand-placed profile after an upgrade.
+- §1 installs `/etc/apparmor.d/bwrap-userns-restrict` as a loose file that no package owns.
+- Ubuntu 24.04 runs unattended-upgrades for `-security` by default (check `apt-config dump APT::Periodic` on .53, read-only), and that's the path an apparmor or
+  bubblewrap fix takes. So an upgrade can arrive with no person in the loop.
+- The profile declares `abi <abi/4.0>`, which a newer parser is meant to honour. That's the
+  expectation, not something the design tests.
+
+If the profile fails to load, the host fails closed on reach. The sysctl stays at 1, so bwrap gets no
+user namespace, and F4's precheck and every role session fail. That widens nothing, but nothing
+reports it either.
+
+Name in §1, §4 and the run sheet:
+- (a) Who checks the profile and when. For example, root-owned `case1-repin.sh` checks the four
+  host-level P9 items in A1 on every re-pin and refuses `profile-drift`: the file's sha256,
+  `aa-status` showing `bwrap` and `unpriv_bwrap` in enforce, the statoverride, and
+  `/usr/bin/bwrap` mode `root:mosaic 0750`. Add a post-upgrade check in the run sheet for ops-01:
+  P9 and F4, after any apparmor, apparmor-profiles or bubblewrap upgrade, found from
+  `/var/log/apt/history.log` at each window.
+- (b) What a failed load looks like, and that it's a stop, not a fix-forward. A changed profile from
+  a newer apparmor comes back here as its own reviewed round, with a new pinned sha256.
+
+Give A1's refusal a `case1-repin.test.mjs` case.
+
+## Notes (do not block)
+
+N1, from mos-1098 item 2. Only one profile governs `/usr/bin/bwrap` in r4. r3's `mosaic-bwrap` (the
+4b form, `flags=(unconfined)`) isn't installed any more. §1 step 2 replaces it, and §6 says so. Ubuntu's
+file attaches profile `bwrap` to `/usr/bin/bwrap`, and `unpriv_bwrap` has no attachment.
+
+Two profiles with the same attachment would be a conflict. So:
+- P9 adds a seventh item: `/etc/apparmor.d/mosaic-bwrap` is absent, and no loaded profile other than
+  `bwrap` names `/usr/bin/bwrap`.
+- The run sheet says r3's profile is never installed.
+
+F5 proves which profile governs, if its strings are exact:
+- the bwrap process reads `bwrap (enforce)`. Under r3's profile it would read
+  `mosaic-bwrap (unconfined)`.
+- the claude process reads `bwrap//&unpriv_bwrap (enforce)`, from the profile's
+  `px /** -> bwrap//&unpriv_bwrap` rule.
+
+§5 writes the second as "`unpriv_bwrap` (stacked)". Give the exact string in §5 and the test fixture.
+
+N2. The profile's own header says it is "disabled by default as it can break some use cases". It also
+gives `bwrap` itself `allow capability`, `mount` and `pivot_root` over `/{**,}`. With the statoverride
+only `mosaic` runs it, which is the residual Mos accepted. One more F5 item: a role session that runs
+a nested `bwrap` or anything that needs a capability is refused (`audit deny capability`). If the
+harness or a tool the chief uses needs one, F3 fails. That's the check working, not a reason to widen
+the profile.
+
+N3. "before it logs or migrates anything" (:256, :327) isn't quite right. `refuse` (:65) writes a
+`result refused` line with no activation outside `--plan`. That's harmless, and it closes nothing. But
+A2f's "stack log is byte-identical" test passes only because A2f never runs A3. Say "before it logs
+`started`".
+
+N4. `ActiveEnterTimestamp` with `--timestamp=unix` has second precision, and `startedAt` has
+milliseconds. The `>=` bound holds, because the bus starts the PM after the unit is active. Compare
+against the floor of the second in the fake fixtures too, so a test doesn't pass only on a
+millisecond-aligned clock.
+
+A round that changes only B1's lines in §4, B2's lines in §1, §4 and the run sheet, the §5 strings, the
+§7 cases and these notes gets a diff check.

agents/duckworth/work/row196/NOTE-cleanup.md

@@ -0,0 +1,28 @@
+# Row 196: Gander's cleanup mismatch (duckworth-0025)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-20. Reply to gander-0017 (19:34:28Z). Static. Gander's reproducer is
+uncommitted, so I haven't read it.
+
+The finding is correct. libuv records the path a pipe was bound to and unlinks that path when the handle
+closes (`uv__pipe_close`, src/unix/pipe.c). It does this whichever inode sits there by then, and before any
+JS code runs. So `server.close()` on a `listen(path)` server can't keep section 3's promise to remove only
+the inode it owns.
+
+Two ways forward:
+
+1. Keep the promise with a rename (recommended). Bind to a temporary name inside the same checked 0700
+   parent, record the socket's dev and ino, then `rename()` it onto the final path. A bound Unix socket keeps
+   working after a rename, because clients connect to the inode. libuv still holds the temporary name, so its
+   unlink on close hits a name that's already gone (ENOENT, harmless). Cleanup is then the design's own
+   lstat, compare, unlink on the final path. One race remains: a same-uid process can swap the file between
+   lstat and unlink. That falls inside the residual below. Tests: replace the final path with another inode
+   before close and check it survives, and check that the temporary name is gone after `listen()`. Add a
+   mutant that binds the final path directly.
+2. Gander's proposal: drop the promise. The 0700 parent and 0600 socket stay the boundary against other
+   uids, a hostile same-uid replacement or deletion is classed as residual, and Node's normal cleanup is
+   used.
+
+Either one is acceptable on security grounds. The boundary row 196 defends is other uids, and a same-uid
+process can already delete or replace the path at any time. Option 1 costs one rename and one test, and
+keeps the design's wording true. If Sage takes option 2, section 3 has to drop the "owned inode only"
+sentence and name the residual, and the review is re-run on that diff.

agents/duckworth/work/row196/REVIEW-r2.md

@@ -0,0 +1,32 @@
+# Review: Gander row 196 design r2 (duckworth-0009)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-20. Static review, no code run.
+Subject: agents/gander/work/queue-196/DESIGN.md, diff 76b5c8d93..5fe259f16 (one commit, gander-0012).
+DESIGN.md at 5fe259f16 has sha256 c4322b13…e4b9, checked. The commit also appends one BUILD-LOG.md line
+and removes nothing. Against duckworth-0006 (REVIEW.md, 86be181a2).
+
+## Verdict: approve
+
+## r1 codes
+
+- B1 resolved (T2, DESIGN.md:257). At least 8 concurrent proof processes with barriered helpers, a copier
+  racing a live CLI, each own peer PID checked, M20 for a swapped pending socket. The accepted socket is
+  shown working both ways after the helper exits. Section 5 also keeps the Socket in its connection
+  closure, with no shared current-fd variable. That design choice is what prevents the bug.
+- Q1 conditions incorporated (section 5, :183-212). The interpreter is pinned to `/usr/bin/python3`,
+  resolved to a root-owned ELF with safe path components. Shims, scripts and home paths are refused. No
+  PATH lookup. The helper runs for proofs only, M22 proves that with a spy, and the Containerfile is
+  correctly left alone. T10 (:265) tests it.
+- Q2 conditions incorporated. The live-session mapping is in 4 item 6 and T8. R2 goes into P19 333 word
+  for word (:296-298).
+- N2 kept in R1. N3 done: gid is validated and grants nothing, and only pid and uid select. N4 is done,
+  with Mos's acceptance (mos-1015) recorded.
+
+## Note (does not block)
+
+N5. Activation records the interpreter's hash, and the bus pins it at startup (:193-198). Say what a later
+bus restart does after a routine OS upgrade replaces `/usr/bin/python3`. If startup compares against the
+activation record, an upgrade stops the bus at its next restart, which is fail-closed but an outage nobody
+planned. If startup only re-runs the safety checks, the record shows a different binary from the one
+running. Either answer is acceptable. Write it down, and give the operator a re-pin step for an
+interpreter change.

agents/duckworth/work/row196/REVIEW.md

@@ -0,0 +1,73 @@
+# Review: Gander row 196 design r1, the human boundary (duckworth-0006)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-20. Static review, no code run.
+Subject: agents/gander/work/queue-196/DESIGN.md at 76b5c8d93 (sha256 839b5ecb…5074, checked), base 96f243faf,
+Gitea #1694, P19 333. Code read at 96f243faf. Rulings asked: Q1 (kernel credentials) and Q2 (Console
+provenance or bus OIDC), per sage-1343.
+
+## Verdict: changes, B1 only
+
+The direction is right. Binding the proof to the kernel peer closes the copied-proof hole that today's
+cooperative check leaves open: `verifyHuman` reads `proof.pid` from the envelope (human.mjs:52-71), and
+`serve` never asks who connected (server.mjs:13-60). The same-uid limit is stated honestly (section 8 R1),
+and the split with R3 and row 193 matches federation r4. One test gap blocks.
+
+## Rulings
+
+Q1: O1, the Python helper, with three conditions. O2 and O3 are rejected for the reasons in section 5.
+Node's net API has no peer-credential accessor, so the choice is between O1 and O4, and O1 is less code to
+audit and adds no build artifacts.
+- Pin a root-owned system interpreter, recorded at activation, for example `/usr/bin/python3`. On dragon-lin
+  that's a symlink to python3.14, and Python 3.12.8 also sits in the user's PATH through a pyenv shim at
+  `~/.pyenv/shims/python3`. A shim is a shell script that picks an interpreter from the environment and the
+  working directory before Python runs, so `-I -S` can't stop it. Refuse an interpreter path that resolves
+  under any home directory, or that is a script rather than an ELF binary.
+- Run the helper only for proof envelopes (human, tester, user). A cap request is already bound to the
+  uid by the 0700 `bus/` directory and the 0600 socket (store `safe(directory,true)`, section 2), and the
+  cap is the authority. SO_PEERCRED is fixed at `connect()`, so reading the envelope first and the
+  credentials second is sound. That keeps a Python spawn off every managed-run bus call. If Gander keeps
+  the helper for all connections, the gate's cost measurement decides (DESIGN.md:186-188). Security is the
+  same either way.
+- O4 stays the fallback if a bus host or a future bus image has no Python. The current Containerfile is the
+  worker image (`node:24-bookworm-slim`, entrypoint run-agent.sh) and doesn't run the bus, so today it needs
+  no change. Say so in section 5, so "add an image build dependency" doesn't send someone to the wrong
+  image.
+
+Q2: the Console provenance contract is approved for this slice. Bus-side OIDC would not move the boundary.
+A process that can fake Console provenance on the instance's uid can also read the Console's session and
+tokens. Passing ID tokens to the bus would turn them into bearer credentials that can be replayed
+(DESIGN.md:156-161). The issuer is also the weaker link today (federation B8, duckworth-0005). Two
+conditions: the Console puts in the proof only a user id it mapped from claims Q175 verified for that same
+request's session, never from one cached past the session (R6 tests this). And the P19 333 text keeps R2
+(DESIGN.md:255-256) word for word, so "zero trust" isn't claimed for the bus.
+
+## Blocker
+
+B1. No test proves the helper reads the credentials of the right connection when connections run at the
+same time. The design allows up to 16 helpers at once (DESIGN.md:183-184). The obvious bug is passing the
+wrong fd: a neighbour's accepted socket, or a reused fd number after a close. T2's copied-proof case
+(DESIGN.md:230) runs one connection at a time, so it can't see that bug. Under a swap, an attacker who
+copies a live proof and connects alongside the real CLI gets the real CLI's peer PID and passes. That is
+the exact attack this row exists to stop. Reading the listening socket's fd instead would refuse
+everything, and every test would catch that. A swap between live connections is the one that passes
+quietly.
+Fix: add to T2 at least 8 concurrent proof connections from distinct processes, each with its own proof,
+and one copier racing a live CLI. Each must bind its own peer PID, and the copier must refuse. Add mutant
+M20, where the helper is given another pending connection's socket, and the test must fail on it. Also
+assert the accepted socket still reads and writes after the helper exits, so the helper's close of its
+copy doesn't end the parent's connection.
+
+## Notes (do not block)
+
+N1. The inventory (section 2) matches the code I read. The walk ends at `ppid === 1` and re-reads the CLI
+(human.mjs:89-92). `serve` takes exactly one of cap, human and tester (server.mjs:52-60). No peer check exists
+today. I didn't re-read the control board, the Discord connector or the launcher sockets, so those rows rest
+on Gander's reading.
+N2. Section 4 item 5 requires the Console as direct parent. A daemonized Console started from the same tree
+by an unsandboxed same-uid agent passes the walk and the parent check. That is federation C1 and P19 333,
+stated in R1, so the row is consistent. I'm noting it so nobody reads T5 as covering it.
+N3. The helper's JSON record carries pid, uid and gid. Refuse gid values too large to be safe integers, as
+with pid and uid (DESIGN.md:185), and record which of the three the bus actually uses. Today only uid and
+pid are needed.
+N4. Sections 3 and 6 move tester HTTP off TCP, so the row 176 browser tester page loses direct navigation.
+That's an operator-facing change. The window plan should name it to Jason, not only Sage's packet audit.

agents/duckworth/work/row199/REVIEW-r3.md

@@ -0,0 +1,68 @@
+# Review: Megavolt row 199 design r2 and r3 (duckworth-0017)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-20. Static review, no code run.
+Subject: agents/megavolt/work/queue-199/DESIGN.md on megavolt/row199. r2 is e806656b1 (sha256 435ee3b1…2e19,
+checked, megavolt-0004). r3 is c2c729ddf (sha256 d1ef44c6…d90d, checked, megavolt-0006), which supersedes r2.
+Diffs 624e8ea3a..e806656b1 and e806656b1..c2c729ddf, one commit each. Code read at 992650232.
+Against duckworth-0013 (REVIEW.md, 6ab9cd927).
+
+## Verdict: changes, B3 and B4
+
+## r1 codes
+
+- B1 resolved (D3a, T1, T5, mutants). ENOENT on a `store` path loads as absent and shows `not-issued`. Every
+  other defect still refuses start, and `{file}` keeps E2's behavior. Both mutants are in.
+- B2 resolved in the design text (D9 step 5, step 2). `protocol.https.allow=always` and
+  `http.followRedirects=false` are the only additions to SAFE (seat/src/working.mjs:92-98). The helper is
+  bound to https and host:port, and step 2 compares the port. working.mjs runs git under seat
+  `gitEnv` (checkout.mjs:79-88), which passes only PATH from the bus env, so no proxy or `GIT_SSL_*`
+  variable reaches it. The test for B2 is B3 below.
+- N1 to N5 done. N3: `work-not-yours` reads the last `recordPush`. N4: D9a. N5: D9b, and no op returns a
+  token.
+
+## Blockers
+
+B3. T3 can't run with the flags it tests. The fake Gitea is "a node http server on 127.0.0.1" (section 11),
+which is plain http. `publish` allows only https (D9 step 5), and the helper answers only `protocol=https`.
+So the happy path fails, or the test loosens the flags it is meant to check. The 302 test passes either way:
+git refuses the http transport before any request, so "the second port receives no request with an
+Authorization header" holds with the redirect check removed, and the `http.followRedirects=false` mutant
+survives.
+Fix: the fake serves TLS with a scratch CA. The test passes the CA through a test-only seam, the way
+`FSCK` is replaced in tests (working.mjs:100), and production adds no CA flag. The 302 test also checks
+that the first port received the request, so it can't pass by never connecting. Same for the wrong-port
+and `remote-unrelated` tests.
+
+B4. The decision doesn't bind the commit that gets published. D9 step 1 says the decision "names the
+commit" and cites `checkLand`. But `#authorityFor` binds a decision to action, role, thread and `target`
+(the task ref) only (broker.mjs:769-798). `checkLand` gets its commit from somewhere else: `readLanding`
+reads the review verdict's commit (bus/src/landing.mjs:144-150), and `#landFacts` compares it with
+`#latestPush` (broker.mjs:936-937). D9 names no field that carries a commit for `git.push.remote`, and
+`decision.raise` has none today. Without one, Jason approves a publish while the task's latest push is A.
+The agent pushes B to the working repo, then publishes B under the same decision. `#latestPush` is B and
+the source is B, so every check passes.
+Separately, step 5 pushes `<src>`, the work ref, by name. A push to the working repo between
+`checkPublish` and the git call moves that ref, so even a bound commit isn't what goes out.
+Fix:
+- Name the carrier: a `commit` in the raise's context for `git.push.remote` (or another field), and the
+  code that reads it.
+- `checkPublish` refuses unless that commit equals `#latestPush(...).commit` and the work ref's tip.
+- Step 5 pushes that oid, `git push <remote> <oid>:<dst>`, not the ref name.
+- T3's "decision for another commit" test covers the A-then-B case above, and a mutant pushes the ref name.
+
+## Notes (do not block)
+
+N6. D9a: main follows root only in `seed` (working.mjs:164-176), which runs in push, review and land. Say
+whether `publish` seeds first. If not, a human pull into root reaches main only at the agent's next push,
+and `remote-unrelated` stays until then.
+N7. D9a also means each publish carries root commits between upstream's tip and main, which is landed work
+not yet upstream, onto the agent's fork. That fits O1. Say it in D9a so nobody reads the fork as holding
+only the agent's commits.
+N8. Citation: `vocabulary.mjs` is
+packages/business/src/vocabulary.mjs, and its ROUTED starts at :58, not :52-55.
+
+## r3 rulings (mos-1027)
+
+The hard wait is right for now. `git.push.remote` is in neither ROUTED (broker.mjs:44-69, vocabulary.mjs:58),
+so it's gated and every publish needs a human-resolved decision, spent once. B4 is what makes that decision
+mean "this commit". O1, Q-M3 and Q-M4 match my r1 inputs.

agents/duckworth/work/row199/REVIEW-r4.md

@@ -0,0 +1,31 @@
+# Review: Megavolt row 199 design r4 (duckworth-0022)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-20. Static review, no code run.
+Subject: agents/megavolt/work/queue-199/DESIGN.md, diff c2c729ddf..e1aa6216c (one commit, megavolt-0007).
+DESIGN.md at e1aa6216c has sha256 f4437d6d…f069c, checked. Code read at 992650232.
+Against duckworth-0017 (REVIEW-r3.md, 4065ed59f).
+
+## Verdict: approve
+
+## r3 codes
+
+- B4 resolved (D9 steps 1, 3 and 5, T3, mutants).
+  - The carrier is `pushCommit` in the `decision.raise` body. The broker reads it from `#latestPush` and
+    the agent never supplies it. It is the same pattern as `holderRun` (broker.mjs:1733-1734).
+  - `#authorityFor` checks it the way it checks `holderRun` (:796-797).
+  - Step 3 makes the decision's commit, `#latestPush` and the work ref tip equal under the lock.
+  - Step 5 pushes by oid, so the ref name never decides what goes out.
+  - T3 covers both cases: approve at A then push B, and a push that lands between checkPublish and the
+    git call. Mutants cover the comparison, push by ref name and the tip check. `no-push` at raise only
+    narrows.
+- B3 resolved (D9 step 5, T3). The fake serves https from a scratch CA. The CA reaches git only through a
+  `tls` parameter that defaults to `[]`, the same seam as FSCK (working.mjs:100). Each test that should
+  reach the network asserts that the first port got the request. A mutant covers a CA flag in production.
+- N6 to N8 done. `publish` seeds under the lock before D9a. D9a states that landed root commits go to the
+  fork. The vocabulary path is fixed.
+
+## Note (does not block)
+
+N9. After routing, a within-role publish has no decision, so `context.pushCommit` doesn't exist. Step 3
+then needs C from `#latestPush` alone, still checked against the tip under the lock. The reviewed commit
+that routes the action should say this and add a test for it.

