From 1afab9739ea07cc2ecf09b0ec6f18bba04c7579b Mon Sep 17 00:00:00 2001 From: jochen Date: Tue, 27 Oct 2026 20:27:41 +0100 Subject: [PATCH 1/4] Playbook 07: a node-agent change runs under the node's real permissions before review approves, and a pull request whose safety is its check is approved only on its passing verdict (issue 1126, 2026-10-27) --- 00-META/process/07-feature-branches.md | 26 ++++++++++++++++++++++++++ 00-META/process/playbooks.html | 4 ++-- 2 files changed, 28 insertions(+), 2 deletions(-) diff --git a/00-META/process/07-feature-branches.md b/00-META/process/07-feature-branches.md index e5433f93..df38d935 100644 --- a/00-META/process/07-feature-branches.md +++ b/00-META/process/07-feature-branches.md @@ -40,6 +40,12 @@ A small fix (one repository, one issue, about an hour of work) follows and a check per fix round on an open pull request spent it several times over: every push to an open pull request asks a new check, of every member for a group. A release runs one check ("every release should only run 1 check or 1 try", the operator, 2026-10-26; ADR 0548). +- **A switch of who composes, proven only by review.** On 2026-10-27 the placement seed of design 47 (issue 1126) was + merged on the operator's Approve while its check had no verdict yet, after two reviews that read the node agent's + code but never ran it under a node's real bus permissions. Every node's agent then asked for a consumer its grant + refuses and stopped composing; the grants part's list of the same minute dropped the subscriptions of the seats + held once for the mesh, the operator's channel among them, so the revert waited most of a day for an Approve that + could not be asked. - **A module proven only after it reached the machines.** The mail modules were delivered with unit tests only, then failed live three times (issues 859, 865, 868) and took five more hours of fixes. @@ -282,6 +288,16 @@ issue whether it is being fixed in between, after the delivery, or waits, and on report to the second round naming a kind and one place only, followed by a third round on the same kind, is this rule skipped. +10. **A change to what a node agent reads or who composes a node runs under the node's real permissions before the + review approves.** A unit test cannot show a bus grant, and a reviewer reading code does not see one. Such a change + carries an integration test that runs the node agent on a user with exactly the node principal's production + permissions (mesh-sdk `buscompose.PermissionsFor`, the node kind, with its production flags) against an embedded + bus, and that fails with the live refusal when the change's widest read is put back; the reviewer runs it. A + change that switches nodes to composing their own (a placement seed, a new self-composer path) is first answered + by every node in shadow on the live mesh (ADR 0559), each answer read, before its pull request is opened. How it + is checked: a review approving such a change with no run under the node's permissions named in its report is this + rule skipped (issue 1126, 2026-10-27). + ## Step 3 — Check (no review) 1. **Push the reviewed heads once, then open one pull request per repository, together** (ADR 0548; the operator, @@ -418,6 +434,16 @@ its health check on the canary each wait for the operator's answer to the assign (`operator-channel.asks`) before telling the operator it waits, and adds it to the wait list. No session writes a want to get past a hold. +**A pull request whose safety is its check merges only on its passing verdict.** The check gates no merge +(`check-gates-merge` false, the operator's choice), and the Approve ask says it merges at once, before the check +ends; for most pull requests that is right. For one whose check is the proof that it is safe (a placement change, +ADR 0559; a change to every node's composition), the lead says so in the pull request's title, in its description +and to the operator in the same turn it opens it, and the operator's Approve waits for the check; the lead opens it +only while the operator can read that. A merge before the verdict is reverted at once, the revert asked for the +operator's Approve with the same words. How it is checked: such a pull request merged with its check pending, with +no such line before its opening, is this rule skipped. mesh-delivery holding the Approve ask of a pull request marked +so until its check passes is the tool that would replace this rule (issue 1126 note 24). + **A new module's first assignment is its first real composition.