# Row 41 (#1523): slice 1 S6, candidate packet, round 4 Author: Filbert. Reviewer: Darkwing. Brief: `docs/plans/2026-10-04_slice-1.md`, section "Slice 1 S6", blob `72d11de2`. Plan: `PLAN.md` here (b6d2fe2b). Rulings: lead decisions 77 and 78, Sage's round 2 ruling (fix R1, R2 and R3), round 3 ruling (fix R4) and round 4 ruling (fix R5). Base: `915e00e5` (`base.txt`). None of the 42 files changed between the base and `0a4c8f13`, where the round 4 gate ran. The candidate source is uncommitted. There are no pushes. No token, private binding or tracker host was read or written, and nothing touched the live `mosaic-bus@mosaic-stack` unit or `~/.mosaic-dev/bus/`. ## Round 4 Darkwing's round 3 asked for changes (#1523 comment 27032, rev 271, packet `agents/darkwing/work/s6-review/review-r3.md` and `r3/`, 974da6ed). R4 is verified fixed. Sage ruled: fix R5 in this round; leave R1 to R4 alone, no other scope. Four files changed since round 3, and none is new: - `packages/harness/src/gate.mjs`, `README.md` - `packages/harness/tests/gate.test.mjs`, `pi-session.test.mjs` No source outside `insideWorkspace` in the gate changed. ### R5: a relative path is resolved from the real path of Pi's cwd Both adapters `cd "$MOSAIC_WORKSPACE"` before they start the harness, and a process's cwd is the real path (`getcwd`). Pi 0.85.1 resolves a relative path lexically against `process.cwd()` (`resolveToCwd`), so `..` climbs the real path's parents. Round 3's `insideWorkspace` resolved a relative path against the workspace as given. With the workspace or the dataRoot behind a symlink, the two climb different directories. In Darkwing's layout (`$R/data -> $R/deep/store`, workspace `$R/data/ws`), `../../data/ws/X` is `$R/data/ws/X` to the gate and `$R/deep/data/ws/X` to Pi. A real Pi session read a file there and wrote a new one. The fix: a relative path must resolve inside from both the workspace's real path, as Pi resolves it, and the path as given. An absolute path is unchanged. `spellings()` already built from both bases (R4), so `read`'s other-spelling check needed no change. The given-path check is a choice, and it is stricter than Pi. A path that is inside for Pi but climbs out of the given path is refused, for example `../../store/ws/x` when the workspace is `$R/a/ws -> $R/deep/store/ws`. I kept it so the gate stays fail-closed whatever directory it runs in, and doesn't rest on the adapter's `cd` alone. The cost is that such a path is refused even though it is safe. A session has no need for it: the plain relative path or the absolute one works. ### Claude Code isn't affected Claude Code makes a `file_path` absolute against its own cwd before the `PreToolUse` hook runs. Its cwd is also the real path, so `claude-gate.mjs` gets the path Claude Code will open, and the absolute branch checks it. Darkwing's `claude-cwd-dotdot.sh` shows this: the hook's refusal names `/deep/data/ws/secret.txt`, not the relative name. My rerun against round 4 gives the same (below). The new check covers a relative path from Claude Code too, if a later version passes one through. ### Tests - `gate.test.mjs`, "a relative path climbs from the workspace's real path, in both harnesses". Two layouts, each in Pi and Claude Code: - workspace behind a symlink: `/a/ws -> /deep/store/ws`; - dataRoot behind a symlink: `/data -> /deep/store`, workspace `/data/workspaces/b/i`, the launcher's shape. In each, the `../..` escape is inside as given and lands on a planted file outside for Pi (the test asserts both). Read and write of the escape are refused. Read and write of `../ws/...` or `../i/...