stack/agents/steelbeak/work/queue-287/BUILD.md

Row 287 design notes: C2-21, the grant executor for a library project (#1792)

Builder Megavolt, reviewer Dewey, gate owner Sage (sage-2910, Q226, mos-1310). Branch megavolt/row287, a doc-only draft off 94c33a43c, written during Gizmoduck's slot with local git only. The build starts on the candidates of row 285 (C2-08b, Scrooge) and row 226 (C2-13b, Gosalyn) and rebases onto their landings (Q177). Nothing here has been run.

The brief is "C2-21 the grant executor for a library project" in docs/plans/2026-10-20_case2-rows.md at 94c33a43c. Its gate: Dewey approves the manifest; the bus suite, the Gitea Docker test and the install test are green on Sage's gate, along with every scripts/test-*.sh; a search of the test run's output for the fixture admin and seat tokens finds nothing.

Sources (line cites at 94c33a43c)

• packages/bus/src/gitea-grant.mjs: the admin api (adminApi, no collaborator call yet), the seat api (forkGet, fork, repos), identitySha256, REPO_PAGE/REPO_PAGES.
• packages/bus/src/broker.mjs: #giteaRole :2132, #giteaTargets :2149, #giteaGrantBinding and its block :2167-2196, #giteaRecheck :2200, #giteaSteps step 4 :2425-2441 and step 5 :2442-2473, the grant.applied body and notice :2480-2488, the host refusals host-creative-role :1106 and :1254.
• packages/business/src/business.mjs :266-288: a kind: "library" project goes through checkMapping, and :286 refuses any role whose publish names a library project.
• packages/library/src/mapping.mjs: a library entry carries remote, branch and an optional user.
• packages/bus/tests/gitea-grant.test.mjs :297-334 pins the grant.applied body (forks: [...]) and the block; fake-gitea-api.mjs keeps collaborators as a list of logins with no permission.
• packages/bus/tests/gitea-grant-docker.test.mjs: the scratch gitea/gitea:1.27.1 container; it uses os.tmpdir().

1. Rulings, blockers and questions

• B1, the publish rule. business.mjs:286 refuses any publish entry that names a library project ("library repositories cannot be published by agents"). The brief's chief needs publish: ["books"], and a creative seat needs the library project in publish for #giteaRole and #giteaTargets to pass. No test under packages/*/tests or scripts pins the :286 message (positive control: "publish names" hits agent-identity.test.mjs).
• Ruling sage-2916 (18:42Z 10-22), files-owned extension: row 287 owns packages/business/src/business.mjs :283-291 and the packages/business/tests/business.test.mjs cases for it. Row 285 leaves business.mjs alone. Conditions:
  • The refusal is rewritten, not deleted. A library project in publish loads only for a creative instance (CREATIVE_DEFINITIONS) or the chief of staff, each with a gitea credential. Any other instance still refuses, with a new message that names the rule. Tests cover both sides. The grant path serves an allowed one with collaborator reach, never a fork. (To confirm on the base: how business.mjs names the chief, by definition chief-of-staff or by launch.by.)
  • Before in-review, grep 'packages//tests/' and scripts/test-*.sh again for the old message text, with a positive control.
  • PRD 1.15 REQ-LIB-6 is the authority for this. If Mos changes 1.15 (sage-2914, library.write routing), check this text against what lands.
• Q1 to Q4 below: Sage accepted them as stated assumptions (sage-2916). Dewey checks them in the round.
• Q1, the hash. identitySha256 covers identity, publish and remotes, not a project's kind or the role's definition name, and the level comes from the definition name. Proposal: add a library key ({project: level}) to the hash input only when a publish project is a library, so every non-library grant's hash stays byte-identical and no open grant turns decision-mismatch on upgrade.
• Q2, the event. grant.applied and its notice carry forks, and the test at :322 pins that body. Proposal: forks stays (empty when every target is a library), and a repositories: [{project, repository, level}] key appears only when a library target exists. The notice names them the same way.
• Q3, mixed raises. A creative raise must name only library projects (mos-1320 item 2). The chief may name a library project next to forked ones in one raise; step 4 forks the others and adds the collaborator on the library one. Proposal: allow that, and test it. Under sage-2916, any other non-creative instance can't hold a library project in publish at all, so the business file refuses it before any raise.
• Q4, the token search for the Docker test. The fake API's tokens are fixtures and can be grepped. The Docker test's tokens are minted by the container at run time, so the gate grep can't know them in advance. Proposal: the Docker test captures its own diagnostics and asserts that no token it minted appears in them, and the gate greps the run's output for every fake-API fixture token.