agents/duckworth/work/row199/REVIEW-r5.md

@@ -0,0 +1,62 @@
+# Review: Megavolt row 199 design r5 (duckworth-0026)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-20. Static review, no code run.
+Subject: agents/megavolt/work/queue-199/DESIGN.md at 34bfe4a53 on megavolt/row199 (megavolt-0010), sha256
+d0b326bb…214d1e (checked). 34bfe4a53 sits on a merge of refactor (12c85ada1), so I diffed the file only:
+e1aa6216c..34bfe4a53, 25 lines added and 7 removed. Against duckworth-0022 (REVIEW-r4.md, d2e305db4).
+
+## Verdict: changes, B5 and B6
+
+The direction is right. With one `remote` per project, two agents can't each have a fork, and deriving the
+fork from the upstream plus the agent's own `gitea.user` means the agent never picks where the push goes.
+Making `identity` optional (D8) fixes a real conflict with "today's files load unchanged". Coder declares
+`gitea` and has no identity. The new T3 case and the two new mutants are what the change needs. Two gaps
+remain, both caused by the rename of what `remote` means.
+
+## Blockers
+
+B5. D9a and step 5 still say "the remote", and the remote is now the upstream. D9 step 2 makes
+`projects.<p>.remote` the upstream URL, which the host "never pushes to". But D9a (:191-201) still says "A
+project's `remote` must be root's upstream or a fork of it" and runs `ls-remote` "for the remote's default
+branch". Step 5 (:176) is `git push <remote> <C>:<dst>`, and the helper matches "the remote's" host (:186).
+Read literally, `ls-remote` checks the upstream while the push goes to the fork. The check then guards the
+wrong repository. If the agent user's `<user>/REPO` is empty, or isn't a fork (A3 not done, or a repository
+of the same name made by hand), the upstream passes `remote-unrelated`. The push then sends all of root,
+landing squashes included, to that repository. That is exactly what D9a exists to stop.
+Fix:
+- Name the derived URL once (for example `fork`), and use it in D9a's `ls-remote`, step 5's push, the
+  helper's host match, the `checkPublish` result (:208) and step 6's event.
+- Reword D9a's first rule as "the agent's fork must share root's history".
+- T3: the upstream is related while the fork is empty, and then while the fork is unrelated. Both refuse
+  `remote-unrelated` with no objects received.
+- Mutant: `ls-remote` against the upstream.
+
+B6. The fork's URL is built from a parsed string, and the parse isn't stated. "By construction" (:163)
+holds only if the parse can't be steered. These need writing down:
+- The upstream is parsed with `new URL()`. Userinfo, a query and a fragment are refused. After
+  normalization the path must be exactly `/OWNER/REPO`, with one trailing `.git` allowed and stripped. A
+  dot segment such as `/<user>/../OWNER/REPO` normalizes to a different owner, so the check runs on the
+  normalized path.
+- `OWNER`, `REPO` and `gitea.user` each match Gitea's name rule (letters, digits, `-`, `_`, `.`, and not
+  `.` or `..`). This is checked at load.
+- Gitea compares user and repository names without case (`lower_name`). `remote-not-fork` compares that way
+  too. Otherwise an upstream owned by `Coder` and a `gitea.user` of `coder` build a "fork" URL that is the
+  upstream itself.
+- `identity.gitea.url` has path `/`, or the design says how a sub-path Gitea is handled. The construction
+  drops any path today.
+Tests: a case-variant owner refuses `remote-not-fork`. A dot segment, an extra path segment, userinfo and a
+query each refuse at load.
+
+## r4 codes
+
+All still resolved. B3 (TLS fake through the `tls` seam) and B4 (`pushCommit` carrier, push by oid) are
+unchanged. The destination is still `refs/heads/<gitea.user>/<branch>`, built by the host (:172).
+N9 (after routing, a within-role publish has no `pushCommit`) stands as a note.
+
+## Notes (do not block)
+
+N10. Name the refusal for `publish` by an agent without `identity`, or whose definition doesn't declare
+`gitea` (D8, :125-126), and give it a T3 case.
+N11. If `ls-remote` fails because the fork doesn't exist, it should refuse with a stated code rather than be
+read as "empty". Add to A3 that Gitea's push-to-create (`ENABLE_PUSH_CREATE_USER`) stays off. Otherwise a
+push to a missing `<user>/REPO` creates a plain repository instead of failing.

agents/duckworth/work/row199/REVIEW-r6.md

@@ -0,0 +1,31 @@
+# Review: Megavolt row 199 design r6 (duckworth-0027)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-20. Static review of the design, plus one node check of D9c's
+normalization claims.
+Subject: agents/megavolt/work/queue-199/DESIGN.md at 4d3007ec9 on megavolt/row199 (megavolt-0012), sha256
+aa458dfe…dc787384 (checked). Diff 34bfe4a53..4d3007ec9, one commit, the file only. Against duckworth-0026
+(REVIEW-r5.md, 3cb6888e1).
+
+## Verdict: approve
+
+- B5 resolved. `fork` is named once in D9 step 2 and is the only URL the rest of `publish` uses: D9a's
+  `ls-remote --symref <fork> HEAD`, step 5's push, the helper's host match, the `checkPublish` result, the
+  publish result and step 6's event. D9a now checks the fork and says why a related upstream proves
+  nothing. T3 puts an empty fork and an unrelated fork behind a related upstream, and the fake records every
+  path, so a check against the upstream fails the test. The upstream `ls-remote` mutant is in.
+- B6 resolved (D9c). I ran the equality check in node 26 (`url.origin + url.pathname === input`). These
+  each fail it: a dot segment, `%2e%2e`, an upper-case host, `:443`, backslashes, userinfo, a query and a
+  fragment. A trailing slash passes it, and so does `%41`. The two-segment rule catches the first and the
+  name rule (no `%`) catches the second, so both refuse. The owner and the repository are read from the
+  normalized path, so the owner that gets checked is the owner that gets used. The `.git` strip followed by
+  the name rule refuses `.git` and `..git`. `remote-not-fork` compares without case. A sub-path Gitea refuses
+  at load. The three new mutants cover the three ways this could regress.
+- N10 resolved. Load refuses a `publish` grant without `identity` or without `gitea`, with a fixed message,
+  and has a T3 case for each.
+- N11 resolved. A non-zero `ls-remote` refuses `fork-unavailable` and its stderr isn't returned. A3 keeps
+  push-to-create off for users and orgs, and the mutant that reads failure as empty is in.
+- r4 codes hold. The `pushCommit` binding, the push by oid, the `tls` seam and the
+  `refs/heads/<gitea.user>/<branch>` destination are unchanged. N9 is carried to BUILD.md for the routing
+  commit, which is the right place for it.
+
+Code can start on this revision.

agents/duckworth/work/row199/REVIEW.md

@@ -0,0 +1,69 @@
+# Review: Megavolt row 199 design r1, per-agent credentials and remote push (duckworth-0013)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-20. Static review, no code run.
+Subject: agents/megavolt/work/queue-199/DESIGN.md at 624e8ea3a on megavolt/row199 (sha256 3eb2df7c…1cd4,
+checked), base 992650232, Gitea #1697. Code read at 992650232.
+
+## Verdict: changes, B1 and B2
+
+The shape is right. The path is derived from the cap, never named in a request. No `gitea` or `vikunja`
+token enters a sandbox. The destination ref is built by the host. `publish` is no-force. E1 to E10 match the
+code where I checked them. The launcher and its git socket run in the bus process (cli.mjs:504-506), so
+`useFor` from `publish` doesn't move a token across processes. Two things block.
+
+## Blockers
+
+B1. A `store` reference with no file stops the whole bus at start. D13 creates an agent "with `store`
+references and no files" and says `launch` then refuses `credential-unavailable`. `revoke` (section 6)
+unlinks the file and leaves the reference. But D1 keeps E2's reader, and that reader throws
+`credential-file` when the file is missing (credentials.mjs:38-43). It runs inside `startBroker`'s try
+(runtime.mjs:89), so the bus refuses to start. The fault doesn't show at the verb. It shows at the next
+restart, for every agent of the business. Row 194's fire calls revoke before it edits the business file
+(D13), so a failed edit after a good revoke leaves exactly this state.
+Fix: say what a `store` reference with no file means. I suggest: ENOENT on a `store` path loads as an
+absent entry, `status` shows `not-issued`, and `useFor` refuses `credential-unavailable`. Every other defect
+still refuses start: wrong owner or mode, a symlink, bad format, a dir problem. `{file}` and `{env}` stay as
+they are. T1 and T5 gain a bus restart after create-without-issue and after revoke. Add a mutant that makes
+ENOENT on a `store` path fatal again, and one that makes ENOENT on a `{file}` path silent.
+
+B2. D9 step 5 doesn't bind the token to the remote's host. A one-shot helper that hands out the token on
+any `get` gives it to whatever host git asks about. Git follows a redirect on the first request
+(`http.followRedirects` defaults to `initial`) and then asks the helper for credentials for the new host.
+So a redirect from the remote, or from anything that answers for its name, sends the agent's
+`write:repository` token off the Gitea host. Separately, "E8's safe env" can't push to https at all:
+working.mjs:95 sets `protocol.allow=never` with only `file` allowed.
+Fix, in D9 step 5:
+- `publish` sets `protocol.https.allow=always` and nothing else beyond SAFE.
+- It sets `http.followRedirects=false`.
+- The helper answers `get` only when `protocol` is `https` and `host`, port included, equals the remote's.
+  It answers nothing for `store` and `erase`.
+- Step 2's host check compares the port too.
+- T3 gains a fake remote that 302s to a second 127.0.0.1 port, where no basic auth may arrive.
+- Add a mutant whose helper answers any host.
+
+## Notes (do not block)
+
+N1. Section 6 lets the tester run every lifecycle verb on the dev instance (Q173). Agents act as tester,
+so `issue` and `rotate` under the tester mean an agent session holds a live token on stdin. That cuts
+against section 7 ("Agents never mint accounts or tokens") and the no-credential-values rule. I suggest
+the tester gets `status` and `revoke` only, and `issue` and `rotate` stay with Jason. This is input to
+Q-M3.
+N2. The `issue` flag has to follow the kind. The reader takes `rotateBy` for `gitea` and `expires` for
+`vikunja` and refuses any other key (credentials.mjs:24-33). Say `--rotate-by` is gitea-only and
+`--expires` is vikunja-only.
+N3. The work ref is per task, `work/vikunja-<project>-<task>` (working.mjs:110-114), not per agent. "The
+agent's own work ref" (D9 step 3) holds only through step 4's identity check. Say so, or also check that
+the last `recordPush` for that ref was the caller's.
+N4. `publish` sends the working repo's `main` history from the project root along with the work. If the
+remote doesn't share root's history, the first publish uploads all of root, landing squashes included. Say
+that a project's `remote` must be root's upstream, and have R1 or T3 show a first publish against an empty
+fork.
+N5. E5 cites `git-socket.mjs:398-407`. It is `packages/cli/src/git-socket.mjs`. Name the host op that
+`publish` uses to reach `useFor`, since the socket today reaches the broker only through `host.op`.
+
+## Q-M inputs for Mos
+
+- Q-M1: O1 (forks). Gitea enforces it, and no per-agent rule can drift. O2 depends on probe P1, which hasn't run.
+- Q-M2: no objection. It's a reviewed `roles/` change, with nothing automatic.
+- Q-M3: human-only, plus N1's narrowing for the tester.
+- Q-M4: agreed. Per-agent model tokens need the proxy row.

agents/duckworth/work/row201/REVIEW-r1.md

@@ -0,0 +1,56 @@
+# Review: Gizmoduck row 201 FED R1 manifest, round 1 (duckworth-0033)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-20. Subject: gizmoduck/fed-r1 at 44e36fc4c, candidate 80fe31071,
+base ae3c36f24 (gizmoduck-0032). Against the FED R1 brief (docs/plans/2026-10-20_federation-r1-r2-r5.md at
+a2af7ab49) and DESIGN.md 3.5 at a1daa3c07.
+- Manifest digests checked, all three match: access.mjs 74ac7e9e…dc4f4, index.mjs 7ee59b6e…3d20,
+  access.test.mjs 3bec097f…b238. 44e36fc4c only deletes a `__pycache__` .pyc.
+- I read access.mjs in full, the test file in full, BUILD.md, and util.mjs:66-89 (`readJsonFile`).
+- In a scratch git worktree at 80fe31071, `node --test packages/business/tests/access.test.mjs` passed 24 of
+  24 with exit 0. I removed the worktree afterwards. I ran no suites and no mutants.
+
+## Verdict: approve
+
+Each brief test item maps to a test:
+
+| Brief item | Test |
+|---|---|
+| symlink, non-regular file | access.test.mjs:216, :219 |
+| another owner | :224 |
+| group or other write | :225-228 |
+| expiry | :178-186, and covers :259-266 |
+| `*` | :154-156, :165 |
+| subjects (deviation 2) | :132-135 |
+| `human`, `tester`, any business's human | :111-115 |
+| any level other than collaborator | :171-176 |
+| project not a UUID | :151-153 |
+| covers: `*` and listed ids, unlisted project, instance or business, expired, level filter | :244-274 |
+
+The file checks run on one descriptor opened with `O_NOFOLLOW | O_NONBLOCK`. `fstat` comes before the read
+(util.mjs:66-89), so there's no check-then-read race, and a FIFO is refused instead of blocking. Mode
+`& 0o022` and the uid compare match 3.5's first rule. The interface (`checkAccess`, `loadAccess`, `covers`,
+`LEVELS`, `accessFilePath`, and the context with `ssoSubjects` required) is the one Morgana confirmed
+(morgana-0014, 08bb4d827) and Sage accepted (sage-1399).
+
+Deviation 1, a past `expires` loads and `covers` returns false: right. 3.5 says such a grant "is treated
+as absent", not refused, and sage-1399 confirms it.
+
+Deviation 2: your reading is the one I meant. The brief's phrase is about the 3.5 subject rules: a
+`(provider, sub)` pair appears once in the file and never in `console.sso.subjects`. :132-135 cover a pair
+repeated within a user, a pair shared across users, an owner subject, and the same sub under another
+provider. The other reading, a grant naming a user that isn't in the file, is covered by your added rule at
+:145.
+
+What remains is Sage's gate: the business suite, every `scripts/test-*.sh`, and M01-M44 each killed.
+
+## Notes (do not block)
+
+N1. `covers` with no `level` lets any level cover (access.mjs:177-185, test :271). That matches 3.5 ("when
+one is asked for"), and today it is harmless because `LEVELS` holds only collaborator. Once 193a adds
+`viewer`, any broker path that calls `covers` without `level` for a write verb lets a viewer grant send.
+For 193a (Morgana) and R3: the verb gate always passes `level`, and add a test that a viewer grant refuses
+`thread.send` and `thread.create`. Making `level` required would be an interface change, so that would go
+to Sage first.
+N2. `covers` relies on the grant having passed `checkAccess`. `projects[0] === "*"` is correct only
+because `*` must stand alone (:154-156). The doc comment says "a checked grant". R5 and 193a should only
+pass grants from `checkAccess` or `loadAccess` output, never ones they built themselves.

agents/duckworth/work/row202/REVIEW-r1.md

@@ -0,0 +1,91 @@
+# Review: Quackerjack row 202 FED R5 manifest, round 1 (duckworth-0040)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-20. Subject: quackerjack/fed-r5, build 030809e15, manifest
+agents/quackerjack/work/queue-202/MANIFEST.md at 959bfb275, per quackerjack-0004. Against the FED R5 brief
+(docs/plans/2026-10-20_federation-r1-r2-r5.md) and DESIGN.md 3.5 at b93f098f0.
+- The six manifest hashes match the blobs at 030809e15. 959bfb275 adds MANIFEST.md only.
+- I read cli/src/access.mjs in full, the cli.mjs and scripts/mosaic diffs, the README section, BUILD.md,
+  test 10, broker.mjs:375-378 and :2318-2322, client.mjs:20-45 and transport.mjs `refuseInsideAgent`.
+- In a scratch git worktree at 030809e15, `node --test tests/access.test.mjs` from packages/cli passed 18
+  of 18 with exit 0.
+- One probe of my own, in scratch: an access.json at mode 0664, then `list` and `revoke` through
+  `accessCommand`. Both throw a `BusinessError`, not a `CliError` (B1). Nothing was written and the lock
+  was removed.
+- I removed the worktree and the probe. I ran no suites and no mutants.
+
+## Verdict: changes, B1 only
+
+Your four points:
+
+1. Human proof: sound. `proveHuman` makes one `project.list` call through `humanTransport` before any read
+   of the file, for all three verbs. The broker runs `#human` on it (broker.mjs:2319), which needs
+   `s.human`, `via` `cli` and `outsideAgent` (:377). `refuseInsideAgent` runs first, and `--tester` refuses
+   before the bus is asked. One correction to the reasoning is in N1.
+2. Lock: it does what BUILD.md says. `O_EXCL` create at 0600, the pid written after, removed in a
+   `finally`, and a reclaim only on ESRCH. EPERM reads as alive, and an empty or non-pid lock refuses. So
+   every doubt fails closed. I agree the reclaim race (limit 1) is acceptable for a human-only verb. It
+   needs a crash plus two writers at once, and it's Sage's call. See N2 and N3.
+3. Write: `checkAccess` runs on the whole new document before `writeAtomic`. The temp file is created
+   `wx` at 0600 in the same directory, written, fsynced and renamed. The revision is compared inside the
+   lock. See N4.
+4. Bus finding: agreed, it's outside R5. A closed socket maps to `outcome-unknown` at client.mjs:32-33.
+   Pinning it in test 10 is the right call. When row 196 changes it, this test fails and must be updated
+   in that row. See N5.
+
+## Blocker
+
+B1. A bad access file, or a bad business file, escapes as an uncaught `BusinessError`. `readCurrent`
+calls `loadAccess` (access.mjs:78) for `list`, and inside the lock for `grant` and `revoke` (:203). Only
+the `checkAccess` call at :236-241 converts `BusinessError` to a `CliError`. `run` (cli.mjs:613-614)
+rethrows anything that isn't a `CliError`, so node prints a stack trace and exits 1. My probe: an
+access.json at mode 0664 gives `BusinessError: access file must not be writable by group or other` from
+both `list` and `revoke`. The same happens for a file owned by another uid, and for a hand edit that
+breaks any 3.5 rule. DESIGN.md 3.5 says "Jason may also edit the file by hand", so this is an expected
+path, not a corner case. `accessContextFor` (:44-57) has the same gap for `loadBusiness`. It also runs in
+cli.mjs before `accessCommand`, so a broken business file reaches an agent caller ahead of the agent
+refusal.
+Fix:
+- Convert `BusinessError` to `CliError(`refused: ${message}`, 2)` around `readCurrent` too. One wrapper
+  round the whole verb body does it.
+- Build the context after `refuseInsideAgent`, e.g. pass `contextFor: () => accessContextFor(...)` and call
+  it inside `accessCommand`.
+- Add one test: an access file at 0664 refuses `grant` with exit 2, and the file, the receipt and the lock
+  are unchanged.
+The manifest's line "BusinessError is caught and re-thrown as exit 2" is then true.
+
+## Notes (do not block)
+
+N1. The header comment (access.mjs:5-6) and README say the bus refusing a non-human shell is why "no agent
+and no tester can write". For a tester that's not quite right. `project.list` exempts testers
+(broker.mjs:2319, `if (!s.tester) this.#human(s)`). Testers are kept out because the CLI refuses
+`--tester` and always uses `humanTransport`. Say so in the comment. For R4, record that `access.reload`
+must call `#human` with no tester exemption, because that verb is the proof once R4 swaps it in.
+N2. The empty-lock window can go away. `bus host` already writes the pid to a temp file and hard-links it
+in as `host.lock` (packages/cli/README.md:297-299), so the lock never exists without a pid. With that
+pattern, the "empty lock, remove by hand" case disappears.
+N3. In the reclaim race, the loser's `finally` `unlinkSync(lock)` can remove the winner's lock. If its own
+lock was already taken, it throws ENOENT after the rename has happened, and no receipt is written.
+Using `rmSync(lock, { force: true })` or checking the pid before unlinking narrows that. It's part of
+limit 1, so Sage decides.
+N4. `writeAtomic` doesn't fsync the directory after `renameSync`, so a power cut can lose the rename. A
+failed write leaves the `.access-*.tmp` file behind. The receipt is appended after the lock is released
+(:246), so two writers' receipt lines can land in either order, and a crash between rename and append
+leaves a write with no receipt. Appending inside the lock, after the rename, keeps the log in revision
+order.
+N5. Test 10's `outcome-unknown` tells a human that the outcome is unknown when nothing was written. Until
+row 196 lands, the README could add: a refused proof shows as `outcome-unknown`, and no write happened.
+N6. R1's `loadAccess` checks that the file's uid matches the caller's, and the rename makes the caller
+the owner. So `mosaic access` has to run as the instance's uid, e.g. `mosaic` on .54 (Q181). Run as
+anyone else, every read refuses. The README should say which user runs it.
+N7. No verb adds or removes a `users` entry. `grant` needs the user already in the file (R1's rule), so a
+new user is a hand edit. "To cut a user off, revoke" removes that user's grants at one `--business` only.
+Say both in the help text. DESIGN.md 3.7 says "Removing the users from access.json acts at once", and the
+help should not read as if `revoke` does that.
+N8. When row 204 (193a) lands, `--level viewer` is accepted through `LEVELS` with no R5 change. The usage
+line, the help and the README name only `collaborator`. The row that lands second updates the text and
+adds a viewer grant test (my duckworth-0037 N1, carried in Morgana's BUILD.md).
+N9. `accessContextFor` calls `p.subjects.map` with no guard, so a provider with no `subjects` throws a
+`TypeError`. That goes away once R5 rebases onto row 192 and reads `console` through `checkConsole`, as
+BUILD.md says.
+
+A round that changes only B1 and any notes taken gets a diff check, not a full re-read.

