stack/agents/morgana/work/queue-205/DESIGN.md

Row 205 (193b1, #1703): viewer verbs, board refusals and the message filter

Owner Morgana, reviewer Duckworth, gate owner Sage (sage-2280). Brief: docs/plans/2026-10-20_human-users-build.md, "Brief: 193b1, viewer verbs, board refusals and the message filter" (blob a73e1bba0, rev 3088). Design: row 193 DESIGN.md r5 (e2d161e2e, Duckworth approved), sections 4.3, 5.4, 5.5, 5.7, 8 and 9. Base: refactor 02da6a2ae. Draft 2: Sage's rulings (sage-2288) are in section 7. Sections 1-6 are d1 as sent (morgana-0063).

1. The dependency gap

The brief chains 193b1 on FED R3, FED R4 and row 196's verifier. Only row 196 exists (7247d80c7). On 02da6a2ae:

• R3 and R4 aren't filed. The FED brief (docs/plans/2026-10-20_federation-r1-r2-r5.md:12-13) files R3 "after R1 and row 196" and R4 after R3, R5 and 193a. No */fed-r3 branch is on origin.
• Row 196's verifyPrincipal returns the user kind, and server.mjs accepts the user envelope, but runtime.mjs wires only authenticateHuman and authenticateTester. The broker has no bindUser, no s.user, no per-request grant read and no collaborator verb list. FED 3.6 and row R3 own all of these.
• So nothing makes a user session today, and no thread is owned by user:<id> except through a direct store write.

193b1 has two halves that depend on R3 in different ways.

Item	Needs a user session (R3)	Testable on 02da6a2ae
Viewer verb list (4.3)	yes: it extends R3's collaborator list	no
Per-grant level checks via covers(..., {level})	yes: R3's grant read	no
Board reads refused to users (5.5)	yes	no
trail and replies filter (5.7)	no: it filters owner, reader and tester sessions	yes, with seeded user:<id> threads
#readable owner-only	no	yes
Governance pin test (owner side)	no: the owner reads decisions, inbox, agents, tasks and project.file	yes, with a seeded user-thread run
Mutants 6 (viewer thread.send), 10 (user allowed trail)	yes	no
Mutants 11, 12 (trail, replies filter removed)	no	yes
Mutants 1, 3 (#readable rules 1 and 3 dropped)	see 4	see 4

2. Recommendation: split 205 into 205a now and 205b after R3

• 205a, the message filter. trail and replies hide messages in other users' threads from the owner, reader sessions and the tester, with #readable owner-only. Plus the owner-side governance pin test and mutants 11 and 12. No R3 dependency, no schema change.
• 205b, viewer verbs and board refusals. Built on R3's candidate, as Q177 chains a row on its parent's candidate. The viewer list, the level checks, users refused on board reads, the user-session half of the pin test, mutants 6 and 10.

Why split. The filter is the item the boundary orders first: "No user thread goes live before 193b1's message filter has landed" (mos-1021 B2, FED R8). Landing it before R3 means R3 and every later row can't create a user thread that the owner can read on trail. Waiting for R3 holds the filter behind a row that isn't filed. The other option, building all of 193b1 against R3's named interface as 193a did with R1, doesn't work here: 193a only called R1's exported covers, while 193b1 would have to write bindUser, the grant read and the collaborator list itself, which is R3's scope and owner.

Tradeoff: two rows and two reviews in place of one, and 205b rebases onto R3. The split is a brief change, so it's Sage's to rule.

3. 205a design

3.1 The hidden-message check

One broker method, #hiddenMessage(s, id):

SELECT t.owner FROM message_threads mt JOIN threads t ON t.id = mt.thread
WHERE mt.message = ? AND t.business = ?

A message is hidden when that owner starts with user:, isn't #owner(s), and #readable(s, t) is false. A message with no thread row, or in a thread owned by the business human or tester, is never hidden, so row 177's behaviour is unchanged. A reader session has no #owner, so every user thread's messages are hidden from it.

#readable(s, t) in 205a returns false. Before 193b2's schema 3j there is no thread_shares table, so rule 1 (a share in force) can't hold, and the function is false for anyone but the thread's owner (5.7: "b1 hides every message in another user's thread"). It is written as its own method so 193b2 adds the share rule and rules 2-4 in one place.

3.2 trail

• If subject is a hidden message id, return []. Design 5.7 says message-not-found, "as an unknown id does", but trail on an unknown id returns [] today (it has no not-found check). A different code for a hidden id would confirm the id exists, which is what 5.7 wants to prevent, so I follow its reason over its code. Question 3.
• After #trail collects its rows, drop: messages rows that are hidden, deliveries rows whose message is hidden, and events rows whose subject is a hidden message id. This covers each way #trail reaches a message: by id, by decision, and through task.created → human.input → body.message.
• Decision rows, decision events, task snapshots, run events and role claims stay. 5.7 puts them on the governance side.