Early look, Dewey (dewey-0862, 18:53Z 10-22, on 5bcfef0ad, read only), folded

These replace the matching proposals in sections 2 and 3 where they differ.

• Q2 accepted. forks stays and is [] when every target is a library. repositories: [{project, repository, level}] appears only when a library target exists. repository is the remote URL, the same form as forks; the full_name that step 5 matched is asserted in a test and doesn't go in the body. The only src reader of forks is the notice (:2483). The notice drops its forks clause when the list is empty and adds "repositories: ()". A non-library notice keeps today's text.
• The read line: "The token can read every path of this repository. It can't push to it, because the user is a read collaborator." The seat scope is still write:repository (:2189).
• B-a: \nForks: (:2187) prints only when a fork target exists.
• B-b: "Step 5 checks that this is only its forks." (:2193) is unchanged with no library target. With one, it reads "Step 5 checks that this is only its forks and the repositories above at their level."
• B-c: others (:2181, :2194) splits. An untargeted library project in publish gets its own line, "It may also reach these repositories as a collaborator: ()", because a revoke leaves the collaborator entry and step 5 accepts it publish-wide. Forked others keep today's line. L8 covers B-a to B-c.
• Q1 holds. Test: a project flipped to kind: "library" between the raise and the recheck gives decision-mismatch (L10).
• Q3 holds. Library projects stay out of step 5's fork upstream set (:2446), so a fork of her repository refuses gitea-reach-wider; L4 covers it.
• Q4 holds if the assertion covers what the test prints, TAP stdout and stderr, not only an in-test buffer. The Docker test prints one line, "minted N, hits 0", for the gate to grep.
• Step 5 compares exactly the keys admin, push and pull. BUILD.md records F-B's actual permissions object, so an extra Gitea key can't pass or fail by accident.
• The chief is named by definition chief-of-staff, not launch.by, matching broker STAFF_TO (:240) and row 286 (dewey-0860). A fired chief keeps its roles entry (instance-settings.mjs:355), so B-2 also loads a fired chief's entry.

The definitions' gitea credential (dewey-0865)

At 94c33a43c, chief-of-staff.json and all six creative definitions have credentials: [], so #giteaRole (:2137-2143) would refuse them all gitea-not-declared. Row 287 doesn't add the credential. Row 285 (C2-08b) owns those role files, and its brief (case2-rows.md :1823-1824) gives each creative role and the chief [{"service": "gitea"}], which Mos authorized in mos-1309 item 5. That is why 287 builds after 285 lands. Two notes for 285, not for this row:

• The grant path reads only service === 'gitea'. The seat token's scopes come from SEAT_SCOPES in code, not from the definition. coder.json adds scopes, and 285's validator decides whether the bare form passes.
• Five bus tests read roles/chief-of-staff.json directly (chief-of-staff, fire-revokes-grants, instances-verb, names, routes-verb), and 285's gate names the business suite, not the bus suite.
• Settled (sage-2950, 19:06Z 10-22): 285's gate runs the bus suite whole (sage-2946), and Scrooge has the role.mjs no-scopes check. Dewey withdrew dewey-0865 (dewey-0867). Mos withdrew the mos-1332 item 3 publish fence (mos-1333), so business.mjs stays out of 285's files and sage-2916 stands as written.
• Correction (sage-2958, Scrooge): role.mjs refuses {"service": "gitea"} with no scopes (checkGiteaScopes :100-111, util.mjs:42); only a host entry may omit them (:134). So 285's entries name their scopes, equal to SEAT_SCOPES (sage-2915). The chief-of-staff.json readers are seven, not five: add host-run and reload. 287's tests that build definitions give gitea entries scopes: ["read:user", "write:repository"].