** The composition check composes every machine as it is assigned, so a module that no machine runs yet is composed by no check: on 2026-10-21 the build modules' first assignment found two faults no merge check could see (issue 1537, a template the controller filled for a value the diff --git a/00-META/process/playbooks.html b/00-META/process/playbooks.html index 9f7da3d3..e6992829 100644 --- a/00-META/process/playbooks.html +++ b/00-META/process/playbooks.html @@ -461,10 +461,10 @@ const P = [ {n:"07",name:"Features",kind:"build",c:"--build", trig:"Work that changes code across issues or repositories, too large for a small fix.", who:"A lead (larger model), one fixing agent per repository (smaller), one reviewer (larger).", - steps:["Prepare: name the branch, make the worktrees, settle every question.","Write one context file per repository.","Write the findings and acceptance criteria into each issue.","Survey every other reader and writer of each changed value. (new)","Answer three questions in the milestone file: who deletes each new key and stream, how the switch-over is tried on one node first, what the one check does not cover. The review checks them. (new)","List every part the change reaches; copy fixtures from the real writer.","Develop: one agent per repository, one commit per issue.","A test fails first on behaviour, not on compiling. (new)","Bring each branch up to the trunk; nothing is pushed, no try runs. (new)","Review all of it, reading the integration tests against the code; at most 3 rounds.","A group pins the group's own mesh-sdk head in every member. (new)","Push the reviewed heads once and read each forge head against the reviewed commit; no draft pull request, no fix round on an open one. (new)","Open one pull request per repository, together, with Reviewed-by and Pushed-by; the one check runs. A failed check is read, fixed, reviewed, pushed once more. (new)","The operator's Approve on Telegram; the group merges in one pass.","Follow the delivery in the status view (moving, settled, stuck, delivered) to done; resolve the issues; clean up. (new)","When the builder cannot deliver its own fix: revert, a build by a session's call, a registration at the terminal, copies kept outside the store; a broken controller is put back by a want the operator writes, a hand build by mesh-hand-compose and a want. (new)"], + steps:["Prepare: name the branch, make the worktrees, settle every question.","Write one context file per repository.","Write the findings and acceptance criteria into each issue.","Survey every other reader and writer of each changed value. (new)","Answer three questions in the milestone file: who deletes each new key and stream, how the switch-over is tried on one node first, what the one check does not cover. The review checks them. (new)","List every part the change reaches; copy fixtures from the real writer.","Develop: one agent per repository, one commit per issue.","A test fails first on behaviour, not on compiling. (new)","Bring each branch up to the trunk; nothing is pushed, no try runs. (new)","Review all of it, reading the integration tests against the code; at most 3 rounds.","A change to what a node agent reads runs under the node's real permissions before the review approves; a switch of who composes is answered by every node in shadow first. (new)","A group pins the group's own mesh-sdk head in every member. (new)","Push the reviewed heads once and read each forge head against the reviewed commit; no draft pull request, no fix round on an open one. (new)","Open one pull request per repository, together, with Reviewed-by and Pushed-by; the one check runs. A failed check is read, fixed, reviewed, pushed once more. (new)","A pull request whose safety is its check is approved only on its passing verdict. (new)","The operator's Approve on Telegram; the group merges in one pass.","Follow the delivery in the status view (moving, settled, stuck, delivered) to done; resolve the issues; clean up. (new)","When the builder cannot deliver its own fix: revert, a build by a session's call, a registration at the terminal, copies kept outside the store; a broken controller is put back by a want the operator writes, a hand build by mesh-hand-compose and a want. (new)"], prod:"One pull request per repository, one source revision delivered, resolved issues, no branch or worktree left.", next:"02 (when it ships)",bounds:"Prepare 15 min · 30 min per issue · review 15 min, ≤ 3 rounds · one check, pushed once", - prev:["Pull requests as scratchpads","Context bought again and again","Review rounds spent on what a run would show"], + prev:["Pull requests as scratchpads","Context bought again and again","Review rounds spent on what a run would show","A switch of who composes, proven only by review"], check:"The checker's one status, mesh/check; the review record; the tracker's move."}, {n:"08",name:"Small fixes",kind:"build",c:"--build", trig:"One issue in one repository, about an hour of work.", From 0d1aa93e376bd235ae90aa2e999f9e3e47a20dbe Mon Sep 17 00:00:00 2001 From: jochen Date: Tue, 27 Oct 2026 20:28:16 +0100 Subject: [PATCH 2/4] Playbook 07: keep only the node-agent permission lesson; the operator keeps merging before the check by choice (2026-10-27) --- 00-META/process/07-feature-branches.md | 35 ++++++++------------------ 00-META/process/playbooks.html | 4 +-- 2 files changed, 12 insertions(+), 27 deletions(-) diff --git a/00-META/process/07-feature-branches.md b/00-META/process/07-feature-branches.md index df38d935..f59000a9 100644 --- a/00-META/process/07-feature-branches.md +++ b/00-META/process/07-feature-branches.md @@ -40,12 +40,9 @@ A small fix (one repository, one issue, about an hour of work) follows and a check per fix round on an open pull request spent it several times over: every push to an open pull request asks a new check, of every member for a group. A release runs one check ("every release should only run 1 check or 1 try", the operator, 2026-10-26; ADR 0548). -- **A switch of who composes, proven only by review.