agents/duckworth/work/row202/REVIEW-r2.md

@@ -0,0 +1,46 @@
+# Review: Quackerjack row 202 FED R5, round 2 (duckworth-0041)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-20. Subject: candidate 48a3fb96e on quackerjack/fed-r5, manifest
+agents/quackerjack/work/queue-202/MANIFEST.md at 7fd265033, per quackerjack-0005. Round 1 was
+REVIEW-r1.md (duckworth-0040, changes B1, on 030809e15).
+- The six manifest hashes match the blobs at 48a3fb96e. scripts/mosaic is unchanged since round 1.
+- I read the full diff 030809e15..48a3fb96e for packages/cli (access.mjs, cli.mjs, the test file and the
+  README) and BUILD.md.
+- In a scratch git worktree at 48a3fb96e, from packages/cli, `tests/access.test.mjs` alone passed 21 of
+  21 with exit 0. I removed the worktree. I ran no suites and no mutants.
+- No test pins a hash of `packages/cli/src/access.mjs` or reads it by path.
+
+## Verdict: approve
+
+- B1 resolved. `accessCommand` runs `refuseInsideAgent`, then wraps the whole verb body, so a
+  `BusinessError` from `loadAccess`, `loadBusiness` or `checkAccess` becomes `CliError("refused: …", 3)`.
+  The exit code is 3 under Sage's ruling (sage-1437). The new test sets a 0664 file and asserts exit 3,
+  the path in the message, and the file, receipt and lock unchanged.
+- The context is now `contextFor()`, called after the `--tester` refusal and the human proof. The new
+  test makes `contextFor` throw and the file 0664, and both the agent and the `--tester` caller get their
+  own refusal first.
+- The lock no longer reclaims. A dead-pid, empty or non-pid lock refuses and names the path, and the
+  dead-pid case names the pid. With no reclaim, the `finally` unlink only ever removes the caller's own
+  lock, so my N3 is gone too. That trades the race for a manual clear after a crash, which is the
+  fail-closed choice, and Sage made it (sage-1429).
+- `writeAtomic` removes its temp file on any failure up to the rename. The test injects a throwing
+  `renameSync` through `deps.fs` and checks the old bytes, no `.access-*.tmp`, no lock and no receipt.
+  M11, the direct-write mutant, is now killable.
+- `deps.fs` undefined falls back to the real functions through the default parameter, in both
+  `writeAtomic` and `withLock`.
+- N6 taken in the help text and the README.
+
+## Notes (do not block)
+
+N1. Exit codes are now mixed. Load and check refusals are 3. `--level takes …`, `project-not-found` and
+"no grant … to revoke" stay 2. If that's intended, say so in the README. If not, it's a small follow-up.
+Sage's call.
+N2. The receipt is still appended after the lock is released (round 1 N4, second part). Receipt lines
+can land out of revision order when two writes run back to back. A crash between the rename and the
+append leaves a write with no receipt. Not required by the brief.
+N3. `writeAtomic`'s catch unlinks `tmp` even when `openSync(tmp, "wx")` failed with EEXIST, i.e. a temp
+name that belongs to someone else. With 8 random bytes this won't happen in practice.
+N4. Round 1 N1, N5, N7, N8 and N9 carry as you said. N1 is already in the R4 brief line of the
+manifest.
+
+What remains is Sage's gate: the cli suite, every `scripts/test-*.sh`, and M1-M13 each killed.

agents/duckworth/work/row204/REVIEW-r1.md

@@ -0,0 +1,42 @@
+# Review: Morgana row 204 (193a) manifest, round 1 (duckworth-0037)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-20. Subject: morgana/row193a at 0caf6e2f6, base 44e36fc4c (row 201
+FED R1 candidate tree), per morgana-0018. Against design `agents/morgana/work/queue-193/DESIGN.md` r5 4.2,
+my R1 N1 (duckworth-0033) and sage-1420.
+- Manifest digest d38de8c9…f75a checked, and its three file hashes match the tree: access.mjs 0c1d9a12…b2ae,
+  access.test.mjs 11dc4dd3…698c, access-levels.test.mjs a0656806…d52a.
+- I read the full diff 44e36fc4c..0caf6e2f6, BUILD.md, mutants.py and mutants.log.
+- In a scratch git worktree at 0caf6e2f6, from packages/business, each file alone with the tap reporter:
+  access-levels.test.mjs 5 of 5, access.test.mjs 26 of 26, both exit 0. I removed the worktree. I ran no
+  suites and no mutants.
+
+## Verdict: approve
+
+- `LEVELS` is `["collaborator", "viewer"]`, most to least, and the comment at access.mjs:13-15 says the
+  order matters.
+- `covers` (access.mjs:180-188) throws a `TypeError` for a missing or unknown `level` after the `now`
+  check. That resolves my R1 N1 the way sage-1420 item 2 ruled.
+- The least-level compare is right. A grant covers when its index is at or below the asked index, so a
+  viewer grant (1) fails a collaborator ask (0), and any grant passes a viewer ask.
+- The `!LEVELS.includes(grant.level)` guard at :188 is needed. Without it an unknown grant level gives
+  `indexOf` -1, which would pass every ask. Mutant A6 drops it and access.test.mjs test 25 catches that.
+- `checkAccess`'s refusal path is unchanged apart from the list in its message. "Viewer", "viewer " and
+  `["viewer"]` refuse.
+- The tests carry the design's matrix, the missing-level throw, an unknown grant level, and a viewer grant
+  that still needs business, project, instance and expiry.
+- No other package calls `covers` (grep over packages at 0caf6e2f6), and no test pins a hash of either
+  source or test path.
+
+What remains is Sage's gate: the business suite, every `scripts/test-*.sh`, and A1-A6 each killed on the
+rebased tree.
+
+## Notes (do not block)
+
+N1. R5 (row 202, quackerjack/fed-r5 at 959bfb275) imports `LEVELS` for `access grant --level`. Once both
+land, `--level viewer` is accepted with no R5 change. R5's usage line and README still name only
+`collaborator`. Whichever row lands second should update that text and add one grant test with `viewer`.
+R5 doesn't call `covers`.
+N2. On the rebased tree, R1's M43 anchor no longer exists, as BUILD.md says. If Sage's gate for 193a
+reruns R1's mutants, M43 needs the new anchor or it aborts on an anchor count of 0.
+N3. BUILD.md's mutant table labels A5b "no level means viewer", while mutants.py and the log say "means
+any". The two are the same mutant, since every grant covers a viewer ask. Doc-only.

agents/duckworth/work/row210/REVIEW-code-r1.md

@@ -0,0 +1,91 @@
+# Review: Gizmoduck row 210 round 1 code, host.run with sudo through the credential store (duckworth-0052)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-20. Subject, per gizmoduck-0052, which moved it from gizmoduck-0049:
+- 12ffe0b56 on `gizmoduck/row210-on-199-r2`, base 07141966e (row 199's tip, megavolt-0027).
+- `git range-diff addee664a..8ec923585 07141966e..12ffe0b56`: the DESIGN commits and the code commit
+  c7958740a are `=`. 12ffe0b56 adds only BUILD.md and manifest lines.
+- `candidate-manifest.sha256` (sha256 82b701e7…): 20 files, all OK in my worktree. It lists exactly the
+  non-packet files in `07141966e..12ffe0b56`.
+
+What I read in full: `bus/src/host-run.mjs`, `business/src/hosts.mjs`, and the diffs of `broker.mjs`,
+`bus/src/credentials.mjs`, `credential-verbs.mjs`, `runtime.mjs`, `server.mjs`, `bus/src/business.mjs`,
+`business/src/business.mjs`, `credentials.mjs`, `resolve.mjs`, `role.mjs` and `vocabulary.mjs`. I read
+T9 and the test titles against DESIGN r3 D3-D9 and section 9.
+
+## Checks I ran
+
+- The 17 touched test files, each alone, in a scratch worktree at 12ffe0b56 with TMPDIR under my own scratch
+  dir: 134 pass, 0 fail, from an awk sum over the TAP log. This matches gizmoduck-0052.
+- `host-run.test.mjs` alone again: 18 tests, 0 skipped. The scratch sshd ran.
+- After the runs, no sshd, ssh or ssh-agent of mine was left, and no `h-` dir was left.
+- Hash pins: no test line pairs a changed file's name with a 64-hex value.
+- I didn't run the suites or the 47 mutants. They need Sage's slot.
+
+## Verdict: changes, B1
+
+The design holds in the code:
+- D4 binding. `hostRun` is `{host, argvSha256, stdinSha256}` at the raise (broker.mjs `hostRun`). It's
+  compared whole in `#authorityFor`. The broker appends the question text, and the 4096 cap applies to all
+  of it. T9 covers each mismatch, consumed, unapproved, and the full stdin in the question.
+- D5 order. Busy is checked before `#consumeAuthority`, so a busy refusal leaves the decision usable
+  (deviation 5). From the broker's `busy` check to `#inflight.set` in `use()` there's no await, so two
+  calls can't both pass.
+- D6. The quoting is POSIX single-quote, with `sudo -n --` first. T10's argv list covers `$( )`, a
+  backtick, `;`, a newline and glob characters. The prefix match is literal. `refusedCommand` takes the
+  basename. The digits-and-dots and hex-label refusals follow my r3 note.
+- D7. ssh and ssh-agent each lead a group under `setpriv --pdeathsig KILL`. The options are all on argv
+  with `-F /dev/null`, and known_hosts is pinned per call. Field 22 of `/proc/<pid>/stat` is counted after
+  the last `)`. The sweep keeps a dir whose bus pid and start time are alive, kills only a live recorded
+  pid whose cmdline names the dir, and refuses start on any stray entry.
+- D8 and D9. The needles cover the seed at the three base64 offsets and in hex. Revoke aborts the
+  controller, and `use()` answers `credential-unavailable` on an aborted signal.
+- The kinds are closed through `credentialKind`. `resolveInstance` drops `host.*` from the session, and
+  the bus puts it back on the bus side only (deviation 1).
+
+## Blocker
+
+B1. The ssh tests skip and pass when sshd is missing, but their skip text says the gate fails.
+- `host-run.test.mjs:22`: `skip = existsSync(SSHD) ? false : 'no /usr/bin/sshd: the gate fails on this skip'`.
+  14 of the 18 tests carry `{ skip }`. That's T4 to T22 and three of the four T27 cases.
+- `node --test` exits 0 on skipped tests, and no `scripts/test-*.sh` counts skips. I grepped for `skip`. The
+  only hits are each script's own docker-unavailable skip lines.
+- So on a gate machine without `/usr/bin/sshd`, the bus suite reports green and runs none of the D4-D9
+  executor tests. That's the false-pass shape, and the text claims the opposite.
+
+Fix, either way:
+- Make a missing sshd a failure, for example a first test that asserts `existsSync(SSHD)`, with no skip on
+  the rest.
+- Or keep the skip, change the text so it doesn't claim a failure, and have the gate check `# skipped 0`
+  for this file.
+
+Add a mutant or a one-off check with `SSHD` pointed at a missing path, so the gate's answer is shown.
+
+## Notes (do not block)
+
+N1. A `host.sudo` raise checks only that the host is in the registry. It doesn't check that the raising
+role has a grant for that host, or that the argv matches a prefix. T9 raises and approves for `web2`
+(`host-run.test.mjs:235`), which that role isn't granted (`:209-211` refuses `host-not-granted`). Jason can
+be asked to approve a call that can never run. That widens nothing, because the call checks the grant.
+Checking `roles[s.role].hosts[target]` and `commandAllowed` at the raise would keep those questions out
+of his queue. Refuse with the same codes as the call.
+
+N2. `addKey` (`host-run.mjs:84-92`) has no time limit and doesn't listen to the abort signal. If ssh-add
+never exits, `runHost` never returns. `#inflight` keeps the entry, because its delete is in `use()`'s
+`finally`. Every later call for that agent and host then refuses `host-busy` until the bus restarts.
+Revoke aborts the controller but can't clear the entry. ssh-add talks to a local agent on a private
+socket, so this is unlikely. Give it the `agentWaitMs` limit, or kill its group on abort.
+
+N3. `host-key-mismatch` (`:177`) is chosen from exit 255 plus the stderr text. A remote command that exits
+255 and prints that line gets the same answer, and its stdout is lost. Only a command Jason approved can
+do that, so this is a reporting matter. Say so in the D6 exit-255 residual, or match the text only at the
+start of stderr.
+
+N4. Deviation 3's wider runner list and deviation 11's T3 at the broker are fine. M25's CRLF mutant is
+equivalent, as BUILD.md says. With `\r` refused at :27, the line regex (:29) refuses it anyway.
+
+N5. `business/tests/helpers.mjs:14` makes `mosaic-business-*` dirs that no test removes. One run of the
+17 files left 377 under TMPDIR, and `hosts.test.mjs` alone left 111. The helper is older than this row.
+It's a follow-up, not this row's to fix.
+
+A round that changes only `host-run.test.mjs`'s skip, the mutant or check for B1, and these notes gets a
+diff check.

agents/duckworth/work/row210/REVIEW-code-r2.md

@@ -0,0 +1,36 @@
+# Diff check: Gizmoduck row 210 round 2 code, for duckworth-0052 (duckworth-0053)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-20. Subject, per gizmoduck-0054:
+- 455964f23 on `gizmoduck/row210-on-199-r2`, one commit on 12ffe0b56. The base is still 07141966e.
+- The range is `12ffe0b56..455964f23`: 7 files, +163 -40. I read the whole code and test diff.
+- `candidate-manifest.sha256`: all 20 files OK in my worktree, and it lists exactly the non-packet files in
+  `07141966e..455964f23`.
+
+## Checks I ran
+
+- The 17 touched test files, each alone, in a scratch worktree at 455964f23: 137 pass, 0 fail, 0 skipped,
+  from an awk sum over the TAP log. `host-run.test.mjs` ran 21 tests, all passing, with none skipped.
+- B1 by hand. In my copy I set `SSHD` to `/nonexistent/sshd`, with a backup, and checked the sha on restore.
+  The file exits 1 with 21 tests: 8 pass, 13 fail, 0 skipped. That matches gizmoduck-0054.
+- After the runs, no sshd or ssh-agent of mine was left.
+- I didn't run the suites or the 53 mutants. They need Sage's slot.
+
+## Verdict: approve
+
+- B1 is met. The `{ skip }` guard is gone. A first test asserts each binary, and `sshd()` throws when
+  `SSHD` is missing. A missing sshd now fails the file, and the gate sees it.
+- N1 is taken. The raise runs host.run's grant and prefix check (`broker.mjs:1964-1967`). T5-T8 count 0
+  `host.sudo` decisions after both refusals. T9 grants `web2` through `coderWeb2`. The `hard-waits.test.mjs`
+  fixture change follows from N1 and only adds a grant.
+- N2 is taken. `addKey` kills ssh-add's group at `limitMs` (`host-failed`) or on abort
+  (`credential-unavailable`). `runHost` passes `agentWaitMs` and the call's signal. The test's silent socket
+  sees both connections close.
+- N3 is taken. `-E <dir>/ssh.log` keeps ssh's own messages apart from the remote command's stderr, and the pin
+  refusal reads only that log on exit 255. The new test covers both a remote `fail255` and a closed port.
+
+## Note (does not block)
+
+N1. On an exit 255, `out.stderr += log` can take stderr up to 4096 characters past `outputMax`, and
+`truncated.stderr` stays false. That's bounded and only ssh's own text. Leave it or cap the sum.
+
+The suites and the mutant batch, M36-M38 included, are Sage's gate.

agents/duckworth/work/row210/REVIEW-r1.md

@@ -0,0 +1,103 @@
+# Review: Gizmoduck row 210 (#1707) DESIGN.md r1, agent host access with sudo (duckworth-0042)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-20. Subject: agents/gizmoduck/work/queue-210/DESIGN.md at 7b10bc0ff
+on gizmoduck/row210, blob 1514a36d96 (checked), base refactor 9ba31b5b3, per gizmoduck-0041. Against the
+brief docs/plans/2026-10-20_host-credentials.md (9db578ff5), REQ-CRED-3 in Honker's 1.7 draft r2 (approved
+duckworth-0039), row 199 design r6 (4d3007ec9) and row 199's code on origin/megavolt/row199 at addee664a.
+- I checked E1-E11 at 9ba31b5b3: credentials.mjs:22, :84-87, :95-103, :104-117, host.mjs:31 and :270,
+  broker.mjs:145-147, :790-797 and :1490-1532, server.mjs:87-95, business.mjs:89, vocabulary.mjs:101-103,
+  sandbox.mjs:29-31, instance-settings.mjs:27. They hold. E12 is stale, see N1.
+- 199's `useFor` at addee664a (credentials.mjs:228-256) passes a BusError through and maps anything else to
+  `service-failed`, so D5's own codes (`host-key-mismatch`, `credential-leak`) reach the caller as designed.
+- I ran nothing. The probe in section 2 is the author's, and I didn't repeat it.
+
+## Verdict: changes, B1-B4
+
+What holds:
+- The four grant layers, checked on every call, meet REQ-CRED-3's "a grant exists for that agent and that
+  host before the credential is used". The agent never names another agent: the key comes from the cap
+  through `useFor`.
+- No agent and not the chief can write layers 2-4. `hosts` is outside ORGANIZATION_KEYS and INSTANCE_KEYS,
+  and `instances.set` refuses credentialed definitions.
+- `host.sudo` lands as a hard wait under REQ-WAIT-3, and T25 enforces REQ-WAIT-2.
+- The key handoff keeps the key off disk, argv and env (T19). `-F /dev/null`, a bus-written known_hosts
+  under `HostKeyAlias` and `StrictHostKeyChecking=yes` give no trust on first use. Forwarding is off and
+  `restrict` is on the host side.
+- The command is built from argv with POSIX single quotes and `sudo -n --`, never taken as a string.
+- The executor runs in the bus child as a broker.sock verb. The 10 s serial IPC (E5) is a sound reason not
+  to use a host op. It matches where 199 put the push (199 BUILD.md deviation 11), see N1.
+- The brief's two named mutants are there: pin skip (M12, M13) and key leak (M15, M16).
+- Section 6 states the limits plainly, including that `"any"` is root and can outlive the grant.
+
+## Blockers
+
+B1. The event log doesn't say what ran as root. D5 step 6 records `action.allowed` with "host, argv hash,
+stdin size and hash", and T22 checks that the bodies carry hashes. After routing, a within-role call has no
+decision, so no record anywhere in the stack names the command, only its sha256. The existing verbs log the
+thing done in clear: `requestWeb` records the url or query (broker.mjs:1521), and 1.7's push line says
+"Every push is logged with the remote, the ref, the commit and, when one was given, the decision" (draft
+:105). argv has already passed `#secretCheck` (step 1), so it holds no known secret, and it's capped at
+32 KiB. The design gives no reason to hash it. Fix: record `host`, `user` and `argv` in clear in the
+`requested` event, and keep output as sizes and hashes. Change T22 to assert argv is present and stdout,
+stderr and the key are not, and M24's partner: a mutant that drops argv from the event.
+
+B2. A pre-routing decision binds stdin that Jason never sees. D4 binds `stdinSha256`, and the question
+shows only "the host id and the argv". `stdin` can be 64 KiB (D6). So `argv: ["bash"]` with a script on
+stdin shows Jason the question "… bash", and he approves a script he can't read. Binding a hash he can't
+check doesn't give him a decision about it. Fix, either:
+- the question shows stdin in full when present (it passed `#secretCheck`), or
+- a gated call refuses non-empty stdin, and stdin is allowed only for a routed within-role call.
+Add a T9 case for the chosen rule and a mutant that drops it.
+
+B3. If the bus child dies, the key stays loaded and the call can't be revoked. D7 step 5 cleans up in a
+`finally`, and T18 covers success, refusal, timeout and a thrown error. A bus child that is SIGKILLed or
+crashes never runs the `finally`. `ssh-agent -D` has no lifetime of its own, so it keeps the key loaded on
+its socket until the machine reboots. A detached ssh keeps running the remote command. After the restart
+the new bus's kill map is empty, so D9's "revoke also kills a `host.run` in flight" no longer holds for
+that call. 199's push leans on git's own time limit for the same case (deviation 11, "git's own time limit
+ends it"). ssh-agent has no such limit unless one is given. Fix:
+- `ssh-add -t <timeout + grace>`, so the agent drops the key on its own.
+- At bus start, sweep `<configDir>/secrets/run/`: kill what each leftover dir's recorded pids name (check
+  they are still that ssh-agent or ssh first) and remove the dir.
+- Consider `setpriv --pdeathsig SIGKILL` around ssh-agent and ssh, which the sandbox already uses
+  (sandbox.mjs:25-27). Probe it from node first.
+Add a test that SIGKILLs the bus child mid-call and then asserts the key is gone from the agent by the
+bound and the next start leaves no run dir. Add a mutant that drops `-t`.
+
+B4. Nothing routes section 4 to Jason. REQ-CRED-3 says "Who grants a host credential, and how, is set by
+the #424 design, which Jason approves", and section 4 ends "The table above is that answer". Section 10's
+only Jason question, Q-J1, is about the first grants at the live window. My approval of the design doesn't
+stand in for his. Fix: add a Q-J0 to section 10, sent through Mos before the build lands: approve the
+section 4 table. Name where his answer is recorded.
+
+## Notes (do not block)
+
+N1. 199 is on origin now: origin/megavolt/row199 at addee664a carries code and BUILD.md. The header's "199
+has no code on origin yet" and E12 are stale. The bus child already spawns git there: runtime.mjs:245 calls
+`publishRemote`, which runs `runGit` (seat/src/checkout.mjs:95-138) as a detached group leader with
+SIGTERM, a grace period and SIGKILL to the group. Reuse that shape, or the helper, for ssh rather than
+writing a second one. Q-S2: deviation 11 keeps the token and the push in the bus child, and the host side
+only polls. D5's assumption holds, and since the agent reaches broker.sock directly, 210 needs no poll.
+Sage confirms.
+N2. Section 6 should say that a registry entry for the stack's own machine, or any host where the stack's
+`<configDir>` lives, gives the agent with `"any"` every agent's keys and tokens, not just root there.
+Consider refusing a loopback `address` at load.
+N3. D5 says every spawn is `detached: true`, so each gets its own group. D7 step 3 says ssh-agent runs "in
+the same process group". Say which group ssh-agent is in, and make sure the timeout and revoke kill reach
+both the agent and ssh.
+N4. Prefix lists plus stdin: `[["tee"]]` or `[["dd"]]` writes any file as root from stdin. D6 already says
+a prefix list limits mistakes, not a determined agent. Say in the doc that stdin goes to the command, so
+some prefixes are root on their own.
+N5. Pass the user with `-l <user>` and the address as its own argument rather than `<user>@<address>`.
+Then nothing depends on how ssh splits on `@`, or on an IPv6 literal.
+N6. D8 is defense in depth. The remote never holds the private key, and forwarding is off, so output can
+carry the key only if the agent already had it. It's still right to keep. Also note that a `host.*` entry
+in the shared token map makes today's `assertClean` loop over a multi-line value that never matches
+(E3), which is harmless.
+N7. My #423 r5 condition (duckworth-0035) applies. If ops-01 changes step 1 to fit this design, for
+example per-agent `from=…,restrict` lines for localadmin, that changed step 1 comes to me as a diff before
+it runs. That's the live part, not this row.
+N8. Q-S1 (route `host.sudo` in 1.7) is Sage's and Jason's call. Without it, B2's rule matters on every
+call.
+
+A round with only B1-B4 and any notes taken gets a diff check, not a full re-read.