2. The change (proposed)

• Order in the executor: step 2 (user) and step 3 (mint) as today. Step 4, for each target: a library project gets PUT /api/v1/repos/{owner}/{repo}/collaborators/{user} with {permission} through the admin api, op collaborator-add, the token header, logged like every call. Expect 204, or anything else fails with gitea-failed. A non-library project forks as today.
• The level: write when CREATIVE_DEFINITIONS.includes(role.definition), read otherwise. The raise has no field for it; giteaGrantCheck still refuses any key other than method, agent, rotateBy and target.
• Step 5: the upstream set stays for forks. A repository is accepted when it is the user's fork of a non-library publish upstream (today's rule), or when its full_name is a library publish project's owner/repo and its permissions are exactly {admin: false, push: level === 'write', pull: true}. Any other repository, a wider permission or admin: true refuses gitea-reach-wider with the repository named.
• #giteaRole: the CREATIVE_DEFINITIONS refusal becomes "unless every project the raise names is a library project". #giteaRole gets the raise's project list from its two callers (the binding at :2168 and the recheck at :2201), so it can decide. The comment cites mos-1320 item 2 and keeps mos-1163 for every other project and every host grant. The host refusals at :1106 and :1254 and their tests stay as they are.
• #giteaTargets returns {project, upstream, library: true, repository, level} for a library project and today's {project, upstream, fork} otherwise. forkProblem still runs for both: a library remote on another host refuses remote-host-mismatch, and one the seat user owns refuses remote-not-fork.
• The block: a library target prints Repository: <remote>, level <write|read>. in place of its fork line, plus the brief's line "The token can write every path of this repository. Only the bus's path check limits it to supporting folders." for a write level. For a read level the line says the token can read every path. (The brief gives only the write line; Dewey can rule the read wording.)
• Revoke deletes the token as today; the collaborator entry stays, as forks do. A fire sets prohibit_login as today. Neither path changes.
• scripts/case2-install.sh (row 226's file): the chief of staff's instance gets identity and publish: ["books"]. If #grantableAgent refuses the chief as its own target, the row stops and goes to Sage. Read of :2037-2042 says it passes when the chief is launch.by; a test proves it.

3. Tests (proposed)

Docker (gitea-grant-docker.test.mjs), each fact first, before any code is trusted:

• F-A: the admin token with ADMIN_SCOPES adds a collaborator to a repository the admin account doesn't own. F-B: /user/repos with the seat token lists that repository with the granted permissions. Either failing stops the row; the output goes to Mos.
• F-C (recorded, not gating): a protected file pattern on her branch refuses a seat user's push to a story path while her own push passes. F-D (recorded): branch protection refuses a seat user's force-push while a normal push passes. Each logs its result as a diagnostic and doesn't fail the file; BUILD.md and a message to Mos carry them.

Fake API (gitea-grant.test.mjs, fake-gitea-api.mjs): collaborators carry a permission, repoJson returns permissions, and the PUT route requires a site admin token with write:repository.

• L1 a creative definition gets write; L2 the chief gets read, including a mixed raise of the library project and a forked one (Q3).
• L4 a repository with push: true for a read grant, or admin: true, or a fork of her library repository, refuses gitea-reach-wider naming it.
• L5 revoke deletes the token and leaves the collaborator.
• L6 a non-library project still forks, and its grant.applied body is byte-identical to today's.
• L7 a creative raise naming a non-library project, or a library and a non-library one, refuses gitea-not-declared.
• L8 the block holds the repository, the level and the brief's line, plus B-a to B-c (dewey-0862); the notice has no "forks: ." on a library-only grant.
• L10 a project flipped to kind: "library" between the raise and the recheck gives decision-mismatch.
• L9 the chief raises its own grant through credential.mint.
• Install test: the business file gives the chief identity and publish.

Business (business.test.mjs, sage-2916): B-1 a creative instance with identity, a gitea credential and a library project in publish loads; B-2 so does the chief; B-3 any other instance with a library project in publish refuses with the new message; B-4 a creative instance or the chief without a gitea credential still refuses under the existing publish needs identity and a gitea definition rule. Mutant: M5 drop the creative-or-chief condition (any instance loads), killed by B-3.