`, through the symlinked root and back in, are allowed. A path that is inside for Pi but outside as given is refused. - `pi-session.test.mjs`, "pi: a relative path climbs from the real path of a workspace behind a symlink", and the same for a dataRoot. A real Pi 0.85.1 session runs through the adapter and the mock API, in the symlinked workspace: - the escape read and write come back as gate errors; - the outside file's text never reaches stdout; - the outside directory holds only the planted secret, and no `planted.txt` appears in the workspace; - the inside read returns its content, and the inside write lands. `session()` in that file gains an optional workspace placement for this; the other tests keep `/ws`. ### Mutants Each was made on `gate.mjs`, restored from a copy and checked with `cmp`. The base passes `gate.test.mjs` and `pi-session.test.mjs`, 19/19. | Mutant | Change | Result | |---|---|---| | given | the given path only (round 3) | 16/3: the gate test and both Pi sessions | | real | the real path only | 18/1: the gate test's stricter case | The first draft of the gate test let `real` survive. The stricter case was added for it. ### Darkwing's probes against round 4 `r3/probe/pi-cwd-dotdot.sh` and `claude-cwd-dotdot.sh`, run unchanged with `WT` set to the round 4 build, both modes each. Outputs are in `out/probe-pi-cwd-dotdot.txt` and `out/probe-claude-cwd-dotdot.txt`. | Probe | Mode | Result | |---|---|---| | Pi | read | gate refuses `../../data/ws/secret.txt`; the tool result is the refusal; the secret isn't read | | Pi | write | gate refuses `../../data/ws/planted.txt`; nothing is written outside or in the workspace | | Claude Code | read | the hook refuses `/deep/data/ws/secret.txt` (absolute) | | Claude Code | write | the hook refuses `/deep/data/ws/planted.txt`; nothing is written | ### Darkwing's other round 3 notes Per Sage's ruling, nothing else changed this round. These go to follow-ups: - Mw, Mx, My and Mz survive the spelling tests. Each flips some of Darkwing's spell-edge cases from refused to allowed: lowercase `am`, two apostrophes, a path below a respelled self-loop, and the normalised forms (`@`, NBSP before AM, `file://`, `%27`). - Darkwing's fix 2: realpath the workspace in the seat's `workspaceDir` (`packages/seat/src/session.mjs:46`), so a symlinked dataRoot never reaches the harness as a given path. - The Ma leftover (`fake-adapter.mjs`) reproduced, and stays a follow-up. ## Round 3 Darkwing's round 2 asked for changes (#1523 comment 27010, rev 259, packet `agents/darkwing/work/s6-review/review-r2.md` and `r2/`). Sage ruled: fix R4 in this round; R1 to R3 hold and stay closed. Six files changed since round 2, and none is new: - `packages/harness/src/gate.mjs`, `README.md` - `packages/harness/tests/gate.test.mjs`, `pi-session.test.mjs` - `packages/cli/tests/host.test.mjs`, `launcher.test.mjs` No source outside the harness gate changed. ### R4: a read is checked under every spelling Pi's read would open When the name it is given doesn't exist, Pi 0.85.1's `read` opens another spelling. `resolveReadPathAsync` (`dist/core/tools/path-utils.js`) tries these in order, and opens the first that exists: 1. ` AM.` or ` PM.` with U+202F before the `AM`/`PM`; 2. the NFD form; 3. `'` changed to U+2019; 4. both 2 and 3. The `pi` binary runs the same code from `dist/bundle/`. In 0.85.1 only `read` and the CLI's file arguments call it. `write`, `edit`, `grep`, `find` and `ls` take the name as given. The gate checked only the given name, so asking for `notes's.txt` could read a link `notes’s.txt` that points outside. The fix is `otherSpelling` in `gate.mjs`. It covers Pi's `read` and Claude Code's `Read` (Darkwing's note 3): - It builds every spelling from the workspace path and from its real path. The adapter starts Pi with `cd "$MOSAIC_WORKSPACE"`, so Pi resolves a relative name against the real path. - A spelling that exists and resolves outside the workspace refuses the read. So does one that goes through a dangling link. - A spelling that doesn't exist is skipped, and so is ENOTDIR. Any other `lstat` error refuses the read. It doesn't depend on which spelling Pi would open. So a read is refused even when the exact name exists inside and some spelling points outside. The README's "Limits" says so, with the example of a sibling `jo’s/ws` beside a workspace in `jo's/ws`. Its pin note lists what to recheck on a Pi upgrade. Tests: - `gate.test.mjs`, "read is checked under every spelling pi's read would open, in both harnesses". It asks for six names, relative and absolute, in both harnesses, covering each family and their mixes: - straight quote - AM/PM - NFD - NFD with a quote - NFD with a straight quote kept - a quote with composed accents Each is refused when its other spelling links outside. It