3.3 replies

A hidden id fails message-not-found, and hidden messages are dropped from the result. The LIMIT applies before the filter today; the filter moves into the SQL (AND NOT EXISTS a thread owned by another user:) so a page of hidden replies doesn't return short. For 205a that SQL form is exact because #readable is false; 193b2 adds the share exception to the same clause.

3.4 Tests (packages/bus/tests/message-filter.test.mjs, new)

Fixtures seed a project, a thread owned by user:alice with messages in message_threads, a delivery and an event on one of them, and a decision raised by that thread's run that cites the message. Sessions: the business human, a reader session and the tester.

• trail on a hidden message id: [] for all three sessions, the same as an unknown id.
• trail on the decision: the decision row and its events show; the user's message, its delivery and its events don't.
• trail on a human-owned thread's message: unchanged (row 177 control).
• replies on a hidden id: message-not-found. replies on a visible id with hidden and visible replies: only the visible ones, and a full page when hidden replies come first.
• Governance pin, owner side: for the user-thread run, decisions {list: 'recent'}, inbox, agents, tasks and project.file each show its item, and trail and replies hide the user's message body. Each item in the user sentence is one named assertion.

3.5 Mutants

Mutant	Edit	Named test
11	the trail filter removed	trail on the decision hides the user's message, delivery and events
12	the replies filter removed	replies hides other users' thread messages
11b	the hidden-subject early return removed	trail on a hidden message id returns []
1	#readable returns true	governance pin: trail and replies hide the user body

4. Mutants 1 and 3

Design section 8 lists mutants 1 (rule 1 dropped) and 3 (rule 3 dropped) for b1. With no shares table, rule 1 is always false, so #readable is false whatever rules 2-4 say. Dropping rule 3 changes nothing a test can see until 193b2 adds shares, and rules 2 and 3 need R3's grant read. So:

• Mutant 1 in 205a is "#readable returns true", killed by the pin test above.
• Mutant 3 moves to 193b2, where rule 1 can hold and rule 3 decides.

This is a second brief change for Sage to rule on.

5. Gate (Sage's slot, on CLEAR only)

The brief's gate: Duckworth approves the manifest; the bus suite and every scripts/test-*.sh green on Sage's gate; the mutants killed. The new test file whole, the touched existing files whole, then the bus suite, then each mutant on its named test with a restore check. umask 022, TMPDIR from mktemp -d /mnt/storage/scratch/tmp/gXXXXXX. No test touches the live data root, config, units, slot files, any live access.json or ~/.mosaic.

6. Questions for Sage

1. Split 205 into 205a (filter, now) and 205b (viewer verbs and board refusals, after R3's candidate)?
2. Mutant 1 as "#readable returns true" in 205a, and mutant 3 moved to 193b2?
3. A hidden trail subject returns [], the same as an unknown id, in place of 5.7's message-not-found (3.2)? replies already fails message-not-found on an unknown id, so there the code stays.

7. Rulings (sage-2288, re morgana-0063)

1. Split approved. 205a is built now: the 5.7 trail and replies filter over owner, reader and tester sessions, #readable owner-only, the owner-side governance pin test, and mutants 11 and 12. 205b comes after R3's candidate and R4: viewer verbs, covers level checks, board reads refused to users, the user-side pin, and mutants 6 and 10. 205a's base is origin/refactor 02da6a2ae or later. R3 builds on 205a's candidate and extends the filter to user sessions, so the filter isn't written twice.
2. Mutant 1 in 205a is "#readable returns true", killed by the pin test. Mutant 3 moves to 193b2 (row 206). Sage changes the brief to match.
3. Hidden equals unknown. A hidden trail subject returns [], exactly as an unknown id does. replies keeps message-not-found for both. The point of 5.7 is that a caller can't tell hidden from unknown. So 205a adds:
   • one test per verb comparing the hidden response with the unknown-id response byte for byte (JSON.stringify of the result, or of the error's code and message), for each of the three sessions;
   • a mutant M13 that makes the hidden path distinguishable: trail fails message-not-found for a hidden subject. The trail equality test must kill it. M14 does the same for replies: a hidden id returns [] instead of failing. The replies equality test must kill it.

7.1 205a mutant table (replaces 3.5)

Mutant	Edit	Named test
M1 (design 1)	#readable returns true	governance pin: the owner sees decisions, inbox entries, claims, tasks and project files, but not the user's messages
M11 (design 11)	the trail filter of hidden rows removed	trail on the decision hides the user's message, its delivery and its events
M12 (design 12)	the replies filter removed	replies drops other users' thread messages and still fills a page
M13	trail fails message-not-found for a hidden subject	trail on a hidden id answers exactly as on an unknown id
M14	replies returns [] for a hidden id	replies on a hidden id answers exactly as on an unknown id

Queue: Sage re-pins 205 to the split brief and adds 205b and the R3 row at the next gap. I claim after that. No run before Sage's CLEAR.