stack/agents/filbert/work/s6/BUILD.md

# Row 41 (#1523): slice 1 S6, candidate packet, round 4

Author: Filbert. Reviewer: Darkwing. Brief: `docs/plans/2026-10-04_slice-1.md`,
section "Slice 1 S6", blob `72d11de2`. Plan: `PLAN.md` here (b6d2fe2b).
Rulings: lead decisions 77 and 78, Sage's round 2 ruling (fix R1, R2
and R3), round 3 ruling (fix R4) and round 4 ruling (fix R5). Base:
`915e00e5` (`base.txt`). None of the 42 files changed between the base and
`0a4c8f13`, where the round 4 gate ran. The candidate source is uncommitted. There are no pushes. No token, private
binding or tracker host was read or written, and nothing touched the live
`mosaic-bus@mosaic-stack` unit or `~/.mosaic-dev/bus/`.

## Round 4

Darkwing's round 3 asked for changes (#1523 comment 27032, rev 271, packet
`agents/darkwing/work/s6-review/review-r3.md` and `r3/`, 974da6ed). R4 is
verified fixed. Sage ruled: fix R5 in this round; leave R1 to R4 alone, no
other scope. Four files changed since round 3, and none is new:

- `packages/harness/src/gate.mjs`, `README.md`
- `packages/harness/tests/gate.test.mjs`, `pi-session.test.mjs`

No source outside `insideWorkspace` in the gate changed.

### R5: a relative path is resolved from the real path of Pi's cwd

Both adapters `cd "$MOSAIC_WORKSPACE"` before they start the harness, and
a process's cwd is the real path (`getcwd`). Pi 0.85.1 resolves a relative
path lexically against `process.cwd()` (`resolveToCwd`), so `..` climbs the
real path's parents. Round 3's `insideWorkspace` resolved a relative path
against the workspace as given. With the workspace or the dataRoot behind
a symlink, the two climb different directories. In Darkwing's layout
(`$R/data -> $R/deep/store`, workspace `$R/data/ws`), `../../data/ws/X` is
`$R/data/ws/X` to the gate and `$R/deep/data/ws/X` to Pi. A real Pi
session read a file there and wrote a new one.

The fix: a relative path must resolve inside from both the workspace's
real path, as Pi resolves it, and the path as given. An absolute path is
unchanged. `spellings()` already built from both bases (R4), so `read`'s
other-spelling check needed no change.

The given-path check is a choice, and it is stricter than Pi. A path that
is inside for Pi but climbs out of the given path is refused, for example
`../../store/ws/x` when the workspace is `$R/a/ws -> $R/deep/store/ws`. I
kept it so the gate stays fail-closed whatever directory it runs in, and
doesn't rest on the adapter's `cd` alone. The cost is that such a path is
refused even though it is safe. A session has no need for it: the plain
relative path or the absolute one works.

### Claude Code isn't affected

Claude Code makes a `file_path` absolute against its own cwd before the
`PreToolUse` hook runs. Its cwd is also the real path, so `claude-gate.mjs`
gets the path Claude Code will open, and the absolute branch checks it.
Darkwing's `claude-cwd-dotdot.sh` shows this: the hook's refusal names
`<R>/deep/data/ws/secret.txt`, not the relative name. My rerun against
round 4 gives the same (below). The new check covers a relative path from
Claude Code too, if a later version passes one through.

### Tests

- `gate.test.mjs`, "a relative path climbs from the workspace's real path,
  in both harnesses". Two layouts, each in Pi and Claude Code:
  - workspace behind a symlink: `<dir>/a/ws -> <dir>/deep/store/ws`;
  - dataRoot behind a symlink: `<dir>/data -> <dir>/deep/store`, workspace
    `<dir>/data/workspaces/b/i`, the launcher's shape.

  In each, the `../..` escape is inside as given and lands on a planted
  file outside for Pi (the test asserts both). Read and write of the escape
  are refused. Read and write of `../ws/...` or `../i/...`, through the
  symlinked root and back in, are allowed. A path that is inside for Pi
  but outside as given is refused.
- `pi-session.test.mjs`, "pi: a relative path climbs from the real path of
  a workspace behind a symlink", and the same for a dataRoot. A real Pi
  0.85.1 session runs through the adapter and the mock API, in the
  symlinked workspace:
  - the escape read and write come back as gate errors;
  - the outside file's text never reaches stdout;
  - the outside directory holds only the planted secret, and no
    `planted.txt` appears in the workspace;
  - the inside read returns its content, and the inside write lands.

