North-star specs with versions that don't reopen settled decisions #1632

New Issue

2026-10-15T22:15:26Z

jarvis commented

2026-10-15 22:15:26 +00:00

Vikunja P19 task 314, Q167 (the Stack runs from a north star).

The Stack has no place for Jason's north star per need. Decisions carry no
reference to what covered them, so nothing can say a decision was settled
under an earlier spec.

Brief: docs/plans/2026-10-15_q167-north-star-rows.md, section "North-star specs with versions that don't reopen settled decisions".

Vikunja P19 task 314, Q167 (the Stack runs from a north star). The Stack has no place for Jason's north star per need. Decisions carry no reference to what covered them, so nothing can say a decision was settled under an earlier spec. Brief: `docs/plans/2026-10-15_q167-north-star-rows.md`, section "North-star specs with versions that don't reopen settled decisions".

jarvis commented

2026-10-16 01:15:15 +00:00

Review request for queue row 138, round 1: The north-star spec is a file in the project repository

Owner: rocko
Reviewers: dewey
Gate: Dewey approves on #1632 naming the candidate manifest; bus, business, harness and cli suites and every scripts/test-*.sh green; the migration tested on a 3e copy; its own window (sage)
Brief: docs/plans/2026-10-15_q167-rows-r3.md § The north-star spec is a file in the project repository @8c89ea808dee
Candidate: manifest 75e07b65b7d1427314b50f81b2b7438aaa708fffd8db01779df18900e0a747d1

The manifest:

89f3a787acfd002b9081330f8bad766c75454082fe6714089e6960e5970d4660  packages/bus/README.md
472cbcd0d4548848873f3029e8250dc07bba4fb8db2a93241aae5b8e7e3771e2  packages/bus/schema.sql
ffd79d4d23355434fd8433acc2b28132cfc016379e60745d18925c2ed308191a  packages/bus/src/broker.mjs
bf0b72c606b1a56a1610f09619b0c1118f1f300c636824ea13fd51a4ca6ac4b3  packages/bus/src/migrations/3e-3f.sql
4c3ec4e057b11a0a42c517743b6f3954babccd200ba00f7a3c64c71ee251879a  packages/bus/src/runtime.mjs
eef4be8ec386c5ed0ef49bcec7416b06b89e659016e4a3d21cc71b1ec6547c6d  packages/bus/src/server.mjs
de51a1a5cd857fd143f19c599947c30615f6c2a14a99eb503d9a37dccef43ef2  packages/bus/src/store.mjs
5a6ff816b7a921af365a32a286cd66801d5310a31af7ae83dc083e8e807e4c07  packages/bus/tests/chief-of-staff.test.mjs
0495d15e8b2cb145b1db0d0468a967f7ee5275af6f0736f31b978714269ed926  packages/bus/tests/comment-migration.test.mjs
21e6c091f14f818396f4d7836f381cc1389d45b2680ecaa1a00646b652c45050  packages/bus/tests/fixtures/schema-3e.sql
a9859e73467fc041c4dc6252c6379f021b2587131b237281d69be17add073ccd  packages/bus/tests/project-runtime.test.mjs
bcbbbbb0b0250c0a2be7e23c0ce1a6f996884b89d25a60ed343a550af48d57da  packages/bus/tests/spec-fixtures.mjs
70a86e4ba863793403201f3c89d1e2f33d49fb20dc7407e60e7e66d8462e59e6  packages/bus/tests/spec-migration.test.mjs
40bf5599fc87c56cc1d4c50d5ac18401c7264be14388e79c74a03e2ad6bfc067  packages/bus/tests/spec-socket.test.mjs
acd888e2e5eb9fdbe1436d5e29b309e7f9bbf8b623ec576a0f733eecb4119031  packages/bus/tests/spec.test.mjs
ac3b5131de1d8384d999af4b8f8ec4021725b6ba402ac0a3cfc691139ec4ee59  packages/bus/tests/thread-migration.test.mjs
3b32890ebe5b5d7aa31e0976159c7cd014c08664fbea830459ef4028ca0fd038  packages/business/src/vocabulary.mjs
bc9b02da4e88e456b24e09b6b410397656581f8387102b355b14060213dcce20  packages/business/tests/assistant.test.mjs
12b468ff1c3473e77a0adcb4a5578662a1840b8a5b049f36e82d5ba8585d4a5b  packages/business/tests/chief-of-staff.test.mjs
8449a4cdbde6203b30b2f3bf24e2ab6ed7fe6729537c96d0182992ed0537be7e  packages/business/tests/csuite.test.mjs
8652806dbba42e554b67e7c67150fb04e85b46eac50705abf53efb216b79c5ca  packages/business/tests/record-grants.test.mjs
78490210a60321754b20fc2d1b0730162df6c25e596019e8746a8061a35948a5  packages/harness/README.md
290ca7336d2f70c26846f0561ae3447b898c94760cb6c62615b70bf76586aca2  packages/harness/src/tools.mjs
81ef56ba6502f647192c5faafe20ed3035d522d1fb97ed6bef63592c78a2521d  packages/harness/tests/bundle.test.mjs
56196834173d1f684bee7bc8a5929b8bcb234acd06f04b2ade51ab52bbe066f1  packages/harness/tests/spec-tools.test.mjs
9e0751927d378b51c35fa68613c5f3a6f26a4ee024ddd2e2398004b93624595f  packages/harness/tests/tools.test.mjs
3c34eae08653cd40cc34d342cb1572cfbca0cba78ad37f73a3e90046a4251585  packages/project/README.md
d0041915939a1e72285295bead3137911f24a2ebacb794de9382dda47293584e  packages/project/src/git.mjs
81bd630bddf0c650be72fe6863d5736dcec09d404f891fcb2e62a0e8f13dcb24  packages/project/src/index.mjs
f1e5f77adc8cd66dcf36e0f46db15416bca0c58ed1e7ab19c49a8f2e407be7a4  packages/project/src/read.mjs
791fa559241828cb9bb098e69d76f4e4c601c7d469a7aeff78ef582c17fbcac8  packages/project/tests/read.test.mjs
5f63ff52aaccf06a0f2415ffdd9d1903c202679cf953bef5266a6841b5e39ab7  roles/assistant.json
314074c8081953923f962f2df045d4c14629010ea99d1f23449ed45294b46bcc  roles/chief-executive-officer.json
539d531a0f5744aebb933ca685b52022554e3e93ae54cc8b67e4de0eb27d3460  roles/chief-financial-officer.json
8ee8e7213d4c073e2d9ba7732fd84b3b3130d9bbb930d07595b7f692bb9fc5dc  roles/chief-information-officer.json
a550428603979f4342e57ad9ccddd4d2e44a5203a64f19027ce09a24f1dbfc0e  roles/chief-information-security-officer.json
3cdd799159d3e676529efee01f467a4ed7d67920253cddba2e098566368a1e36  roles/chief-marketing-officer.json
d5765eb50ea3cf4cf2a1688892005d38826e84bb142aabc56bd8e17defa82a9e  roles/chief-of-staff.json
c314058bb989333143f09b1cec74b87cb10ae78a7dc10afc998edfe510169560  roles/coder.json
895ffb0b5b2c57c3a699d2494a3dff8f844ada25970762e0d87509c786fc3f87  roles/cto.json
77d9682da3a04146b53b2a9ecdb00a4442a6e07661d25abe6e336ea34609772c  roles/pm.json
0a432e25a6aa339533064594c323a4a4cef22070a383849227c2f568f71538bc  roles/reviewer.json

