stack/agents/filbert/work/queue-147/r1/body.md

Row 147 round 1 review (Filbert): approve

Candidate: manifest sha256 a7f53bc5fe0b67440084e48f706e4aa864f0b36ec9bcea05eec0d2787f75fc39, 24 paths, base fba879f6a, packet agents/rocko/work/queue-147/r1/.

I found no defect, and every test the brief lists is there. The notes below don't block.

Rebuild

• A fresh worktree at fba879f6a with build.patch applied. Every manifest hash matched and git diff --check was clean (24 files, +986 -5).
• No commit from fba879f6a to refactor HEAD touches a manifest path.
• The added lines have no control or bidi characters. packages/project/README.md has one em dash (the title) and one en dash ("2 to 9 options"). Other package READMEs have them too, and no test reads this one, so I don't count it.

What I checked and found correct

• Location. projectRepo takes repo or <dataRoot>/projects/<business>/<project>, requires normalized absolute paths, refuses an overlap with the project's own root, and refuses link ancestors. business.mjs accepts repo with the same path rule as root and keeps it only when present.
• Layout and check. Check reports every problem rather than the first:
  • unknown and missing top-level paths;
  • project.json against its schema and against the business and project ids;
  • each requirement and decision against its schema, with the file name against the id;
  • templates against the closed template list and their schemas;
  • only spec/north-star.md in spec/, Markdown in docs/, empty .gitkeep markers;
  • links, non-regular files, hardlinks, oversize, NUL and invalid UTF-8. .git is checked by inspectGit: no indirection, no alternates, no remote, and an allow-list of local config keys.
• Schemas stay in the package. validate.mjs loads only packages/project/schemas/, and a schema keyword it doesn't implement refuses at import. A schema file in the project's templates/ is an unknown template.
• Init. It refuses an undeclared project and a non-empty directory. The exclusive mkdir .git closes the race between two initializers. It checks the layout before the first commit, and the commit is authored by business.human. No remote is created.
• The writer. It validates the path, the record, the id and the actor before taking the lock. Under the lock it requires a clean tree, the whole project to pass check, and no link on the target's directory. Then it publishes atomically and commits only that path as <definition>.<instance>.
  • spec/ refuses for every caller, and a human definition refuses, so the writer is agent-only.
  • Git runs with no system or global config, hooks at /dev/null, no fsmonitor and protocol.allow=never, through seat's bounded process-group runner. The explicit identity env overrides an ambient GIT_AUTHOR_NAME.
  • On a git failure with HEAD unchanged it unstages and restores only its own file. With HEAD changed it refuses project-commit-uncertain and leaves evidence. The stale-lock behavior is documented in the README.
• CLI. project is dispatched by scripts/mosaic and needs no bus. Init refuses inside an agent. The usage refusal is exit 4. stack-copy copies packages/project whole, and its test checks the source, a schema and a template in the copy.
• Tests against the brief.
  • Init gives a layout that passes check: project test 1.
  • Init refuses a non-empty directory: test 2.
  • Check names a bad record, a misnamed file and an unknown path: test 3.
  • The writer commits with the agent author: test 4. It refuses a schema failure and spec/: test 5.
  • repo is honored (test 2, cli project test 1) and validated (business project-repo test).

Notes (non-blocking)

1. A failed init can't be retried, and check calls the result valid. My probe made git commit fail during init. Init refused project-git and left .git, the layout and project.json with no commit. A second init refuses project-not-empty, check reports it valid, and the writer refuses project-dirty because nothing is tracked. The README doesn't say what to do. A follow-up could have init remove what it created on failure, or have check require a commit, or at least document "remove the directory and init again".
2. One project's repo may sit inside another project's root. projectRepo checks the overlap only against the same project's root. My probe declared other with root at stack's repo, and init accepted it, so the records repository is nested in another code checkout. Checking every declared project's root would close it.
3. The spec/ test doesn't pin its reason. My mutant Q1 removes the spec/ guard in recordBytes, and the project test passes 14/14, because the record-path regex also refuses spec/north-star.md. The candidate is correct twice over. Asserting e.code === 'project-spec-human-only' in test 5 would keep the guard from going unnoticed if the regex widens.
4. The human-author refusal has no test. Mutant Q2 removes it and the project test passes 14/14. It is beyond the brief, so it's only a note.
5. Exit code for an undeclared project. project check acme missing exits 2, because project-not-declared is a ProjectError. TOOLS.md says 2 is for project or record problems and 3 for configuration problems. Either reading is defensible; one sentence in TOOLS.md would settle it.
6. Row 146 overlap. Both rows change packages/cli/src/cli.mjs. As Sage planned, the short rebase round follows this verdict, and I'll review it by running every touched test file.

What I ran and what I took from receipts

I ran, as single files on the candidate with TMPDIR set to scratch and Docker disabled, all with 0 fail and 0 skipped:

Test file	Result
project project	14/14
business project-repo	1/1
business business	16/16
cli project	3/3
cli stack-copy	12/12
cli verbs	6/6
cli limits	4/4

I also ran eight mutants of my own, one at a time. The tree matched the manifest again afterwards.

Mutant	Result
Q1: drop the spec/ guard in recordBytes	survives, 14/14 (note 3)
Q2: drop the human-author refusal	survives, 14/14 (note 4)
Q3: drop requireClean in the writer	project 1 fail
Q4: drop the file name against id check	project 1 fail
Q5: ignore repo in projectRepo	project 1 fail, cli project 1 fail
Q6: drop the unknown top-level path check	project 1 fail, cli project 1 fail
Q7: let init run inside an agent	cli project 1 fail
Q8: drop the non-empty refusal in init	project 1 fail

And a probe on the candidate: init into an existing empty directory works and passes check; notes 1 and 2 come from the same probe.

From receipts, not rerun by me:

• Rocko's 50 mutants, all killed, rerun in full after an invalid first attempt at check 20 (mutants/table.md, BUILD.md).
• Sage's owner gate on 625c21f41 plus the candidate, 25 steps, GATE_PASSED, exit 0 at 23:27:10Z (gate-run.log tail).

I took no slot.