Root and registry

  - attempt 1 builder, session 2ca6580e-c732-4aaa-8dd3-01a1b22c9f60: pass (said done)
  - attempt 1 verifier, session 66235903-9d06-4d6e-806e-01a1b22e81fa: pass (Evidence written by the verifier)
- runs-need-root (step review/review): open
  - attempt 2 fixer in cycle 2, session e636ca75-d1d7-444c-9116-01a1b26f72f9: pass (said done)
  - attempt 2 verifier in cycle 2, session a6df410e-3760-4a50-a1e3-01a1b2774c8a: pass (Evidence written by the verifier)
- testscripts-run-under-root (step review/review): open
  - attempt 2 fixer in cycle 2, session b12ce90e-5c01-41ed-8f0c-01a1b2777529: pass (said done)
  - attempt 2 verifier in cycle 2, session 99bb450f-9e2f-4061-b20e-01a1b2784328: pass (Evidence written by the verifier)

## Checks

- compliance (step review/review): passed after 2 cycles
  - cycle 1: failed, check session e87f50c1-329b-456c-b213-01a1b2463f71 pass (said done), critic session 1b3eef32-b6e4-435a-8d84-01a1b26c9ed1 pass (said done)
  - cycle 2: passed, check session 1747f0b6-37d8-4fe9-9b1e-01a1b27d0e01 pass (said done)
  - round 1 (cycle 1): 3 findings, 1 confirmed
    - f1 blocker at internal/api/run.go:534 on runs-need-root: requireProject in runRunStart and runRequest (internal/api/request.go:103) breaks 21 existing internal/api unit tests that start runs or queue requests in a temp repo under no root, e.g. TestRunStartQueuesForTheDaemon, TestRunStartChecksArbiter, TestDaemonPlanRequestsRequeuesUnjournaled, TestRunAmend* (run_amend_test.go:136..298), request_test.go:27, TestRunJournalsProcess: each fails with '<tmp>/repo is not inside a Rhiza root'. `go test -trimpath -short ./internal/api` fails, so CI's make check fails. The scripts pass under the Setup root, but the Go test helpers that make a repo need the same root (a rhiza.toml registering the temp repo). — confirmed: Reproduced: requireProject at internal/api/run.go:534 and request.go:103 makes `go test -trimpath -short ./internal/api -run 'TestRunStartQueuesForTheDaemon|TestRunStartChecksArbiter'` fail with '<tmp>/repo is not inside a Rhiza root'; the unit-test fixtures register no root, so CI's make check fails.
    - f2 minor at cmd/rhiza/testdata/script/runs-need-root.txtar:9 on runs-need-root: Acceptance says exit 2; the script uses `! exec`, which accepts any non-zero exit, and never asserts the code is 2 (Usagef gives 2 in code, so the behaviour holds).
    - f3 minor at cmd/rhiza/testdata/script/project-add-path.txtar:33 on project-add-path: Acceptance asks for exit 2 for outside, nested, non-git and duplicate; only the duplicate case asserts exit=2, and the nested refusal asserts no next: line. Code returns Usagef with a next for all four, so behaviour holds.
  - round 2 (cycle 2): 3 findings, 0 confirmed
    - f1 minor at cmd/rhiza/testdata/script/runs-need-root.txtar:9 on runs-need-root: Acceptance says exit 2; the script uses `! exec` (any non-zero) and never asserts code 2. requireProject returns Usagef, so the behaviour holds.
    - f2 minor at cmd/rhiza/testdata/script/project-add-path.txtar:33 on project-add-path: Acceptance asks for exit 2 for outside, nested, non-git and duplicate; only the duplicate asserts exit=2, and the nested refusal asserts no next: line. The code gives Usagef with a next for all four.
    - f3 minor at cmd/rhiza/testdata/script/testscript-root.txtar:11 on testscripts-run-under-root: Acceptance says root show in $NOROOT gets exit 2; the script uses `! exec` and does not assert 2 (root-init.txtar does assert exit=2 outside a root, so the behaviour is covered elsewhere).
- quality (step review/review): passed after 2 cycles
  - cycle 1: failed, check session c65b89e9-31cd-48af-bc6a-01a1b2467941 pass (said done), critic session aa72e653-9a7c-482e-a4cc-01a1b26cf21e pass (said done)
  - cycle 2: passed, check session 88379dda-8586-4a1b-9f08-01a1b27d35c9 pass (said done)
  - round 1 (cycle 1): 4 findings, 1 confirmed