** On 2026-10-27 the placement seed of design 47 (issue 1126) was - merged on the operator's Approve while its check had no verdict yet, after two reviews that read the node agent's - code but never ran it under a node's real bus permissions. Every node's agent then asked for a consumer its grant - refuses and stopped composing; the grants part's list of the same minute dropped the subscriptions of the seats - held once for the mesh, the operator's channel among them, so the revert waited most of a day for an Approve that - could not be asked. +- **A node agent's bus reads, proven only by review.** On 2026-10-27 a change widened what every node agent watches + on the bus; two reviews read the code, no test ran it under a node's real permissions, and once it was live every + node's agent was refused that read and stopped composing (issue 1126). - **A module proven only after it reached the machines.** The mail modules were delivered with unit tests only, then failed live three times (issues 859, 865, 868) and took five more hours of fixes. @@ -288,15 +285,13 @@ issue whether it is being fixed in between, after the delivery, or waits, and on report to the second round naming a kind and one place only, followed by a third round on the same kind, is this rule skipped. -10. **A change to what a node agent reads or who composes a node runs under the node's real permissions before the - review approves.** A unit test cannot show a bus grant, and a reviewer reading code does not see one. Such a change - carries an integration test that runs the node agent on a user with exactly the node principal's production - permissions (mesh-sdk `buscompose.PermissionsFor`, the node kind, with its production flags) against an embedded - bus, and that fails with the live refusal when the change's widest read is put back; the reviewer runs it. A - change that switches nodes to composing their own (a placement seed, a new self-composer path) is first answered - by every node in shadow on the live mesh (ADR 0559), each answer read, before its pull request is opened. How it - is checked: a review approving such a change with no run under the node's permissions named in its report is this - rule skipped (issue 1126, 2026-10-27). +10. **A change to what a node agent reads on the bus runs under the node's real permissions before the review + approves.** A unit test cannot show a bus grant, and a reviewer reading code does not see one. Such a change carries + an integration test that runs the node agent on a user with exactly the node principal's production permissions + (mesh-sdk `buscompose.PermissionsFor`, the node kind, with its production flags) against an embedded bus, and that + fails with the live refusal when the change's widest read is put back; the reviewer runs it. How it is checked: a + review approving such a change with no run under the node's permissions named in its report is this rule skipped + (issue 1126, 2026-10-27). ## Step 3 — Check (no review) @@ -434,16 +429,6 @@ its health check on the canary each wait for the operator's answer to the assign (`operator-channel.asks`) before telling the operator it waits, and adds it to the wait list. No session writes a want to get past a hold. -**A pull request whose safety is its check merges only on its passing verdict.** The check gates no merge -(`check-gates-merge` false, the operator's choice), and the Approve ask says it merges at once, before the check -ends; for most pull requests that is right. For one whose check is the proof that it is safe (a placement change, -ADR 0559; a change to every node's composition), the lead says so in the pull request's title, in its description -and to the operator in the same turn it opens it, and the operator's Approve waits for the check; the lead opens it -only while the operator can read that. A merge before the verdict is reverted at once, the revert asked for the -operator's Approve with the same words. How it is checked: such a pull request merged with its check pending, with -no such line before its opening, is this rule skipped. mesh-delivery holding the Approve ask of a pull request marked -so until its check passes is the tool that would replace this rule (issue 1126 note 24). - **A new module's first assignment is its first real composition.