jason.woltje
b9ea9304fd
Unclaimed files left in the canonical checkout. Inventory: canonical-cleanup-inventory.md (commit-as-evidence groups). detect-secrets scan clean on 2026-11-02: hits are sha256 pins, git object ids, test sentinels already in tracked tests and unit-file lines.
1 line
4.7 KiB
JSON
1 line
4.7 KiB
JSON
{"body":"## Filbert review: row 108 round 1 (#1602): approve\n\nCandidate manifest sha256 `19ef7133db592787c24fa473357687a5741ccd7823627b970624c930a7611dbc` (6 files), as named in request 28485. I rebuilt it in my own worktree at BASE 234121b30 with `build.patch` from packet a6e4fe747. All 6 hashes match, and `git diff --check` is clean. No manifest path has drifted from 234121b30 to HEAD. The patch's added lines have no dashes, bidi or control characters. All six paths are in the brief's file list.\n\n### The brief, item by item\n\n1. **Drop-in guard.** The existing loop over `systemd-analyze --user unit-paths` now globs `mosaic-bus@*.service.d`, `mosaic-.service.d` and `service.d` in each directory, with the same refusals on an unreadable directory or file. Those are the only prefix drop-ins systemd applies to `mosaic-bus@<b>.service`: the name has one dash, so the only prefix is `mosaic-`. The new tests put `WorkingDirectory` and then `ExecStart` in each inherited directory and get exit 1 with the file named and the old unit bytes unchanged. An `Environment=`-only file is still allowed. A dangling directory symlink and a dangling `.conf` symlink both refuse before writing.\n2. **Header comment.** The `render` and `install` lines now carry exactly the flags in `USAGE`: `--copy ID [--copies DIR]`, `--pm`, `--dir`, `--no-reload` and `--claude`.\n3. **Dead `show` arms.** The packet says it removed them. The install fakes in host.test.mjs and stack-copy.test.mjs now answer `list-units` and `exit 99` on anything else, so any unexpected `systemctl` call by install now fails the test, which is stricter than before. The systemd 261 template-rejection arm stays in its test. If install ever ran `show [email protected]` again, that arm would fail it, and so would the `calls` log check. The status fake's `show` arm is reached by `status`.\n4. **Wrapper.** The marker stays on line 2. Two comments follow it, naming the copy root and saying the Q81 lease probe answers at `mosaic-old`. Then come the exact lease line and the final exec. `$root` has already passed `plain_path`, so the comment can't break the file. A rerun stays idempotent: the marker is still on line 2, and the lease line still matches once under `grep -Fxc`. The test asserts lines 2 to 4 and the last line, runs the lease, and shows `check` passing on the new wrapper. The foreign-wrapper case now has matching effective roots and a matching exec, so the marker alone refuses it. That is the fixture fix the packet records after the first marker mutant survived.\n5. **Install-script audit.** I checked it independently. No file in `COPY_PATHS` mentions `@google/genai`, `esbuild` or `protobufjs`. `PI_BIN` in `pi-pin.mjs` and pi's `bin` both select `dist/bundle/cli.js`, and the bundle has no reference to `@google/genai` or `protobufjs`. Its only `esbuild` text is undici's `esbuildDetection` variable, not a load. The unbundled `pi-ai` Google providers do import `@google/genai`, but nothing on the copy's paths runs them. The README paragraph says the warning is expected and why, and that a new runtime loader needs a fresh audit. There is no `allowScripts` change, so the row doesn't stop for Sage.\n\n### Mutants\n\nThe packet's seven mutants cover each new check: miss-prefix, miss-all-services, ignore-unreadable-directory, ignore-unreadable-file, omit-copy-comment, omit-lease-comment and accept-foreign-check-wrapper. I read `mutants.py` and the final `out/mutants/*.txt`. Each mutant is a unique string replacement restored in `finally`, and each fails the case written for it. Reading the tests, I'd expect each one to be killed for the stated reason. For example, with the file-read refusal removed, the dangling `.conf` reads as empty, install exits 0, and the test's `status 1` fails.\n\n### Notes, no change needed\n\n- The new template-261 assertion runs the fake `systemctl` directly. That tests the fixture, not bus-service.sh. It's harmless, and the arm still guards a regression as described in item 3.\n- The inherited-directory tests use the first lookup directory only. The glob list is inside the per-directory loop, and the existing two-directory test covers that loop.\n- The render line in the header comment is padded past the column the other lines use.\n\n### What I ran\n\nI ran the rebuild and the checks above. In my own worktree, with `DOCKER_HOST` pointing at a dead socket, I ran single test files without the slot: `node --test packages/cli/tests/host.test.mjs` passed 41 of 41, and `packages/cli/tests/stack-copy.test.mjs` passed 12 of 12. I did not rerun the mutants, the full CLI suite or the shell suites. Those counts are Rocko's receipts (CLI 187, 7 of 7 killed). The Docker-dependent steps Rocko skipped run in Sage's landing gate.\n\nVerdict: **approve**.\n"} |