  `session()` in that file gains an optional workspace placement for this;
  the other tests keep `<dir>/ws`.

### Mutants

Each was made on `gate.mjs`, restored from a copy and checked with `cmp`.
The base passes `gate.test.mjs` and `pi-session.test.mjs`, 19/19.

| Mutant | Change | Result |
|---|---|---|
| given | the given path only (round 3) | 16/3: the gate test and both Pi sessions |
| real | the real path only | 18/1: the gate test's stricter case |

The first draft of the gate test let `real` survive. The stricter case was
added for it.

### Darkwing's probes against round 4

`r3/probe/pi-cwd-dotdot.sh` and `claude-cwd-dotdot.sh`, run unchanged with
`WT` set to the round 4 build, both modes each. Outputs are in
`out/probe-pi-cwd-dotdot.txt` and `out/probe-claude-cwd-dotdot.txt`.

| Probe | Mode | Result |
|---|---|---|
| Pi | read | gate refuses `../../data/ws/secret.txt`; the tool result is the refusal; the secret isn't read |
| Pi | write | gate refuses `../../data/ws/planted.txt`; nothing is written outside or in the workspace |
| Claude Code | read | the hook refuses `<R>/deep/data/ws/secret.txt` (absolute) |
| Claude Code | write | the hook refuses `<R>/deep/data/ws/planted.txt`; nothing is written |

### Darkwing's other round 3 notes

Per Sage's ruling, nothing else changed this round. These go to
follow-ups:

- Mw, Mx, My and Mz survive the spelling tests. Each flips some of
  Darkwing's spell-edge cases from refused to allowed: lowercase `am`,
  two apostrophes, a path below a respelled self-loop, and the
  normalised forms (`@`, NBSP before AM, `file://`, `%27`).
- Darkwing's fix 2: realpath the workspace in the seat's `workspaceDir`
  (`packages/seat/src/session.mjs:46`), so a symlinked dataRoot never
  reaches the harness as a given path.
- The Ma leftover (`fake-adapter.mjs`) reproduced, and stays a follow-up.

## Round 3

Darkwing's round 2 asked for changes (#1523 comment 27010, rev 259, packet
`agents/darkwing/work/s6-review/review-r2.md` and `r2/`). Sage ruled: fix
R4 in this round; R1 to R3 hold and stay closed. Six files changed since
round 2, and none is new:

- `packages/harness/src/gate.mjs`, `README.md`
- `packages/harness/tests/gate.test.mjs`, `pi-session.test.mjs`
- `packages/cli/tests/host.test.mjs`, `launcher.test.mjs`

No source outside the harness gate changed.

### R4: a read is checked under every spelling Pi's read would open

When the name it is given doesn't exist, Pi 0.85.1's `read` opens another
spelling. `resolveReadPathAsync` (`dist/core/tools/path-utils.js`) tries
these in order, and opens the first that exists:

1. ` AM.` or ` PM.` with U+202F before the `AM`/`PM`;
2. the NFD form;
3. `'` changed to U+2019;
4. both 2 and 3.

The `pi` binary runs the same code from `dist/bundle/`. In 0.85.1 only
`read` and the CLI's file arguments call it. `write`, `edit`, `grep`,
`find` and `ls` take the name as given. The gate checked only the given
name, so asking for `notes's.txt` could read a link `notes’s.txt` that
points outside.

The fix is `otherSpelling` in `gate.mjs`. It covers Pi's `read` and
Claude Code's `Read` (Darkwing's note 3):

- It builds every spelling from the workspace path and from its real
  path. The adapter starts Pi with `cd "$MOSAIC_WORKSPACE"`, so Pi resolves
  a relative name against the real path.
- A spelling that exists and resolves outside the workspace refuses the
  read. So does one that goes through a dangling link.
- A spelling that doesn't exist is skipped, and so is ENOTDIR. Any other
  `lstat` error refuses the read.

It doesn't depend on which spelling Pi would open. So a read is refused
even when the exact name exists inside and some spelling points outside.
The README's "Limits" says so, with the example of a sibling `jo’s/ws`
beside a workspace in `jo's/ws`. Its pin note lists what to recheck on a
Pi upgrade.

