stack/agents/filbert/work/queue-166/r1/body.md at dev-console

0 Fork 1

Files

T

jason.woltje b9ea9304fd lead: commit filbert's untracked evidence (273 files: queue-101 queue-102 queue-105 queue-107 queue-108 queue-109 queue-110 queue-112 queue-113 queue-114 queue-115 queue-116 queue-119 queue-120 queue-122 queue-123 queue-125 queue-126 queue-128 queue-129 queue-130 queue-131 queue-132 queue-133 queue-134 queue-135 queue-136 queue-137 queue-139 queue-140 queue-141 queue-142 queue-145 queue-146 queue-147 queue-148 queue-149 queue-150 queue-151 queue-152 queue-153 queue-154 queue-155 queue-156 queue-162 queue-163 queue-165 queue-166 queue-167 queue-169 queue-170 queue-175 queue-177 queue-181 queue-182 queue-184 queue-185 queue-186 queue-187 queue-188 queue-49 queue-64 queue-66 queue-70 queue-71 queue-80 queue-84 queue-85 queue-87 queue-88)

Unclaimed files left in the canonical checkout. Inventory: canonical-cleanup-inventory.md (commit-as-evidence groups). detect-secrets scan clean on 2026-11-02: hits are sha256 pins, git object ids, test sentinels already in tracked tests and unit-file lines.

2026-11-02 15:05:14 -06:00

6.3 KiB

Raw Permalink Blame History

Filbert review, row 166 round 1: approve

Candidate manifest agents/darkwing/work/queue-166/candidate-manifest.sha256, sha256 d0c58a37805f82ccae0dcda59b3ed9e8dc4d88663d884e4e1597fd75eb0e64e4 (2 paths). build.patch is f7c22a97c931aaa248df9017f94c2de77f1dc872cc83518b2dc3a61720b191f8.

I applied it with --index to 139e28673. Both manifest lines matched, git diff --cached --check is clean, and the diff is +124 -18 over 2 files. The script part of the cached diff is byte-equal to stack-release-sh.diff (490d6c99...88d3). I read it against the brief docs/plans/2026-10-18_stack-release-hardening.md (c70f360ae) and BUILD.md.

Item 1: unreadable drop-ins

drop_in_override now matches install_guard (scripts/bus-service.sh:112-129) line for line:

the absolute-path refusal;
-e || -L for the unit path, the drop-in directory and the .conf;
-d && -r && -x for both directories;
content="$(cat ...)" followed by the grep on the content.

Each refusal is drop-in-override with install_guard's own wording, and all of it runs in the precheck before any stop.

T28's three subtests use mode 000 on the unit path, the bus drop-in directory (${BUS}.d matches mosaic-bus@*.service.d) and a .conf. Each one asserts:

exit 3 and the exact stderr;
no start or stop in the stand-in log;
both units still active;
the fingerprint unchanged;
one more log line, with code drop-in-override.

That is the brief's test, plus the unit path case.

Item 2: the is-active to read race

plan_store. It rechecks is-active after heldversion, and on a change sets S_SCHEMA=unknown with the "run --plan again" reason. plan() then drops the note and the whole migration/restore branch (:653-667). plan_store is called only from plan() (:647), so a real run never sees S_CHANGED.
Rollback --restore. It rechecks after heldcount and refuses restore-mismatch before run_steps, so nothing stops. The run already recounted after the stop (:695-697, rollback_in_run post-backup-events). So this turns a late rollback into an early refusal, which is what the brief asks for.

T29 uses the new bus-stops-after 1 stand-in fault. The first bus is-active answers the real state, every later one answers inactive, and units.json is left alone.

The --plan subtest asserts the whole stdout, so if any earlier bus check had used up the one real answer, the output would differ.
The rollback subtest asserts the exact restore-mismatch message with the STAMP, no start or stop, and no post-attempt dir.

Item 3: the copy check names the target

The gate now captures stack-copy.sh check's stdout and compares its bus: line with copy="$COPIES/$1" (:363, local, as is out). On a mismatch it sets GATE_WHY with both paths.

check already requires bus to start with the literal "$COPIES/" (stack-copy.sh:102), and the run passes it the same --copies. So a correct install can't fail this compare through a path spelling difference.

T30 runs a copy of the repo whose stack-copy.sh answers check with all three on B and runs the real script otherwise. The test then asserts:

activate C1 exits 1, and stderr is rolledBack('copy-check');
stdout carries the line "agree on .../B, not .../C1";
the log line is gate-failed, copy-check, rollback ok;
the pointer stays on B, and the bus runs from B.

run() taking e.sr affects only this test.

Item 4: quoted units

unquoted refuses ", ' and \ in three places: the bus argv, the Console argv and the bus Environment=. The three read -r -a splits now read those same captured values. T31 covers four forms: Environment with double quotes, with single quotes and with a backslash, and the bus ExecStart with "--pm". Each form asserts:

activate refuses unit-flags-drift;
status prints unit flags: cannot read the units;
adopt refuses check-failed and writes no pointer;
no stderr names /a.

That is the brief's test.

Other checks

Brief scope. The diff touches only the script and its test, and no verb's wording changes. Its commit-msg.txt has no attribution line.
Hash pins. No 64-hex pin in packages/*/tests or scripts/test-*.sh names either manifest path. A grep of packages, scripts and tools for stack-release also finds packages/cli/README.md:648, which BUILD.md's list leaves out. Its text (adopt, activate, rollback, status, a failed gate rolls back) is still true.
Base drift. From 139e28673 to HEAD c9c8c14d4, nothing changed on the 2 manifest paths, stack-copy.sh or bus-service.sh. The canonical script is still blob 4b16e848, and build.patch passes git apply --cached --check on HEAD in a temporary index.
Landing order. This approves the candidate only. It lands after the 8e7ea89a1 window, per mos-0834 via sage-0956.

Notes (not blocking)

Console ExecStart has no test. Item 4 covers "the ExecStart argv split... used at :153 and :159". The Console argv check is there (unquoted "$console_argv"), but T31's only ExecStart form is in the bus unit. A mutant that drops only && unquoted "$console_argv" would, as I read T31, survive. Mutant 4b removes the ExecStart check as a whole. The brief's test line names only the Environment= form, so I don't count this as a missing brief-required test. A follow-up could add a fifth T31 form on the Console unit. I didn't run that mutant.
The non-absolute unit path refusal has no test. It copies install_guard and isn't in the brief, so this is a follow-up only.
TOOLS.md wording. docs/TOOLS.md:389-390 lists stack-copy.sh check in the gate without saying that the copy must be the one this run installed. TOOLS.md isn't in the manifest, and no test reads that text for this row. Doc-only, follow-up.

Ran by me

Nothing that needed the slot. I applied the patch, ran sha256sum -c (2/2), compared the script diff, read install_guard, stack-copy.sh check and the run and plan paths, ran greps, and ran the HEAD apply check.

Not mine

Darkwing's slot run (sage-0952) as BUILD.md records it: stack-release.test.mjs 71 of 71, stack-copy.test.mjs 12 of 12, awk pass 83, fail 0. CONTROL passes, and all 8 mutants (1a, 1b, 1c, 2a, 2b, 3, 4a, 4b) are killed. Its logs are under ~/darkwing-scratch, which I don't read, so I have not checked them. The full gate is Sage's at landing.

6.3 KiB Raw Permalink Blame History