Build verification — KN-WORK-PATH-LIST-b round 1
Verdict: pass
Frozen spec: docs/KN-WORK-PATH-LIST-FREEZE.md (frozen: true, freeze-review pass digest sha256:1354ed45531fc4dac329e989727deb9f9f4eb1ed17936a5d65c83b25cb8a1506)
Diff scope: Muse feat/kn-work-path-list-b — lib/path/**, hub list/get/propose/approve wire, blob learning_paths mergeById, seven-tier test/path-list-*.test.mjs, HUB-API / OpenAPI / PROPOSAL-LIFECYCLE / .env.example
Reviewer posture: independent checklist vs freeze D1–D12 + §3–§5 + §7 + §9 (not redesign)
Evidence
| type | sha256 | ref | notes |
|---|---|---|---|
| test_output | a733bb9fe7c66f7d20821519c656fd39c04ac0928f3f8add74d2b4e1a09dcd98 |
node --test test/path-list-*.test.mjs |
44/44 pass |
Checklist
| # | Check | Evidence |
|---|---|---|
| V1 | Deliverables at frozen paths | lib/path/path-store.mjs, path-write.mjs, path-handlers.mjs, path-hosted-proposal.mjs; hub/gateway/path-approve-hosted.mjs; hub/bridge/path-routes.mjs; seven-tier tests; HUB-API §3.4.1; OpenAPI LearningPaths; PROPOSAL-LIFECYCLE learning-path row |
| V2 | APIs match §4 | GET api/v1/learning-paths + GET :path_id; gated POST …/proposals; hosted POST …/apply-approved; self-hosted approve precheck/reconcile on PATH_PROPOSAL_SOURCE next to the task pair (hub/server.mjs); gateway hook after task/media |
| V3 | Test matrix | unit/integration/e2e/stress/data-integrity/performance/security present; security pre-fix stubs (a)(b)(c) fail the contract; real impl covers 404-not-leak, gate off, no T5 admit, no writeNote from path modules |
| V4 | No scope creep | No ~/scooling/ edits this Auto; lib/task/task-write.mjs untouched; orchestrator_graphs merge not rewritten; no MCP/CLI/Hub wizard; no production Path seed |
| V5 | Requirements held | D1 learning_paths[] on hub_flow_store.json; D2 server mint path_+16 hex; D3 getPathWritesEnabled in path-write.mjs only; D4 T5 refused; D7 empty list honest; D11 archive keep-row; D12 last-updated wins, no base_state_id |
| V6 | Governance truthful | ROADMAP → DONE only after this pass; handover NEXT → Scooling HOME-BIND Thinking (this repo does not edit Scooling) |
| V7 | Secrets / injection | .env.example # PATH_WRITES_ENABLED= name only (not 1/true); path kinds off ADMITTED_*; note_path rejects ../ and URLs; control chars → PATH_TEXT_INVALID |
| V8 | Claims ↔ evidence | Seven-tier hash above; PATH_WRITES_ENABLED unset in source; honesty ledger N/A (honesty.enabled absent) |
Findings
None.
Honest summary
Knowtation now stores structured learning paths in the existing hub_flow_store.json vault bucket as learning_paths[], lists and gets them over Hub REST, and persists only through Review-before-write proposals (path_create | path_update | path_archive) with PATH_WRITES_ENABLED default off. Hosted apply copies the task approve hook. Path kinds stay off T5 self-apply. Scooling harvest, Home bind, Live, and BRAIN-PAIR-b were not started.