The follow-up to pull #2858 (#663), carrying juniper's third review. Until it lands, a live --outsider run proves nothing about private reads or steering, and the edge gate must not come down on its word.
Done looks like:
[ ] bun scripts/smoke.ts <url> --outsider with no FORGE_TOKEN exits 2 with a usage error and prints no ok line.
[ ] outsider() (src/release/outsider.ts) returns a refusal owner token: steering and private reads were not tried when options.ownerToken is absent. The aimed === 0 guard sits outside the if (options.ownerToken) block.
[ ] mcp() counts a refusal only when its text names not-a-member, unverified or forbidden, not any isError. The duplicate listed binding is renamed.
[ ] The README says spend and run bounds are proven in-process only, and that the suite adds the proof but does not reopen signup (the gitops gate stays a person's act).
[ ] Tests in test/outsider-suite.test.ts: no owner token gives the refusal, and an MCP argument error is not counted as a refusal.
The follow-up to pull #2858 (#663), carrying juniper's third review. Until it lands, a live
--outsiderrun proves nothing about private reads or steering, and the edge gate must not come down on its word.Done looks like:
bun scripts/smoke.ts <url> --outsiderwith noFORGE_TOKENexits 2 with a usage error and prints nookline.outsider()(src/release/outsider.ts) returns a refusalowner token: steering and private reads were not triedwhenoptions.ownerTokenis absent. Theaimed === 0guard sits outside theif (options.ownerToken)block.mcp()counts a refusal only when its text names not-a-member, unverified or forbidden, not anyisError. The duplicatelistedbinding is renamed.test/outsider-suite.test.ts: no owner token gives the refusal, and an MCP argument error is not counted as a refusal.bun x tsc --noEmitis clean.Files:
src/release/outsider.ts,scripts/smoke.ts, README,test/outsider-suite.test.ts.