Unclaimed files left in the canonical checkout. Inventory: canonical-cleanup-inventory.md (commit-as-evidence groups). detect-secrets scan clean on 2026-11-02: hits are sha256 pins, git object ids, test sentinels already in tracked tests and unit-file lines.
5.2 KiB
5.2 KiB
Row 139 round 1 review (Filbert): approve
Candidate: manifest sha256 5657702e1e255164e41cb57d32487146e28ed935eb3d3eb19812e1c95d78d0a5, 8 paths, base 5661bd233, packet agents/dewey/work/queue-139/ in 62f354746 (request comment 28772). Brief: docs/plans/2026-10-15_q167-rows-r3.md at b2a2d741c.
I found no defect. Every test the brief asks this row for is there, and the REQ-LAND-1 refusal is correctly left to row 137 under the b2a2d741c carry rule. The notes below don't block.
Rebuild
- A fresh worktree at
5661bd233. build.patch is a plain diff, so I applied it withgit apply --index. - All 8 manifest hashes matched, and
git diff --checkwas clean (8 files, +255 -40). - The added lines have no dash, curly-quote or control characters.
- No commit from
5661bd233to refactor HEAD touches a manifest path. The commits since the base are the brief re-pin, the queue revisions and Dewey's packet and SESSIONS line.
Brief tests, each found
- Each hard wait: bus hard-waits.test.mjs routes all eight to the human uncited, cited, and cited with a domain, and the arbiter's resolve is refused
human-required. - REQ-WAIT-2: the broker refuses a business granting any hard wait within-role or cross-role (
invalid-authority), and accepts the four actions that left. - A cited merge raised by merge-gate goes to the technical arbiter, and the arbiter resolves it.
- An uncited gated raise goes to the human, for each of the four actions that left.
- A stale citation refuses
stale-specand an unconfirmed onespec-unconfirmed, with no decision written. - land-work:
not-human:arbiter-crossandnot-human:arbiter-citedin scripts/test-land-work.sh. - The coder land-refusal test rides with the REQ-LAND-1 refusal. Row 137 has not landed (
git log 5661bd233..HEADholds no land code), so row 137 carries both as the brief says. Sage checks this at each landing, and if 137 lands first this row needs a round 2.
What I checked and found correct
- Routing.
HARD_WAITSisACTIONSminus the explicitROUTEDset, so a new action is a hard wait by default (REQ-WAIT-3), and the business vocabulary derivesGATED_ONLYthe same way. The test pins both lists equal. - Consumers. Gated authority is spent only through
authorize()(tasks verbs.mjs and runtime.mjs for role.launch) and the broker's own paths. Nothing consumesgit.merge.protectedtoday, so leaving the REQ-LAND-1 refusal to row 137 opens no live path. - Arbiters. The business validator requires
arbiters(business.mjs lines 150 to 158), sob.arbiters[domain]always reads a declared role. An arbiter raising its own cited decision falls back to the human, and a test pins that. - Dewey's point 3 (REQ-WAIT-2). The list lives in code that changes only by reviewed commit, and both the validator and the broker refuse a hard-wait grant. I agree that this meets it.
- Dewey's point 2. A cited role.launch going to the arbiter is what REQ-DEC-2 says.
- Dewey's open question, force push. The host already refuses one: packages/seat/src/working.mjs line 201 refuses
non-fast-forward. The PRD 1.5 tech note says the same, and REQ-WAIT-1 makes any future path a hard wait. - Docs. The bus and business READMEs match the code and the test strings.
Notes (non-blocking)
- Dewey's point 1, role.revoke within-role. I agree. PRD 1.5 line 343 lets role.revoke leave the lists, and the broker still requires a decision id on the decision path. A within-role grant would close that decision on raise, so a holder could revoke without anyone approving. No shipped role is granted it. Sage may want the PRD or a later row to say whether a within-role role.revoke grant is meant to be allowed.
- The assistant can now be revoked on an arbiter's approval.
END_PROTECTED(broker.mjs line 127) is checked only on thereasonpath at line 1151. The decision path has no such check. Before this row, revoking the assistant needed the human. Now a cited role.revoke targeting the assistant can be approved by the arbiter. The PRD allows it as written; I'm naming it so it's a choice, not an accident. - Follow-ups Dewey lists (the roles/pm.md and chief-of-staff.md contract text, the harness raise_decision description) are outside this row's files.
What I ran and what I took from receipts
I ran, as single files on the candidate with Docker disabled and TMPDIR set to scratch, all with 0 fail and 0 skipped:
| Test file | Pass |
|---|---|
| bus hard-waits | 7 |
| business hard-waits | 3 |
| bus approval-binding | 6 |
| bus broker | 16 |
| bus tester | 11 |
| bus single-use | 12 |
| bus chief-of-staff | 13 |
| bus requirements | 3 |
| bus decision-close | 8 |
| bus messaging | 13 |
| bus replies | 7 |
| bus threads | 14 |
| bus agents | 11 |
| bus spec | 4 |
| bus spec-socket | 6 |
| bus decision-route | 5 |
| bus message-citation | 3 |
| bus decisions | 7 |
| bus project-runtime | 3 |
| business role | 14 |
| business record-grants | 1 |
| harness tools | 18 |
I did not run scripts/test-land-work.sh (a suite), any mutant or any gate, and I took no slot.
From Dewey's receipts, not rerun by me:
- The gate: every scripts/test-*.sh rc=0 between 18:28:41Z and 18:31:11Z, bus 301/301, business 112/112, with both new land-work variants exiting 2
not-human. - Mutants m1 to m5 all killed (mutants-summary.txt).