Mutants: M1 drop the library-only condition from #giteaRole (the brief's), killed by L7. Others to list once the code exists: the level forced to write (L2), step 5's exact-permission check loosened to push || pull (L4), the fork path taken for a library project (L1, a fork call counted).

4. Gate plan (draft)

On Sage's CLEAR, with TMPDIR from mktemp -d /mnt/storage/scratch/tmp/gXXXXXX, stopping at the first red: the touched bus test files whole, then the mutants, the bus suite, the Docker test (checking for ^skip first, since a missing image skips it), the install test, every scripts/test-*.sh under row 281's limits, then the token grep over the saved output. Timeouts and limits go in this file before the run.

Runs

Filled in after the runs.

Steelbeak takeover (2026-10-24, base 18334d713)

Sage-4124 dispatches Steelbeak as builder, Boyd first reviewer and Dewey landing reviewer. The inherited text above is retained as design history; this section records current execution. No test has run. Root npm ci uses this worktree only. Short TMPDIR is /mnt/storage/scratch/tmp/1ysAmV; every scripts/test-*.sh invocation will use timeout -k 10. Canonical queue next returned nothing while assignment was pending. Start op steelbeak-287-start refused the sage-4122 assign lock; retry no sooner than two minutes after that refusal.

Delta at 18334d713: broker grantableAgent 2667-2672 (launch.by self eligible), giteaRole 2760-2777 (new chief refusal), targets 2781-2789, binding/block 2799-2830, recheck 2832-2842, step4 3070-3085, step5 3087-3120, applied/notice 3124-3132. gitea-grant hash 75-80 and API 250-264 unchanged. Business publish fence is 291-299. Install library helper is 109-127. Row286 library-credential.test.mjs seeds 153-179, consumed at 219, 225 and 286, must become real minting.

Chief scope delta raised in steelbeak-0001: row285 declares read scopes and sage-2921 fences the existing write-scoped executor; inherited dewey-0862 retained SEAT_SCOPES and Q3 allowed mixed chief grants. Await explicit resolution of that boundary before implementing it. Other accepted rulings (conditional library hash, optional repositories event key, exact permission keys, business publish fence, preserved host creative refusals) remain applicable.

Tests planned: Docker F-A/F-B gating first; F-C/F-D recorded. Fake L1/L2/L4-L10 and business B1-B4 from inherited plan; install chief identity/publish and row286 real-mint replacement. Mutants M1 library-only guard, M2 forced write, M3 loose permissions, M4 library fork, M5 missing creative-or-chief publish fence. No suite runs before Sage CLEAR.

Rulings

Sage-4125 (2026-10-24 14:49:27Z), replacing Q3 and dewey-0862's chief SEAT_SCOPES line:

1. Chief grants name only library projects; mixed and fork-only chief raises refuse gitea-not-declared.
2. Library mint scopes come from the definition's gitea credential: chief read:repository/read:user, creative its declared scopes. Fork grants retain SEAT_SCOPES.
3. Role comment retains sage-2921's reason and cites mos-1320 item 2 and sage-4125.
4. L2 pins chief read collaborator and read token scopes; L7b pins chief nonlibrary/mixed refusal; M6 substitutes SEAT_SCOPES for library minting, M7 drops chief library-only condition.
5. Stop/report if grantableAgent or business validator still refuses chief after that condition.

Root npm ci passed (128 packages), webui npm ci passed (2), both worktree-local with ignore-scripts, no-audit and no-fund. Start retry met a different queue lock (louie-290-in-review); no bypass.

Prepared tests only (not executed): Docker F-A/F-B against both creative write and chief read users; F-B prints the actual permissions object. F-C/F-D use a private scratch repo and HTTP Git, logging only exit codes. A parent captures the fact child's entire TAP stdout/stderr and checks actual minted tokens before emitting diagnostics. New executor/business/install cases are drafted, including same-definition-hash level drift. Production files and fake API remain unchanged until Docker facts and expected RED evidence are recorded under CLEAR.

Row286 T7/T9 fixture draft now raises chief/books, resolves the human yes and awaits the executor; asserts repositories read level and actual token read scopes. The mapping remote is the fake's acme/books; revoke/fire assertions are unchanged. This intentional replacement is expected RED on the pre-C2-21 executor, separately from regressions in unchanged tests. No execution yet.