agents/duckworth/work/row210/REVIEW-r2.md

@@ -0,0 +1,66 @@
+# Review: Gizmoduck row 210 (#1707) DESIGN.md r2, diff check (duckworth-0043)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-20. Subject: DESIGN.md at b726e10f4 on gizmoduck/row210, blob
+8c6c6a8c5e (checked), per gizmoduck-0044. Diff 7b10bc0ff..b726e10f4, +153 -60, one file. I read the
+whole diff, including sage-1450's D6 change, which goes past my B items. Round 1 was REVIEW-r1.md
+(duckworth-0042). I checked the new cites at 9ba31b5b3:
+- broker.mjs:126 `text()` caps a string at 4096, and :1654 runs `string(a.question)` on the raise.
+- sandbox.mjs:44 is `KILL_WITH_PARENT = ["/usr/bin/setpriv", "--pdeathsig", "KILL", "--"]`.
+- E12 and 199's cites at addee664a match what I read in round 1.
+I ran nothing.
+
+## Verdict: approve on b726e10f4, with one condition (C1)
+
+- B1 resolved. `requested` and `completed` carry host, address, user and argv in clear, after
+  `#secretCheck`. stdin and output stay as size and sha256. T22 asserts both sides, and M30 drops argv.
+- B2 resolved. The broker appends host, user, JSON-quoted argv and the full stdin to the question itself,
+  inside the existing 4096 cap. A raise that doesn't fit refuses `invalid-request`. T9 checks the stored
+  question and the cap, and M31 omits stdin. With sage-1455 (every call a Jason decision under 1.7, per
+  mos-1086), this was the rule that mattered most, and it now holds.
+- B3 resolved.
+  - `setpriv --pdeathsig KILL --`, the sandbox's own prefix, wraps every spawn.
+  - `ssh-add -t <timeout+30>` bounds the key even if the agent survives.
+  - A pids file and a sweep before `broker.sock` listens. The sweep kills only a pid whose cmdline names
+    the dir, and leaves alone a dir whose bus pid is alive, which also covers two buses sharing
+    `<configDir>`.
+  - T27 covers all three, and M32-M34 drop each one.
+- B4 resolved. Q-J0 is in section 10 in standalone form, routed through Mos before landing, and recorded in
+  DECISIONS.md. See C1.
+- sage-1450's D6 holds together. There's no wildcard grant. Load refuses a string, empty, duplicate and
+  glob-character `commands`, and a shell or runner as `argv[0]` by basename (so `/bin/bash` too). T26 and
+  M6, M28 and M29 cover each one. Section 6's known limit names what closes it (`bwrap --unshare-net`) and
+  doesn't claim the allowlist closes it.
+- Notes N1-N7 were taken as asked.
+
+## Condition
+
+C1. Q-J0 overstates revoke. Its line "You, Mos or the tester can revoke at once. The stack drops the key
+and stops a running command" goes to Jason word for word. Section 6 says "Revoke stops the stack's path,
+not remote processes. Killing ssh may leave a remote process running." He should approve on the accurate
+version. Replace the line with something like: "You, Mos or the tester can revoke at once. The stack drops
+the key and cuts its connection. A command already started on the machine may keep running." That's a
+one-line change that needs only my diff check, and it must be in before Mos sends Q-J0.
+
+## Notes (do not block)
+
+N1. The runner list is open by design (D6 says so), and it's Sage's ruling. Commands that run another
+command as root as directly as `env` or `nohup` do: `systemd-run`, `runuser`, `chroot`, `nsenter`,
+`unshare`, `setpriv`, `capsh`, `doas`, `pkexec`, `flock`, `stdbuf`, `ionice`, `chrt`, `taskset`, `strace`,
+`script`, `watch`, and the interpreters (`python3`, `perl`, `ruby`, `node`, `awk`). Adding them costs one
+array line each. `systemd-run` is the one I'd add first.
+N2. The loopback check names `127.0.0.0/8`, `::1` and `localhost`. getaddrinfo also takes these to the
+local machine: `0.0.0.0` (and `0`), `::`, `::ffff:127.0.0.1`, short or numeric IPv4 forms such as
+`127.1` or `2130706433`, which pass the DNS-name regex, and `*.localhost`, which systemd-resolved maps to
+loopback. Refuse a name made only of digits and dots unless it's a full four-part IPv4 literal, and run
+the address check on `net.isIP` output. Section 6 already says load can't know every address of the
+stack's machine, so this narrows the gap without closing it.
+N3. The sweep trusts that a live pid is still the bus that wrote the file. A reused pid leaves that dir in
+place until the next start. The cmdline check already stops a wrong kill. Recording each pid's start time
+(`/proc/<pid>/stat` field 22) beside it removes the reuse case. Low stakes, because `-t` and pdeathsig
+have already dropped the key.
+N4. T26 is listed after T27, and M28/M29 after M35. Cosmetic.
+N5. On a gated call the 4096 cap counts the agent's own question, the JSON-quoted argv and the stdin, so
+stdin's real room is smaller than 4 KiB. D4 says this. The tool help should say it too.
+
+Q-S3 (the host_run harness tool) is Sage's call. What remains: C1, then the build, manifest review and
+Sage's gate. The row lands after 199 and after the PRD version holding REQ-CRED-3.

agents/duckworth/work/row210/REVIEW-r3.md

@@ -0,0 +1,35 @@
+# Review: Gizmoduck row 210 DESIGN r3, C1 diff check (duckworth-0044)
+
+Reviewer Duckworth (Opus 5.5), 2026-10-20. Subject: gizmoduck/row210 at e021dfa26, DESIGN.md blob
+ece332e306 (checked), per gizmoduck-0047. e021dfa26 is a fast-forward of b726e10f4, and the diff touches
+DESIGN.md only (+51 -26). I read the whole diff.
+
+## Verdict: C1 met, approve stands
+
+C1. Q-J0 now says "The stack drops the key and cuts its connection. A command already started on the machine
+may keep running." That matches section 6 and D9's revoke line. The quote is still 10 lines, and the yes/no
+question is last. Dropping "on the machine" from the ops-01 sentence loses nothing. Mos can send Q-J0 as it
+stands at e021dfa26.
+
+The rest of r3 matches the rulings and my r2 notes:
+- Q-S3 (sage-1468): the `host_run` row is gone from D10, and the scope line says no `packages/harness` file
+  changes. My r2 N5 goes to Sage's follow-up row.
+- N1 (sage-1473): D6 carries the whole runner list, five interpreters, and the line that the list can't be
+  complete and Jason's per-call decision is the control. T26 has one case per name.
+- N2: I checked `net.isIP` on node here. It returns 0 for `127.1`, `2130706433`, `0177.0.0.1`,
+  `127.000.000.001` and `127.0.0.01`, and 4 for `10.1.1.53`. glibc resolves `0177.0.0.1` and `127.0.0.01`
+  to 127.0.0.1. The rule "a name of only digits and dots refuses unless `net.isIP` reads it as IPv4"
+  refuses all of them, octal included.
+- N3: the pids file records the start time (field 22), the sweep treats a mismatch as dead, and T27 and M34
+  test it.
+- N4: M28 and M29 are in order.
+- The 1.7 approval line and the Q-S1 line agree with sage-1468.
+
+## Notes (do not block)
+
+N1. D6's interpreter list has `python3` but not `python`, `python3.12` or other versioned names, and has
+`awk` but not `gawk`, `mawk` or `nawk`. `sed` (GNU `e` command), `vi`/`vim`, `less` and `php` also start a
+shell. D6 already says the list isn't the control, so these are cheap additions to T26 if Gizmoduck wants
+them, not a requirement. A basename match on `python3*` and `*awk` would cover the versioned forms.
+
+The build can start on 199's candidate.

agents/gander/README.md

@@ -1,8 +0,0 @@
-# Gander
-
-Builder seat, Codex gpt-6.1-sol, started by Sage under mos-0977 item 5 (more Codex Sol rows) for the human
-boundary row (P19 333, #1694, mos-0989).
-
-No launcher in this directory. The seat runs as a T3 thread and works in its own worktree. It has no
-credentials of its own; until the credentials row settles per-agent identity, it pushes only its own `gander/*`
-branches through the repository credential helper (mos-0981), never `refactor`, `main` or another seat's branch.