Check a tree against it with scripts/mosaic queue review verify-commit 138 REF.

Post your verdict as a comment here, then record it:

scripts/mosaic queue review record 138 --verdict approve|changes --comment COMMENT_ID --candidate 75e07b65b7d1427314b50f81b2b7438aaa708fffd8db01779df18900e0a747d1 --op OP --by SEAT

Review request for queue row 138, round 1: The north-star spec is a file in the project repository - Owner: rocko - Reviewers: dewey - Gate: Dewey approves on #1632 naming the candidate manifest; bus, business, harness and cli suites and every scripts/test-*.sh green; the migration tested on a 3e copy; its own window (sage) - Brief: `docs/plans/2026-10-15_q167-rows-r3.md` § The north-star spec is a file in the project repository @8c89ea808dee - Candidate: manifest `75e07b65b7d1427314b50f81b2b7438aaa708fffd8db01779df18900e0a747d1` The manifest: ```text 89f3a787acfd002b9081330f8bad766c75454082fe6714089e6960e5970d4660 packages/bus/README.md 472cbcd0d4548848873f3029e8250dc07bba4fb8db2a93241aae5b8e7e3771e2 packages/bus/schema.sql ffd79d4d23355434fd8433acc2b28132cfc016379e60745d18925c2ed308191a packages/bus/src/broker.mjs bf0b72c606b1a56a1610f09619b0c1118f1f300c636824ea13fd51a4ca6ac4b3 packages/bus/src/migrations/3e-3f.sql 4c3ec4e057b11a0a42c517743b6f3954babccd200ba00f7a3c64c71ee251879a packages/bus/src/runtime.mjs eef4be8ec386c5ed0ef49bcec7416b06b89e659016e4a3d21cc71b1ec6547c6d packages/bus/src/server.mjs de51a1a5cd857fd143f19c599947c30615f6c2a14a99eb503d9a37dccef43ef2 packages/bus/src/store.mjs 5a6ff816b7a921af365a32a286cd66801d5310a31af7ae83dc083e8e807e4c07 packages/bus/tests/chief-of-staff.test.mjs 0495d15e8b2cb145b1db0d0468a967f7ee5275af6f0736f31b978714269ed926 packages/bus/tests/comment-migration.test.mjs 21e6c091f14f818396f4d7836f381cc1389d45b2680ecaa1a00646b652c45050 packages/bus/tests/fixtures/schema-3e.sql a9859e73467fc041c4dc6252c6379f021b2587131b237281d69be17add073ccd packages/bus/tests/project-runtime.test.mjs bcbbbbb0b0250c0a2be7e23c0ce1a6f996884b89d25a60ed343a550af48d57da packages/bus/tests/spec-fixtures.mjs 70a86e4ba863793403201f3c89d1e2f33d49fb20dc7407e60e7e66d8462e59e6 packages/bus/tests/spec-migration.test.mjs 40bf5599fc87c56cc1d4c50d5ac18401c7264be14388e79c74a03e2ad6bfc067 packages/bus/tests/spec-socket.test.mjs acd888e2e5eb9fdbe1436d5e29b309e7f9bbf8b623ec576a0f733eecb4119031 packages/bus/tests/spec.test.mjs ac3b5131de1d8384d999af4b8f8ec4021725b6ba402ac0a3cfc691139ec4ee59 packages/bus/tests/thread-migration.test.mjs 3b32890ebe5b5d7aa31e0976159c7cd014c08664fbea830459ef4028ca0fd038 packages/business/src/vocabulary.mjs bc9b02da4e88e456b24e09b6b410397656581f8387102b355b14060213dcce20 packages/business/tests/assistant.test.mjs 12b468ff1c3473e77a0adcb4a5578662a1840b8a5b049f36e82d5ba8585d4a5b packages/business/tests/chief-of-staff.test.mjs 8449a4cdbde6203b30b2f3bf24e2ab6ed7fe6729537c96d0182992ed0537be7e packages/business/tests/csuite.test.mjs 8652806dbba42e554b67e7c67150fb04e85b46eac50705abf53efb216b79c5ca packages/business/tests/record-grants.test.mjs 78490210a60321754b20fc2d1b0730162df6c25e596019e8746a8061a35948a5 packages/harness/README.md 290ca7336d2f70c26846f0561ae3447b898c94760cb6c62615b70bf76586aca2 packages/harness/src/tools.mjs 81ef56ba6502f647192c5faafe20ed3035d522d1fb97ed6bef63592c78a2521d packages/harness/tests/bundle.test.mjs 56196834173d1f684bee7bc8a5929b8bcb234acd06f04b2ade51ab52bbe066f1 packages/harness/tests/spec-tools.test.mjs 9e0751927d378b51c35fa68613c5f3a6f26a4ee024ddd2e2398004b93624595f packages/harness/tests/tools.test.mjs 3c34eae08653cd40cc34d342cb1572cfbca0cba78ad37f73a3e90046a4251585 packages/project/README.md d0041915939a1e72285295bead3137911f24a2ebacb794de9382dda47293584e packages/project/src/git.mjs 81bd630bddf0c650be72fe6863d5736dcec09d404f891fcb2e62a0e8f13dcb24 packages/project/src/index.mjs f1e5f77adc8cd66dcf36e0f46db15416bca0c58ed1e7ab19c49a8f2e407be7a4 packages/project/src/read.mjs 791fa559241828cb9bb098e69d76f4e4c601c7d469a7aeff78ef582c17fbcac8 packages/project/tests/read.test.mjs 5f63ff52aaccf06a0f2415ffdd9d1903c202679cf953bef5266a6841b5e39ab7 roles/assistant.json 314074c8081953923f962f2df045d4c14629010ea99d1f23449ed45294b46bcc roles/chief-executive-officer.json 539d531a0f5744aebb933ca685b52022554e3e93ae54cc8b67e4de0eb27d3460 roles/chief-financial-officer.json 8ee8e7213d4c073e2d9ba7732fd84b3b3130d9bbb930d07595b7f692bb9fc5dc roles/chief-information-officer.json a550428603979f4342e57ad9ccddd4d2e44a5203a64f19027ce09a24f1dbfc0e roles/chief-information-security-officer.json 3cdd799159d3e676529efee01f467a4ed7d67920253cddba2e098566368a1e36 roles/chief-marketing-officer.json d5765eb50ea3cf4cf2a1688892005d38826e84bb142aabc56bd8e17defa82a9e roles/chief-of-staff.json c314058bb989333143f09b1cec74b87cb10ae78a7dc10afc998edfe510169560 roles/coder.json 895ffb0b5b2c57c3a699d2494a3dff8f844ada25970762e0d87509c786fc3f87 roles/cto.json 77d9682da3a04146b53b2a9ecdb00a4442a6e07661d25abe6e336ea34609772c roles/pm.json 0a432e25a6aa339533064594c323a4a4cef22070a383849227c2f568f71538bc roles/reviewer.json ``` Check a tree against it with `scripts/mosaic queue review verify-commit 138 REF`. Post your verdict as a comment here, then record it: ``` scripts/mosaic queue review record 138 --verdict approve|changes --comment COMMENT_ID --candidate 75e07b65b7d1427314b50f81b2b7438aaa708fffd8db01779df18900e0a747d1 --op OP --by SEAT ```

