fix(organization): validate narrowed arbiter resolve authority (#1873)

The mark from the previous commit kept the wait off the old page, but
the wait could still start on it and be killed by the reload
("Inspected target navigated or closed", once in ten runs). navigate()
waits for the load; a query makes the same URL load again.

packages/bus/src/broker.mjs

@@ -50,6 +50,7 @@ export const ACTIONS = Object.freeze([
   'policy.change',
   'prd.approve',
   'decision.resolve.technical',
+  'decision.resolve.delivery',
   // Row 285 (C2-08b, #1790): routed under PRD 1.16 REQ-WAIT-3 and REQ-LIB-6, below.
   'library.write',
 ]);
@@ -78,6 +79,7 @@ const ROUTED = new Set([
   'policy.change',
   'prd.approve',
   'decision.resolve.technical',
+  'decision.resolve.delivery',
   // PRD 1.7 REQ-COS-3 (row 194, #1692): the chief's hire and fire, within the bounds the broker checks.
   'role.hire',
   'role.fire',
@@ -88,6 +90,8 @@ const ROUTED = new Set([
 export const HARD_WAITS = Object.freeze(ACTIONS.filter((action) => !ROUTED.has(action)));
 const GATED = new Set(HARD_WAITS);
 const CLOSED = "('resolved','withdrawn','expired')";
+// RR (#1873): these actions never take their domain from the raising agent.
+const DECISION_DOMAINS = Object.freeze({ 'git.merge.protected': 'technical', 'policy.change': 'delivery' });
 // How many closed decisions `decisions` with list 'recent' returns, newest close first.
 export const RECENT = 50;
 // How many replies `replies` returns, oldest first.
@@ -5061,6 +5065,20 @@ export class Broker {
     );
     return evidence ? JSON.parse(evidence.body) : null;
   }
+  #checkResolver(s, d) {
+    const b = this.#business(s.business), role = b.roles[s.role];
+    const domain = d.action === 'prd.approve' ? 'technical' : DECISION_DOMAINS[d.action] ?? this.#raised(s.business, d.id)?.domain;
+    // Pre-RR evidence has no domain. Assignments may have changed since raise,
+    // so require both possible rights rather than infer one from today's file.
+    const domains = domain === undefined ? ['technical', 'delivery'] : [domain];
+    for (const kind of domains) {
+      if (!['technical', 'delivery'].includes(kind)) fail('not-resolver');
+      const right = `decision.resolve.${kind}`;
+      if (!role?.authority?.withinRole.includes(right)) {
+        throw new BusError('not-resolver', `instance ${s.role}, role ${role?.definition ?? s.role}, lacks ${right}`);
+      }
+    }
+  }
   // Whether an executor already used the decision. decision.raise records context, not permission
   // consumed by an executor.
   #spent(business, decision) {
@@ -7064,8 +7082,8 @@ export class Broker {
         if (!choices.includes(a.recommendation)) fail('invalid-recommendation');
         const approvalChoice = a.approvalChoice ?? 'yes';
         if (!choices.includes(approvalChoice)) fail('invalid-approval-choice');
-        const domain = a.domain ?? 'delivery';
-        if (!['technical', 'delivery'].includes(domain)) fail('invalid-domain');
+        if (a.domain !== undefined && !['technical', 'delivery'].includes(a.domain)) fail('invalid-domain');
+        const domain = DECISION_DOMAINS[a.action] ?? a.domain ?? 'delivery';
         // PRD 1.5 REQ-DEC-2 (row 139, #1633): a gated raise citing the project's current spec commit
         // goes to the arbiter for its domain, like a cross-role one. An uncited gated raise and any
         // hard wait go to the human. readSpec already refused a stale or unconfirmed citation.
@@ -7147,6 +7165,7 @@ export class Broker {
             decision: did,
             action: a.action,
             operation: 'decision.raise',
+            domain,
             task_ref: a.task_ref ?? null,
             target: a.target ?? null,
             approvalChoice,
@@ -7213,6 +7232,7 @@ export class Broker {
         else {
           this.#agent(s);
           if (s.role !== d.route_to) fail('not-resolver');
+          if (verb === 'decision.resolve') this.#checkResolver(s, d);
         }
         const op = verb === 'decision.resolve' || viaConsole ? 'resolved' : verb === 'decision.seen' ? 'seen' : 'withdrawn';
         if (op === 'resolved' && !JSON.parse(d.options).some((o) => o.key === a.choice))

packages/bus/tests/chief-of-staff.test.mjs

@@ -282,7 +282,7 @@ test('REQ-LIMIT-1: the chief of staff is logged as allowed, and organization.set
   const outside = [
     { launch: { by: 'coder' } },
     { human: 'mallory' },
-    { arbiters: { technical: 'coder', delivery: 'coder' } },
+    { arbiters: { technical: 'chief', delivery: 'chief' } },
     { roles: {} },
     { actor: 'jason' },
     { 'launch.by': 'coder' },
@@ -1026,7 +1026,7 @@ test('row 194 T8, T9, T18: through the runtime the chief hires and fires with th
   const root = mkdtempSync(join(tmpdir(), 'bus-chief-hire-'));
   const rolesDir = rolesCopy(root);
   // A hireable scratch definition: version 2, no credentials, every action on HIRE_ALLOWED.
-  writeFileSync(join(rolesDir, 'aide.md'), '# Aide\n');
+  writeFileSync(join(rolesDir, 'aide.md'), '# Aide\n\n## Authority\n');
   writeJson(join(rolesDir, 'aide.json'), {
     roleVersion: 2, name: 'aide', title: 'Aide', contract: 'aide.md', tools: ['read'], network: 'api-only',
     authority: { withinRole: ['message.send'], crossRole: [] }, credentials: [],

packages/bus/tests/citation-helpers.mjs

@@ -18,8 +18,8 @@ export function citationWorld(t, { definition = 'coder', library = true, guard:
   writeFileSync(settings, JSON.stringify({ replyLimits: { requireCitation: false, citationsPerReply: 20 } }));
   const business = { id: 'acme', human: 'jason', vars: { 'bus.tester': true },
     ...(library ? { projects: { books: map } } : {}),
-    arbiters: { technical: 'coder', delivery: 'coder' },
-    roles: { coder: { definition, web: true, authority: { withinRole: sendAuthority ? ['message.send'] : [], crossRole: [] } } } };
+    arbiters: { technical: 'chief', delivery: 'chief' },
+    roles: {chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } },  coder: { definition, web: true, authority: { withinRole: sendAuthority ? ['message.send'] : [], crossRole: [] } } } };
   const limits = () => {
     try { return resolveReplyLimits({ readable: true, document: JSON.parse(readFileSync(settings, 'utf8')) }); }
     catch { return resolveReplyLimits({ readable: false }); }

packages/bus/tests/citation-runtime.test.mjs

@@ -18,8 +18,8 @@ test('C2-06 runtime reads changed and unreadable reply limits without restarting
   // Runtime takes the host's broker projection, not the business validator's unresolved role entries.
   // No agent action is needed here: use the same empty-authority shape as limits-runtime.test.mjs.
   const business = { id: 'acme', human: 'jason', projects: checked.projects,
-    arbiters: { technical: 'coder', delivery: 'coder' },
-    roles: { coder: { definition: 'coder', authority: { withinRole: [], crossRole: [] } } } };
+    arbiters: { technical: 'chief', delivery: 'chief' },
+    roles: {chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } },  coder: { definition: 'coder', authority: { withinRole: [], crossRole: [] } } } };
   const runtime = await startBroker({ dataRoot, businesses: { acme: business }, organization: { dir, rolesDir, system: systemFor(root) } });
   t.after(() => runtime.close());
   const human = runtime.broker.bindHuman({ business: 'acme', human: 'jason', via: 'cli', outsideAgent: true });

packages/bus/tests/console-decide.test.mjs

@@ -48,8 +48,8 @@ function setup(t) {
     human: 'jason',
     arbiters: { technical: 'pm', delivery: 'pm' },
     roles: {
-      chief: { definition: 'chief-of-staff', authority: { withinRole: ['message.send'], crossRole: [] } },
-      pm: { definition: 'pm', authority: { withinRole: ['message.send'], crossRole: [] } },
+      chief: { definition: 'chief-of-staff', authority: { withinRole: ['message.send', 'decision.resolve.delivery'], crossRole: [] } },
+      pm: { definition: 'pm', authority: { withinRole: ['message.send', 'decision.resolve.delivery'], crossRole: [] } },
     },
     vars: { 'bus.tester': true },
   };
@@ -227,7 +227,7 @@ test('ordinary PRD approval and nine non-yes/no choices use the same protocol wi
 test('ordinary role routes refuse Console resolution and agent answers retain the actual role/run', (t) => {
   const f = setup(t);
   for (const route of ['pm', 'chief']) {
-    const id = grantDecision(f.store, { action: 'prd.approve', route, close: null });
+    const id = grantDecision(f.store, { action: 'policy.change', route, close: null });
     refusesSync(() => f.call('console', 'decision.preview.console', { id }), 'decision-not-eligible');
     refusesSync(() => f.call('console', 'decision.resolve.console', { id, choice: 'yes', digest: '0'.repeat(64) }), 'decision-not-eligible');
     f.call(route, 'decision.resolve', { id, choice: 'yes' });

packages/bus/tests/credential-verbs.test.mjs

@@ -30,8 +30,8 @@ async function setup(t, { storeRoot = true } = {}) {
   const store = (agent, service) => join(root, 'secrets', 'agents', 'demo', agent, service);
   // The bus's resolved business carries the same references; a store one names its derived file.
   const demo = {
-    id: 'demo', human: 'jason', arbiters: { technical: 'coder', delivery: 'coder' }, vars: { 'bus.tester': true },
-    roles: {
+    id: 'demo', human: 'jason', arbiters: { technical: 'chief', delivery: 'chief' }, vars: { 'bus.tester': true },
+    roles: {chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } },
       coder: { ...role, credentials: { gitea: { store: true, file: store('coder', 'gitea'), rotateBy: DATE }, vikunja: doc.roles.coder.credentials.vikunja } },
       reviewer: { ...role, credentials: doc.roles.reviewer.credentials },
     },
@@ -58,7 +58,7 @@ test('row 199: the lifecycle verbs refuse every session but the human, and the t
   const calls = [];
   const b = new Broker({
     store: s,
-    businesses: { demo: { id: 'demo', human: 'jason', arbiters: { technical: 'coder', delivery: 'coder' }, vars: { 'bus.tester': true }, roles: { coder: role } } },
+    businesses: { demo: { id: 'demo', human: 'jason', arbiters: { technical: 'chief', delivery: 'chief' }, vars: { 'bus.tester': true }, roles: {chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } },  coder: role } } },
     credentialVerbs: (id, verb, args, actor) => (calls.push([verb, actor]), { ok: true }),
   });
   const human = b.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });
@@ -97,7 +97,7 @@ test('row 199: the lifecycle verbs refuse every session but the human, and the t
   b.request(tester, { verb: 'credentials.revoke', args: args['credentials.revoke'] });
   assert.deepEqual(calls, [['credentials.issue', 'jason'], ['credentials.revoke', 'jason'], ['credentials.delete', 'jason'], ['credentials.revoke', 'tester']]);
   // No lifecycle without the runtime's store.
-  const bare = new Broker({ store: s, businesses: { demo: { id: 'demo', human: 'jason', arbiters: { technical: 'coder', delivery: 'coder' }, roles: { coder: role } } } });
+  const bare = new Broker({ store: s, businesses: { demo: { id: 'demo', human: 'jason', arbiters: { technical: 'chief', delivery: 'chief' }, roles: {chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } },  coder: role } } } });
   const h2 = bare.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });
   assert.throws(() => bare.request(h2, { verb: 'credentials.revoke', args: args['credentials.revoke'] }), /not-configured/);
 });
@@ -182,8 +182,8 @@ test('#1886: a store root that exists with loose modes still refuses start', asy
   mkdirSync(join(root, 'secrets', 'agents'), { recursive: true, mode: 0o750 });
   chmodSync(join(root, 'secrets', 'agents'), 0o750);
   const demo = {
-    id: 'demo', human: 'jason', arbiters: { technical: 'coder', delivery: 'coder' }, vars: {},
-    roles: { coder: { ...role, credentials: { gitea: { store: true, file: join(root, 'secrets', 'agents', 'demo', 'coder', 'gitea'), rotateBy: DATE } } } },
+    id: 'demo', human: 'jason', arbiters: { technical: 'chief', delivery: 'chief' }, vars: {},
+    roles: {chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } },  coder: { ...role, credentials: { gitea: { store: true, file: join(root, 'secrets', 'agents', 'demo', 'coder', 'gitea'), rotateBy: DATE } } } },
   };
   await assert.rejects(startBroker({ dataRoot: join(root, 'data'), businesses: { demo }, organization: { dir: root, rolesDir, system: systemFor(root) } }), /credential-file/);
 });

packages/bus/tests/daily-quota-runtime.test.mjs

@@ -24,8 +24,8 @@ async function setup(t, limit = 0) {
   writeJson(join(root, 'businesses/demo.json'), doc);
   mkdirSync(join(root, 'data'), { mode: 0o700 });
   const bus = await startBroker({ dataRoot: join(root, 'data'),
-    businesses: { demo: { id: 'demo', human: 'jason', arbiters: { technical: 'coder', delivery: 'coder' },
-      roles: ROLES, definitions: { coder: {} }, projects: { stack: { root: '/nonexistent' } } } },
+    businesses: { demo: { id: 'demo', human: 'jason', arbiters: { technical: 'chief', delivery: 'chief' },
+      roles: { chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } }, ...ROLES }, definitions: { coder: {} }, projects: { stack: { root: '/nonexistent' } } } },
     organization: { dir: root, rolesDir, system: systemFor(root) } });
   t.after(async () => { await bus.close(); rmSync(root, { recursive: true, force: true }); });
   return { bus, human: bus.broker.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true }) };
@@ -76,8 +76,8 @@ test('REQ-LIMIT-4 bindLaunch keeps the account off session.launched, refuses one
   const root = mkdtempSync(join(tmpdir(), 'mosaic-daily-bind-'));
   const store = new Store(root);
   t.after(() => { store.close(); rmSync(root, { recursive: true, force: true }); });
-  const broker = new Broker({ store, businesses: { demo: { id: 'demo', human: 'jason', arbiters: { technical: 'coder', delivery: 'coder' },
-    roles: ROLES, definitions: { coder: {} }, projects: { stack: { root: '/nonexistent' } } } } });
+  const broker = new Broker({ store, businesses: { demo: { id: 'demo', human: 'jason', arbiters: { technical: 'chief', delivery: 'chief' },
+    roles: { chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } }, ...ROLES }, definitions: { coder: {} }, projects: { stack: { root: '/nonexistent' } } } } });
   const base = { business: 'demo', role: 'coder', harness: 'claude-code', provider: 'anthropic', model: 'opus' };
   for (const [i, account] of ['Jason Max', '', 5, {}, '-x'].entries())
     assert.throws(() => broker.bindLaunch({ ...base, run: `bad${i}`, account }), { code: 'invalid-request' }, JSON.stringify(account));

packages/bus/tests/decision-close.test.mjs

@@ -13,8 +13,8 @@ const options = [
   { key: 'no', text: 'Decline' },
 ];
 const roles = {
-  pm: { authority: { withinRole: ['message.send'], crossRole: [] } },
-  cto: { authority: { withinRole: ['message.send'], crossRole: [] } },
+  pm: { authority: { withinRole: ['decision.resolve.delivery', 'message.send'], crossRole: [] } },
+  cto: { authority: { withinRole: ['decision.resolve.technical', 'message.send'], crossRole: [] } },
   coder: { authority: { withinRole: ['message.send'], crossRole: ['task.scope.change'] } },
 };
 const businesses = { demo: { id: 'demo', human: 'jason', arbiters: { technical: 'cto', delivery: 'pm' }, roles } };

packages/bus/tests/decision-route.test.mjs

@@ -22,8 +22,8 @@ const options = [
 ];
 const pusher = { authority: { withinRole: ['message.send'], crossRole: ['git.push.working'] } };
 const roles = {
-  pm: { definition: 'pm', authority: { withinRole: ['message.send'], crossRole: [] } },
-  chief: { definition: 'chief-of-staff', authority: { withinRole: ['message.send'], crossRole: [] } },
+  pm: { definition: 'pm', authority: { withinRole: ['message.send', 'decision.resolve.technical'], crossRole: [] } },
+  chief: { definition: 'chief-of-staff', authority: { withinRole: ['message.send', 'decision.resolve.delivery'], crossRole: [] } },
   assistant: { definition: 'assistant', authority: { withinRole: ['message.send'], crossRole: [] } },
   // Hears from pm, the technical arbiter, but not from the chief of staff, the delivery arbiter.
   coder: { definition: 'coder', ...pusher },

packages/bus/tests/decisions.test.mjs

@@ -13,8 +13,8 @@ const options = [
   { key: 'no', text: 'Decline' },
 ];
 const roles = {
-  pm: { authority: { withinRole: ['message.send', 'task.create'], crossRole: [] } },
-  cto: { authority: { withinRole: ['message.send'], crossRole: [] } },
+  pm: { authority: { withinRole: ['decision.resolve.delivery', 'message.send', 'task.create'], crossRole: [] } },
+  cto: { authority: { withinRole: ['decision.resolve.technical', 'message.send'], crossRole: [] } },
   coder: { authority: { withinRole: ['message.send'], crossRole: ['task.scope.change'] } },
 };
 const businesses = {

packages/bus/tests/grant-enroll.test.mjs

@@ -48,7 +48,7 @@ function setup(t, { keygen, check, hang = false } = {}) {
     arbiters: { technical: 'pm', delivery: 'pm' },
     roles: {
       chief: { definition: 'chief-of-staff', authority: { withinRole: ['message.send'], crossRole: [] } },
-      pm: { definition: 'pm', authority: { withinRole: ['message.send'], crossRole: [] } },
+      pm: { definition: 'pm', authority: { withinRole: ['message.send', 'decision.resolve.delivery'], crossRole: [] } },
     },
     vars: { 'bus.tester': true },
   };

packages/bus/tests/grant-scope-runtime.test.mjs

@@ -17,8 +17,8 @@ test('row 298 runtime: human scope approval writes the file and organization his
   const file = writeJson(join(root, 'businesses/demo.json'), businessDoc(root, 'demo'));
   mkdirSync(join(root, 'data'), { mode: 0o700 });
   runtime = await startBroker({ dataRoot: join(root, 'data'),
-    businesses: { demo: { id: 'demo', human: 'jason', arbiters: { technical: 'coder', delivery: 'coder' },
-      roles: { coder: { authority: { withinRole: [], crossRole: [] } } } } },
+    businesses: { demo: { id: 'demo', human: 'jason', arbiters: { technical: 'chief', delivery: 'chief' },
+      roles: {chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } },  coder: { authority: { withinRole: [], crossRole: [] } } } } },
     organization: { dir: root, rolesDir, system: systemFor(root) },
   });
   const human = runtime.broker.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });

packages/bus/tests/hard-waits.test.mjs

@@ -27,8 +27,8 @@ test('REQ-WAIT-2: a business granting a hard wait at either class is refused; th
   const root = mkdtempSync(join(tmpdir(), 'hard-waits-'));
   const store = new Store(root);
   t.after(() => { store.close(); rmSync(root, { recursive: true, force: true }); });
-  const business = authority => ({ demo: { id: 'demo', human: 'jason', arbiters: { technical: 'coder', delivery: 'coder' },
-    roles: { coder: { definition: 'coder', authority } } } });
+  const business = authority => ({ demo: { id: 'demo', human: 'jason', arbiters: { technical: 'chief', delivery: 'chief' },
+    roles: {chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } },  coder: { definition: 'coder', authority } } } });
   for (const action of WAITS) {
     assert.throws(() => new Broker({ store, businesses: business({ withinRole: [action], crossRole: [] }) }), /invalid-authority/, action);
     assert.throws(() => new Broker({ store, businesses: business({ withinRole: [], crossRole: [action] }) }), /invalid-authority/, action);
@@ -54,19 +54,19 @@ test('REQ-DEC-2: every hard wait goes to the human, cited or not, and the arbite
     }
   }
   const d = await f.raise({ action: 'data.delete', ...cite(f) });
-  assert.throws(() => f.call(f.reviewer, 'decision.resolve', { id: d.id, choice: 'yes' }), /human-required/);
+  assert.throws(() => f.call(f.chief, 'decision.resolve', { id: d.id, choice: 'yes' }), /human-required/);
   f.call(f.human, 'decision.resolve', { id: d.id, choice: 'yes' });
 });
 
 test('REQ-DEC-2: a gated raise citing the current spec goes to the arbiter for its domain; uncited, to the human', async t => {
-  const f = await fixture(t, { arbiters: { technical: 'cto', delivery: 'reviewer' },
-    roles: { cto: { definition: 'cto', authority: { withinRole: ['message.send'], crossRole: [] } } } });
+  const f = await fixture(t, { arbiters: { technical: 'cto', delivery: 'chief' },
+    roles: {chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } },  cto: { definition: 'cto', authority: { withinRole: ['message.send', 'decision.resolve.technical'], crossRole: [] } } } });
   f.agent('cto');
   for (const action of LEFT) {
     const raise = { action, ...(action === 'role.revoke' ? { target: 'reviewer' } : {}) };
     assert.deepEqual(routed(f, f.raise(raise)), { class: 'gated', route_to: 'human' }, action);
-    assert.deepEqual(routed(f, await f.raise({ ...raise, ...cite(f), domain: 'technical' })), { class: 'gated', route_to: 'cto' }, action);
-    assert.deepEqual(routed(f, await f.raise({ ...raise, ...cite(f) })), { class: 'gated', route_to: 'reviewer' }, action);
+    assert.deepEqual(routed(f, await f.raise({ ...raise, ...cite(f), domain: 'technical' })), { class: 'gated', route_to: action === 'policy.change' ? 'chief' : 'cto' }, action);
+    assert.deepEqual(routed(f, await f.raise({ ...raise, ...cite(f) })), { class: 'gated', route_to: action === 'git.merge.protected' ? 'cto' : 'chief' }, action);
   }
 });
 
@@ -74,15 +74,15 @@ test('REQ-DEC-2: an arbiter-approved cited gated decision authorizes the raiser,
   const f = await fixture(t, { roles: { pm: { definition: 'pm', authority: { withinRole: ['message.send'], crossRole: [] } } } });
   f.agent('pm');
   const d = await f.raise({ action: 'role.revoke', target: 'pm', ...cite(f) });
-  assert.deepEqual(routed(f, d), { class: 'gated', route_to: 'reviewer' });
+  assert.deepEqual(routed(f, d), { class: 'gated', route_to: 'chief' });
   assert.throws(() => f.call(f.human, 'decision.resolve', { id: d.id, choice: 'yes' }), /agent-required/);
-  f.call(f.reviewer, 'decision.resolve', { id: d.id, choice: 'yes' });
+  f.call(f.chief, 'decision.resolve', { id: d.id, choice: 'yes' });
   assert.deepEqual(f.call(f.coder, 'role.revoke', { role: 'pm', decision: d.id }), { revoked: true });
 });
 
 test('REQ-DEC-2: a cited merge raised by merge-gate goes to the technical arbiter; a merge raised without the grant routes by citation', async t => {
-  const f = await fixture(t, { arbiters: { technical: 'cto', delivery: 'reviewer' }, roles: {
-    cto: { definition: 'cto', authority: { withinRole: ['message.send'], crossRole: [] } },
+  const f = await fixture(t, { arbiters: { technical: 'cto', delivery: 'chief' }, roles: {chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } },
+    cto: { definition: 'cto', authority: { withinRole: ['message.send', 'decision.resolve.technical'], crossRole: [] } },
     'merge-gate': { definition: 'merge-gate', authority: { withinRole: [], crossRole: ['git.merge.protected'] } },
   } });
   const cto = f.agent('cto'), gate = f.agent('merge-gate');
@@ -106,7 +106,7 @@ test('REQ-DEC-2: a stale or unconfirmed citation refuses without a decision; an
   await assert.rejects(f.raise({ action: 'policy.change', ...old, spec_commit: edit }), { code: 'spec-unconfirmed' });
   assert.equal(f.store.get('SELECT count(*) n FROM decisions').n, 0);
   const current = f.save('# Current\n');
-  const own = await f.call(f.reviewer, 'decision.raise', { action: 'policy.change', question: 'Change?',
+  const own = await f.call(f.chief, 'decision.raise', { action: 'policy.change', question: 'Change?',
     options: [{ key: 'yes', text: 'Yes' }, { key: 'no', text: 'No' }], recommendation: 'yes', blocking: false,
     project: 'stack', spec_path: 'spec/north-star.md', spec_commit: current });
   assert.deepEqual(routed(f, own), { class: 'gated', route_to: 'human' });
@@ -136,7 +136,7 @@ const allowedCount = f => f.store.get("SELECT count(*) n FROM events WHERE kind=
 test('Q169: the chief of staff\'s end of the assistant stops every thread run; its own run and another ender\'s are refused', async t => {
   const f = await fixture(t, { roles: { ...seats,
     chief: { definition: 'chief-of-staff', ...grants(['role.end']) }, lead: { definition: 'lead', ...grants(['role.end']) } } });
-  const chief = f.agent('chief'), lead = f.agent('lead');
+  const chief = f.chief, lead = f.agent('lead');
   // No thread is held yet, so there is nothing to end.
   assert.throws(() => f.call(chief, 'role.revoke', { role: 'assistant', reason: 'Q169' }), /not-held/);
   const a = held(f, 'a-run'), b = held(f, 'b-run');
@@ -158,11 +158,11 @@ test('Q169: the chief of staff\'s end of the assistant stops every thread run; i
 
 test('Q169: a revoke of the assistant the chief of staff raises goes to the human, cited or not, and no arbiter resolves it', async t => {
   const f = await fixture(t, { roles: { ...seats, chief: { definition: 'chief-of-staff', ...grants(['role.end']) } } });
-  const chief = f.agent('chief');
+  const chief = f.chief;
   for (const args of [{}, cite(f), { ...cite(f), domain: 'technical' }, { ...cite(f), domain: 'delivery' }]) {
     const d = await revoke(f, chief, 'assistant', args);
     assert.deepEqual(routed(f, d), { class: 'gated', route_to: 'human' }, JSON.stringify(args));
-    assert.throws(() => f.call(f.reviewer, 'decision.resolve', { id: d.id, choice: 'yes' }), /human-required/);
+    assert.throws(() => f.call(f.chief, 'decision.resolve', { id: d.id, choice: 'yes' }), /human-required/);
   }
   // Resolved by the human, the chief's revoke citing it stops the thread run, once.
   const a = held(f, 'a-run');
@@ -181,8 +181,8 @@ test('Q169: another role\'s cited revoke of the assistant, resolved by an arbite
   // One raised while the instance's definition wasn't protected went to the arbiter. The same
   // store under a business that now makes it the assistant still refuses it.
   const d = await revoke(f, f.coder, 'pm', cite(f));
-  assert.deepEqual(routed(f, d), { class: 'gated', route_to: 'reviewer' });
-  f.call(f.reviewer, 'decision.resolve', { id: d.id, choice: 'yes' });
+  assert.deepEqual(routed(f, d), { class: 'gated', route_to: 'chief' });
+  f.call(f.chief, 'decision.resolve', { id: d.id, choice: 'yes' });
   const now = { ...f.business, roles: { ...f.business.roles, pm: { definition: 'assistant', ...grants([]) } } };
   const later = new Broker({ store: f.store, businesses: { demo: now } });
   const coder = later.bindLaunch({ business: 'demo', role: 'coder', run: 'coder-run', harness: 'pi', address: 'coder' });
@@ -192,7 +192,7 @@ test('Q169: another role\'s cited revoke of the assistant, resolved by an arbite
 test('Q169: a revoke of the assistant citing a decision the human resolved stops its thread run', async t => {
   const f = await fixture(t, { roles: seats });
   const d = await revoke(f, f.coder, 'assistant', cite(f));
-  assert.throws(() => f.call(f.reviewer, 'decision.resolve', { id: d.id, choice: 'yes' }), /human-required/);
+  assert.throws(() => f.call(f.chief, 'decision.resolve', { id: d.id, choice: 'yes' }), /human-required/);
   f.call(f.human, 'decision.resolve', { id: d.id, choice: 'yes' });
   // Row 155: the recorded holder run (null) and the role_claims one (none) compare equal, so the
   // revoke reaches the thread claims and stops the held one.
@@ -205,8 +205,8 @@ test('Q169: a cited revoke of a role not in END_PROTECTED still goes to the arbi
   const f = await fixture(t, { roles: seats });
   f.agent('pm');
   const d = await revoke(f, f.coder, 'pm', cite(f));
-  assert.deepEqual(routed(f, d), { class: 'gated', route_to: 'reviewer' });
-  f.call(f.reviewer, 'decision.resolve', { id: d.id, choice: 'yes' });
+  assert.deepEqual(routed(f, d), { class: 'gated', route_to: 'chief' });
+  f.call(f.chief, 'decision.resolve', { id: d.id, choice: 'yes' });
   assert.deepEqual(f.call(f.coder, 'role.revoke', { role: 'pm', decision: d.id }), { revoked: true });
 });
 
@@ -216,7 +216,7 @@ test('Q169: a role granted role.revoke at either class still sends a revoke of t
     boss: { definition: 'boss', ...grants(['role.revoke']) } } });
   const lead = f.agent('lead'), boss = f.agent('boss');
   assert.deepEqual(routed(f, await revoke(f, lead, 'assistant', cite(f))), { class: 'gated', route_to: 'human' });
-  assert.deepEqual(routed(f, await revoke(f, lead, 'pm', cite(f))), { class: 'cross-role', route_to: 'reviewer' });
+  assert.deepEqual(routed(f, await revoke(f, lead, 'pm', cite(f))), { class: 'cross-role', route_to: 'chief' });
   const own = await revoke(f, boss, 'assistant', { choice: 'yes' });
   assert.deepEqual(routed(f, own), { class: 'gated', route_to: 'human' });
   assert.equal(f.store.get('SELECT count(*) n FROM decision_events WHERE decision=?', own.id).n, 0);

packages/bus/tests/host-fixtures.mjs

@@ -12,7 +12,7 @@ export const HUMAN_YES = { op: 'resolved', by: 'jason', choice: 'yes', via: 'cli
 