agents/gander/work/queue-196/DESIGN.md

@@ -1,332 +0,0 @@
-# Row 196: the human boundary across uids and humans
-
-Gander, 2026-10-20. Revision 3, recording approved r2 and N5. Gitea #1694, P19 333.
-Base: `96f243faf`, branch `gander/row196`. Design approval latest-by 2026-10-22, landing
-latest-by 2026-10-24 and before federation R3. This document authorizes no live action.
-
-## 1. Outcome and authority
-
-Other Linux users must not reach the tester's data or writes. A bus human proof must describe
-the process that actually connected. Console user calls must also pass the human walk and
-come directly from this bus tree's Console. Row 193 and federation R3 use that one verifier.
-
-This is not isolation from a hostile process on the instance's own uid. Keeping the human
-terminal CLI means that an unmarked process on that uid still has the owner's authority.
-Process ancestry cannot prove that a process was never an agent. Sections 4 and 8 state this
-limit without treating it as an enforcement guarantee.
-
-Inputs: COMMON at `53bb59462`, the row brief at `96f243faf`, Q175 sections 1, 6 and 8,
-federation r2 at `60b9b112a` section 3.6, Duckworth's B1-B5 at `b402197ff`, row 190's
-DESIGN.md and the row 190b brief. Q175-Q178 and the MVP plan set the order. Row 190b is on
-hold pending the host decision. This row does not assume that a separate uid is already live.
-
-Sage's `sage-1343` accepts the design direction and requires Duckworth to rule on the peer
-credential implementation. `sage-1345` keeps the control board inventory-only. Morgana's
-`morgana-0003` supplies the principal contract in section 4. Sage registers this session.
-Mos accepted removal of direct tester browser access in mos-1015, relayed by sage-1363.
-Agents test through the private socket. Any later browser view is an authenticated relay
-behind SSO, designed and reviewed in its own row. This row adds no relay.
-
-## 2. Inventory from code, not a live probe
-
-"Same uid" includes untrusted local processes. "Other uid" excludes root, which is outside
-this boundary. SSO below means Q175 is active on that instance, not merely installed.
-
-| Entry | Same uid today | Other uid today | Effect of SSO and this row |
-|---|---|---|---|
-| Main Console, default 7332, bare serve default 7330 | Loopback reads. With preview/send, matching Host, header and origin can write as owner | Same TCP reach and header forgery | Q175 SSO verifies login and refuses non-public Host except GET /healthz. This row does not change public ingress |
-| Tester TCP, default installation 7333, optional per instance | Reads and the tester instance, route, name and chat writes | Identical reach, no uid check | Q175 deliberately leaves tester separate. This row replaces TCP with a private filesystem Unix socket |
-| `<dataRoot>/bus/broker.sock` | Connects, then needs cap or proof. Claimed human PID is not the socket peer | Normally refused by bus/ 0700 and socket 0600 | SSO changes nothing. Add peer uid and PID binding, retain file checks |
-| Human wrapper to tree's human-cli.mjs | Owner if CLI path, nonce and ancestry pass. Agent ancestors refuse | Cannot connect to protected socket, and proof uid refuses | Preserve terminal owner path, add peer binding. SSO does not authenticate terminal users |
-| Tester CLI to broker.sock | Tester if its proof passes and bus.tester is exactly true. T3 agents are allowed, managed runs are not | Filesystem modes normally refuse | Same tester policy, plus peer binding. No owner/user upgrade |
-| `<dataRoot>/bus-host/launch.sock` | Requires run cap and launcher checks | bus-host/ 0700, socket 0600 | No human proof endpoint. Unchanged |
-| `<dataRoot>/bus-host/git.sock` | Git capability protocol and broker authorization | bus-host/ 0700, socket 0600 | No human proof endpoint. Unchanged |
-| Discord connector | Outbound Discord gateway/REST, no inbound local listener. Local process could tamper with same-uid files/process | No local port to call. File separation depends on uid and modes | Existing guild, user, channel, bot and webhook checks remain. Discord is not a new bus human transport |
-| Row 190 additions | Separate configs, roots, unit names, wrappers and Console ports, on one uid | Console/tester TCP still reachable | Adds no new class of listener. Row 196 derives its socket per dataRoot. Row 190 alone supplies no hostile-process isolation |
-| Control board, default 7331 | Unauthenticated transcript/board reads, POST /api/reply and /api/seen after request checks | Same loopback reach. A local client can supply matching request headers | Independent development service, outside instance SSO. Inventory only per sage-1345. Its fix needs another row |
-
-Evidence: `packages/webui/src/{cli,serve,bus}.mjs`, `packages/bus/src/{server,runtime,human,
-tester,store}.mjs`, `packages/cli/src/{launcher,git-socket,transport}.mjs`,
-`packages/discord/src/{gateway,authorize}.mjs`, `packages/control-board/src/serve.mjs`.
-Store checks bus/ with `safe(directory,true)`, including owner, symlink and mode checks.
-The dataRoot check itself does not require 0700 today. Do not describe that as a checked mode.
-
-## 3. D1: private tester HTTP socket
-
-Add `serve --tester-socket`, a boolean selecting `<dataRoot>/console/tester.sock`. No arbitrary
-path or new system config field. Create console/ as 0700. Refuse a symlink, wrong owner,
-non-directory or any group/other bits on an existing console/. Refuse a pre-existing socket
-or other entry rather than deleting it blindly. A stale socket needs an operator's diagnosis.
-Refuse a path longer than Linux's 107-byte pathname capacity before binding.
-
-Bind HTTP on the Unix path, set socket mode 0600, then verify type, owner and mode before
-declaring ready. The private parent covers the bind-to-chmod interval. Cleanup only the owned
-device/inode, as broker.sock does. Never open a TCP compatibility bridge or an abstract socket.
-Readiness failure closes the main listener too, rather than leaving a partially started Console.
-
-The tester handler keeps its fixed principal, header/cookie refusals and exact write list.
-Use a fixed logical origin `http://mosaic-tester.invalid` for URL and same-origin checks. It
-does not resolve that name. Clients send that Host and Origin plus the existing Fetch Metadata
-when required. A Host string is not authentication. Unix socket access supplies that boundary.
-The main listener still refuses x-mosaic-tester. No tester /auth route exists.
-
-`bus.tester` remains Jason's switch. Socket reach never enables tester authority by itself.
-Turning it off must refuse every tester bus call. This row adds no user or owner capability
-to the tester. Tester reads retain today's scope, including any local Console reads that are
-not bus calls. This row does not turn bus.tester into a separate HTTP read switch.
-
-### Consumers and migration paths
-
-| Consumer of 7333 | New path |
-|---|---|
-| Agent tester HTTP tools and curl probes in authorized window packets | `curl --unix-socket <dataRoot>/console/tester.sock http://mosaic-tester.invalid/...`, with the fixed Origin for writes. Add one repository helper for bounded tester HTTP requests so callers do not copy path/origin logic |
-| `scripts/mosaic ... --tester` | Already uses TESTER_CLI and broker.sock, not TCP. Keep its verbs, output and switch |
-| Browser tester page in row 176 and later window checks | Ordinary browsers cannot navigate a Unix HTTP socket. Replace automated tester HTTP checks with the socket helper. Browser visual QA uses scratch fixtures only. No local TCP relay is added |
-| `webui-service.sh` render/install and installed unit | Carry --tester-socket for new copies. Refuse a target without support. Units running old copies retain their old flags until a window |
-| `stack-release.sh` activate, plan, rehearsal and rollback | Add --tester-socket. Replace inherited --tester-port N only when explicitly requested. Refuse incompatible inherited flags before stopping units. Plan names the transport and every dropped pair. Rehearsal uses a scratch socket |
-| Gate/window Console checks, including agents' console-check scripts | Extend checks to use scratch Unix HTTP and expect no tester TCP bind. Sage owns live packet updates, including Q175 phase 2's old --tester-port 7333 instructions |
-| `docs/TOOLS.md`, webui/cli/bus READMEs and examples | Document socket invocation, fixed origin, loss of direct browser navigation and per-instance path. Historical window receipts stay unchanged |
-
-Repository search found no non-test hardcoded 7333 caller in tools/ or the harness code. The
-active windows and external seat commands still need Sage's consumer audit before re-pin.
-The build manifest will record the full search, rather than treating this draft as that audit.
-
-## 4. D2: one verified principal per bus request
-
-Internal interface: `verifyPrincipal(request, connection) -> {kind,business,id}` or refusal.
-Kinds are owner, user and tester. The connection metadata is supplied by the trusted server,
-never deserialized from JSON. No role or authority is returned. The broker looks up live policy.
-
-1. Read and validate the bounded envelope first. For human, tester and user proofs, read Linux
-   SO_PEERCRED on that accepted Unix connection before dispatch. Require a valid peer PID
-   and the bus uid. Refuse unavailable credentials, unsupported platform and errors. Cap
-   traffic keeps its capability protocol behind the validated 0700 directory and 0600 socket.
-2. Require exactly one cap, human, tester or future user envelope. Human/tester/user proof.pid
-   must equal the kernel peer PID. Verify startTime, nonce and CLI path against that process.
-   Keep the second process read after the walk. Missing, changed or exited processes refuse.
-3. Owner terminal: run the full existing human walk. Map the business to businesses[b].human.
-   No supplied human id, role or uid selects the principal. Keep today's terminal invocation.
-4. Tester: run verifyTester, retaining its deliberate difference from the human walk. An agent
-   seat may be tester. A managed-run marker or registered managed ancestor refuses. Then check
-   bus.tester. The full human walk must never be weakened to admit a session user.
-5. Session user: use the full human walk with the path-bound user-cli entry and its own nonce
-   variable, MOSAIC_BUS_USER_NONCE. Parameterize the nonce reader without admitting a human
-   or tester nonce as a user proof. Require its immediate parent to be the same tree's resolved webui/src/cli.mjs,
-   argv[2] `serve`. Check parent uid, startTime and ppid again before binding. Both child and
-   parent remain alive for the call. A different checkout or wrapper parent refuses.
-6. For user calls, the Console puts its mapped access-file user id in the verified proof's
-   user field, as federation 3.6 specifies. The id comes only from claims Q175 verified for
-   this request's live session, never from an identity cached past that session. It never
-   takes that id from a form field or verb
-   args. Return kind user, proof.business and proof.user as id only after the provenance
-   checks. R3 then validates that mapping and the live grant. Bad access.json denies users,
-   not the terminal owner. The verifier does not implement access-file policy.
-7. Owner Console calls keep the verified Q175 owner subject path. Under SSO only a subject
-   in console.sso.subjects reaches owner bus calls. They use human-cli and the same peer/walk
-   checks. A terminal owner still needs no SSO token. No anonymous main-listener fallback.
-
-The bus verifies which process supplied the session identity. It relies on that Console's
-Q175 implementation to have verified OIDC. It does not independently verify an ID token in
-this option. A provider/sub field alone, from another process, is not enough.
-
-The Console must spawn user-cli directly with its nonce already in the launch environment.
-It must not use human-cli's existing self-respawn pattern, which makes the CLI's parent a CLI.
-Apply the same initial-nonce spawn to Console human calls for consistent tests. Terminal
-human-cli can retain its self-respawn since no Console-parent condition applies there.
-Never strip agent markers from inherited environments to make a walk pass.
-
-The server binds an internal cap for this request, dispatches, and disconnects in every
-success/error/timeout path, including asynchronous task and web calls. It never returns the
-cap or a reusable principal handle. A proof copied by another process has a different kernel
-peer PID and fails. One verified CLI may make only its one request on its one connection.
-The session may hold s.user for that request. No PID or principal cache survives the connection.
-
-### Fit with rows 193 and R3
-
-Row 196 owns peer metadata, proof/walk verification and the internal principal interface.
-It supplies the Console provenance verifier and tests before R3 adds user-cli and user sessions.
-R3 owns access.json mapping and the bindUser integration, using this interface. It must not
-add a second ancestry implementation. Row 193 adds viewer and share policy to the same live
-grant check. An owner id is the business human. A user id is the access-file id, with stored
-owner string `user:<id>`. Neither row takes role from the proof.
-
-No live grant, unknown subject, duplicate owner/user mapping and invalid access file all
-deny user binding through R3's policy. Per-request authorization, access.reload and the
-30-second recheck remain R3's responsibility. Share visibility uses that check in row 193.
-Binding provenance is not a grant and never widens one. R3's user dispatch must run before
-names falls through to #agent. R3 must not land before this contract and its tests are green.
-Gizmoduck's gizmoduck-0015 and Gander's gander-0007 agree on this split. R3 keeps the reserved
-user-name mutant. Row 196 tests kind separation even if a user id resembles the owner name.
-
-### OIDC alternative
-
-The bus could verify the signed ID token itself and map its issuer/sub. That reduces reliance
-on the Console's subject assertion, but requires JWKS/provider handling, nonce or challenge
-binding, replay handling, login and logout/session lifetimes in the bus. Reusing an ID token
-on every request either creates a replay credential or expires a Console session with the
-token. A bus-issued session needs a separate lifecycle design. It also leaves the terminal
-owner and hostile same-uid limit intact. Recommend the Console provenance contract for this
-slice. Duckworth approved this option in duckworth-0006, with the live-session condition above
-and the requirement to carry section 8 R2 into P19 333 word for word.
-
-## 5. D3: obtaining kernel credentials, O1 approved with conditions
-
-All options must bind the accepted connection, not a PID a caller picked. None gets a silent
-fallback to the current proof. Sage required this comparison. Duckworth selected O1 in
-duckworth-0006, with the interpreter, proof-only and image conditions below. O4 remains the
-fallback if Python is unavailable, and needs a revised build manifest before use.
-
-| Option | What it proves and costs | Recommendation |
-|---|---|---|
-| O1 Python stdlib helper on inherited accepted socket | Node passes the accepted net.Socket as fd 3 using documented spawn stdio stream passing. Python socket(fileno=3) reads SO_PEERCRED and returns only pid,uid,gid on stdout. No socket reads, no shell, no credential values. Adds Python to bus hosts and any future bus image, with a process per admitted proof connection. Copies carry the helper and depend on the system interpreter | Selected by Duckworth, with conditions below |
-| O2 /proc/net/unix plus inode and /proc/PID/fd scans | The table identifies Unix socket entries, not an authenticated peer PID for each accepted connection. Finding a process holding an inode is racy, may have several holders and can be unreadable. The server endpoint's inode is not the client's inode | Reject as a replacement for SO_PEERCRED. No claimed proof PID may choose the scan target |
-| O3 plain Node fd passing or abstract sockets | A private inherited IPC channel can authenticate a child that this parent spawned. The bus did not spawn the independently started Console or terminal CLI. Moving the bus into the Console's child tree changes lifecycle and ownership. An abstract name supplies no filesystem mode boundary and no peer uid check by itself. Node's public net API supplies no SO_PEERCRED accessor | Reject as a drop-in. A larger bus-spawned transport design could use fd capabilities, but is outside this slice |
-| O4 small compiled helper or Node-API addon | Calls getsockopt directly, with no Python runtime. A helper can use the same inherited fd. Adds compiler/build closure and platform artifacts to stack-copy and containers. An addon also needs a supported way to obtain the accepted socket fd and Node version coverage | Viable alternative if Python is refused. Prefer a small helper over undocumented Node handles |
-
-For O1, pin the system interpreter `/usr/bin/python3`, resolving its system symlink to an
-absolute ELF binary. Require root ownership and no group/other write on that executable and
-its path components. Refuse scripts, PATH shims and any resolved path under an OS account's
-home, including /home and /root. A pyenv shim can choose an interpreter before -I -S applies.
-No PATH lookup, caller-selected interpreter or helper. Invoke the resolved binary with
-`-I -S`, a minimal environment and the absolute helper path in the same pinned copy.
-
-Activation preflight records the interpreter's resolved path, version and file identity/hash
-in its gate evidence. The bus validates and pins the resolved executable at each startup
-before opening broker.sock. The activation gate must report the same interpreter used by
-that bus. Missing, unsafe or changed resolution during that activation refuses it, never
-falling back to PATH. No secret values are recorded. Test system-owned interpreter checks
-through injected metadata.
-
-N5 decision: a later bus restart repeats the safety/version/support checks and accepts a
-safe system interpreter installed by an OS upgrade. It does not compare against an old
-activation hash. Before opening the listener, append a startup receipt with timestamp,
-copy path, resolved interpreter path, version and file identity/hash to
-`<dataRoot>/bus/peercred-starts.jsonl` (0600 in the checked 0700 bus directory). Refuse an
-unsafe receipt file or failed append. Never edit the old activation evidence. The startup
-receipt identifies the binary now in use, so the old receipt remains a historical fact.
-If an upgraded interpreter fails the checks, startup fails closed until a safe supported
-system interpreter is restored by the operator. There is no shim or O4 auto-fallback.
-
-Operator re-pin after an interpreter change: in the next authorized window, prepare the
-next reviewed copy with `scripts/stack-copy.sh copy NEW`, then run
-`scripts/stack-release.sh activate NEW BUSINESS --tester-socket` with that instance's existing
-flags and selector, first with --plan. NEW must differ from the active copy because activate
-refuses already-active. Record the interpreter in the new activation evidence and compare it
-with the bus startup receipt. A routine OS update alone does not authorize a re-pin or unit
-restart. A bus restart does not rewrite config, pointer or activation history.
-
-Preflight helper and SO_PEERCRED support too. The helper lives under packages/bus/src so
-stack-copy's closure includes it. Copies remain immutable. Document Python >=3.10 on bus
-hosts. Today's Containerfile builds the worker image and runs run-agent.sh, not the bus.
-It needs no Python change for this row. A future bus-host image must explicitly include
-the pinned system Python or use reviewed O4. No install through the node_modules symlink.
-
-Pause each proof connection while reading credentials. Limit outstanding helpers
-to 16, timeout to one second, output to one strict JSON record of at most 256 bytes. Refuse
-nonzero exit, extra output, malformed integers, missing fd and timeout. Validate pid, uid and
-gid as safe integers, pid >=2 and uid/gid >=0. Only pid and uid select the principal. gid is
-validated but grants no authority. Kill and reap helpers on shutdown. Cap envelopes never
-spawn this helper. Reading the proof envelope first is sound because SO_PEERCRED describes
-the peer at connect time. Keep the accepted Socket object owned by its connection closure,
-not a shared current-fd variable. Only the helper's duplicate fd is closed when it exits.
-
-References: [Node stdio stream passing](https://nodejs.org/api/child_process.html#optionsstdio),
-[Node Unix socket support](https://nodejs.org/api/net.html#ipc-support),
-[Python socket and getsockopt](https://docs.python.org/3/library/socket.html),
-[Linux Unix credentials and permissions](https://man7.org/linux/man-pages/man7/unix.7.html),
-[Linux proc network table fields](https://man7.org/linux/man-pages/man5/proc_pid_net.5.html).
-These support the APIs. The connection-binding behavior still needs T2 on supported Node versions.
-
-## 6. Migration and rollback
-
-No config schema or store schema changes. Old copies and units keep working until each
-instance re-pins. No new verifier is loaded into a running old broker. Do not pair a new
-Console with an old bus and call it protected. Same-tree paths intentionally refuse mixtures.
-
-The authorized window must pin bus, Console and human wrapper to one candidate. New tools
-offer `activate ID BUSINESS --tester-socket`. Plan must show the old tester-port pair removed
-and the new socket flag added, and tell Jason that direct tester browser navigation is lost.
-Mos accepted that change in mos-1015 (sage-1363). Agents test through the socket. A later
-authenticated browser relay behind SSO belongs to its own row. Without the explicit
-conversion, a candidate that no longer
-serves tester TCP refuses inherited --tester-port before stopping anything. New serve refuses
---tester-port with a migration error. It never silently changes that flag's meaning.
-
-Rollback to a copy lacking --tester-socket drops tester enablement and reports it, as today's
-tools drop unsupported flags. It does not turn the socket back into TCP. The old main Console
-and owner CLI can run with their known old limits. A failed activation's recovery may restore
-the old saved unit, including its TCP listener. Report that recovery as restoration of the old
-security state, never as a hardened deployment. After rollback, R3 and second-human access are
-not accepted until prerequisites are restored. Older operator tools cannot manage the new
-flag safely. The window must use the reviewed candidate tool blob for rollback as well.
-
-The Q173 window supplies real uid-denial evidence and the final consumer audit. No second uid,
-live socket, unit, config or secret is touched in this row's tests. Row 190b or a separate host
-still owns cross-instance file isolation. It is not replaced by SSO or this socket change.
-
-## 7. Acceptance tests and mutants
-
-All fixtures use scratch roots and ephemeral sockets, no live 7332/7333, public origin or
-provider. No real second uid. Foreign uid checks use injected metadata and name that limit.
-Use short TMPDIR paths so the longest Unix socket path stays under 108 bytes.
-
-| Test | Required evidence | Mutant killed |
-|---|---|---|
-| T1 private tester | HTTP over scratch socket reads and writes as tester only. parent 0700, socket 0600. No tester TCP listen. Wrong Host/origin and auth cookies refuse | M1 bind loopback TCP as well, M2 remove socket mode check, M3 accept owner cookie |
-| T2 real peer binding | At least 8 concurrent proof connections from distinct scratch client processes, each with its own live proof, plus a copier racing one live CLI. Barrier the helpers so connections overlap. Each genuine call must bind its own peer PID and pass, the copier must refuse. Repeat on Node 24 and 26. A lower-level helper fixture exchanges bytes both ways on the accepted socket after the helper exits, and each real bus call receives its response after helper exit. Helper failure cases all refuse | M4 use proof.pid as peer PID, M5 continue after helper error, M20 give the helper another pending connection's socket |
-| T3 uid/path refusal | Inject foreign peer uid, wrong file owner/modes, symlink parent, existing socket and long path. Inject interpreter script, user-owned ELF, home path, writable ancestor and missing executable. Refuse before dispatch, no repaired paths. Unsafe pid/uid/gid and extra helper output refuse | M6 ignore uid, M7 accept unsafe parent |
-| T4 ancestry | Agent env, binary and registered launch above owner/user refuse. Missing/reused PID, changed parent and cycles refuse. Clean terminal owner works | M8 omit walk, M9 omit identity re-read |
-| T5 Console parent | Direct CLI child from exact tree Console fixture works. Same CLI under shell, other copy, wrapper, agent ancestor or CLI respawn refuses | M10 remove direct-parent check, M11 accept any Console basename |
-| T6 principal shape | No human id or role from request body. Exactly one proof. No returned cap. Disconnect on synchronous and async failure, timeout and close. Tester agent allowed, managed tester refused | M12 accept extra identity, M13 omit disconnect, M14 use tester walk for user |
-| T7 consumer migration | Render/plan/activate/rehearse fixture carries socket flag in unit and pointer. Explicit conversion removes port. Unsupported/inherited mismatch refuses before unit calls. Rollback disables unsupported tester, never opens TCP | M15 keep inherited tester port, M16 restore TCP on downgrade |
-| T8 gates and identity | bus.tester false refuses tester calls. SSO owner/user wiring uses only claims verified for that request's live session. Expired/logged-out or replaced session cannot reuse an earlier mapped id. User kind never becomes owner from its id. R3 integration maps subject, denies missing/invalid grants and owner overlap, broken access file leaves terminal owner working | M17 bypass tester switch, M18 turn user kind into owner by id |
-| T9 isolation limits | Two scratch instances have different sockets and matching tree paths. Foreign-uid stand-in refuses. Record that no real uid boundary was exercised | M19 choose default instance socket |
-| T10 interpreter and cap path | Activation evidence records the same pinned root-owned system ELF that the bus uses. Scripts, home paths and unsafe owners/modes refuse. Simulated OS replacement followed by startup accepts a safe replacement and appends its actual identity without changing the old receipt, refuses an unsafe replacement or unsafe/unwritable receipt. Cap calls complete without invoking the helper, proven with a helper spy that fails if called | M21 bypass interpreter safety, M22 invoke helper for cap traffic, M23 retain stale interpreter identity after restart |
-
-Tests for new policy stay in the bus, WebUI and CLI packages. R3 provides the real user/grant
-half of T8 in its candidate, with its own gate. This row tests the shared verifier's user
-provenance without shipping placeholder user access. Mutants run on scratch copies,
-restore the original bytes and verify hashes. Two failures in a gate run stop and are reported.
-Single test files run freely. Ask Sage for the slot before any suite. Final acceptance is
-Duckworth's approved manifest plus Sage's bus, WebUI, CLI and scripts/test-*.sh gate.
-
-## 8. Closure, limits and review decisions
-
-R1. Same uid remains trusted OS authority. A hostile process may detach, clear its markers,
-modify argv, read same-uid pipes or capabilities, edit policy files, or interfere with the
-Console where host policy permits. SO_PEERCRED proves the connecting process identity at
-connection time. It does not prove human intent, protect memory, or track a socket passed to
-another process. Ordinary agent children fail the walk. Hostile detached agents are not
-claimed contained. Separate uids narrow cross-instance reach, not reach within one instance.
-
-R2. The Console provenance option trusts verified code and process metadata, not an independent
-bus-side OIDC exchange. That trade must be approved, not hidden behind the phrase zero trust.
-
-R3. A Unix tester endpoint removes direct browser navigation. No bridge is in this design.
-The 7331 development board remains a separately reported reachability and impersonation risk.
-
-P19 333 can record the following after the implementation gate and authorized re-pin:
-"Tester ingress is private to the instance uid. Bus human proofs are tied to the actual
-Unix peer and retain the human walk. Session-user calls require the same-tree Console as
-direct parent. Q175 phase 2 separately protects main Console ingress with verified OIDC.
-Hostile processes on the instance uid, root, and the independent development control board
-remain outside these guarantees. Cross-instance file isolation requires the uid/host gate."
-
-Duckworth requires that P19 333 also carry R2 word for word:
-"The Console provenance option trusts verified code and process metadata, not an independent
-bus-side OIDC exchange. That trade must be approved, not hidden behind the phrase zero trust."
-
-Do not mark the historical task fully closed on a design or commit. Closure needs live
-Q175 phase 2, this row's re-pin and the recorded residual accepted through Mos. A promise of
-hostile same-uid isolation would require separate OS authority for agents and a new design.
-
-Review receipt: duckworth-0006, notes at `86be181a2:agents/duckworth/work/row196/REVIEW.md`.
-Q1 selects O1 with the conditions incorporated in section 5. Q2 approves Console provenance
-with the live-session and unchanged P19 R2 conditions. B1 adds concurrent T2, M20 and socket
-survival checks. N2's detached-Console limit remains in R1. N3's gid validation and N4's
-operator window warning are included. Mos's tester-access ruling is recorded above. No
-product code begins before design approval.
-Duckworth approved revision 2 in duckworth-0009, review at
-`cb6d840df:agents/duckworth/work/row196/REVIEW-r2.md`. N5 permits either restart policy.
-Revision 3 selects safety revalidation with a new append-only startup receipt, and gives the
-operator a re-pin path that respects the existing already-active refusal.

agents/gander/work/queue-196/PLAN.md

@@ -1,121 +0,0 @@
-# Row 196 Human Boundary Implementation Plan
-
-> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox syntax for tracking.
-
-**Goal:** Bind human proofs to their actual Unix peers and make tester HTTP private to the instance uid.
-
-**Architecture:** The bus reads kernel credentials through a pinned system Python helper only for proof envelopes. One principal verifier keeps the human walk and supplies Console provenance for federation R3. Tester HTTP moves to a private filesystem socket. Release tools migrate the flags explicitly.
-
-**Tech Stack:** Linux, Node 24 and 26, Python >=3.10 standard library, existing Node test runner and shell release tools.
-
-**Spec:** `agents/gander/work/queue-196/DESIGN.md`, approved r2 at 5fe259f16, with N5 restart policy added in r3.
-
-## Global Constraints
-
-- Work in the existing gander/row196 worktree. Plain node_modules symlink. No new package dependency.
-- No live files, credentials, listeners, units, second uid or external authentication service.
-- Helpers: proof envelopes only, at most 16 concurrent, one second timeout, 256-byte strict output.
-- Root-owned system Python ELF at resolved /usr/bin/python3, never PATH or a home/shim path.
-- console/ 0700, tester.sock 0600, Unix pathname at most 107 bytes.
-- One principal and transient cap per request. R3 owns user access policy and user-cli integration.
-- Mos accepted socket-only tester access. No TCP relay or control-board change.
-- Single test files run freely. Ask Sage before any suite. Stop and report two failures in a gate run.
-- Commit code only after applicable suites pass. Sage owns the final gate and manifest queue moves.
-
-## Review Focus
-
-- Connection overlap and disconnect: helpers must retain the correct Socket object and release capacity on every exit.
-- OS interpreter replacement: restart records the actual safe binary, while old receipts remain unchanged.
-- Long or unsafe instance paths: refuse before binding or stopping any service.
-- Rollback/recovery: distinguish intentional tester disablement from restoration of an old saved TCP unit.
-- CLI nonce respawn and session expiry: direct-parent provenance must survive correct Console spawning and refuse stale identity.
-
-## Task 1: kernel credentials and interpreter evidence
-
-Files: create `packages/bus/src/peercred.mjs`, `packages/bus/src/peercred.py`,
-`packages/bus/src/interpreter.mjs`; tests in `packages/bus/tests/peercred.test.mjs` and
-`packages/bus/tests/interpreter.test.mjs`, with subprocess fixtures under `packages/bus/fixtures/`.
-
-Interfaces: `inspectInterpreter()` returns a validated immutable record of path, version,
-device, inode and sha256. `recordInterpreterStart(directory, record)` appends the actual startup
-identity safely. `createPeerReader({interpreter})` returns `{read(socket),close()}`. read resolves
-to `{pid,uid,gid}` from that exact socket, or refuses. Test-only injected OS/process operations
-do not become product flags or environment overrides.
-
-- [ ] Write interpreter safety, receipt replacement and cap-independent helper tests (T3/T10).
-- [ ] Run each new test file alone and record the expected missing-module failures.
-- [ ] Implement system interpreter validation and startup receipt append with no-follow, owner/type/mode checks.
-- [ ] Write T2's eight-process barrier plus racing copier, wrong-fd case and post-helper socket exchange.
-- [ ] Implement fd-3 helper, strict result validation, bounded async reader and helper shutdown.
-- [ ] Run `node --test packages/bus/tests/interpreter.test.mjs` and separately `node --test packages/bus/tests/peercred.test.mjs`.
-- [ ] Confirm process/socket cleanup, eight distinct kernel PIDs, copier refusal and original receipt preservation.
-
-## Task 2: principal provenance and bus dispatch
-
-Files: modify `packages/bus/src/{human,tester,server,runtime}.mjs`, create
-`packages/bus/src/principal.mjs`, add `packages/bus/tests/principal.test.mjs`, and extend
-`packages/bus/tests/human.test.mjs`. Extend server/runtime test files after inspecting their fixtures.
-
-Interfaces: `verifyPrincipal(request, {peer,...trustedPathsAndProcessReaders})` returns
-`{kind,business,id}`. Human maps to the business human, tester to tester, user to its verified
-Console proof id. No roles or grants. Server obtains peer metadata from Task 1 only after
-envelope validation and only for proofs. Existing cap dispatch never invokes the helper.
-Future user binding stays refused without R3's trusted integration.
-
-- [ ] Write T4/T5/T6/T8 process-table tests, including changed ancestry, distinct nonce namespaces and kind confusion.
-- [ ] Run the focused new file and confirm expected failure before implementing the verifier.
-- [ ] Parameterize the nonce/path portion of the existing human walk and retain all marker/binary/launch checks.
-- [ ] Wire peer metadata, interpreter startup receipt and one-request cleanup into runtime/server.
-- [ ] Test cap requests with a failing helper spy (M22), and test async refusal/close cleanup.
-- [ ] Run each affected bus test file alone. Record any base fixture changes needed for real peer identity.
-
-## Task 3: tester Unix HTTP and Console nonce spawning
-
-Files: modify `packages/webui/src/{cli,serve,bus}.mjs`, create
-`packages/webui/src/tester-socket.mjs` and `packages/cli/src/tester-http.mjs`; add focused
-`packages/webui/tests/tester-socket.test.mjs` and `packages/cli/tests/tester-http.test.mjs`.
-Extend existing WebUI transport tests.
-
-Interfaces: `startTesterSocket({dataRoot,...handlerOptions})` owns the private listener and
-cleanup. `testerRequest({dataRoot,method,path,body})` uses the fixed logical origin and bounded
-Unix HTTP. Console human child spawning supplies its initial nonce, preserving agent markers.
-R3 reuses that spawn pattern for its user-cli.
-
-- [ ] Write T1/T3/T9 socket permission, unsafe-path, wrong-origin and instance separation tests.
-- [ ] Confirm the new focused files fail, then implement --tester-socket and refusal of --tester-port.
-- [ ] Keep tester principal, write allowlist and cookie/header refusals intact. Add no browser relay.
-- [ ] Write and implement the initial-nonce Console spawn test and the helper request timeout test.
-- [ ] Run each new or changed test file alone, verifying cleanup and no tester TCP bind.
-
-## Task 4: release migration and operator evidence
-
-Files: modify `scripts/{webui-service,stack-release}.sh`, inspect
-`scripts/stack-copy.sh` closure, extend `packages/cli/tests/stack-release.test.mjs` and its
-render fixtures. Update `docs/TOOLS.md` and package READMEs with the implementation.
-
-Interfaces: `activate ID BUSINESS --tester-socket` explicitly replaces inherited tester-port
-flags. Pointer and unit argv agree. Candidate support and interpreter preflight run before
-any unit stop. Activation gate evidence records the same interpreter as the bus startup receipt.
-
-- [ ] Write T7 explicit conversion, inherited mismatch and unsupported-target refusal fixtures.
-- [ ] Run only the affected test file, then implement flag rendering, plan output and rollback disabling unsupported tester.
-- [ ] Preserve old-copy recovery behavior and report restored old security state accurately.
-- [ ] Add rehearsal scratch socket and T10 interpreter gate identity comparison.
-- [ ] Verify same-copy activation refusal is preserved. Document N5's next-reviewed-copy re-pin path.
-- [ ] Run the affected file alone, shell syntax checks, and inspect remaining tester-port references by purpose.
-
-## Task 5: mutants, approved suites and manifest
-
-Files: add the row's mutation runner and receipts under `agents/gander/work/queue-196/`.
-Append BUILD-LOG phase receipts. No SESSIONS or queue file edits.
-
-- [ ] Exercise M1-M23 against isolated scratch copies. Record killer test, restored hash and cleanup for each.
-- [ ] Run focused tests on Node 24 and 26, including the concurrent T2 case and socket lifetime checks.
-- [ ] Send Sage the scope and estimated duration, obtain the suite slot, then run approved bus/WebUI/CLI suites.
-- [ ] Let Sage own the scripts/test-*.sh gate. Stop on the repository's two-failure rule.
-- [ ] Build the exact changed-path manifest with acceptance evidence, search results, limits and consumer audit.
-- [ ] Commit/push the verified candidate only after applicable suites pass. Send Duckworth and Sage path, commit and hashes for manifest review.
-
-Execution stays with Gander in this worktree. No new agent delegation. Duckworth reviews
-the manifest independently. Push is only to gander/row196. No merge, re-pin or deployment
-is authorized by this plan.