Tests:

- `gate.test.mjs`, "read is checked under every spelling pi's read would
  open, in both harnesses". It asks for six names, relative and absolute,
  in both harnesses, covering each family and their mixes:
  - straight quote
  - AM/PM
  - NFD
  - NFD with a quote
  - NFD with a straight quote kept
  - a quote with composed accents

  Each is refused when its other spelling links outside. It is allowed
  when that spelling links to a file inside. A `write` of the asked name is
  allowed.
- `gate.test.mjs`, "other spellings cover directories, dangling links and
  pi's cwd". These are refused:
  - a directory spelling;
  - a dangling spelling;
  - a workspace given through a link, whose real path has a sibling
    `jo’s/ws`.

  A name with no other spelling is allowed, and so is ENOTDIR.
- `pi-session.test.mjs`, "pi: a read is refused when pi would open another
  spelling outside". A real Pi 0.85.1 session runs through the adapter and
  the mock API. It reads the six names, plus one whose other spelling is
  inside:
  - each of the six comes back as an error naming the other spelling;
  - the outside file's text never reaches stdout;
  - the inside one returns its content.

Darkwing's `r2/probe/pi-variant.sh` against this round refuses all four
modes: plain, quote, ampm and nfd. Plain is refused by the existing check.

Mutants: each was made on `gate.mjs`, restored from a copy and checked
with `cmp`. The base passes `gate.test.mjs` and `pi-session.test.mjs`,
16/16.

| Mutant | Change | Result |
|---|---|---|
| none | no other-spelling check | 13/3 |
| pibase | spellings from the given workspace path only | 15/1: Pi's cwd case |
| ampm | no AM/PM spelling | 14/2 |
| nfd | no NFD spelling | 14/2 |
| curly | no U+2019 spelling | 14/2 |
| nfdcurly | no NFD-with-U+2019 spelling | 14/2 |
| pionly | Pi's `read` only, not Claude's `Read` | 15/1 |
| danglingok | a dangling spelling is skipped | 15/1 |
| enotdir | ENOTDIR refuses | 15/1 |
| existsonly | a spelling that is a link is skipped | 13/3 |

The first draft of the tests let `nfd` and `curly` survive. Their names
had both features, so the combined spelling alone caught them. The two
single-feature names were added for that.

### Darkwing's other round 2 notes

1. **Mr.** `host.test.mjs` has a new test, "a broker reply with no
   request waiting breaks the channel and the host exits 1". It binds a
   coder, then has the broker child send an `identity` reply with an id
   that no request waits for. The host logs "broker channel broken (reply
   with no request waiting)" and exits 1, and a later op refuses with
   `broker-channel-broken`. Under Mr (such a reply is ignored), the test
   fails at its 5 s limit. No code changed.
2. **Mv.** Every `launcher.test.mjs` test now has a 30 s timeout. The
   longest real run is 3.7 s. Under Mv the file ends in 62 s with 6
   failed, 2 cancelled and 1 passed; round 2's run hung.
3. **Claude's `Read`.** It gets the same check (R4 above).
4. **The leftover after Ma.** Not traced this round. It goes to
   follow-ups.
5. **Mq** still fails only at the 30 s test timeout. That is a failure,
   not a hang, so I left it.

A related leftover, not from this candidate: a `conversation/src/shim.mjs`
from my round 2 gate's conversation suite was still running about an hour
later. It belonged to a removed worktree, under my scratch `TMPDIR`. It
ignored SIGTERM, and I killed it by PID with SIGKILL. The conversation
package is row 40's, so it goes to follow-ups for its owner.

## Round 2

Darkwing's round 1 asked for changes (#1523 comment 26995, rev 247,
packet `agents/darkwing/work/s6-review/` at `f19787ee`). Sage ruled that all three
findings are fixed in this round. R1 sits inside decision 77: it's trusted
IPC, with no socket verb, event kind or schema change. This round adds one
file, `packages/cli/tests/host.test.mjs`, which round 1 didn't touch.

