stack/agents/filbert/work/queue-137/r1/body.md at dev-console

0 Fork 1

Files

T

jason.woltje b9ea9304fd lead: commit filbert's untracked evidence (273 files: queue-101 queue-102 queue-105 queue-107 queue-108 queue-109 queue-110 queue-112 queue-113 queue-114 queue-115 queue-116 queue-119 queue-120 queue-122 queue-123 queue-125 queue-126 queue-128 queue-129 queue-130 queue-131 queue-132 queue-133 queue-134 queue-135 queue-136 queue-137 queue-139 queue-140 queue-141 queue-142 queue-145 queue-146 queue-147 queue-148 queue-149 queue-150 queue-151 queue-152 queue-153 queue-154 queue-155 queue-156 queue-162 queue-163 queue-165 queue-166 queue-167 queue-169 queue-170 queue-175 queue-177 queue-181 queue-182 queue-184 queue-185 queue-186 queue-187 queue-188 queue-49 queue-64 queue-66 queue-70 queue-71 queue-80 queue-84 queue-85 queue-87 queue-88)

Unclaimed files left in the canonical checkout. Inventory: canonical-cleanup-inventory.md (commit-as-evidence groups). detect-secrets scan clean on 2026-11-02: hits are sha256 pins, git object ids, test sentinels already in tracked tests and unit-file lines.

2026-11-02 15:05:14 -06:00

7.0 KiB

Raw Permalink Blame History

Row 137 round 1 review (Filbert): changes

Candidate: manifest sha256 a2f942048900aaf35f1ea07e4e36d4da0ebaa1fae2ded7420cc9ec019b3c5758, 31 paths, base 7a2987cf5, packet agents/darkwing/work/queue-137/ (request comment 28780, packet note 28781). Brief: docs/plans/2026-10-15_q167-rows-r3.md at blob 6805904555.

The design holds and the code reads correctly. Two tests the brief requires are missing, so this is changes. Both are small.

Rebuild

A fresh worktree at 7a2987cf5. r1/build.patch is a plain diff, so I applied it with git apply --index.
All 31 manifest hashes matched, and git diff --cached --check was clean (31 files, +1999 -255).
The added lines have no dash, curly-quote or control characters.
No commit from 7a2987cf5 to refactor HEAD touches a manifest path.

Blocking

B1. No host-side test for patch-drift. The brief's test list ends with "each land-work refusal code". working.mjs prepareLand refuses patch-drift when the applied diff's patch-id differs from the reviewed one, but no test in packages/seat/tests, packages/cli/tests or packages/bus/tests names the code. Only scripts/test-land-work.sh does, for land-work. BUILD.md's coverage table for "Each land-work refusal code" lists every other host code and leaves this one out without saying why.

I checked it with a probe: with the check changed to if (false) refuse("patch-drift", ...), seat working.test passed 24/24 and cli git-socket.test passed 23/23. A test can reach the check the way land-work's does, with a tampering git first on the PATH that working.mjs passes through gitEnv.

B2. No test pins push's unrelated-history check to main. The brief asks for "push's unrelated-history check against main". The existing test (working.test line 164) runs where main and root are the same commit, and the new "after a landing, a push built on the root still lands" test pushes a commit that shares history with both. With the check changed to compare against refs/heads/root, seat working.test passed 24/24 and cli git-socket.test passed 23/23. A test where root no longer shares history with a landed main (an orphan root, say) would tell the two apart.

Sage's check: the gated refusal and the arbiter acceptance

Both are left to row 139, and the packet says so. BUILD.md "Arbiter path and gated refusal left out" (line 305) says 137 will probably land first and leave "the gated-merge refusal and the host op's arbiter acceptance, with their tests, to 139 (sage-0535)", and that Darkwing adds both in another round if 139 lands first. The "REQ-LAND-1 and the gated path" section names where the refusal goes (checkLand and recordLand, after #checkAuthority).

