stack/agents/filbert/work/queue-188/r1/body.md at dev-console

0 Fork 1

Files

T

jason.woltje b9ea9304fd lead: commit filbert's untracked evidence (273 files: queue-101 queue-102 queue-105 queue-107 queue-108 queue-109 queue-110 queue-112 queue-113 queue-114 queue-115 queue-116 queue-119 queue-120 queue-122 queue-123 queue-125 queue-126 queue-128 queue-129 queue-130 queue-131 queue-132 queue-133 queue-134 queue-135 queue-136 queue-137 queue-139 queue-140 queue-141 queue-142 queue-145 queue-146 queue-147 queue-148 queue-149 queue-150 queue-151 queue-152 queue-153 queue-154 queue-155 queue-156 queue-162 queue-163 queue-165 queue-166 queue-167 queue-169 queue-170 queue-175 queue-177 queue-181 queue-182 queue-184 queue-185 queue-186 queue-187 queue-188 queue-49 queue-64 queue-66 queue-70 queue-71 queue-80 queue-84 queue-85 queue-87 queue-88)

Unclaimed files left in the canonical checkout. Inventory: canonical-cleanup-inventory.md (commit-as-evidence groups). detect-secrets scan clean on 2026-11-02: hits are sha256 pins, git object ids, test sentinels already in tracked tests and unit-file lines.

2026-11-02 15:05:14 -06:00

5.0 KiB

Raw Permalink Blame History

Filbert review: row 188 round 1 (#1686), approve

Request 29432. Candidate manifest 86aa549bad75ef6138b6658d5ad0156436cb86c30ed88a148390eda3539d81a3 (1 path) on base 525990ecb. The brief is docs/plans/2026-10-20_proof-test-gaps.md. This row is my N1 and N2 on row 187 (29424), P19 409 and 410.

Verdict: approve. No findings on the candidate. N1 is a script gap I found during the review. It's outside this row, which can't change the script blob. Mos ruled on it in mos-0959.

What I ran

I built ~/filbert-scratch/r188-r1/wt at b9c1c9fe2 (the refactor head), then ran git apply --index build.patch.
- sha256sum -c on the manifest passed 1/1.
- The patch-id is c9a56b167c07: 1 file, +59/-4.
- scripts/stack-release.sh is blob 2586a2a37cd2, unchanged.
Base drift: git log 525990ecb..b9c1c9fe2 on the test file and the script is empty.
Readers and pins: no test or script reads stack-release.test.mjs as a file, and no 64-hex pin names it.
I took the slot after sage-1283. The /proc busy check was CLEAR at 10:59:10Z and 11:07:12Z, and TMPDIR was ~/fs188.
- stack-release.test.mjs: 151/151 pass, 0 fail, rc 0, from 10:59:11Z to 11:04:14Z. The counts are awk sums over the spec log.
I ran four mutants against ^(T53|T54) (19 tests), each restored by git checkout. Afterwards the script was blob 2586a2a37cd2 and the tree had only the staged test file. The fail counts include the T54 parent.
- M8, the brief's (return 0 before the fi that ends the carried branch, :738): killed, 5 fail. T54 test 1 (chmod, symlink, removal) and test 2.
- M9, the brief's (the $REPO cases dropped, :775): killed, 3 fail. T54 tests 3 and 4.
- M10, the brief's (proof_file_problem skipped when PROOF_HEADER is empty, :759): killed, 5 fail. T54 test 1 x3 and test 2.
- M11, mine (realpath -e -s, so the path isn't resolved through symlinks, :774): killed, 2 fail. T54 test 4 only. So test 4 pins the symlink resolution that test 3 can't.
Darkwing's run (151/151, the control, M8-M10) and Sage's gate (GATE_PASSED, sage-1283) are their receipts, not mine.

Checked against the brief

Test 1. Three subtests, each on a fresh mk stand-in: chmod 644, a symlink to a watched mode-600 file, and removal. Each one sets the pair with activate B, then:
- checks that --plan for activate C1 prints proof: carried and exactly one refusal, proof-file-invalid with the reason;
- runs the real activate through refused;
- checks that the pointer stays on B with the pair.
Test 2. A rollback from C1 to B (B's Console takes the pair) after chmod 644. Same shape, and the plan names to: B.
Test 3. A mode-600 file of the test's uid under the fixture repo/proof-r188 refuses in the plan and the run with is inside the repository or the copies. The fixture repo is realpathSync'd tmp, never the checkout. t.after removes the directory.
Test 4. e.root/repo-link.188 is a directory symlink into repo/proof-r188. The test asserts the given path isn't itself a symlink and isn't under repo/. My M11 shows the realpath step is what refuses it.
Test 5. Every subtest ends in noLeak. The swapped-in file swap.188 is a watched proof file too.
The script is unchanged, and so are webui-service.sh, docs/TOOLS.md and packages/webui. P19 407 and 408 are not in this row.

Readings

I agree with both.

"No log line." A precheck refusal has always written one result: refused line. Removing it would need a script change. refused pins one refused line and no unit, pointer or store change, which is what the brief protects.
The hard link before removal or the swap. The script's view is the same: the path is gone, or it's a symlink. Without the link, inotify's IN_IGNORED on the freed inode would count as a read in the watch's tally. The kept link stays under e.root, which noLeak doesn't walk, and isn't in any run's output.

Notes

N1 (script gap outside this row, doesn't block; mos-0959): the "inside the repository" check compares a physical realpath with a logical REPO.
- stack-release.sh sets REPO="$(pwd)" after cd "$(dirname "$0")/.." (:22-23), and webui-service.sh:67 sets REPO with cd ... && pwd. Both are the logical path. The proof file's path is realpath -e, which is physical.
- So when either script is invoked through a symlinked path, a file inside the repo isn't refused. ~/src/mosaic-stack-dev-test -> /mnt/storage/src/mosaic-stack is one such path.
- I probed the same pattern in my scratch: through the symlink it printed MISSED, and through the real path REFUSED. The copies side uses realpath -m and is fine.
- Neither row 187's tests nor row 188's can see this, because the fixture base is realpathSync'd.
- The fix is pwd -P, or a realpath on REPO, in both scripts, plus a test that runs the script through a symlinked checkout. Per mos-0959, Part B's run brief requires the physical path and PB3 checks pwd -P = pwd. The fix is filed after Part B.

5.0 KiB Raw Permalink Blame History