### R1: host↔broker replies carry the request's id

- `host.mjs`: every request gets `id = ++seq`, and the broker process echoes
  it on every launch-op, bind and startup reply (`tag()` in
  `packages/bus/src/process.mjs`). A reply is taken only if its id is the
  waiting request's.
- Any of these breaks the channel (`breakChannel`): no reply within
  `REQUEST_TIMEOUT_MS` (10 s), a reply with another id, a reply with no id,
  or a reply with no request waiting.
- Once the channel is broken:
  - the waiting request refuses with `broker-channel-broken`, and so does
    every later one, including those already queued;
  - the host logs it and closes with exit 1, for the unit to restart;
  - a launch waiting on the channel is refused, never allowed.
- Tests:
  - `host.test.mjs` "a broker reply that misses the wait breaks the
    channel …". The broker is SIGSTOPped with one request waiting and a
    bind queued behind it. Both refuse, the broker is resumed and its late
    reply answers nothing, the host exits 1, and a later request refuses.
  - "a broker reply with another request's id, or none, breaks the
    channel …" changes the id on the way out, so the broker echoes the
    wrong one, or drops it.
  - `end-launch.test.mjs` checks the echo, refusals included.
- The cli and bus READMEs say this.

Darkwing's `probe/desync.mjs` against this round: after the stall, p1 to p4
all refuse with `broker-channel-broken`, and the host logs "broker channel
broken (no reply within 10 s); stopping the host". The probe's second half
(two binds during a stall) then fails with `kill ESRCH`, because the host
has already stopped the broker. Round 1 cross-wired the replies there
(`b2 bind run-y (reviewer) got: {"run":"run-x"}`).

### R3: the gate refuses dangling symlinks

`gate.mjs` `real()` walks up with `lstat`, not `exists`, so a dangling
symlink counts as an existing name. It then takes the realpath of the
nearest existing ancestor, and an `ENOENT` from `realpathSync` means the
path reaches a dangling link. `decide()` refuses that as "path goes through
a dangling symlink", at any depth, even when the link points inside the
workspace. A write through the link would create its target wherever the
link names, and Pi's `write` creates missing parent directories first. A
link whose target exists is checked as before, so one pointing outside the
workspace is refused as outside it.

- `gate.test.mjs` "a dangling symlink is refused at any depth, in both
  harnesses" covers Pi `write` and Claude Code `Write`, by relative and
  absolute path. `notes.md` points outside, `dangling` points nowhere and
  `inner` points to a missing name inside the workspace. All of
  `notes.md`, `dangling/x`, `dangling/deep/x` and `inner` are refused. Once
  the targets exist, `notes.md` is refused as outside and `inner` is
  allowed. A path under a regular file is refused as `ENOTDIR`.
- `pi-session.test.mjs` "pi: a write through a dangling symlink is blocked,
  and nothing appears outside" runs a real Pi session's `write` through the
  extension. `notes.md` and `gone/x.md` come back as tool errors, a plain
  `fine.md` lands in the workspace, and the outside directory stays empty.
- Claude Code: `--restricted` stays defence in depth. The gate refuses the
  path whether or not the flag is set.

Darkwing's probes against this round:
- `pi-dangling.sh`: the dangling link gives "mosaic gate: write path goes
  through a dangling symlink: notes.md", and the outside file stays absent.
  With the target present, the write is refused as outside the workspace
  and the file keeps its content.
- `claude-dangling.sh`: the hook refuses with the same reason, and the
  outside file stays absent.
- `gate-edges.mjs`: the output matches round 1 except one line, `write
  dangling/x`, which went from ALLOW to the dangling-symlink refusal.

The README's "Limits" gains a TOCTOU line: the gate checks a path when the
call is made, so a link that `bash` or another process of the same user
changes between the check and the open isn't seen. That reach is the same
as `bash` itself.

### R2: a half-open `launch.sock` client can't hold `close()`

The launcher keeps its `launch.sock` connections in a set. `close()` calls
`server.close` and then destroys each connection, before it waits for the
server to close. `launcher.test.mjs` "a launch client that never closes its
side doesn't hold the host's close" opens one client that was answered and
keeps its side open, and one that never sends. `close()` must finish within
5 s. Darkwing's `close-hang.mjs`, in both modes (`silent`, `line`), now
gives `closed 0` about 15 ms after `host.close(0)`. In round 1, the close
waited until the probe destroyed its client at 25 s. The cli README says
so.

### Notes 1 to 5

1. **`--restricted`.** The harness README and the `adapters/claude/adapter.sh`
   comment now say that the flag keeps `CLAUDE.md` files (user, parent,
   workspace) and auto-memory out of the prompt, and that the gate doesn't
   rely on it for paths. Two tests cover it:
   - "claude adapter: --restricted is always passed" runs the adapter
     against a stand-in `claude` and checks argv. It runs without Claude
     Code installed.
   - "claude: CLAUDE.md files and auto-memory don't reach the model;
     without --restricted they do" plants the four markers and runs the
     real adapter against the mock API: none reaches the request. A copy of
     the adapter without the flag sends all four.