 // A credential.mint decision with `grant` in its raise body. `close` is the decision_events row, or null
 // for an open decision.
-export function grantDecision(store, { business = 'demo', action = 'credential.mint', route = 'human', grant, close = HUMAN_YES }) {
+export function grantDecision(store, { business = 'demo', action = 'credential.mint', route = 'human', domain = 'delivery', grant, close = HUMAN_YES }) {
   const id = randomUUID();
   store.run(
     'INSERT INTO decisions(id,at,business,raised_by_role,raised_by_run,class,action,route_to,question,options,recommendation,blocking) VALUES(?,?,?,?,?,?,?,?,?,?,?,?)',
@@ -21,7 +21,7 @@ export function grantDecision(store, { business = 'demo', action = 'credential.m
   store.run(
     "INSERT INTO events(id,at,business,kind,actor_role,actor_run,subject,body) VALUES(?,?,?,'action.allowed',?,?,?,?)",
     randomUUID(), AT, business, 'chief', 'chief-run', id,
-    JSON.stringify({ decision: id, action, operation: 'decision.raise', approvalChoice: 'yes', ...(grant ? { grant } : {}) }),
+    JSON.stringify({ decision: id, action, operation: 'decision.raise', ...(domain === null ? {} : { domain }), approvalChoice: 'yes', ...(grant ? { grant } : {}) }),
   );
   if (close)
     store.run('INSERT INTO decision_events(decision,at,op,by,choice,via) VALUES(?,?,?,?,?,?)', id, AT, close.op, close.by, close.choice ?? null, close.via ?? null);

packages/bus/tests/host-run.test.mjs

@@ -572,8 +572,8 @@ test('T27: the bus start sweeps <configDir>/secrets/run before it listens, and a
   await new Promise((r) => dead.on('close', r));
   writeFileSync(join(run, 'h-dddddd', 'pids'), `${dead.pid} x\n`);
   const demo = {
-    id: 'demo', human: 'jason', arbiters: { technical: 'coder', delivery: 'coder' },
-    roles: { coder: { authority: { withinRole: ['message.send'], crossRole: [] }, credentials: {} } },
+    id: 'demo', human: 'jason', arbiters: { technical: 'chief', delivery: 'chief' },
+    roles: {chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } },  coder: { authority: { withinRole: ['message.send'], crossRole: [] }, credentials: {} } },
   };
   const start = () => startBroker({ dataRoot: join(root, 'data'), businesses: { demo }, organization: { dir: root, rolesDir, system: systemFor(root) } });
   const bus = await start();
@@ -640,8 +640,8 @@ test('M3: a host_grants record gives Credentials a store reference at start, and
   mkdirSync(join(root, 'secrets', 'agents'), { recursive: true, mode: 0o700 });
   chmodSync(join(root, 'secrets'), 0o700);
   const demo = {
-    id: 'demo', human: 'jason', arbiters: { technical: 'coder', delivery: 'coder' },
-    roles: { coder: { authority: { withinRole: ['message.send'], crossRole: [] }, credentials: {} } },
+    id: 'demo', human: 'jason', arbiters: { technical: 'chief', delivery: 'chief' },
+    roles: {chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } },  coder: { authority: { withinRole: ['message.send'], crossRole: [] }, credentials: {} } },
   };
   const start = () => startBroker({ dataRoot: join(root, 'data'), businesses: { demo }, organization: { dir: root, rolesDir, system: systemFor(root) } });
   const hostKeys = (bus) => bus.credentials.status().filter((c) => c.service.startsWith('host.'));

packages/bus/tests/instances-verb.test.mjs

@@ -65,7 +65,7 @@ test('row 165 runtime: an add and a change reach the organization file with the
   const rolesDir = rolesCopy(root);
   writeJson(join(root, 'businesses/demo.json'), businessDoc(root, 'demo'));
   mkdirSync(join(root, 'data'), { mode: 0o700 });
-  const bus = await startBroker({ dataRoot: join(root, 'data'), businesses: { demo: { id: 'demo', human: 'jason', arbiters: { technical: 'coder', delivery: 'coder' }, roles: { coder: { authority: { withinRole: [], crossRole: [] } } } } }, organization: { dir: root, rolesDir, system: systemFor(root) } });
+  const bus = await startBroker({ dataRoot: join(root, 'data'), businesses: { demo: { id: 'demo', human: 'jason', arbiters: { technical: 'chief', delivery: 'chief' }, roles: {chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } },  coder: { authority: { withinRole: [], crossRole: [] } } } } }, organization: { dir: root, rolesDir, system: systemFor(root) } });
   t.after(async () => { await bus.close(); rmSync(root, { recursive: true, force: true }); });
   const human = bus.broker.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });
   const file = join(root, 'businesses/demo.json');

packages/bus/tests/land.test.mjs

@@ -26,7 +26,7 @@ const A = 'a'.repeat(40);
 const B = 'b'.repeat(40);
 const C = 'c'.repeat(40);
 const roles = {
-  pm: { authority: { withinRole: ['message.send'], crossRole: [] } },
+  pm: { authority: { withinRole: ['message.send', 'decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } },
   coder: { authority: { withinRole: ['git.push.working', 'review.request', 'message.send'], crossRole: [] } },
   reviewer: { authority: { withinRole: ['review.verdict', 'message.send'], crossRole: [] } },
   'merge-gate': { authority: { withinRole: [], crossRole: [MERGE] } },
@@ -221,15 +221,15 @@ test('REQ-LAND-1: a within-role merge grant refuses not-authorized at the land',
   assert.deepEqual([...w.merges(), ...w.events('action.refused')], []);
 });
 
-test('a cross-role merge that routes to the human, because merge-gate is its own arbiter, lands on the human\'s CLI answer', (t) => {
-  const w = setup(t, { arbiters: { technical: 'merge-gate', delivery: 'merge-gate' } });
+test('a cross-role merge that routes to the human, because the cto lander is its own arbiter, lands on the human\'s CLI answer', (t) => {
+  const w = setup(t, { arbiters: { technical: 'cto', delivery: 'pm' }, roles: { ...roles, cto: { authority: { withinRole: ['decision.resolve.technical'], crossRole: [MERGE] } } } });
   w.push(A);
   w.approve(A);
-  const d = w.raise();
+  const d = w.raise('cto');
   assert.deepEqual(w.routed(d), { class: 'cross-role', route_to: 'human' });
   assert.throws(() => w.resolve(d), /human-required/);
   w.resolve(d, 'yes', 'human');
-  const { ticket, by, via } = w.check({ task_ref: TASK, decision: d.id });
+  const { ticket, by, via } = w.b.checkLand(w.caps.cto, { task_ref: TASK, decision: d.id });
   assert.deepEqual([by, via], ['jason', 'cli']);
   w.b.recordLand(ticket, w.land);
   assert.equal(w.merges()[0].body.class, 'cross-role');

packages/bus/tests/launcher-released.test.mjs

@@ -119,7 +119,7 @@ const TASK = 'vikunja:1/2';
 
 test('row 302 a run landRelease released answers launcher-released, and claims nothing again', (t) => {
   const w = setup(t, {
-    pm: { authority: { withinRole: ['message.send'], crossRole: [] } },
+    pm: { authority: { withinRole: ['message.send', 'decision.resolve.technical'], crossRole: [] } },
     coder: { authority: { withinRole: ['git.push.working', 'review.request', 'message.send'], crossRole: [] } },
     reviewer: { authority: { withinRole: ['review.verdict', 'message.send'], crossRole: [] } },
     'merge-gate': { authority: { withinRole: [], crossRole: [MERGE] } },

packages/bus/tests/library-credential.test.mjs

@@ -43,9 +43,9 @@ async function until(fn, ms = 10000) {
 }
 
 const makeBusiness = ({ root, chief = true, instances = null } = {}) => ({
-  id: 'acme', human: 'jason', arbiters: { technical: 'coder', delivery: 'coder' },
+  id: 'acme', human: 'jason', arbiters: { technical: 'cto', delivery: 'pm' },
   // sage-4097 / mos-1584: the chief's declared read credential; no-chief negative fixture stays absent.
-  roles: { ...(chief ? { chief: { definition: 'chief-of-staff', ...role, credentials: { gitea: giteaReference(join(root, 'secrets', 'agents'), 'acme', 'chief', '2099-01-01') } } } : {}), coder: { definition: 'coder', ...role } },
+  roles: { cto: { definition: 'cto', authority: { withinRole: ['decision.resolve.technical'], crossRole: [] } }, pm: { definition: 'pm', authority: { withinRole: ['decision.resolve.delivery'], crossRole: [] } }, ...(chief ? { chief: { definition: 'chief-of-staff', ...role, credentials: { gitea: giteaReference(join(root, 'secrets', 'agents'), 'acme', 'chief', '2099-01-01') } } } : {}), coder: { definition: 'coder', ...role } },
   projects: { books: { ...mappingEntry(), user: 'books-bot' } },
   ...(instances ? { launch: { instances } } : {}),
 });
@@ -77,7 +77,7 @@ function world(t, options) {
 // chief-of-staff instance, fired by boss. The real read grant targets the library project books.
 function verbDoc(url, root) {
   return {
-    id: 'acme', human: 'jason', arbiters: { technical: 'boss', delivery: 'boss' },
+    id: 'acme', human: 'jason', arbiters: { technical: 'chief', delivery: 'chief' },
     roles: {
       boss: { definition: 'pm', authority: chiefAuthority },
       // sage-4097 / mos-1584: fixture projection carries the chief's own Gitea store reference.

packages/bus/tests/library-lookups.test.mjs

@@ -31,8 +31,8 @@ async function world(t, { projects, adapter, claimed = true, now = () => NOW, fi
   const f = scratchRepo(t, files), dataRoot = join(f.root, 'data');
   mkdirSync(dataRoot);
   const business = { id: 'acme', human: 'jason', vars: { 'bus.tester': true },
-    projects: projects ?? { books: mappingEntry() }, arbiters: { technical: 'coder', delivery: 'coder' },
-    roles: { coder: { definition: 'coder', authority: { withinRole: [], crossRole: [] } } } };
+    projects: projects ?? { books: mappingEntry() }, arbiters: { technical: 'chief', delivery: 'chief' },
+    roles: {chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } },  coder: { definition: 'coder', authority: { withinRole: [], crossRole: [] } } } };
   const context = { business, project: 'books', dataRoot };
   let mirror = null, state = null, fetches = 0;
   if (business.projects.books?.kind === 'library') {
@@ -222,8 +222,8 @@ test('real socket awaits lookup results and rechecks rejected query arguments',
 test('runtime actually injects the lookup adapter, without exposing human library.file', { timeout: 30_000 }, async t => {
   const f = scratchRepo(t, TEXTS), dataRoot = join(f.root, 'runtime'); mkdirSync(dataRoot);
   const business = { id: 'acme', human: 'jason', plugins: { harness: ['pi'] }, projects: { books: mappingEntry() },
-    arbiters: { technical: 'coder', delivery: 'coder' },
-    roles: { coder: { definition: 'coder', authority: { withinRole: [], crossRole: [] } } } };
+    arbiters: { technical: 'chief', delivery: 'chief' },
+    roles: {chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } },  coder: { definition: 'coder', authority: { withinRole: [], crossRole: [] } } } };
   const runtime = await startBroker({ dataRoot, businesses: { acme: business } }); t.after(() => runtime.close());
   const mirror = library.mirrorPath({ business, project: 'books', dataRoot });
   git(f.repo, '-c', 'protocol.file.allow=always', 'push', '-q', mirror, 'HEAD:refs/heads/served');

packages/bus/tests/library-sync.test.mjs

@@ -21,7 +21,7 @@ function world(t, adapter) {
   const root = mkdtempSync(join(tmpdir(), 'bus-library-sync-')), store = new Store(root);
   t.after(() => { store.close(); rmSync(root, { recursive: true, force: true }); });
   const business = { id: 'acme', human: 'jason', vars: { 'bus.tester': true },
-    projects: { books: { ...mappingEntry(), user: 'books-bot' } }, arbiters: { technical: 'coder', delivery: 'coder' }, roles: { coder: { authority: { withinRole: [], crossRole: [] } } } };
+    projects: { books: { ...mappingEntry(), user: 'books-bot' } }, arbiters: { technical: 'chief', delivery: 'chief' }, roles: {chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } },  coder: { authority: { withinRole: [], crossRole: [] } } } };
   const broker = new Broker({ store, businesses: { acme: business }, library: adapter });
   const human = broker.bindHuman({ business: 'acme', human: 'jason', via: 'cli', outsideAgent: true });
   const agent = broker.bindLaunch({ business: 'acme', role: 'coder', run: 'library-sync-agent', harness: 'pi' });
@@ -81,7 +81,7 @@ test('C2-03a runtime: the timer syncs each entry with a user at start and on eac
   mkdirSync(dataRoot, { mode: 0o700 });
   mkdirSync(join(configDir, 'secrets', 'acme'), { recursive: true, mode: 0o700 });
   writeFileSync(join(configDir, 'secrets', 'acme', library.SLOT), TOKEN + '\n', { mode: 0o600 });
-  const business = { id: 'acme', human: 'jason', arbiters: { technical: 'coder', delivery: 'coder' }, roles: { coder: { authority: { withinRole: [], crossRole: [] } } },
+  const business = { id: 'acme', human: 'jason', arbiters: { technical: 'chief', delivery: 'chief' }, roles: {chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } },  coder: { authority: { withinRole: [], crossRole: [] } } },
     projects: { books: { ...mappingEntry(), user: 'books-bot' }, quiet: mappingEntry() } };
   const calls = [];
   // A git that succeeds without fetching: the remote-tracking ref stays absent, so each pass fails.

packages/bus/tests/library-write.test.mjs

@@ -234,8 +234,8 @@ test('C2-02 F2/E6 runtime: human saves/reverts use editor.user; no login never u
     const pushes = [];
     const command = (kind, url, options) => { if (kind === 'push') pushes.push(options.user); return bare.command(kind, url, options); };
     const initial = (await bare.state()).lastFetch;
-    const business = { ...bare.context.business, human: 'jason', roles: { coder: { authority: { withinRole: [], crossRole: [] } } },
-      arbiters: { technical: 'coder', delivery: 'coder' } };
+    const business = { ...bare.context.business, human: 'jason', roles: {chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } },  coder: { authority: { withinRole: [], crossRole: [] } } },
+      arbiters: { technical: 'chief', delivery: 'chief' } };
     const runtime = await startBroker({ dataRoot: bare.context.dataRoot, businesses: { acme: business },
       librarySync: { configDir, command, intervalMs: 60000 } });
     try {

packages/bus/tests/library.test.mjs

@@ -16,7 +16,7 @@ function world(t, adapter = {}) {
   const root = mkdtempSync(join(tmpdir(), 'bus-library-')), store = new Store(root);
   t.after(() => { store.close(); rmSync(root, { recursive: true, force: true }); });
   const business = { id: 'acme', human: 'jason', vars: { 'bus.tester': true },
-    projects: { books: mappingEntry() }, arbiters: { technical: 'coder', delivery: 'coder' }, roles: { coder: { authority: { withinRole: [], crossRole: [] } } } };
+    projects: { books: mappingEntry() }, arbiters: { technical: 'chief', delivery: 'chief' }, roles: {chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } },  coder: { authority: { withinRole: [], crossRole: [] } } } };
   const broker = new Broker({ store, businesses: { acme: business }, library: adapter });
   const human = broker.bindHuman({ business: 'acme', human: 'jason', via: 'cli', outsideAgent: true });
   const agent = broker.bindLaunch({ business: 'acme', role: 'coder', run: 'library-agent', harness: 'pi' });
@@ -68,7 +68,7 @@ test('C2-04 runtime: protectedRoots skips library but retains real code-root cre
   const f = repo(t), dataRoot = join(f.root, 'data'), token = join(f.root, 'fixture-token');
   mkdirSync(dataRoot, { mode: 0o700 }); writeFileSync(token, 'made-up-fixture-token-123456', { mode: 0o600 });
   const business = { id: 'acme', human: 'jason', projects: { books: mappingEntry(), stack: { root: f.repo } },
-    arbiters: { technical: 'coder', delivery: 'coder' }, roles: { coder: { authority: { withinRole: [], crossRole: [] }, credentials: { gitea: { file: token, rotateBy: '2099-01-01' } } } } };
+    arbiters: { technical: 'chief', delivery: 'chief' }, roles: {chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } },  coder: { authority: { withinRole: [], crossRole: [] }, credentials: { gitea: { file: token, rotateBy: '2099-01-01' } } } } };
   const runtime = await startBroker({ dataRoot, businesses: { acme: business } });
   await runtime.close();
   const mirror = library.mirrorPath({ business, project: 'books', dataRoot });
@@ -81,7 +81,7 @@ test('C2-04 runtime: protectedRoots skips library but retains real code-root cre
 test('C2-04 runtime: unsafe existing mirror refuses boot and never publishes a socket', async t => {
   const f = repo(t), dataRoot = join(f.root, 'data');
   mkdirSync(dataRoot, { mode: 0o700 });
-  const business = { id: 'acme', human: 'jason', projects: { books: mappingEntry() }, arbiters: { technical: 'coder', delivery: 'coder' }, roles: { coder: { authority: { withinRole: [], crossRole: [] } } } };
+  const business = { id: 'acme', human: 'jason', projects: { books: mappingEntry() }, arbiters: { technical: 'chief', delivery: 'chief' }, roles: {chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } },  coder: { authority: { withinRole: [], crossRole: [] } } } };
   const mirror = join(dataRoot, 'projects/acme/books'); mkdirSync(mirror, { recursive: true });
   writeFileSync(join(mirror, 'keep'), 'made-up note');
   await assert.rejects(startBroker({ dataRoot, businesses: { acme: business } }), { code: 'library-git' });
@@ -92,7 +92,7 @@ test('C2-04 runtime: unsafe existing mirror refuses boot and never publishes a s
 test('C2-04 runtime: real library adapters reach the socket and lock waits leave other bus reads responsive', { timeout: 15000 }, async t => {
   const f = repo(t), dataRoot = join(f.root, 'data');
   mkdirSync(dataRoot, { mode: 0o700 });
-  const business = { id: 'acme', human: 'jason', projects: { books: mappingEntry() }, arbiters: { technical: 'coder', delivery: 'coder' }, roles: { coder: { authority: { withinRole: [], crossRole: [] } } } };
+  const business = { id: 'acme', human: 'jason', projects: { books: mappingEntry() }, arbiters: { technical: 'chief', delivery: 'chief' }, roles: {chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } },  coder: { authority: { withinRole: [], crossRole: [] } } } };
   const runtime = await startBroker({ dataRoot, businesses: { acme: business } });
   t.after(() => runtime.close());
   const cap = runtime.broker.bindHuman({ business: 'acme', human: 'jason', via: 'cli', outsideAgent: true });

packages/bus/tests/lifecycle-verbs.test.mjs

@@ -26,7 +26,7 @@ const doc = (extra = {}) => ({
   retired: ['old'],
   ...extra,
 });
-const OTHER = { id: 'other', human: 'jason', arbiters: { technical: 'only-there', delivery: 'only-there' }, roles: { 'only-there': none } };
+const OTHER = { id: 'other', human: 'jason', arbiters: { technical: 'chief', delivery: 'chief' }, roles: {chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } },  'only-there': none } };
 
 function setup(t, { organization = null, testerOn = undefined, processing = undefined } = {}) {
   const root = mkdtempSync(join(tmpdir(), 'lifecycle-verbs-'));
@@ -349,7 +349,7 @@ test('row 194 V5 retry: a retired name deletes again only after workspace-rename
   const { transaction } = f.b.lifecycleDelete({ business: 'demo', request });
   f.done(request, { transaction, refusal: 'workspace-rename-failed' });
   // The bus reloads after the commit, as the runtime does.
-  const next = doc({ retired: ['old', 'pm'], arbiters: { technical: 'coder', delivery: 'chief' } });
+  const next = doc({ retired: ['old', 'pm'], arbiters: { technical: 'chief', delivery: 'chief' } });
   delete next.roles.pm;
   f.b.reloadBusiness('demo', next);
   const writes = w.calls.length;

packages/bus/tests/limit-stop.test.mjs

@@ -13,8 +13,8 @@ import { Broker } from '../src/broker.mjs';
 
 const shipped = name => JSON.parse(readFileSync(fileURLToPath(new URL(`../../../roles/${name}.json`, import.meta.url)), 'utf8'));
 const businesses = () => ({ demo: {
-  id: 'demo', human: 'jason', arbiters: { technical: 'coder', delivery: 'coder' },
-  roles: {
+  id: 'demo', human: 'jason', arbiters: { technical: 'chief', delivery: 'chief' },
+  roles: {chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } },
     coder: { definition: 'coder', authority: { withinRole: ['message.send'], crossRole: [] } },
     assistant: { definition: 'assistant', authority: { withinRole: ['message.send'], crossRole: [] } },
   },

packages/bus/tests/limits-runtime.test.mjs

@@ -20,8 +20,8 @@ async function setup(t, plugins, limit = 0) {
   writeJson(join(root, 'businesses/demo.json'), doc);
   mkdirSync(join(root, 'data'), { mode: 0o700 });
   const bus = await startBroker({ dataRoot: join(root, 'data'),
-    businesses: { demo: { id: 'demo', human: 'jason', arbiters: { technical: 'coder', delivery: 'coder' },
-      roles: { coder: { definition: 'coder', authority: { withinRole: [], crossRole: [] } } }, definitions: { coder: {} }, projects: { stack: { root: '/nonexistent' } } } },
+    businesses: { demo: { id: 'demo', human: 'jason', arbiters: { technical: 'chief', delivery: 'chief' },
+      roles: {chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } },  coder: { definition: 'coder', authority: { withinRole: [], crossRole: [] } } }, definitions: { coder: {} }, projects: { stack: { root: '/nonexistent' } } } },
     organization: { dir: root, rolesDir, system: systemFor(root) } });
   t.after(async () => { await bus.close(); rmSync(root, { recursive: true, force: true }); });
   return { bus, human: bus.broker.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true }) };

packages/bus/tests/limits.test.mjs

@@ -8,7 +8,7 @@ import {Broker} from '../src/broker.mjs';
 import {Store} from '../src/store.mjs';
 test('limits binds actor from human proof and rejects role, reader, a tester set and forged actor',t=>{
  const root=mkdtempSync(join(tmpdir(),'mosaic-limits-bus-')),store=new Store(root);t.after(()=>{store.close();rmSync(root,{recursive:true,force:true});});const calls=[];
- const b=new Broker({store,businesses:{demo:{id:'demo',human:'jason',arbiters:{technical:'coder',delivery:'coder'},vars:{'bus.tester':true},roles:{coder:{authority:{withinRole:[],crossRole:[]}}}}},organization:(...args)=>{calls.push(args);return {revision:'b'.repeat(64)};}});
+ const b=new Broker({store,businesses:{demo:{id:'demo',human:'jason',arbiters:{technical:'chief',delivery:'chief'},vars:{'bus.tester':true},roles:{chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } }, coder:{authority:{withinRole:[],crossRole:[]}}}}},organization:(...args)=>{calls.push(args);return {revision:'b'.repeat(64)};}});
  const human=b.bindHuman({business:'demo',human:'jason',via:'cli',outsideAgent:true}),role=b.bindLaunch({business:'demo',role:'coder',run:'coder-run',harness:'pi',address:'coder-run'}),reader=b.bindReader({business:'demo'}),tester=b.bindTester({business:'demo'}),patch={revision:'a'.repeat(64),limits:{total:0}};
  for(const cap of [role,reader])for(const verb of ['limits','limits.set'])assert.throws(()=>b.request(cap,{verb,args:verb==='limits'?{}:patch}),/human-required/);
  // Row 175 (#1673): the tester reads limits; limits.set stays the human's.
@@ -19,7 +19,7 @@ test('limits binds actor from human proof and rejects role, reader, a tester set
 test('runtime wires verified human settings to the actual shared file writer and actor receipt',async t=>{
  const {startBroker}=await import('../src/runtime.mjs');const {businessDoc,rolesCopy,systemFor,writeJson}=await import('../../organization/tests/helpers.mjs');const {readFileSync}=await import('node:fs');
  const root=mkdtempSync(join(tmpdir(),'mosaic-limits-runtime-')),rolesDir=rolesCopy(root),doc=businessDoc(root,'demo');writeJson(join(root,'businesses/demo.json'),doc);mkdirSync(join(root,'data'),{mode:0o700});
- const bus=await startBroker({dataRoot:join(root,'data'),businesses:{demo:{id:'demo',human:'jason',arbiters:{technical:'coder',delivery:'coder'},roles:{coder:{authority:{withinRole:[],crossRole:[]}}}}},organization:{dir:root,rolesDir,system:systemFor(root)}});
+ const bus=await startBroker({dataRoot:join(root,'data'),businesses:{demo:{id:'demo',human:'jason',arbiters:{technical:'chief',delivery:'chief'},roles:{chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } }, coder:{authority:{withinRole:[],crossRole:[]}}}}},organization:{dir:root,rolesDir,system:systemFor(root)}});
  t.after(async()=>{await bus.close();rmSync(root,{recursive:true,force:true});});const human=bus.broker.bindHuman({business:'demo',human:'jason',via:'cli',outsideAgent:true});
  const view=bus.broker.request(human,{verb:'limits'});const done=bus.broker.request(human,{verb:'limits.set',args:{revision:view.revision,limits:{total:0}}});assert.equal(done.limits.total,0);assert.equal(JSON.parse(readFileSync(join(root,'businesses/demo.json'),'utf8')).launch.limits.total,0);const receipt=JSON.parse(readFileSync(join(root,'businesses/.history/demo/changes.jsonl'),'utf8').trim().split('\n').at(-1));assert.equal(receipt.actor,'jason');assert.equal(receipt.state,'committed');
 });
@@ -28,7 +28,7 @@ test('uncertain organization receipts leave bus startup and reads alone but refu
  const root=mkdtempSync(join(tmpdir(),'mosaic-limits-recovery-')),rolesDir=rolesCopy(root),doc=businessDoc(root,'demo'),file=writeJson(join(root,'businesses/demo.json'),doc);mkdirSync(join(root,'data'),{mode:0o700});
  const writer=organizationWriter({dir:root,rolesDir}),original=readFileSync(file,'utf8'),revision=writer.read('demo').revision,next=structuredClone(doc);next.launch.limits.total=7;
  const interrupted=organizationWriter({dir:root,rolesDir,barrier:()=>{throw Error('fixture interruption');}});assert.throws(()=>interrupted.write('demo',next,{revision,actor:'jason'}));const external=structuredClone(doc);external.launch.limits.total=12;writeJson(file,external);const bytes=readFileSync(file,'utf8');
- const bus=await startBroker({dataRoot:join(root,'data'),businesses:{demo:{id:'demo',human:'jason',arbiters:{technical:'coder',delivery:'coder'},roles:{coder:{authority:{withinRole:[],crossRole:[]}}}}},organization:{dir:root,rolesDir,system:systemFor(root)}});t.after(async()=>{await bus.close();rmSync(root,{recursive:true,force:true});});
+ const bus=await startBroker({dataRoot:join(root,'data'),businesses:{demo:{id:'demo',human:'jason',arbiters:{technical:'chief',delivery:'chief'},roles:{chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } }, coder:{authority:{withinRole:[],crossRole:[]}}}}},organization:{dir:root,rolesDir,system:systemFor(root)}});t.after(async()=>{await bus.close();rmSync(root,{recursive:true,force:true});});
  const human=bus.broker.bindHuman({business:'demo',human:'jason',via:'cli',outsideAgent:true});const view=bus.broker.request(human,{verb:'limits'});assert.equal(view.limits.total,12);assert.throws(()=>bus.broker.request(human,{verb:'limits.set',args:{revision:view.revision,limits:{total:1}}}),/organization-uncertain/);assert.equal(readFileSync(file,'utf8'),bytes);
  // The operator reconciles the fixture to the recorded old whole document.
  writeJson(file,original);const reconciled=bus.broker.request(human,{verb:'limits'});const result=bus.broker.request(human,{verb:'limits.set',args:{revision:reconciled.revision,limits:{total:1}}});assert.equal(result.limits.total,1);

packages/bus/tests/message-citation.test.mjs

@@ -15,7 +15,7 @@ function fixture(t, cross = false) {
     arbiters: { technical: 'cto', delivery: 'pm' },
     roles: {
       pm: role(cross ? [] : ['message.send'], cross ? ['message.send'] : []),
-      cto: role(),
+      cto: role(['decision.resolve.technical']),
       coder: role(),
     },
   });

packages/bus/tests/model-catalogue.test.mjs

@@ -46,7 +46,7 @@ test('launch admission refreshes selection and refuses a removed model and incom
   writeJson(join(root,'businesses/demo.json'),doc); mkdirSync(join(root,'data'),{mode:0o700});
   let present=true, reads=0;
   const service={invalidate(){},read:async(_,{fresh})=>{assert.equal(fresh,true);reads++;return {status:'ready',models:present?[{module:'cliproxy',upstream:'zai',model:'fixture-id',available:true,harnesses:['pi']}]:[]};}};
-  const bus=await startBroker({dataRoot:join(root,'data'),businesses:{demo:{id:'demo',human:'jason',arbiters:{technical:'coder',delivery:'coder'},roles:{coder:{authority:{withinRole:[],crossRole:[]}}}}},organization:{dir:root,rolesDir,system:systemFor(root)},modelCatalogue:service});t.after(()=>bus.close());
+  const bus=await startBroker({dataRoot:join(root,'data'),businesses:{demo:{id:'demo',human:'jason',arbiters:{technical:'chief',delivery:'chief'},roles:{chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } }, coder:{authority:{withinRole:[],crossRole:[]}}}}},organization:{dir:root,rolesDir,system:systemFor(root)},modelCatalogue:service});t.after(()=>bus.close());
   const human=bus.broker.bindHuman({business:'demo',human:'jason',via:'cli',outsideAgent:true});
   const revision=bus.broker.request(human,{verb:'limits'}).revision;
   const {checkedTransport}=await import('../../harness/src/bundle.mjs');
@@ -78,7 +78,7 @@ test('a different enabled fixture provider supplies legacy mapping and admission
  const makeProviderLoader=()=>({load:async()=>({refused:[]}),snapshot:()=>[{name:'second-fixture',module}]});
  const offered={key:'fixture-model',module:'second-fixture',upstream:'fixture',provider:'fixture',model:'fixture-model',label:'Fixture',available:true,reason:null,harnesses:['pi']};
  const modelCatalogue={read:async()=>({status:'ready',models:[offered],notices:[]}),invalidate(){}};
- const bus=await startBroker({dataRoot:join(root,'data'),businesses:{demo:{id:'demo',human:'jason',arbiters:{technical:'coder',delivery:'coder'},roles:{coder:{authority:{withinRole:[],crossRole:[]}}}}},organization:{dir:root,rolesDir,system:systemFor(root)},modelCatalogue,makeProviderLoader});t.after(()=>bus.close());
+ const bus=await startBroker({dataRoot:join(root,'data'),businesses:{demo:{id:'demo',human:'jason',arbiters:{technical:'chief',delivery:'chief'},roles:{chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } }, coder:{authority:{withinRole:[],crossRole:[]}}}}},organization:{dir:root,rolesDir,system:systemFor(root)},modelCatalogue,makeProviderLoader});t.after(()=>bus.close());
  const human=bus.broker.bindHuman({business:'demo',human:'jason',via:'cli',outsideAgent:true});const view=await bus.broker.request(human,{verb:'routes'});
  assert.equal(view.catalogue.legacy['fixture-legacy'].module,'second-fixture');
  const answer=await bus.modelAdmission({business:'demo',instance:'coder',modelKey:'fixture-legacy',harness:'pi',revision:view.revision,entry:doc.launch.models['fixture-legacy'],provider:'fixture',model:'fixture-model',account:null,route:'primary',transport});