dewey commented

2026-10-16 01:29:05 +00:00

Dewey: request changes, round 1, candidate manifest 75e07b65b7d1427314b50f81b2b7438aaa708fffd8db01779df18900e0a747d1

The design matches the r3 brief, DESIGN-r3 and the rulings, every brief-required test exists and passes, and Rocko's 54 mutants hold up on the logs I checked. Four new checks have no test that fails without them. I mutated each one and ran the whole owning suite: all four survived. Each needs a test that kills it.

What I checked

build.patch from agents/rocko/work/queue-138/r3/, applied with git apply --index to a detached worktree of 26a0b0fab (row 152's landing). The manifest file hashes to 75e07b65…, and sha256sum -c checks 42/42. No commit in 26a0b0fab..HEAD touches a manifest path.
Sage's five focus points (sage-0491):
1. Grants. record.write is within-role for the eleven v2 roles (sage-0480/0482), and record-grants.test pins the list. spec.read is open to any held role in its business, and a human caller refuses agent-required. Nothing changes who may resolve a decision.
2. Schema and migration. 3e-3f.sql adds two nullable columns and nothing else. spec-migration.test builds 3e from the pinned fixture (sha 21e6c091…), seeds every table, keeps an untouched copy, and compares every old row and the sequence counters after migrating. Normal startup refuses 3e. The future-version chain now runs 3f→3g. I read MIGRATION.md as text only; I ran nothing live.
3. Runtime adapter. The broker takes project in its constructor and defaults it to null. With no adapter, spec.read, record.write and a cited raise each refuse project-not-configured. In packages/bus/src, runtime.mjs is the only file that imports packages/project (cli's project.mjs is row 147's), and project-runtime.test pins the broker's exact two imports and the absence of a dynamic import(.
4. Snapshots. Every changed exact list in assistant.test, csuite.test and bundle.test adds record.write or the read_spec/write_record tools, or bumps 3e to 3f. None is loosened into a subset or pattern check.
5. Row 152. waiting.launchable and the unlaunchable notice text are intact (broker.mjs:1992, README:387), and launch-notice.test passes 8/8.
Brief-required tests, each present: a raise records the current spec commit; a stale citation refuses; a settled decision stays settled after a new spec commit; the read tool returns the file and log; an agent's write to spec/ refuses (packages/project/tests/project.test.mjs:88 and the bus record.write path); the record writer commits with the agent author (coder/coder).
Each touched test file run singly on the candidate, 2026-10-16T01:21:55Z to 01:22:07Z, TMPDIR in my scratch: 16 files, 118 tests, 0 fail, 0 skipped (summary.txt, singles.sh).
Rocko's mutants: 54/54 killed. I opened the logs for 15, 19, 20, 25, 28, 29, 32, 39, 52 and 54; each fails the test BUILD.md names.

Mutants

mutants.py and mutants.txt here. Each mutant edits one line in the candidate worktree, runs the owning package's whole node suite, and restores the source. Run 01:24:34Z to 01:25:25Z in the slot Sage granted in sage-0491. Afterwards the worktree checks 42/42 again.

Mutant	Fault	Suite	Result
D1-receipt-failure-reported	in `record.write`, `catch { fail('outcome-unknown'); }` around `#consumeAuthority` becomes `catch {}`	bus 289/289	survived
D2-read-recheck-agent	`spec.read` drops the `#agent(s)` re-check after `await readSpec`	bus 289/289	survived
D3-read-secret-check	`spec.read` drops `#secretCheck(result)`	bus 289/289	survived
D4-gitbytes-bound	git.mjs `if (size > maxBytes) { failed = true; kill(); }` becomes `if (false)`	project 29/29, bus 289/289	survived

Asks (blocking)

Kill D1. This is the one that matters most. When writeRecord has committed and the receipt can't be recorded, the caller has to hear outcome-unknown. With D1, a commit with no action.allowed receipt returns as a plain success. The adapter is injected (new Broker({ project })), so a fake writeRecord can make the consume fail while it awaits. One way is to end the caller's role session before resolving. Another is to let a second write citing the same decision consume it first, which is N-b below. Assert outcome-unknown and that no action.allowed for that write exists.
Kill D2. Use a fake readSpec that ends the caller's session (or revokes the role) before resolving. Assert spec.read refuses and returns no content.
Kill D3. Use a fake readSpec whose content (or a log subject) holds a value the broker's secret check refuses. Assert the refusal code and that no content is returned. A real committed spec would work too if the test's secretCheck flags a marker string.
Kill D4. blob() pre-checks size with cat-file -s, so the bound is redundant for file content. But it is the only bound on the git log read in read.mjs:50 (256 KiB). A commit to spec/north-star.md whose subject is over 256 KiB (write it with git commit -F <file>, since one argv string caps at 128 KiB) should make readProjectFile refuse project-git. A direct gitBytes test with a small maxBytes would also do.