    - f1 blocker at internal/api/root.go:115 on runs-need-root: requireProject now gates run.start and request, but no internal/api unit-test fixture sets up a rhiza.toml root, so the package's tests fail with '<tmp>/repo is not inside a Rhiza root': at least TestRunStartChecksArbiter, TestRunStartWorkflowRefusals, TestRunStartAgentRefusalsBeforeWrite, TestRunStartCommandSteps, TestRunStartFailedExitsNonZero, TestRunStartDryRunWritesNothing, TestRunStartQueuesForTheDaemon, TestDaemonPlanRequestsRequeuesUnjournaled, the seven TestRunAmend* tests and TestRunJournalsProcess (go test -trimpath -count=1 ./internal/api/ -run 'TestRunStart|TestDaemonPlanRequests|Amend|Process'). CI's make check will fail. The session fixture (internal/api/session_test.go newSessionFixture) needs a root registering its repo, as the testscript Setup does. — confirmed: Reproduced at HEAD 42ecaec2: go test -trimpath -count=1 ./internal/api/ -run 'TestRunStart|TestDaemonPlanRequests|Amend|Process' fails (TestRunStartWorkflowRefusals, TestRunStartAgentRefusalsBeforeWrite, TestRunStartCommandSteps, TestRunStartQueuesForTheDaemon, TestRunAmend*, TestRunJournalsProcess, ...) with '<tmp>/repo is not inside a Rhiza root' from requireProject (internal/api/root.go:115); no internal/api test fixture writes a rhiza.toml root, so CI's make check fails.
    - f2 minor at internal/rootcfg/rootcfg.go:135 on root-show: ProjectOf checks projects in name order and accepts a <project>.<slug> sibling before checking every project's own folder, so with projects app and app.web registered, a directory inside app.web resolves to app (a 'worktree' with slug web). An exact folder match should win over a sibling-worktree match.
    - f3 minor at internal/rootcfg/rootcfg.go:160 on project-add-path: Add and Remove load, modify and rewrite rhiza.toml with no lock and a fixed rhiza.toml.tmp name, so two concurrent project add/rm calls can lose one registration or clobber each other's temp file.
    - f4 nit at internal/api/root.go:69 on root-init: Compares err == rootcfg.ErrExists where the rest of the change uses errors.Is for sentinel errors.
  - round 2 (cycle 2): no findings
- qa (step review/review): passed after 2 cycles
  - cycle 1: failed, check session 9419651a-52e0-4a4c-875a-01a1b246cdbd pass (said done), critic session 73597e1e-fbc4-41b9-84a2-01a1b26d4597 pass (said done)
  - cycle 2: passed, check session 9c5b9523-c93b-4dcb-bf86-01a1b27d7296 pass (said done)
  - round 1 (cycle 1): 3 findings, 1 confirmed
    - f1 blocker at internal/api/run_test.go:921 on runs-need-root: TestRunStartQueuesForTheDaemon fails at HEAD 9402a003 ('<tmp>/repo is not inside a Rhiza root'): requireProject now refuses run start in the test's bare repo, and the test was not given a root. Reproduced with RHIZA_* unset: go test -trimpath ./internal/api -run TestRunStartQueuesForTheDaemon. The project-add-path verifier reported the same failure; it is still unfixed, so CI's make check will fail. — confirmed: Reproduced at HEAD 42ecaec2 with RHIZA_* unset: go test -trimpath -count=1 ./internal/api -run TestRunStartQueuesForTheDaemon fails at run_test.go:921 with '<tmp>/repo is not inside a Rhiza root'. requireProject (internal/api/root.go:115) now gates run.start (run.go:534) and request (request.go:103), and the api test fixtures create no rhiza.toml root, so make check fails in CI.
    - f2 minor at internal/api/project.go:62 on project-add-path: rhiza project add app --name app2 registers a checkout that is already registered as app under a second name (exit 0, two entries with path = "app"). root show then resolves the folder to just one of them, and a daemon could treat it as two projects. Refuse a path that is already registered.
    - f3 nit at internal/api/project.go on project-ls-rm: Text output of rhiza project ls prints the name, path and initialised state but not the repo ID, which the leaf's statement says it lists; --json does include it.
  - round 2 (cycle 2): 2 findings, 0 confirmed
    - f1 minor at internal/api/project.go on project-add-path: Still at 0099b258: rhiza project add app --name app2 registers a checkout already registered as app under a second name (exit 0, two entries with path = "app" and the same repo ID). Refuse a path that is already registered.