The candidate is safe in either order. packages/bus/src/landing.mjs readLanding still requires one human answer through cli for both callers, so an arbiter-resolved decision refuses not-human on the host and in land-work. read.mjs only wraps readLanding with base refactor, so land-work's check is unchanged, as the re-pinned brief asks.

What I checked and found correct

The trail. Each host refusal reaches the task's trail. Before the ticket: checkLand runs inside runtime.mjs refusing, which calls broker.refuse with the task ref, and the git socket's own refusals (land-busy, invalid-request and the like) go through serve's host.op({op: "refuse", ...}). After the ticket: refused() in startLand sends landRefused, which writes action.refused on the task. A Recorded error only answers the socket, so nothing is recorded twice.
The seed. root is fetched forced; main is created once with an empty old value and then follows root only when it is an ancestor (merge-base --is-ancestor), by compare and swap. main is never forced, as the brief says.
prepareLand and finishLand. The squash is MB..C applied to main's tip with the same patch-id, made before the gate starts. finishLand moves main by compare and swap and moves it back if the broker refuses the record (rollback-failed when it can't). dropLand removes the node_modules link before the worktree.
One landing at a time. doLand takes the slot before its first await and frees it unless the background gate owns it. That block's finally frees it on every path, and dropNetwork never rejects.
The gate. One definition in packages/seat/src/landing.mjs for both callers. isMosaicStack needs node_modules and HEAD descending from c2365ae51. The host runs it with gateEnv's twelve variables.
The binding. The launcher binds the git socket when landHeld is true, and sandbox RUNNER_FILES adds bus landing.mjs, which broker.mjs imports. MERGE is reserved in recordEvent, so no run can write the landing's action.allowed (land.test pins it).

Notes (non-blocking)

Three host codes are the broker's, not land-work's. On the host #checkAuthority runs first, so not-a-merge, not-resolved and not-merge-option reach the role as decision-mismatch or decision-not-approved. The brief scopes the broker change to the authority check for the new op, and BUILD.md (line 368) says so. I'm not blocking on it; Sage may want the brief's "with land-work's code" read that way on the record.
The RESULT message goes past "the authority check for the new op only". BUILD.md (line 166) flags it and offers the narrower fallback. Scope is Sage's call.
The gate runs reviewed, agent-authored code on the host, outside a sandbox, with HOME and DOCKER_HOST. BUILD.md says so (line 235). The human-resolved decision and the approving verdict are what authorize it, as with land-work today.

Doc-only, follow-up

agents/darkwing/work/queue-137/BUILD.md line 308 says "Row 139 isn't built yet". Row 139 was built and reviewed in round 1 (comment 28773) and is in round 2. The conclusion, that 137 probably lands first, still stands. grep -rlF queue-137 packages/*/tests scripts/test-*.sh finds nothing.

What I ran and what I took from receipts

I ran, as single files on the candidate with Docker disabled, all with 0 fail and 0 skipped. TMPDIR was set to scratch except for cli launcher and cli thread-launch, which used the inherited TMPDIR.

Test file	Pass
bus land	8
bus project-runtime	3
bus broker	16
cli git-socket	23
cli launcher	19
cli thread-launch	8
harness bundle	22
harness git-tools	5
harness tools	19
seat working	24
seat landing	8
seat checkout	77

cli thread-launch first failed 5 of 8 under the TMPDIR override (the bwrap runner), then passed 8/8 with the inherited TMPDIR.

The two probes for B1 and B2 were one edit each to working.mjs in my worktree, each run against seat working.test and cli git-socket.test. I restored the file and the manifest checked again afterwards. I did not run scripts/test-land-work.sh, any suite or any gate.

From Darkwing's receipts, not rerun by me (r1/gate-run.log): the gate from 18:49:43Z to 18:55:25Z ended GATE_PASSED with every step rc=0, including bus 302, business 109, cli 202, cli launcher 19, seat 148, harness 108 and land-work 84 passed, 0 failed. Darkwing ran no mutants.

7.0 KiB Raw Permalink Blame History