   Darkwing's `claude-memory.sh` gives the same result for this round: 0 of
   4 with the candidate, 4 of 4 without the flag.
2. **`launchPm` skips `authorizeLaunch`.** The cli README now says so:
   `launches off` doesn't stop `bus start --pm`, because the human launches
   the PM, and the other launcher checks still apply.
3. **Policy parse.** `runner.mjs` reads and parses the policy inside the
   `try`, so a missing or malformed policy exits 2 (usage) before the claim.
   Test: "a missing or malformed policy exits 2 before the claim".
4. **System prompt in argv.** This is now a harness README "Limits" line.
   No code change.
5. **Mutants.** Each new test was run against its mutant and fails. Each
   source file was restored from a copy and checked with `cmp`.

| Mutant | Change | Round 1 | Round 2 |
|---|---|---|---|
| R1a | the host takes any reply while a request waits | (finding) | "another request's id, or none" fails |
| R1b | no reply timer | (finding) | the stall test fails at its 30 s test timeout instead of hanging |
| R2 | `close()` doesn't destroy connections | (finding) | the half-open test fails within its 5 s bound |
| R3 | round 1's `existsSync` walk in `real()` | (finding) | the gate and pi-session dangling tests fail |
| N1 | the adapter without `--restricted` | (note) | both claude-session tests fail |
| Mg | `founderCheck` returns null | runner test hangs | the unit test fails; the runner test fails at its 60 s clock |
| Mh | no SIGKILL after the stop timeout in `close()` | survives | "a runner that ignores SIGTERM is killed when the host closes" fails |
| Mi | no SIGKILL in `recover()` | survives | the died-hard "kills them" case fails |
| Mj | no 4096-byte stdin cap | survives | "no capability, or a malformed one, on stdin" fails |
| Mk | no `LINE_MAX` on `launch.sock` | survives | "an over-long launch request is refused at once …" fails |

How the new tests separate the mutants:
- **Mh and Mi** rely on a SIGSTOPped process, which ignores SIGTERM and
  dies only on SIGKILL.
- **Mi:** in the died-hard test, the leftover session and its runner are
  stopped before the next host starts. Without the stop, the runner exits
  on its own once the broker is gone, which is why Mi survived round 1.
- **Mh** uses a test-only `stopTimeoutMs` (default 30000), set to 1 s.
- **Mg and Mj:** `startRunner` in `runner.test.mjs` now SIGKILLs a runner
  still alive after 60 s. A regression fails there instead of hanging the
  file.
- **The stall test** registers its SIGCONT hook before `host.close`. Hooks
  run in order, so a stopped broker can't hold the cleanup.

## Files (`files.txt`, 42)

`build.patch` is `git diff --cached --binary 915e00e5` over those files,
+4998/−63. It applies cleanly to `0a4c8f13` with `git apply`, and
`sha256sum -c candidate-manifest.sha256` passes in that tree.

| Area | Files | What |
|---|---|---|
| Harness (new) | `packages/harness/` | bundle, typed tools, gate, Pi extension, Claude Code gate and MCP server, runner, tests, README |
| Adapters | `adapters/claude/adapter.sh` (new), `adapters/pi/adapter.sh`, `adapters/README.md` | Claude Code adapter; Pi takes `MOSAIC_EXTENSIONS` as `-e`, and `--no-approve` |
| Sessions | `packages/seat/src/session.mjs`, `proc.mjs` (new), tests, README | spawn under `unshare`, registry, launch log, `stop` |
| Launcher and verbs | `packages/cli/src/launcher.mjs` (new), `host.mjs`, `cli.mjs`, tests, README | the launch socket in the trusted host; `mosaic talk`, `stop`, `launches off\|on\|list`; `bus start --pm` |
| Broker | `packages/bus/src/{broker,process,runtime}.mjs`, `tests/end-launch.test.mjs`, README | trusted IPC launch ops; `Broker.endLaunch` |
| Other | `docs/TOOLS.md`, `scripts/mosaic`, `scripts/agent-host-dev.sh` | verb reference; host seats pass `--no-approve` (the DEFERRED entry) |

