stack/agents/morgana/work/queue-243/BUILD.md

Row 243: too-open mode refusal tests set their mode with chmod

Brief: docs/plans/2026-10-21_gate-env-rows.md § "The startup token refusal test sets its file mode" (Sage, sage-1909). Reviewer Webby. Lands after row 197 (mos-1162). Design notes written before 197 lands, read at origin/refactor 01e1fe512. Recheck the line cites against 197's landing before code starts.

The defect

writeFileSync(file, data, { mode }) and mkdirSync(dir, { mode }) apply the process umask to the mode. A test that creates a "too open" file this way and expects a refusal passes under umask 022 (0644 stays 0644) and fails under umask 077 (0644 becomes 0600, and the source accepts it).

Row 197 r6 (df0c59608) runs each gate step under umask 022 (gate-lane.mjs:46), so the lane no longer hits this. Row 243 still makes the tests independent of the umask, as the brief asks.

Sweep

Method: every source-side mode check in packages/*/src and scripts/ (grep for mode & 0o...), then the tests that reach each check's refusal branch, deciding whether the too-open object gets its mode at creation or from an explicit chmod. Also a scan of every writeFileSync/mkdirSync/openSync in packages/*/tests with a group or other bit in its mode (50 hits, 41 without a following chmod), and a grep of the refusal messages for objects created with no mode or by a shell-out. Read at origin/refactor with git show and git grep; nothing run.

Affected refusal tests, all three verified by reading the test (the fourth file, an accept test, follows the table):

Creation	Test	Source check	Expected refusal
packages/bus/tests/process.test.mjs:76 writeFileSync(file, secret, { mode: 0o644 })	startup token refusal returns safe code...	bus/src/credentials.mjs:205 (must be 0600)	credential-file, exit 2 (:83-84)
packages/webui/tests/proof-cli.test.mjs:28 writeFileSync(file, value, { mode }), mode 0o644 from the mode case at :27	proof startup refuses partial flags...	webui/src/serve.mjs:234 (0600 or 0400)	status 2 (:38)
packages/webui/tests/sso.test.mjs:360 writeFileSync(.../secrets/mosaic-stack/a, ..., { mode: 0o644 })	11: the CLI refuses --sso...	webui/src/sso.mjs:45 (no group or other bits)	status 2 and the "no group or other permission bits" line (:361-363); the chmod to 0600 at :364 comes after

Fix for each: keep the write, then chmodSync(<path>, 0o644) right after it. For proof-cli.test.mjs the chmod goes inside the case map after the write, with the case's own mode, so the 0o600 cases are set explicitly too.

Not affected (each sets the mode with a chmod or a chmodding helper before the code under test reads it): bus credentials.test :52, credential-store.test :55-61; business access.test :225-226, business.test :159/161/174, credentials.test :60, cli.test :151, helpers writeJson/tokenFile; cli cli.test :176, notifier.test :318/:321, stack-release.test :1220/1239/1294/1313/1552, stack-upgrade.test :426-430, case2-unit.test :340/:510/:635; control-board discord.test :79; discord binding.test :106/118/140/277, notify.test :76, setspark.test :110, git.test :138/:360, offline-check.test :21; mosaic safety.test :80; queue review.test :214/:228; ledger gitea-helper-raw.test :113; webui service.test :797, sso.test :310; bus host-tools.test :182/:266. The 0o644/0o755 adapter and fake-binary writes (launcher, thread-launch, session, sandbox, checkout, commit, etc.) aren't read by a mode check, or are only checked for the exec bit, which 0700 keeps. host-tools.test.mjs:205, :271 and the confDir at :77 expect acceptance and only need "not group-writable".

Mode checks with no refusal test at all (not this row; listed for the record): bus/src/store.mjs:121, bus/src/host-run.mjs:71, business/src/organization.mjs:28/45/109/141, conversation/src/controller.mjs:299, mosaic/src/materialize-fixture.mjs:16, mosaic/src/refresh-fixture.mjs:64, seat/src/session.mjs:72, scripts/git-credential-mosaic.mjs:49, and the mode branch of scripts/stack-release.sh:1952.

Fourth file, folded in by Sage (sage-1918): packages/cli/tests/stack-instances.test.mjs:84 and :89 assert 0644 on the config and instance.json. scripts/mosaic-config.mjs:337 creates them with openSync(file, "wx", 0o644) and no chmod, so under umask 077 they come out 0600 and the test fails. This is an accept test of a source mode, not a refusal test.

