feat(roles): coder drops the task.reassign grant the broker always refuses (#1567, row 73)

roles/coder.json crossRole goes from ["task.reassign", "task.scope.change"]
to ["task.scope.change"]. The broker refuses a non-pm task.reassign at the
writer check before it looks at authority, so the grant could never be
used. A coder's task.reassign now classifies as gated and goes to the
human. Backed by lead decision 90.

Tests: business role and resolve (the narrowing test moves to the pm,
which still holds two cross-role actions), a bus test on the shipped role
files, a harness test that a coder with a tracker gets no task_reassign,
the tasks fixture, and a verbs line showing a coder's task.reassign
refuses field-writer with no action.allowed. mutants.sh is Rocko's packet
rerun script, already committed.

Author: Rocko (packet agents/rocko/work/queue-73/, commit 2137dd7f).
Candidate manifest sha256 bf4e5ed6, base 324c064b, no drift on the
candidate paths through 8a42e819.
Approval: Dewey, round 1, comment 27506 on #1567.
Gate (Sage, /tmp/sage-g73 on 8a42e819, 23:42-23:48Z): tasks 71, bus 81,
business 60, harness 59, cli 113, webui 61, seat 27 node tests, 0 failed;
every scripts/test-*.sh exit 0, 0 failed.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

This commit is contained in:

jason.woltje

2026-10-11 18:49:09 -05:00

co-authored by

Claude Opus 5.5

parent fb619befd0

commit 0453da7e10

7 changed files with 50 additions and 9 deletions

									
										roles/coder.json
									
		+1
		-1
	
												View File
												
				@@ -7,7 +7,7 @@

				  "network": "api-only",

				  "authority": {

				    "withinRole": ["task.update.assigned", "git.push.working", "review.request", "message.send"],

				    "crossRole": ["task.reassign", "task.scope.change"]

				    "crossRole": ["task.scope.change"]

				  },

				  "credentials": [

				    {