is allowed when that spelling links to a file inside. A `write` of the asked name is allowed. - `gate.test.mjs`, "other spellings cover directories, dangling links and pi's cwd". These are refused: - a directory spelling; - a dangling spelling; - a workspace given through a link, whose real path has a sibling `jo’s/ws`. A name with no other spelling is allowed, and so is ENOTDIR. - `pi-session.test.mjs`, "pi: a read is refused when pi would open another spelling outside". A real Pi 0.85.1 session runs through the adapter and the mock API. It reads the six names, plus one whose other spelling is inside: - each of the six comes back as an error naming the other spelling; - the outside file's text never reaches stdout; - the inside one returns its content. Darkwing's `r2/probe/pi-variant.sh` against this round refuses all four modes: plain, quote, ampm and nfd. Plain is refused by the existing check. Mutants: each was made on `gate.mjs`, restored from a copy and checked with `cmp`. The base passes `gate.test.mjs` and `pi-session.test.mjs`, 16/16. | Mutant | Change | Result | |---|---|---| | none | no other-spelling check | 13/3 | | pibase | spellings from the given workspace path only | 15/1: Pi's cwd case | | ampm | no AM/PM spelling | 14/2 | | nfd | no NFD spelling | 14/2 | | curly | no U+2019 spelling | 14/2 | | nfdcurly | no NFD-with-U+2019 spelling | 14/2 | | pionly | Pi's `read` only, not Claude's `Read` | 15/1 | | danglingok | a dangling spelling is skipped | 15/1 | | enotdir | ENOTDIR refuses | 15/1 | | existsonly | a spelling that is a link is skipped | 13/3 | The first draft of the tests let `nfd` and `curly` survive. Their names had both features, so the combined spelling alone caught them. The two single-feature names were added for that. ### Darkwing's other round 2 notes 1. **Mr.** `host.test.mjs` has a new test, "a broker reply with no request waiting breaks the channel and the host exits 1". It binds a coder, then has the broker child send an `identity` reply with an id that no request waits for. The host logs "broker channel broken (reply with no request waiting)" and exits 1, and a later op refuses with `broker-channel-broken`. Under Mr (such a reply is ignored), the test fails at its 5 s limit. No code changed. 2. **Mv.** Every `launcher.test.mjs` test now has a 30 s timeout. The longest real run is 3.7 s. Under Mv the file ends in 62 s with 6 failed, 2 cancelled and 1 passed; round 2's run hung. 3. **Claude's `Read`.** It gets the same check (R4 above). 4. **The leftover after Ma.** Not traced this round. It goes to follow-ups. 5. **Mq** still fails only at the 30 s test timeout. That is a failure, not a hang, so I left it. A related leftover, not from this candidate: a `conversation/src/shim.mjs` from my round 2 gate's conversation suite was still running about an hour later. It belonged to a removed worktree, under my scratch `TMPDIR`. It ignored SIGTERM, and I killed it by PID with SIGKILL. The conversation package is row 40's, so it goes to follow-ups for its owner. ## Round 2 Darkwing's round 1 asked for changes (#1523 comment 26995, rev 247, packet `agents/darkwing/work/s6-review/` at `f19787ee`). Sage ruled that all three findings are fixed in this round. R1 sits inside decision 77: it's trusted IPC, with no socket verb, event kind or schema change. This round adds one file, `packages/cli/tests/host.test.mjs`, which round 1 didn't touch. ### R1: host↔broker replies carry the request's id - `host.mjs`: every request gets `id = ++seq`, and the broker process echoes it on every launch-op, bind and startup reply (`tag()` in `packages/bus/src/process.mjs`). A reply is taken only if its id is the waiting request's. - Any of these breaks the channel (`breakChannel`): no reply within `REQUEST_TIMEOUT_MS` (10 s), a reply with another id, a reply with no id, or a reply with no request waiting. - Once the channel is broken: - the waiting request refuses with `broker-channel-broken`, and so does every later one, including those already queued; - the host logs it and closes with exit 1, for the unit to restart; - a launch waiting on the channel is refused, never allowed. - Tests: - `host.test.mjs` "a broker