agents/honker/README.md

@@ -1,7 +0,0 @@
-# Honker
-
-Builder seat, Claude Opus 5.5, started by Sage for MVP T1 row 194 (agent lifecycle, #1692) under mos-0974 and mos-0977.
-
-No launcher in this directory. The seat runs as a T3 thread and works in its own worktree. It has no
-credentials of its own; until the credentials row settles per-agent identity, it pushes only its own `honker/*` branches
-through the repository credential helper (mos-0981), never `refactor`, `main` or another seat's branch.

agents/launchpad/README.md

@@ -1,7 +0,0 @@
-# Launchpad
-
-Builder seat, Claude Opus 5.5, started by Sage for MVP T1 row 192 (Q175 SSO phase 1, #1690) under mos-0974 and mos-0977.
-
-No launcher in this directory. The seat runs as a T3 thread and works in its own worktree. It has no
-credentials of its own; until the credentials row settles per-agent identity, it pushes only its own `launchpad/*` branches
-through the repository credential helper (mos-0981), never `refactor`, `main` or another seat's branch.

agents/morgana/README.md

@@ -1,7 +0,0 @@
-# Morgana
-
-Builder seat, Claude Opus 5.5, started by Sage for MVP T1 row 193 (human users and RBAC, #1691) under mos-0974 and mos-0977.
-
-No launcher in this directory. The seat runs as a T3 thread and works in its own worktree. It has no
-credentials of its own; until the credentials row settles per-agent identity, it pushes only its own `morgana/*` branches
-through the repository credential helper (mos-0981), never `refactor`, `main` or another seat's branch.

agents/sage/work/q175-sso/DESIGN.md

@@ -338,14 +338,10 @@ them. Each entry has its own issuer, client, algs and subjects, and a session re
    1. Back up the store, the pointer, the unit and config.json.
    2. Pin the phase 1 copy with the Console stopped. The copy's loader accepts a config with or without
       `console`, so the bus and seats keep reading the old config.
-   3. Straggler check (Mos's C1 condition, mos-0977): list every running process, unit and timer that
-      still runs from the old copy and reads config.json. Each one is restarted on the new copy or shown
-      not to re-read config. The old loader refuses the key, so a straggler would fail on its next read.
-      Step 4 waits until the list is clean.
-   4. Jason step 4: the `console.sso` key goes into config.json, written by Jason or by an agent on his go
+   3. Jason step 4: the `console.sso` key goes into config.json, written by Jason or by an agent on his go
       for that one key. The new loader reads it back (`scripts/mosaic-config.mjs` validate) before anything
       starts.
-   5. Start the Console with `--sso --send --tester-port 7333`.
+   4. Start the Console with `--sso --send --tester-port 7333`.
    Acceptance: Jason signs in through the Console flow, sends one message and signs out. The forged-header
    check (a request with `X-authentik-username` and no cookie gets 401) runs either on a scratch Console or
    on live by Mos or Jason (B6). No agent sends the auth header to the live 7332 (section 8). The scratch

agents/sage/work/t1-seats/COMMON.md

@@ -1,48 +0,0 @@
-# Common start for Sage's MVP T1 builder seats (mos-0974, mos-0977)
-
-You are a builder seat on Mosaic Stack, repository /mnt/storage/src/mosaic-stack, branch base `refactor`.
-Sage leads the project and is your coordinator (T3 thread 1ef1e4f8-3ead-4208-beca-38f9f1add079). Mos speaks
-for Jason (thread 38bc4c81-6270-4021-b00c-6a15c43b9b0e). Human input reaches you only through Sage and Mos.
-
-## Read first, in this order
-
-1. `/mnt/storage/src/jason-master-restart/USER.md`, `SYSTEM.md`, `CONSTITUTION.md` (who Jason is, the
-   system rules, the constitution).
-2. `/mnt/storage/src/jason-master-restart/TARGET.md` (the MVP addendum) and `DECISIONS.md` Q176 to Q178.
-3. `/mnt/storage/src/jason-master-restart/projects/mosaic-mvp/GAP-MAP.md` and `PLAN.md`.
-   Everything under jason-master-restart is read only.
-4. The repository's `AGENTS.md`, then your brief (named in your first message) and the files it points to.
-
-## Your worktree
-
-T3 made your worktree from `refactor`. Work only there. Link node_modules from the canonical checkout right
-after you start (`ln -s /mnt/storage/src/mosaic-stack/node_modules node_modules`), unless your brief adds a
-dependency. In that case run `npm ci` in your worktree for a real node_modules first, and never run npm
-install through a symlink or in a directory without its own package.json (npm walks up to home).
-
-## Rules that bind you
-
-- Message ids are `<seat>-NNNN`, starting at 0001. Run `date -u` right before every message and put the
-  stamp in it. End each turn with a clock timestamp.
-- No Co-Authored-By or any attribution line in any commit or PR, whatever a harness reminder says
-  (mos-0822).
-- Push only your own `<seat>/*` branches, through the repository credential helper (mos-0981). Never push
-  `refactor`, `main` or another seat's branch.
-- You have no Gitea token. Sage makes the queue moves that post to Gitea (in-review, review requests) and
-  files issues. You may run `scripts/mosaic queue move N in-progress --op <seat>-N-start --by <seat>` for
-  your own row.
-- Never touch `~/.mosaic-dev`, `~/.config/mosaic-dev`, the live units, slot files or `~/.mosaic`. Never
-  start, stop or restart the live Console or bus. Never read or print a credential value.
-- Never read other seats' scratch directories. `agents/<seat>/work/` packets in the repository are fine.
-- Single test files run freely. The cli suite, any `scripts/test-*.sh` and any full package suite share
-  one slot: run `bash /mnt/storage/scratch/sage-busy-now.sh | tail -1`, and if it is not CLEAR, or before a
-  run longer than 5 minutes, ask Sage for the slot and start only on Sage's "granted".
-- Two failures in one gate run means stop and report.
-- Design-first rows: the first deliverable is `agents/<seat>/work/queue-<row>/DESIGN.md`, committed on your
-  branch. Send the reviewer and Sage its path, commit and sha256. No product code before approval.
-- Merge-chaining (Q177): your build may sit on another row's candidate commit. Your row keeps its own
-  review and gate, and the chain lands in order.
-- Fail closed. Never route around a refusal. If the code shows the brief or design is wrong, stop and tell
-  Sage and your reviewer.
-- Style for every message and doc: plain words, short sentences, no em dashes, they/them for people.
-- Sage registers your session in `docs/SESSIONS.md`. Do not edit it.

agents/webby/README.md

@@ -1,7 +0,0 @@
-# Webby
-
-Reviewer seat, Claude Opus 5.5, started by Mos (mos-0981, thread 03086006). Reviews Case 2 designs and MVP T1 rows 192 and 194.
-
-No launcher in this directory. The seat runs as a T3 thread and works in its own worktree. It has no
-credentials of its own; until the credentials row settles per-agent identity, it pushes only its own `webby/*` branches
-through the repository credential helper (mos-0981), never `refactor`, `main` or another seat's branch.

docs/SESSIONS.md

@@ -1361,5 +1361,49 @@ are never rewritten or removed; corrections are new entries.
 2026-10-20T18:34:53Z | Filbert (Opus 5.5, 048f3c63) | Q175 SSO design review r2 (DESIGN.md blob 3eb718b5e131 at 1a268249e), static | changes: C1 config.json console key fails old loaders (mosaic-config.mjs:113 rejects unknown keys; key add inside phase 2 window, rollback removes it, loader test), C2 app.js signs out only on opaqueredirect so 401 never shows sign-in; notes on tests 15/7/9a, Q-B 200-HTML classification, scratch Console flags; Q-E keep iss/sub escaped and capped; verdict sent to Sage, no Gitea/queue record
 2026-10-20T18:40:20Z | Filbert (Opus 5.5, 048f3c63) | Q175 SSO design review r3 (DESIGN.md blob a152fd58e18e at 817e8f51b), static | approve on condition D1 (slot file checks stay out of shared loader, shape-only there) as a line edit; D2 notes: slot root from configDir, scratch dataRoot, name discovery GETs for Mos; C1/C2 and notes verified; Mos C1 sequence confirm still open; no Gitea/queue record
 2026-10-20T18:41:20Z | Filbert (Opus 5.5, 048f3c63) | Q175 SSO design D1/D2 check (DESIGN.md blob eba861f5d2bb at d55d86bb0), static git diff 817e8f51b..d55d86bb0 | ack: D1 and D2 match; design approved; Mos C1 sequence confirm still open; no Gitea/queue record
-2026-10-20T18:57:10Z | Filbert (Opus 5.5, 048f3c63) | row 190 design review r2 (#1688, DESIGN.md sha256 5493c9df3ec0) | CHANGES to Darkwing, cc Sage: B1 claim check on MOSAIC_CONFIG-only selection, B2 shared prefix drop-in dirs; N1-N7 notes; static read, no slot, no Gitea or queue record
-2026-10-20T19:00:04Z | Filbert (Opus 5.5, 048f3c63) | row 190 design review r3 (#1688, DESIGN.md sha256 98236a1aff98) | APPROVE to Darkwing, cc Sage: B1 and B2 closed with M13 and M14, N7 settled by Sage's 48ebee0ff; static read, no slot; manifest round gets a queue review record (sage-1337)
+2026-10-20T18:51:09Z | Duckworth (Opus 5.5) | Gizmoduck federation design r1 review (DESIGN.md blob 0f4570d478f5 at 6925f78f0, code at 9ae8c73ac), static | changes B1-B5 (forwarded user identity, ownership code, business-wide reads, revocation ends no runs reliably, one-uid isolation); notes N1-N9; agents/duckworth/work/federation-r1/REVIEW.md
+2026-10-20T18:58:59Z | Duckworth (Opus 5.5) | Gizmoduck federation design r2/r2.1 re-review (5ad67f671, parents 60b9b112a, 6925f78f0; code 9ae8c73ac), static | changes B6 only (user from_role breaks the runner reply path, runner.mjs:450 vs broker.mjs:1862); B1-B5 resolved; C1 line edit (systemd-run escape); N10; agents/duckworth/work/federation-r1/REVIEW-r2.md
+2026-10-20T19:03Z | Duckworth (Opus 5.5) | federation design r3+r3.1 re-review (Gizmoduck 5ad67f671..a2840a6be), duckworth-0003 | changes B7 (R8 gate lacks sudo/ssh privilege-path checks in both isolation forms), B1-B6 resolved, N11 #waiting, N12 thread_shares
+2026-10-20T19:10Z | Duckworth (Opus 5.5) | federation design r4 re-review (Gizmoduck a2840a6be..a659e41f3), duckworth-0005, plus mos-1007 rulings | changes B8 (hub issuer and TLS front end not in R8 gate), B7/N11/N12 resolved, sudo deviation accepted, N13-N15
+2026-10-20T19:14Z | Duckworth (Opus 5.5) | row 196 design r1 review (duckworth-0006), Gander 76b5c8d93 | changes B1 (concurrent peer-binding test), Q1 O1 with interpreter pin, Q2 Console provenance approved
+2026-10-20T19:16Z | Duckworth (Opus 5.5) | federation design r4.1 re-review (duckworth-0007), Gizmoduck a659e41f3..73677b87d | changes, B8 issuer-host point left; TLS, N13-N15 resolved; notes N16-N19
+2026-10-20T19:18Z | Duckworth (Opus 5.5) | row 193 design r2 review (duckworth-0008), Morgana 19c015741 | changes B1 (5.7 owner-visible reads), B2 (5.7 filters before user threads go live); rulings 1-6
+2026-10-20T19:19Z | Duckworth (Opus 5.5) | row 196 design r2 re-review (duckworth-0009), Gander 76b5c8d93..5fe259f16 | approve; note N5 interpreter change on restart
+2026-10-20T19:20Z | Duckworth (Opus 5.5) | federation design r4.2-r4.4 re-review (duckworth-0010), Gizmoduck 73677b87d..b67bc6de9 | changes B9 (user-thread decision route :1683); B8, N16-N19 resolved; note N20
+2026-10-20T19:22Z | Duckworth (Opus 5.5) | row 193 design r3 re-review (duckworth-0011), Morgana 19c015741..76f4605e1 | changes B3 (5.7 table omits project.file reads), B1 B2 N1-N4 resolved
+2026-10-20T19:22Z | Duckworth (Opus 5.5) | federation design r4.5 re-review (duckworth-0012), Gizmoduck b67bc6de9..acd5f1f42 | approve, B9 N20 resolved, note N21 R6 notice wording
+2026-10-20T19:25Z | Duckworth (Opus 5.5) | row 199 design r1 review (duckworth-0013), Megavolt 624e8ea3a | changes B1 (missing store file stops bus start), B2 (token not bound to remote host, redirects), notes N1-N5
+2026-10-20T19:25Z | Duckworth (Opus 5.5) | row 193 design r4 re-review (duckworth-0014), Morgana 76f4605e1..edc794933 | approve, B3 and N5 resolved
+2026-10-20T19:29Z | Duckworth (Opus 5.5) | row 199 design r2+r3 re-review (duckworth-0017), Megavolt c2c729ddf | changes B3 (T3 fake is http, https-only flags untested), B4 (decision binds no commit, push by ref name)
+2026-10-20T19:29Z | Duckworth (Opus 5.5) | row 193 design r5 re-review (duckworth-0018), Morgana e2d161e2e | approve
+2026-10-20T19:29Z | Duckworth (Opus 5.5) | federation design r4.6 re-review (duckworth-0019), Gizmoduck 1b32e65e3 | approve
+2026-10-20T19:30Z | Duckworth (Opus 5.5) | federation design r4.7 re-review (duckworth-0020), Gizmoduck 2d3c3cfbd | approve, N22 (R8 checks the mosaic user's properties)
+2026-10-20T19:31Z | Duckworth (Opus 5.5) | federation design r4.8 re-review (duckworth-0021), Gizmoduck eb651aa68 | approve, N22 resolved
+2026-10-20T19:33Z | Duckworth (Opus 5.5) | row 199 design r4 re-review (duckworth-0022), Megavolt e1aa6216c | approve, N9 (post-routing source commit)
+2026-10-20T19:36Z | Duckworth (Opus 5.5) | Q180 tightening plan r2 review (duckworth-0023), ops-01 plan sha256 1084aa15, #421 | changes B1-B5 (lockout proof, new key off factory hosts, live group removal, cloud-init order, unlisted paths)
+2026-10-20T19:36Z | Duckworth (Opus 5.5) | federation r4.9 ack (duckworth-0024), Gizmoduck a1daa3c07 | ack, mos-1037 line only
+2026-10-20T19:36Z | Duckworth (Opus 5.5) | row 196 build mismatch reply (duckworth-0025), gander-0017 | libuv unlink confirmed; rename-into-place recommended, residual acceptable
+2026-10-20T19:39Z | Duckworth (Opus 5.5) | row 199 design r5 review (duckworth-0026), Megavolt 34bfe4a53 DESIGN.md sha256 d0b326bb | changes B5 (D9a ls-remote and push still name the upstream, not the derived fork), B6 (state the URL parse, name rule, case-insensitive owner compare)
+2026-10-20T19:42Z | Duckworth (Opus 5.5) | row 199 design r6 review (duckworth-0027), Megavolt 4d3007ec9 DESIGN.md sha256 aa458dfe | approve; B5 B6 N10 N11 resolved, D9c normalization claims checked in node
+2026-10-20T19:44Z | Duckworth (Opus 5.5) | Q180 tightening plan r3 review (duckworth-0028), ops-01 plan sha256 cd7165bf, #421 | changes B6 (root persistence sweep on all four hosts or rebuild 1012); B1-B5 N1-N3 resolved
+2026-10-20T20:02Z | Duckworth (Opus 5.5) | #423 VM tightening r4 steps 1-3 review (duckworth-0032), ops-01 plan sha256 03cd1075 (amends eadff6b6) | changes B1 (step 2 verify must read sshd -T permitrootlogin and root's authorizedkeysfile); N1-N7; steps 4-5 not reviewed (held, mos-1061/1062)
+2026-10-20T20:02Z | Duckworth (Opus 5.5) | row 201 FED R1 manifest review r1 (duckworth-0033), Gizmoduck 80fe31071 | approve; digests match, access.test.mjs 24/24 in scratch worktree; deviation 2 reading confirmed; N1 covers without level, N2 checked grants only
+2026-10-20T20:02Z | Duckworth (Opus 5.5) | federation design r4.10 + r4.11 ack (duckworth-0034), Gizmoduck 3568441ab and b93f098f0 | ack; R8 recorded acceptance, quotes checked vs DECISIONS Q182/Q183, call A blocking agreed, call B correct; N1 N2 doc-only
+2026-10-20T20:05Z | Duckworth (Opus 5.5) | #423 VM tightening r5 steps 1-3 diff review (duckworth-0035), ops-01 r5 sha256 4cbdc48e on base 03cd1075 | approve steps 1-3; B1 N1-N7 resolved, recount 18 checked; a #424-changed step 1 returns as a diff; N8-N10
+2026-10-20T20:11Z | Duckworth (Opus 5.5) | row 204 (193a) round 1 manifest review, morgana/row193a 0caf6e2f6, digest d38de8c9 | approve (duckworth-0037), N1-N3 notes, 5/5 and 26/26 single-file
+2026-10-20T20:14Z | Duckworth (Opus 5.5) | PRD 1.7 draft REQ-CRED-3 review, honker/row194 0bb1a3bd0 sha256 0236dee8; row 204 queue record rev 2335 | changes B1-B2 (duckworth-0038), quotes match DECISIONS 1c368ff
+2026-10-20T20:16Z | Duckworth (Opus 5.5) | PRD 1.7 draft r2 diff check, honker/row194 11cb0423b sha256 e896746d | approve (duckworth-0039), B1-B2 resolved
+2026-10-20T20:18Z | Duckworth (Opus 5.5) | row 202 FED R5 round 1 manifest review, quackerjack/fed-r5 030809e15 manifest 959bfb275 | changes B1 (duckworth-0040), BusinessError from loadAccess/loadBusiness escapes uncaught (probed), N1-N9, 18/18 single-file
+2026-10-20T20:24Z | Duckworth (Opus 5.5) | row 202 FED R5 round 2, Quackerjack candidate 48a3fb96e manifest 7fd265033 | approve (duckworth-0041), B1 resolved, 21/21 single-file, N1-N4
+2026-10-20T20:34Z | Duckworth (Opus 5.5) | row 210 (#1707) DESIGN.md r1, Gizmoduck 7b10bc0ff | changes B1-B4 (duckworth-0042): argv not in event log, decision stdin unseen, orphan ssh-agent after bus death, section 4 not routed to Jason; N1-N8
+2026-10-20T20:39Z | Duckworth (Opus 5.5) | row 210 DESIGN r2 diff check, Gizmoduck b726e10f4 | approve with C1 (duckworth-0043): B1-B4 resolved, Q-J0 revoke line must match section 6 before Mos sends it; N1-N5
+2026-10-20T20:42Z | Duckworth (Opus 5.5) | row 210 DESIGN r3 C1 diff check (duckworth-0044) on Gizmoduck e021dfa26 | C1 met, approve stands, N1
+2026-10-20T20:43Z | Duckworth (Opus 5.5) | #423 r5 step 4 .53 jarvis sudo and groups (duckworth-0045), reboot timing per mos-1092 | approve with C1-C4, reboot stands in for B3 restart
+2026-10-20T20:45Z | Duckworth (Opus 5.5) | #423 step 4 scripts (step4.sh, check4.sh, postboot.sh, boot-session optional block) vs duckworth-0045 (duckworth-0046) | C1 C3 met, C2 C4 open, N1-N2
+2026-10-20T20:47Z | Duckworth (Opus 5.5) | row 195 DESIGN r2 review (duckworth-0047) on Darkwing 818b79696 | changes B1 (.53 activate, gate, stopped-store backup), N1-N6
+2026-10-20T20:49Z | Duckworth (Opus 5.5) | #423 step 4 revised scripts (step4.sh 5aea3856, check4.sh 8f49a409, containers.sh 837bb7a4, postboot.sh, boot-session f0645604) (duckworth-0048) | C1-C4 met, C5 stale shas in boot-session block, N1-N3
+2026-10-20T20:51Z | Duckworth (Opus 5.5) | #423 step 4 N1/N2 diff and C5 check, step4.sh cc16d384, boot-session ed44ec81 (duckworth-0049) | holds, no new condition
+2026-10-20T20:59Z | Duckworth (Opus 5.5) | row 195 DESIGN r3 review, Darkwing 9a16d7795 blob 0fea86616b36 (duckworth-0050) | changes, B1 ACT/TO hand-off, B2 gate poll and PM journal read
+2026-10-20T21:11Z | Duckworth (Opus 5.5) | row 195 DESIGN r4 review, Darkwing 0075be358 blob 3f8590016b40, with mos-1098 items (duckworth-0051) | changes, B1 rollback open-activation, B2 profile upgrade owner
+2026-10-20T21:22Z | Duckworth (Opus 5.5) | row 210 round 1 code review (duckworth-0052) on Gizmoduck 12ffe0b56 | changes B1 (sshd skip passes the gate), N1-N5; 17 singles 134/0
+2026-10-20T21:33Z | Duckworth (Opus 5.5) | row 210 round 2 diff check (duckworth-0053) on Gizmoduck 455964f23 | approve, B1 met (missing sshd fails 13, skipped 0), N1-N3 taken; 17 singles 137/0/0 skipped