packages/bus/tests/model-hire-ownership-fixture.mjs

@@ -27,7 +27,7 @@ export async function ownershipFixture(t,{launches=true,listed=true,keep=false,r
  t.after(async()=>{const failures=[];for(const g of gates)g.release();try{await waitFor(()=>active.size===0,'owned operations did not settle',5000);}catch{failures.push('owned-operation-close');}for(const close of [...closers].reverse()){try{await close();}catch{failures.push('owned-close');}}try{server?.closeAllConnections();if(server?.listening)await new Promise((resolve,reject)=>server.close(e=>e?reject(e):resolve()));}catch{failures.push('owned-server-close');}try{checkHistory({logs,proxyReceipts,trace});}catch{failures.push('value-free-receipts');}try{checkHistory({launch:launchLog()});}catch{failures.push('owned-launch-log-guard');}if(stderr)process.stderr.write=stderr;try{fs.rmSync(root,{recursive:true,force:true});}catch{failures.push('owned-root-close');}if(failures.length)throw new AggregateError(failures.map(code=>Error(code)),'owned managed fixture cleanup failed');});
  const f=fixture(root,'acme',doc=>{doc.plugins={...doc.plugins,harness:['pi']};for(const role of Object.values(doc.roles))role.vars={...role.vars,harness:'pi'};doc.roles.chief.vars.model='claude-opus-5-5';doc.roles.aide={definition:'aide',vars:{harness:'pi',model:'claude-opus-5-5',thinking:'high'}};if(listed)doc.launch.instances.push('aide');if(keep)doc.launch.keep=['aide'];if(retired)doc.retired=['alpha'];if(noHire)doc.launch.noHire=['aide'];return doc;});
  // The established scratch aide pattern only; repository roles/policy stay untouched.
- for(const name of ['aide','helper']){fs.writeFileSync(join(f.roles,name+'.md'),'# Scratch aide\n');writeJson(join(f.roles,name+'.json'),{roleVersion:2,name,title:'Aide',contract:name+'.md',tools:['read'],network:'api-only',authority:{withinRole:['message.send'],crossRole:[]},credentials:[]});}
+ for(const name of ['aide','helper']){fs.writeFileSync(join(f.roles,name+'.md'),'# Scratch aide\n\n## Authority\n');writeJson(join(f.roles,name+'.json'),{roleVersion:2,name,title:'Aide',contract:name+'.md',tools:['read'],network:'api-only',authority:{withinRole:['message.send'],crossRole:[]},credentials:[]});}
  const chiefFile=join(f.roles,'chief-of-staff.json');writeJson(chiefFile,{...JSON.parse(fs.readFileSync(chiefFile,'utf8')),hireable:['aide','helper']});
  const env={PATH:process.env.PATH,HOME:process.env.HOME,TMPDIR:process.env.TMPDIR,MOSAIC_CONFIG:f.config,MOSAIC_ROLES_DIR:f.roles};
  const configDir=join(root,'config'),prefix=`msk-${id(configDir)}-`,sentinel=prefix+'sentinel-'+randomBytes(32).toString('base64url');history.add(sentinel);

packages/bus/tests/model-keys.test.mjs

@@ -176,7 +176,7 @@ test('proxy-stop-failed: old proxy key and retiring record survive a failed grac
 async function bootBusiness(f, binding = {}) {
   const rolesDir = rolesCopy(f.root), system = systemFor(f.root), doc = businessDoc(f.root, 'demo');
   // Aide is needed because shipped chief hireable:[] and security-reviewer has review.verdict outside HIRE_ALLOWED.
-  fs.writeFileSync(join(rolesDir, 'aide.md'), '# Aide\n');
+  fs.writeFileSync(join(rolesDir, 'aide.md'), '# Aide\n\n## Authority\n');
   writeJson(join(rolesDir, 'aide.json'), {
     roleVersion: 2, name: 'aide', title: 'Aide', contract: 'aide.md', tools: ['read'], network: 'api-only',
     authority: { withinRole: ['message.send'], crossRole: [] }, credentials: [],

packages/bus/tests/model-orphan-hire.test.mjs

@@ -15,7 +15,7 @@ async function hireFixture(t,{revoking=false}={}){
  if(revoking){const r=old.credentials.modelRecord('demo/orphan');old.credentials.writeModel('demo/orphan',{...r,state:'revoking',revokingAt:'2026-10-25T00:00:00.000Z'});}old.credentials.close();
  const rolesDir=rolesCopy(f.root),system=systemFor(f.root),doc=businessDoc(f.root,'demo');
  // Scratch aide: shipped chief hireable:[] and review.verdict is outside HIRE_ALLOWED.
- fs.writeFileSync(join(rolesDir,'aide.md'),'# Aide\n');writeJson(join(rolesDir,'aide.json'),{roleVersion:2,name:'aide',title:'Aide',contract:'aide.md',tools:['read'],network:'api-only',authority:{withinRole:['message.send'],crossRole:[]},credentials:[]});
+ fs.writeFileSync(join(rolesDir,'aide.md'),'# Aide\n\n## Authority\n');writeJson(join(rolesDir,'aide.json'),{roleVersion:2,name:'aide',title:'Aide',contract:'aide.md',tools:['read'],network:'api-only',authority:{withinRole:['message.send'],crossRole:[]},credentials:[]});
  const chiefFile=join(rolesDir,'chief-of-staff.json');writeJson(chiefFile,{...JSON.parse(fs.readFileSync(chiefFile,'utf8')),hireable:['aide']});doc.plugins={...doc.plugins,harness:['pi']};
  const file=writeJson(join(f.configDir,'businesses','demo.json'),doc);fs.writeFileSync(join(f.configDir,'secrets','proxy-management.key'),'fx651-manage',{mode:0o600});
  const business=loadBusiness('demo',{dir:f.configDir,rolesDir}),resolved={};for(const instance of Object.keys(business.roles))resolved[instance]=resolveInstance({system,business,instance});

packages/bus/tests/model-pending-fixture.mjs

@@ -22,7 +22,7 @@ export async function pendingFixture(t,{twoBusinesses=false}={}){
  const configDir=join(root,'config'),dataRoot=join(root,'data'),rolesDir=rolesCopy(root),system=systemFor(root);fs.mkdirSync(dataRoot,{mode:0o700});
  const doc=businessDoc(root,'demo');doc.plugins={...doc.plugins,harness:['pi']};
  // Existing row331 scratch aide pattern only; repository role authority unchanged.
- fs.writeFileSync(join(rolesDir,'aide.md'),'# Aide\n');writeJson(join(rolesDir,'aide.json'),{roleVersion:2,name:'aide',title:'Aide',contract:'aide.md',tools:['read'],network:'api-only',authority:{withinRole:['message.send'],crossRole:[]},credentials:[]});const chiefFile=join(rolesDir,'chief-of-staff.json');writeJson(chiefFile,{...JSON.parse(fs.readFileSync(chiefFile,'utf8')),hireable:['aide']});
+ fs.writeFileSync(join(rolesDir,'aide.md'),'# Aide\n\n## Authority\n');writeJson(join(rolesDir,'aide.json'),{roleVersion:2,name:'aide',title:'Aide',contract:'aide.md',tools:['read'],network:'api-only',authority:{withinRole:['message.send'],crossRole:[]},credentials:[]});const chiefFile=join(rolesDir,'chief-of-staff.json');writeJson(chiefFile,{...JSON.parse(fs.readFileSync(chiefFile,'utf8')),hireable:['aide']});
  const ids=twoBusinesses?['demo','other']:['demo'],files={},businesses={};for(const name of ids){const document={...structuredClone(doc),id:name};files[name]=writeJson(join(configDir,'businesses',name+'.json'),document);const business=loadBusiness(name,{dir:configDir,rolesDir}),resolved={};for(const instance of Object.keys(business.roles))resolved[instance]=resolveInstance({system,business,instance});businesses[name]=busOrganization(business,resolved);}
  fs.mkdirSync(join(configDir,'secrets'),{recursive:true,mode:0o700});fs.writeFileSync(join(configDir,'secrets','proxy-management.key'),'fx654-manage',{mode:0o600});fs.mkdirSync(join(dataRoot,'bus-host'),{recursive:true,mode:0o700});writeJson(sessionsFile(dataRoot),{sessionsVersion:SESSIONS_VERSION,sessions:[]});
  const sentinel=`msk-${hash(configDir).slice(0,12)}-sentinel-${randomBytes(32).toString('base64url')}`;state.keys.push(sentinel);history.add(sentinel);

packages/bus/tests/model-proxy.test.mjs

@@ -7,7 +7,7 @@ import { join } from 'node:path';
 import { Broker } from '../src/broker.mjs';
 import { Store } from '../src/store.mjs';
 const role={authority:{withinRole:['message.send'],crossRole:[]}};
-function fixture(t,proxyInit){const store=new Store(mkdtempSync(join(tmpdir(),'p1-bus-')));t.after(()=>store.close());const b=new Broker({store,proxyInit,businesses:{demo:{id:'demo',human:'owner',arbiters:{technical:'coder',delivery:'coder'},vars:{'bus.tester':true},roles:{coder:role}}}});return {store,b,human:b.bindHuman({business:'demo',human:'owner',via:'cli',outsideAgent:true}),tester:b.bindTester({business:'demo'}),reader:b.bindReader({business:'demo'}),agent:b.bindLaunch({business:'demo',role:'coder',run:'p1-run',harness:'pi'})};}
+function fixture(t,proxyInit){const store=new Store(mkdtempSync(join(tmpdir(),'p1-bus-')));t.after(()=>store.close());const b=new Broker({store,proxyInit,businesses:{demo:{id:'demo',human:'owner',arbiters:{technical:'chief',delivery:'chief'},vars:{'bus.tester':true},roles:{chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } }, coder:role}}}});return {store,b,human:b.bindHuman({business:'demo',human:'owner',via:'cli',outsideAgent:true}),tester:b.bindTester({business:'demo'}),reader:b.bindReader({business:'demo'}),agent:b.bindLaunch({business:'demo',role:'coder',run:'p1-run',harness:'pi'})};}
 test('proxy.init only accepts path-bound outside-agent human; refuses agent/tester/reader',async t=>{const calls=[];const f=fixture(t,async a=>{calls.push(a);return {port:a.port,binary:'/fixture'};});for(const cap of [f.tester,f.agent])assert.throws(()=>f.b.request(cap,{verb:'proxy.init',args:{key:'p1-management'}}),e=>e.code==='human-required');assert.throws(()=>f.b.request(f.reader,{verb:'proxy.init',args:{key:'p1-management'}}),e=>e.code==='read-only');assert.equal(calls.length,0);assert.deepEqual(await f.b.request(f.human,{verb:'proxy.init',args:{key:'p1-management',port:18432}}),{port:18432,binary:'/fixture'});assert.equal(JSON.stringify(f.store.all('SELECT body FROM events')).includes('p1-management'),false);});
 for(const [code,args]of [['proxy-key-invalid',{key:'a\nb'}],['proxy-config-invalid',{key:'p1-management',port:8317}],['invalid-request',{key:'p1-management',binary:'/forged'}]])test(`proxy.init ${code}`,t=>{const f=fixture(t,()=>{throw Error('must not call');});assert.throws(()=>f.b.request(f.human,{verb:'proxy.init',args}),e=>e.code===code);});
 test('proxy.init not-configured',t=>{const f=fixture(t,null);assert.throws(()=>f.b.request(f.human,{verb:'proxy.init',args:{key:'p1-management'}}),e=>e.code==='not-configured');});

packages/bus/tests/model-revocation-fixture.mjs

@@ -51,7 +51,7 @@ export async function revocationFixture(t,{runtime=false,onRoot=()=>{},missingBo
  let boot,writer,chief,human,busBoots=0;
  if(runtime){
   const rolesDir=rolesCopy(root),system=systemFor(root),doc=businessDoc(root,'demo');doc.plugins={...doc.plugins,harness:['pi']};doc.roles.aide={definition:'aide',vars:{harness:'pi',model:'claude-opus-5-5',thinking:'high'}};doc.launch.instances.push('aide');
-  fs.writeFileSync(join(rolesDir,'aide.md'),'# Aide\n');writeJson(join(rolesDir,'aide.json'),{roleVersion:2,name:'aide',title:'Aide',contract:'aide.md',tools:['read'],network:'api-only',authority:{withinRole:['message.send'],crossRole:[]},credentials:[]});writeJson(join(configDir,'businesses','demo.json'),doc);
+  fs.writeFileSync(join(rolesDir,'aide.md'),'# Aide\n\n## Authority\n');writeJson(join(rolesDir,'aide.json'),{roleVersion:2,name:'aide',title:'Aide',contract:'aide.md',tools:['read'],network:'api-only',authority:{withinRole:['message.send'],crossRole:[]},credentials:[]});writeJson(join(configDir,'businesses','demo.json'),doc);
   const business=loadBusiness('demo',{dir:configDir,rolesDir}),resolved={};for(const name of Object.keys(business.roles))resolved[name]=resolveInstance({system,business,instance:name});
   boot={dataRoot,businesses:{demo:busOrganization(business,resolved)},organization:{dir:configDir,rolesDir,system},proxy:{port,binary:'/fixture-unused'}};writer=organizationWriter({dir:configDir,rolesDir});
   stderr=process.stderr.write;process.stderr.write=function(chunk,...args){if(String(chunk).startsWith('model-proxy: ')){receipts.push(String(chunk));args.find(a=>typeof a==='function')?.();return true;}return stderr.call(this,chunk,...args);};

packages/bus/tests/names.test.mjs

@@ -24,7 +24,7 @@ const demo = () => ({
   demo: {
     id: 'demo',
     human: 'jason',
-    arbiters: { technical: 'lead', delivery: 'chief' },
+    arbiters: { technical: 'chief', delivery: 'chief' },
     roles,
     definitions: { reviewer: {} },
     vars: { 'bus.tester': true },

packages/bus/tests/p5-key-context.test.mjs

@@ -9,7 +9,7 @@ import { createLimits, modelUsageKey } from '../src/limits.mjs';
 const key='012345abcdef';
 test('P5 broker preserves original plugin subject and derives internal run context from authenticated native caller',async t=>{
  const root=mkdtempSync(join(tmpdir(),'p5-context-')),store=new Store(root),asked=[];t.after(()=>{store.close();rmSync(root,{recursive:true,force:true});});
- const b=new Broker({store,businesses:{demo:{id:'demo',human:'jason',arbiters:{technical:'coder',delivery:'coder'},roles:{coder:{authority:{withinRole:[],crossRole:[]}}}}},
+ const b=new Broker({store,businesses:{demo:{id:'demo',human:'jason',arbiters:{technical:'chief',delivery:'chief'},roles:{chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } }, coder:{authority:{withinRole:[],crossRole:[]}}}}},
   limits:{mustStop:async(...args)=>{asked.push(args);return {stop:false};}},usage:{collect:async()=>({recorded:true}),view:()=>({})}});
  const human=b.bindHuman({business:'demo',human:'jason',via:'cli',outsideAgent:true});
  const cap=b.bindLaunch({business:'demo',role:'coder',run:'native-run',harness:'pi',provider:'fixture',model:'fake'});b.request(cap,{verb:'role.claim'});

packages/bus/tests/p5-runtime.test.mjs

@@ -30,7 +30,7 @@ test('P5 real runtime binds stack usage to issued key, daily stops at stack coun
  });
  await new Promise(r=>server.listen(0,'127.0.0.1',r));let bus;
  t.after(async()=>{await bus?.close();await new Promise(r=>server.close(r));rmSync(root,{recursive:true,force:true});});
- bus=await startBroker({dataRoot:data,businesses:{demo:{id:'demo',human:'jason',plugins:doc.plugins,arbiters:{technical:'coder',delivery:'coder'},roles:{coder:{definition:'coder',authority:{withinRole:[],crossRole:[]}}}}},
+ bus=await startBroker({dataRoot:data,businesses:{demo:{id:'demo',human:'jason',plugins:doc.plugins,arbiters:{technical:'chief',delivery:'chief'},roles:{chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } }, coder:{definition:'coder',authority:{withinRole:[],crossRole:[]}}}}},
   organization:{dir:config,rolesDir,system:systemFor(config)},proxy:{port:server.address().port,binary:'/fixture-unused'}});
  assert.equal(calls.some(p=>p.includes('usage/queue')),false);
  const model=await bus.modelPreflight({business:'demo',role:'coder'}),keyId=hash(model.key);
@@ -77,7 +77,7 @@ test('R4 real runtime: a quota spent on A and moved to B with no reset still ref
  });
  await new Promise(r=>server.listen(0,'127.0.0.1',r));let bus;
  t.after(async()=>{await bus?.close();await new Promise(r=>server.close(r));rmSync(root,{recursive:true,force:true});});
- bus=await startBroker({dataRoot:data,businesses:{demo:{id:'demo',human:'jason',plugins:doc.plugins,arbiters:{technical:'coder',delivery:'coder'},roles:{coder:{definition:'coder',authority:{withinRole:[],crossRole:[]}}}}},
+ bus=await startBroker({dataRoot:data,businesses:{demo:{id:'demo',human:'jason',plugins:doc.plugins,arbiters:{technical:'chief',delivery:'chief'},roles:{chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } }, coder:{definition:'coder',authority:{withinRole:[],crossRole:[]}}}}},
   organization:{dir:config,rolesDir,system:systemFor(config)},proxy:{port:server.address().port,binary:'/fixture-unused'}});
  const stored=()=>JSON.parse(readFileSync(join(config,'businesses/demo.json'),'utf8')).launch.limits.tokens.keys;
  const may=async()=>(await bus.mayLaunch({business:'demo',instance:'coder',provider:'fixture',model:'fake'})).allow;

packages/bus/tests/p5-telemetry-fixture.mjs

@@ -64,7 +64,7 @@ export async function telemetryFixture(t, { foreign = false, hold = false, waitM
   });
   await new Promise(resolve=>server.listen(0,'127.0.0.1',resolve));
   let bus=null,startPromise=null,closePromise=null;
-  const start=()=>startPromise??=(startBroker({dataRoot:data,...(orgMode ? {instanceRoot:root} : {}),businesses:{demo:{id:'demo',human:'jason',plugins:doc.plugins,arbiters:{technical:'coder',delivery:'coder'},roles:{coder:{definition:'coder',authority:{withinRole:[],crossRole:[]}}}}},
+  const start=()=>startPromise??=(startBroker({dataRoot:data,...(orgMode ? {instanceRoot:root} : {}),businesses:{demo:{id:'demo',human:'jason',plugins:doc.plugins,arbiters:{technical:'chief',delivery:'chief'},roles:{chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } }, coder:{definition:'coder',authority:{withinRole:[],crossRole:[]}}}}},
     organization:{dir:config,rolesDir,system:systemFor(config)},proxy:{port:server.address().port,binary:'/fixture-unused'}}).then(value=>(bus=value)));
   const release=(fail=false)=>{state.hold=false;for(const res of state.held.splice(0)){if(res.destroyed)continue;if(fail){res.writeHead(503);res.end('{}');}else answerQueue(res);}};
   const close=()=>bus?(closePromise??=bus.close()):Promise.resolve();

packages/bus/tests/plugins-verb.test.mjs

@@ -37,7 +37,7 @@ test('runtime: the switch changes the organization file, the receipt carries the
   const rolesDir = rolesCopy(root);
   writeJson(join(root, 'businesses/demo.json'), businessDoc(root, 'demo'));
   mkdirSync(join(root, 'data'), { mode: 0o700 });
-  const bus = await startBroker({ dataRoot: join(root, 'data'), businesses: { demo: { id: 'demo', human: 'jason', arbiters: { technical: 'coder', delivery: 'coder' }, roles: { coder: { authority: { withinRole: [], crossRole: [] } } } } }, organization: { dir: root, rolesDir, system: systemFor(root) } });
+  const bus = await startBroker({ dataRoot: join(root, 'data'), businesses: { demo: { id: 'demo', human: 'jason', arbiters: { technical: 'chief', delivery: 'chief' }, roles: {chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } },  coder: { authority: { withinRole: [], crossRole: [] } } } } }, organization: { dir: root, rolesDir, system: systemFor(root) } });
   t.after(async () => { await bus.close(); rmSync(root, { recursive: true, force: true }); });
   const human = bus.broker.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });
   const file = join(root, 'businesses/demo.json');
@@ -72,7 +72,7 @@ test('vikunja:19/309 through the broker, a patch switches the kinds it names and
   const rolesDir = rolesCopy(root);
   writeJson(join(root, 'businesses/demo.json'), { ...businessDoc(root, 'demo'), plugins: { 'usage-source': ['meter'] } });
   mkdirSync(join(root, 'data'), { mode: 0o700 });
-  const bus = await startBroker({ dataRoot: join(root, 'data'), businesses: { demo: { id: 'demo', human: 'jason', arbiters: { technical: 'coder', delivery: 'coder' }, roles: { coder: { authority: { withinRole: [], crossRole: [] } } } } }, organization: { dir: root, rolesDir, system: systemFor(root) } });
+  const bus = await startBroker({ dataRoot: join(root, 'data'), businesses: { demo: { id: 'demo', human: 'jason', arbiters: { technical: 'chief', delivery: 'chief' }, roles: {chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } },  coder: { authority: { withinRole: [], crossRole: [] } } } } }, organization: { dir: root, rolesDir, system: systemFor(root) } });
   t.after(async () => { await bus.close(); rmSync(root, { recursive: true, force: true }); });
   const human = bus.broker.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });
   const log = () => readFileSync(join(root, 'businesses/.history/demo/changes.jsonl'), 'utf8').trim().split('\n').filter(Boolean).map(JSON.parse);
@@ -97,7 +97,7 @@ test('plugins read advertises loadable harnesses even when switched off', async
  const root=mkdtempSync(join(tmpdir(),'plugins-available-'));t.after(()=>rmSync(root,{recursive:true,force:true}));
  const rolesDir=rolesCopy(root);const doc=businessDoc(root,'demo');doc.plugins={harness:['claude-code']};
  writeJson(join(root,'businesses/demo.json'),doc);mkdirSync(join(root,'data'),{mode:0o700});
- const host=await startBroker({dataRoot:join(root,'data'),businesses:{demo:{id:'demo',human:'jason',arbiters:{technical:'coder',delivery:'coder'},roles:{coder:{authority:{withinRole:[],crossRole:[]}}}}},organization:{dir:root,rolesDir,system:systemFor(root)}});t.after(()=>host.close());
+ const host=await startBroker({dataRoot:join(root,'data'),businesses:{demo:{id:'demo',human:'jason',arbiters:{technical:'chief',delivery:'chief'},roles:{chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } }, coder:{authority:{withinRole:[],crossRole:[]}}}}},organization:{dir:root,rolesDir,system:systemFor(root)}});t.after(()=>host.close());
  const human=host.broker.bindHuman({business:'demo',human:'jason',via:'cli',outsideAgent:true});
  const view=host.broker.request(human,{verb:'plugins'});
  assert.deepEqual(view.plugins.harness,['claude-code']);assert.ok(view.available.harness.includes('pi'));assert.ok(view.available.harness.includes('claude-code'));

packages/bus/tests/processing-runtime.test.mjs

@@ -10,8 +10,8 @@ import { Client } from '../src/client.mjs';
 import { registerRuntime, updateRuntime, processIdentity } from '../../processing-control/src/runtimes.mjs';
 import { readControl } from '../../processing-control/src/state.mjs';
 
-const businesses = { demo: { id: 'demo', human: 'jason', arbiters: { technical: 'coder', delivery: 'coder' },
-  roles: { coder: { authority: { withinRole: ['message.send'], crossRole: [] } } } } };
+const businesses = { demo: { id: 'demo', human: 'jason', arbiters: { technical: 'chief', delivery: 'chief' },
+  roles: {chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } },  coder: { authority: { withinRole: ['message.send'], crossRole: [] } } } } };
 async function broker(root) {
   const r = await startBroker({ dataRoot: root, businesses, readers: ['demo'] });
   const cap = r.broker.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });

packages/bus/tests/processing.test.mjs

@@ -13,7 +13,7 @@ const state = await import('../../processing-control/src/state.mjs').catch(e =>
   throw e;
 });
 const businesses = { demo: { id: 'demo', human: 'jason', vars: { 'bus.tester': true },
-  arbiters: { technical: 'coder', delivery: 'coder' }, roles: {
+  arbiters: { technical: 'chief', delivery: 'chief' }, roles: {chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } },
     coder: { definition: 'coder', authority: { withinRole: ['message.send', 'record.write'], crossRole: [] } },
   } } };
 function fixture(t, extra = {}) {

packages/bus/tests/project-archive.test.mjs

@@ -17,7 +17,7 @@ import { Broker, TESTER_VERBS, USER_VERBS, VIEWER_VERBS } from '../src/broker.mj
 const shipped = (name) => JSON.parse(readFileSync(new URL(`../../../roles/${name}.json`, import.meta.url), 'utf8'));
 const AT = '2026-11-05T00:00:00.000Z';
 const business = {
-  id: 'demo', human: 'jason', arbiters: { technical: 'continuity', delivery: 'continuity' },
+  id: 'demo', human: 'jason', arbiters: { technical: 'chief', delivery: 'chief' },
   roles: {
     continuity: { definition: 'continuity', authority: { withinRole: ['message.send'], crossRole: [] } },
     chief: { definition: 'chief-of-staff', authority: { withinRole: ['message.send'], crossRole: [] } },

packages/bus/tests/project-await.test.mjs

@@ -10,7 +10,7 @@ function fixture(t, project, secretCheck = () => {}) {
   const root = mkdtempSync(join(tmpdir(), 'project-await-'));
   const store = new Store(root);
   t.after(() => { store.close(); rmSync(root, { recursive: true, force: true }); });
-  const business = { id: 'demo', human: 'jason', arbiters: { technical: 'coder', delivery: 'coder' }, roles: {
+  const business = { id: 'demo', human: 'jason', arbiters: { technical: 'chief', delivery: 'chief' }, roles: {chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } },
     coder: { definition: 'coder', authority: { withinRole: ['record.write'], crossRole: [] } },
   } };
   const broker = new Broker({ store, businesses: { demo: business }, project, secretCheck });

packages/bus/tests/project-runtime.test.mjs

@@ -64,7 +64,7 @@ test('real startBroker injects the project adapter for socket reads and bound-au
   t.after(async () => { await runtime?.close(); rmSync(root, { recursive: true, force: true }); });
   // Row 65: the bound run's harness is switched on.
   const business = { id: 'demo', human: 'jason', plugins: { harness: ['pi'] }, projects: { stack: { root: join(root, 'code') } },
-    arbiters: { technical: 'coder', delivery: 'coder' }, roles: { coder: {
+    arbiters: { technical: 'chief', delivery: 'chief' }, roles: {chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } },  coder: {
       definition: 'coder', authority: { withinRole: ['record.write'], crossRole: [] },
     } } };
   const initialized = await initProject({ business, project: 'stack', dataRoot: root });

packages/bus/tests/provider-materialization-guard.test.mjs

@@ -15,7 +15,7 @@ test('role must not materialize a new catalogue key by submitting legacy entry s
  const offered={key:'zai-fixture-new',module:'cliproxy',upstream:'zai',provider:'zai',model:'fixture-new',label:'Fixture',available:true,reason:null,harnesses:['pi']};
  let status='ready';
  const modelCatalogue={invalidate(){},read:async()=>({status,models:[offered],notices:[]})};
- const bus=await startBroker({dataRoot:join(root,'data'),businesses:{demo:{id:'demo',human:'jason',arbiters:{technical:'coder',delivery:'coder'},roles:{coder:{authority:{withinRole:[],crossRole:[]}},chief:{definition:'chief-of-staff',authority}}}},organization:{dir:root,rolesDir,system:systemFor(root)},modelCatalogue});t.after(()=>bus.close());
+ const bus=await startBroker({dataRoot:join(root,'data'),businesses:{demo:{id:'demo',human:'jason',arbiters:{technical:'chief',delivery:'chief'},roles:{coder:{authority:{withinRole:[],crossRole:[]}},chief:{definition:'chief-of-staff',authority}}}},organization:{dir:root,rolesDir,system:systemFor(root)},modelCatalogue});t.after(()=>bus.close());
  const db=new DatabaseSync(join(root,'data/bus/bus.sqlite'),{readOnly:true});t.after(()=>db.close());
  const allowed=()=>db.prepare("SELECT count(*) AS n FROM events WHERE kind='action.allowed' AND json_extract(body,'$.action')='organization.change'").get().n;
  const human=bus.broker.bindHuman({business:'demo',human:'jason',via:'cli',outsideAgent:true});

packages/bus/tests/provider-repoint-guard.test.mjs

@@ -20,7 +20,7 @@ async function fixture(t, options={}) {
  if(options.fallback)Object.assign(doc.roles.coder.vars,{'fallback.harness':'pi','fallback.model':'existing-alias','fallback.thinking':'low'});
  writeJson(file,doc);fs.mkdirSync(join(root,'data'),{mode:0o700});
  const modelCatalogue={invalidate(){},read:async()=>({status:'ready',models:[offer],notices:[]})};
- const bus=await startBroker({dataRoot:join(root,'data'),businesses:{demo:{id:'demo',human:'jason',arbiters:{technical:'coder',delivery:'coder'},roles:{...Object.fromEntries(Object.keys(doc.roles).map(key=>[key,{authority:{withinRole:[],crossRole:[]}}])),chief:{definition:'chief-of-staff',authority}}}},organization:{dir:root,rolesDir,system:systemFor(root)},modelCatalogue});t.after(()=>bus.close());
+ const bus=await startBroker({dataRoot:join(root,'data'),businesses:{demo:{id:'demo',human:'jason',arbiters:{technical:'chief',delivery:'chief'},roles:{...Object.fromEntries(Object.keys(doc.roles).map(key=>[key,{authority:{withinRole:[],crossRole:[]}}])),chief:{definition:'chief-of-staff',authority}}}},organization:{dir:root,rolesDir,system:systemFor(root)},modelCatalogue});t.after(()=>bus.close());
  const db=new DatabaseSync(join(root,'data/bus/bus.sqlite'),{readOnly:true});t.after(()=>db.close());
  const count=()=>db.prepare("SELECT count(*) AS n FROM events WHERE kind='action.allowed' AND json_extract(body,'$.action')='organization.change'").get().n;
  const human=bus.broker.bindHuman({business:'demo',human:'jason',via:'cli',outsideAgent:true});