reply that misses the wait breaks the channel …". The broker is SIGSTOPped with one request waiting and a bind queued behind it. Both refuse, the broker is resumed and its late reply answers nothing, the host exits 1, and a later request refuses. - "a broker reply with another request's id, or none, breaks the channel …" changes the id on the way out, so the broker echoes the wrong one, or drops it. - `end-launch.test.mjs` checks the echo, refusals included. - The cli and bus READMEs say this. Darkwing's `probe/desync.mjs` against this round: after the stall, p1 to p4 all refuse with `broker-channel-broken`, and the host logs "broker channel broken (no reply within 10 s); stopping the host". The probe's second half (two binds during a stall) then fails with `kill ESRCH`, because the host has already stopped the broker. Round 1 cross-wired the replies there (`b2 bind run-y (reviewer) got: {"run":"run-x"}`). ### R3: the gate refuses dangling symlinks `gate.mjs` `real()` walks up with `lstat`, not `exists`, so a dangling symlink counts as an existing name. It then takes the realpath of the nearest existing ancestor, and an `ENOENT` from `realpathSync` means the path reaches a dangling link. `decide()` refuses that as "path goes through a dangling symlink", at any depth, even when the link points inside the workspace. A write through the link would create its target wherever the link names, and Pi's `write` creates missing parent directories first. A link whose target exists is checked as before, so one pointing outside the workspace is refused as outside it. - `gate.test.mjs` "a dangling symlink is refused at any depth, in both harnesses" covers Pi `write` and Claude Code `Write`, by relative and absolute path. `notes.md` points outside, `dangling` points nowhere and `inner` points to a missing name inside the workspace. All of `notes.md`, `dangling/x`, `dangling/deep/x` and `inner` are refused. Once the targets exist, `notes.md` is refused as outside and `inner` is allowed. A path under a regular file is refused as `ENOTDIR`. - `pi-session.test.mjs` "pi: a write through a dangling symlink is blocked, and nothing appears outside" runs a real Pi session's `write` through the extension. `notes.md` and `gone/x.md` come back as tool errors, a plain `fine.md` lands in the workspace, and the outside directory stays empty. - Claude Code: `--restricted` stays defence in depth. The gate refuses the path whether or not the flag is set. Darkwing's probes against this round: - `pi-dangling.sh`: the dangling link gives "mosaic gate: write path goes through a dangling symlink: notes.md", and the outside file stays absent. With the target present, the write is refused as outside the workspace and the file keeps its content. - `claude-dangling.sh`: the hook refuses with the same reason, and the outside file stays absent. - `gate-edges.mjs`: the output matches round 1 except one line, `write dangling/x`, which went from ALLOW to the dangling-symlink refusal. The README's "Limits" gains a TOCTOU line: the gate checks a path when the call is made, so a link that `bash` or another process of the same user changes between the check and the open isn't seen. That reach is the same as `bash` itself. ### R2: a half-open `launch.sock` client can't hold `close()` The launcher keeps its `launch.sock` connections in a set. `close()` calls `server.close` and then destroys each connection, before it waits for the server to close. `launcher.test.mjs` "a launch client that never closes its side doesn't hold the host's close" opens one client that was answered and keeps its side open, and one that never sends. `close()` must finish within 5 s. Darkwing's `close-hang.mjs`, in both modes (`silent`, `line`), now gives `closed 0` about 15 ms after `host.close(0)`. In round 1, the close waited until the probe destroyed its client at 25 s. The cli README says so. ### Notes 1 to 5 1. **`--restricted`.