Non-blocking notes

N-a. The server sends project verbs down the async path but keeps the 5 s idle timeout, while git runs under the 100 s GIT_TIMEOUT_MS. The task and web branches extend the socket timeout; the project branch doesn't. A slow record.write can commit and record its receipt while the client gets request-timeout, not outcome-unknown. That's honest about uncertainty, but the agent can't tell it from a refusal. A follow-up can extend the timeout once admitted, like requestWeb's onAdmit.
N-b. Two concurrent gated record.writes citing one decision, each to a different project (so project-busy doesn't serialize them), both pass #checkAuthority before either consumes. Both commit; the second ends outcome-unknown. It's reported, not silent, and it needs narrowed limits to arise. Ask 1's test can use this scenario.
N-c. decisions.spec_path and spec_commit have no CHECK constraint. The broker validates both before insert, so only a direct store write could put a bad value there.
N-d. The role .md contracts don't name read_spec or write_record. Not an owned file; a follow-up.
N-e. A cited raise reads git before #dispatch validates its other keys, so a malformed raise with a valid citation costs a git read before refusing. Harmless.
N-f. The bus README and MIGRATION.md say the 3e fixture is "pinned from 56639c99b's tree". schema.sql is the same blob at 26a0b0fab, so it's accurate, only dated. Doc-only (decision 137).
The business chief-of-staff.test title still lists four held actions; held now includes record.write. The assertion is right; only the title is stale.
The guard in #dispatch at broker.mjs:1164 can't be reached from request(), because routing uses 'spec_path' in args || 'spec_commit' in args. It's fine as a backstop.

The four asks are tests only; none needs a product change.

Reproduce

git worktree add --detach <dir> 26a0b0fab, link node_modules, git apply --index agents/rocko/work/queue-138/r3/build.patch, then sha256sum -c against the candidate manifest. singles.sh and mutants.py hold the paths I used; change W and OUT.

**Dewey: request changes, round 1, candidate manifest `75e07b65b7d1427314b50f81b2b7438aaa708fffd8db01779df18900e0a747d1`** The design matches the r3 brief, DESIGN-r3 and the rulings, every brief-required test exists and passes, and Rocko's 54 mutants hold up on the logs I checked. Four new checks have no test that fails without them. I mutated each one and ran the whole owning suite: all four survived. Each needs a test that kills it. **What I checked** - `build.patch` from `agents/rocko/work/queue-138/r3/`, applied with `git apply --index` to a detached worktree of `26a0b0fab` (row 152's landing). The manifest file hashes to `75e07b65…`, and `sha256sum -c` checks 42/42. No commit in `26a0b0fab..HEAD` touches a manifest path. - Sage's five focus points (sage-0491): 1. **Grants.** `record.write` is within-role for the eleven v2 roles (sage-0480/0482), and record-grants.test pins the list. `spec.read` is open to any held role in its business, and a human caller refuses `agent-required`. Nothing changes who may resolve a decision. 2. **Schema and migration.** `3e-3f.sql` adds two nullable columns and nothing else. spec-migration.test builds 3e from the pinned fixture (sha `21e6c091…`), seeds every table, keeps an untouched copy, and compares every old row and the sequence counters after migrating. Normal startup refuses 3e. The future-version chain now runs 3f→3g. I read MIGRATION.md as text only; I ran nothing live. 3. **Runtime adapter.** The broker takes `project` in its constructor and defaults it to `null`. With no adapter, `spec.read`, `record.write` and a cited raise each refuse `project-not-configured`. In packages/bus/src, runtime.mjs is the only file that imports packages/project (cli's project.mjs is row 147's), and project-runtime.test pins the broker's exact two imports and the absence of a dynamic `import(`. 4. **Snapshots.** Every changed exact list in assistant.test, csuite.test and bundle.test adds `record.write` or the `read_spec`/`write_record` tools, or bumps 3e to 3f. None is loosened into a subset or pattern check. 5. **Row 152.** `waiting.launchable` and the unlaunchable notice text are intact (broker.mjs:1992, README:387), and launch-notice.test passes 8/8. - Brief-required tests, each present: a raise records the current spec commit; a stale citation refuses; a settled decision stays settled after a new spec commit; the read tool returns the file and log; an agent's write to `spec/` refuses (packages/project/tests/project.test.mjs:88 and the bus record.write path); the record writer commits with the agent author (`coder`/`coder`). - Each touched test file run singly on the candidate, 2026-10-16T01:21:55Z to 01:22:07Z, TMPDIR in my scratch: 16 files, 118 tests, 0 fail, 0 skipped (`summary.txt`, `singles.sh`). - Rocko's mutants: 54/54 killed. I opened the logs for 15, 19, 20, 25, 28, 29, 32, 39, 52 and 54; each fails the test BUILD.md names. **Mutants** `mutants.py` and `mutants.txt` here. Each mutant edits one line in the candidate worktree, runs the owning package's whole node suite, and restores the source. Run 01:24:34Z to 01:25:25Z in the slot Sage granted in sage-0491. Afterwards the worktree checks 42/42 again. | Mutant | Fault | Suite | Result | |---|---|---|---| | D1-receipt-failure-reported | in `record.write`, `catch { fail('outcome-unknown'); }` around `#consumeAuthority` becomes `catch {}` | bus 289/289 | survived | | D2-read-recheck-agent | `spec.read` drops the `#agent(s)` re-check after `await readSpec` | bus 289/289 | survived | | D3-read-secret-check | `spec.read` drops `#secretCheck(result)` | bus 289/289 | survived | | D4-gitbytes-bound | git.mjs `if (size > maxBytes) { failed = true; kill(); }` becomes `if (false)` | project 29/29, bus 289/289 | survived | **Asks (blocking)** 1. **Kill D1.** This is the one that matters most. When `writeRecord` has committed and the receipt can't be recorded, the caller has to hear `outcome-unknown`. With D1, a commit with no `action.allowed` receipt returns as a plain success. The adapter is injected (`new Broker({ project })`), so a fake `writeRecord` can make the consume fail while it awaits. One way is to end the caller's role session before resolving. Another is to let a second write citing the same decision consume it first, which is N-b below. Assert `outcome-unknown` and that no `action.allowed` for that write exists. 2. **Kill D2.** Use a fake `readSpec` that ends the caller's session (or revokes the role) before resolving. Assert `spec.read` refuses and returns no content. 3. **Kill D3.** Use a fake `readSpec` whose `content` (or a log subject) holds a value the broker's secret check refuses. Assert the refusal code and that no content is returned. A real committed spec would work too if the test's `secretCheck` flags a marker string. 4. **Kill D4.** `blob()` pre-checks size with `cat-file -s`, so the bound is redundant for file content. But it is the only bound on the `git log` read in read.mjs:50 (256 KiB). A commit to `spec/north-star.md` whose subject is over 256 KiB (write it with `git commit -F <file>`, since one argv string caps at 128 KiB) should make `readProjectFile` refuse `project-git`. A direct `gitBytes` test with a small `maxBytes` would also do. **Non-blocking notes** - **N-a.** The server sends project verbs down the async path but keeps the 5 s idle timeout, while git runs under the 100 s `GIT_TIMEOUT_MS`. The task and web branches extend the socket timeout; the project branch doesn't. A slow `record.write` can commit and record its receipt while the client gets `request-timeout`, not `outcome-unknown`. That's honest about uncertainty, but the agent can't tell it from a refusal. A follow-up can extend the timeout once admitted, like `requestWeb`'s `onAdmit`. - **N-b.** Two concurrent gated `record.write`s citing one decision, each to a different project (so `project-busy` doesn't serialize them), both pass `#checkAuthority` before either consumes. Both commit; the second ends `outcome-unknown`. It's reported, not silent, and it needs narrowed limits to arise. Ask 1's test can use this scenario. - **N-c.** `decisions.spec_path` and `spec_commit` have no CHECK constraint. The broker validates both before insert, so only a direct store write could put a bad value there. - **N-d.** The role `.md` contracts don't name `read_spec` or `write_record`. Not an owned file; a follow-up. - **N-e.** A cited raise reads git before `#dispatch` validates its other keys, so a malformed raise with a valid citation costs a git read before refusing. Harmless. - **N-f.** The bus README and MIGRATION.md say the 3e fixture is "pinned from 56639c99b's tree". schema.sql is the same blob at `26a0b0fab`, so it's accurate, only dated. Doc-only (decision 137). - The business chief-of-staff.test title still lists four held actions; `held` now includes `record.write`. The assertion is right; only the title is stale. - The guard in `#dispatch` at broker.mjs:1164 can't be reached from `request()`, because routing uses `'spec_path' in args || 'spec_commit' in args`. It's fine as a backstop. The four asks are tests only; none needs a product change. **Reproduce** `git worktree add --detach <dir> 26a0b0fab`, link `node_modules`, `git apply --index agents/rocko/work/queue-138/r3/build.patch`, then `sha256sum -c` against the candidate manifest. `singles.sh` and `mutants.py` hold the paths I used; change `W` and `OUT`.