packages/bus/tests/proxy-page.test.mjs

@@ -18,8 +18,8 @@ function setup(t, proxyPage = async () => ({ ok: true })) {
     access: () => ({ accessVersion: 1, revision: 1, users: [], grants: [
       { id: 'g-1', user: 'alice', business: 'demo', projects: ['*'], instances: ['coder'], level: 'collaborator' },
     ] }),
-    businesses: { demo: { id: 'demo', human: 'owner', arbiters: { technical: 'coder', delivery: 'coder' },
-      vars: { 'bus.tester': true }, roles: { coder: { definition: 'coder', authority: { withinRole: ['message.send'], crossRole: [] } } } } },
+    businesses: { demo: { id: 'demo', human: 'owner', arbiters: { technical: 'chief', delivery: 'chief' },
+      vars: { 'bus.tester': true }, roles: {chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } },  coder: { definition: 'coder', authority: { withinRole: ['message.send'], crossRole: [] } } } } },
   });
   const caps = {
     human: broker.bindHuman({ business: 'demo', human: 'owner', via: 'cli', outsideAgent: true }),

packages/bus/tests/publish.test.mjs

@@ -24,9 +24,9 @@ function businesses(upstream = 'https://git.example/mosaic/stack') {
     demo: {
       id: 'demo',
       human: 'jason',
-      arbiters: { technical: 'reviewer', delivery: 'reviewer' },
+      arbiters: { technical: 'chief', delivery: 'chief' },
       projects: { stack: { root: '/nonexistent', remote: upstream }, books: { root: '/nonexistent-books' } },
-      roles: {
+      roles: {chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } },
         coder: { authority: pusher, identity: identity('acme-coder'), publish: ['stack'] },
         second: { authority: pusher, identity: identity('acme-second'), publish: ['stack'] },
         plain: { authority: pusher },

packages/bus/tests/reload.test.mjs

@@ -211,13 +211,13 @@ test('T14 reloadBusiness refuses an unknown business, a changed human and a docu
   const root = mkdtempSync(join(tmpdir(), 'reload-unit-'));
   t.after(() => rmSync(root, { recursive: true, force: true }));
   const role = { authority: { withinRole: [], crossRole: [] } };
-  const demo = { id: 'demo', human: 'jason', arbiters: { technical: 'coder', delivery: 'coder' }, roles: { coder: role } };
+  const demo = { id: 'demo', human: 'jason', arbiters: { technical: 'chief', delivery: 'chief' }, roles: {chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } },  coder: role } };
   const b = new Broker({ store: new Store(root), businesses: { demo } });
   assert.equal(code(() => b.reloadBusiness('other', demo)), 'unknown-business');
   assert.equal(code(() => b.reloadBusiness('demo', { ...demo, human: 'mos' })), 'invalid-business');
   assert.equal(code(() => b.reloadBusiness('demo', { ...demo, roles: { coder: role, tester: role } })), 'invalid-business');
   assert.equal(code(() => b.reloadBusiness('demo', { ...demo, roles: { coder: { authority: { withinRole: ['spend'], crossRole: [] } } } })), 'invalid-authority');
   assert.equal(code(() => b.reloadBusiness('demo', null)), 'invalid-business');
-  b.reloadBusiness('demo', { ...demo, roles: { coder: role, 'sec-1': role } });
+  b.reloadBusiness('demo', { ...demo, roles: { ...demo.roles, 'sec-1': role } });
   assert.ok(b.bindLaunch({ business: 'demo', role: 'sec-1', run: 'run-1', harness: 'pi' }));
 });

packages/bus/tests/resolve-rights.test.mjs

@@ -0,0 +1,82 @@
+// RR (#1873): resolution checks current role rights, and callers cannot choose a merge/policy arbiter.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { loadRole } from '../../organization/src/index.mjs';
+import { REPO_ROLES } from '../../organization/tests/helpers.mjs';
+import { fixture } from './spec-fixtures.mjs';
+import { grantDecision } from './host-fixtures.mjs';
+
+async function setup(t, { shared = false } = {}) {
+  const roles = Object.fromEntries(['cto', 'pm', 'chief-of-staff'].map(definition => {
+    const role = loadRole(REPO_ROLES, definition);
+    return [definition === 'chief-of-staff' ? 'chief' : definition, { definition, authority: structuredClone(role.authority) }];
+  }));
+  roles.coder = { definition: 'coder', authority: { withinRole: ['message.send', 'record.write'], crossRole: ['task.scope.change', 'git.merge.protected', 'policy.change'] } };
+  const f = await fixture(t, { roles, arbiters: { technical: 'cto', delivery: shared ? 'cto' : 'pm' } });
+  return { ...f, roles, cto: f.agent('cto'), pm: f.agent('pm'), chief: f.chief };
+}
+
+for (const [domain, resolver] of [['technical', 'cto'], ['delivery', 'pm']]) {
+  test(`RR: ${domain} arbiter that loses its right refuses not-resolver`, async t => {
+    const f = await setup(t);
+    const d = f.raise({ action: 'task.scope.change', domain });
+    f.business.roles[resolver].authority.withinRole = ['message.send'];
+    f.broker.reloadBusiness('demo', f.business);
+    assert.throws(() => f.call(f[resolver], 'decision.resolve', { id: d.id, choice: 'yes' }), error => {
+      assert.equal(error.code, 'not-resolver');
+      assert.match(error.reason, new RegExp(`${resolver}.*${resolver}.*decision\\.resolve\\.${domain}`));
+      return true;
+    });
+    assert.equal(f.store.get('SELECT count(*) n FROM decision_events WHERE decision=?', d.id).n, 0);
+  });
+}
+
+test('RR: a shared arbiter cannot resolve a delivery decision using only its technical right', async t => {
+  const f = await setup(t, { shared: true });
+  const d = f.raise({ action: 'task.scope.change', domain: 'delivery' });
+  assert.equal(d.route_to, 'cto');
+  assert.throws(() => f.call(f.cto, 'decision.resolve', { id: d.id, choice: 'yes' }), { code: 'not-resolver' });
+});
+
+test('RR: merge raised with delivery still routes to CTO and resolves (acceptance 314 step 5)', async t => {
+  const f = await setup(t);
+  const d = await f.raise({ action: 'git.merge.protected', domain: 'delivery', project: 'stack', spec_path: 'spec/north-star.md', spec_commit: f.commit });
+  assert.equal(d.route_to, 'cto');
+  assert.throws(() => f.call(f.pm, 'decision.resolve', { id: d.id, choice: 'yes' }), { code: 'not-resolver' });
+  f.call(f.cto, 'decision.resolve', { id: d.id, choice: 'yes' });
+  assert.equal(f.store.get('SELECT op FROM decision_events WHERE decision=?', d.id).op, 'resolved');
+});
+
+for (const resolver of ['chief', 'pm']) {
+  test(`RR: ${resolver} named delivery arbiter resolves policy.change even when raised technical`, async t => {
+    const f = await setup(t); f.business.arbiters.delivery = resolver;
+    f.broker.reloadBusiness('demo', f.business);
+    const d = f.raise({ action: 'policy.change', domain: 'technical' });
+    assert.equal(d.route_to, resolver);
+    f.call(f[resolver], 'decision.resolve', { id: d.id, choice: 'yes' });
+    assert.equal(f.store.get('SELECT by FROM decision_events WHERE decision=?', d.id).by, `${resolver}-run`);
+  });
+}
+
+test('RR: the chief holds both rights when named for both domains', async t => {
+  const f = await setup(t); f.business.arbiters = { technical: 'chief', delivery: 'chief' };
+  f.broker.reloadBusiness('demo', f.business);
+  for (const action of ['git.merge.protected', 'policy.change']) {
+    const d = f.raise({ action }); assert.equal(d.route_to, 'chief');
+    f.call(f.chief, 'decision.resolve', { id: d.id, choice: 'yes' });
+  }
+});
+
+// Old raise evidence did not preserve domain. Current assignments cannot prove the old domain.
+test('RR: remapping arbiters cannot let a legacy decision resolve with only the other domain right', async t => {
+  const f = await setup(t);
+  const id = grantDecision(f.store, { action: 'task.scope.change', route: 'pm', domain: null, close: null });
+  f.business.arbiters = { technical: 'pm', delivery: 'cto' };
+  f.business.roles.pm.authority.withinRole = ['message.send', 'decision.resolve.technical'];
+  f.broker.reloadBusiness('demo', f.business);
+  assert.throws(() => f.call(f.pm, 'decision.resolve', { id, choice: 'yes' }), { code: 'not-resolver' });
+  assert.equal(f.store.get('SELECT count(*) n FROM decision_events WHERE decision=?', id).n, 0);
+  // Human recovery closes the old route by withdrawing it, before the raiser creates a new decision.
+  f.call(f.human, 'decision.withdraw', { id });
+  assert.equal(f.store.get('SELECT op FROM decision_events WHERE decision=?', id).op, 'withdrawn');
+});

packages/bus/tests/room-check.test.mjs

@@ -28,7 +28,7 @@ test('C2-10c check hydration preserves unchecked rows and one broadcast with two
   const messaging = JSON.parse(readFileSync(new URL('../../../roles/companion.json', import.meta.url))).messaging;
   const role = { definition: 'companion', authority: { withinRole: ['message.send'], crossRole: [] } };
   const broker = new Broker({ store, businesses: { demo: { id: 'demo', human: 'jason', vars: {},
-    arbiters: { technical: 'bean', delivery: 'bean' }, roles: { bean: role, chet: role }, definitions: { companion: { messaging } } } } });
+    arbiters: { technical: 'chief', delivery: 'chief' }, roles: {chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } },  bean: role, chet: role }, definitions: { companion: { messaging } } } } });
   const human = broker.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });
   const call = (verb, args) => broker.request(human, { verb, args });
   const project = call('project.create', { name: 'Room' }).id;

packages/bus/tests/routes-verb.test.mjs

@@ -110,7 +110,7 @@ test('row 65 runtime: routes and routes.set reach the organization file with the
   const file = join(root, 'businesses/demo.json');
   writeJson(file, doc);
   mkdirSync(join(root, 'data'), { mode: 0o700 });
-  const bus = await startBroker({ dataRoot: join(root, 'data'), businesses: { demo: { id: 'demo', human: 'jason', arbiters: { technical: 'coder', delivery: 'coder' }, roles: { coder: { authority: { withinRole: [], crossRole: [] } } } } }, organization: { dir: root, rolesDir, system: systemFor(root) } });
+  const bus = await startBroker({ dataRoot: join(root, 'data'), businesses: { demo: { id: 'demo', human: 'jason', arbiters: { technical: 'chief', delivery: 'chief' }, roles: {chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } },  coder: { authority: { withinRole: [], crossRole: [] } } } } }, organization: { dir: root, rolesDir, system: systemFor(root) } });
   t.after(() => bus.close());
   const human = bus.broker.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });
   const log = () => readFileSync(join(root, 'businesses/.history/demo/changes.jsonl'), 'utf8').trim().split('\n').filter(Boolean).map(JSON.parse);
@@ -157,7 +157,7 @@ test('fixture provider catalogue appears in actual routes and materializes the s
   const file = join(root, 'businesses/demo.json'); writeJson(file, doc); mkdirSync(join(root, 'data'), { mode: 0o700 });
   const offered={ key:'zai-fixture-id',module:'cliproxy',upstream:'zai',provider:'zai',model:'fixture-id',label:'fixture-id',available:true,reason:null,harnesses:['pi'] };
   const catalogues={ read:async()=>({status:'ready',observedAt:'2026-11-06T00:00:00.000Z',models:[offered],notices:[]}),invalidate:()=>{} };
-  const bus = await startBroker({ dataRoot: join(root, 'data'), businesses: { demo: { id:'demo',human:'jason',arbiters:{technical:'coder',delivery:'coder'},roles:{coder:{authority:{withinRole:[],crossRole:[]}}} } }, organization:{dir:root,rolesDir,system:systemFor(root)}, modelCatalogue:catalogues });
+  const bus = await startBroker({ dataRoot: join(root, 'data'), businesses: { demo: { id:'demo',human:'jason',arbiters:{technical:'chief',delivery:'chief'},roles:{chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } }, coder:{authority:{withinRole:[],crossRole:[]}}} } }, organization:{dir:root,rolesDir,system:systemFor(root)}, modelCatalogue:catalogues });
   t.after(() => bus.close());
   const human=bus.broker.bindHuman({business:'demo',human:'jason',via:'cli',outsideAgent:true});
   const before=await bus.broker.request(human,{verb:'routes'});
@@ -179,7 +179,7 @@ for (const writer of ['limits.set','organization.set','instances.set']) test(`${
  let mode='absent';
  const offered={key:'fixture-persisted',module:'cliproxy',upstream:'zai',provider:'zai',model:'fixture-id',label:'fixture',available:true,reason:null,harnesses:['pi']};
  const catalogue={read:async()=>({status:'ready',observedAt:'2026-11-06T00:00:00.000Z',models:mode==='absent'?[]:[{...offered,harnesses:mode==='incompatible'?['claude-code']:['pi']}],notices:[]}),invalidate(){}};
- const bus=await startBroker({dataRoot:join(root,'data'),businesses:{demo:{id:'demo',human:'jason',arbiters:{technical:'coder',delivery:'coder'},roles:{coder:{authority:{withinRole:[],crossRole:[]}},chief:{definition:'chief-of-staff',authority:chiefAuthority}}}},organization:{dir:root,rolesDir,system:systemFor(root)},modelCatalogue:catalogue});t.after(()=>bus.close());
+ const bus=await startBroker({dataRoot:join(root,'data'),businesses:{demo:{id:'demo',human:'jason',arbiters:{technical:'chief',delivery:'chief'},roles:{coder:{authority:{withinRole:[],crossRole:[]}},chief:{definition:'chief-of-staff',authority:chiefAuthority}}}},organization:{dir:root,rolesDir,system:systemFor(root)},modelCatalogue:catalogue});t.after(()=>bus.close());
  const human=bus.broker.bindHuman({business:'demo',human:'jason',via:'cli',outsideAgent:true});
  const cap=writer==='organization.set'?bus.broker.bindLaunch({business:'demo',role:'chief',run:'provider-chief',harness:'pi'}):human;
  if(writer==='organization.set')bus.broker.request(cap,{verb:'role.claim'});
@@ -201,7 +201,7 @@ test('legacy routes follow enabled module mappings while unchanged unavailable s
  writeJson(join(root,'businesses/demo.json'),doc);mkdirSync(join(root,'data'),{mode:0o700});
  let state='ready';const offered={key:'zai-fixture-two',module:'cliproxy',upstream:'zai',provider:'zai',model:'fixture-two',label:'fixture',available:true,reason:null,harnesses:['pi']};
  const catalogue={read:async()=>({status:state,observedAt:'2026-11-06T00:00:00.000Z',models:[offered],notices:[]}),invalidate(){}};
- const bus=await startBroker({dataRoot:join(root,'data'),businesses:{demo:{id:'demo',human:'jason',arbiters:{technical:'coder',delivery:'coder'},roles:{coder:{authority:{withinRole:[],crossRole:[]}}}}},organization:{dir:root,rolesDir,system:systemFor(root)},modelCatalogue:catalogue});t.after(()=>bus.close());
+ const bus=await startBroker({dataRoot:join(root,'data'),businesses:{demo:{id:'demo',human:'jason',arbiters:{technical:'chief',delivery:'chief'},roles:{chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } }, coder:{authority:{withinRole:[],crossRole:[]}}}}},organization:{dir:root,rolesDir,system:systemFor(root)},modelCatalogue:catalogue});t.after(()=>bus.close());
  const human=bus.broker.bindHuman({business:'demo',human:'jason',via:'cli',outsideAgent:true});const request=(verb,args)=>bus.broker.request(human,{verb,args});
  let view=await request('routes');assert.deepEqual(view.catalogue.legacy['legacy-one'],{module:'cliproxy',upstream:'claude',model:'fixture-one'});
  const pick=(harness,model,fallback=null)=>({harness,model,thinking:'low',fallback});

packages/bus/tests/single-use.test.mjs

@@ -12,8 +12,8 @@ const businesses = {
     arbiters: { technical: 'cto', delivery: 'pm' },
     roles: {
       coder: { authority: { withinRole: ['message.send'], crossRole: ['task.scope.change'] } },
-      cto: { authority: { withinRole: [], crossRole: [] } },
-      pm: { authority: { withinRole: [], crossRole: [] } },
+      cto: { authority: { withinRole: ['decision.resolve.technical'], crossRole: [] } },
+      pm: { authority: { withinRole: ['decision.resolve.delivery'], crossRole: [] } },
     },
   },
 };

packages/bus/tests/spec-fixtures.mjs

@@ -7,7 +7,7 @@ import { Broker } from '../src/broker.mjs';
 import { initProject, readSpec, writeRecord, listProjectFiles, readProjectFile, writeHumanFile, ProjectError } from '../../project/src/index.mjs';
 export const git = (repo, ...args) => execFileSync('git', ['-c', 'core.hooksPath=/dev/null', '-c', 'maintenance.auto=false', '-c', 'gc.auto=0', '-C', repo, ...args], { encoding: 'utf8' }).trim();
 const options = [{ key: 'yes', text: 'Yes' }, { key: 'no', text: 'No' }];
-export async function fixture(t, { adapter = true, roles = {}, arbiters = { technical: 'reviewer', delivery: 'reviewer' }, access = null } = {}) {
+export async function fixture(t, { adapter = true, roles = {}, arbiters = { technical: 'chief', delivery: 'chief' }, access = null } = {}) {
   const root = mkdtempSync(join(tmpdir(), 'bus-spec-'));
   const store = new Store(root);
   t.after(() => { store.close(); rmSync(root, { recursive: true, force: true }); });
@@ -16,6 +16,7 @@ export async function fixture(t, { adapter = true, roles = {}, arbiters = { tech
     projects: { stack: { root: join(root, 'code'), repo: join(root, 'records') } }, roles: {
       coder: { definition: 'coder', authority: authority(['message.send', 'record.write']) },
       reviewer: { definition: 'reviewer', authority: authority(['message.send']) },
+      chief: { definition: 'chief-of-staff', authority: authority(['message.send', 'decision.resolve.technical', 'decision.resolve.delivery']) },
       ...roles,
     } };
   const { repo, commit } = await initProject({ business, project: 'stack', dataRoot: root });
@@ -31,7 +32,7 @@ export async function fixture(t, { adapter = true, roles = {}, arbiters = { tech
     const cap = broker.bindLaunch({ business: 'demo', role, run: role + '-run', harness: 'pi', address: role });
     broker.request(cap, { verb: 'role.claim' }); return cap;
   };
-  const coder = agent('coder'), reviewer = agent('reviewer');
+  const coder = agent('coder'), reviewer = agent('reviewer'), chief = agent('chief');
   const human = broker.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });
   const call = (cap, verb, args = {}) => broker.request(cap, { verb, args });
   const raise = args => call(coder, 'decision.raise', { action: 'deploy', question: 'Ship?', options,
@@ -42,5 +43,5 @@ export async function fixture(t, { adapter = true, roles = {}, arbiters = { tech
     git(repo, '-c', `user.name=${author}`, '-c', '[email protected]', 'commit', '-m', 'Spec');
     return git(repo, 'rev-parse', 'HEAD');
   };
-  return { root, store, business, broker, repo, commit, agent, coder, reviewer, human, call, raise, save };
+  return { root, store, business, broker, repo, commit, agent, coder, reviewer, chief, human, call, raise, save };
 }

packages/bus/tests/spec-review.test.mjs

@@ -19,7 +19,7 @@ async function setup(t, { running = ['chief', 'pm', 'cto'], thread = true } = {}
     cto: { definition: 'cto', ...within }, assistant: { definition: 'assistant', ...within },
   } });
   f.business.definitions = { assistant: { messaging: shipped('assistant').messaging } };
-  f.cap = Object.fromEntries(running.map(role => [role, f.agent(role)]));
+  f.cap = Object.fromEntries(running.map(role => [role, role === 'chief' ? f.chief : f.agent(role)]));
   if (thread) {
     const project = f.call(f.human, 'project.create', { name: 'stack work', repo: 'stack' }).id;
     f.threadId = f.call(f.human, 'thread.create', { project, name: 'alpha' }).id;

packages/bus/tests/staff-request.test.mjs

@@ -139,7 +139,7 @@ test('REQ-COS-1: the request goes to the business launcher, and only when that i
 // launcher `chief`, so a check on the name passes there; these use names that differ from the definitions.
 test('REQ-COS-1: the sender is judged by definition: an instance `lead` of the pm definition can ask, an instance `pm` of the coder definition can\'t', (t) => {
   const lead = setup(t, {
-    arbiters: { technical: 'lead', delivery: 'chief' },
+    arbiters: { technical: 'chief', delivery: 'chief' },
     roles: {
       chief: { definition: 'chief-of-staff', authority: authority.chief },
       lead: { definition: 'pm', authority: authority.pm },
@@ -172,9 +172,9 @@ test('REQ-COS-1: the sender is judged by definition: an instance `lead` of the p
 
 test('REQ-COS-1: the launcher is judged by definition: an instance `boss` of the chief-of-staff definition receives, a `chief` of the coder definition gives no-chief-of-staff', (t) => {
   const boss = setup(t, {
-    arbiters: { technical: 'pm', delivery: 'boss' },
+    arbiters: { technical: 'pm', delivery: 'chief' },
     launch: { by: 'boss', instances: ['coder'], max: { opus: 2, sonnet: 2 } },
-    roles: {
+    roles: {chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } },
       boss: { definition: 'chief-of-staff', authority: authority.chief },
       pm: { definition: 'pm', authority: authority.pm },
       coder: { definition: 'coder', ...none },

packages/bus/tests/system-type.test.mjs

@@ -91,7 +91,7 @@ test('runtime reads the current organization file for project selections and con
   doc.plugins = { 'system-type': ['coding'] };
   writeJson(join(root, 'businesses/demo.json'), doc);
   mkdirSync(join(root, 'data'), { mode: 0o700 });
-  const business = { id: 'demo', human: 'jason', arbiters: { technical: 'coder', delivery: 'coder' }, roles: { coder: { authority: { withinRole: [], crossRole: [] } } } };
+  const business = { id: 'demo', human: 'jason', arbiters: { technical: 'chief', delivery: 'chief' }, roles: {chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } },  coder: { authority: { withinRole: [], crossRole: [] } } } };
   const bus = await startBroker({ dataRoot: join(root, 'data'), businesses: { demo: business }, organization: { dir: root, rolesDir, system: systemFor(root) } });
   t.after(async () => { await bus.close(); rmSync(root, { recursive: true, force: true }); });
   const human = bus.broker.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });

packages/bus/tests/tester-writes.test.mjs

@@ -46,8 +46,8 @@ async function runtime(t) {
     dataRoot: join(root, 'data'),
     businesses: {
       demo: {
-        id: 'demo', human: 'jason', arbiters: { technical: 'coder', delivery: 'coder' }, vars: { 'bus.tester': true },
-        roles: { coder: { definition: 'coder', ...none }, assistant: { definition: 'assistant', ...none } },
+        id: 'demo', human: 'jason', arbiters: { technical: 'chief', delivery: 'chief' }, vars: { 'bus.tester': true },
+        roles: {chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } },  coder: { definition: 'coder', ...none }, assistant: { definition: 'assistant', ...none } },
       },
     },
     organization: { dir: root, rolesDir, system: systemFor(root) },
@@ -166,8 +166,8 @@ function broker(t, vars = { 'bus.tester': true }) {
     store,
     businesses: {
       demo: {
-        id: 'demo', human: 'jason', arbiters: { technical: 'lead', delivery: 'lead' }, ...(vars ? { vars } : {}),
-        roles: { dev: { definition: 'coder', ...none }, lead: { definition: 'pm', ...none } },
+        id: 'demo', human: 'jason', arbiters: { technical: 'chief', delivery: 'chief' }, ...(vars ? { vars } : {}),
+        roles: {chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } },  dev: { definition: 'coder', ...none }, lead: { definition: 'pm', ...none } },
       },
     },
   });

packages/bus/tests/usage-broker.test.mjs

@@ -8,7 +8,7 @@ import { Broker } from '../src/broker.mjs';
 test('REQ-LIMIT-4 usage protocol binds run identity, requires a delivered turn and isolates businesses', async t => {
   const root = mkdtempSync(join(tmpdir(), 'usage-broker-'));
   const store = new Store(root); t.after(() => { store.close(); rmSync(root, { recursive: true, force: true }); });
-  const businesses = { demo: { id: 'demo', human: 'jason', roles: { coder: { definition: 'coder', authority: { withinRole: [], crossRole: [] } } }, arbiters: { technical: 'coder', delivery: 'coder' } } };
+  const businesses = { demo: { id: 'demo', human: 'jason', roles: {chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } },  coder: { definition: 'coder', authority: { withinRole: [], crossRole: [] } } }, arbiters: { technical: 'chief', delivery: 'chief' } } };
   const recorded = [];
   const broker = new Broker({ store, businesses, usage: {
     collect: async (...args) => { recorded.push(args); return { recorded: true }; },

packages/bus/tests/usage-runtime.test.mjs

@@ -12,7 +12,7 @@ test('REQ-PLUG-1 runtime reaches transcript only through loader, over the real b
   t.after(async () => { await runtime?.close(); rmSync(root, { recursive: true, force: true }); });
   const dir = join(root, 'launches/demo/run1/session'); mkdirSync(dir, { recursive: true });
   const business = { id: 'demo', human: 'jason', plugins: { 'usage-source': ['transcript'], harness: ['pi'] },
-    roles: { coder: { authority: { withinRole: [], crossRole: [] } } }, arbiters: { technical: 'coder', delivery: 'coder' } };
+    roles: {chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } },  coder: { authority: { withinRole: [], crossRole: [] } } }, arbiters: { technical: 'chief', delivery: 'chief' } };
   runtime = await startBroker({ dataRoot: root, businesses: { demo: business }, launches: [{
     // Row 65: the launch names where its harness keeps the session files.
     business: 'demo', role: 'coder', run: 'run1', harness: 'pi', provider: 'other-provider', model: 'other-model', transcript: dir,

packages/bus/tests/workflow-roles.test.mjs

@@ -65,10 +65,10 @@ test("merge-gate's technical raise is cross-role, goes to the cto, and only merg
   assert.throws(() => b.authorize(caps['merge-gate'], 'git.merge.protected', { decision: d.id, target: TASK }), /decision-consumed/);
 });
 
-test("merge-gate has no message.send, and without a domain its raise goes to the delivery arbiter", (t) => {
+test("merge-gate has no message.send, and without a domain its merge raise still goes to the technical arbiter", (t) => {
   const { call, raise } = setup(t);
   assert.throws(() => call('merge-gate', 'message.send', { to: 'cto', body: 'landed' }), /decision-required/);
-  assert.equal(raise('merge-gate', 'git.merge.protected', { target: TASK }).route_to, 'pm');
+  assert.equal(raise('merge-gate', 'git.merge.protected', { target: TASK }).route_to, 'cto');
   // Every other action is gated for merge-gate, so an uncited raise goes to the human.
   const push = raise('merge-gate', 'git.push.working', { domain: 'technical', target: TASK });
   assert.deepEqual([push.class, push.route_to], ['gated', 'human']);

packages/business/src/composition.mjs

@@ -0,0 +1,2 @@
+// Old path of packages/organization/src/composition.mjs (rename design r2, stage B).
+export * from "../../organization/src/composition.mjs";

packages/cli/src/org.mjs

@@ -11,7 +11,7 @@ import { consoleBusRestart } from './org-console.mjs';
 import { refuseInsideAgent } from './transport.mjs';
 export const ORG_USAGE = 'mosaic org system-types installed | system-types enabled ID | lock show|clear ID | reload ID | archive ID --if-revision N [--json] | restore ID --if-revision N [--json] | delete ID --confirm ID [--if-revision N] [--json] | template render ID [--fixture local] --output FILE | validate FILE | create ID --from FILE | show ID [--json] | list [--json] | update ID --from FILE --if-revision N | queue init ID (--local-only --accept-local-loss-risk | --remote URL) | queue show ID [--json] | project repo init ID PROJECT (--local-only --accept-local-loss-risk | --remote URL) | project repo show ID PROJECT [--json] | config validate ID | config resolve ID INSTANCE [--project ID]';
 function parse(args) { const pos = [], values = {}, flags = new Set(); for (let i = 0; i < args.length; i++) { const a = args[i]; if (['--json', '--local-only', '--accept-local-loss-risk'].includes(a)) { if (flags.has(a)) throw new CliError(`duplicate ${a}`, 4); flags.add(a); } else if (['--fixture', '--output', '--from', '--if-revision', '--remote', '--confirm'].includes(a)) { if (values[a] !== undefined || !args[i+1] || args[i+1].startsWith('--')) throw new CliError(`${a} needs one value`, 4); values[a] = args[++i]; } else if (a.startsWith('--')) throw new CliError(`unknown option ${a}`, 4); else pos.push(a); } return { pos, values, flags }; }
-async function document(file) { try { return JSON.parse(await readFile(file, 'utf8')); } catch (e) { throw new CliError(`cannot read document ${file}: ${e.message}`, 2); } }
+async function document(file) { try { return JSON.parse(await readFile(file, 'utf8')); } catch (e) { throw new CliError(`cannot read document ${file}: ${e instanceof SyntaxError ? 'not valid JSON' : e.message}`, 2); } }
 export async function orgCommand(args, io, deps = {}) {
  try {
   const p = parse(args); const words = p.pos; let result; let accepted = [];

packages/cli/tests/access.test.mjs

@@ -290,7 +290,7 @@ test("the real human-cli, run from agent ancestry, refuses and writes nothing",
   const config = join(root, "config");
   const bus = await startBroker({
     dataRoot: f.dataRoot,
-    businesses: { acme: { id: "acme", human: "jason", arbiters: { technical: "coder", delivery: "coder" }, roles: { coder: { authority: { withinRole: [], crossRole: [] } } } } },
+    businesses: { acme: { id: "acme", human: "jason", arbiters: { technical: 'chief', delivery: 'chief' }, roles: {chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } },  coder: { authority: { withinRole: [], crossRole: [] } } } } },
     organization: { dir: config, rolesDir: f.roles, system: systemFor(root) },
   });
   t.after(() => bus.close());

packages/cli/tests/instances.test.mjs

@@ -33,7 +33,7 @@ async function setup(t, { stub = false, hook = null } = {}) {
   const bus = await startBroker({
     dataRoot: f.dataRoot,
     businesses: stub
-      ? { acme: { id: "acme", human: "jason", arbiters: { technical: "coder", delivery: "coder" }, roles: { coder: { authority: { withinRole: [], crossRole: [] } } } } }
+      ? { acme: { id: "acme", human: "jason", arbiters: { technical: 'chief', delivery: 'chief' }, roles: {chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } },  coder: { authority: { withinRole: [], crossRole: [] } } } } }
       : boot.businesses,
     organization: stub ? { dir, rolesDir: f.roles, system: systemFor(root) } : boot.organization,
   });

