stack/agents/rocko/work/queue-79/BUILD.md

# Row 79 (#1573): coder grant stale text, candidate packet, round 1

Author: Rocko. Reviewer: Dewey. Brief:
`docs/plans/2026-10-11_claude-pin-and-coder-grant.md`, section "Coder
grant stale text" (blob 4784ee65, re-pinned by Sage at revs 567-568). It
also carries Dewey's row 73 note N1 (comment 27506 on #1567). Base:
`331d037c` (`base.txt`). `331d037c..bd4dff33` (2ece4491, bd4dff33,
5fc7635c) touches none of this row's paths. I checked that before
packing. The packet is uncommitted. I made no commits, pushes or Gitea
calls and read no token or private binding.

## Files (`files.txt`, `candidate-manifest.sha256`)

| File | Change |
|---|---|
| `packages/business/README.md` | version 2 example: `crossRole` is `["task.scope.change"]`, so the example matches `roles/coder.json` |
| `packages/tasks/README.md` | the `task.reassign` paragraph: the coder holds no grant (row 73), and the writer check refuses a non-pm `task.reassign` before authority anyway |
| `packages/tasks/live/run.mjs` | the coder authority line matches `packages/tasks/tests/world.mjs` |
| `packages/harness/tests/tools.test.mjs` | coder-without-a-tracker test: one `deepEqual` on the whole untyped list replaces two `includes` asserts (N1) |
| `agents/rocko/work/queue-79/mutants.sh` | the mutant rerun: `mutants.sh <tree>` |

Totals: 4 tracked files, +7 -9, and the new `mutants.sh`. I changed no
role file, `broker.mjs`, field table or any other test.

### run.mjs, the coder line

The old line was `withinRole: ['task.update.assigned', 'message.send'],
crossRole: ['task.reassign', 'task.scope.change']`. It was stale in two
ways: the reassign grant, and the missing `git.push.working` and
`review.request`. The new line is word for word the coder entry in
`world.mjs` and has the same authority as `roles/coder.json`.

Two other lines in the same `AUTHORITY` object differ from `world.mjs`,
and I left them alone because the brief owns only the coder line:

- pm: `run.mjs` has no `role.launch`. `world.mjs` and `roles/pm.json`
  have it.
- reviewer: `run.mjs` has no `review.verdict`. `world.mjs` and
  `roles/reviewer.json` have it.

The live run uses neither action, so this doesn't change its result. If
Sage wants the whole object to match, that's a follow-up row.

## N1: the untyped list (`out/mutants-candidate.txt`, `out/mutants-base.txt`)

`untypedActions` (`packages/harness/src/tools.mjs:122-125`) returns
`[...withinRole, ...crossRole]` minus the actions that have a typed tool.
For the shipped coder without a tracker, that is `task.update.assigned`,
`git.push.working`, `review.request` and `task.scope.change`.
`message.send` is typed (`send_message`). The test now pins that list,
including its order, with one `deepEqual`.

| Mutant | Edit in `packages/harness/src/tools.mjs` | Base `331d037c` | Candidate |
|---|---|---|---|
| `untyped-within-only` | `return [...withinRole].filter(…)` (Dewey's mutant) | **survived** | killed |
| `untyped-cross-first` | `return [...crossRole, ...withinRole].filter(…)` | **survived** | killed |
| `untyped-keeps-typed` | `.filter((a) => a === "message.send" \|\| !typed.has(a))` | killed | killed |

Every kill is in "a coder gets no launch, no resolve_decision, and no
task tools without a tracker". On the base, the old `!includes("message.send")`
assert already kills `untyped-keeps-typed`. I kept that mutant to show
the `deepEqual` doesn't lose that check.

The script saves the file, applies the sed and checks it changed
something. It then runs `packages/harness/tests/tools.test.mjs` and
restores the file from the saved copy. The base run used a clean
detached worktree at `331d037c`, which I removed afterwards.
`out/mutants-*/` holds each diff and log. The script exits 1 on the base,
as it should when a mutant survives.

A correction to my own first run: I wrote `untyped-keeps-typed` with
`a !== "message.send"`. That inverts it into a mutant that keeps every
typed action except `message.send`, and the coder has no other typed
action in `withinRole` or `crossRole`, so it survived. That run says
nothing about the test. I fixed the expression to `===` and reran. The
outputs in `out/` are from the fixed script only.