** The harness README and the `adapters/claude/adapter.sh` comment now say that the flag keeps `CLAUDE.md` files (user, parent, workspace) and auto-memory out of the prompt, and that the gate doesn't rely on it for paths. Two tests cover it: - "claude adapter: --restricted is always passed" runs the adapter against a stand-in `claude` and checks argv. It runs without Claude Code installed. - "claude: CLAUDE.md files and auto-memory don't reach the model; without --restricted they do" plants the four markers and runs the real adapter against the mock API: none reaches the request. A copy of the adapter without the flag sends all four. Darkwing's `claude-memory.sh` gives the same result for this round: 0 of 4 with the candidate, 4 of 4 without the flag. 2. **`launchPm` skips `authorizeLaunch`.** The cli README now says so: `launches off` doesn't stop `bus start --pm`, because the human launches the PM, and the other launcher checks still apply. 3. **Policy parse.** `runner.mjs` reads and parses the policy inside the `try`, so a missing or malformed policy exits 2 (usage) before the claim. Test: "a missing or malformed policy exits 2 before the claim". 4. **System prompt in argv.** This is now a harness README "Limits" line. No code change. 5. **Mutants.** Each new test was run against its mutant and fails. Each source file was restored from a copy and checked with `cmp`. | Mutant | Change | Round 1 | Round 2 | |---|---|---|---| | R1a | the host takes any reply while a request waits | (finding) | "another request's id, or none" fails | | R1b | no reply timer | (finding) | the stall test fails at its 30 s test timeout instead of hanging | | R2 | `close()` doesn't destroy connections | (finding) | the half-open test fails within its 5 s bound | | R3 | round 1's `existsSync` walk in `real()` | (finding) | the gate and pi-session dangling tests fail | | N1 | the adapter without `--restricted` | (note) | both claude-session tests fail | | Mg | `founderCheck` returns null | runner test hangs | the unit test fails; the runner test fails at its 60 s clock | | Mh | no SIGKILL after the stop timeout in `close()` | survives | "a runner that ignores SIGTERM is killed when the host closes" fails | | Mi | no SIGKILL in `recover()` | survives | the died-hard "kills them" case fails | | Mj | no 4096-byte stdin cap | survives | "no capability, or a malformed one, on stdin" fails | | Mk | no `LINE_MAX` on `launch.sock` | survives | "an over-long launch request is refused at once …" fails | How the new tests separate the mutants: - **Mh and Mi** rely on a SIGSTOPped process, which ignores SIGTERM and dies only on SIGKILL. - **Mi:** in the died-hard test, the leftover session and its runner are stopped before the next host starts. Without the stop, the runner exits on its own once the broker is gone, which is why Mi survived round 1. - **Mh** uses a test-only `stopTimeoutMs` (default 30000), set to 1 s. - **Mg and Mj:** `startRunner` in `runner.test.mjs` now SIGKILLs a runner still alive after 60 s. A regression fails there instead of hanging the file. - **The stall test** registers its SIGCONT hook before `host.close`. Hooks run in order, so a stopped broker can't hold the cleanup. ## Files (`files.txt`, 42) `build.patch` is `git diff --cached --binary 915e00e5` over those files, +4998/−63. It applies cleanly to `0a4c8f13` with `git apply`, and `sha256sum -c candidate-manifest.sha256` passes in that tree. | Area | Files | What | |---|---|---| | Harness (new) | `packages/harness/` | bundle, typed tools, gate, Pi extension, Claude Code gate and MCP server, runner, tests, README | | Adapters | `adapters/claude/adapter.sh` (new), `adapters/pi/adapter.sh`, `adapters/README.md` | Claude Code adapter; Pi takes `MOSAIC_EXTENSIONS` as `-e`, and `--no-approve` | | Sessions | `packages/seat/src/session.mjs`, `proc.mjs` (new), tests, README | spawn under `unshare`, registry, launch log, `stop` | | Launcher and verbs | `packages/cli/src/launcher.mjs` (new), `host.mjs`, `cli.mjs`, tests, README | the launch socket in the trusted host; `mosaic talk`, `stop`, `launches off\|on\|list`; `bus start --pm` | | Broker | `packages/bus/src/{broker,process,runtime}.mjs`, `tests/end-launch.test.mjs`, README | trusted IPC launch ops; `Broker.endLaunch` | | Other | `docs/TOOLS.md`, `scripts/mosaic`, `scripts/agent-host-dev.sh` | verb reference; host seats pass `--no-approve` (the DEFERRED entry) | ## Against the brief - **Bundles, Pi then