** The composition check composes every machine as it is assigned, so a module that no machine runs yet is composed by no check: on 2026-10-21 the build modules' first assignment found two faults no merge check could see (issue 1537, a template the controller filled for a value the diff --git a/00-META/process/playbooks.html b/00-META/process/playbooks.html index e6992829..384d103f 100644 --- a/00-META/process/playbooks.html +++ b/00-META/process/playbooks.html @@ -461,10 +461,10 @@ const P = [ {n:"07",name:"Features",kind:"build",c:"--build", trig:"Work that changes code across issues or repositories, too large for a small fix.", who:"A lead (larger model), one fixing agent per repository (smaller), one reviewer (larger).", - steps:["Prepare: name the branch, make the worktrees, settle every question.","Write one context file per repository.","Write the findings and acceptance criteria into each issue.","Survey every other reader and writer of each changed value. (new)","Answer three questions in the milestone file: who deletes each new key and stream, how the switch-over is tried on one node first, what the one check does not cover. The review checks them. (new)","List every part the change reaches; copy fixtures from the real writer.","Develop: one agent per repository, one commit per issue.","A test fails first on behaviour, not on compiling. (new)","Bring each branch up to the trunk; nothing is pushed, no try runs. (new)","Review all of it, reading the integration tests against the code; at most 3 rounds.","A change to what a node agent reads runs under the node's real permissions before the review approves; a switch of who composes is answered by every node in shadow first. (new)","A group pins the group's own mesh-sdk head in every member. (new)","Push the reviewed heads once and read each forge head against the reviewed commit; no draft pull request, no fix round on an open one. (new)","Open one pull request per repository, together, with Reviewed-by and Pushed-by; the one check runs. A failed check is read, fixed, reviewed, pushed once more. (new)","A pull request whose safety is its check is approved only on its passing verdict. (new)","The operator's Approve on Telegram; the group merges in one pass.","Follow the delivery in the status view (moving, settled, stuck, delivered) to done; resolve the issues; clean up. (new)","When the builder cannot deliver its own fix: revert, a build by a session's call, a registration at the terminal, copies kept outside the store; a broken controller is put back by a want the operator writes, a hand build by mesh-hand-compose and a want. (new)"], + steps:["Prepare: name the branch, make the worktrees, settle every question.","Write one context file per repository.","Write the findings and acceptance criteria into each issue.","Survey every other reader and writer of each changed value. (new)","Answer three questions in the milestone file: who deletes each new key and stream, how the switch-over is tried on one node first, what the one check does not cover. The review checks them. (new)","List every part the change reaches; copy fixtures from the real writer.","Develop: one agent per repository, one commit per issue.","A test fails first on behaviour, not on compiling. (new)","Bring each branch up to the trunk; nothing is pushed, no try runs. (new)","Review all of it, reading the integration tests against the code; at most 3 rounds.","A change to what a node agent reads on the bus runs under the node's real permissions before the review approves. (new)","A group pins the group's own mesh-sdk head in every member. (new)","Push the reviewed heads once and read each forge head against the reviewed commit; no draft pull request, no fix round on an open one. (new)","Open one pull request per repository, together, with Reviewed-by and Pushed-by; the one check runs. A failed check is read, fixed, reviewed, pushed once more. (new)","The operator's Approve on Telegram; the group merges in one pass.","Follow the delivery in the status view (moving, settled, stuck, delivered) to done; resolve the issues; clean up. (new)","When the builder cannot deliver its own fix: revert, a build by a session's call, a registration at the terminal, copies kept outside the store; a broken controller is put back by a want the operator writes, a hand build by mesh-hand-compose and a want. (new)"], prod:"One pull request per repository, one source revision delivered, resolved issues, no branch or worktree left.", next:"02 (when it ships)",bounds:"Prepare 15 min · 30 min per issue · review 15 min, ≤ 3 rounds · one check, pushed once", - prev:["Pull requests as scratchpads","Context bought again and again","Review rounds spent on what a run would show","A switch of who composes, proven only by review"], + prev:["Pull requests as scratchpads","Context bought again and again","Review rounds spent on what a run would show","A node agent's bus reads, proven only by review"], check:"The checker's one status, mesh/check; the review record; the tracker's move."}, {n:"08",name:"Small fixes",kind:"build",c:"--build", trig:"One issue in one repository, about an hour of work.", From 7ff4c7ce6888ca96fe0eb1f50951506fbfb279ae Mon Sep 17 00:00:00 2001 From: jochen Date: Tue, 27 Oct 2026 20:29:11 +0100 Subject: [PATCH 3/4] Playbook 07: the developer runs the node-permission test locally as a named exception to step 1 --- 00-META/process/07-feature-branches.md | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/00-META/process/07-feature-branches.md b/00-META/process/07-feature-branches.md index f59000a9..28531edc 100644 --- a/00-META/process/07-feature-branches.md +++ b/00-META/process/07-feature-branches.md @@ -287,11 +287,12 @@ issue whether it is being fixed in between, after the delivery, or waits, and on 10. **A change to what a node agent reads on the bus runs under the node's real permissions before the review approves.