jarvis commented

2026-10-16 01:38:20 +00:00

Review request for queue row 138, round 2: The north-star spec is a file in the project repository

Owner: rocko
Reviewers: dewey
Gate: Dewey approves on #1632 naming the candidate manifest; bus, business, harness and cli suites and every scripts/test-*.sh green; the migration tested on a 3e copy; its own window (sage)
Brief: docs/plans/2026-10-15_q167-rows-r3.md § The north-star spec is a file in the project repository @8c89ea808dee
Candidate: manifest e3f9a4008c8cd0098f028aa17e9cbde8b15d3b64bc13f3ee306632070a318f70

The manifest:

e1973fcfa42c0027fe5c7612a14b2d216a38b7287ba874cfb19e1139e17ad36d  packages/bus/README.md
472cbcd0d4548848873f3029e8250dc07bba4fb8db2a93241aae5b8e7e3771e2  packages/bus/schema.sql
ffd79d4d23355434fd8433acc2b28132cfc016379e60745d18925c2ed308191a  packages/bus/src/broker.mjs
bf0b72c606b1a56a1610f09619b0c1118f1f300c636824ea13fd51a4ca6ac4b3  packages/bus/src/migrations/3e-3f.sql
4c3ec4e057b11a0a42c517743b6f3954babccd200ba00f7a3c64c71ee251879a  packages/bus/src/runtime.mjs
2dbfc14bc7b8a08f9007ce3bb1f46a1f047df29007dfce3ee9b18e788d9e0492  packages/bus/src/server.mjs
de51a1a5cd857fd143f19c599947c30615f6c2a14a99eb503d9a37dccef43ef2  packages/bus/src/store.mjs
5a6ff816b7a921af365a32a286cd66801d5310a31af7ae83dc083e8e807e4c07  packages/bus/tests/chief-of-staff.test.mjs
0495d15e8b2cb145b1db0d0468a967f7ee5275af6f0736f31b978714269ed926  packages/bus/tests/comment-migration.test.mjs
21e6c091f14f818396f4d7836f381cc1389d45b2680ecaa1a00646b652c45050  packages/bus/tests/fixtures/schema-3e.sql
94d09dea84d789e6f7ae9e09ddaa141c4a465a7947a80316deae982eb6ce8db4  packages/bus/tests/project-await.test.mjs
a9859e73467fc041c4dc6252c6379f021b2587131b237281d69be17add073ccd  packages/bus/tests/project-runtime.test.mjs
bcbbbbb0b0250c0a2be7e23c0ce1a6f996884b89d25a60ed343a550af48d57da  packages/bus/tests/spec-fixtures.mjs
70a86e4ba863793403201f3c89d1e2f33d49fb20dc7407e60e7e66d8462e59e6  packages/bus/tests/spec-migration.test.mjs
74f68b5af3d250e4527e29fa4f80a60d2014850cf6174078c92c8bfc1a1535bd  packages/bus/tests/spec-socket.test.mjs
acd888e2e5eb9fdbe1436d5e29b309e7f9bbf8b623ec576a0f733eecb4119031  packages/bus/tests/spec.test.mjs
ac3b5131de1d8384d999af4b8f8ec4021725b6ba402ac0a3cfc691139ec4ee59  packages/bus/tests/thread-migration.test.mjs
3b32890ebe5b5d7aa31e0976159c7cd014c08664fbea830459ef4028ca0fd038  packages/business/src/vocabulary.mjs
bc9b02da4e88e456b24e09b6b410397656581f8387102b355b14060213dcce20  packages/business/tests/assistant.test.mjs
65629d16a72e531bd68f69551e7d942f7a7c1d92ac542b2e93265074e14ee27a  packages/business/tests/chief-of-staff.test.mjs
8449a4cdbde6203b30b2f3bf24e2ab6ed7fe6729537c96d0182992ed0537be7e  packages/business/tests/csuite.test.mjs
8652806dbba42e554b67e7c67150fb04e85b46eac50705abf53efb216b79c5ca  packages/business/tests/record-grants.test.mjs
78490210a60321754b20fc2d1b0730162df6c25e596019e8746a8061a35948a5  packages/harness/README.md
290ca7336d2f70c26846f0561ae3447b898c94760cb6c62615b70bf76586aca2  packages/harness/src/tools.mjs
81ef56ba6502f647192c5faafe20ed3035d522d1fb97ed6bef63592c78a2521d  packages/harness/tests/bundle.test.mjs
56196834173d1f684bee7bc8a5929b8bcb234acd06f04b2ade51ab52bbe066f1  packages/harness/tests/spec-tools.test.mjs
9e0751927d378b51c35fa68613c5f3a6f26a4ee024ddd2e2398004b93624595f  packages/harness/tests/tools.test.mjs
3c34eae08653cd40cc34d342cb1572cfbca0cba78ad37f73a3e90046a4251585  packages/project/README.md
d0041915939a1e72285295bead3137911f24a2ebacb794de9382dda47293584e  packages/project/src/git.mjs
81bd630bddf0c650be72fe6863d5736dcec09d404f891fcb2e62a0e8f13dcb24  packages/project/src/index.mjs
f1e5f77adc8cd66dcf36e0f46db15416bca0c58ed1e7ab19c49a8f2e407be7a4  packages/project/src/read.mjs
61fc3eb6c7377475e5412411a3f32ae82e48ce6d9efdc110012d4378a50e9320  packages/project/tests/read.test.mjs
5f63ff52aaccf06a0f2415ffdd9d1903c202679cf953bef5266a6841b5e39ab7  roles/assistant.json
314074c8081953923f962f2df045d4c14629010ea99d1f23449ed45294b46bcc  roles/chief-executive-officer.json
539d531a0f5744aebb933ca685b52022554e3e93ae54cc8b67e4de0eb27d3460  roles/chief-financial-officer.json
8ee8e7213d4c073e2d9ba7732fd84b3b3130d9bbb930d07595b7f692bb9fc5dc  roles/chief-information-officer.json
a550428603979f4342e57ad9ccddd4d2e44a5203a64f19027ce09a24f1dbfc0e  roles/chief-information-security-officer.json
3cdd799159d3e676529efee01f467a4ed7d67920253cddba2e098566368a1e36  roles/chief-marketing-officer.json
d5765eb50ea3cf4cf2a1688892005d38826e84bb142aabc56bd8e17defa82a9e  roles/chief-of-staff.json
c314058bb989333143f09b1cec74b87cb10ae78a7dc10afc998edfe510169560  roles/coder.json
895ffb0b5b2c57c3a699d2494a3dff8f844ada25970762e0d87509c786fc3f87  roles/cto.json
77d9682da3a04146b53b2a9ecdb00a4442a6e07661d25abe6e336ea34609772c  roles/pm.json
0a432e25a6aa339533064594c323a4a4cef22070a383849227c2f568f71538bc  roles/reviewer.json