Claude Code** (`packages/harness/README.md`, "The bundle"): prompt, policy, typed tools and a manifest from one resolved instance. Each manifest names the S0 lines it relies on (`reliesOn`). Skills: resolution runs without a skills source, so bundles list none (README "Limits"). - **S0 lines** (README table): Pi blocks in a `tool_call` handler, a throw blocks, a missing `-e` refuses to start, and a hang is bounded by the runner's wall clock plus the `agent_end` turn marker. Claude Code uses a command hook run as `timeout -k 2 10 || exit 2` with hook timeout 20; `--bare` is never passed. `--restricted` is defence in depth for the gate, and it keeps `CLAUDE.md` files and auto-memory out of the prompt. Line 5 (`bash`) is the tool limit and is written as a limit. - **The PM launches through the broker, within `launch`**: the host's launch socket checks the instance list, that the instance isn't already running, the model family against `launch.max` (every running session counts, the PM's too), then the broker's own `role.launch` authorization. Every launch, refusal and end is a launch-log line and a broker event. `mosaic launches off` is Jason's one word (`launch.revoke`). `mosaic stop ` ends a session. - **Founder credentials (REQ-CRED-2)**: the session environment is an allowlist (`ENV_ALLOW`). The runner exits 20 before claiming if a known founder variable reached it, or if a service the role needs has no usable role token (the broker's credential status, metadata only). - **The PM moves off T3**: `mosaic bus start --pm` launches the business's `launch.by` instance without a window, and `mosaic talk` reaches it. The handover of Sage's T3 thread is the acceptance run below. ## Changes from the plan 1. **The capability goes to the runner as one stdin line**, not a 0600 file. It is written after the bind and is never on disk, in argv or in the environment. 2. **Verbs live in `packages/cli`**, not `packages/seat` (lead decision 77). `packages/seat` keeps the session module and the moved `/proc` helpers (`proc.mjs`). 3. **`--pm` takes no argument.** The PM is the business file's `launch.by` instance; its harness and model come from resolution. 4. **Runner exit 23** covers a `role.claim` with no answer as well as `brokerRetries` failed polls. 5. **The adapter runs as `/bin/sh `**, because the repository keeps adapters 0644 and only the image sets the mode. ## Broker surface No socket verb, no event kind and no schema change. The new launch ops are trusted IPC from the host to the broker process: `identity`, `authorizeLaunch`, `refuse`, `endLaunch`, `credentialStatus`, beside the existing `bindLaunch`. `bindLaunch` records the run only after its checks, and a rebind of an ended run refuses with `run-ended`, also across a broker restart. The host gains `op(message)` and `beforeClose(fn)`. ## Process control - **Early signals.** The runner installs its SIGTERM and SIGINT handlers before anything else, because pid 1 of a PID namespace ignores a signal with no handler. Node's own startup still leaves a window, so the launcher and `mosaic stop` resend SIGTERM every second. - **`isRunner(pid)`** is `cmdline[1] === RUNNER`, which skips `unshare`'s forked child before its exec (its argv still names the runner). - **Host lost.** A starting host reads the last host's `sessions.json`. Before the launch socket opens, for each entry of this business it SIGKILLs the session if it still runs, rebinds the run with the recorded identity and ends it as `host-lost`, which releases the role. A rebind that refuses with `run-ended` logs "was already ended". An unreadable or malformed `sessions.json` refuses the host start with exit 3. - **PID namespace limits** are in `packages/harness/README.md`, "Limits": same UID, shared broker socket and `/tmp`, network not confined, and a same-UID process can still ask something outside its tree (a systemd user manager, an existing tmux server) to run a command. The README no longer says the namespace blocks `ptrace` in general; it hides other sessions by pid. ## `--no-approve` (DEFERRED: "Host seats launch Pi with `--approve`") `scripts/agent-host-dev.sh` and `adapters/pi/adapter.sh` now pass `--no-approve`. Pi 