stack/agents/filbert/work/queue-87/r1/body.md

Filbert review, row 87 round 1: changes.

Candidate: commit 203481725 (2034817252), the design docs/plans/2026-10-18_containerized-install-design.md and the rows docs/plans/2026-10-18_containerized-install-rows.md. Every line below is at 203481725's tree.

No test reads either file (grep -rlF containerized-install packages/*/tests scripts/test-*.sh finds nothing), so under decision 137 these would count as doc-only. I still record changes. Here the documents are the deliverable, Sage asked for a gap between section 9 and a brief to count as a change, and findings 1 and 2 would make a builder ask or let a row land without a test the design requires.

Changes

1. Section 8's Console mounts leave out reads the Console makes today, so I4's builder has to ask and I4's "exact mount list" test has no list to hold (design.md:522-531, rows.md:213-230).

   • The business file. loaded() calls loadBusiness(id, { dir: configDir, rolesDir }) (packages/webui/src/reads.mjs:186-190), and launchSettings({ dir: configDir, ... }) reads it too (reads.mjs:234, packages/business/src/launch-settings.mjs:8-13). Both resolve <configDir>/businesses/<id>.json through businessFilePath. Section 8 mounts only config.json as a file, so every business read and the limits panel would fail in the container.
   • bus-host/ is mounted "for host.json and sessions.json" (design.md:527). The Console also reads <dataRoot>/bus-host/boot-status.json through readBootStatus(dataRoot) (reads.mjs:216). The mount covers it, but section 8 should name it so the start check and the mount test account for it.
   • Paths inside the container. loadSystem() gives the host dataRoot, and packages/webui/src/cli.mjs:58 builds the broker path as socketPath(dataRoot), the single local socket. Section 8 says neither where sock/human, config.json, the business file and bus-host/ land in the container nor how the Console finds them. Name the destinations, or say I4 adds a containerized path rule and what it is.

2. Section 9's "Mount lists, exactly. For each container kind" (design.md:556-558) has a test only in I4 (rows.md:225) and I5 (rows.md:285). Section 2 says the same narrower thing, "I5 and I4 therefore test each container's mount list exactly" (design.md:55-57). I6 starts the broker and notifier container and both egress containers, and moves the pi worker to "only its run directory and workspace" (rows.md:351-353), but its tests (rows.md:363-366) check none of those mount lists. The broker is the only container with the dataRoot and the service credentials, and section 2's tradeoff rests on the mount list being right, so it needs the exact test most. Add the exact mount list for the broker and notifier, each egress container and the pi worker to I6's tests, and make section 2 match section 9.

3. "The broker can't reach a provider host" (design.md:560-561) is in no brief's tests. I2's suite run puts a client on an internal network (rows.md:79-81). I3 leaves the broker on the host (rows.md:169). I6 starts the broker container, and its tests (rows.md:363-366) leave this out. Put it in I6's tests.

4. Hardening is "every container" in section 3 (design.md:97-104) but only the session case is in section 9 (design.md:562-563) and I5 (rows.md:287). No row tests --cap-drop ALL, no-new-privileges or --read-only on the Console (I4) or on the broker and egress containers (I6). Either extend section 9 and those two briefs' tests, or say in section 9 why the session check is enough.

Minor, fix in the same round

5. design.md:149-150: "the output contains name=rootless". S1 settles more than that (agents/researcher/work/i1-spikes/REPORT.md:100-102, 574): check the exit status, then require an array element exactly equal to name=rootless. A plain grep name=rootless in scripts/lib/docker.sh would pass a substring. Say "an element exactly equal to".
6. design.md:579-581 lists three refusal cases: "the rootful socket, a missing socket and a non-rootless daemon". The rootful socket is a non-rootless daemon, and I2 tests the rootful socket, a missing socket and the rootless endpoint passing (rows.md:73-76). Either name the third case or drop it, so section 9 and I2 match.
7. design.md:196-197: "A human or tester envelope gets human-required, as the spike measured (S4, HP)". S4 measured only human envelopes (i1-spikes/REPORT.md:239-241, 277), and the HP report has no tester case. Cite the tester half as design, not measurement. I3's test (rows.md:147-148) already covers both.
8. Line ranges a little off: recover() is at packages/cli/src/launcher.mjs:491-513 (the doc says 489, the comment above it), and serve() starts at packages/bus/src/server.mjs:13. The doc's 132-137 is the listen and the chmodSync(path, 0o600) at 137, which is what the sentence means, so that one only needs the function line too.
9. rows.md:34-36 lists test-release.sh:58, whose only Docker use is a docker info probe, but not scripts/test-task.sh, which probes the same way at 139, 395, 442 and 517. Either list both (I6 moves "the scripts listed in I2's problem", rows.md:337) or drop the probes and say why.

Checked and correct

• Every other cited line at 203481725: credentials.mjs 35-79 and 60-72; mosaic-config.mjs 109, 115 and 160; session.mjs 87-92, 110/123, 230-241 and 247-268; launcher.mjs 279, 325-330, 566-600 and checks 5 and 6; server.mjs 14-19 and row 148's allowance; runtime.mjs 110-118; broker.mjs 316, 456, 511-514, 1551, 1699 and 1847; webui bus.mjs 27-31 and 65; reads.mjs 75-79, 125-132, 229 and 234; control-board serve.mjs 59, 74-94 and 239-248, scan.mjs 196-209; compose.yaml 36-37 and 40; CONDUCTOR.md 17 and 40; the 43-line connect-proxy.mjs; REPORT.md:19's base digest; and all twelve script lines in rows.md:34-36.
• Section 5's reader list. A repo-wide grep of src for 'cli' finds only landing.mjs:107, runtime.mjs:117, public/bus.js:188 and tasks/live/run.mjs:108. No SQL CHECK constrains decision_events.via.
• Every other S0-S9 and HP claim I traced says what the design says: S1's exit status and --host, S2's uid map and socket modes, S3's directory mount and dead inode, S4's sizes, S5's internal network and -p, S6, S7, S8's 143 and 137 (REPORT.md:491-519), S9's CapEff, NoNewPrivs and Seccomp, and HP's environ, relay, nonce, peer-cred and engine-route results.
• Decisions 105 to 108 (docs/plans/2026-09-26_lead-decisions.md:2323-2410). Nothing reopens them. The design keeps the agent socket refusing human, mounts the human socket only into the Console, pins the endpoint with the name=rootless refusal, keeps execution.backend at docker, adds no WebAuthn, and keeps the token as a read-only file read by the runner.
• Section 5 against mos-0657 and P19 333 (design.md:290-329). The same-uid routes are carried by decision 105. The other-uid reach goes to Jason with the documented-limit default. Only I6's limits section waits on it (rows.md:358-361), and I4's out of scope re-pins I4 if Jason picks the unix-socket Console first (rows.md:234-236). That matches.
• Each brief has the template's six sections (docs/plans/BRIEF-TEMPLATE.md) and names its suites and gate.

Not run by me

Nothing executed. This is a read of the two documents against the tree and the two spike reports. The spike measurements are Researcher's.

Verdict: changes, on 1 to 4. Items 5 to 9 are small and can go in the same round.