# Row 296 / #1802 — R2 scoped acceptance verified; review pending

Base: e0c6142f3a411ed70e32b2c50d01930e0b0641c8. Branch: lena/row296-r2. Reviewer: Filbert. Gate owner: Sage.
Handoff: c6ab9bdc9 preserved as ad84c1e45, rebased as 4a16ebaa4, including
agents/quackerjack/work/queue-296/BUILD.md. Every changed path is in MANIFEST.sha256,
except the checksum file itself (self-hash is excluded). No product file or pre-existing test changed.
Pre-existing test numstat: empty. BUILD-LOG.md and docs/SESSIONS.md are append-only additions.

Binding ruling: sage-3625 replaces the brief's transient-unit start with plain child Consoles and
explicit test stand-ins. **This candidate does not prove genuine outside-agent ancestry.**
It creates no transient systemd unit and makes no systemd CLI call. R8 remains row 209.

## What is real, and what is a stand-in

- Two configs created by bootstrap --instance hub/factory, two marked data roots, real Console
  cli.mjs serve --sso --send, real broker runtime and launcher, real path-bound human-cli and
  user-cli wrappers, real access loader, CLI writes/reload, grant filters and revocation.
- One existing HTTPS fakeOidc server, two issuer/client identities. Its generated CA is trusted
  only through NODE_EXTRA_CA_CERTS in this test's child environment, never any trust store.
- federation-host.mjs replaces verifyHuman's readProcess argument with actual process fields plus
  ppid=1, exactly the test pattern Sage named. This stands in for Jason's shell on setup,
  grant/revoke and both Consoles' transports. The actual Console parent/path check remains.
  There is no product parameter, environment switch or altered verifier default.
- fakeHarnesses replaces only the pi harness adapter() with a scratch shell invoking the existing
  thread-adapter.mjs. The existing webui channel is re-exported unchanged. No network model runs.
- Public HTTPS origins are modelled through HTTP loopback requests with matching Host/Origin;
  reverse-proxy TLS deployment is outside this scratch proof.

## Acceptance map

All checks live in `FED R7 scratch two-instance acceptance` in
packages/cli/tests/federation-acceptance.test.mjs.

| Requirement | Assertion/evidence |
| --- | --- |
| Isolated instances | different config paths/data roots/ports; scratch HOME/TMPDIR; two named markers from bootstrap; port 0, forbidden live ports 7330–7332 checked |
| Jason is collaborator, not owner | owner melanie; access user jason-test, home factory, fake sub jason-test-sub; hub /api/config user=true |
| One project, one granted instance | actual access grant CLI, projects=[shared], instances=[assistant]; user project list contains shared only |
| Thread and reply | create thread on shared, POST message, correlated RESULT with in_reply_to=sent.id, from_role=assistant, to_role=user, body contains question |
| Other project refused | private project absent from listing; create on private returns 403 access-refused |
| Board reads refused | /api/board, /api/bus/inbox and /api/bus/tasks return 403 owner-only |
| Factory sees no hub objects | Jason sub refused at factory; factory owner sees factory-only project and no threads; hub cookie gets 401 at factory |
| Revoke takes effect | actual access revoke CLI; existing hub session 401 and re-login 403 |
| Claim and process ended | live run before revoke; end log exitCode=0; no registered sessions; engine and runner pid/startTime gone; readonly claim history has revoke/access-revoked before the process-end wait, latest op=revoke afterward |
| Normal cleanup | EXIT trap terminates only recorded pid/startTime-checked groups; checks no live group member, no recorded TCP/Unix listener, no other scratch Unix listener, removes scratch directory/socket files |
| Killed-driver cleanup | --kill-after-start prints both-Consoles-started marker then SIGKILLs test driver; shell performs the same independent cleanup; expected nonzero run with successful cleanup line |

## Verification commands (executed on sage-4035 CLEAR)

- scripts/test-federation-acceptance.sh — must exit 0, one acceptance test passes, cleanup line present.
- scripts/test-federation-acceptance.sh --kill-after-start — must exit nonzero, print the explicit
  interruption marker and `R7 cleanup: no child groups, ports or sockets remain; no units created`.
- python3 agents/lena/work/queue-296/mutants.py M1 — once-only R5 grant projects -> ['*']; must fail
  `R7 ungranted project must not appear` and verify cleanup, then restore original source bytes. Python relies on the shell's own run deadline and cleanup; no outer killing timeout.
- python3 agents/lena/work/queue-296/mutants.py M2 — once-only R4 claim end omitted; must fail
  `R7 revoke must end the claim as access-revoked` before shutdown, verify cleanup and restore bytes.
- Sage integration gate remains separate: every scripts/test-*.sh and full applicable suites per Sage; not run in this scoped slot.

Status: scoped gate passed: plain 1/1 (exit 0), killed-driver expected exit 1 with verified cleanup, M1/M2 drivers exit 0 with named assertion kills and source restoration; normal whole-file invocation exit 0 with one intentional dedicated-script skip. All cancellations 0. Receipts in run-r2/; counts and commands in BUILD.md.
The script never silently skips a missing tool/sandbox/provider: prerequisites fail the acceptance.
Ordinary CLI suites skip the dedicated test until invoked by its owning script.

Static-review follow-up: filbert-296-first-push-static. C1 removes Python's outer timeout so it
cannot SIGKILL the shell before EXIT cleanup. N2 moves the named claim-history assertion before
the process-end wait. N1's spawn-to-ledger SIGKILL gap is retained and documented in BUILD.md;
--kill-after-start exercises the fully recorded groups. N3 remains a cosmetic fixture limitation.
N4 indentation corrected. N5 scratch-bootstrap config overwrite is explicitly fixture-only.

R2 provenance: source identical to the statically cleared a1321f8f9. Rebase mapping/range-diff
and stable patch IDs are in run-r2/. Only append-log conflict context changed. No unexpected
first-run failure, no old test changed/run, and no broader suite or shared gate claimed.
Manifest coverage is the complete changed-path set over e0c6142f3..candidate, including all
text evidence and this description; only MANIFEST.sha256 itself is excluded from its own hash.