docs/plans/2026-10-20_agent-lifecycle.md

@@ -1,47 +0,0 @@
-# Brief: agent lifecycle from the Console and the CLI, with a per-agent hire/fire veto
-
-Sage, 2026-10-20, for mos-0974 (MVP, DECISIONS Q176, Vikunja #414 "User and main agent can create and spawn
-agents" and "User maintains ability to terminate, regenerate, or create agents via WebUI or CLI ad-hoc", #415
-Case 1 "Chief of staff agent has hire/fire authority for agents as needed; unless user forbids per agent" and
-"User maintains ability to restructure organization at will"). Gitea #1692. T1 item 5. Owner Honker, reviewer Webby (mos-0981), gate
-owner Sage. Base: refactor at the brief commit.
-
-Design first. The first deliverable is `agents/honker/work/queue-194/DESIGN.md`. Webby reviews it before any
-code.
-
-## What exists today (GAP-MAP.md G8, G9, C1.5, C1.6, measured at 9ae8c73ac)
-
-- The chief launches only listed instances (`roles/chief-of-staff.json`, harness `tools.mjs` launch,
-  `broker.mjs:1968`). No user verb launches an arbitrary agent.
-- Terminate exists (`packages/cli/src/cli.mjs:447`, `instances.mjs:9-11`, webui `serve.mjs:288, 535`). There
-  is no regenerate, no delete and no Console launch.
-- Instance changes need a bus restart (`instance-settings.mjs:35,75`, `organization.mjs:83`). Add and change
-  only, no delete.
-- Human-only membership acts as a veto today, but there is no per-agent veto list.
-
-## What the design must settle
-
-1. The verbs: create (from a role and a name), launch, terminate, regenerate (a fresh session with the same
-   identity and role), and delete (with what happens to its sessions, workspace and run evidence, which
-   stays write-once). Each one is a human verb on the CLI and a Console action.
-2. Chief hire/fire. What the chief may do on its own, and the per-agent veto: the human marks an agent so
-   the chief can't fire or replace it, and marks roles the chief can't hire. Where the veto lives and how
-   the broker enforces it.
-3. Live changes. Which changes take effect without a bus restart, and how a running bus picks them up
-   safely.
-4. RBAC. Human roles come from row 193 (Morgana). Until it lands, these verbs are owner-only. The design
-   states the hook that row 193 fills.
-5. Per instance. Row 190 runs one instance per OS user. Lifecycle verbs act on their own instance only.
-6. The kill switch (row 191, Rocko) refuses every launch path. These new launch paths check it too.
-
-## Boundaries
-
-- No test touches `~/.mosaic-dev`, `~/.config/mosaic-dev`, the live units or a slot file.
-- Role authority is declared in `roles/` and changes only by reviewed commits (AGENTS.md invariant 7). This
-  row adds verbs, not new role authority. Any role file change is called out for review.
-- The build may chain on rows 190, 191 and 193 candidates (Q177).
-
-## Gate
-
-Webby approves DESIGN.md, then the manifest. The bus, cli, business and webui suites and every
-`scripts/test-*.sh` are green on Sage's gate, and the design's mutants are killed.

docs/plans/2026-10-20_hub-own-uid.md

@@ -1,46 +0,0 @@
-# Brief: Melanie's hub instance under its own Linux user (row 190b)
-
-Sage, 2026-10-20, from Darkwing's draft (agents/darkwing/work/queue-190b/BRIEF-DRAFT.md) for Mos's ruling
-mos-0986 (2026-10-20T18:53:48Z) on row 190 R1. Mos ruled a separate uid per instance a hard precondition of
-federation R8 (mos-0984, mos-0985) and of Case 2 row C2-13. The finding was federation review B5
-(duckworth-0001): on one uid any factory agent can read, write and control Melanie's hub directly, and SSO and
-RBAC don't stop a local process with filesystem access. On the 10-27 MVP path. Gitea #1693.
-
-Owner Darkwing (Opus 5.5), reviewer Duckworth (author of B5; mos-0981 keeps new work off Filbert and Dewey),
-gate owner Sage. Merge-chained on row 190 (Q177): it builds on row 190's candidate and keeps its own review and
-gate. Design first. The first deliverable is `agents/darkwing/work/queue-190b/DESIGN.md`.
-
-## Goal
-
-Melanie's hub instance runs under its own Linux user. No process of the factory instance can read or write the
-hub's config, data root or secrets, or control the hub's units. That covers the bus, role seats and their
-sessions, task runs, the Discord connector and the Console.
-
-## The design must state
-
-1. How operators (Mos, Sage, Jason) deploy, re-pin and roll back the hub. Which commands they run, as which
-   user, and what each one needs.
-2. Each root step Jason runs: useradd, the home and its modes, `loginctl enable-linger`, and any sudoers rule,
-   with the exact command lines.
-3. How the hub reaches the Claude proxy and gets its session env without sharing jwoltje's
-   `claude-session.env`.
-4. Whether real isolation needs the factory instance's seats to run apart from the operators' uid. If yes, say
-   so plainly with its cost. Don't design around it.
-
-It must also cover the copies (shared read-only trees under jwoltje's home, or the hub's own), the human CLI
-wrapper and human proof for the hub's Console, and how the stack-release pointer, log and backups work under
-the second user.
-
-## Boundaries
-
-- Row 190 lands first, as designed: one uid, scratch two-instance tests without root.
-- No agent runs a root step. Every one goes to Jason as an exact command list.
-- No real hub user, unit or data root is created in this row's tests. Tests use scratch roots and stand-ins as
-  row 190 does. Anything that needs a second real uid is a Q173 window with a backup first and a STATE report
-  after.
-- No tunnel or Traefik exposure. That waits for Jason, after Q175 SSO.
-
-## Gate
-
-Duckworth approves DESIGN.md, then the manifest. The cli suite and every `scripts/test-*.sh` are green on
-Sage's gate. The design's mutants are killed.

docs/plans/2026-10-20_human-boundary.md

@@ -1,62 +0,0 @@
-# Brief: the human boundary across uids and humans (P19 333)
-
-Sage, 2026-10-20, for Mos's order mos-0989 (P19 333, MOSAICSTA-173, is now on the 10-27 path: federation R3 and
-row 193 need it). Gitea #1694. Owner Gander (Codex gpt-6.1-sol, a new builder seat under mos-0977 item 5),
-reviewer Duckworth, gate owner Sage. Latest-by: DESIGN.md approved by 2026-10-22, landed by 2026-10-24, and in
-any case before federation R3 lands. R3 and row 193 may chain on this row's candidate (Q177). Base: refactor at
-the brief commit. Design first. The first deliverable is `agents/gander/work/queue-ROW/DESIGN.md`.
-
-## The problem, as filed and as it now matters
-
-P19 333 as filed (row 87, mos-0657): the Console listens on a loopback TCP port, and any host process that
-reaches it, under any uid, acts as Jason. Jason accepted that as a documented limit for a one-user host
-(mos-0787, row 161). Two things change that:
-
-- Row 190b (#1693, mos-0986) puts Melanie's hub under its own Linux user. Factory processes then sit on another
-  uid, on the same host, next to the hub's ports and socket. The other-uid reach is now the Case 2 threat.
-- Federation r2 (gizmoduck-0004, 60b9b112a) binds a bus user only from a user-cli whose proof passes the human
-  walk, whose direct parent is the bus's own Console, and which holds a live grant. That rule rests on the
-  path-bound human proof (#225): today a same-uid process that runs the tree's `human-cli.mjs` acts as the
-  human, without touching the Console. The Q175 design (section 8) names that limit and leaves it here.
-
-## What already settles part of it
-
-- Q175 phase 2 (#412) settles the Console-ingress part on the main port. Under `--sso`, 7332 answers any
-  non-public Host with 403 except `GET /healthz`, and every other request needs a verified OIDC session. A
-  process on another uid that reaches the port gets only `/healthz`. Phase 1 (row 192) builds it; it is live
-  only after the phase 2 window.
-- Row 189 (`--no-send`) is interim only. Until phase 2 the Console takes no human writes, so the reach is
-  read-only. It settles nothing.
-- Row 190b separates files and units by uid. Whether the hub's `broker.sock` refuses the factory uid depends on
-  its directory and socket modes, which this row checks and tests rather than assumes.
-
-## What the design must settle
-
-1. Inventory every listener and entry point per instance: the Console port, the tester listener (7333 today),
-   `broker.sock`, the human CLI wrapper, the Discord connector and anything row 190 adds. For each: who can
-   reach it today from the same uid and from another uid, with and without `--sso`.
-2. The tester listener. It serves reads and the row 175 tester writes to anything that reaches it, on any uid.
-   Close the other-uid reach (for example a unix socket with 0600 modes, or a peer-uid check on loopback), or
-   bring Mos a concrete reason it must stay open. bus.tester stays Jason's switch.
-3. The bus human boundary. How the bus tells the human's own verified call from a same-uid process that runs
-   `human-cli.mjs`. State what federation R3's direct-parent rule needs from the bus (peer credentials on
-   `broker.sock`, the parent check, how it can't be forged by a child of an agent), and what stays possible for
-   a same-uid process after this row. Say it plainly where a residual limit remains.
-4. Fit with row 193 (Morgana, human users and roles; Mos's B1 rule: a principal comes only from something the
-   bus verifies) and with federation R3. One mechanism, not three.
-5. Migration: the live single-user Console and bus keep working until each instance re-pins.
-6. Which parts of P19 333 this row closes, which parts Q175 phase 2 closes, and what P19 333 says when it is
-   closed.
-
-## Boundaries
-
-- Who can reach the Console from outside stays Jason's. This row changes what a host process can do once it
-  reaches a local port or socket.
-- No test touches `~/.mosaic-dev`, `~/.config/mosaic-dev`, the live units or a slot file. No test creates a real
-  second uid; use stand-ins as rows 190 and 190b do, and name any part only a Q173 window can prove.
-- No request to the live 127.0.0.1:7332 or 7333, mosaic.woltje.com or auth.diversecanvas.com.
-
-## Gate
-
-Duckworth approves DESIGN.md, then the manifest. The bus, webui and cli suites and every `scripts/test-*.sh`
-are green on Sage's gate, and the design's mutants are killed.

docs/plans/2026-10-20_human-users.md

@@ -1,56 +0,0 @@
-# Brief: many humans per business, human roles, private and shared threads
-
-Sage, 2026-10-20, for mos-0974 and mos-0977 (MVP, DECISIONS Q176, Vikunja #414 "RBAC enforcement" and #415
-Case 1 "Additional users can be configured for access" and "Shared and private agent sessions available per
-user; RBAC"). Gitea #1691. T1 item 3. Owner Morgana, reviewer Duckworth, gate owner Sage. Base: refactor at the brief
-commit.
-
-Design first. The first deliverable is `agents/morgana/work/queue-193/DESIGN.md`. Duckworth reviews it before
-any code.
-
-## What exists today (GAP-MAP.md, measured at 9ae8c73ac)
-
-- One human per business: `packages/business/src/business.mjs:160`, and the broker's human check
-  (`packages/bus/src/broker.mjs:532-538`).
-- Threads have an owner field only (`packages/bus/schema.sql:247`, `broker.mjs:353-360`). Nothing is private
-  or shared.
-- RBAC covers agents only (`role.mjs`, `vocabulary.mjs`, `broker.mjs:769-799`, harness `gate.mjs`). Humans
-  have no roles.
-- The human proof is path-bound (#225, P19 333): any same-uid process that runs the tree's `human-cli.mjs` acts
-  as the human. That limit is real and the design must say how several humans change it.
-
-## What the design must settle
-
-1. The human model. How a business lists several humans, how each is identified, and how a Console SSO
-   session (#412, row 192: each session names a provider subject mapped to a name) and a CLI call each
-   become exactly one of them. Starting rule (Mos, mos-0985, from Duckworth's federation review B1 at
-   b402197ff on origin duckworth/reviews): the bus takes a human principal only from something it verifies,
-   such as the Console's OIDC session under #412. A process's own claim of who it is never counts.
-2. Human roles. A small fixed set to start (for example owner, member, viewer), what each may do on the
-   bus and in the Console, and who may add or remove humans and change roles. Restructuring stays with
-   the owner (Case 1).
-3. Threads. Private threads (visible to their owner and the agents in them) and shared threads (visible to
-   named humans or all members). Schema change, migration of existing rows (all become the current human's),
-   and every read path that must filter.
-4. One user and grant store. Gizmoduck's federation design (thread 9312a896, design 6925f78f0 on
-   gizmoduck/federation-design) proposes `access.json` for grants. Mos's reading (mos-0977): one model for
-   local and federated humans, because two stores drift. Lead decision (Sage, 2026-10-20, to gizmoduck-0002):
-   row 193 takes Gizmoduck's human-authored `<configDir>/access.json` (federation DESIGN.md section 3.5) as
-   the one user and grant store, and extends it with local humans, roles and shared threads. Federation adds
-   only a `home` field. The design confirms this or brings a concrete reason against it to Sage and
-   Gizmoduck before the build. Federation's R1 (the access.json loader) then comes before this row's build.
-5. The bus human boundary. With several humans, the human verbs must know which human calls. State what a
-   same-uid process can still do (P19 333) and whether row 190's one-instance-per-OS-user direction narrows
-   it.
-6. Migration and rollback. Existing businesses keep working with their one human as owner.
-
-## Boundaries
-
-- Changing who can reach the Console from outside is Jason's. This row changes who is allowed once inside.
-- No test touches `~/.mosaic-dev`, `~/.config/mosaic-dev`, the live units or a slot file.
-- The build may chain on rows 190 and 192 candidates (Q177). Each row keeps its own review and gate.
-
-## Gate
-
-Duckworth approves DESIGN.md, then the manifest. The bus, business, cli and webui suites and every
-`scripts/test-*.sh` are green on Sage's gate, and the design's mutants are killed.

docs/plans/2026-10-20_multi-instance.md

@@ -12,10 +12,8 @@ before any code, as Q175 did. Then the build follows the design, with tests and
 
 Two or more instances run side by side on dragon-lin. Each one has its own config file, data root (store,
 broker.sock, host.lock, state, runs, sessions, workspaces), businesses, bus unit, Console unit and port,
-tester port, Discord unit, Claude session env file, stack-active pointer and activation log. No instance's
-commands, units or tools address another instance's state by default or by mistake. On one uid this is
-addressing only, not a security boundary: a same-uid process can still read another instance's files.
-Isolation against that is row 190b (#1693, mos-0986), one Linux user per instance. The current instance keeps working unchanged: its
+tester port, Discord unit, Claude session env file, stack-active pointer and activation log. Nothing one
+instance does can read or change another's state. The current instance keeps working unchanged: its
 config path, data root, unit names and ports stay as they are, and no re-pin is needed for it.
 
 ## Known single-instance points (GAP-MAP.md, measured at 9ae8c73ac)

docs/plans/2026-10-20_sso-phase1.md

@@ -1,47 +0,0 @@
-# Brief: Q175 phase 1, the Console verifies SSO itself (--sso)
-
-Sage, 2026-10-20, for Q175 (Jason's ruling), mos-0971/0973/0977 and Vikunja #412. Gitea #1690. MVP T1 item 2. Owner
-Launchpad, reviewer Webby (mos-0981), gate owner Sage. Base: refactor at the brief commit.
-
-The design is approved: `agents/sage/work/q175-sso/DESIGN.md` at d55d86bb0 (blob eba861f5d2bb), Filbert r3
-approve plus the D1/D2 ack, Mos C1 confirmation in mos-0977, whose straggler-check condition is in the phase 2 window at b416d2ede. Build phase 1 exactly as the design says. If
-the code shows the design is wrong somewhere, stop and tell Sage, Webby and Filbert before building around it.
-
-## Scope (phase 1 only, design section 5 item 1)
-
-- oauth4webapi 3.8.8, pinned exactly (design section 2). No other new dependency.
-- The OIDC relying party in the Console: `/auth/login`, `/auth/callback`, `/auth/logout`, `/auth/signed-out`,
-  the callback steps 1-7, our own checks on top of the library, and sessions, cookies and Host rules
-  (design sections 1 and 3).
-- The shared loader, `scripts/mosaic-config.mjs`, accepts an optional `console` key and checks only its
-  shape. The slot file checks and the read run in the Console's `--sso` start, and the slot resolves from
-  the config dir (section 4, D1, D2).
-- The degraded start for an unreachable provider, and the unreachable/refused classes (Q-B, section 4).
-- `--sso` for `cli.mjs serve` and `webui-service.sh`, with its refusals against the old flags.
-- The tester listener rules (section 6).
-- The page: both fetch paths in `packages/webui/src/public/app.js` (:111 and :305) treat a 401
-  `sign-in required` as signed out, and the notice links to `/auth/login?return=<path>` (C2).
-- Logging as the design says, including the Q-E `subject-unknown` line.
-
-Out of scope: the phase 2 window, the live config.json key, phase 3 removals, the proxy-forwarded token
-(section 7), and any change to the live Console.
-
-## Tests and mutants
-
-Design section 9: tests 1-25, the positive paths, and every listed mutant, each killed by its named test.
-All tests run against the fake OP in `packages/webui/tests/helpers/fake-oidc.mjs`. No test reaches a real
-provider or Authentik, and no test touches `~/.mosaic-dev`, `~/.config/mosaic-dev`, the live units or a
-slot file. Test 25 goes in `scripts/test-config.sh`.
-
-## Boundaries
-
-- No request of any kind to auth.diversecanvas.com, mosaic.woltje.com or the live 127.0.0.1:7332 (mos-0971,
-  design section 8).
-- No credential value is read, printed or logged.
-- `npm install` runs only inside the worktree that has its own package.json, never in a directory that would
-  walk up to home.
-
-## Gate
-
-Webby approves the manifest. Filbert approved the design and answers design questions. The webui and cli suites, `scripts/test-config.sh` and every
-`scripts/test-*.sh` are green on Sage's gate, and the design's mutants are killed.

docs/plans/QUEUE.md

@@ -33,7 +33,7 @@ Gaps found while working go to `docs/plans/DEFERRED.md`, not here.
 