    - f2 nit at internal/api/project.go on project-ls-rm: rhiza project ls text output omits the repo ID that the leaf says it lists; --json includes it.
- scope (step review/review): passed after 1 cycle
  - cycle 1: passed, check session c2b0c5a6-c90e-40a3-aa83-01a1b2471b90 pass (said done)
  - round 1 (cycle 1): 1 finding, 0 confirmed
    - f1 nit at cmd/rhiza/testdata/script/run-ship-change-rebase.txtar:128 on testscripts-run-under-root: Four existing scripts (build-tabs, daemon-milestone-request, run-resume-lost-fixer, run-ship-change-rebase) gain one line each to register their extra repoN/hook/block folders in $WORK/rhiza.toml. No leaf names these edits, but runs-need-root makes them necessary and none of them is on the leaf's must-stay-unedited list, so they stay within the intent.
- model (step review/review): passed after 2 cycles
  - cycle 1: failed, check session b354a324-8385-4bdc-b6b7-01a1b2478608 pass (said done), critic session d2d2750c-0039-4b25-b71e-01a1b26d9a35 pass (said done)
  - cycle 2: passed, check session cb715e45-887f-4d46-bdf9-01a1b27daca9 pass (said done)
  - round 1 (cycle 1): 3 findings, 2 confirmed
    - f1 major at .rhiza (testscripts-run-under-root statement and acceptance); cmd/rhiza/main_test.go:106 on testscripts-run-under-root: The leaf's statement still says Setup writes a rhiza.toml in the scripts' shared work root registering each script's $WORK folder as a project. Its acceptance says root show in $WORK sees its own project, and it lists daemon-repo-session among the scripts that pass unedited. The code follows m29-test-root-per-script instead: each $WORK is its own root, with project repo at $WORK/repo (testscript-root.txtar runs root show in $WORK/repo). m29-rewrite-daemon-repo-session also takes daemon-repo-session out of the pass-unedited list. The answered questions review-01m6rmj6-r3-f1/f2 still block the leaf, and neither decision is linked decided-by from it. Update the statement and acceptance to match the decisions and link them. — confirmed: testscripts-run-under-root's statement still describes a shared work root registering each $WORK, and its acceptance runs root show in $WORK and lists daemon-repo-session as unedited; main_test.go:106 makes each $WORK its own root with project repo at $WORK/repo, per m29-test-root-per-script, and m29-rewrite-daemon-repo-session drops daemon-repo-session from the list. The leaf is still blocked by the answered review-01m6rmj6-r3-f1/f2 and has no decided-by link to either decision.
    - f2 major at internal/api/run_test.go:921 on runs-need-root: runs-need-root's acceptance says the existing run start scripts pass under the Setup root, but the Go test TestRunStartQueuesForTheDaemon now fails with 'repo is not inside a Rhiza root'. requireProject in internal/api/root.go refuses its temp repo, and the test was not given a root. Reproduced at HEAD with go test -trimpath -count=1 -run TestRunStartQueuesForTheDaemon ./internal/api/. CI's make check will fail. — confirmed: Reproduced at HEAD, also with RHIZA_ROOT/CHANGE/RUN unset: go test -trimpath -count=1 -run TestRunStartQueuesForTheDaemon ./internal/api/ fails at run_test.go:921 with 'repo is not inside a Rhiza root'. runs-need-root's acceptance (existing run start tests pass) is not met, and CI's make check will fail.
    - f3 minor at cmd/rhiza/testdata/script/build-tabs.txtar:58 on testscripts-run-under-root: build-tabs, daemon-milestone-request, run-resume-lost-fixer and run-ship-change-rebase were edited to append their extra repos to $WORK/rhiza.toml. The model says the existing scripts stay unedited and does not record that a script making a second repo must register it under the Setup root.
  - round 2 (cycle 2): 1 finding, 0 confirmed
    - f1 minor at cmd/rhiza/testdata/script/build-tabs.txtar:58 on testscripts-run-under-root: build-tabs, daemon-milestone-request, run-resume-lost-fixer and run-ship-change-rebase append their extra repos to $WORK/rhiza.toml; the model still does not record that a script making a second repo that starts runs must register it under the Setup root (carried from cycle 1 f3).

