stack/agents/filbert/work/queue-136/r1/body.md

Row 136 round 1 review (Filbert): approve

Candidate: manifest sha256 38b0d3cda5b7f69a0a4c60fc0434c66ba8cc8e7b834fcb865383dd2ee6d711e8 (5 paths), base e37d6e583, packet agents/dewey/work/queue-136/ in 8e2c5c2d0.

Rebuild: a fresh worktree at 8e2c5c2d0 (current refactor) with build.patch applied. Every manifest hash matched and git diff --check was clean. The added lines have no dash, curly-quote or control characters. The packet manifest checks. No commit from e37d6e583 to 8e2c5c2d0 touches a manifest path.

What I checked and found correct

• Scope. The broker change is in #checkAuthority and the decision.raise supersede check only, plus the new #raisedThread helper. There's no schema step: the helper reads thread_claims, which row 121 added.
• s.thread. bindLaunch sets it to record.thread ?? null. A thread instance must give a thread (thread-required), and another instance can't give one (thread-not-allowed). So a non-thread run's null equals #raisedThread's null, and a thread run's thread is fixed for its life.
• #raisedThread. A thread run claims only s.thread, and it must claim before it can raise. So the latest op='claim' row for raised_by_run is the raise's thread. The release row doesn't match op='claim', so the thread survives the run's end. The query is scoped by business.
• Binding. The approval now binds to the business (#decision is business-scoped), the role instance (raised_by_role, kept), the thread when there was one, and the decision. Class, action, context and target are unchanged. #agent still requires a held claim, so only the current holder of the instance consumes it.
• Single use. #consumeAuthority refuses decision-consumed once any non-raise action.allowed row exists for the decision, whichever run wrote it. No code change was needed. The README names the code and now says "by any run".
• Supersede. The role check is new and needed. Before, the run check implied it. The #closed check stays.
• role.revoke still checks the target's holder run recorded at the raise. The broker.test.mjs "replaced role holder" checks are unchanged.
• Strict thread equality. A thread instance's decision from before row 121 has no claim row, so no thread run can consume or supersede it. That fails closed, and it's no worse than before, when it was bound to a run that has ended. The README says so.
• Changed expectations. broker.test.mjs:287 and the single-use "another run" test both asserted the run binding the brief replaces. The single-use test still checks that a refused check consumes nothing, and it now checks single use across runs.
• Tests against the brief. approval-binding.test.mjs covers each brief case:
  • a new run consumes after the raising run ends and the store reopens;
  • a second consumption refuses, by the same run and by a third run;
  • another instance of the same definition refuses;
  • a run in another thread refuses;
  • supersede works from a later run of the same instance and is refused from another instance or another thread.

Notes (non-blocking)

1. decision.withdraw is still run-bound. A later run can supersede an open decision but can't withdraw it. Dewey recorded this on #1630 (28620), and sage-0387 keeps it out of the row.
2. The pre-row-121 null-thread case has no test. It's a deliberate fail-closed choice, and the brief doesn't ask for it.
3. The close message's thread lookup (broker.mjs about line 1172) duplicates #raisedThread's query. Dewey noted it as out of the row's scope.
4. Base drift. Row 144 landed 19fabe47c, 91b963e25 and 193ae70c6 after the base. They touch no manifest path, but they do change roles/, bus tests/requirements.test.mjs, and cli and webui files. Dewey's gate log doesn't say which base its worktree was on. I ran bus requirements (3/3) and business csuite (6/6) on the candidate at 8e2c5c2d0. Sage's landing gate on the landing base is still part of the row's gate. Row 145 (task 305) also changes broker.mjs; whichever lands second rebases.

What I ran and what I took from receipts

I ran, as single files on the candidate at 8e2c5c2d0 with TMPDIR set and Docker disabled, all with 0 fail and 0 skipped:

Test file	Result
bus approval-binding	5/5
bus single-use	12/12
bus broker	16/16
bus decision-route	5/5
bus decision-close	8/8
bus decisions	7/7
bus agents	11/11
bus messaging	13/13
bus threads	14/14
bus message-citation	3/3
bus end-launch	7/7
bus chief-of-staff	13/13
bus requirements	3/3
business csuite	6/6

I also ran three mutants of my own on broker.mjs, each against approval-binding, single-use and broker. The tree matched the manifest again afterwards.

Mutant	approval-binding	single-use	broker
F1: #checkAuthority back to d.raised_by_run !== s.run	2 fail	1 fail	1 fail
F2: #checkAuthority drops the thread check	1 fail	0	0
F3: supersede back to old.raised_by_run !== s.run	2 fail	0	0

From Dewey's receipts, not rerun by me:

• the 4 of 4 mutants in MUTANTS.md;
• the gate from 22:25:05Z to 22:29:11Z, exit 0: bus 219, cli 203, harness 90, plugins 21, seat 135, tasks 97, webui 112, and the ten scripts/test-*.sh.

I took no slot.