packages/cli/tests/json-redaction.test.mjs

@@ -0,0 +1,59 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { spawnSync } from 'node:child_process';
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { loadSystem } from '../src/config.mjs';
+import { tmp } from './helpers.mjs';
+
+const repo = resolve(import.meta.dirname, '../../..');
+const configScript = join(repo, 'scripts/mosaic-config.mjs');
+const cli = join(repo, 'packages/cli/src/cli.mjs');
+const secret = 'sk-test-NOT-A-SECRET-1234';
+function fixture(t) {
+  const root = tmp(t, 'jr-'), home = join(root, 'home');
+  const file = join(home, '.config/mosaic-redacttest/config.json');
+  const env = { PATH: process.env.PATH, HOME: home, TMPDIR: process.env.TMPDIR, LANG: 'C.UTF-8', MOSAIC_CONFIG: file };
+  const run = (script, ...args) => spawnSync(process.execPath, [script, ...args], { env, cwd: repo, encoding: 'utf8' });
+  const boot = () => {
+    const result = run(configScript, 'bootstrap', '--instance', 'redacttest');
+    assert.equal(result.status, 0, result.stderr);
+  };
+  return { root, file, env, run, boot };
+}
+function redacted(result, file, status) {
+  assert.equal(result.status, status, result.stderr);
+  assert.equal(result.stdout, '');
+  assert.ok(result.stderr.includes(file), result.stderr);
+  assert.match(result.stderr, /not valid JSON/);
+  assert.doesNotMatch(result.stderr, /sk-test|Unexpected token/);
+}
+
+test('system config parse refusal and CLI relay omit parser bytes', t => {
+  const f = fixture(t);
+  mkdirSync(dirname(f.file), { recursive: true }); writeFileSync(f.file, secret);
+  redacted(f.run(configScript, 'validate', '--instance', 'redacttest'), f.file, 2);
+  assert.throws(() => loadSystem({ env: f.env, instance: 'redacttest' }), error => {
+    assert.equal(error.exitCode, 3);
+    assert.ok(error.message.includes(f.file));
+    assert.match(error.message, /not valid JSON/);
+    assert.doesNotMatch(error.message, /sk-test|Unexpected token/);
+    return true;
+  });
+  redacted(f.run(cli, 'org', 'config', 'validate', 'alpha'), f.file, 3);
+});
+
+test('named instance marker parse refusal omits parser bytes', t => {
+  const f = fixture(t); f.boot();
+  const { dataRoot } = JSON.parse(readFileSync(f.file, 'utf8'));
+  const marker = join(dataRoot, 'instance.json'); writeFileSync(marker, secret);
+  redacted(f.run(configScript, 'validate', '--instance', 'redacttest'), marker, 3);
+});
+
+for (const operation of ['validate', 'create', 'update']) test(`org ${operation} document refusal omits parser bytes`, t => {
+  const f = fixture(t); f.boot();
+  const file = join(f.root, 'alpha.json'); writeFileSync(file, secret);
+  const args = operation === 'validate' ? ['validate', file]
+    : [operation, 'alpha', '--from', file, ...(operation === 'update' ? ['--if-revision', '1'] : [])];
+  redacted(f.run(cli, 'org', ...args), file, 2);
+});

packages/cli/tests/launcher.test.mjs

@@ -445,7 +445,7 @@ test("each launch makes sure the workspace has a clone of the project: cloned, f
 test("a role the broker says holds a merge decision gets land_work, its prompt line, its landing and the git socket; without it, none", { skip, timeout: 30000 }, async (t) => {
   const asked = [];
   const held = [{ instance: "chief", decision: "d1", task_ref: "vikunja:1/2" }, { instance: "coder", decision: "d2", task_ref: "vikunja:1/3" }];
-  const answering = (holders) => ({ wrap: (host) => Object.create(host, { op: { value: async (m) => (m.op === "landHolders" ? (asked.push(m), holders) : host.op(m)) } }) });
+  const answering = (holders) => ({ threadTickMs: 3600000, wrap: (host) => Object.create(host, { op: { value: async (m) => (m.op === "landHolders" ? (asked.push(m), holders) : host.op(m)) } }) });
   const landing = "- Landing: once your merge decision is approved, land_work it with the task.";
   const read = (f, run, file) => readFileSync(join(f.dataRoot, "launches", "acme", run, file), "utf8");
 

packages/cli/tests/publish-socket.test.mjs

@@ -90,9 +90,9 @@ async function setup(t, { publishDeadlineMs } = {}) {
     credentials: { gitea: { store: true, file: join(root, "secrets", "agents", "demo", user, "gitea"), rotateBy: "2099-01-01" } },
   });
   const demo = {
-    id: "demo", human: "jason", arbiters: { technical: "reviewer", delivery: "reviewer" },
+    id: "demo", human: "jason", arbiters: { technical: 'chief', delivery: 'chief' },
     projects: { stack: { root: project, remote: `${gitea.origin}/mosaic/stack` } },
-    roles: {
+    roles: {chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } },
       coder: agent("coder"),
       second: agent("second"),
       reviewer: { authority: { withinRole: ["message.send"], crossRole: [] } },

packages/cli/tests/tester-reads.test.mjs

@@ -18,8 +18,8 @@ const none = { authority: { withinRole: ["message.send"], crossRole: [] } };
 const inAgent = (env) => io({ ...env, CLAUDECODE: "1", CLAUDE_CODE_ENTRYPOINT: "sdk-ts" });
 const bus = (vars = { "bus.tester": true }) => ({
   acme: {
-    id: "acme", human: "jason", arbiters: { technical: "coder", delivery: "coder" }, ...(vars ? { vars } : {}),
-    roles: { coder: { definition: "coder", ...none }, assistant: { definition: "assistant", ...none } },
+    id: "acme", human: "jason", arbiters: { technical: 'chief', delivery: 'chief' }, ...(vars ? { vars } : {}),
+    roles: {chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } },  coder: { definition: "coder", ...none }, assistant: { definition: "assistant", ...none } },
   },
 });
 

packages/cli/tests/tester-threads.test.mjs

@@ -281,8 +281,8 @@ function mosaic(args, env) {
 test("row 184: scripts/mosaic runs thread create, threads, talk --thread and thread read as the tester through tester-cli.mjs", async (t) => {
   const { root, f, org } = await orgFixture(t);
   const none = { authority: { withinRole: ["message.send"], crossRole: [] } };
-  const businesses = { acme: { id: "acme", human: "jason", arbiters: { technical: "coder", delivery: "coder" }, vars: { "bus.tester": true },
-    roles: { coder: { definition: "coder", ...none }, assistant: { definition: "assistant", ...none } } } };
+  const businesses = { acme: { id: "acme", human: "jason", arbiters: { technical: 'chief', delivery: 'chief' }, vars: { "bus.tester": true },
+    roles: {chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } },  coder: { definition: "coder", ...none }, assistant: { definition: "assistant", ...none } } } };
   const rt = await startBroker({ dataRoot: org.root, businesses, organization: { dir: join(root, ".config", "mosaic-test"), rolesDir: f.roles, system: systemFor(root) } });
   t.after(() => rt.close());
   const human = rt.broker.bindHuman({ business: "acme", human: "jason", via: "cli", outsideAgent: true });

packages/harness/src/bundle.mjs

@@ -98,7 +98,7 @@ export function sessionModel(resolved, models = null, which = "primary", { proxy
   });
   if (models === null) return { harness, provider: null, model, thinking };
   const entry = Object.hasOwn(models, model) ? models[model] : null;
-  if (!entry) throw new BundleError(`instance ${resolved.instance}: unknown model table selection ${model}`);
+  if (!entry) throw new BundleError(`instance ${resolved.instance}: unknown model table selection for ${ROUTE_VARS[which][1]} var`);
   const transport = entry.provider === "proxy" || proxy ? checkedTransport(entry, null, resolver) : null;
   return { harness, provider: entry.provider, model: entry.model, modelKey: model, thinking,
     ...(transport ? { proxyRoute: transport.routeId, proxyTransport: transport } : {}) };

packages/harness/tests/bundle.test.mjs

@@ -125,7 +125,20 @@ test("sessionModel: the route is the instance's own vars, and a missing one refu
   const fb = resolvedFor(t, "coder", (d) => (d.roles.coder.vars = { harness: "claude-code", model: "claude-opus-5-5", thinking: "max", "fallback.harness": "pi", "fallback.model": "glm-5.3-flash", "fallback.thinking": "minimal" }));
   assert.deepEqual(sessionModel(fb, null, "fallback"), { harness: "pi", provider: null, model: "glm-5.3-flash", thinking: "minimal" });
   assert.throws(() => sessionModel(resolvedFor(t, "pm"), null, "fallback"), (e) => e.code === "no-route" && e.missing === "fallback.harness");
-  assert.throws(() => sessionModel(resolvedFor(t, "coder"), models), /unknown model table selection glm-5.3-flash/);
+  assert.throws(() => sessionModel(resolvedFor(t, "coder"), models), /unknown model table selection for model var/);
+});
+
+for (const [route, name] of [["primary", "model"], ["fallback", "fallback.model"]]) test(`unknown ${route} model selection names the variable without its value`, (t) => {
+  const secret = "sk-test-NOT-A-SECRET-1234";
+  const resolved = resolvedFor(t, "coder");
+  const vars = { ...resolved.vars, [name]: secret, "fallback.harness": "pi", "fallback.thinking": "high" };
+  assert.throws(() => sessionModel({ ...resolved, vars }, {}, route), error => {
+    assert.ok(error instanceof BundleError);
+    assert.equal(error.code, "bundle-refused");
+    assert.equal(error.message, `instance coder: unknown model table selection for ${name} var`);
+    assert.ok(!error.message.includes(secret));
+    return true;
+  });
 });
 
 test("a pi bundle: prompt, policy, tools and manifest, 0600 in a 0700 directory", (t) => {
@@ -180,17 +193,17 @@ test("a chief-of-staff bundle lists launch among the bus tools and the manifest'
 
 // Row 132 (#1628, REQ-ROLE-2, REQ-COS-1): the 3d re-pin window checks this manifest: both tools typed.
 // Row 141 (#1635, REQ-MSG-2) granted instance.name, and row 155 (#1649) gives it set_name, so nothing
-// the chief holds is untyped and the prompt has no untyped line. Row 194 (#1692, PRD 1.7 REQ-COS-3)
-// granted role.hire and role.fire, with hire and fire.
-test("a chief-of-staff bundle lists end_run, change_organization and set_name as typed and nothing untyped, for either harness", (t) => {
+// the chief held then was untyped. Row 194 (#1692, PRD 1.7 REQ-COS-3)
+// granted role.hire and role.fire, with hire and fire. RR adds two resolve rights; TI owns their tools.
+test("a chief-of-staff bundle lists end_run, change_organization and set_name as typed and resolve rights as untyped, for either harness", (t) => {
   for (const harness of ["pi", "claude-code"]) {
     const r = resolvedFor(t, "chief", (d) => (d.roles.chief.vars = { harness, model: "claude-opus-5-5" }));
     const b = build(t, r);
     const prefix = harness === "pi" ? "" : "mcp__mosaic__";
     assert.deepEqual(b.manifest.typed, ["send_message", "launch", "end_run", "hire", "fire", "organization_revision", "change_organization", "set_name", "read_spec", "write_record", "raise_decision", "list_agents", "inbox", "trail", "list_tasks", "get_task"].map((n) => prefix + n), harness);
-    assert.deepEqual(b.manifest.untyped, [], harness);
+    assert.deepEqual(b.manifest.untyped, ["decision.resolve.technical", "decision.resolve.delivery"], harness);
     assert.match(readFileSync(b.files.prompt, "utf8"), /Bus tools: send_message, launch, end_run, hire, fire, organization_revision, change_organization, set_name, read_spec, write_record, raise_decision, /);
-    assert.doesNotMatch(readFileSync(b.files.prompt, "utf8"), /Actions you hold that have no bus tool yet/);
+    assert.match(readFileSync(b.files.prompt, "utf8"), /Actions you hold that have no bus tool yet/);
   }
 });
 

packages/harness/tests/request-tools.test.mjs

@@ -55,7 +55,7 @@ for (const harness of ['pi', 'claude-code']) {
 }
 
 test('PM intake writes and staff request follow the existing message.send grant', t => {
-  const muted = bundle(t, 'pm', 'pi', doc => { doc.roles.pm.vars['limits.authority'] = ['task.assign']; });
+  const muted = bundle(t, 'pm', 'pi', doc => { doc.roles.pm.vars['limits.authority'] = ['task.assign', 'decision.resolve.delivery']; });
   assert.deepEqual(muted.tools.filter(intake).map(t => t.name).sort(), reads.toSorted());
   assert.ok(!muted.tools.some(t => t.name === 'request_staff'));
 });

packages/harness/tests/runner.test.mjs

@@ -23,15 +23,15 @@ const businesses = {
   demo: {
     id: "demo",
     human: "jason",
-    arbiters: { technical: "pm", delivery: "pm" },
+    arbiters: { technical: "chief", delivery: "pm" },
     launch: { by: "pm", instances: ["coder"], models:{}, limits:{} },
     roles: {
-      pm: { authority: { withinRole: ["message.send", "role.launch"], crossRole: [] } },
+      pm: { authority: { withinRole: ["message.send", "role.launch", "decision.resolve.delivery"], crossRole: [] } },
       coder: { authority: { withinRole: ["message.send"], crossRole: [] } },
       // Row 132 (#1628): the chief of staff's grants and the assistant. Since row 139 (Q169) the
       // chief may end the assistant; with no thread run holding a claim the end refuses not-held.
       // Row 155 (#1649) adds row 141's instance.name for set_name.
-      chief: { definition: "chief-of-staff", authority: { withinRole: ["message.send", "role.end", "organization.change", "instance.name"], crossRole: [] } },
+      chief: { definition: "chief-of-staff", authority: { withinRole: ["message.send", "role.end", "organization.change", "instance.name", "decision.resolve.technical", "decision.resolve.delivery"], crossRole: [] } },
       assistant: { definition: "assistant", authority: { withinRole: ["message.send"], crossRole: [] } },
     },
   },
@@ -829,8 +829,10 @@ test("a run in a landing turn isn't released for a second held decision until it
   const earlier = ctx.broker.bindLaunch({ business: "demo", role: "coder", run: "coder-0", harness: "pi" });
   ctx.call(earlier, "role.claim");
   const d1 = ctx.call(earlier, "decision.raise", merge("vikunja:1/2"));
-  assert.equal(d1.route_to, "pm");
-  ctx.call(ctx.pm, "decision.resolve", { id: d1.id, choice: "yes" });
+  const chief = ctx.broker.bindLaunch({ business: "demo", role: "chief", run: "chief-run", harness: "pi" });
+  ctx.call(chief, "role.claim");
+  assert.equal(d1.route_to, "chief");
+  ctx.call(chief, "decision.resolve", { id: d1.id, choice: "yes" });
   ctx.broker.endLaunch({ business: "demo", run: "coder-0", reason: "exited" });
   const file = join(ctx.runDir, "session.json");
   writeFileSync(file, JSON.stringify({ ...JSON.parse(readFileSync(file, "utf8")), landing: [{ decision: d1.id, task_ref: "vikunja:1/2" }] }));
@@ -843,7 +845,7 @@ test("a run in a landing turn isn't released for a second held decision until it
   await until(() => existsSync(started));
   // d2 is resolved during the landing turn, so the landing pass lists it for the running holder.
   const d2 = ctx.call(ctx.cap, "decision.raise", merge("vikunja:1/3"));
-  ctx.call(ctx.pm, "decision.resolve", { id: d2.id, choice: "yes" });
+  ctx.call(chief, "decision.resolve", { id: d2.id, choice: "yes" });
   assert.deepEqual(ctx.broker.landHolders("demo").map((h) => [h.instance, h.decision]), [["coder", d1.id], ["coder", d2.id]]);
   const release = () => ctx.broker.landRelease({ business: "demo", run: "coder-run", decision: d2.id });
   assert.deepEqual(release(), { released: false, landing: true });

packages/harness/tests/tools.test.mjs

@@ -58,7 +58,8 @@ test("the chief of staff gets launch, send_message, end_run, hire, fire, change_
   // Row 132 (#1628): role.end and organization.change have their tools. Row 141 (#1635) granted
   // instance.name, and row 155 (#1649) gives it set_name, so no held action is untyped. Row 194 (#1692,
   // PRD 1.7 REQ-COS-3) granted role.hire and role.fire, with hire and fire.
-  assert.deepEqual(untypedActions(chief, tools), []);
+  // RR grants resolve rights; TI owns their typed tool exposure.
+  assert.deepEqual(untypedActions(chief, tools), ["decision.resolve.technical", "decision.resolve.delivery"]);
 });
 
 // Row 194 (#1692, PRD 1.7 REQ-COS-3): hire and fire send the broker's argument keys, reason required,
@@ -104,7 +105,7 @@ test("request_staff is the pm's alone: staff.request over message.send, roles an
   const assistant = resolvedFor(t, "assistant", (d) => (d.roles.assistant = { definition: "assistant", holder: "mos" }));
   assert.ok(!names(typedTools({ resolved: assistant })).includes("request_staff"));
   // A pm without message.send is offered no request_staff, as for send_message.
-  const mute = resolvedFor(t, "pm", (d) => (d.roles.pm.vars["limits.authority"] = ["task.assign"]));
+  const mute = resolvedFor(t, "pm", (d) => (d.roles.pm.vars["limits.authority"] = ["task.assign", "decision.resolve.delivery"]));
   assert.ok(!names(typedTools({ resolved: mute, tracker: true })).includes("request_staff"));
   // The pm still has no launch tool, and the chief of staff's launch offer is its limits, not a request.
   assert.ok(!names(tools).includes("launch"));
@@ -240,7 +241,7 @@ test("list_requirements reads the requirement ids, for a task.create holder with
   assert.match(list.description, /task_create takes only these/);
   assert.match(list.description, /Product intake always needs an approved product snapshot/);
   assert.ok(!names(typedTools({ resolved: pm, arbiter: true })).includes("list_requirements"));
-  const noCreate = resolvedFor(t, "pm", (d) => (d.roles.pm.vars["limits.authority"] = ["message.send", "task.assign"]));
+  const noCreate = resolvedFor(t, "pm", (d) => (d.roles.pm.vars["limits.authority"] = ["message.send", "task.assign", "decision.resolve.delivery"]));
   const without = names(typedTools({ resolved: noCreate, tracker: true }));
   assert.ok(without.includes("task_assign") && !without.includes("task_create") && !without.includes("list_requirements"));
   const create = tools.find((x) => x.name === "task_create").parameters.properties;

packages/organization/src/agent-levels.mjs

@@ -87,7 +87,7 @@ export function loadRootAgents(configDir, { rolesDir } = {}) {
     if (error?.name !== "BusinessError") throw error;
     if (error.exitCode === 4 && /not found/.test(error.message)) return deepFreeze({ state: "absent", agents: {}, assistant: null });
     // The read's messages carry the host path; the Console shows this one, so it names the file only.
-    // A parse refusal also quotes the parser, which can quote the file's bytes: say only that it is not JSON.
+    // Keep parse refusals file-only here too, without the host path.
     if (/ is not valid JSON /.test(error.message)) refuse(`root agent file is not valid JSON (${ROOT_FILE})`, error.exitCode);
     refuse(error.message.replaceAll(file, ROOT_FILE), error.exitCode);
   }