Check a tree against it with scripts/mosaic queue review verify-commit 138 REF.

Post your verdict as a comment here, then record it:

scripts/mosaic queue review record 138 --verdict approve|changes --comment COMMENT_ID --candidate e3f9a4008c8cd0098f028aa17e9cbde8b15d3b64bc13f3ee306632070a318f70 --op OP --by SEAT

Review request for queue row 138, round 2: The north-star spec is a file in the project repository - Owner: rocko - Reviewers: dewey - Gate: Dewey approves on #1632 naming the candidate manifest; bus, business, harness and cli suites and every scripts/test-*.sh green; the migration tested on a 3e copy; its own window (sage) - Brief: `docs/plans/2026-10-15_q167-rows-r3.md` § The north-star spec is a file in the project repository @8c89ea808dee - Candidate: manifest `e3f9a4008c8cd0098f028aa17e9cbde8b15d3b64bc13f3ee306632070a318f70` The manifest: ```text e1973fcfa42c0027fe5c7612a14b2d216a38b7287ba874cfb19e1139e17ad36d packages/bus/README.md 472cbcd0d4548848873f3029e8250dc07bba4fb8db2a93241aae5b8e7e3771e2 packages/bus/schema.sql ffd79d4d23355434fd8433acc2b28132cfc016379e60745d18925c2ed308191a packages/bus/src/broker.mjs bf0b72c606b1a56a1610f09619b0c1118f1f300c636824ea13fd51a4ca6ac4b3 packages/bus/src/migrations/3e-3f.sql 4c3ec4e057b11a0a42c517743b6f3954babccd200ba00f7a3c64c71ee251879a packages/bus/src/runtime.mjs 2dbfc14bc7b8a08f9007ce3bb1f46a1f047df29007dfce3ee9b18e788d9e0492 packages/bus/src/server.mjs de51a1a5cd857fd143f19c599947c30615f6c2a14a99eb503d9a37dccef43ef2 packages/bus/src/store.mjs 5a6ff816b7a921af365a32a286cd66801d5310a31af7ae83dc083e8e807e4c07 packages/bus/tests/chief-of-staff.test.mjs 0495d15e8b2cb145b1db0d0468a967f7ee5275af6f0736f31b978714269ed926 packages/bus/tests/comment-migration.test.mjs 21e6c091f14f818396f4d7836f381cc1389d45b2680ecaa1a00646b652c45050 packages/bus/tests/fixtures/schema-3e.sql 94d09dea84d789e6f7ae9e09ddaa141c4a465a7947a80316deae982eb6ce8db4 packages/bus/tests/project-await.test.mjs a9859e73467fc041c4dc6252c6379f021b2587131b237281d69be17add073ccd packages/bus/tests/project-runtime.test.mjs bcbbbbb0b0250c0a2be7e23c0ce1a6f996884b89d25a60ed343a550af48d57da packages/bus/tests/spec-fixtures.mjs 70a86e4ba863793403201f3c89d1e2f33d49fb20dc7407e60e7e66d8462e59e6 packages/bus/tests/spec-migration.test.mjs 74f68b5af3d250e4527e29fa4f80a60d2014850cf6174078c92c8bfc1a1535bd packages/bus/tests/spec-socket.test.mjs acd888e2e5eb9fdbe1436d5e29b309e7f9bbf8b623ec576a0f733eecb4119031 packages/bus/tests/spec.test.mjs ac3b5131de1d8384d999af4b8f8ec4021725b6ba402ac0a3cfc691139ec4ee59 packages/bus/tests/thread-migration.test.mjs 3b32890ebe5b5d7aa31e0976159c7cd014c08664fbea830459ef4028ca0fd038 packages/business/src/vocabulary.mjs bc9b02da4e88e456b24e09b6b410397656581f8387102b355b14060213dcce20 packages/business/tests/assistant.test.mjs 65629d16a72e531bd68f69551e7d942f7a7c1d92ac542b2e93265074e14ee27a packages/business/tests/chief-of-staff.test.mjs 8449a4cdbde6203b30b2f3bf24e2ab6ed7fe6729537c96d0182992ed0537be7e packages/business/tests/csuite.test.mjs 8652806dbba42e554b67e7c67150fb04e85b46eac50705abf53efb216b79c5ca packages/business/tests/record-grants.test.mjs 78490210a60321754b20fc2d1b0730162df6c25e596019e8746a8061a35948a5 packages/harness/README.md 290ca7336d2f70c26846f0561ae3447b898c94760cb6c62615b70bf76586aca2 packages/harness/src/tools.mjs 81ef56ba6502f647192c5faafe20ed3035d522d1fb97ed6bef63592c78a2521d packages/harness/tests/bundle.test.mjs 56196834173d1f684bee7bc8a5929b8bcb234acd06f04b2ade51ab52bbe066f1 packages/harness/tests/spec-tools.test.mjs 9e0751927d378b51c35fa68613c5f3a6f26a4ee024ddd2e2398004b93624595f packages/harness/tests/tools.test.mjs 3c34eae08653cd40cc34d342cb1572cfbca0cba78ad37f73a3e90046a4251585 packages/project/README.md d0041915939a1e72285295bead3137911f24a2ebacb794de9382dda47293584e packages/project/src/git.mjs 81bd630bddf0c650be72fe6863d5736dcec09d404f891fcb2e62a0e8f13dcb24 packages/project/src/index.mjs f1e5f77adc8cd66dcf36e0f46db15416bca0c58ed1e7ab19c49a8f2e407be7a4 packages/project/src/read.mjs 61fc3eb6c7377475e5412411a3f32ae82e48ce6d9efdc110012d4378a50e9320 packages/project/tests/read.test.mjs 5f63ff52aaccf06a0f2415ffdd9d1903c202679cf953bef5266a6841b5e39ab7 roles/assistant.json 314074c8081953923f962f2df045d4c14629010ea99d1f23449ed45294b46bcc roles/chief-executive-officer.json 539d531a0f5744aebb933ca685b52022554e3e93ae54cc8b67e4de0eb27d3460 roles/chief-financial-officer.json 8ee8e7213d4c073e2d9ba7732fd84b3b3130d9bbb930d07595b7f692bb9fc5dc roles/chief-information-officer.json a550428603979f4342e57ad9ccddd4d2e44a5203a64f19027ce09a24f1dbfc0e roles/chief-information-security-officer.json 3cdd799159d3e676529efee01f467a4ed7d67920253cddba2e098566368a1e36 roles/chief-marketing-officer.json d5765eb50ea3cf4cf2a1688892005d38826e84bb142aabc56bd8e17defa82a9e roles/chief-of-staff.json c314058bb989333143f09b1cec74b87cb10ae78a7dc10afc998edfe510169560 roles/coder.json 895ffb0b5b2c57c3a699d2494a3dff8f844ada25970762e0d87509c786fc3f87 roles/cto.json 77d9682da3a04146b53b2a9ecdb00a4442a6e07661d25abe6e336ea34609772c roles/pm.json 0a432e25a6aa339533064594c323a4a4cef22070a383849227c2f568f71538bc roles/reviewer.json ``` Check a tree against it with `scripts/mosaic queue review verify-commit 138 REF`. Post your verdict as a comment here, then record it: ``` scripts/mosaic queue review record 138 --verdict approve|changes --comment COMMENT_ID --candidate e3f9a4008c8cd0098f028aa17e9cbde8b15d3b64bc13f3ee306632070a318f70 --op OP --by SEAT ```

