Playbook 07: the developer runs the node-permission test locally as a named exception to step 1

2026-10-27 20:29:11 +01:00
parent 0d1aa93e37
commit 7ff4c7ce68
1 changed files with 6 additions and 5 deletions
@@ -287,11 +287,12 @@ issue whether it is being fixed in between, after the delivery, or waits, and on

 10. **A change to what a node agent reads on the bus runs under the node's real permissions before the review
   approves.** A unit test cannot show a bus grant, and a reviewer reading code does not see one. Such a change carries
-   an integration test that runs the node agent on a user with exactly the node principal's production permissions
-   (mesh-sdk `buscompose.PermissionsFor`, the node kind, with its production flags) against an embedded bus, and that
-   fails with the live refusal when the change's widest read is put back; the reviewer runs it. How it is checked: a
-   review approving such a change with no run under the node's permissions named in its report is this rule skipped
-   (issue 1126, 2026-10-27).
+   an integration test that runs the node agent on a bus user with exactly a node's production permissions (mesh-sdk
+   `buscompose.PermissionsFor` for a node, with its production flags) against an embedded bus, and that fails with the
+   live refusal when the change's widest read is put back. The developer runs that one test locally before the review,
+   an exception to step 1's rule that integration tests only compile, and the pull request says so. How it is
+   checked: a review approving such a change whose report names no such run is this rule skipped (issue 1126,
+   2026-10-27).

 ## Step 3 — Check (no review)