stack/docs/plans/reviews/2026-09-08_publication-trial-launcher-verdict.md

PUB-REC-FILBERT-LAUNCHER-1 — final launcher candidate verdict

Reviewer: Filbert (independent). Coordinator: Darkwing. Original launcher authorship: Codex (session history); coordinator corrections: test fixture narrowing, TOOLS.md flags, skill compatibility note.

Independence: I authored none of the 23 candidates; the agents/filbert/ seat files describe my seat but were written by Codex. No conflict.

Verdict: APPROVED for publication

Exact candidate: the 23 candidatePaths of snapshot /tmp/pub-rec-launcher-review-a35yzs12, manifest SHA-256 8900faf13b3a95918b9542e4b96a57f3561101be7004d74db7b0bb6a7e0a7a5c (57 files including dependencies). All 57 hashes verified before and after review; snapshot unchanged. Dependencies supplied context only; this verdict does not publish them. The approved WUI draft and recovery summary are separate approvals and are not folded in here.

This grants no deployment, live-launch, or push authority. Jason retains final trial acceptance.

Independent checks and results

• Syntax: bash -n on five shell candidates and node --check on both test files and all three validate-sessions.mjs copies: pass. The three validator copies differ only in the agent name in the error string, as claimed.
• Fixture reruns, in my disposable copy (separate from Rocko's recorded historical recovery action and from the coordinator's run): node --test scripts/test-darkwing-launch.mjs — 4 tests, 4 pass, 0 fail, exit 0; node --test scripts/test-rocko-launch.mjs — 1 test, 1 pass, 0 fail, exit 0. Logs: /tmp/filbert-launcher-vkdzSG/.
• Pinned continuity: rocko test 13c32cad…, rocko launcher b65566e1…, and skills/ms-executive-update/SKILL.md 368a8576… are byte-identical to the values pinned in the recovery review and inventory. Coordinator corrections did not touch them.
• Isolation of both fixtures confirmed by full source read: temp roots, fake capture-only pi/claude, stubbed common.sh/sync-dev-extensions.sh/docker, fixture contracts; the Pi fixture now copies only launch.sh, SOUL.md, CONTEXT.md, validate-sessions.mjs per agent and asserts work/ and scratch/ absent (the coordinator's narrowing, verified in source and by rerun).
• Branch separation: --host-dev is a leading explicit mode only; container refusals never fall back to host. Container path keeps config gating, fail-closed auth resolution (data-root-managed, non-symlink, 0600), role ceilings, skill enablement, workspace naming.
• Refusals: host mode rejects container flags (--auth/--mission/--tools land on the unknown-argument refusal; TOOLS.md documents this), invalid names, flag-like values, invalid thinking levels, non-TTY, second concurrent TUI (flock), damaged or foreign-workspace session history, and empty/missing context files. All exercised by the fixtures I reran.
• Config/auth isolation: host mode uses native Pi authentication and copies no credentials; --check creates no .pi/state (asserted by the fixture).
• Session semantics: first launch starts a conversation; resume validates JSONL structure and workspace match before --continue; --fresh preserves earlier history; every launch writes a hashed private context snapshot.
• Documentation consistency: TOOLS.md host-dev usage now includes --provider/--model/--thinking matching agent-host-dev.sh; agents/README.md wrapper/override description matches the actual wrappers (Filbert's appends provider/model/thinking); per-seat READMEs match launcher behavior.
• Skill note: skills/ms-executive-update/README.md accurately preserves Codex/operator provenance without claiming a fresh byte comparison, flags the dangling fleet-layout references, defers to the actual goal_report schema, and states the skill is not loaded by the host-dev launcher (confirmed: it is not in the ten-skill list). Publication does not activate it.
• Publication safety scan of all 23 candidates: no session UUIDs, hosted conversation links, home paths, token/credential shapes, or socket names. .pi/state mentions are generic path documentation. The canonical checkout path is already-public posture per the inventory.

Findings (non-blocking)

1. Cosmetic: scripts/agent.sh initializes AGENT_DEF_SKILLS="" twice in immediate succession (lines 98–99). Dead assignment, re-initialized before use; no behavioral effect. Fix at leisure in a future reviewed change, not a publication blocker.
2. Argv observation assessed, not redesigned: agents/rocko/launch.sh passes the context snapshot as a single argv value. Current inputs are a few KB against a megabyte-scale argv limit; it stays a documented scalability observation (inventory issue 4) with no unobserved redesign.
3. Context note: the compatibility-symlink home path appears only in a dependency README (agents/darkwing/README.md), not in any candidate; existing published posture already includes such paths.

Publication boundary

Publish exactly the 23 candidatePaths at the verified manifest. Dependencies (34 paths) supplied review context only. Raw worker records with runtime identifiers remain local per the recovery verdict. Any candidate change requires a new review.