packages/organization/src/composition.mjs

@@ -0,0 +1,518 @@
+// Roles round 2, slice P1 (#1873): the primitives registry and the composition validator.
+// Design: docs/plans/2026-11-10_roles-and-rails-design.md sections 3, 4 and 7, and the P1
+// paragraph of section 13.
+//
+// A role is a composition of the primitives in section 4 and nothing else: tools, network,
+// authority, credentials, messaging, skills, instructions and personality. checkComposition
+// checks one against a registry (the core set from vocabulary.mjs plus a plugin-declared set) in
+// the seven steps section 4 lists, in order, and returns the lines a human must see flagged.
+//
+// Nothing calls checkComposition yet. HIRE_ALLOWED and unhireableAction (vocabulary.mjs) still
+// bound a hire, and role.mjs and the broker still use them. Slice A4 switches hire over to this
+// validator and removes them. In P1 the plugin set is whatever the caller passes, empty by
+// default; nothing here reads a plugin file (PL1 builds install and the manifest).
+//
+// A refusal names the field and the position at fault. It quotes a value only when that value is
+// a registered name (a core or plugin action, tool, network, service or scope), so no role text,
+// and no secret placed where a name belongs, reaches an error. Free text (instructions,
+// personality) is never quoted.
+
+import { refuse } from "./errors.mjs";
+import {
+  ACTIONS, ROUTED, GATED_ONLY, TOOLS, NETWORKS, SERVICES, HOST_SERVICE, GITEA_SCOPE_CATEGORIES, VIKUNJA_GRANTABLE,
+  ID_PATTERN,
+} from "./vocabulary.mjs";
+import { NAME as PLUGIN_NAME } from "../../plugins/src/kinds.mjs";
+import { deepFreeze } from "./util.mjs";
+
+// The primitives (section 4). Every other key refuses (step 1).
+export const COMPOSITION_KEYS = Object.freeze([
+  "tools", "network", "authority", "credentials", "messaging", "skills", "instructions", "personality",
+]);
+const REQUIRED = Object.freeze(["tools", "network", "authority", "credentials", "instructions"]);
+const AUTHORITY_KEYS = Object.freeze(["withinRole", "crossRole"]);
+const MESSAGING_KEYS = Object.freeze(["sendTo", "receiveFrom"]);
+const PERSONALITY_KEYS = Object.freeze(["summary", "traits", "voice"]);
+const CREDENTIAL_KEYS = Object.freeze(["service", "scopes"]);
+const PLUGIN_KEYS = Object.freeze(["name", "tools", "actions", "services"]);
+const PLUGIN_SERVICE_KEYS = Object.freeze(["name", "scopes"]);
+
+// Step 6's length bounds, in characters or entries. The design gives none, so P1 sets them. The
+// largest shipped contract is about 8 KB; instructions get twice that. T1 stores personality
+// with these same bounds.
+export const COMPOSITION_BOUNDS = Object.freeze({
+  instructions: 16384,
+  summary: 280,
+  traits: 12,
+  trait: 40,
+  voice: 280,
+  messaging: 64,
+  skills: 64,
+});
+
+// Ruling 8 and R9: a hired agent can't hire or fire, whatever HIRE_ALLOWED says later.
+export const NEVER_HIRED = Object.freeze(["role.hire", "role.fire"]);
+// The role rails (section 3): an action that lets its holder decide for other agents.
+export const RESOLVE_PREFIX = "decision.resolve.";
+
+export const FLAG_RESOLVE = "resolve-right";
+export const FLAG_ABOVE_CHIEF = "above-chief";
+
+const SKILL_NAME = /^[A-Za-z0-9._-]+$/;
+const GITEA_SCOPE = /^(read|write):([a-z]+)$/;
+// A plugin's declared bare name: lower-case segments joined by dots. With the prefix it is
+// <plugin>.<name>.
+const DECLARED_NAME = /^[a-z][a-z0-9_-]*(?:\.[a-z][a-z0-9_-]*)*$/;
+const DECLARED_SCOPE = /^[a-z][a-z0-9_.:-]*$/;
+const NAME_MAX = 64;
+
+const isPlain = (value) => {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+};
+
+// ---------------------------------------------------------------------------------------------
+// The registry.
+
+const BUILT = new WeakSet();
+
+// The first segment of every core action, tool and service. A plugin may not take one as its
+// name, so a prefixed plugin name can never read as a core name (git + push.protected).
+const RESERVED_PLUGIN_NAMES = Object.freeze([...new Set([
+  ...ACTIONS.map((a) => a.split(".")[0]), ...TOOLS, ...SERVICES, HOST_SERVICE, ...NETWORKS,
+])]);
+
+function declaredList(value, where, pattern) {
+  if (value === undefined) return [];
+  if (!Array.isArray(value)) refuse(`${where} must be an array`);
+  const seen = new Set();
+  value.forEach((entry, i) => {
+    if (typeof entry !== "string" || entry.length > NAME_MAX || !pattern.test(entry)) {
+      refuse(`${where}[${i}] must be a name matching ${pattern}`);
+    }
+    if (seen.has(entry)) refuse(`${where}[${i}] repeats an earlier entry`);
+    seen.add(entry);
+  });
+  return [...seen];
+}
+
+// One plugin's declared set: { name, tools?: [name], actions?: [name], services?: [{ name, scopes:
+// [scope] }] }. Names are declared bare and registered with the plugin's prefix. A plugin action is
+// always routed (section 4), so it may not name a hard wait, and no declared name may reuse a core
+// name, bare or prefixed.
+function checkPlugin(plugin, i, core) {
+  const where = `registry plugins[${i}]`;
+  if (!isPlain(plugin)) refuse(`${where} must be a JSON object`);
+  for (const key of Object.keys(plugin)) {
+    if (!PLUGIN_KEYS.includes(key)) refuse(`${where} has a key outside ${PLUGIN_KEYS.join(", ")}`);
+  }
+  const { name } = plugin;
+  if (typeof name !== "string" || name.length > 32 || !PLUGIN_NAME.test(name)) refuse(`${where}.name must match ${PLUGIN_NAME}`);
+  if (RESERVED_PLUGIN_NAMES.includes(name)) refuse(`${where}.name ${JSON.stringify(name)} is a core name`);
+  const full = (bare) => `${name}.${bare}`;
+  const coreName = (bare) => core.has(bare) || core.has(full(bare));
+  const tools = declaredList(plugin.tools, `${where}.tools`, DECLARED_NAME);
+  tools.forEach((bare, j) => {
+    if (coreName(bare)) refuse(`${where}.tools[${j}] reuses the core name ${JSON.stringify(core.has(bare) ? bare : full(bare))}`);
+  });
+  const actions = declaredList(plugin.actions, `${where}.actions`, DECLARED_NAME);
+  actions.forEach((bare, j) => {
+    if (GATED_ONLY.includes(bare)) refuse(`${where}.actions[${j}] declares ${bare}, a hard wait; a plugin action is always routed`);
+    if (coreName(bare)) refuse(`${where}.actions[${j}] reuses the core name ${JSON.stringify(core.has(bare) ? bare : full(bare))}`);
+  });
+  if (plugin.services !== undefined && !Array.isArray(plugin.services)) refuse(`${where}.services must be an array`);
+  const services = (plugin.services ?? []).map((service, j) => {
+    const at = `${where}.services[${j}]`;
+    if (!isPlain(service)) refuse(`${at} must be a JSON object`);
+    for (const key of Object.keys(service)) {
+      if (!PLUGIN_SERVICE_KEYS.includes(key)) refuse(`${at} has a key outside ${PLUGIN_SERVICE_KEYS.join(", ")}`);
+    }
+    const [bare] = declaredList([service.name], `${at}.name`, DECLARED_NAME);
+    if (coreName(bare)) refuse(`${at}.name reuses the core name ${JSON.stringify(core.has(bare) ? bare : full(bare))}`);
+    const scopes = declaredList(service.scopes, `${at}.scopes`, DECLARED_SCOPE);
+    if (scopes.length === 0) refuse(`${at}.scopes must not be empty`);
+    return { name: full(bare), scopes };
+  });
+  const names = [...tools, ...actions, ...services.map((s) => s.name.slice(name.length + 1))];
+  const twice = names.find((n, j) => names.indexOf(n) !== j);
+  if (twice !== undefined) refuse(`${where} declares ${JSON.stringify(full(twice))} twice`);
+  return { name, tools: tools.map(full), actions: actions.map(full), services };
+}
+
+// The registry checkComposition reads: the core set plus each plugin's declared set. The plugin
+// set is the caller's input and empty by default (PL1 passes the plugins enabled in the
+// organization). checkComposition accepts only a registry built here.
+export function buildRegistry({ plugins = [] } = {}) {
+  if (!Array.isArray(plugins)) refuse("registry plugins must be an array");
+  const core = new Set([...ACTIONS, ...TOOLS, ...SERVICES, HOST_SERVICE]);
+  const declared = plugins.map((plugin, i) => checkPlugin(plugin, i, core));
+  const pluginNames = declared.map((p) => p.name);
+  const twice = pluginNames.find((n, j) => pluginNames.indexOf(n) !== j);
+  if (twice !== undefined) refuse(`registry names plugin ${JSON.stringify(twice)} twice`);
+  const services = Object.create(null);
+  for (const name of SERVICES) services[name] = { kind: name };
+  services[HOST_SERVICE] = { kind: HOST_SERVICE };
+  for (const p of declared) for (const s of p.services) services[s.name] = { kind: "plugin", scopes: s.scopes };
+  const pluginActions = declared.flatMap((p) => p.actions);
+  const registry = deepFreeze({
+    tools: [...TOOLS, ...declared.flatMap((p) => p.tools)],
+    networks: [...NETWORKS],
+    actions: [...ACTIONS, ...pluginActions],
+    routed: [...ROUTED, ...pluginActions],
+    services,
+    plugins: declared,
+  });
+  BUILT.add(registry);
+  return registry;
+}
+
+// ---------------------------------------------------------------------------------------------
+// The validator.
+
+function keysWithin(object, allowed, where) {
+  Object.keys(object).forEach((key, i) => {
+    if (!allowed.includes(key)) refuse(`composition ${where} has an unknown key (key ${i + 1}; allowed: ${allowed.join(", ")})`);
+  });
+}
+
+// A list of distinct strings. Entries are named by position only: this runs before anything is
+// known to be a registered name.
+function stringList(value, where, { nonEmpty = false } = {}) {
+  if (!Array.isArray(value)) refuse(`composition ${where} must be an array`);
+  if (nonEmpty && value.length === 0) refuse(`composition ${where} must not be empty`);
+  const seen = new Set();
+  for (let i = 0; i < value.length; i += 1) {
+    if (typeof value[i] !== "string" || value[i].includes("\0")) refuse(`composition ${where}[${i}] must be a string`);
+    if (seen.has(value[i])) refuse(`composition ${where}[${i}] repeats an earlier entry`);
+    seen.add(value[i]);
+  }
+  return [...seen];
+}
+
+function text(value, where) {
+  if (typeof value !== "string" || value.includes("\0")) refuse(`composition ${where} must be a string`);
+  return value;
+}
+
+// Step 1: the shape, with every unknown key refused. Returns a fresh copy; the input is not read
+// again after this.
+function shape(role) {
+  if (!isPlain(role)) refuse("composition must be a JSON object");
+  keysWithin(role, COMPOSITION_KEYS, "role");
+  for (const key of REQUIRED) {
+    if (role[key] === undefined) refuse(`composition requires "${key}"`);
+  }
+  const out = {};
+  out.tools = stringList(role.tools, "tools", { nonEmpty: true });
+  if (typeof role.network !== "string") refuse("composition network must be a string");
+  out.network = role.network;
+
+  if (!isPlain(role.authority)) refuse("composition authority must be a JSON object");
+  keysWithin(role.authority, AUTHORITY_KEYS, "authority");
+  out.authority = {};
+  for (const key of AUTHORITY_KEYS) out.authority[key] = stringList(role.authority[key], `authority.${key}`);
+  out.authority.crossRole.forEach((action, i) => {
+    if (out.authority.withinRole.includes(action)) refuse(`composition authority.crossRole[${i}] is also in authority.withinRole`);
+  });
+
+  if (!Array.isArray(role.credentials)) refuse("composition credentials must be an array");
+  out.credentials = role.credentials.map((entry, i) => {
+    const where = `credentials[${i}]`;
+    if (!isPlain(entry)) refuse(`composition ${where} must be a JSON object`);
+    keysWithin(entry, CREDENTIAL_KEYS, where);
+    if (typeof entry.service !== "string") refuse(`composition ${where}.service must be a string`);
+    const copy = { service: entry.service };
+    if (entry.scopes !== undefined) {
+      if (Array.isArray(entry.scopes)) {
+        copy.scopes = stringList(entry.scopes, `${where}.scopes`);
+      } else if (isPlain(entry.scopes)) {
+        // No prototype, so a "__proto__" group stays a key and step 2 refuses it.
+        copy.scopes = Object.create(null);
+        Object.keys(entry.scopes).forEach((group, j) => {
+          if (group.includes("\0")) refuse(`composition ${where}.scopes key ${j + 1} must be a string`);
+          copy.scopes[group] = stringList(entry.scopes[group], `${where}.scopes (group ${j + 1})`);
+        });
+      } else {
+        refuse(`composition ${where}.scopes must be an array or a JSON object`);
+      }
+    }
+    return copy;
+  });
+
+  if (role.messaging === undefined) {
+    out.messaging = null;
+  } else {
+    if (!isPlain(role.messaging)) refuse("composition messaging must be a JSON object");
+    keysWithin(role.messaging, MESSAGING_KEYS, "messaging");
+    out.messaging = {};
+    for (const key of MESSAGING_KEYS) {
+      out.messaging[key] = stringList(role.messaging[key], `messaging.${key}`);
+      out.messaging[key].forEach((entry, i) => {
+        if (!ID_PATTERN.test(entry)) refuse(`composition messaging.${key}[${i}] must be a role name matching ${ID_PATTERN}`);
+        if (entry === "tester") refuse(`composition messaging.${key}[${i}] names the tester, which is never a role`);
+      });
+    }
+  }
+
+  out.skills = role.skills === undefined ? [] : stringList(role.skills, "skills");
+  out.skills.forEach((name, i) => {
+    if (!SKILL_NAME.test(name) || name === "." || name === "..") refuse(`composition skills[${i}] must be a skill directory name matching ${SKILL_NAME}`);
+  });
+
+  out.instructions = text(role.instructions, "instructions");
+
+  if (role.personality === undefined) {
+    out.personality = null;
+  } else {
+    if (!isPlain(role.personality)) refuse("composition personality must be a JSON object");
+    keysWithin(role.personality, PERSONALITY_KEYS, "personality");
+    out.personality = {};
+    if (role.personality.summary !== undefined) out.personality.summary = text(role.personality.summary, "personality.summary");
+    if (role.personality.traits !== undefined) out.personality.traits = stringList(role.personality.traits, "personality.traits");
+    if (role.personality.voice !== undefined) out.personality.voice = text(role.personality.voice, "personality.voice");
+  }
+  return out;
+}
+
+function checkGitea(scopes, where) {
+  if (!Array.isArray(scopes) || scopes.length === 0) refuse(`composition ${where}.scopes must be a non-empty array of read:<category> or write:<category>`);
+  const categories = new Set();
+  scopes.forEach((scope, i) => {
+    const m = GITEA_SCOPE.exec(scope);
+    if (!m || !GITEA_SCOPE_CATEGORIES.includes(m[2])) {
+      refuse(`composition ${where}.scopes[${i}] is not a grantable gitea scope (categories: ${GITEA_SCOPE_CATEGORIES.join(", ")}; admin and all are never granted)`);
+    }
+    if (categories.has(m[2])) refuse(`composition ${where}.scopes[${i}] names the category ${m[2]} again; a token holds one level per category`);
+    categories.add(m[2]);
+  });
+}
+
+function checkVikunja(scopes, where) {
+  if (!isPlain(scopes) || Object.keys(scopes).length === 0) refuse(`composition ${where}.scopes must name at least one vikunja route group`);
+  Object.keys(scopes).forEach((group, j) => {
+    if (!Object.hasOwn(VIKUNJA_GRANTABLE, group)) refuse(`composition ${where}.scopes group ${j + 1} is not a grantable vikunja route group`);
+    const verbs = scopes[group];
+    if (verbs.length === 0) refuse(`composition ${where}.scopes.${group} must not be empty`);
+    verbs.forEach((verb, i) => {
+      if (!VIKUNJA_GRANTABLE[group].includes(verb)) refuse(`composition ${where}.scopes.${group}[${i}] is not a grantable vikunja verb`);
+    });
+  });
+}
+
+function checkPluginScopes(scopes, declared, service, where) {
+  if (!Array.isArray(scopes) || scopes.length === 0) refuse(`composition ${where}.scopes must be a non-empty array of ${service} scopes`);
+  scopes.forEach((scope, i) => {
+    if (!declared.includes(scope)) refuse(`composition ${where}.scopes[${i}] is not a scope ${service} declares`);
+  });
+}
+
+// Step 2: every action, tool, network, service and scope must be in the registry.
+function registered(c, registry) {
+  c.tools.forEach((tool, i) => {
+    if (!registry.tools.includes(tool)) refuse(`composition tools[${i}] names no registered tool`);
+  });
+  if (!registry.networks.includes(c.network)) refuse(`composition network must be one of: ${registry.networks.join(", ")}`);
+  for (const key of AUTHORITY_KEYS) {
+    c.authority[key].forEach((action, i) => {
+      if (!registry.actions.includes(action)) refuse(`composition authority.${key}[${i}] names no registered action`);
+    });
+  }
+  const seen = new Set();
+  c.credentials.forEach((entry, i) => {
+    const where = `credentials[${i}]`;
+    if (!Object.hasOwn(registry.services, entry.service)) refuse(`composition ${where}.service names no registered credential service`);
+    if (seen.has(entry.service)) refuse(`composition ${where} names ${entry.service} again`);
+    seen.add(entry.service);
+    const { kind, scopes } = registry.services[entry.service];
+    if (kind === HOST_SERVICE) {
+      if (entry.scopes !== undefined) refuse(`composition ${where} names ${HOST_SERVICE}, which takes no scopes`);
+    } else if (kind === "gitea") {
+      checkGitea(entry.scopes, where);
+    } else if (kind === "vikunja") {
+      checkVikunja(entry.scopes, where);
+    } else {
+      checkPluginScopes(entry.scopes, scopes, entry.service, where);
+    }
+  });
+}
+
+function eachAction(c, fn) {
+  for (const key of AUTHORITY_KEYS) c.authority[key].forEach((action, i) => fn(action, key, i));
+}
+
+// Every string in the composition with its path, for step 6.
+function strings(c) {
+  const out = [];
+  c.tools.forEach((v, i) => out.push([`tools[${i}]`, v]));
+  out.push(["network", c.network]);
+  eachAction(c, (v, key, i) => out.push([`authority.${key}[${i}]`, v]));
+  c.credentials.forEach((entry, i) => {
+    out.push([`credentials[${i}].service`, entry.service]);
+    if (Array.isArray(entry.scopes)) entry.scopes.forEach((v, j) => out.push([`credentials[${i}].scopes[${j}]`, v]));
+    else if (entry.scopes) {
+      for (const [group, verbs] of Object.entries(entry.scopes)) {
+        out.push([`credentials[${i}].scopes (group key)`, group]);
+        verbs.forEach((v, j) => out.push([`credentials[${i}].scopes.${group}[${j}]`, v]));
+      }
+    }
+  });
+  if (c.messaging) for (const key of MESSAGING_KEYS) c.messaging[key].forEach((v, i) => out.push([`messaging.${key}[${i}]`, v]));
+  c.skills.forEach((v, i) => out.push([`skills[${i}]`, v]));
+  out.push(["instructions", c.instructions]);
+  if (c.personality) {
+    if (c.personality.summary !== undefined) out.push(["personality.summary", c.personality.summary]);
+    (c.personality.traits ?? []).forEach((v, i) => out.push([`personality.traits[${i}]`, v]));
+    if (c.personality.voice !== undefined) out.push(["personality.voice", c.personality.voice]);
+  }
+  return out;
+}
+
+function bounded(value, max, where, { empty = false } = {}) {
+  if ((!empty && value.trim().length === 0) || value.length > max) {
+    refuse(`composition ${where} must be ${empty ? "" : "non-empty and "}at most ${max} characters`);
+  }
+}
+
+// Step 6, the bounds half.
+function checkBounds(c) {
+  const b = COMPOSITION_BOUNDS;
+  bounded(c.instructions, b.instructions, "instructions");
+  if (c.personality) {
+    if (c.personality.summary !== undefined) bounded(c.personality.summary, b.summary, "personality.summary");
+    if (c.personality.voice !== undefined) bounded(c.personality.voice, b.voice, "personality.voice");
+    const traits = c.personality.traits ?? [];
+    if (traits.length > b.traits) refuse(`composition personality.traits must hold at most ${b.traits} entries`);
+    traits.forEach((trait, i) => bounded(trait, b.trait, `personality.traits[${i}]`));
+  }
+  if (c.messaging) {
+    for (const key of MESSAGING_KEYS) {
+      if (c.messaging[key].length > b.messaging) refuse(`composition messaging.${key} must hold at most ${b.messaging} entries`);
+    }
+  }
+  if (c.skills.length > b.skills) refuse(`composition skills must hold at most ${b.skills} entries`);
+}
+
+// A plain JSON copy of a caller's object, read once. Getters, proxies and toJSON run here and only
+// here, and whatever they throw becomes the fixed message: their error text could carry role text.
+function snapshot(value, message) {
+  let copy;
+  try {
+    copy = isPlain(value) ? JSON.parse(JSON.stringify(value)) : undefined;
+  } catch {
+    copy = undefined;
+  }
+  if (!isPlain(copy)) refuse(message);
+  return copy;
+}
+
+// The chief's resolved role, as loadRole returns it. Read only for step 7; a malformed one refuses.
+function checkChief(chief) {
+  const bad = () => refuse("checkComposition needs the chief's resolved role");
+  if (!isPlain(chief) || !Array.isArray(chief.tools) || !NETWORKS.includes(chief.network)) bad();
+  if (!isPlain(chief.authority) || !AUTHORITY_KEYS.every((k) => Array.isArray(chief.authority[k]))) bad();
+  if (!Array.isArray(chief.credentials) || !chief.credentials.every((c) => isPlain(c) && typeof c.service === "string")) bad();
+  if (chief.messaging !== null && chief.messaging !== undefined &&
+    !(isPlain(chief.messaging) && MESSAGING_KEYS.every((k) => Array.isArray(chief.messaging[k])))) bad();
+  return chief;
+}
+
+// One string per credential scope a role holds: service, then scope (a vikunja scope is
+// group.verb; host has the one line "host").
+function credentialLines(credentials) {
+  const out = [];
+  for (const { service, scopes } of credentials) {
+    if (scopes === undefined) out.push([service, service]);
+    else if (Array.isArray(scopes)) for (const scope of scopes) out.push([service, scope]);
+    else for (const [group, verbs] of Object.entries(scopes)) for (const verb of verbs) out.push([service, `${group}.${verb}`]);
+  }
+  return out;
+}
+
+// Validate a composition (section 4's seven steps, in order) against a registry from
+// buildRegistry, with the chief's resolved role for step 7. options.assertClean is the credential
+// store's check (credentials.assertClean, as the broker's secretCheck); it throws on a held
+// secret. Returns a frozen { composition, flagged }, where each flagged line is
+// { field, value, reasons } and reasons holds "resolve-right" (step 5), "above-chief" (step 7) or
+// both. A composition that fails a step refuses with an OrganizationConfigError.
+export function checkComposition(role, registry, chief, { assertClean } = {}) {
+  if (!BUILT.has(registry)) refuse("checkComposition needs a registry from buildRegistry");
+  if (typeof assertClean !== "function") refuse("checkComposition needs the credential store's assertClean");
+  const boss = checkChief(snapshot(chief, "checkComposition needs the chief's resolved role"));
+
+  // 1. Unknown keys, and the shape.
+  const c = shape(snapshot(role, "composition must be a JSON object"));
+
+  // 2. Every name in the registry.
+  registered(c, registry);
+
+  // 3. Hard waits stay with the human (R4). From here on an action is a registered name and may be
+  //    quoted.
+  eachAction(c, (action, key, i) => {
+    if (!registry.routed.includes(action)) refuse(`composition authority.${key}[${i}] is ${action}, a hard wait the human always decides`);
+  });
+
+  // 4. No hire chains (R9).
+  eachAction(c, (action, key, i) => {
+    if (NEVER_HIRED.includes(action)) refuse(`composition authority.${key}[${i}] is ${action}; a hired agent cannot hire or fire`);
+  });
+
+  // 5. Every resolve right is a flagged line.
+  const lines = [];
+  const flag = (field, value, reason) => {
+    const line = lines.find((l) => l.field === field && l.value === value);
+    if (line) {
+      if (!line.reasons.includes(reason)) line.reasons.push(reason);
+    } else {
+      lines.push({ field, value, reasons: [reason] });
+    }
+  };
+  eachAction(c, (action, key) => {
+    if (action.startsWith(RESOLVE_PREFIX)) flag(`authority.${key}`, action, FLAG_RESOLVE);
+  });
+
+  // 6. No secret in any string (R1), and every field within its bound.
+  for (const [where, value] of strings(c)) {
+    let clean = true;
+    try {
+      assertClean(value);
+    } catch {
+      clean = false;
+    }
+    if (!clean) refuse(`composition ${where} holds a credential`);
+  }
+  checkBounds(c);
+
+  // 7. Everything the chief's own role does not hold (R8). A within-role action is held only
+  //    within-role; a cross-role one either way.
+  const chiefWithin = boss.authority.withinRole;
+  const chiefAny = [...chiefWithin, ...boss.authority.crossRole];
+  c.authority.withinRole.forEach((action) => {
+    if (!chiefWithin.includes(action)) flag("authority.withinRole", action, FLAG_ABOVE_CHIEF);
+  });
+  c.authority.crossRole.forEach((action) => {
+    if (!chiefAny.includes(action)) flag("authority.crossRole", action, FLAG_ABOVE_CHIEF);
+  });
+  c.tools.forEach((tool) => {
+    if (!boss.tools.includes(tool)) flag("tools", tool, FLAG_ABOVE_CHIEF);
+  });
+  if (NETWORKS.indexOf(c.network) > NETWORKS.indexOf(boss.network)) flag("network", c.network, FLAG_ABOVE_CHIEF);
+  const held = new Set(credentialLines(boss.credentials).map(([s, v]) => `${s}\n${v}`));
+  for (const [service, value] of credentialLines(c.credentials)) {
+    if (!held.has(`${service}\n${value}`)) flag(`credentials.${service}`, value, FLAG_ABOVE_CHIEF);
+  }
+  // Both directions: the broker checks the sender's sendTo and the recipient's receiveFrom. A role
+  // with no messaging key may message and hear anyone; "*" stands for that.
+  if (boss.messaging) {
+    for (const key of MESSAGING_KEYS) {
+      const chiefList = boss.messaging[key];
+      if (c.messaging === null) flag(`messaging.${key}`, "*", FLAG_ABOVE_CHIEF);
+      else c.messaging[key].forEach((target) => {
+        if (!chiefList.includes(target)) flag(`messaging.${key}`, target, FLAG_ABOVE_CHIEF);
+      });
+    }
+  }
+
+  for (const line of lines) line.reasons.sort();
+  return deepFreeze({ composition: c, flagged: lines });
+}

packages/organization/src/org-registry.mjs

@@ -4,6 +4,7 @@ import { dirname, isAbsolute, join, normalize, parse, resolve } from 'node:path'
 import { createHash, randomBytes } from 'node:crypto';
 import { processState } from '../../seat/src/process-state.mjs';
 import { ID_PATTERN } from './vocabulary.mjs';
+import { parseJsonFileText } from './util.mjs';
 
 export class OrgError extends Error {
   constructor(code, message, path) { super(message); this.name = 'OrgError'; this.code = code; if (path) this.path = path; }
@@ -22,7 +23,7 @@ async function safeDir(path, create = false) {
 }
 async function readPrivate(file) {
   const fd = await fs.open(file, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
-  try { const st = await fd.stat(); if (!st.isFile() || st.uid !== process.getuid() || (st.mode & 0o777) !== 0o600) fail('org-mismatch', 'unsafe metadata file', file); return JSON.parse(await fd.readFile('utf8')); } finally { await fd.close(); }
+  try { const st = await fd.stat(); if (!st.isFile() || st.uid !== process.getuid() || (st.mode & 0o777) !== 0o600) fail('org-mismatch', 'unsafe metadata file', file); return parseJsonFileText(await fd.readFile('utf8'), file, 'metadata file'); } finally { await fd.close(); }
 }
 async function privateDir(path) { const st = await fs.lstat(path); if (!st.isDirectory() || st.isSymbolicLink() || st.uid !== process.getuid() || (st.mode & 0o077)) fail('org-mismatch', 'unsafe private directory', path); }
 function validateRegistry(doc, file) {
@@ -86,7 +87,7 @@ export function withRegistryWriter(configDir, fn) {
         if (!dir.isDirectory() || dir.isSymbolicLink() || dir.uid !== process.getuid() || (dir.mode & 0o077)) fail('org-mismatch', 'unsafe private directory', configDir);
         const st = fstatSync(fd);
         if (!st.isFile() || st.uid !== process.getuid() || (st.mode & 0o777) !== 0o600) fail('org-mismatch', 'unsafe metadata file', file);
-        registry = validateRegistry(JSON.parse(readFileSync(fd, 'utf8')), file);
+        registry = validateRegistry(parseJsonFileText(readFileSync(fd, 'utf8'), file, 'registry file'), file);
       } finally { closeSync(fd); }
     }
     const publish = () => {

packages/organization/src/org-service.mjs

@@ -9,6 +9,7 @@ import { ID_PATTERN } from './vocabulary.mjs';
 import { OrgError, orgRoot, readRegistry, reserveOrg, resolveOrg, withRegistry, withOrgLifecycle } from './org-registry.mjs';
 import { loadInstalled } from '../../plugins/src/loader.mjs';
 import { BINDING_NAME } from '../../discord/src/binding.mjs';
+import { parseJsonFileText } from './util.mjs';
 const rolesDir = resolve(dirname(fileURLToPath(import.meta.url)), '../../../roles');
 const owner = Object.freeze({ provider: 'local-dev', iss: 'local-dev', sub: 'local-dev-owner' });
 const fail = (code, message, path) => { throw new OrgError(code, message, path); };
@@ -87,7 +88,8 @@ export async function templateRender(id, { fixture, preset, thinking } = {}) {
   if (fixture !== undefined && preset !== undefined) fail('org-invalid', 'choose fixture or preset');
   if (fixture === 'local') preset = 'fixture';
   checkId(id);
-  const doc = JSON.parse(await fs.readFile(new URL('./org-template.json', import.meta.url), 'utf8'));
+  const template = new URL('./org-template.json', import.meta.url);
+  const doc = parseJsonFileText(await fs.readFile(template, 'utf8'), fileURLToPath(template), 'organization template file');
   doc.id = id; doc.projects.work.root = `/__mosaic_org__/${id}/projects/work`;
   if (preset !== undefined) {
     if (typeof preset !== 'string') fail('org-invalid', 'unknown preset');
@@ -126,13 +128,14 @@ async function readCurrentUnlocked(ctx, id, { includeArchived = false } = {}) {
   const found = await resolveOrg(ctx, id);
   if (found.state === 'archived' && !includeArchived) fail('org-archived', 'organization is archived');
   if (found.state !== 'active' && !(includeArchived && found.state === 'archived')) fail('org-unavailable', 'organization is not active');
-  const principal = JSON.parse(await privateRead(join(found.root, 'owner.json'))); if (!same(principal, ctx.principal)) fail('org-forbidden', 'organization owner required');
+  const ownerFile = join(found.root, 'owner.json');
+  const principal = parseJsonFileText(await privateRead(ownerFile), ownerFile, 'organization owner file'); if (!same(principal, ctx.principal)) fail('org-forbidden', 'organization owner required');
   // From here the caller is the verified owner. A failure carries that proof so a list may
   // show this org as broken to its owner; earlier failures prove nothing and stay hidden.
   try {
-    const entry = (await readRegistry(ctx)).orgs[id]; const raw = await privateRead(join(ctx.configDir, 'businesses', `${id}.json`));
+    const entry = (await readRegistry(ctx)).orgs[id]; const file = join(ctx.configDir, 'businesses', `${id}.json`); const raw = await privateRead(file);
     if (!entry.digest || entry.digest !== digest(raw)) fail('org-mismatch', 'organization document and registry disagree');
-    const doc = JSON.parse(raw); await checked(doc); return { ...found, revision: entry.revision, doc, principal };
+    const doc = parseJsonFileText(raw, file, 'organization file'); await checked(doc); return { ...found, revision: entry.revision, doc, principal };
   } catch (e) { if (e && typeof e === 'object') e.ownerVerified = true; throw e; }
 }
 // Readers do not take the writer lock. Require unchanged registry snapshots and
@@ -174,7 +177,7 @@ export async function notificationShow(ctx, id) {
   const file = join(current.root, 'notify', id, 'notify.json');
   const st = await fs.lstat(file);
   if (!st.isFile() || st.isSymbolicLink() || st.uid !== process.getuid() || (st.mode & 0o777) !== 0o600) fail('org-mismatch', 'unsafe notifier configuration');
-  const binding = JSON.parse(await privateRead(file));
+  const binding = parseJsonFileText(await privateRead(file), file, 'notifier configuration file');
   if (!binding || Object.keys(binding).sort().join(',') !== 'binding,notifyVersion' || binding.notifyVersion !== 1 || !(binding.binding === null || typeof binding.binding === 'string' && BINDING_NAME.test(binding.binding))) fail('org-mismatch', 'invalid notifier configuration');
   const record = (await receipts(current.root)).find(r => r.op === 'org.create' && r.org === id && same(r.subject, current.principal));
   if (!record || record.notifications !== 'none') fail('org-mismatch', 'notification choice receipt unavailable');
@@ -325,7 +328,7 @@ export async function deleteOrg(ctx, id, { confirm, ifRevision, busStop } = {})
     try {
       await deleteSafeRoot(ctx.dataRoot);
       await ensurePrivateDir(deleted); await ensurePrivateDir(destination);
-      try { result = JSON.parse(await privateRead(receiptFile)); }
+      try { result = parseJsonFileText(await privateRead(receiptFile), receiptFile, 'deletion receipt file'); }
       catch (e) { if (e.code !== 'ENOENT') throw e; result = { op: 'org.delete', org: id, actor: deletion.actor, time: deletion.time, revision: deletion.revision, destination, bus: null, moves: [], secrets: [], note: 'Purging deleted data and remote-side revocation are out of scope.' }; await atomic(receiptFile, encode(result), true); }
       if (result.org !== id || result.destination !== destination || result.revision !== deletion.revision || !Array.isArray(result.moves) || !Array.isArray(result.secrets)) fail('org-mismatch', 'invalid deletion receipt');
       if (!result.bus) {

packages/organization/src/organization-config.mjs

@@ -267,6 +267,12 @@ export function validateOrganizationDocument(document, file, { rolesDir }) {
     if (definitions[definition].messaging) {
       refuse(`${file} arbiters.${kind} names ${name}, whose role definition ${definition} declares messaging lists`);
     }
+    const right = `decision.resolve.${kind}`;
+    const narrowed = [vars, roles[name].vars].some(layer =>
+      layer["limits.authority"] !== undefined && !layer["limits.authority"].includes(right));
+    if (!definitions[definition].authority.withinRole.includes(right) || narrowed) {
+      refuse(`${file} arbiters.${kind} names ${name}, whose role definition ${definition} lacks ${right}`);
+    }
     arbiters[kind] = name;
   }
 

packages/organization/src/organization.mjs

@@ -7,7 +7,7 @@ import {
 import { join, dirname } from "node:path";
 import { randomUUID } from "node:crypto";
 import { businessFilePath, validateBusinessDocument } from "./organization-config.mjs";
-import { requireId, sha256, canonicalJson } from "./util.mjs";
+import { requireId, sha256, canonicalJson, parseJsonFileText } from "./util.mjs";
 import { isDailyModelQuota } from "../../plugins/src/model-quota.mjs";
 import { checkReplyLimits } from "../../library/src/limits.mjs";
 import { ADDITION_VERB, additionProblem } from "./project-bootstrap.mjs";
@@ -153,7 +153,7 @@ export function organizationWriter({ dir, rolesDir, barrier = () => {} }) {
   function read(id) {
     const file = businessFilePath(id, dir);
     const bytes = regular(file);
-    const document = JSON.parse(bytes);
+    const document = parseJsonFileText(bytes, file, "organization file");
     validateBusinessDocument(document, file, { rolesDir });
     return { document, revision: sha256(bytes) };
   }
@@ -243,7 +243,7 @@ export function organizationWriter({ dir, rolesDir, barrier = () => {} }) {
       throw e;
     }
     if (text && !text.endsWith("\n")) fail("organization-uncertain", "torn organization receipt");
-    const entries = text.trim() ? text.trim().split("\n").map(JSON.parse) : [];
+    const entries = text.trim() ? text.trim().split("\n").map(line => parseJsonFileText(line, logFile(id), "organization receipt file")) : [];
     const pending = new Map();
     for (const e of entries) {
       if (e.state === "prepared") pending.set(e.transaction, e);
@@ -287,7 +287,7 @@ export function organizationWriter({ dir, rolesDir, barrier = () => {} }) {
           fail('org-mismatch', 'organization document and registry disagree');
         }
         if (revision !== before) fail("revision-conflict", "organization revision changed; read again");
-        const old = JSON.parse(oldBytes);
+        const old = parseJsonFileText(oldBytes, file, "organization file");
         if (typeof document === "function") document = document(old);
         guard(old, document);
         replyLimitsFence(old, document, actor);
@@ -421,7 +421,7 @@ export function organizationWriter({ dir, rolesDir, barrier = () => {} }) {
     }
     if (text && !text.endsWith("\n")) fail("organization-uncertain", "torn organization receipt");
     const last = new Map();
-    for (const e of text.trim() ? text.trim().split("\n").map(JSON.parse) : []) last.set(e.transaction, e);
+    for (const e of text.trim() ? text.trim().split("\n").map(line => parseJsonFileText(line, logFile(id), "organization receipt file")) : []) last.set(e.transaction, e);
     const hash = sha256(regular(businessFilePath(id, dir)));
     for (const e of last.values()) {
       const d = e.detail;

packages/organization/src/role.mjs

@@ -4,7 +4,7 @@
 // ceilings. Version 1 files still load: they carry no authority, so every
 // vocabulary action is gated for them.
 
