New roles:
- roles/security-reviewer.json and .md: read tools only, review.verdict
within its role, no cross-role grant and no credentials, one verdict per
request.
- roles/merge-gate.json and .md: read tools only, cross-role
git.merge.protected only. It raises with domain technical and the task
ref, and lands with land_work once the decision resolves, the verdicts
approve and the gate passes. The chief of staff messages the relaunched
instance with the task ref and decision id (round 3 finding 28913).
Contracts:
- All 13 roles/*.md carry the proactive line in their Authority section.
- pm and chief-of-staff carry the REQ-DEC-2 routing paragraph. Its eight
hard waits are pinned to GATED_ONLY by a test.
Harness: raise_decision takes an optional domain, technical or delivery,
defaulting to delivery. The tool description says where each kind of raise
goes. end_run is unchanged (row 155).
Tests are new files only: business and bus workflow-roles tests and
harness raise-domain. Builder Dewey; Filbert approved round 4 (comment
28929) on manifest 6b4af9c2685b, base 0f715a054 plus build.patch
df0fec543dba.
Gate on 806ab89df plus the candidate, 16:34:57Z to 16:39:43Z: 2027
package tests and 422 script selftests (plus the queue suite's 156 node
tests), 0 failed. Doc-only follow-ups: business README:194-196 and the
launch.instances doc line.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
