jason.woltje
b9ea9304fd
Unclaimed files left in the canonical checkout. Inventory: canonical-cleanup-inventory.md (commit-as-evidence groups). detect-secrets scan clean on 2026-11-02: hits are sha256 pins, git object ids, test sentinels already in tracked tests and unit-file lines.
3.3 KiB
Row 131 round 2 review (Filbert): approve
Candidate: manifest sha256 466c835f7dce79d20c7ab74c197a52b70e7fdeb0efae0456222dc6d0a633f219 (14 paths, now including organization.mjs), base 0bdd573ff, packet agents/dewey/work/queue-131/r2/ in 80797a539.
Rebuild: a fresh worktree at 0bdd573ff with the r2 build.patch applied. Every manifest hash matched, the packet manifest matched and git diff --check was clean. The added lines have no dash, curly-quote or control characters. No commit from 0bdd573ff to HEAD touches a candidate path.
Round 1 findings
| Finding | Status | How I checked |
|---|---|---|
| F1 setter publishes a non-JSON value | Fixed (F1a and F1b) | I reran my round 1 probe on the candidate. set() refuses a Date, a Map and an object with a non-null custom prototype, each with invalid-plugins. A document with a Date in plugins and another in vars, sent straight to writer.write, throws BusinessError. File bytes unchanged and no changes.jsonl. |
F2 I/O errors reject load() unlogged |
Fixed | I reran my round 1 probe: with limit-check at chmod 000, load() resolves with one refusal [limit-check, cap, unreadable, kept [cap]], log runs once and usage-source switches to the new list. fsCall wraps the lstat and both realpath calls. |
| Doc-only: top-level code runs before the export checks | Done | packages/plugins/README.md:105 |
| Note: no unmutated control | Done | MUTANTS.md Control: six test sets on the unmutated candidate, all exit 0, 0 skipped. |
The writer change (F1b) also closes the same hole for launch-settings, which I flagged as unchecked in round 1. My vars Date case goes through the same writer path. Keeping the in-memory validate before JSON.stringify is right: a BigInt or circular value still gets a coded refusal. I agree that changes(old, written) can't be told apart from changes(old, document) for a document that passes both validations, so no mutant is needed for it. Mutant 47 covers the check that refuses.
organization.mjs is row 122's writer. Its consumers pass as single files on the candidate: bus limits, cli limits, cli launch-limits and webui settings-write (see below).
Notes (non-blocking)
- A writer refusal from the parsed-bytes check is a BusinessError with no
code, the same as the writer's existing validation refusals. The setter's own refusals are coded, so ruling 2 holds for the setter.
What I ran and what I took from receipts
I ran, as single files with TMPDIR set and Docker disabled, all at 0 failures and 0 skipped:
| Test file | Result |
|---|---|
| plugins kinds | 5/5 |
| plugins loader (the chmod tests ran) | 16/16 |
| business plugin-settings | 4/4 |
| business business | 15/15 |
| business launch-settings | 8/8 |
| bus limits | 3/3 |
| cli limits | 3/3 |
| cli launch-limits | 1/1 |
| webui settings-write | 3/3 |
I also reran the F1 and F2 probes above.
From Dewey's receipts, not rerun by me:
- the targeted gate: plugins 21, business 92, bus 171, webui 112 and cli 195, all at 0 failures and 0 skipped (591 total). The five gate/ logs agree.
- 47 of 47 mutants killed. mutants/results.json has 47 entries, all KILLED, including 43 to 47 for this round. The six control runs are in mutants/control.json.
I took no slot. Sage's full gate at the landing target is still to come.