Implementation sequence and acceptance

After CLEAR: run only the C2-21 Docker facts first, under a 360-second outer timeout, and stop/report if F-A or F-B fails or skips. Then run new C2-21 tests and the intentionally replaced T7/T9 cases against unchanged production to establish expected RED. Save the evidence and report the first RED. No production fix until that evidence exists. Old tests retain assertions; the old chief refusal case still targets a non-library project and should remain green.

Implementation boundaries: definition-based scopes only for library minting, collaborator PUT through admin token, exact admin/push/pull check publish-wide with library projects excluded from fork parents, conditional library hash input preserving legacy hashes, optional repositories event field preserving legacy event shape, scope-accurate block/notice. Business library publish remains fenced to creative or chief and existing identity/credential validation. Install adds only chief identity/publish for the library profile. Host creative refusals remain untouched.

Builder verification after expected RED and fix: touched test files whole (600 seconds each), bus, business and cli whole (1800 seconds each); mutants M1-M7 with targeted test filters (180 seconds each), restoring source after each; Docker whole (600 seconds); all scripts/test-*.sh (1200 seconds each, timeout -k 10); token search across saved output. Tests do not run concurrently. Stop on an unexpected old-test RED or second RED and report to Sage before any remediation. The gate's cli skip-list rules and Sage's slot ownership remain authoritative. No live host change, push to refactor, merge or deployment is authorized. Own-branch push is authorized after applicable suites are green.

Canonical start succeeded at 14:56Z: ok steelbeak-287-start rev 3955 row 287 briefed→in-progress. Prepared all independent pre-CLEAR work; no tests, production edits, commits or pushes. Reported ready in steelbeak-0004. The first execution is the Docker facts, never a fake or package suite.

CLEAR run (sage-4130, 2026-10-24 15:04Z)

Worktree-local root npm ci passed (128 packages) and webui npm ci passed (2), ignore-scripts, no-audit, no-fund. New short TMPDIR /mnt/storage/scratch/tmp/HvDvQ8. First Docker facts invocation returned a vacuous green: inherited NODE_TEST_CONTEXT made Node skip the nested runner, minted 0. INVALID evidence, no fact pass claimed; reported steelbeak-0006. Corrected only the new harness child environment (delete NODE_TEST_CONTEXT) and added a requirement that four actual tokens were minted. Second facts invocation is running. Production unchanged.

Docker facts (gitea/gitea:1.27.1, corrected harness, rc 0)

Evidence: evidence/docker-facts-r2.log, 1 pass, 0 fail, 0 skip; all four tokens minted and no minted value in complete captured TAP stdout/stderr. Container g287-* removed by t.after cleanup.

• F-A PASS: exact admin scopes write:admin/write:repository/write:user; collaborator PUT on writer/books (admin does not own it) returned 204 for creative write and chief read.
• F-B PASS: seat /user/repos lists writer/books. Actual creative permissions {"admin":false,"push":true,"pull":true}; chief permissions {"admin":false,"push":false,"pull":true}. Chief token has read:repository/read:user scopes.
• F-C NOT ESTABLISHED: Story/** protection rejected both seat push (rc 1) and owner push (rc 1). The required owner control did not pass; do not claim a useful seat-only protected-file fence.
• F-D ESTABLISHED: on protected branch normal seat supporting-file push rc 0, force-push rc 1.

Proceeding to expected RED against untouched production, then sage-4125 implementation.

RED and correction record

New-test first RED: evidence/red-new.log, 17 tests, 4 pass (refusal controls), 13 fail at missing behavior. T7/T9 replacement expected RED: evidence/red-replacement.log, 2 fail gitea-not-declared. After implementation, touched-r1.log: 122 tests, 115 pass, 7 fail, 0 skip, all failures new cases. Stopped/reported steelbeak-0008 before changes. Mos-1590 via sage-4138 approved two fixture fixes: seat-only /user/repos overrides (not admin prechecks) and real declared coder scopes for kind drift. Dedicated-admin refusal already covered by X-G2 "admin set refuses each failed check and writes nothing, then writes the slot once" at gitea-grant.test.mjs:276 (:293 asserts grant-admin-not-dedicated).