Creation	Test	Source	Ruling
scripts/mosaic-config.mjs:337 via bootstrap() (stack-instances.test.mjs:41, a spawnSync of scripts/bootstrap.sh)	the --instance create test, :79-89	createExclusive passes 0o644 and the umask narrows it	test-only (sage-1918)

• No change to mosaic-config.mjs. Letting the operator's umask narrow the config is the source's choice; a chmod to 0644 would make the config wider than that umask. No row asks for it.
• bootstrap() runs its child under an explicit umask 022, the pattern from gate-lane.mjs:46: run("/bin/bash", ["-c", 'umask 022; exec "$@"', "bash", BOOTSTRAP, ...args], homeEnv(home)). Every bootstrap() call goes through it (:79, :99, :102, :119, :127, :136, :140, :152, :165, :169), so the 0644 assertions still prove the mode the source asks for, whatever the gate's umask.
• New assertion: a bootstrap --instance run under umask 077 makes the config and instance.json 0600. That pins that the source honors the umask, so a later chmod "fix" fails a test. The directories stay 0700 in both runs (they're created with mode: 0o700, which 077 can't narrow).
• The config() helper (:42) has no mode assertion and stays as it is.

Tests outside packages/*/tests: the five scripts/foundation/*.test.mjs files have no open-mode write. cli.test.mjs:144/148 chmods to 0o000 and 0o600, which doesn't depend on the umask. The agents/*/work probe tests are review evidence, not gate steps (discoverSteps doesn't run them), so they're out of scope.

Tests

• Each of the four files runs whole twice, once under umask 022 and once under umask 077 (bash -c 'umask 077; node --test <file>'). Both pass. The brief requires this for process.test.mjs; Sage extended it to all four (sage-1918).
• Proof that the change matters: before the change, the same four files under umask 077 fail on the named assertions. I record that run too, on the slot, so the 077 pass after the change is meaningful.
• Order (mos-1162): this lands after 197 r6, so r6's proof ran on the unchanged test.

Files (expected)

packages/bus/tests/process.test.mjs, packages/webui/tests/proof-cli.test.mjs, packages/webui/tests/sso.test.mjs, packages/cli/tests/stack-instances.test.mjs. Test-only. No source change.

Build (sage-2056: start on row 197's landing a36523713)

Branch morgana/row243, one commit on a36523713. Cites rechecked there: all hold except proof-cli's write, which is now proof-cli.test.mjs:30 (was :28).

• bus/tests/process.test.mjs: imports chmodSync; chmodSync(file, 0o644) after the write at :76.
• webui/tests/proof-cli.test.mjs:30: chmodSync(file, mode) after the write, with each case's own mode, so the 0o600 cases are set explicitly too.
• webui/tests/sso.test.mjs:360: chmodSync(..., 0o644) after the write, before the --sso start that must refuse.
• cli/tests/stack-instances.test.mjs: underUmask(mask, home, args) runs scripts/bootstrap.sh through /bin/bash -c 'umask <mask>; exec "$@"'; bootstrap() is underUmask("022", ...). New subtest in T-I1: under umask 077 the config dir and root are 0700, and the config and instance.json are 0600.
• Hash pins: no test or script names any of the four files (a grep for the basenames; positive control stack-release.test found in two files). stack-release.test.mjs:2122 mentions stack-instances.test.mjs only in a comment.

Tests: on Sage's slot (sage-2062, plan approved in sage-2059), 18:55Z. My busy check read CLEAR before and after. Each file ran whole with node --test --test-concurrency=2 from its package, under bash -c 'umask <mask>; exec ...', with TMPDIR from mktemp -d /mnt/storage/scratch/tmp/g243XXXX. Script /mnt/storage/scratch/morgana-r243/slot243.sh, logs in logs/ next to it.

Tree	umask	process	proof-cli	sso	stack-instances
base a36523713	077	7/1	2/1	27/1	21/2
candidate 137bda3af	022	8/0	3/0	28/0	24/0
candidate 137bda3af	077	8/0	3/0	28/0	24/0

(pass/fail.) The base fails are the predicted ones: "startup token refusal returns safe code...", "proof startup refuses partial flags...", "11: the CLI refuses --sso...", and in stack-instances the 0644 subtest "alpha and beta get a 0700 config dir..." plus its parent T-I1 (so 2). stack-instances has one more test on the candidate (the umask 077 subtest). No unpredicted failure.