-import { existsSync, lstatSync } from "node:fs";
+import { existsSync, lstatSync, readFileSync } from "node:fs";
 import { basename, dirname, join } from "node:path";
 import { refuse } from "./errors.mjs";
 import {
@@ -155,6 +155,9 @@ function checkContract(contract, file) {
     refuse(`role contract not found: ${path}`);
   }
   if (!stat.isFile() || stat.isSymbolicLink() || stat.size === 0) refuse(`role contract must be a non-empty regular file: ${path}`);
+  if (!/^## Authority[\t ]*\r?$/m.test(readFileSync(path, "utf8"))) {
+    refuse(`role contract ${path} requires a ## Authority section`);
+  }
   return path;
 }
 

packages/organization/src/util.mjs

@@ -58,6 +58,16 @@ export function requireDate(value, where) {
   return value;
 }
 
+// Parser diagnostics can quote file bytes. Keep the existing SyntaxError refusal,
+// but never attach the parser's message or cause to an error that callers can log.
+export function parseJsonFileText(text, file, what = "file") {
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw new SyntaxError(`${what} is not valid JSON (${file})`);
+  }
+}
+
 // Read a JSON file that must be a regular file, not a symbolic link.
 // Missing or not a regular file is 4; unparseable is 2. One descriptor,
 // opened without following a link, serves every check and the read.
@@ -81,9 +91,9 @@ export function readJsonFile(file, what, checkStat) {
     closeSync(fd);
   }
   try {
-    return JSON.parse(text);
-  } catch (error) {
-    refuse(`${what} is not valid JSON (${file}): ${error.message}`);
+    return parseJsonFileText(text, file, what);
+  } catch {
+    refuse(`${what} is not valid JSON (${file})`);
   }
 }
 

packages/organization/src/vocabulary.mjs

@@ -58,6 +58,7 @@ export const ACTIONS = Object.freeze([
   "policy.change",
   "prd.approve",
   "decision.resolve.technical",
+  "decision.resolve.delivery",
   // Row 285 (C2-08b, #1790): a creative agent writes a supporting Markdown file in the human's library.
   // Added as a hard wait and routed under PRD 1.16 REQ-WAIT-3 and REQ-LIB-6; role.mjs grants it within-role
   // to the creative roles only.
@@ -93,6 +94,7 @@ export const ROUTED = Object.freeze([
   "policy.change",
   "prd.approve",
   "decision.resolve.technical",
+  "decision.resolve.delivery",
   // PRD 1.7 REQ-COS-3 (row 194, #1692): the chief's hire and fire, within the bounds the broker checks.
   "role.hire",
   "role.fire",

packages/organization/tests/chief-of-staff.test.mjs

@@ -15,11 +15,11 @@ import { businessDoc, launchDoc, REPO_ROLES, systemFor, tmp, writeJson } from ".
 // Decision 104's list plus role.launch (decision 139) plus role.end and
 // organization.change (row 123, REQ-COS-1) and record.write (row 138), plus instance.name
 // (row 141, REQ-MSG-2, sage-0589), plus role.hire and role.fire (row 194, PRD 1.7 REQ-COS-3,
-// sage-1471, mos-1089). A role file that differs from it fails.
+// sage-1471, mos-1089), plus both resolve rights (RR, #1873). A role file that differs fails.
 const APPROVED = Object.freeze({
   tools: ["read", "grep", "find", "ls"],
   network: "api-only",
-  authority: Object.freeze({ withinRole: Object.freeze(["message.send", "role.launch", "role.end", "organization.change", "record.write", "instance.name", "role.hire", "role.fire"]), crossRole: Object.freeze([]) }),
+  authority: Object.freeze({ withinRole: Object.freeze(["message.send", "role.launch", "role.end", "organization.change", "record.write", "instance.name", "role.hire", "role.fire", "decision.resolve.technical", "decision.resolve.delivery"]), crossRole: Object.freeze([]) }),
   // Row 285 (#1790, mos-1309 item 5, sage-2915): gitea for the library read grant, read scopes only.
   credentials: Object.freeze([Object.freeze({ service: "gitea", scopes: Object.freeze(["read:repository", "read:user"]) })]),
   // Row 194 (#1692, Q4, sage-1374): empty until a policy commit after the PRD 1.7 resolve.
@@ -91,7 +91,7 @@ test("the resolved record matches the approved list, so a widened file fails", (
 
 test("the chief of staff holds role.launch, message.send, role.end, organization.change, record.write, instance.name, role.hire and role.fire; every other action is gated", () => {
   const record = resolved(loadFixture());
-  const held = ["message.send", "role.launch", "role.end", "organization.change", "record.write", "instance.name", "role.hire", "role.fire"];
+  const held = ["message.send", "role.launch", "role.end", "organization.change", "record.write", "instance.name", "role.hire", "role.fire", "decision.resolve.technical", "decision.resolve.delivery"];
   for (const action of ACTIONS) {
     assert.equal(classify(record, action), held.includes(action) ? "within" : "gated", action);
   }

packages/organization/tests/composition.test.mjs

@@ -0,0 +1,325 @@
+// Roles round 2, slice P1 (#1873): the composition validator and its registry.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { loadRole, BusinessError } from "../src/index.mjs";
+import { GATED_ONLY, HIRE_ALLOWED, unhireableAction, ROUTED } from "../src/vocabulary.mjs";
+import {
+  buildRegistry, checkComposition, COMPOSITION_BOUNDS, COMPOSITION_KEYS, FLAG_RESOLVE, FLAG_ABOVE_CHIEF,
+} from "../src/composition.mjs";
+import { REPO_ROLES } from "./helpers.mjs";
+
+const SECRET = "sk-test-NOT-A-SECRET-1234";
+// Stands in for the bus credential store's assertClean. Its own error quotes the secret, so a test
+// can tell if checkComposition ever passes that error on.
+const assertClean = (value) => {
+  if (JSON.stringify(value).includes(SECRET)) throw new Error(`credential-leak: ${SECRET}`);
+};
+const OPTS = { assertClean };
+const CHIEF = loadRole(REPO_ROLES, "chief-of-staff");
+const CORE = buildRegistry();
+
+function base(overrides = {}) {
+  return {
+    tools: ["read"],
+    network: "none",
+    authority: { withinRole: ["message.send"], crossRole: [] },
+    credentials: [{ service: "gitea", scopes: ["read:repository"] }],
+    instructions: "Do the work in the brief.",
+    ...overrides,
+  };
+}
+
+const run = (role, registry = CORE, chief = CHIEF) => checkComposition(role, registry, chief, OPTS);
+
+function refuses(fn, pattern, ...absent) {
+  assert.throws(fn, (error) => {
+    assert.ok(error instanceof BusinessError, `expected BusinessError, got ${error}`);
+    assert.equal(error.exitCode, 2);
+    assert.match(error.message, pattern);
+    for (const text of [SECRET, ...absent]) {
+      assert.ok(!error.message.includes(text), `the refusal quotes ${JSON.stringify(text)}: ${error.message}`);
+    }
+    return true;
+  });
+}
+
+test("a minimal composition passes with nothing flagged", () => {
+  const { composition, flagged } = run(base());
+  assert.deepEqual(flagged, []);
+  assert.equal(composition.instructions, "Do the work in the brief.");
+  assert.equal(composition.messaging, null);
+  assert.equal(composition.personality, null);
+  assert.ok(Object.isFrozen(composition) && Object.isFrozen(composition.authority.withinRole));
+});
+
+test("checkComposition needs a registry from buildRegistry and the store's assertClean", () => {
+  refuses(() => checkComposition(base(), { ...CORE }, CHIEF, OPTS), /registry from buildRegistry/);
+  refuses(() => checkComposition(base(), CORE, CHIEF), /assertClean/);
+  refuses(() => checkComposition(base(), CORE, CHIEF, { assertClean: true }), /assertClean/);
+  refuses(() => checkComposition(base(), CORE, { tools: [] }, OPTS), /chief's resolved role/);
+});
+
+// Step 1.
+test("an unknown key refuses at every level, without quoting the key", () => {
+  const key = `notes ${SECRET}`;
+  refuses(() => run({ ...base(), [key]: 1 }), /role has an unknown key/, key);
+  for (const field of ["name", "title", "contract", "roleVersion", "hireable"]) {
+    refuses(() => run({ ...base(), [field]: "x" }), /role has an unknown key/);
+  }
+  refuses(() => run(base({ authority: { withinRole: [], crossRole: [], [key]: [] } })), /authority has an unknown key/, key);
+  refuses(() => run(base({ credentials: [{ service: "gitea", scopes: ["read:issue"], [key]: 1 }] })), /credentials\[0\] has an unknown key/, key);
+  refuses(() => run(base({ messaging: { sendTo: [], receiveFrom: [], [key]: [] } })), /messaging has an unknown key/, key);
+  refuses(() => run(base({ personality: { summary: "Calm.", [key]: "x" } })), /personality has an unknown key/, key);
+  refuses(() => run(JSON.parse('{"__proto__": {"tools": ["read"]}}')), /unknown key|requires/);
+});
+
+test("the required primitives and their shapes", () => {
+  for (const key of ["tools", "network", "authority", "credentials", "instructions"]) {
+    const role = base();
+    delete role[key];
+    refuses(() => run(role), new RegExp(`requires "${key}"`));
+  }
+  refuses(() => run(base({ tools: [] })), /tools must not be empty/);
+  refuses(() => run(base({ tools: ["read", "read"] })), /tools\[1\] repeats/);
+  refuses(() => run(base({ authority: { withinRole: ["message.send"] } })), /authority.crossRole must be an array/);
+  refuses(() => run(base({ authority: { withinRole: ["message.send"], crossRole: ["message.send"] } })), /crossRole\[0\] is also in authority.withinRole/);
+  refuses(() => run(base({ instructions: ["x"] })), /instructions must be a string/);
+  refuses(() => run(base({ instructions: "a\0b" })), /instructions must be a string/);
+  refuses(() => run(base({ messaging: { sendTo: ["tester"], receiveFrom: [] } })), /names the tester/);
+  refuses(() => run(base({ messaging: { sendTo: ["Bad Name"], receiveFrom: [] } })), /sendTo\[0\] must be a role name/, "Bad Name");
+  refuses(() => run(base({ skills: [".."] })), /skills\[0\] must be a skill directory name/);
+  assert.deepEqual(Object.keys(base()).every((k) => COMPOSITION_KEYS.includes(k)), true);
+});
+
+// Step 2.
+test("an unknown action, tool, network, service or scope refuses without quoting it", () => {
+  const odd = `zz-${SECRET}`;
+  refuses(() => run(base({ authority: { withinRole: [odd], crossRole: [] } })), /withinRole\[0\] names no registered action/, odd);
+  refuses(() => run(base({ authority: { withinRole: [], crossRole: ["task.nonesuch"] } })), /crossRole\[0\] names no registered action/, "task.nonesuch");
+  refuses(() => run(base({ tools: ["read", "hammer"] })), /tools\[1\] names no registered tool/, "hammer");
+  refuses(() => run(base({ network: odd })), /network must be one of: none, api-only, open/, odd);
+  refuses(() => run(base({ credentials: [{ service: "jira", scopes: ["read"] }] })), /credentials\[0\].service names no registered/, "jira");
+  refuses(() => run(base({ credentials: [{ service: "gitea", scopes: ["write:nonesuch"] }] })), /scopes\[0\] is not a grantable gitea scope/, "nonesuch");
+  refuses(() => run(base({ credentials: [{ service: "vikunja", scopes: { nonesuch: ["read_one"] } }] })), /group 1 is not a grantable vikunja route group/, "nonesuch");
+  refuses(() => run(base({ credentials: [{ service: "vikunja", scopes: { __proto__: null, ["__proto__"]: ["read_one"] } }] })), /not a grantable vikunja route group/);
+  refuses(() => run(base({ credentials: [{ service: "vikunja", scopes: { tasks: ["obliterate"] } }] })), /scopes.tasks\[0\] is not a grantable vikunja verb/, "obliterate");
+  refuses(() => run(base({ credentials: [{ service: "host", scopes: ["any"] }] })), /host, which takes no scopes/);
+  refuses(() => run(base({ credentials: [{ service: "gitea", scopes: ["read:issue"] }, { service: "gitea", scopes: ["read:user"] }] })), /credentials\[1\] names gitea again/);
+});
+
+test("gitea admin and all refuse, at either level", () => {
+  for (const scope of ["admin", "all", "write:admin", "read:admin", "write:all", "read:all", "sudo"]) {
+    refuses(() => run(base({ credentials: [{ service: "gitea", scopes: [scope] }] })), /not a grantable gitea scope/);
+  }
+  refuses(() => run(base({ credentials: [{ service: "gitea", scopes: ["read:issue", "write:issue"] }] })), /scopes\[1\] names the category issue again/);
+  refuses(() => run(base({ credentials: [{ service: "gitea", scopes: [] }] })), /non-empty array/);
+});
+
+// Step 3.
+test("each hard wait refuses, in either authority list", () => {
+  assert.ok(GATED_ONLY.length > 0);
+  for (const action of GATED_ONLY) {
+    refuses(() => run(base({ authority: { withinRole: [action], crossRole: [] } })), /withinRole\[0\] is .* a hard wait/);
+    refuses(() => run(base({ authority: { withinRole: [], crossRole: [action] } })), /crossRole\[0\] is .* a hard wait/);
+  }
+});
+
+// Step 4.
+test("role.hire and role.fire refuse", () => {
+  for (const action of ["role.hire", "role.fire"]) {
+    assert.ok(ROUTED.includes(action), `${action} is routed, so step 4 is what refuses it`);
+    refuses(() => run(base({ authority: { withinRole: [action], crossRole: [] } })), /cannot hire or fire/);
+    refuses(() => run(base({ authority: { withinRole: [], crossRole: [action] } })), /cannot hire or fire/);
+  }
+});
+
+// Step 5.
+test("a decision.resolve action comes back as a flagged line", () => {
+  for (const domain of ["technical", "delivery"]) {
+    const action = `decision.resolve.${domain}`;
+    const without = { ...CHIEF, authority: { ...CHIEF.authority,
+      withinRole: CHIEF.authority.withinRole.filter(value => value !== action) } };
+    const input = base({ authority: { withinRole: ["message.send"], crossRole: [action] } });
+    assert.deepEqual(run(input, CORE, without).flagged, [
+      { field: "authority.crossRole", value: action, reasons: [FLAG_ABOVE_CHIEF, FLAG_RESOLVE] },
+    ]);
+    // RR gives the shipped chief both rights. Each still flags, without above-chief.
+    assert.deepEqual(run(input).flagged, [
+      { field: "authority.crossRole", value: action, reasons: [FLAG_RESOLVE] },
+    ]);
+    const held = run(base({ authority: { withinRole: [action], crossRole: [] } }));
+    assert.deepEqual(held.flagged, [{ field: "authority.withinRole", value: action, reasons: [FLAG_RESOLVE] }]);
+  }
+});
+
+// Step 6.
+test("a secret in instructions or personality refuses, and the refusal does not contain it", () => {
+  const cases = [
+    [{ instructions: `Use ${SECRET} for the API.` }, /instructions holds a credential/],
+    [{ personality: { summary: `Knows ${SECRET}.` } }, /personality.summary holds a credential/],
+    [{ personality: { traits: ["calm", `key ${SECRET}`] } }, /personality.traits\[1\] holds a credential/],
+    [{ personality: { voice: `Says ${SECRET} often.` } }, /personality.voice holds a credential/],
+    [{ skills: [SECRET] }, /skills\[0\] holds a credential/],
+  ];
+  for (const [overrides, pattern] of cases) refuses(() => run(base(overrides)), pattern, "Use ", "Knows", "Says");
+});
+
+test("the free text never reaches an error", () => {
+  const prose = "PRIVATE-INSTRUCTION-TEXT";
+  refuses(() => run(base({ instructions: prose.repeat(2000) })), /instructions must be non-empty and at most 16384 characters/, prose);
+  refuses(() => run(base({ instructions: prose, personality: { summary: prose.repeat(20) } })), /personality.summary must be/, prose);
+  refuses(() => run(base({ instructions: prose, authority: { withinRole: ["deploy"], crossRole: [] } })), /hard wait/, prose);
+});
+
+test("the length bounds hold, from one exported constant", () => {
+  assert.deepEqual({ ...COMPOSITION_BOUNDS }, { instructions: 16384, summary: 280, traits: 12, trait: 40, voice: 280, messaging: 64, skills: 64 });
+  assert.ok(Object.isFrozen(COMPOSITION_BOUNDS));
+  const b = COMPOSITION_BOUNDS;
+  run(base({ instructions: "x".repeat(b.instructions), personality: { summary: "s".repeat(b.summary), voice: "v".repeat(b.voice), traits: Array.from({ length: b.traits }, (_, i) => `${i}`.padEnd(b.trait, "t")) } }));
+  refuses(() => run(base({ instructions: "x".repeat(b.instructions + 1) })), /instructions must be/);
+  refuses(() => run(base({ instructions: "   " })), /instructions must be non-empty/);
+  refuses(() => run(base({ personality: { summary: "s".repeat(b.summary + 1) } })), /personality.summary must be/);
+  refuses(() => run(base({ personality: { voice: "v".repeat(b.voice + 1) } })), /personality.voice must be/);
+  refuses(() => run(base({ personality: { traits: Array.from({ length: b.traits + 1 }, (_, i) => `t${i}`) } })), /at most 12 entries/);
+  refuses(() => run(base({ personality: { traits: ["t".repeat(b.trait + 1)] } })), /traits\[0\] must be/);
+  refuses(() => run(base({ messaging: { sendTo: Array.from({ length: b.messaging + 1 }, (_, i) => `r${i}`), receiveFrom: [] } })), /sendTo must hold at most 64/);
+  refuses(() => run(base({ skills: Array.from({ length: b.skills + 1 }, (_, i) => `s${i}`) })), /skills must hold at most 64/);
+});
+
+test("the steps run in order: a hard wait refuses before the secret check", () => {
+  refuses(() => run(base({ instructions: SECRET, authority: { withinRole: ["spend"], crossRole: [] } })), /hard wait/);
+  refuses(() => run(base({ instructions: SECRET, authority: { withinRole: ["role.fire"], crossRole: [] } })), /cannot hire or fire/);
+});
+
+// Step 7.
+test("the shipped coder against the shipped chief flags exactly the hand-built set", () => {
+  const coder = loadRole(REPO_ROLES, "coder");
+  const role = {
+    tools: coder.tools,
+    network: coder.network,
+    authority: coder.authority,
+    credentials: coder.credentials,
+    skills: coder.skills,
+    instructions: readFileSync(join(REPO_ROLES, "coder.md"), "utf8"),
+  };
+  const { flagged } = run(role);
+  const above = (field, value) => ({ field, value, reasons: [FLAG_ABOVE_CHIEF] });
+  const expected = [
+    above("authority.withinRole", "task.update.assigned"),
+    above("authority.withinRole", "git.push.working"),
+    above("authority.withinRole", "review.request"),
+    above("authority.crossRole", "task.scope.change"),
+    above("tools", "write"),
+    above("tools", "edit"),
+    above("tools", "bash"),
+    above("credentials.gitea", "write:issue"),
+    above("credentials.gitea", "write:repository"),
+    above("credentials.vikunja", "tasks.read_one"),
+    above("credentials.vikunja", "tasks.update"),
+    above("credentials.vikunja", "tasks_comments.create"),
+    above("credentials.vikunja", "projects.views_buckets_tasks"),
+  ];
+  const key = (l) => `${l.field} ${l.value}`;
+  assert.deepEqual([...flagged].map((l) => ({ ...l, reasons: [...l.reasons] })).sort((a, b) => key(a).localeCompare(key(b))),
+    expected.sort((a, b) => key(a).localeCompare(key(b))));
+});
+
+test("network, cross-role and messaging above the chief are flagged", () => {
+  assert.deepEqual(run(base({ network: "open" })).flagged, [{ field: "network", value: "open", reasons: [FLAG_ABOVE_CHIEF] }]);
+  assert.deepEqual(run(base({ network: "api-only" })).flagged, []);
+  // A cross-role action the chief holds within its role is not above it.
+  assert.deepEqual(run(base({ authority: { withinRole: [], crossRole: ["message.send"] } })).flagged, []);
+  // A within-role action the chief holds only cross-role is.
+  const crossChief = { ...CHIEF, authority: { withinRole: ["message.send"], crossRole: ["record.write"] } };
+  assert.deepEqual(run(base({ authority: { withinRole: ["record.write"], crossRole: [] } }), CORE, crossChief).flagged,
+    [{ field: "authority.withinRole", value: "record.write", reasons: [FLAG_ABOVE_CHIEF] }]);
+  const host = run(base({ credentials: [{ service: "host" }] })).flagged;
+  assert.deepEqual(host, [{ field: "credentials.host", value: "host", reasons: [FLAG_ABOVE_CHIEF] }]);
+  const narrow = { ...CHIEF, messaging: { sendTo: ["pm"], receiveFrom: ["qa"] } };
+  assert.deepEqual(run(base(), CORE, narrow).flagged, [
+    { field: "messaging.sendTo", value: "*", reasons: [FLAG_ABOVE_CHIEF] },
+    { field: "messaging.receiveFrom", value: "*", reasons: [FLAG_ABOVE_CHIEF] },
+  ]);
+  assert.deepEqual(run(base({ messaging: { sendTo: ["pm", "cto"], receiveFrom: ["qa"] } }), CORE, narrow).flagged,
+    [{ field: "messaging.sendTo", value: "cto", reasons: [FLAG_ABOVE_CHIEF] }]);
+  // Review finding 1: a wider inbound list is above the chief too.
+  assert.deepEqual(run(base({ messaging: { sendTo: ["pm"], receiveFrom: ["qa", "cto"] } }), CORE, narrow).flagged,
+    [{ field: "messaging.receiveFrom", value: "cto", reasons: [FLAG_ABOVE_CHIEF] }]);
+  // A chief with no messaging key holds both directions to everyone.
+  assert.deepEqual(run(base({ messaging: { sendTo: ["cto"], receiveFrom: ["cto"] } })).flagged, []);
+});
+
+// Review finding 2: the caller's object is read once, as JSON data, and nothing it throws escapes.
+test("a getter, proxy or toJSON that throws role text refuses with a fixed message", () => {
+  const throwing = base();
+  Object.defineProperty(throwing, "instructions", { enumerable: true, get() { throw new Error(SECRET); } });
+  refuses(() => run(throwing), /^composition must be a JSON object$/);
+  const proxy = new Proxy(base(), { ownKeys() { throw new Error(SECRET); } });
+  refuses(() => run(proxy), /^composition must be a JSON object$/);
+  const proto = new Proxy(base(), { getPrototypeOf() { throw new Error(SECRET); } });
+  refuses(() => run(proto), /^composition must be a JSON object$/);
+  refuses(() => run(base({ personality: { toJSON() { throw new Error(SECRET); } } })), /^composition must be a JSON object$/);
+  const cyclic = base();
+  cyclic.authority.self = cyclic;
+  refuses(() => run(cyclic), /^composition must be a JSON object$/);
+  refuses(() => run(base({ tools: ["read", 10n] })), /^composition must be a JSON object$/);
+  const chief = { ...CHIEF };
+  Object.defineProperty(chief, "tools", { enumerable: true, get() { throw new Error(SECRET); } });
+  refuses(() => run(base(), CORE, chief), /chief's resolved role/);
+});
+
+test("a getter that changes its answer is read once: what is checked is what comes back", () => {
+  let reads = 0;
+  const role = base();
+  Object.defineProperty(role, "network", { enumerable: true, get() { reads += 1; return reads === 1 ? "none" : "open"; } });
+  const { composition, flagged } = run(role);
+  assert.equal(reads, 1);
+  assert.equal(composition.network, "none");
+  assert.deepEqual(flagged, []);
+});
+
+// The plugin-declared set (section 7, registry shape only).
+test("a plugin action is accepted only with its prefix", () => {
+  const registry = buildRegistry({ plugins: [{ name: "forge", tools: ["lathe"], actions: ["build.run"], services: [{ name: "store", scopes: ["read", "write"] }] }] });
+  const ok = run(base({
+    tools: ["read", "forge.lathe"],
+    authority: { withinRole: ["forge.build.run"], crossRole: [] },
+    credentials: [{ service: "forge.store", scopes: ["read"] }],
+  }), registry);
+  assert.deepEqual(ok.flagged.map((l) => `${l.field} ${l.value}`).sort(),
+    ["authority.withinRole forge.build.run", "credentials.forge.store read", "tools forge.lathe"]);
+  refuses(() => run(base({ authority: { withinRole: ["build.run"], crossRole: [] } }), registry), /names no registered action/, "build.run");
+  refuses(() => run(base({ tools: ["lathe"] }), registry), /names no registered tool/, "lathe");
+  refuses(() => run(base({ credentials: [{ service: "store", scopes: ["read"] }] }), registry), /names no registered credential service/);
+  refuses(() => run(base({ credentials: [{ service: "forge.store", scopes: ["admin"] }] }), registry), /is not a scope forge.store declares/, "admin");
+  // Without the plugin in the registry, its names are unknown.
+  refuses(() => run(base({ authority: { withinRole: ["forge.build.run"], crossRole: [] } })), /names no registered action/);
+});
+
+test("a plugin refuses if it reuses a core name or declares a hard wait", () => {
+  const reg = (plugin) => () => buildRegistry({ plugins: [plugin] });
+  for (const action of GATED_ONLY) refuses(reg({ name: "forge", actions: [action] }), /a hard wait/);
+  refuses(reg({ name: "forge", actions: ["message.send"] }), /reuses the core name "message.send"/);
+  refuses(reg({ name: "forge", tools: ["read"] }), /reuses the core name "read"/);
+  refuses(reg({ name: "forge", services: [{ name: "gitea", scopes: ["x"] }] }), /reuses the core name "gitea"/);
+  for (const name of ["git", "role", "decision", "read", "gitea", "host", "open"]) {
+    refuses(reg({ name, actions: ["x"] }), /is a core name/);
+  }
+  refuses(reg({ name: "Forge" }), /name must match/);
+  refuses(reg({ name: "forge", extra: 1 }), /has a key outside/);
+  refuses(reg({ name: "forge", actions: ["a", "a"] }), /repeats an earlier entry/);
+  refuses(reg({ name: "forge", tools: ["a"], actions: ["a"] }), /declares "forge.a" twice/);
+  refuses(reg({ name: "forge", actions: [`x ${SECRET}`] }), /must be a name matching/);
+  refuses(reg({ name: "forge", services: [{ name: "store", scopes: [] }] }), /scopes must not be empty/);
+  refuses(() => buildRegistry({ plugins: [{ name: "forge" }, { name: "forge" }] }), /plugin "forge" twice/);
+  refuses(() => buildRegistry({ plugins: {} }), /plugins must be an array/);
+  // A plugin action is routed, so it never reads as a hard wait at step 3.
+  assert.ok(buildRegistry({ plugins: [{ name: "forge", actions: ["build.run"] }] }).routed.includes("forge.build.run"));
+});
+
+test("HIRE_ALLOWED and unhireableAction stay until A4", () => {
+  assert.ok(Array.isArray(HIRE_ALLOWED) && HIRE_ALLOWED.length > 0);
+  assert.equal(typeof unhireableAction, "function");
+});

packages/organization/tests/csuite.test.mjs

@@ -89,7 +89,7 @@ test("limits can narrow a C-suite role but never widen it", () => {
 test("any unknown key, tool, action or version in a role file is refused", () => {
   const base = JSON.parse(readFileSync(join(REPO_ROLES, "chief-executive-officer.json"), "utf8"));
   const root = tmp();
-  writeFileSync(join(root, "chief-executive-officer.md"), "# contract\n");
+  writeFileSync(join(root, "chief-executive-officer.md"), "# contract\n\n## Authority\n");
   const check = (extra) => validateRoleDocument({ ...base, ...extra }, join(root, "chief-executive-officer.json"));
   assert.equal(check({}).name, "chief-executive-officer");
   for (const extra of [{ arbiter: "technical" }, { launch: {} }, { tools: ["read", "browser"] }, { roleVersion: 3 }, { authority: { withinRole: ["message.send", "deploy.prod"], crossRole: [] } }]) {

packages/organization/tests/hard-waits.test.mjs

@@ -13,7 +13,7 @@ const WAITS = ["spend", "data.delete", "network.expose", "account.create", "cred
 const LEFT = ["git.merge.protected", "policy.change", "prd.approve", "role.revoke"];
 const role = (authority) => {
   const dir = tmp();
-  writeFileSync(join(dir, "r.md"), "# contract\n");
+  writeFileSync(join(dir, "r.md"), "# contract\n\n## Authority\n");
   const doc = { roleVersion: 2, name: "r", title: "R", contract: "r.md", tools: ["read"], network: "none", authority,
     credentials: [{ service: "gitea", scopes: ["read:issue"] }] };
   return validateRoleDocument(doc, join(dir, "r.json"));

packages/organization/tests/json-redaction.test.mjs

@@ -0,0 +1,130 @@
+import { test } from 'node:test';
+import fsPromises from 'node:fs/promises';
+import { syncBuiltinESMExports } from 'node:module';
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmp, writeJson, REPO_ROLES } from './helpers.mjs';
+import { loadBusiness } from '../src/organization-config.mjs';
+import { loadBusiness as legacyLoadBusiness } from '../../business/src/business.mjs';
+import { loadProject } from '../src/project.mjs';
+import { loadRootAgents } from '../src/agent-levels.mjs';
+import { readJsonFile } from '../src/util.mjs';
+import { organizationWriter } from '../src/organization.mjs';
+import { readRegistry, withRegistryWriter } from '../src/org-registry.mjs';
+import { createOrg, deleteOrg, notificationShow, showOrg, templateRender } from '../src/org-service.mjs';
+
+const secret = 'sk-test-NOT-A-SECRET-1234';
+const malformed = secret;
+function fixture(t) {
+  const root = tmp();
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  const ctx = { configDir: join(root, 'config'), dataRoot: join(root, 'data'), instance: 'test',
+    principal: { provider: 'local-dev', iss: 'local-dev', sub: 'local-dev-owner' } };
+  for (const dir of [ctx.configDir, ctx.dataRoot]) mkdirSync(dir, { mode: 0o700 });
+  return ctx;
+}
+function safe(file, { name = 'SyntaxError', code, exitCode, prefix } = {}) {
+  return error => {
+    assert.equal(error.name, name);
+    assert.equal(error.code, code);
+    assert.equal(error.exitCode, exitCode);
+    assert.ok(error.message.includes(file), error.message);
+    assert.match(error.message, /not valid JSON/);
+    assert.doesNotMatch(error.message, /sk-test|private|broken|Unexpected|position|line \d/);
+    assert.ok(!error.stack.includes(secret));
+    assert.equal(error.cause, undefined);
+    if (prefix) assert.ok(error.message.startsWith(prefix));
+    return true;
+  };
+}
+
+for (const [label, load, relative] of [
+  ['shared reader', file => readJsonFile(file, 'config file'), 'config.json'],
+  ['organization loader', (_file, ctx) => loadBusiness('alpha', { dir: ctx.configDir, rolesDir: REPO_ROLES }), 'businesses/alpha.json'],
+  ['legacy business loader', (_file, ctx) => legacyLoadBusiness('alpha', { dir: ctx.configDir, rolesDir: REPO_ROLES }), 'businesses/alpha.json'],
+  ['project loader', (_file, ctx) => loadProject(ctx.configDir), '.mosaic/project.json'],
+]) test(`${label} names malformed JSON's file without quoting bytes`, t => {
+  const ctx = fixture(t), file = writeJson(join(ctx.configDir, relative), malformed);
+  assert.throws(() => load(file, ctx), safe(file, { name: 'BusinessError', exitCode: 2 }));
+});
+
+test('root agents keep their existing file-only refusal', t => {
+  const ctx = fixture(t); writeJson(join(ctx.configDir, 'agents.json'), malformed);
+  assert.throws(() => loadRootAgents(ctx.configDir, { rolesDir: REPO_ROLES }), safe('agents.json', { name: 'BusinessError', exitCode: 2 }));
+});
+
+for (const operation of ['read', 'write', 'recover', 'findAddition']) test(`organization writer ${operation} does not quote malformed file bytes`, async t => {
+  const ctx = fixture(t);
+  await createOrg(ctx, 'alpha', await templateRender('alpha'));
+  const writer = organizationWriter({ dir: ctx.configDir, rolesDir: REPO_ROLES });
+  const current = writer.read('alpha');
+  const receipt = ['recover', 'findAddition'].includes(operation);
+  const file = receipt ? writer.logFile('alpha') : join(ctx.configDir, 'businesses/alpha.json');
+  if (receipt) mkdirSync(join(ctx.configDir, 'businesses/.history/alpha'), { recursive: true, mode: 0o700 });
+  writeJson(file, malformed + '\n');
+  if (operation === 'write') {
+    // Exercise the parse after both the revision and registry digest fences.
+    current.revision = createHash('sha256').update(readFileSync(file)).digest('hex');
+    const registryFile = join(ctx.configDir, 'org-runtime.json');
+    const registry = JSON.parse(readFileSync(registryFile)); registry.orgs.alpha.digest = current.revision;
+    writeJson(registryFile, registry);
+  }
+  const invoke = () => operation === 'write'
+    ? writer.write('alpha', current.document, { revision: current.revision, actor: ctx.principal.sub })
+    : writer[operation]('alpha', {});
+  assert.throws(invoke, safe(file));
+});
+
+for (const operation of ['async', 'sync']) test(`${operation} registry read names the file without parser bytes`, async t => {
+  const ctx = fixture(t), file = writeJson(join(ctx.configDir, 'org-runtime.json'), malformed);
+  if (operation === 'async') await assert.rejects(readRegistry(ctx), safe(file, { name: 'OrgError', code: 'org-mismatch', prefix: 'invalid registry: ' }));
+  else assert.throws(() => withRegistryWriter(ctx.configDir, () => assert.fail('must refuse')), safe(file));
+});
+
+for (const kind of ['owner', 'organization', 'notifier', 'deletion receipt']) test(`service ${kind} refuses malformed JSON without file bytes`, async t => {
+  const ctx = fixture(t);
+  const created = await createOrg(ctx, 'alpha', await templateRender('alpha'));
+  let file;
+  if (kind === 'owner') file = join(created.root, 'owner.json');
+  if (kind === 'organization') file = join(ctx.configDir, 'businesses/alpha.json');
+  if (kind === 'notifier') file = join(created.root, 'notify/alpha/notify.json');
+  if (kind === 'deletion receipt') {
+    const registryFile = join(ctx.configDir, 'org-runtime.json');
+    const registry = JSON.parse(readFileSync(registryFile));
+    registry.orgs.alpha.state = 'deleting';
+    registry.orgs.alpha.deletion = { actor: ctx.principal, time: new Date().toISOString(), revision: 1, folder: 'alpha-redaction' };
+    writeJson(registryFile, registry);
+    const destination = join(ctx.dataRoot, 'deleted/alpha-redaction');
+    mkdirSync(destination, { recursive: true, mode: 0o700 });
+    file = join(destination, 'receipt.json');
+  }
+  writeJson(file, malformed);
+  if (kind === 'organization') {
+    const registryFile = join(ctx.configDir, 'org-runtime.json');
+    const registry = JSON.parse(readFileSync(registryFile));
+    registry.orgs.alpha.digest = createHash('sha256').update(malformed).digest('hex');
+    writeJson(registryFile, registry);
+  }
+  if (kind === 'notifier') await assert.rejects(notificationShow(ctx, 'alpha'), safe(file));
+  else if (kind === 'deletion receipt') await assert.rejects(deleteOrg(ctx, 'alpha', { confirm: 'alpha', ifRevision: 1, busStop: async () => assert.fail('must refuse first') }), safe(file));
+  else await assert.rejects(showOrg(ctx, 'alpha'), safe(file));
+});
+
+// The packaged template is immutable at runtime; substitute only its read result
+// to exercise a corrupt template without editing repository data.
+test('template reader refuses malformed JSON without quoting template bytes', async t => {
+  const original = fsPromises.readFile;
+  t.mock.method(fsPromises, 'readFile', function(file, ...args) {
+    if (file instanceof URL && file.pathname.endsWith('/org-template.json')) return Promise.resolve(malformed);
+    return original.call(this, file, ...args);
+  });
+  syncBuiltinESMExports();
+  try {
+    await assert.rejects(templateRender('alpha'), safe('org-template.json'));
+  } finally {
+    t.mock.restoreAll();
+    syncBuiltinESMExports();
+  }
+});