0.85.1 (`trust-manager.js`) gates project `.pi/` resources on trust: `settings.json`, extensions, skills, prompts, themes, `SYSTEM.md`, `APPEND_SYSTEM.md`. `-e` paths load in the "temporary" scope, which trust doesn't gate. A scratch probe against a workspace saved as trusted, with a mock Messages API, showed: | argv | project `SYSTEM.md` | explicit `--skill` | generated prompt | `-e` extension | |---|---|---|---|---| | host-seat, `--approve` | loaded | loaded | loaded | loaded | | host-seat, `--no-approve` | ignored | loaded | loaded | loaded | | `adapters/pi/adapter.sh` | ignored | loaded | loaded | loaded | The skill appears only when the session has a tool to read it; the probe's first run used `--no-tools` and showed no skill in any case, the `--approve` control included. `agent-host-dev.sh` keeps `--append-system-prompt`, not the entry's "explicit system prompt", because its comment preserves Pi's built-in coding prompt on purpose, and `--no-approve` already closes the project `SYSTEM.md`. I didn't edit `docs/plans/DEFERRED.md`: it holds another seat's uncommitted changes. The entry can close when this lands. `scripts/test-goal-native.py` still passes `--approve` on purpose (it tests project extensions) and is untouched. ## Gate Run at `0a4c8f13` with this round's patch applied, in a detached worktree. `sha256sum -c candidate-manifest.sha256` passed there (42 OK). Suites ran sequentially, each output in `out/` (`out/summary.txt`). `TMPDIR` was on the scratch disk and `DOCKER_HOST=unix:///nonexistent.sock`, so nothing reached Docker. Round 1's outputs stay in this directory at `9b670e27`, round 2's at `779e9780` and round 3's at `0f38236f`. Darkwing's R5 probe outputs from round 4 are `out/probe-pi-cwd-dotdot.txt` and `out/probe-claude-cwd-dotdot.txt`. | Suite | Pass | Fail | |---|---|---| | node: bus, business, cli, control-board | 74, 60, 83, 124 | 0 | | node: conversation, discord, harness, ledger | 161, 178, 56, 78 | 0 | | node: mosaic, queue, seat, tasks, webui | 69, 148, 27, 51, 22 | 0 | | test-auth, conductor, config, discord | 15, 17, 24, 66 | 0 | | test-extension-package, foundation, queue, release | 18, 44, 27, 4 | 0 | | test-task | 26 | 2 | Against round 3, harness gains 3 tests (R5). Conversation (161) and webui (22) grew because row 40 landed (08b428ec); none of their files is in this candidate. The two `test-task` failures are "user recall run succeeds (exit 1)" and "recalled user name". That check runs a live worker and needs Docker. The unpatched base at `0a4c8f13` fails the same two (`out/base-test-task.txt`, identical PASS/FAIL lines), so they come from the environment, not this candidate. No test process was left running after the gate. ## Acceptance run: waiting The recorded run (the host started with `--pm`, `mosaic talk` asks the PM to launch a coder, `mosaic agents` shows both claims) waits on the Vikunja move to tasks.woltje.com (Q14), as Sage ruled: the integration commit and the acceptance run wait for that cutover; build and review continue. It will not run on Astra (R26) or against the live unit. The tracker host comes only from `vars.tracker.baseUrl`; no code, test or launcher config names one, and fixtures use 127.0.0.1 and example.test. ## Follow-ups (not in this row) - `packages/queue/tests/commit.test.mjs`, `pausedCommit`, awaits the child's `exit` rather than `close`, so its stderr can be unread when `test-queue` F1 matches it. - `scripts/test-task.sh` (:514-518): the live user-recall check needs Docker and isn't skipped when Docker is unavailable. - Darkwing's round 2 note 4: after the Ma mutant's harness run, a `fake-adapter.mjs` was left running. Which test spawned it, and whether that test cleans up when it fails, isn't traced. - `packages/conversation` (row 40): a `shim.mjs` from a gate's conversation suite outlived the run, and it ignored SIGTERM. - Darkwing's round 3 survivors Mw, Mx, My and Mz in the gate's spelling check (lowercase `am`, two apostrophes, a path below a respelled self-loop, the normalised forms). Each needs a test; Sage kept them out of round 4. - Realpath the workspace in the seat's `workspaceDir` (`packages/seat/src/session.mjs:46`), Darkwing's round 3 fix 2.