## Code checks

- step review/code: pass

## Sign-offs

- signoff (visit 1): approved by rule autonomous

## Sessions

- build/build, session be8a36d6-c309-41c8-a023-01a1b1f3d997: tokens input 40, output 11585, cache creation 58734, cache read 1427351; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session c860a90e-09f0-45b6-8a1f-01a1b2004b52: tokens input 22, output 3630, cache creation 34071, cache read 611019; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session 81de8ae6-8751-404b-be13-01a1b2008442: tokens input 12, output 1716, cache creation 29373, cache read 300501; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session 1057fbaf-f0c2-4151-9dff-01a1b2018e20: tokens input 30, output 3894, cache creation 35927, cache read 785517; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session a44a0ab9-b2c3-45f1-9920-01a1b201d363: tokens input 34, output 7339, cache creation 44656, cache read 1041056; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session 21ee0dc5-193c-449d-ab2f-01a1b20c6826: tokens input 56, output 5308, cache creation 46789, cache read 1558144; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session 7f2a4c34-454c-4c44-a952-01a1b20ca3b0: tokens input 14, output 5502, cache creation 31141, cache read 350992; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session 078ababe-eab3-4f01-983d-01a1b20fc4fd: tokens input 58, output 7830, cache creation 42106, cache read 1507774; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session 232c14e1-35fc-458e-881a-01a1b21021d1: tokens input 18, output 3455, cache creation 33515, cache read 475553; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session 9c43fd95-ef84-4109-aea6-01a1b214981e: tokens input 22, output 3944, cache creation 33700, cache read 595378; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session c31d25b3-8509-41b3-be8a-01a1b214e9c3: tokens input 52, output 9565, cache creation 56255, cache read 1837780; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session 2dd23c4e-2e0b-4879-bd00-01a1b22c5df1: tokens input 20, output 3846, cache creation 33407, cache read 537084; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session 2ca6580e-c732-4aaa-8dd3-01a1b22c9f60: tokens input 12, output 1992, cache creation 26089, cache read 289942; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session 66235903-9d06-4d6e-806e-01a1b22e81fa: tokens input 20, output 3873, cache creation 28657, cache read 511472; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session 84b51d77-ed00-4c0d-89ff-01a1b2380606: tokens input 16, output 1926, cache creation 27636, cache read 402846; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session c3d6e71e-c54a-4833-86c5-01a1b23ba398: tokens input 34, output 5975, cache creation 36855, cache read 882449; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session e87f50c1-329b-456c-b213-01a1b2463f71: tokens input 38, output 6976, cache creation 53576, cache read 1240105; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session c65b89e9-31cd-48af-bc6a-01a1b2467941: tokens input 58, output 10028, cache creation 64624, cache read 2320835; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 9419651a-52e0-4a4c-875a-01a1b246cdbd: tokens input 46, output 10989, cache creation 54924, cache read 1525381; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session c2b0c5a6-c90e-40a3-aa83-01a1b2471b90: tokens input 18, output 3190, cache creation 48279, cache read 556629; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session b354a324-8385-4bdc-b6b7-01a1b2478608: tokens input 16, output 3450, cache creation 51354, cache read 493535; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 1b3eef32-b6e4-435a-8d84-01a1b26c9ed1: tokens input 12, output 1623, cache creation 26171, cache read 290096; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session aa72e653-9a7c-482e-a4cc-01a1b26cf21e: tokens input 10, output 1601, cache creation 24726, cache read 229562; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 73597e1e-fbc4-41b9-84a2-01a1b26d4597: tokens input 14, output 1509, cache creation 24527, cache read 338446; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session d2d2750c-0039-4b25-b71e-01a1b26d9a35: tokens input 14, output 2416, cache creation 27075, cache read 346143; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session e636ca75-d1d7-444c-9116-01a1b26f72f9: tokens input 20, output 2455, cache creation 29599, cache read 469679; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session a6df410e-3760-4a50-a1e3-01a1b2774c8a: tokens input 22, output 2972, cache creation 27420, cache read 560498; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session b12ce90e-5c01-41ed-8f0c-01a1b2777529: tokens input 18, output 2763, cache creation 26782, cache read 452790; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 99bb450f-9e2f-4061-b20e-01a1b2784328: tokens input 26, output 4518, cache creation 30895, cache read 696323; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 1747f0b6-37d8-4fe9-9b1e-01a1b27d0e01: tokens input 30, output 4016, cache creation 50680, cache read 865650; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 88379dda-8586-4a1b-9f08-01a1b27d35c9: tokens input 26, output 3243, cache creation 53626, cache read 919923; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 9c5b9523-c93b-4dcb-bf86-01a1b27d7296: tokens input 38, output 9397, cache creation 58487, cache read 1291134; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session cb715e45-887f-4d46-bdf9-01a1b27daca9: tokens input 26, output 2900, cache creation 46552, cache read 683181; helper tokens input 0, output 0, cache creation 0, cache read 0

Totals: tokens input 892, output 155426, cache creation 1298208, cache read 26394768; helper tokens input 0, output 0, cache creation 0, cache read 0