## Repository grep for `task.reassign`

`git grep -n 'task\.reassign'` on the candidate tree, outside `agents/`:

| Path | Hits | Why it stays |
|---|---|---|
| `roles/pm.json:9` | 1 | the pm grant (decision 90: assignee is pm-only) |
| `packages/business/src/vocabulary.mjs:17` | 1 | the action vocabulary |
| `packages/bus/src/broker.mjs:10` | 1 | the broker's action list. The brief puts `broker.mjs` out of scope |
| `packages/harness/src/tools.mjs:46` | 1 | the `task_reassign` typed tool. A pm with a tracker gets it |
| `packages/tasks/src/verbs.mjs:13,191,200,201` | 4 | `PM_VERBS` and the verb itself |
| `packages/tasks/README.md:107,150,176,193-194` | 5 | the writer-check list, the verb table, the `task-unassigned` refusal, and this row's rewritten paragraph |
| `packages/tasks/live/README.md:65` | 1 | the pm's live reassign step |
| `packages/tasks/live/run.mjs:29,154` | 2 | the pm grant and the pm's reassign step. The coder line no longer has it |
| `packages/tasks/tests/world.mjs:34` | 1 | the pm grant in the test world |
| `packages/tasks/tests/verbs.test.mjs:96-110` | 6 | a coder's `task.reassign` refused with `field-writer`, no coder holds it, and the pm's reassign paths |
| `packages/tasks/tests/shapes.test.mjs:127` | 1 | a pm reassign |
| `packages/bus/tests/broker.test.mjs:361,373,381` | 3 | the shipped coder raises `task.reassign` as gated to the human. That holds because the coder has no grant for it |
| `packages/business/tests/resolve.test.mjs:141` | 1 | `classify(coder, "task.reassign")` is `gated`, the same fact |
| `packages/business/tests/role.test.mjs:64,117` | 2 | 64 is row 73's comment on the coder file. 117 is a synthetic role that holds the action in both lists, to test that refusal |
| `scripts/test-task.sh:279` | 1 | `v2ok`, a synthetic version 2 role with the action in `crossRole`, used only to check that `resolve-role` accepts a minimal role. It isn't the coder |
| `docs/design/mosaic-stack-design.html:729,732,975` | 3 | the action list, the pm grant and the verb list. There's no coder grant here |
| `docs/plans/2026-10-04_slice-1.md:73` | 1 | the field table: assignee is pm, via `task.assign` and `task.reassign` |
| `docs/plans/2026-09-26_lead-decisions.md:1914` | 1 | decision 90's record of the old coder grant, which is history |
| `docs/plans/2026-10-11_claude-pin-and-coder-grant.md` | 14 | the briefs for rows 73 and 79 |
| `docs/plans/queue.json`, `docs/plans/QUEUE.md` | 5, 1 | row titles and notes |
| `BUILD-LOG.md`, `docs/SESSIONS.md` | 7, 2 | append-only history |

`v1/` has no hits. No hit outside history and briefs shows the coder
holding `task.reassign`.

## Dewey's correction to the row 73 packet

Dewey's approval of row 73 (comment 27506) corrects a line in that
packet. The header of `agents/rocko/work/queue-73/mutants.sh` says "the
tasks test kills nothing". That's true only for my five mutants. Dewey's
`verbs-reassign-not-pm` mutant is killed only by the verbs line row 73
added. The committed row 73 file stays as it is, on Sage's instruction,
and this note is the record.

## Gate (`out/gate/`, sequential, scratch worktree at 331d037c with the candidate, `node_modules` linked)

Run 00:11:53Z-00:17:41Z (2026-10-12). The brief's gate names the tasks,
business and harness suites and every script. I also ran bus, cli,
webui and seat, the package set row 73's gate used.

| Suite | Result |
|---|---|
| tasks | 71 pass, 0 fail, 0 skipped |
| bus | 84 pass, 0 fail, 0 skipped |
| business | 60 pass, 0 fail, 0 skipped |
| harness | 59 pass, 0 fail, 0 skipped |
| cli | 113 pass, 0 fail, 0 skipped (the base predates row 78's added test) |
| webui | 61 pass, 0 fail, 0 skipped |
| seat | 27 pass, 0 fail, 0 skipped |
| test-auth | 15 passed, 0 failed |
| test-conductor | 17 passed, 0 failed |
| test-config | 24 passed, 0 failed |
| test-discord | 66 passed, 0 failed |
| test-extension-package | 18 passed, 0 failed |
| test-foundation | 44 passed, 0 failed |
| test-queue | 27 passed, 0 failed |
| test-release | 14 passed, 0 failed |
| test-task | 98 passed, 0 failed (Docker) |

The harness count is unchanged, because the row edits one existing test.
After the gate I removed the `rocko-r79_default` network.