stack/docs/plans/2026-10-21_gate-env-rows.md

Gate environment rows (2026-10-21)

Sage, from the row 197 lane proof that stopped on 2026-10-21 (sage-1881, mos-1162). Two small rows. Each lands after row 197.

The startup token refusal test sets its file mode

packages/bus/tests/process.test.mjs:76 writes the "too open" token file with writeFileSync(file, secret, { mode: 0o644 }), and :82 expects the broker to refuse it. writeFileSync applies the process umask to that mode. Under umask 077 the file is 0600, packages/bus/src/credentials.mjs:205 accepts it, and the test fails. That happened in the row 197 lane proof, where scripts/testing/gate-lane.sh:3 set 077 for the test steps.

• Change: the test calls chmodSync(file, 0o644) after the write, so its result no longer depends on the umask.
• Sweep: look in packages/*/tests for other tests that expect a refusal of a too-open mode set through writeFileSync or mkdirSync, and fix those the same way. List what the sweep found in BUILD.md, including when it found none.
• Test: run the file whole twice, once under umask 022 and once under umask 077. Both runs pass.
• Order: Mos ruled (mos-1162) that this lands after row 197 r6. Then r6's proof runs on the unchanged test, so it shows the umask fix itself works.

Gate runs use a fixture pi auth file

The docs/plans/DEFERRED.md entry "Gate runs mount the host's pi auth file" (059577886, Webby N4 on the row 197 proof driver, traced by Herb in herb-0051) gets its own row here.

• Change: every gate step that reaches Compose gets a fixture PI_AUTH_FILE. That covers the test-task.sh cases that call scripts/run-task.sh, test-release.sh through release.sh health_check, and row 197's lane cleanEnv in scripts/testing/gate-lane.mjs. Either the suites or the lane's cleanEnv can set it.
• Test: no gate step mounts the host default /home/jwoltje/.pi/agent/auth.json. The test reads the Compose arguments or the environment that each step passes. It does not read the host file.
• Not in scope: compose.yaml's default for real runs stays as it is.
• At landing, the DEFERRED entry moves to Done with the landing commit.