stack/agents/darkwing/work/queue-60-review/review-r2.md

Row 60, bus read: credential status on the broker, round 2 review (Darkwing)

Issue #1549, request comment 27553, packet agents/filbert/work/queue-60/ (commit 5fc7635c). Base bbd22f1b. Candidate manifest sha256 13541657c830ed59281f101fc3566924454fd96d1be01df844100544b10cbf93, 9 files, matching the request. Scope: Sage's rev 569.

Verdict: approve. The rebase changes no code. The decisions row is right, and Dewey's N1 sentence is right where my round 1 answer to question 1 was wrong; the correction is below. Nothing blocks.

Method

• A detached worktree at bbd22f1b with git apply --index build.patch, then sha256sum -c on the manifest: 9 OK. None of the 9 paths changed from bbd22f1b to HEAD at the time of review.
• I compared the added and removed lines of round 1's build.patch (5fc7635c^) with round 2's. They match except for the two packages/bus/README.md edits: the new decisions table row and the rewritten last sentences of the credentials paragraph.
• I read the merged files where the patch meets rows 58 and 74.
• The credential and WebUI bus test files, then my 16 round 1 mutants on the new tree (r2/mutants.sh, one test file each), with views-no-verb pointed at the WebUI bus tests this time.

Node v26.8.1, TMPDIR=~/darkwing-scratch/rv60r2/tmp.

Tests and mutants

On the candidate, 00:35:31Z to 00:35:46Z on 2026-10-12: packages/bus/tests/credential-status.test.mjs 4 pass, 0 fail; packages/webui/tests/bus.test.mjs 9 pass, 0 fail (r2/tests-light.txt). I didn't run the full bus and WebUI suites. Another seat's mutant run held the machine, the code is round 1's, and Sage's gate rerun is running the full set now.

The same 16 mutants as round 1 (r2/mutants.txt): 14 fail, each on the test meant for it, and the same two survive for round 1's reasons (account-undefined is equivalent under the business loader, no-result-check removes a base line). views-no-verb fails 2 WebUI bus tests on the first run now that the script points at them.

The merged hunks

• serve.mjs: the patch changes only the BUS_VERBS line and its comment. Row 74's checks run in the request handler at lines 107 to 135, and the bus route lookup is at line 160, after them. So in preview mode /api/bus/credentials gets the same Host, Origin, sign-in and read-only checks as every other bus read. A GET from the operator's loopback path reaches it as before.
• broker.mjs: the credentials case sits before default:. Row 58's change is in the tasks branch, and the reader allowlist and the constructor are lines row 58 doesn't touch.
• webui/tests/bus.test.mjs and webui/README.md: the round 1 additions sit after row 58's and row 74's, sharing no lines.

The two README edits

The decisions row. It matches the broker. keys(a, ['list'], ['list']) requires list. roles returns open decisions not routed to human, and recent returns the last RECENT closed ones, which is 50. The row says human and reader sessions only, which is what the broker checks.

Dewey's N1. The new sentences are correct. Credentials.status() maps over the tokens the host loaded at startup, and the date comes from that load; only state is computed at the request. The broker takes account from its businesses, also loaded at startup. So the read and the Business view differ only when the business file changes after startup.

Correction to my round 1 review

In round 1 I answered question 1 by saying this read shows "a token file rotated after startup, which the host doesn't reread until restart". That was wrong. A token rotation without a date edit changes neither view, which is what the README now says. The case a side-by-side view would catch is a business file edited after startup: a new date, account or credential that the host won't load until it restarts. My answer itself stands, to leave the Business view alone in this row, and a later row could still compare the two. The reason is that case, not rotation.

I also take back round 1's note 2. test-release prints 4 without Docker and 14 with it. My round 1 gate had Docker for test-release, and Filbert's didn't. build.md now says so.

Dewey's N2

Decision 98 rules it: the read ships as built behind the one-user preview. I have nothing to add.