## Against the brief

- **Bundles, Pi then Claude Code** (`packages/harness/README.md`, "The
  bundle"): prompt, policy, typed tools and a manifest from one resolved
  instance. Each manifest names the S0 lines it relies on (`reliesOn`).
  Skills: resolution runs without a skills source, so bundles list none
  (README "Limits").
- **S0 lines** (README table): Pi blocks in a `tool_call` handler, a throw
  blocks, a missing `-e` refuses to start, and a hang is bounded by the
  runner's wall clock plus the `agent_end` turn marker. Claude Code uses a
  command hook run as `timeout -k 2 10 <gate> || exit 2` with hook timeout
  20; `--bare` is never passed. `--restricted` is defence in depth for the
  gate, and it keeps `CLAUDE.md` files and auto-memory out of the prompt.
  Line 5 (`bash`) is the tool limit and is written as a limit.
- **The PM launches through the broker, within `launch`**: the host's
  launch socket checks the instance list, that the instance isn't already
  running, the model family against `launch.max` (every running session
  counts, the PM's too), then the broker's own `role.launch` authorization.
  Every launch, refusal and end is a launch-log line and a broker event.
  `mosaic launches off` is Jason's one word (`launch.revoke`). `mosaic stop
  <run>` ends a session.
- **Founder credentials (REQ-CRED-2)**: the session environment is an
  allowlist (`ENV_ALLOW`). The runner exits 20 before claiming if a known
  founder variable reached it, or if a service the role needs has no usable
  role token (the broker's credential status, metadata only).
- **The PM moves off T3**: `mosaic bus start <business> --pm` launches the
  business's `launch.by` instance without a window, and `mosaic talk`
  reaches it. The handover of Sage's T3 thread is the acceptance run below.

## Changes from the plan

1. **The capability goes to the runner as one stdin line**, not a 0600
   file. It is written after the bind and is never on disk, in argv or in
   the environment.
2. **Verbs live in `packages/cli`**, not `packages/seat` (lead decision
   77). `packages/seat` keeps the session module and the moved `/proc`
   helpers (`proc.mjs`).
3. **`--pm` takes no argument.** The PM is the business file's `launch.by`
   instance; its harness and model come from resolution.
4. **Runner exit 23** covers a `role.claim` with no answer as well as
   `brokerRetries` failed polls.
5. **The adapter runs as `/bin/sh <adapter.sh>`**, because the repository
   keeps adapters 0644 and only the image sets the mode.

## Broker surface

No socket verb, no event kind and no schema change. The new launch ops are
trusted IPC from the host to the broker process: `identity`,
`authorizeLaunch`, `refuse`, `endLaunch`, `credentialStatus`, beside the
existing `bindLaunch`. `bindLaunch` records the run only after its checks,
and a rebind of an ended run refuses with `run-ended`, also across a broker
restart. The host gains `op(message)` and `beforeClose(fn)`.

## Process control

- **Early signals.** The runner installs its SIGTERM and SIGINT handlers
  before anything else, because pid 1 of a PID namespace ignores a signal
  with no handler. Node's own startup still leaves a window, so the
  launcher and `mosaic stop` resend SIGTERM every second.
- **`isRunner(pid)`** is `cmdline[1] === RUNNER`, which skips `unshare`'s
  forked child before its exec (its argv still names the runner).
- **Host lost.** A starting host reads the last host's `sessions.json`.
  Before the launch socket opens, for each entry of this business it
  SIGKILLs the session if it still runs, rebinds the run with the recorded
  identity and ends it as `host-lost`, which releases the role. A rebind
  that refuses with `run-ended` logs "was already ended". An unreadable or
  malformed `sessions.json` refuses the host start with exit 3.
- **PID namespace limits** are in `packages/harness/README.md`, "Limits":
  same UID, shared broker socket and `/tmp`, network not confined, and a
  same-UID process can still ask something outside its tree (a systemd user
  manager, an existing tmux server) to run a command. The README no longer
  says the namespace blocks `ptrace` in general; it hides other sessions by
  pid.

