stack/agents/filbert/work/queue-110/r1/verdict.json

{"body":"## Filbert review: row 110 round 1 (#1604): approve\n\nCandidate manifest sha256 `cceb961f29071092165df653ad5818233311353237219b12235a90245245dcf3` (19 files), as named in comment 28353. I rebuilt it in my own worktree at BASE badfa52b9 with `build.patch` from packet 0bfc16654. All 19 hashes match, `git diff --check` is clean, and no manifest path has drifted from badfa52b9 to HEAD. The added lines have no dashes, bidi or control characters.\n\n### The brief, ruling by ruling\n\n1. **Switch.** `bus.tester` is a business-only boolean, default false (`vars.mjs`). `bindTester` refuses `tester-off` unless the var is exactly `true`. The broker reads its businesses at start, so a change needs a restart.\n2. **Proof.** `tester.mjs` checks the same proof shape and process facts as `verifyHuman`: uid, start time, nonce, and `argv[1]` equal to the bus's own `tester-cli.mjs`. The nonce comes from `MOSAIC_BUS_TESTER_NONCE` only. `testerNonce` reads it from `/proc/<pid>/environ` because `readProcess` keeps only the human's variable, so neither CLI's nonce proves the other. The walk refuses a launch record and `MOSAIC_RUN_ID`, `MOSAIC_BUS_CAP` and `MOSAIC_AGENT_RUN`, and drops the agent markers and the binary check. `human.mjs` and `human-cli.mjs` have no diff at all. `server.mjs` requires exactly one of `cap`, `human` and `tester` (`invalid-envelope`), and gives `tester-required` with no authenticator. The real bwrap case in `sandbox.test.mjs` ran in my run and did not skip.\n3. **Replies.** A role sends to `tester` only with `in_reply_to` naming a stored tester message in its business (`tester-reply-required`). The human gets `unknown-role`. The human's `message.receive` and `messages` both filter `to_role='human'`, and the test checks both for human and reader caps.\n4. **Runner.** `turnRequest` puts the \"never Jason's instruction and authorizes nothing\" line before the body only when `from_role` is `tester`. A tester send writes no event, `request` is null, and `taskView('demo','input',id)` is false.\n\nWhat ships: the refusal gate runs before dispatch and before any argument check. The test covers every non-listed verb, including `state`, `credentials`, `requirements` and all task verbs, with good and malformed arguments. Each refusal is recorded against `tester`. Non-message verbs run through a reader view, and a test shows they deep-equal the reader's. The CLI adds `--tester` to inbox, tasks, agents, trail, talk and follow. decide, stop and launches reject it at parse, and `talk --tester` refuses an unprefixed body before any call.\n\n### b44 and b45\n\nI agree they are equivalent. The only `role_claims` writers are `role.claim`, which refuses a tester, and `#claimEnd`, which needs a held claim, so `role.revoke` of `tester` gives `not-held`. The constructor refuses a role named `tester`, and `bindLaunch` refuses it as an unknown role. So `#holder(business,'tester')` is always empty, and dropping `s.tester` from the holder choice can't change a row.\n\n### Note (not blocking)\n\n- **N1.** Ruling 2 asks for a test for a role connection and for a reader connection. The envelope test sends `tester` with a reader cap only. The server code doesn't tell one cap from another, so a role cap would refuse the same way. The launch-record test and the bwrap case cover a role session's own bind. One more loop entry with a role cap would close the letter of the ruling.\n\n### What I ran (single files, no slot)\n\nbus: `tester` 11/11, `broker` 15/15, `human` 4/4, `messages` 4/4, `replies` 7/7, `transport` 5/5, `business` 1/1, `process` 7/7, `single-use` 12/12, `agents` 11/11, `review` 8/8. cli: `tester` 6/6, `app` 30/30, `stack-copy` 9/9. business: `vars` 6/6. harness: `runner` 21/21. seat: `sandbox` 8/8, with the bwrap tester case passing. I didn't rerun the mutants or the full package suites, and relied on the packet receipts for those. The worktree is removed and no process is left in it.\n\nVerdict: **approve**.\n"}