** A unit test cannot show a bus grant, and a reviewer reading code does not see one. Such a change carries - an integration test that runs the node agent on a user with exactly the node principal's production permissions - (mesh-sdk `buscompose.PermissionsFor`, the node kind, with its production flags) against an embedded bus, and that - fails with the live refusal when the change's widest read is put back; the reviewer runs it. How it is checked: a - review approving such a change with no run under the node's permissions named in its report is this rule skipped - (issue 1126, 2026-10-27). + an integration test that runs the node agent on a bus user with exactly a node's production permissions (mesh-sdk + `buscompose.PermissionsFor` for a node, with its production flags) against an embedded bus, and that fails with the + live refusal when the change's widest read is put back. The developer runs that one test locally before the review, + an exception to step 1's rule that integration tests only compile, and the pull request says so. How it is + checked: a review approving such a change whose report names no such run is this rule skipped (issue 1126, + 2026-10-27). ## Step 3 — Check (no review) From 6ef40bbcc7d8147930520ef323415ad0250e806a Mon Sep 17 00:00:00 2001 From: jochen Date: Tue, 27 Oct 2026 20:36:54 +0100 Subject: [PATCH 4/4] How-we-build: a bus permission is proven under the real permission (ADR 0560); playbook 07 keeps only the failure note, as the operator asked --- 00-META/how-we-build.md | 16 ++++++++++++++++ 00-META/process/07-feature-branches.md | 12 ++---------- 00-META/process/playbooks.html | 2 +- 3 files changed, 19 insertions(+), 11 deletions(-) diff --git a/00-META/how-we-build.md b/00-META/how-we-build.md index 80d0b6f9..657c4fd5 100644 --- a/00-META/how-we-build.md +++ b/00-META/how-we-build.md @@ -173,6 +173,22 @@ quietly stop being true, and nobody will learn that from a document. Not test-driven development as a blanket rule — a test written first against undiscovered behaviour asserts a guess. The obligation is that every decision has a defender. +### A bus permission is proven under the real permission + +A change that adds or widens what a mesh process reads or writes on the bus (a subscription, a publish, a stream or +key-value read, a consumer) carries an integration test that runs it on a bus user with exactly the production +permissions of that account (mesh-sdk's composition of them), against a real bus server, and that fails with the +bus's permissions violation when the widest new access is not granted. It runs in the forge's check like every +integration test. A reviewer reading code does not see a grant, and a fake bus grants everything (ADR 0560). + +How it is checked: a review that approves such a change whose pull request names no such test is the rule skipped. + +### A bus permission under the real permission — how it was earned + +On 2026-10-27 a change widened what every node agent watches; two reviews read its code and its tests ran against a +fake bus. Live, every node's agent was refused that read by its grant and stopped composing, and the same day the +grants part's user list dropped nine seats' subscriptions (issues 1126 and 1945). + ### Tests run at the lowest level that proves them, within a time budget Three levels, by how much real system a test uses (ADR 0391): diff --git a/00-META/process/07-feature-branches.md b/00-META/process/07-feature-branches.md index 28531edc..915c53a4 100644 --- a/00-META/process/07-feature-branches.md +++ b/00-META/process/07-feature-branches.md @@ -42,7 +42,8 @@ A small fix (one repository, one issue, about an hour of work) follows run 1 check or 1 try", the operator, 2026-10-26; ADR 0548). - **A node agent's bus reads, proven only by review.** On 2026-10-27 a change widened what every node agent watches on the bus; two reviews read the code, no test ran it under a node's real permissions, and once it was live every - node's agent was refused that read and stopped composing (issue 1126). + node's agent was refused that read and stopped composing (issue 1126). How-we-build's rule "A bus permission is + proven under the real permission" (ADR 0560) is what the review now asks for. - **A module proven only after it reached the machines.** The mail modules were delivered with unit tests only, then failed live three times (issues 859, 865, 868) and took five more hours of fixes. @@ -285,15 +286,6 @@ issue whether it is being fixed in between, after the delivery, or waits, and on report to the second round naming a kind and one place only, followed by a third round on the same kind, is this rule skipped. -10. **A change to what a node agent reads on the bus runs under the node's real permissions before the review - approves.