Touched-r2.log: 123 tests, 122 pass, 1 fail, 0 skip. New L10's extra zero-network assertion was false: executor correctly performs four read-only admin checks before binding recheck. Stopped/reported steelbeak-0009. Sage-4139 approves exact GET admin checks, no /admin/users, /tokens or /collaborators, unchanged decision-mismatch, and absent grant file/record. Add M10, an early write ahead of recheck. The added no-declared-scopes case ran green before its mutant, an ordering error recorded honestly; its proof will be M8 removing the scopes check, followed by restored green. No prior RED-first proof is claimed for that added case. Add M9 dedication-check removal against existing X-G2.

F-C follow-up (sage-4134): a protected Story/** rule refused owner and seat; the first row depending on owner pushes to a protected branch must resolve this. Record only; no 287 behavior changes. Install choice: books is the chief's read project when present; another library project's existing install support is retained by using the first library project. Default identity is business-id-chief on that project's origin, with a mosaic.invalid email; an explicit input identity is preserved.

Touched-r3.log: 123 tests, 123 pass, 0 fail/skip after sage-4139. No unchanged assertion removed. Mutants M1-M11: all KILLED by assertion failures (rc 1, positive fail count, zero skips), no timeout, syntax or module-load kill. Every edited file restored byte-for-byte after each mutant; runner is mutants.py, evidence/mutants-run.log and evidence/M*.log hold the outcomes. M8's restored proof is the forthcoming full bus run; the added case's initial green remains recorded above.

Mutant	Change	Catch
M1	drop creative library-only guard	L7 creative nonlibrary/mixed
M2	force library level write	L2 chief read
M3	accept pull regardless of admin/push	L4 widened read
M4	fork instead of collaborator	L1 creative write
M5	remove library publish fence	business only creative/chief
M6	library mint SEAT_SCOPES	L2 chief declared read scopes
M7	drop chief library-only guard	L7b chief nonlibrary/mixed
M8	remove declared-scopes check	no-declared-scopes refusal
M9	remove admin dedication check	existing X-G2
M10	move step2 user-create write before binding recheck	L10 exact GETs, no writes/file/record
M11	omit library kind/level from identity hash	L10 drift

Full suites in progress

Restored full bus: evidence/bus-suite.log, rc 0, 998/998 pass, 0 fail/skip. This includes restored M8 proof and both Docker tests (fact child diagnostics also carry their own nested summary). Full business: evidence/business-suite.log, rc 0, 283/283 pass, 0 fail/skip. CLI is running sequentially after business at --test-concurrency=2. Every package invocation uses short TMPDIR and an outer timeout -k 10; no live provider opt-in is passed. Docker executor container prefix is now g287-executor-* (only the test's scratch name changed), so the separately required full Docker rerun and final sweep can target only this row's g287-*.

Full CLI: evidence/cli-suite.log, rc 0, 990 tests, 989 pass, 0 fail, 1 skip, duration 851 seconds. The existing skip is packages/cli/tests/federation-acceptance.test.mjs, "FED R7 scratch two-instance acceptance", runner scripts/test-federation-acceptance.sh. That runner must pass in this same gate before the CLI skip is accepted (BRIEF-TEMPLATE mos-1583); no new skipped test was introduced. Dedicated full Docker and install-file reruns are now running; shell gates follow sequentially.

Dedicated Docker whole: evidence/docker-whole.log, rc 0, 2/2 pass, 0 fail/skip; actual F-A/F-B permissions and F-C negative/F-D positive reproduced. Complete captured fact TAP: minted 4, hits 0. Dedicated install whole: evidence/install-whole.log, rc 0, 27/27 pass, 0 fail/skip. Docker shell wrapper adds an EXIT/INT/TERM cleanup for g287-* only, alongside each test's t.after. Every scripts/test-*.sh is now running sequentially at timeout -k 10 1200, NO_COLOR=1 and MOSAIC_TEST_CONCURRENCY=2, with MOSAIC_LIVE_PROVIDER and NODE_TEST_CONTEXT unset. Each script's own scratch-project cleanup remains active. Stop at the first nonzero result; shell-summary.txt records rc.

