Files

5.2 KiB

Row 139 round 1 review (Filbert): approve

Candidate: manifest sha256 5657702e1e255164e41cb57d32487146e28ed935eb3d3eb19812e1c95d78d0a5, 8 paths, base 5661bd233, packet agents/dewey/work/queue-139/ in 62f354746 (request comment 28772). Brief: docs/plans/2026-10-15_q167-rows-r3.md at b2a2d741c.

I found no defect. Every test the brief asks this row for is there, and the REQ-LAND-1 refusal is correctly left to row 137 under the b2a2d741c carry rule. The notes below don't block.

Rebuild

  • A fresh worktree at 5661bd233. build.patch is a plain diff, so I applied it with git apply --index.
  • All 8 manifest hashes matched, and git diff --check was clean (8 files, +255 -40).
  • The added lines have no dash, curly-quote or control characters.
  • No commit from 5661bd233 to refactor HEAD touches a manifest path. The commits since the base are the brief re-pin, the queue revisions and Dewey's packet and SESSIONS line.

Brief tests, each found

  • Each hard wait: bus hard-waits.test.mjs routes all eight to the human uncited, cited, and cited with a domain, and the arbiter's resolve is refused human-required.
  • REQ-WAIT-2: the broker refuses a business granting any hard wait within-role or cross-role (invalid-authority), and accepts the four actions that left.
  • A cited merge raised by merge-gate goes to the technical arbiter, and the arbiter resolves it.
  • An uncited gated raise goes to the human, for each of the four actions that left.
  • A stale citation refuses stale-spec and an unconfirmed one spec-unconfirmed, with no decision written.
  • land-work: not-human:arbiter-cross and not-human:arbiter-cited in scripts/test-land-work.sh.
  • The coder land-refusal test rides with the REQ-LAND-1 refusal. Row 137 has not landed (git log 5661bd233..HEAD holds no land code), so row 137 carries both as the brief says. Sage checks this at each landing, and if 137 lands first this row needs a round 2.

What I checked and found correct

  • Routing. HARD_WAITS is ACTIONS minus the explicit ROUTED set, so a new action is a hard wait by default (REQ-WAIT-3), and the business vocabulary derives GATED_ONLY the same way. The test pins both lists equal.
  • Consumers. Gated authority is spent only through authorize() (tasks verbs.mjs and runtime.mjs for role.launch) and the broker's own paths. Nothing consumes git.merge.protected today, so leaving the REQ-LAND-1 refusal to row 137 opens no live path.
  • Arbiters. The business validator requires arbiters (business.mjs lines 150 to 158), so b.arbiters[domain] always reads a declared role. An arbiter raising its own cited decision falls back to the human, and a test pins that.
  • Dewey's point 3 (REQ-WAIT-2). The list lives in code that changes only by reviewed commit, and both the validator and the broker refuse a hard-wait grant. I agree that this meets it.
  • Dewey's point 2. A cited role.launch going to the arbiter is what REQ-DEC-2 says.
  • Dewey's open question, force push. The host already refuses one: packages/seat/src/working.mjs line 201 refuses non-fast-forward. The PRD 1.5 tech note says the same, and REQ-WAIT-1 makes any future path a hard wait.
  • Docs. The bus and business READMEs match the code and the test strings.

Notes (non-blocking)

  1. Dewey's point 1, role.revoke within-role. I agree. PRD 1.5 line 343 lets role.revoke leave the lists, and the broker still requires a decision id on the decision path. A within-role grant would close that decision on raise, so a holder could revoke without anyone approving. No shipped role is granted it. Sage may want the PRD or a later row to say whether a within-role role.revoke grant is meant to be allowed.
  2. The assistant can now be revoked on an arbiter's approval. END_PROTECTED (broker.mjs line 127) is checked only on the reason path at line 1151. The decision path has no such check. Before this row, revoking the assistant needed the human. Now a cited role.revoke targeting the assistant can be approved by the arbiter. The PRD allows it as written; I'm naming it so it's a choice, not an accident.
  3. Follow-ups Dewey lists (the roles/pm.md and chief-of-staff.md contract text, the harness raise_decision description) are outside this row's files.

What I ran and what I took from receipts

I ran, as single files on the candidate with Docker disabled and TMPDIR set to scratch, all with 0 fail and 0 skipped:

Test file Pass
bus hard-waits 7
business hard-waits 3
bus approval-binding 6
bus broker 16
bus tester 11
bus single-use 12
bus chief-of-staff 13
bus requirements 3
bus decision-close 8
bus messaging 13
bus replies 7
bus threads 14
bus agents 11
bus spec 4
bus spec-socket 6
bus decision-route 5
bus message-citation 3
bus decisions 7
bus project-runtime 3
business role 14
business record-grants 1
harness tools 18

I did not run scripts/test-land-work.sh (a suite), any mutant or any gate, and I took no slot.

From Dewey's receipts, not rerun by me:

  • The gate: every scripts/test-*.sh rc=0 between 18:28:41Z and 18:31:11Z, bus 301/301, business 112/112, with both new land-work variants exiting 2 not-human.
  • Mutants m1 to m5 all killed (mutants-summary.txt).