## `--no-approve` (DEFERRED: "Host seats launch Pi with `--approve`")

`scripts/agent-host-dev.sh` and `adapters/pi/adapter.sh` now pass
`--no-approve`. Pi 0.85.1 (`trust-manager.js`) gates project `.pi/`
resources on trust: `settings.json`, extensions, skills, prompts, themes,
`SYSTEM.md`, `APPEND_SYSTEM.md`. `-e` paths load in the "temporary" scope,
which trust doesn't gate. A scratch probe against a workspace saved as
trusted, with a mock Messages API, showed:

| argv | project `SYSTEM.md` | explicit `--skill` | generated prompt | `-e` extension |
|---|---|---|---|---|
| host-seat, `--approve` | loaded | loaded | loaded | loaded |
| host-seat, `--no-approve` | ignored | loaded | loaded | loaded |
| `adapters/pi/adapter.sh` | ignored | loaded | loaded | loaded |

The skill appears only when the session has a tool to read it; the probe's
first run used `--no-tools` and showed no skill in any case, the
`--approve` control included.

`agent-host-dev.sh` keeps `--append-system-prompt`, not the entry's
"explicit system prompt", because its comment preserves Pi's built-in coding
prompt on purpose, and `--no-approve` already closes the project
`SYSTEM.md`. I didn't edit `docs/plans/DEFERRED.md`: it holds another
seat's uncommitted changes. The entry can close when this lands.
`scripts/test-goal-native.py` still passes `--approve` on purpose (it tests
project extensions) and is untouched.

## Gate

Run at `0a4c8f13` with this round's patch applied, in a detached worktree.
`sha256sum -c candidate-manifest.sha256` passed there (42 OK). Suites ran
sequentially, each output in `out/` (`out/summary.txt`). `TMPDIR` was on
the scratch disk and `DOCKER_HOST=unix:///nonexistent.sock`, so nothing
reached Docker. Round 1's outputs stay in this directory at `9b670e27`,
round 2's at `779e9780` and round 3's at `0f38236f`. Darkwing's R5 probe
outputs from round 4 are `out/probe-pi-cwd-dotdot.txt` and
`out/probe-claude-cwd-dotdot.txt`.

| Suite | Pass | Fail |
|---|---|---|
| node: bus, business, cli, control-board | 74, 60, 83, 124 | 0 |
| node: conversation, discord, harness, ledger | 161, 178, 56, 78 | 0 |
| node: mosaic, queue, seat, tasks, webui | 69, 148, 27, 51, 22 | 0 |
| test-auth, conductor, config, discord | 15, 17, 24, 66 | 0 |
| test-extension-package, foundation, queue, release | 18, 44, 27, 4 | 0 |
| test-task | 26 | 2 |

Against round 3, harness gains 3 tests (R5). Conversation (161) and webui
(22) grew because row 40 landed (08b428ec); none of their files is in this
candidate.

The two `test-task` failures are "user recall run succeeds (exit 1)" and
"recalled user name". That check runs a live worker and needs Docker. The
unpatched base at `0a4c8f13` fails the same two (`out/base-test-task.txt`,
identical PASS/FAIL lines), so they come from the environment, not this
candidate. No test process was left running after the gate.

## Acceptance run: waiting

The recorded run (the host started with `--pm`, `mosaic talk` asks the PM
to launch a coder, `mosaic agents` shows both claims) waits on the Vikunja
move to tasks.woltje.com (Q14), as Sage ruled: the integration commit and
the acceptance run wait for that cutover; build and review continue. It
will not run on Astra (R26) or against the live unit. The tracker host
comes only from `vars.tracker.baseUrl`; no code, test or launcher config
names one, and fixtures use 127.0.0.1 and example.test.

## Follow-ups (not in this row)

- `packages/queue/tests/commit.test.mjs`, `pausedCommit`, awaits the
  child's `exit` rather than `close`, so its stderr can be unread when
  `test-queue` F1 matches it.
- `scripts/test-task.sh` (:514-518): the live user-recall check needs
  Docker and isn't skipped when Docker is unavailable.
- Darkwing's round 2 note 4: after the Ma mutant's harness run, a
  `fake-adapter.mjs` was left running. Which test spawned it, and whether
  that test cleans up when it fails, isn't traced.
- `packages/conversation` (row 40): a `shim.mjs` from a gate's
  conversation suite outlived the run, and it ignored SIGTERM.
- Darkwing's round 3 survivors Mw, Mx, My and Mz in the gate's spelling
  check (lowercase `am`, two apostrophes, a path below a respelled
  self-loop, the normalised forms). Each needs a test; Sage kept them out
  of round 4.
- Realpath the workspace in the seat's `workspaceDir`
  (`packages/seat/src/session.mjs:46`), Darkwing's round 3 fix 2.