Shell launcher error: direct timeout invocation of scripts/test-land-work.sh returned rc 126, Permission denied. File is tracked 100644; no assertion ran. Not a test RED. Reported steelbeak-0013; sage-4141 approved bash invocation for this and remaining scripts, matching the landing gate. No chmod or source change. Preserve initial shell-summary.txt and add shell-resume-summary.txt.

Builder verification complete (sage-4130)

All twelve shell scripts passed (shell-summary.txt plus shell-resume-summary.txt), with the recorded rc126 launcher error followed by the approved bash run. Counts: auth 15, conductor 17, config 55, discord 82, extension-package 18, FED 1, foundation 44, land-work 86, push-check 38 checks plus its six killed internal mutants, queue 28 shell checks and 156 node passes, release 15, task 92; zero failed checks. Queue's canonical-only verify/render checks are intentionally skipped by its linked worktree runner. Task's live-provider cases remain off as required by row244 and this assignment.

Summary: bus 998/998; business 283/283; CLI 989 passed, zero failed and the one existing FED skip covered by dedicated runner 1/1 with zero skips and cleanup receipt; Docker whole 2/2; install 27/27; all 12 shell scripts rc0; M1-M11 killed without timeout/syntax kills and byte-restored. Known fixture search: 3 values across 37 logs, hits0. Fact runner checked four actual minted values against complete TAP stdout/stderr, hits0. Fake cases check every issued value against stored data. Final cleanup: no owned test node/chromium processes and no g287 Docker containers; test-task and release network removal checks passed; FED reports no groups/ports/sockets. Other containers and preexisting harness/MCP services were untouched. git diff --check passes.

Scope result: a creative library seat gets collaborator write; chief library read uses its declared read token scopes; creative/chief non-library or mixed raises refuse. Business publish remains fenced to creative/chief; legacy forks/event fields and host creative refusals retain coverage. T7/T9 now mint real chief grants before their unchanged revoke/fire assertions. F-C owner-protection follow-up is recorded above; F-D force-push observation is positive. No live Gitea or host change.

Review handoff: Boyd first, Dewey landing review, Sage gate. Base 18334d713; branch steelbeak/row287. The review manifest freezes all changed code, tests, logs and these notes (excluding only the manifest itself). Commit/push are authorized by sage-4130; review/landing remain separate stages.

First-review doc-only follow-up (Boyd boyd-0034)

Boyd approved the frozen product candidate c2338ed588 and manifest 3683b40a32b68163c3ab0430ee0d6a4603c97882bf62e982d33a40058507c2b6 (56 entries), static review, no tests or slot use. Dewey received the Q210 landing-review handoff.

Correction to the earlier diff-check claims: plain git diff --check checked the then-current unstaged changes only. The complete base 18334d713 → frozen candidate diff-check returns rc2 because raw RED/mutant evidence logs retain Node assertion formatting with trailing whitespace. The complete product/test diff-check returns rc0. Raw evidence is preserved; do not claim the entire committed diff is whitespace-clean. This correction changes documentation only and does not rerun or weaken a test.

Old-test numstats, verified with git diff --numstat 18334d713 c2338ed58 (added/deleted lines):

Existing test file	Added	Deleted
packages/bus/tests/fake-gitea-api.mjs	13	3
packages/bus/tests/gitea-grant-docker.test.mjs	127	2
packages/bus/tests/gitea-grant.test.mjs	155	0
packages/bus/tests/library-credential.test.mjs	24	35
packages/business/tests/business.test.mjs	25	0
packages/cli/tests/case2-install.test.mjs	13	0

Canonical queue move steelbeak-287-r1-review succeeded at rev3963, round1 on #1792. Its automatic review request failed at rev3964 because MOSAIC_GITEA_CREDENTIAL_FILE is unset; this seat has no Gitea credential. No substitution or secret access attempted. Sage received the precise boundary in steelbeak-0016 and handles the normal lead request/comment route. The test slot was returned.

Per lead decision137, this is a separate doc-only follow-up to the approved candidate. The frozen manifest and product/test bytes remain unchanged; the follow-up is not a new product review round.