** A unit test cannot show a bus grant, and a reviewer reading code does not see one. Such a change carries - an integration test that runs the node agent on a bus user with exactly a node's production permissions (mesh-sdk - `buscompose.PermissionsFor` for a node, with its production flags) against an embedded bus, and that fails with the - live refusal when the change's widest read is put back. The developer runs that one test locally before the review, - an exception to step 1's rule that integration tests only compile, and the pull request says so. How it is - checked: a review approving such a change whose report names no such run is this rule skipped (issue 1126, - 2026-10-27). - ## Step 3 — Check (no review) 1. **Push the reviewed heads once, then open one pull request per repository, together** (ADR 0548; the operator, diff --git a/00-META/process/playbooks.html b/00-META/process/playbooks.html index 384d103f..a0fd38bd 100644 --- a/00-META/process/playbooks.html +++ b/00-META/process/playbooks.html @@ -461,7 +461,7 @@ const P = [ {n:"07",name:"Features",kind:"build",c:"--build", trig:"Work that changes code across issues or repositories, too large for a small fix.", who:"A lead (larger model), one fixing agent per repository (smaller), one reviewer (larger).", - steps:["Prepare: name the branch, make the worktrees, settle every question.","Write one context file per repository.","Write the findings and acceptance criteria into each issue.","Survey every other reader and writer of each changed value. (new)","Answer three questions in the milestone file: who deletes each new key and stream, how the switch-over is tried on one node first, what the one check does not cover. The review checks them. (new)","List every part the change reaches; copy fixtures from the real writer.","Develop: one agent per repository, one commit per issue.","A test fails first on behaviour, not on compiling. (new)","Bring each branch up to the trunk; nothing is pushed, no try runs. (new)","Review all of it, reading the integration tests against the code; at most 3 rounds.","A change to what a node agent reads on the bus runs under the node's real permissions before the review approves. (new)","A group pins the group's own mesh-sdk head in every member. (new)","Push the reviewed heads once and read each forge head against the reviewed commit; no draft pull request, no fix round on an open one. (new)","Open one pull request per repository, together, with Reviewed-by and Pushed-by; the one check runs. A failed check is read, fixed, reviewed, pushed once more. (new)","The operator's Approve on Telegram; the group merges in one pass.","Follow the delivery in the status view (moving, settled, stuck, delivered) to done; resolve the issues; clean up. (new)","When the builder cannot deliver its own fix: revert, a build by a session's call, a registration at the terminal, copies kept outside the store; a broken controller is put back by a want the operator writes, a hand build by mesh-hand-compose and a want. (new)"], + steps:["Prepare: name the branch, make the worktrees, settle every question.","Write one context file per repository.","Write the findings and acceptance criteria into each issue.","Survey every other reader and writer of each changed value. (new)","Answer three questions in the milestone file: who deletes each new key and stream, how the switch-over is tried on one node first, what the one check does not cover. The review checks them. (new)","List every part the change reaches; copy fixtures from the real writer.","Develop: one agent per repository, one commit per issue.","A test fails first on behaviour, not on compiling. (new)","Bring each branch up to the trunk; nothing is pushed, no try runs. (new)","Review all of it, reading the integration tests against the code; at most 3 rounds.","A group pins the group's own mesh-sdk head in every member. (new)","Push the reviewed heads once and read each forge head against the reviewed commit; no draft pull request, no fix round on an open one. (new)","Open one pull request per repository, together, with Reviewed-by and Pushed-by; the one check runs. A failed check is read, fixed, reviewed, pushed once more. (new)","The operator's Approve on Telegram; the group merges in one pass.","Follow the delivery in the status view (moving, settled, stuck, delivered) to done; resolve the issues; clean up. (new)","When the builder cannot deliver its own fix: revert, a build by a session's call, a registration at the terminal, copies kept outside the store; a broken controller is put back by a want the operator writes, a hand build by mesh-hand-compose and a want. (new)"], prod:"One pull request per repository, one source revision delivered, resolved issues, no branch or worktree left.", next:"02 (when it ships)",bounds:"Prepare 15 min · 30 min per issue · review 15 min, ≤ 3 rounds · one check, pushed once", prev:["Pull requests as scratchpads","Context bought again and again","Review rounds spent on what a run would show","A node agent's bus reads, proven only by review"],