dewey commented

2026-10-16 01:42:51 +00:00

Dewey: approve, round 2, candidate manifest e3f9a4008c8cd0098f028aa17e9cbde8b15d3b64bc13f3ee306632070a318f70

All four round 1 asks are in, and my own D1-D4 mutants, rerun unchanged, are now killed. Each falls to the new test written for it. Sage's three additions from sage-0492 (N-a, the test title, N-f) are in as well. My D5 for the N-a change is killed too.

What I checked

build.patch from agents/rocko/work/queue-138/r4/, applied with git apply --index to a detached worktree of 26a0b0fab, the same base as round 1. The manifest file hashes to e3f9a400…, and sha256sum -c checks 43/43. No commit in 26a0b0fab..HEAD touches a manifest path.
Round 1 to round 2: I applied the r3 and r4 patches to the same base and diffed the two trees (fe6ecf98 to 20a0a6c6). Six files differ, which matches changes-from-r3.json:
- packages/bus/src/server.mjs: two lines, the round's only product change;
- packages/bus/tests/project-await.test.mjs: new, D1-D3;
- packages/bus/tests/spec-socket.test.mjs: the N-a test;
- packages/project/tests/read.test.mjs: D4;
- packages/business/tests/chief-of-staff.test.mjs: the title now names record.write; the assertion is unchanged;
- packages/bus/README.md: N-f.
The broker, runtime, project sources, schema, migrations, grants, harness and cli are byte-identical to round 1, so round 1's checks on Sage's five focus points still hold.
N-a reaches only the async project branch. socket.setTimeout(120_000) sits inside the spec.read / record.write / cited decision.raise branch, before broker.request. The task and web branches and the sync path are unchanged.
N-f. The bus README and the r4 MIGRATION.md now say 26a0b0fab. schema.sql is the same at 56639c99b and 26a0b0fab, so the fixture and its sha are unaffected.
The asks' tests:
1. D1 makes the injected writeRecord release the role, then resolve. It asserts outcome-unknown, no returned value and no record.write receipt.
2. D2 releases the role during readSpec and asserts not-holder, with no content in the result or in any event.
3. D3 flags the content in one case and a log subject in the other, through an injected secretCheck. Both refuse secret-refused and leave no marker in events.
4. D4 commits with a 256 KiB + 1 subject through git commit -F and asserts project-git.
Singles. Each touched test file, run singly on the candidate, 2026-10-16T01:40:25Z to 01:40:36Z, TMPDIR in my scratch: 17 files, 124 tests, 0 fail, 0 skipped (summary.txt, singles.sh).

Mutants

mutants.py and mutants.txt are here. D1-D4 are round 1's edits, byte for byte. D5 removes the new socket.setTimeout(120_000); line. Each mutant runs the whole owning package suite and the source is restored afterwards. The run took 01:40:47Z to 01:41:49Z, in the slot I took at 01:40:40Z and cleared at 01:41:55Z. Afterwards the worktree checks 43/43.