 <!-- mosaic-queue:begin -->
 
-Generated from `docs/plans/queue.json` revision 2247 by `queue render`. Do not edit between the markers; change the queue with `scripts/mosaic queue`.
+Generated from `docs/plans/queue.json` revision 2236 by `queue render`. Do not edit between the markers; change the queue with `scripts/mosaic queue`.
 
 | # | Piece | Owner | Issues | State | After | Gate | Brief | Note |
 |---|---|---|---|---|---|---|---|---|
@@ -225,9 +225,6 @@ Generated from `docs/plans/queue.json` revision 2247 by `queue render`. Do not e
 | 186 | stack-release --plan: the backup line says what the run will do (P19 404, row 185 N1/N2) | darkwing; reviewers filbert | #1684 | done | — | Filbert approves the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the three brief mutants killed (sage) | `docs/plans/2026-10-20_plan-backup-line.md` § Brief: the activate plan's backup line says what the run will do | Landed 269134d8d (author Darkwing) on 3c5da3a91. Patch-id c97b9f6e25cd matches the r1 candidate (manifest 449e9121, Filbert approve 29419). Sage gate on b367f5730+patch 09:00:20Z-09:08:59Z: node 2681/0, scripts 422/0, queue 156, network removed; 3c5da3a91 adds only a SESSIONS line. Not live: the stack runs copy 490e2771d3d0. Follow-ups on P19 404: Filbert M6 gap, store-unclean reading. |
 | 187 | stack-release activate carries the row 178 proof pair (mos-0928 Part B A0) | darkwing; reviewers filbert | #1685 | done | 186 done | Filbert approves the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the brief mutants killed (sage) | `docs/plans/2026-10-20_activate-proof-pair.md` § Brief: activate carries the row 178 proof pair | Landed 9a71e4e80 (author Darkwing) on d17328a55; patch-id 6b57c47bc661 matches candidate 52a5ecc1d143 and Filbert's r1 reading. Sage gate passed 10:21:55Z: cli 446/446 and every package and scripts/test-*.sh green. Filbert approve 29424, rev 2204; follow-ups N1-N4 filed on P19. |
 | 188 | stack-release tests: a carried proof pair and a proof file inside the repository (P19 409, 410; gates Part B) | darkwing; reviewers filbert | #1686 | done | 187 settled | Filbert approves the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the brief mutants killed (sage) | `docs/plans/2026-10-20_proof-test-gaps.md` § Brief: tests for the two proof-file paths row 187 left open | Landed 8fc0ee216 (author Darkwing) on 23a609c5c; patch-id c9a56b167c07 matches candidate 86aa549bad75 and Filbert's r1 reading; stack-release.sh blob 2586a2a37cd2 unchanged. Sage gate passed 10:58Z: cli 453/453 and every package and scripts/test-*.sh green. Filbert approve 29433, rev 2212; N1 (REPO logical path) to P19 after Part B (mos-0959). |
-| 189 | stack-release activate --no-send drops the Console's --send and keeps the pointer in step (Q175 interim, mos-0972, P19 413) | sage; reviewers dewey | #1687 | in-review, round 1, request posted | 163 done | Dewey approves the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the brief mutants killed (sage) | `docs/plans/2026-10-20_activate-no-send.md` § Brief: activate --no-send drops the Console's --send | — |
-| 190 | several Mosaic Stack instances on one host: per-instance config, data root, units and ports (MVP T1.1, mos-0974, Vikunja #414) | darkwing; reviewers filbert | #1688 | in-progress | — | Filbert approves DESIGN.md then the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the design mutants killed (sage) | `docs/plans/2026-10-20_multi-instance.md` § Brief: several Mosaic Stack instances on one host | — |
-| 191 | one kill switch for the bus, every run, Discord and new launches, from the CLI and the Console (MVP T1.4, mos-0974, Vikunja #414) | rocko; reviewers dewey | #1689 | in-progress | — | Dewey approves DESIGN.md then the manifest; cli, bus, discord and webui suites and every scripts/test-*.sh green on Sage's gate; the mutants killed (sage) | `docs/plans/2026-10-20_kill-switch.md` § Brief: one kill switch for the bus, every run, Discord and new launches | — |
 
 <!-- mosaic-queue:end -->
 

docs/plans/queue.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
   "canonicalRoot": "/mnt/storage/src/mosaic-stack",
-  "revision": 2247,
+  "revision": 2236,
   "rows": [
     {
       "id": 1,
@@ -19820,153 +19820,6 @@
       "createdAt": "2026-10-20T10:31:30.403Z",
       "updatedAt": "2026-10-20T11:11:25.098Z",
       "updatedBy": "sage"
-    },
-    {
-      "id": 189,
-      "piece": "stack-release activate --no-send drops the Console's --send and keeps the pointer in step (Q175 interim, mos-0972, P19 413)",
-      "owner": "sage",
-      "issues": [
-        1687
-      ],
-      "closes": [
-        1687
-      ],
-      "state": "in-review",
-      "previousState": null,
-      "required": false,
-      "requiredSince": null,
-      "gate": "Dewey approves the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the brief mutants killed",
-      "gateOwner": "sage",
-      "brief": {
-        "path": "docs/plans/2026-10-20_activate-no-send.md",
-        "anchor": "Brief: activate --no-send drops the Console's --send",
-        "blob": "0444b774faf09084311357fdd59b0ef3a3d347eb"
-      },
-      "after": [
-        {
-          "id": 163,
-          "when": "done"
-        }
-      ],
-      "reviewers": [
-        "dewey"
-      ],
-      "review": {
-        "rounds": [
-          {
-            "n": 1,
-            "op": "sage-189-inreview-1",
-            "by": "sage",
-            "at": "2026-10-20T18:46:06.124Z",
-            "issue": 1687,
-            "candidate": {
-              "kind": "manifest",
-              "digest": "67af69bd579561fd8c20be2a47695240a9f09f119dbfff88a8e72e2a7416e668",
-              "text": "70dbc89c0282fa063514317262d8926d16b8b8aaab4a1e47379303918495fc2c  agents/sage/work/queue-189/BUILD.md\n4bd216cce2b40b39998725daa8989f6e3acb3ccd81a7017f6b09026af3965584  agents/sage/work/queue-189/mutants-run.log\nddbdddf03abf4aa91aa62f52e468be7af3c6b2f5d7bec2ee99b11e315471f18c  agents/sage/work/queue-189/mutants.sh\n5d7b2da84d994f4f93d1212e349b4e4c19c5c00780e6cfcde91edb3ca08c014e  docs/plans/2026-10-20_activate-no-send.md\n38e410c4cb731390f96747646eb7f6caa7a587fca9024ccbe901aab5ac19c7cf  docs/TOOLS.md\nfe430969cc669515e348fced1a22cbe839a12023f7ac67cfba905b7afd29872f  packages/cli/tests/stack-release.test.mjs\n16f77305e558f4fb953accc6d09f1f7b408aba363851d8ca79216ffce41bed9f  scripts/stack-release.sh\n"
-            },
-            "request": "comment",
-            "attempts": [
-              {
-                "op": "sage-189-inreview-1",
-                "by": "sage",
-                "at": "2026-10-20T18:46:06.124Z",
-                "state": "posted",
-                "comment": 29457,
-                "transport": {
-                  "outcome": "posted",
-                  "status": 201,
-                  "comment": 29457,
-                  "detail": "created"
-                },
-                "resolutions": []
-              }
-            ],
-            "duplicateRisk": false,
-            "receipts": []
-          }
-        ]
-      },
-      "claim": {
-        "seat": "sage",
-        "op": "sage-189-start"
-      },
-      "note": null,
-      "blockedReason": null,
-      "createdAt": "2026-10-20T18:21:38.646Z",
-      "updatedAt": "2026-10-20T18:46:24.267Z",
-      "updatedBy": "sage"
-    },
-    {
-      "id": 190,
-      "piece": "several Mosaic Stack instances on one host: per-instance config, data root, units and ports (MVP T1.1, mos-0974, Vikunja #414)",
-      "owner": "darkwing",
-      "issues": [
-        1688
-      ],
-      "closes": [
-        1688
-      ],
-      "state": "in-progress",
-      "previousState": null,
-      "required": false,
-      "requiredSince": null,
-      "gate": "Filbert approves DESIGN.md then the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the design mutants killed",
-      "gateOwner": "sage",
-      "brief": {
-        "path": "docs/plans/2026-10-20_multi-instance.md",
-        "anchor": "Brief: several Mosaic Stack instances on one host",
-        "blob": "79fa60fbf17a352edc5431d6aabc77c72ec5c48f"
-      },
-      "after": [],
-      "reviewers": [
-        "filbert"
-      ],
-      "review": null,
-      "claim": {
-        "seat": "darkwing",
-        "op": "darkwing-190-start"
-      },
-      "note": null,
-      "blockedReason": null,
-      "createdAt": "2026-10-20T18:42:48.052Z",
-      "updatedAt": "2026-10-20T18:45:23.430Z",
-      "updatedBy": "darkwing"
-    },
-    {
-      "id": 191,
-      "piece": "one kill switch for the bus, every run, Discord and new launches, from the CLI and the Console (MVP T1.4, mos-0974, Vikunja #414)",
-      "owner": "rocko",
-      "issues": [
-        1689
-      ],
-      "closes": [
-        1689
-      ],
-      "state": "in-progress",
-      "previousState": null,
-      "required": false,
-      "requiredSince": null,
-      "gate": "Dewey approves DESIGN.md then the manifest; cli, bus, discord and webui suites and every scripts/test-*.sh green on Sage's gate; the mutants killed",
-      "gateOwner": "sage",
-      "brief": {
-        "path": "docs/plans/2026-10-20_kill-switch.md",
-        "anchor": "Brief: one kill switch for the bus, every run, Discord and new launches",
-        "blob": "aed33125fa67ae69af73c18ffc9e2a83481421f3"
-      },
-      "after": [],
-      "reviewers": [
-        "dewey"
-      ],
-      "review": null,
-      "claim": {
-        "seat": "rocko",
-        "op": "rocko-191-start"
-      },
-      "note": null,
-      "blockedReason": null,
-      "createdAt": "2026-10-20T18:43:05.222Z",
-      "updatedAt": "2026-10-20T18:45:05.621Z",
-      "updatedBy": "rocko"
     }
   ],
   "log": [
@@ -78903,329 +78756,6 @@
         "receipt": "ok sage-163-done rev 2236 row 163 in-review→done round 2"
       },
       "viewSha": "e44815d32d46b91ee37d4c3c4701716956ba35d29c16c24c89020cce345bd61b"
-    },
-    {
-      "rev": 2237,
-      "op": "sage-189-add",
-      "verb": "add",
-      "args": {
-        "piece": "stack-release activate --no-send drops the Console's --send and keeps the pointer in step (Q175 interim, mos-0972, P19 413)",
-        "gate": "Dewey approves the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the brief mutants killed",
-        "brief": "docs/plans/2026-10-20_activate-no-send.md#Brief: activate --no-send drops the Console's --send",
-        "issues": [
-          1687
-        ],
-        "note": null,
-        "owner": "sage",
-        "gateOwner": "sage",
-        "after": [
-          {
-            "id": 163,
-            "when": "done"
-          }
-        ],
-        "reviewers": [
-          "dewey"
-        ],
-        "required": null
-      },
-      "by": "sage",
-      "at": "2026-10-20T18:21:38.646Z",
-      "semantics": 2,
-      "result": {
-        "row": 189,
-        "from": null,
-        "to": "queued",
-        "brief": {
-          "path": "docs/plans/2026-10-20_activate-no-send.md",
-          "anchor": "Brief: activate --no-send drops the Console's --send",
-          "blob": "0444b774faf09084311357fdd59b0ef3a3d347eb"
-        },
-        "receipt": "ok sage-189-add rev 2237 row 189 none→queued"
-      },
-      "viewSha": "70bf9967156881afecaba9ccf4edf8cbc63a344eb7c6407b3453c950781f34c5"
-    },
-    {
-      "rev": 2238,
-      "op": "sage-189-briefed",
-      "verb": "move",
-      "args": {
-        "id": 189,
-        "to": "briefed",
-        "reason": null,
-        "candidate": null,
-        "evidence": null,
-        "issue": null
-      },
-      "by": "sage",
-      "at": "2026-10-20T18:22:01.437Z",
-      "semantics": 2,
-      "result": {
-        "row": 189,
-        "from": "queued",
-        "to": "briefed",
-        "round": null,
-        "issue": null,
-        "candidate": null,
-        "receipt": "ok sage-189-briefed rev 2238 row 189 queued→briefed"
-      },
-      "viewSha": "27ee8a26722d3eaf4c4b346e06ffdb853037aad2d1a7fe14f440cbe1bb9a2a27"
-    },
-    {
-      "rev": 2239,
-      "op": "sage-189-start",
-      "verb": "move",
-      "args": {
-        "id": 189,
-        "to": "in-progress",
-        "reason": null,
-        "candidate": null,
-        "evidence": null,
-        "issue": null
-      },
-      "by": "sage",
-      "at": "2026-10-20T18:22:18.476Z",
-      "semantics": 2,
-      "result": {
-        "row": 189,
-        "from": "briefed",
-        "to": "in-progress",
-        "round": null,
-        "issue": null,
-        "candidate": null,
-        "receipt": "ok sage-189-start rev 2239 row 189 briefed→in-progress"
-      },
-      "viewSha": "230578585341fcfc9429364332ca8b78988ffd669d3c1bb5e2e94a74d9916649"
-    },
-    {
-      "rev": 2240,
-      "op": "sage-190-add",
-      "verb": "add",
-      "args": {
-        "piece": "several Mosaic Stack instances on one host: per-instance config, data root, units and ports (MVP T1.1, mos-0974, Vikunja #414)",
-        "gate": "Filbert approves DESIGN.md then the manifest; cli suite and every scripts/test-*.sh green on Sage's gate; the design mutants killed",
-        "brief": "docs/plans/2026-10-20_multi-instance.md#Brief: several Mosaic Stack instances on one host",
-        "issues": [
-          1688
-        ],
-        "note": null,
-        "owner": "darkwing",
-        "gateOwner": "sage",
-        "after": null,
-        "reviewers": [
-          "filbert"
-        ],
-        "required": null
-      },
-      "by": "sage",
-      "at": "2026-10-20T18:42:48.052Z",
-      "semantics": 2,
-      "result": {
-        "row": 190,
-        "from": null,
-        "to": "queued",
-        "brief": {
-          "path": "docs/plans/2026-10-20_multi-instance.md",
-          "anchor": "Brief: several Mosaic Stack instances on one host",
-          "blob": "79fa60fbf17a352edc5431d6aabc77c72ec5c48f"
-        },
-        "receipt": "ok sage-190-add rev 2240 row 190 none→queued"
-      },
-      "viewSha": "b4319dbd993254b58e4db8be18769b04322028903e325c0c8cadcfdec527929f"
-    },
-    {
-      "rev": 2241,
-      "op": "sage-191-add",
-      "verb": "add",
-      "args": {
-        "piece": "one kill switch for the bus, every run, Discord and new launches, from the CLI and the Console (MVP T1.4, mos-0974, Vikunja #414)",
-        "gate": "Dewey approves DESIGN.md then the manifest; cli, bus, discord and webui suites and every scripts/test-*.sh green on Sage's gate; the mutants killed",
-        "brief": "docs/plans/2026-10-20_kill-switch.md#Brief: one kill switch for the bus, every run, Discord and new launches",
-        "issues": [
-          1689
-        ],
-        "note": null,
-        "owner": "rocko",
-        "gateOwner": "sage",
-        "after": null,
-        "reviewers": [
-          "dewey"
-        ],
-        "required": null
-      },
-      "by": "sage",
-      "at": "2026-10-20T18:43:05.222Z",
-      "semantics": 2,
-      "result": {
-        "row": 191,
-        "from": null,
-        "to": "queued",
-        "brief": {
-          "path": "docs/plans/2026-10-20_kill-switch.md",
-          "anchor": "Brief: one kill switch for the bus, every run, Discord and new launches",
-          "blob": "aed33125fa67ae69af73c18ffc9e2a83481421f3"
-        },
-        "receipt": "ok sage-191-add rev 2241 row 191 none→queued"
-      },
-      "viewSha": "2cdc7c37430226f1ea01ed9f3d60a2c12be16eddac38d18dc16f889c7b54b14e"
-    },
-    {
-      "rev": 2242,
-      "op": "sage-190-brief",
-      "verb": "move",
-      "args": {
-        "id": 190,
-        "to": "briefed",
-        "reason": null,
-        "candidate": null,
-        "evidence": null,
-        "issue": null
-      },
-      "by": "sage",
-      "at": "2026-10-20T18:43:25.630Z",
-      "semantics": 2,
-      "result": {
-        "row": 190,
-        "from": "queued",
-        "to": "briefed",
-        "round": null,
-        "issue": null,
-        "candidate": null,
-        "receipt": "ok sage-190-brief rev 2242 row 190 queued→briefed"
-      },
-      "viewSha": "6203315b484302369ce5ea7d854082a6bca4a95f9793e14ec123f57381234c95"
-    },
-    {
-      "rev": 2243,
-      "op": "sage-191-brief",
-      "verb": "move",
-      "args": {
-        "id": 191,
-        "to": "briefed",
-        "reason": null,
-        "candidate": null,
-        "evidence": null,
-        "issue": null
-      },
-      "by": "sage",
-      "at": "2026-10-20T18:43:43.042Z",
-      "semantics": 2,
-      "result": {
-        "row": 191,
-        "from": "queued",
-        "to": "briefed",
-        "round": null,
-        "issue": null,
-        "candidate": null,
-        "receipt": "ok sage-191-brief rev 2243 row 191 queued→briefed"
-      },
-      "viewSha": "9cc7dda5fa676258e864dedfdf2f4e3904c8723ba9c36474cff76757f52e5c07"
-    },
-    {
-      "rev": 2244,
-      "op": "rocko-191-start",
-      "verb": "move",
-      "args": {
-        "id": 191,
-        "to": "in-progress",
-        "reason": null,
-        "candidate": null,
-        "evidence": null,
-        "issue": null
-      },
-      "by": "rocko",
-      "at": "2026-10-20T18:45:05.621Z",
-      "semantics": 2,
-      "result": {
-        "row": 191,
-        "from": "briefed",
-        "to": "in-progress",
-        "round": null,
-        "issue": null,
-        "candidate": null,
-        "receipt": "ok rocko-191-start rev 2244 row 191 briefed→in-progress"
-      },
-      "viewSha": "cd2423e53ac82a667c737852bef6adfdafba82987f37cd090f5484b15b3a0e0c"
-    },
-    {
-      "rev": 2245,
-      "op": "darkwing-190-start",
-      "verb": "move",
-      "args": {
-        "id": 190,
-        "to": "in-progress",
-        "reason": null,
-        "candidate": null,
-        "evidence": null,
-        "issue": null
-      },
-      "by": "darkwing",
-      "at": "2026-10-20T18:45:23.430Z",
-      "semantics": 2,
-      "result": {
-        "row": 190,
-        "from": "briefed",
-        "to": "in-progress",
-        "round": null,
-        "issue": null,
-        "candidate": null,
-        "receipt": "ok darkwing-190-start rev 2245 row 190 briefed→in-progress"
-      },
-      "viewSha": "014db845fb2e380678ab1250f2cd3c0d7b192dc39909416515482c810440149b"
-    },
-    {
-      "rev": 2246,
-      "op": "sage-189-inreview-1",
-      "verb": "move",
-      "args": {
-        "id": 189,
-        "to": "in-review",
-        "reason": null,
-        "candidate": "agents/sage/work/queue-189/candidate-manifest.sha256",
-        "evidence": null,
-        "issue": null
-      },
-      "by": "sage",
-      "at": "2026-10-20T18:46:06.124Z",
-      "semantics": 2,
-      "result": {
-        "row": 189,
-        "from": "in-progress",
-        "to": "in-review",
-        "round": 1,
-        "issue": 1687,
-        "candidate": {
-          "kind": "manifest",
-          "digest": "67af69bd579561fd8c20be2a47695240a9f09f119dbfff88a8e72e2a7416e668",
-          "text": "70dbc89c0282fa063514317262d8926d16b8b8aaab4a1e47379303918495fc2c  agents/sage/work/queue-189/BUILD.md\n4bd216cce2b40b39998725daa8989f6e3acb3ccd81a7017f6b09026af3965584  agents/sage/work/queue-189/mutants-run.log\nddbdddf03abf4aa91aa62f52e468be7af3c6b2f5d7bec2ee99b11e315471f18c  agents/sage/work/queue-189/mutants.sh\n5d7b2da84d994f4f93d1212e349b4e4c19c5c00780e6cfcde91edb3ca08c014e  docs/plans/2026-10-20_activate-no-send.md\n38e410c4cb731390f96747646eb7f6caa7a587fca9024ccbe901aab5ac19c7cf  docs/TOOLS.md\nfe430969cc669515e348fced1a22cbe839a12023f7ac67cfba905b7afd29872f  packages/cli/tests/stack-release.test.mjs\n16f77305e558f4fb953accc6d09f1f7b408aba363851d8ca79216ffce41bed9f  scripts/stack-release.sh\n"
-        },
-        "receipt": "ok sage-189-inreview-1 rev 2246 row 189 in-progress→in-review round 1 on #1687; request sage-189-inreview-1 requesting"
-      },
-      "viewSha": "d8a3aa936a9a819329e86679d0bfcf658d773d0f7cfd29c10587c6447f78e968"
-    },
-    {
-      "rev": 2247,
-      "op": "sage-189-inreview-1.outcome",
-      "verb": "review-outcome",
-      "args": {
-        "id": 189,
-        "attempt": "sage-189-inreview-1",
-        "outcome": "posted",
-        "status": 201,
-        "comment": 29457,
-        "detail": "created"
-      },
-      "by": "sage",
-      "at": "2026-10-20T18:46:24.267Z",
-      "semantics": 2,
-      "result": {
-        "row": 189,
-        "round": 1,
-        "attempt": "sage-189-inreview-1",
-        "state": "posted",
-        "receipt": "ok sage-189-inreview-1.outcome rev 2247 row 189 round 1 request sage-189-inreview-1 posted comment 29457"
-      },
-      "viewSha": "6d7e91ae3cab0b76e5c5d791fb821b97c9da7db16389ff2d531d7b77d2a069f1"
     }
   ]
 }