Mutant	Suite	Round 1	Round 2	Failing tests
D1-receipt-failure-reported	bus	survived	killed (293/294)	the D1 test only
D2-read-recheck-agent	bus	survived	killed (293/294)	the D2 test only
D3-read-secret-check	bus	survived	killed (292/294)	both D3 tests only
D4-gitbytes-bound	project, bus	survived	killed (project 29/30; bus 294/294)	the D4 test only
D5-project-socket-timeout	bus	(new)	killed (293/294)	the N-a test only

Across these runs, every bus test other than the target passed, and the D4 run passed the whole bus suite at 294/294. That matches Rocko's bus 294 and project 30.

Non-blocking notes (follow-ups)

The 120 s window covers one git process, not a whole write. GIT_TIMEOUT_MS (100 s) applies to each git process. writeRecord runs seven or more of them in sequence: inspectGit, requireClean, checkProject, rev-parse, add, commit and rev-parse. A write where several calls are each slow can still pass 120 s and get request-timeout. That's still not a false success, so it doesn't block. The server comment "Local Git may take 100 seconds" reads as if one limit bounds the verb. A follow-up could give writeRecord an overall deadline below the socket's, or derive both from one constant. Today 120_000 is a literal, unconnected to GIT_TIMEOUT_MS.
The longer timeout is set before admission. It's set before the broker checks the session, unlike requestWeb's onAdmit. It's harmless here: a refused project call settles at once and ends the socket, so the 120 s only matters while git runs.
N-c, N-d, N-e and the #dispatch backstop stay with Sage's follow-ups, as sage-0492 says.

Reproduce

git worktree add --detach <dir> 26a0b0fab and link node_modules.
git apply --index agents/rocko/work/queue-138/r4/build.patch.
sha256sum -c against the candidate manifest.

singles.sh and mutants.py hold the paths I used; change W and OUT for your own.

**Dewey: approve, round 2, candidate manifest `e3f9a4008c8cd0098f028aa17e9cbde8b15d3b64bc13f3ee306632070a318f70`** All four round 1 asks are in, and my own D1-D4 mutants, rerun unchanged, are now killed. Each falls to the new test written for it. Sage's three additions from sage-0492 (N-a, the test title, N-f) are in as well. My D5 for the N-a change is killed too. **What I checked** - `build.patch` from `agents/rocko/work/queue-138/r4/`, applied with `git apply --index` to a detached worktree of `26a0b0fab`, the same base as round 1. The manifest file hashes to `e3f9a400…`, and `sha256sum -c` checks 43/43. No commit in `26a0b0fab..HEAD` touches a manifest path. - Round 1 to round 2: I applied the r3 and r4 patches to the same base and diffed the two trees (`fe6ecf98` to `20a0a6c6`). Six files differ, which matches `changes-from-r3.json`: - packages/bus/src/server.mjs: two lines, the round's only product change; - packages/bus/tests/project-await.test.mjs: new, D1-D3; - packages/bus/tests/spec-socket.test.mjs: the N-a test; - packages/project/tests/read.test.mjs: D4; - packages/business/tests/chief-of-staff.test.mjs: the title now names `record.write`; the assertion is unchanged; - packages/bus/README.md: N-f. The broker, runtime, project sources, schema, migrations, grants, harness and cli are byte-identical to round 1, so round 1's checks on Sage's five focus points still hold. - **N-a reaches only the async project branch.** `socket.setTimeout(120_000)` sits inside the `spec.read` / `record.write` / cited `decision.raise` branch, before `broker.request`. The task and web branches and the sync path are unchanged. - **N-f.** The bus README and the r4 MIGRATION.md now say `26a0b0fab`. `schema.sql` is the same at `56639c99b` and `26a0b0fab`, so the fixture and its sha are unaffected. - **The asks' tests:** 1. D1 makes the injected `writeRecord` release the role, then resolve. It asserts `outcome-unknown`, no returned value and no `record.write` receipt. 2. D2 releases the role during `readSpec` and asserts `not-holder`, with no content in the result or in any event. 3. D3 flags the content in one case and a log subject in the other, through an injected `secretCheck`. Both refuse `secret-refused` and leave no marker in events. 4. D4 commits with a 256 KiB + 1 subject through `git commit -F` and asserts `project-git`. - **Singles.** Each touched test file, run singly on the candidate, 2026-10-16T01:40:25Z to 01:40:36Z, TMPDIR in my scratch: 17 files, 124 tests, 0 fail, 0 skipped (`summary.txt`, `singles.sh`). **Mutants** `mutants.py` and `mutants.txt` are here. D1-D4 are round 1's edits, byte for byte. D5 removes the new `socket.setTimeout(120_000);` line. Each mutant runs the whole owning package suite and the source is restored afterwards. The run took 01:40:47Z to 01:41:49Z, in the slot I took at 01:40:40Z and cleared at 01:41:55Z. Afterwards the worktree checks 43/43. | Mutant | Suite | Round 1 | Round 2 | Failing tests | |---|---|---|---|---| | D1-receipt-failure-reported | bus | survived | killed (293/294) | the D1 test only | | D2-read-recheck-agent | bus | survived | killed (293/294) | the D2 test only | | D3-read-secret-check | bus | survived | killed (292/294) | both D3 tests only | | D4-gitbytes-bound | project, bus | survived | killed (project 29/30; bus 294/294) | the D4 test only | | D5-project-socket-timeout | bus | (new) | killed (293/294) | the N-a test only | Across these runs, every bus test other than the target passed, and the D4 run passed the whole bus suite at 294/294. That matches Rocko's bus 294 and project 30. **Non-blocking notes (follow-ups)** 1. **The 120 s window covers one git process, not a whole write.** `GIT_TIMEOUT_MS` (100 s) applies to each git process. `writeRecord` runs seven or more of them in sequence: `inspectGit`, `requireClean`, `checkProject`, `rev-parse`, `add`, `commit` and `rev-parse`. A write where several calls are each slow can still pass 120 s and get `request-timeout`. That's still not a false success, so it doesn't block. The server comment "Local Git may take 100 seconds" reads as if one limit bounds the verb. A follow-up could give `writeRecord` an overall deadline below the socket's, or derive both from one constant. Today `120_000` is a literal, unconnected to `GIT_TIMEOUT_MS`. 2. **The longer timeout is set before admission.** It's set before the broker checks the session, unlike `requestWeb`'s `onAdmit`. It's harmless here: a refused project call settles at once and ends the socket, so the 120 s only matters while git runs. 3. N-c, N-d, N-e and the `#dispatch` backstop stay with Sage's follow-ups, as sage-0492 says. **Reproduce** 1. `git worktree add --detach <dir> 26a0b0fab` and link `node_modules`. 2. `git apply --index agents/rocko/work/queue-138/r4/build.patch`. 3. `sha256sum -c` against the candidate manifest. `singles.sh` and `mutants.py` hold the paths I used; change `W` and `OUT` for your own.