packages/organization/tests/resolve-rights.test.mjs

@@ -0,0 +1,86 @@
+// RR (#1873): the file writer refuses arbiters without their domain's right.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { organizationWriter } from '../src/organization.mjs';
+import { loadRole, validateBusinessDocument } from '../src/index.mjs';
+import { businessDoc, REPO_ROLES, rolesCopy, tmp, writeJson } from './helpers.mjs';
+
+for (const [domain, instance, definition] of [['technical', 'cto', 'cto'], ['delivery', 'pm', 'pm']]) {
+  test(`RR: naming ${instance} without decision.resolve.${domain} refuses when written`, t => {
+    const root = tmp(); t.after(() => rmSync(root, { recursive: true, force: true }));
+    const rolesDir = rolesCopy(root), file = join(root, 'businesses/acme.json');
+    writeJson(file, businessDoc(root));
+    const writer = organizationWriter({ dir: root, rolesDir });
+    const { document, revision } = writer.read('acme'), before = readFileSync(file, 'utf8');
+    const roleFile = join(rolesDir, `${definition}.json`), role = JSON.parse(readFileSync(roleFile, 'utf8'));
+    role.authority.withinRole = role.authority.withinRole.filter(a => a !== `decision.resolve.${domain}`);
+    writeJson(roleFile, role);
+    assert.throws(() => writer.write('acme', document, { revision, actor: 'jason' }), error => {
+      assert.match(error.message, new RegExp(`arbiters\\.${domain}.*${instance}.*role definition ${definition}.*decision\\.resolve\\.${domain}`));
+      return true;
+    });
+    assert.equal(readFileSync(file, 'utf8'), before);
+  });
+}
+
+test('RR: a coder named as arbiter refuses when written', t => {
+  const root = tmp(); t.after(() => rmSync(root, { recursive: true, force: true }));
+  const file = join(root, 'businesses/acme.json'); writeJson(file, businessDoc(root));
+  const writer = organizationWriter({ dir: root, rolesDir: REPO_ROLES });
+  const { document, revision } = writer.read('acme'), before = readFileSync(file, 'utf8');
+  document.arbiters.delivery = 'coder';
+  assert.throws(() => writer.write('acme', document, { revision, actor: 'jason' }), /arbiters\.delivery.*coder.*role definition coder.*decision\.resolve\.delivery/);
+  assert.equal(readFileSync(file, 'utf8'), before);
+});
+
+test('RR: a cross-role resolve grant cannot qualify an arbiter', t => {
+  const root = tmp(); t.after(() => rmSync(root, { recursive: true, force: true }));
+  const rolesDir = rolesCopy(root), roleFile = join(rolesDir, 'cto.json');
+  const role = JSON.parse(readFileSync(roleFile, 'utf8'));
+  role.authority.withinRole = role.authority.withinRole.filter(a => a !== 'decision.resolve.technical');
+  role.authority.crossRole.push('decision.resolve.technical'); writeJson(roleFile, role);
+  assert.throws(() => validateBusinessDocument(businessDoc(root), join(root, 'businesses/acme.json'), { rolesDir }), /cto.*decision\.resolve\.technical/);
+});
+
+test('RR: a version 2 contract without its Authority section refuses', t => {
+  const root = tmp(); t.after(() => rmSync(root, { recursive: true, force: true }));
+  const rolesDir = rolesCopy(root);
+  writeFileSync(join(rolesDir, 'coder.md'), '# Role contract: coder\n\n## Duties\nRead only.\n');
+  assert.throws(() => loadRole(rolesDir, 'coder'), /coder.*## Authority/);
+});
+
+for (const [domain, instance] of [['technical', 'cto'], ['delivery', 'pm']]) {
+  for (const layer of ['agent', 'business', 'intersection']) {
+    test(`RR: ${layer} limits removing ${instance}'s ${domain} resolve right refuse when written`, t => {
+      const root = tmp(); t.after(() => rmSync(root, { recursive: true, force: true }));
+      const file = join(root, 'businesses/acme.json'); writeJson(file, businessDoc(root));
+      const writer = organizationWriter({ dir: root, rolesDir: REPO_ROLES });
+      const { document, revision } = writer.read('acme'), before = readFileSync(file, 'utf8');
+      const right = `decision.resolve.${domain}`;
+      const rights = ['message.send', 'decision.resolve.technical', 'decision.resolve.delivery'];
+      if (layer === 'agent') document.roles[instance].vars['limits.authority'] = ['message.send'];
+      else document.vars['limits.authority'] = rights.filter(value => value !== right);
+      if (layer === 'intersection') document.roles[instance].vars['limits.authority'] = rights;
+      assert.throws(() => writer.write('acme', document, { revision, actor: 'jason' }), error => {
+        assert.match(error.message, new RegExp(`arbiters\\.${domain}.*${instance}.*role definition ${instance}.*decision\\.resolve\\.${domain}`));
+        return true;
+      });
+      assert.equal(readFileSync(file, 'utf8'), before);
+    });
+  }
+}
+
+test('RR: narrowed arbiters retaining their domain rights can be written', t => {
+  const root = tmp(); t.after(() => rmSync(root, { recursive: true, force: true }));
+  const file = join(root, 'businesses/acme.json'); writeJson(file, businessDoc(root));
+  const writer = organizationWriter({ dir: root, rolesDir: REPO_ROLES });
+  const { document, revision } = writer.read('acme');
+  document.vars['limits.authority'] = ['message.send', 'decision.resolve.technical', 'decision.resolve.delivery'];
+  for (const [domain, instance] of [['technical', 'cto'], ['delivery', 'pm']]) {
+    document.roles[instance].vars['limits.authority'] = ['message.send', `decision.resolve.${domain}`];
+  }
+  writer.write('acme', document, { revision, actor: 'jason' });
+  assert.deepEqual(writer.read('acme').document.arbiters, document.arbiters);
+});

packages/organization/tests/resolve.test.mjs

@@ -138,10 +138,10 @@ test("limits.authority without role.launch leaves the launcher with no launch bl
 test("limits.authority narrows cross-role actions too", () => {
   // pm, the role with two cross-role actions: the limit keeps one and drops the other.
   const s = setup((d) => {
-    d.roles.pm.vars["limits.authority"] = ["task.create", "task.close", "task.priority.change"];
+    d.roles.pm.vars["limits.authority"] = ["task.create", "task.close", "task.priority.change", "decision.resolve.delivery"];
   });
   const pm = resolve(s, "pm");
-  assert.deepEqual(pm.limits.authority, { withinRole: ["task.create", "task.close"], crossRole: ["task.priority.change"] });
+  assert.deepEqual(pm.limits.authority, { withinRole: ["task.create", "task.close", "decision.resolve.delivery"], crossRole: ["task.priority.change"] });
   assert.equal(classify(pm, "task.priority.change"), "cross");
   assert.equal(classify(pm, "task.scope.change"), "gated");
   assert.equal(classify(pm, "task.assign"), "gated");

packages/organization/tests/role.test.mjs

@@ -15,7 +15,7 @@ function refuses(fn, pattern, exitCode = 2) {
   });
 }
 
-function scratchRole(overrides = {}, contract = "# contract\n") {
+function scratchRole(overrides = {}, contract = "# contract\n\n## Authority\n") {
   const dir = tmp();
   if (contract !== null) writeFileSync(join(dir, "r.md"), contract);
   const doc = {
@@ -243,7 +243,7 @@ test("the six creative roles load: read tools, message.send and library.write, g
 test("M1: a creative role file wider than read and answer is refused", () => {
   const creative = (name, overrides) => {
     const dir = tmp();
-    writeFileSync(join(dir, `${name}.md`), "# contract\n");
+    writeFileSync(join(dir, `${name}.md`), "# contract\n\n## Authority\n");
     const doc = {
       roleVersion: 2, name, title: "C", contract: `${name}.md`, tools: ["read"], network: "none",
       authority: { withinRole: ["message.send"], crossRole: [] }, credentials: [],
@@ -284,7 +284,7 @@ const REFUSED_FOR_HIRE = ACTIONS.filter((action) => !HIRE_ALLOWED.includes(actio
 function hireDir(definitions) {
   const dir = tmp();
   for (const [name, doc] of Object.entries(definitions)) {
-    writeFileSync(join(dir, `${name}.md`), "# contract\n");
+    writeFileSync(join(dir, `${name}.md`), "# contract\n\n## Authority\n");
     writeJson(join(dir, `${name}.json`), doc === 1 ? { roleVersion: 1, name, tools: ["read"] } : {
       roleVersion: 2, name, title: name, contract: `${name}.md`, tools: ["read"], network: "none",
       authority: { withinRole: doc.withinRole ?? ["message.send"], crossRole: doc.crossRole ?? [] }, credentials: [],

packages/webui/src/public/panes.js

@@ -269,7 +269,7 @@
       restore(p, body, kept);
     }
     const content = body.querySelector('[data-project-content]');
-    if (content) await window.MosaicProjects.mountContent({ container: content, project, threads, section: what.section, canSend: false, org, pane: true, views: viewsOf(p, org) });
+    if (content) await window.MosaicProjects.mountContent({ container: content, project, threads, section: what.section, canSend: false, org, pane: true, views: viewsOf(p, org), idPrefix: `pane-${p.key}-` });
     return what.section === 'overview' ? project.name || project.id : `${project.name || project.id} · ${sectionName}`;
   }
   // A pane's request choice and PRD disclosure, per organization, kept on the pane so a repaint

packages/webui/src/public/projects.js

@@ -205,14 +205,15 @@
   // state lives as long as the container.
   const paneViews = new WeakMap();
   const viewState=(container,pane,views)=>{if(!pane) return {selected:selectedRequests,expanded:expandedPrds}; if(views?.selected instanceof Map && views.expanded instanceof Set) return views; if(!paneViews.has(container)) paneViews.set(container,{selected:new Map(),expanded:new Set()}); return paneViews.get(container);};
-  function requirementView(data,project,selected,expandedSet=expandedPrds) {
+  function requirementView(data,project,selected,expandedSet=expandedPrds,idPrefix='') {
+    const pid=esc(idPrefix);
     const options=data.requests.filter(r=>r.draft), r=options.find(x=>x.id===selected)||options[0], d=r?.draft;
     const north=typeof data.north?.content==='string'?data.north.content:null;
-    const select=options.length>1?`<label>Request <select id="project-request-select">${options.map(x=>`<option value="${clean(x.id)}"${x===r?' selected':''}>${clean(x.id)} · ${clean(x.thread.name)}</option>`).join('')}</select></label>`:'';
+    const select=options.length>1?`<label>Request <select id="${pid}project-request-select">${options.map(x=>`<option value="${clean(x.id)}"${x===r?' selected':''}>${clean(x.id)} · ${clean(x.thread.name)}</option>`).join('')}</select></label>`:'';
     const candidate=d?.candidate, expanded=r && expandedSet.has(project.id+':'+r.id);
     const docPath=candidate?.prd_path, docLink=project.repo && typeof docPath==='string' && /^docs\/[A-Za-z0-9][A-Za-z0-9._-]{0,127}\.md$/.test(docPath) ? `#/docs/${encodeURIComponent(project.repo)}/${encodeURIComponent(docPath)}` : null;
     const rows=candidate ? [['PRD version',candidate.prd_version],['Approved snapshot',d.snapshot.id || 'None'],['PRD file',docPath],['PRD blob',candidate.prd_blob],['Records commit',candidate.records_commit],['Confirmed intent commit',candidate.spec_commit],['Mode revision',candidate.mode_revision]].map(([label,value])=>`<div class="project-provenance-row"><span>${label}</span>${label==='PRD file' && docLink?`<a href="${docLink}"><code>${clean(value)}</code></a>`:`<code>${clean(value)}</code>`}</div>`).join('') : '<p>Unavailable until a PRD is read.</p>';
-    return `${r?`<div class="project-panel project-source">${select || `Request <code>${clean(r.id)}</code>`} · ${chip(r.state)} · from ${clean(r.thread.name)} <a href="${conversationLink(r.thread)}">Open conversation</a></div>`:select}<div class="project-columns"><section><h2>Project direction</h2><h3 id="project-north-star">North star</h3>${north!==null?`<div data-north-star></div><a class="project-text-link" href="#/docs/${encodeURIComponent(project.repo)}/${encodeURIComponent('spec/north-star.md')}">Open north star in Docs</a>`:data.northRecordsMissing?`<p>${window.MosaicRecords.markup(project.repo)}</p>`:data.northMissing?'<p>No north star yet.</p>':project.repo?'<p>North star unavailable. Docs could not read this project’s repository.</p>':`<p>This project has no linked repository. The north star and project documents live in a repository. Linking one to an existing project isn't available yet.</p>`}<h3 id="project-prd">${candidate?`PRD ${clean(candidate.prd_version)}`:'PRD'} ${candidate?`<span class="project-chip ${d.snapshot.id?'success':''}">${d.snapshot.id?'Approved':'Draft'}</span>`:''}</h3>${d?`<p>${d.snapshot.id?'Approved snapshot '+clean(d.snapshot.id):'This candidate has no active approved snapshot.'}</p><div class="project-panel project-prd-panel"><div class="project-prd-preview${expanded?' expanded':''}" data-prd></div><button type="button" class="btn project-prd-toggle" aria-expanded="${!!expanded}">${expanded?'Show less':'Show full PRD'}</button></div><h3>Requirements <span class="project-count">${d.requirements.length}</span></h3><div class="project-panel">${d.requirements.map((req,i)=>`<details data-restore-key="req:${clean(r.id)}:${clean(req.id)}"><summary>${clean(req.id)} · ${clean(req.title)}</summary><p>${clean(req.text)}</p><p>Requirement identity: <code>${clean(candidate.requirements[i]?.path)}</code> · <code>${clean(candidate.requirements[i]?.blob)}</code></p></details>`).join('')}</div>`:`<p>${(data.failed || data.requests.some(x=>x.materialFailed))?'Request or PRD unavailable. Refresh to try again.':'No current PRD candidate or approved snapshot. Waiting for a PRD submission.'}</p>`}${d && data.requests.some(x=>x.materialFailed)?'<p role="status">Some request PRDs could not be read. Refresh to try again.</p>':''}</section><aside class="project-panel project-provenance"><details data-restore-key="provenance"${matchMedia('(min-width:700px)').matches?' open':''}><summary>Version and provenance</summary>${rows}${candidate?`<p>Approval and revocation live in the conversation's Request details.</p><a href="${conversationLink(r.thread)}">Open conversation</a>`:''}</details></aside></div>`;
+    return `${r?`<div class="project-panel project-source">${select || `Request <code>${clean(r.id)}</code>`} · ${chip(r.state)} · from ${clean(r.thread.name)} <a href="${conversationLink(r.thread)}">Open conversation</a></div>`:select}<div class="project-columns"><section><h2>Project direction</h2><h3 id="${pid}project-north-star">North star</h3>${north!==null?`<div data-north-star></div><a class="project-text-link" href="#/docs/${encodeURIComponent(project.repo)}/${encodeURIComponent('spec/north-star.md')}">Open north star in Docs</a>`:data.northRecordsMissing?`<p>${window.MosaicRecords.markup(project.repo)}</p>`:data.northMissing?'<p>No north star yet.</p>':project.repo?'<p>North star unavailable. Docs could not read this project’s repository.</p>':`<p>This project has no linked repository. The north star and project documents live in a repository. Linking one to an existing project isn't available yet.</p>`}<h3 id="${pid}project-prd">${candidate?`PRD ${clean(candidate.prd_version)}`:'PRD'} ${candidate?`<span class="project-chip ${d.snapshot.id?'success':''}">${d.snapshot.id?'Approved':'Draft'}</span>`:''}</h3>${d?`<p>${d.snapshot.id?'Approved snapshot '+clean(d.snapshot.id):'This candidate has no active approved snapshot.'}</p><div class="project-panel project-prd-panel"><div class="project-prd-preview${expanded?' expanded':''}" data-prd></div><button type="button" class="btn project-prd-toggle" aria-expanded="${!!expanded}">${expanded?'Show less':'Show full PRD'}</button></div><h3>Requirements <span class="project-count">${d.requirements.length}</span></h3><div class="project-panel">${d.requirements.map((req,i)=>`<details data-restore-key="req:${clean(r.id)}:${clean(req.id)}"><summary>${clean(req.id)} · ${clean(req.title)}</summary><p>${clean(req.text)}</p><p>Requirement identity: <code>${clean(candidate.requirements[i]?.path)}</code> · <code>${clean(candidate.requirements[i]?.blob)}</code></p></details>`).join('')}</div>`:`<p>${(data.failed || data.requests.some(x=>x.materialFailed))?'Request or PRD unavailable. Refresh to try again.':'No current PRD candidate or approved snapshot. Waiting for a PRD submission.'}</p>`}${d && data.requests.some(x=>x.materialFailed)?'<p role="status">Some request PRDs could not be read. Refresh to try again.</p>':''}</section><aside class="project-panel project-provenance"><details data-restore-key="provenance"${matchMedia('(min-width:700px)').matches?' open':''}><summary>Version and provenance</summary>${rows}${candidate?`<p>Approval and revocation live in the conversation's Request details.</p><a href="${conversationLink(r.thread)}">Open conversation</a>`:''}</details></aside></div>`;
   }
   function overview(data,project,canSend,receipt='') {
     const active=data.requests.filter(r=>r.state && !ended(r.state)), waiting=active.filter(r=>needs(r.state)), ordered=[...data.requests].sort(requestOrder), first=ordered[0], threads=[...data.threads];
@@ -255,7 +256,9 @@
     const focus=f.id ? root.querySelector('#'+CSS.escape(f.id)) : f.details ? [...root.querySelectorAll('details[data-restore-key]')].find(el=>el.dataset.restoreKey===f.details)?.querySelector(':scope > summary') : root.querySelectorAll(FOCUSABLE)[f.index];
     focus?.focus({preventScroll:true});
   }
-  async function mountContent({container,project,threads,section,canSend,restore,roomReceipt,org=null,pane=false,views:paneState=null}) {
+  // A Side by side pane passes `idPrefix` (pane-a-, pane-b-), so the same project in both panes
+  // draws distinct ids; the full view passes none and keeps its ids.
+  async function mountContent({container,project,threads,section,canSend,restore,roomReceipt,org=null,pane=false,views:paneState=null,idPrefix=''}) {
     if(!container || !project) return;
     const generation=epoch, run=(contentRuns.get(container) || 0)+1;
     contentRuns.set(container,run);
@@ -267,7 +270,7 @@
     const selected=selectedRequests.get(project.id);
     if(selected && !data.requests.some(r=>r.id===selected && r.draft)) selectedRequests.delete(project.id);
     const selection=selectedRequests.get(project.id);
-    const view = section==='requirements'?requirementView(data,project,selection,expandedPrds):section==='files'?filesView(data,project):section==='tasks'?tasksView(data):overview(data,project,canSend,roomReceipt);
+    const view = section==='requirements'?requirementView(data,project,selection,expandedPrds,idPrefix):section==='files'?filesView(data,project):section==='tasks'?tasksView(data):overview(data,project,canSend,roomReceipt);
     const selectedRequest=data.requests.find(r=>r.id===(selection||data.requests.find(x=>x.draft)?.id));
     // The generated presentation and separately mounted Markdown determine visible content.
     const signature=JSON.stringify([view, section==='requirements' ? selectedRequest?.draft?.prd : null, ['requirements','overview'].includes(section) ? data.north?.content : null, data.failed && ['files','tasks'].includes(section)]);
@@ -285,12 +288,13 @@
     const liveRestore=contentPaints.has(container) && container.children.length ? captureView(container) : null;
     const draw=selected=>{
       const {data,project,section,canSend,roomReceipt}=contentModels.get(container);
-      container.innerHTML=section==='requirements'?requirementView(data,project,selected,expandedPrds):section==='files'?filesView(data,project):section==='tasks'?tasksView(data):overview(data,project,canSend,roomReceipt);
+      container.innerHTML=section==='requirements'?requirementView(data,project,selected,expandedPrds,idPrefix):section==='files'?filesView(data,project):section==='tasks'?tasksView(data):overview(data,project,canSend,roomReceipt);
       if(data.failed && ['files','tasks'].includes(section)) container.insertAdjacentHTML('afterbegin','<p role="status">Some request data could not be read; this list may be incomplete.</p>');
       const selectedRequest=data.requests.find(r=>r.id===(selected||data.requests.find(x=>x.draft)?.id));
       const md=container.querySelector('[data-prd]'); if(md && selectedRequest?.draft) { md.replaceChildren(window.MosaicMarkdown?.render(selectedRequest.draft.prd) || document.createTextNode(selectedRequest.draft.prd)); const toggle=container.querySelector('.project-prd-toggle'); toggle.hidden=!md.classList.contains('expanded') && md.scrollHeight<=md.clientHeight; toggle.addEventListener('click',()=>{const key=project.id+':'+selectedRequest.id; if(expandedPrds.has(key)) expandedPrds.delete(key); else expandedPrds.add(key); const open=expandedPrds.has(key); md.classList.toggle('expanded',open); toggle.setAttribute('aria-expanded',String(open));toggle.textContent=open?'Show less':'Show full PRD';}); }
       const north=container.querySelector('[data-north-star]'); if(north && typeof data.north?.content==='string') { const text=section==='overview' && data.north.content.length>500 ? previewCut(data.north.content,500) : data.north.content; north.replaceChildren(window.MosaicMarkdown?.render(text) || document.createTextNode(text)); }
-      container.querySelector('#project-request-select')?.addEventListener('change',e=>{selectedRequests.set(project.id,e.target.value);draw(e.target.value);container.querySelector('#project-request-select')?.focus({preventScroll:true});});
+      const requestSelect='#'+CSS.escape(idPrefix+'project-request-select');
+      container.querySelector(requestSelect)?.addEventListener('change',e=>{selectedRequests.set(project.id,e.target.value);draw(e.target.value);container.querySelector(requestSelect)?.focus({preventScroll:true});});
     };
     draw(selection);
     restore=liveRestore || restore;
@@ -298,7 +302,7 @@
       restoreView(container,restore);
     }
     const sectionTarget=pane ? null : new URLSearchParams(location.hash.split('?')[1] || '').get('section');
-    if(section==='requirements' && ['prd','north-star'].includes(sectionTarget)) container.querySelector('#project-'+sectionTarget)?.scrollIntoView({block:'start'});
+    if(section==='requirements' && ['prd','north-star'].includes(sectionTarget)) container.querySelector('#'+CSS.escape(idPrefix+'project-'+sectionTarget))?.scrollIntoView({block:'start'});
   }
   // Cut at a word boundary, unless that would leave only a markdown marker (a long heading).
   function previewCut(content,max) {

packages/webui/src/public/tasks-board.js

@@ -373,6 +373,8 @@
   }
   async function submit(form) {
     const kind = form.dataset.tbForm, btns = form.querySelectorAll('button');
+    // A form whose Save is disabled is sending, or waiting on the current task: it takes no second save.
+    if (form.querySelector('[data-tb-submit]')?.disabled) return;
     if (!form.reportValidity()) return;
     let body, t = null;
     if (kind === 'create') {
@@ -388,16 +390,32 @@
     }
     btns.forEach(b => { b.disabled = true; }); formStatus(form, 'Sending…');
     const r = await write(body);
+    // The task changed under the form: the form reopens on the current task and keeps the refusal.
+    // Until the current task is read the old form stays disabled and does not show the refusal, so
+    // the refusal never stands beside the old task and no save goes out against its digest.
+    if (!r.ok && r.error === 'task-conflict' && t) {
+      formStatus(form, 'Reading the current task…');
+      // A read a poll overtook leaves the board's old read in place, so only a read that landed counts.
+      const fresh = await reload().catch(() => false);
+      const now = (fresh && find(key(t))) || await current(t);
+      // Closed (Escape, Cancel) while the task was read: the dialog stays closed. close() clears `open`
+      // at once but queues the event that empties the dialog, so `open` is the check that holds.
+      const d = dialogEl();
+      if (!d.open || !d.contains(form)) { paint(); return; }
+      if (now) { openDialog(editForm(now), dialogEl().dataset.return, now); const f2 = dialogEl().querySelector('form'); if (f2) formStatus(f2, r.message); }
+      else {
+        // The current task could not be read: the form still holds the old one, so it takes no save.
+        opened = null;
+        formStatus(form, 'The task changed after the board read it. Nothing was written, and the current task could not be read; close this form and open the task again.');
+        form.querySelectorAll('[data-tb-cancel]').forEach(b => { b.disabled = false; });
+      }
+      paint();
+      return;
+    }
     btns.forEach(b => { b.disabled = false; });
     if (!r.ok) {
       formStatus(form, r.message);
-      // The task changed under the form: the form shows the current task and keeps the refusal.
-      if (r.error === 'task-conflict' && t) {
-        try { await reload(); } catch {}
-        const now = find(key(t)) || await current(t);
-        if (now) { const msg = r.message; openDialog(editForm(now), dialogEl().dataset.return, now); const f2 = dialogEl().querySelector('form'); if (f2) formStatus(f2, msg); }
-        paint();
-      } else if (r.unknown) { try { await reload(); } catch {} paint(); }
+      if (r.unknown) { try { await reload(); } catch {} paint(); }
       return;
     }
     const label = orgOf(body.org).label;

packages/webui/tests/archive-unknown-browser.test.mjs

@@ -30,7 +30,7 @@ test('a failed archive lookup cannot hide the real broker refusal of an archived
   const store = new Store(root);
   t.after(() => { store.close(); rmSync(root, { recursive: true, force: true }); });
   const roles = { assistant: { definition:'assistant', authority:{withinRole:['message.send'],crossRole:[]} } };
-  const broker = new Broker({ store, businesses:{ demo:{ id:'demo', human:'jason', arbiters:{technical:'assistant',delivery:'assistant'}, roles, definitions:{assistant:{}}, projects:{} } } });
+  const broker = new Broker({ store, businesses:{ demo:{ id:'demo', human:'jason', arbiters:{technical:'chief',delivery:'chief'}, roles: { chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } }, ...roles }, definitions:{assistant:{}}, projects:{} } } });
   const cap = broker.bindHuman({ business:'demo', human:'jason', via:'cli', outsideAgent:true });
   const call = (verb, args = {}) => broker.request(cap, { verb, args });
   const project = call('project.create', { name:'archive test' }).id;

packages/webui/tests/proxy-canary.test.mjs

@@ -19,7 +19,7 @@ test('API-key canary reaches fake once and zero responses/logs/receipts/store fi
   const store = new Store(root);
   t.after(() => { store.close(); rmSync(root, { recursive: true, force: true }); });
   const b = new Broker({ store, proxyPage: (...args) => fake.page.request(...args),
-    businesses: { demo: { id: 'demo', human: 'owner', roles: { coder: { authority: { withinRole: [], crossRole: [] } } }, arbiters: { technical: 'coder', delivery: 'coder' } } } });
+    businesses: { demo: { id: 'demo', human: 'owner', roles: {chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } },  coder: { authority: { withinRole: [], crossRole: [] } } }, arbiters: { technical: 'chief', delivery: 'chief' } } } });
   const cap = b.bindHuman({ business: 'demo', human: 'owner', via: 'cli', outsideAgent: true });
   const logs = [], output = [];
   const auth = await createSsoSession(t, { host: 'console.example', owner: { sub: 'owner-sub', name: 'owner' } });
@@ -57,7 +57,7 @@ test('OAuth URLs, state and code stay out of broker records and management recei
   const store = new Store(root);
   t.after(() => { store.close(); rmSync(root, { recursive: true, force: true }); });
   const b = new Broker({ store, proxyPage: (...args) => fake.page.request(...args),
-    businesses: { demo: { id: 'demo', human: 'owner', roles: { coder: { authority: { withinRole: [], crossRole: [] } } }, arbiters: { technical: 'coder', delivery: 'coder' } } } });
+    businesses: { demo: { id: 'demo', human: 'owner', roles: {chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } },  coder: { authority: { withinRole: [], crossRole: [] } } }, arbiters: { technical: 'chief', delivery: 'chief' } } } });
   const cap = b.bindHuman({ business: 'demo', human: 'owner', via: 'cli', outsideAgent: true });
   const call = (verb, args = {}) => b.request(cap, { verb, args });
   const login = await call('proxy.login.start', { provider: 'claude' });

packages/webui/tests/routes-browser.test.mjs

@@ -31,7 +31,7 @@ test('row 65 Settings: the routing table lists every instance, saves a harness,
  const dir=join(root,'config'),file=join(dir,'businesses','acme.json');
  const host=await startBroker({
   dataRoot:f.dataRoot,
-  businesses:{acme:{id:'acme',human:'jason',arbiters:{technical:'coder',delivery:'coder'},roles:{coder:{authority:{withinRole:[],crossRole:[]}}}}},
+  businesses:{acme:{id:'acme',human:'jason',arbiters:{technical:'chief',delivery:'chief'},roles:{chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } }, coder:{authority:{withinRole:[],crossRole:[]}}}}},
   organization:{dir,rolesDir:f.roles,system:systemFor(root)},
  });
  t.after(()=>host.close());
@@ -161,7 +161,7 @@ test('Routing offers catalogue models only for compatible harnesses and saves a
  const dir=join(root,'config'),file=join(dir,'businesses','acme.json');
  const offered={key:'zai-fixture-id',module:'cliproxy',upstream:'zai',provider:'zai',model:'fixture-id',label:'z.ai / fixture-id',available:true,reason:null,harnesses:['pi']};
  const modelCatalogue={read:async()=>({status:'ready',observedAt:'2026-11-06T00:00:00.000Z',models:[offered],notices:[]}),invalidate(){}};
- const host=await startBroker({dataRoot:f.dataRoot,businesses:{acme:{id:'acme',human:'jason',arbiters:{technical:'coder',delivery:'coder'},roles:{coder:{authority:{withinRole:[],crossRole:[]}}}}},organization:{dir,rolesDir:f.roles,system:systemFor(root)},modelCatalogue});t.after(()=>host.close());
+ const host=await startBroker({dataRoot:f.dataRoot,businesses:{acme:{id:'acme',human:'jason',arbiters:{technical:'chief',delivery:'chief'},roles:{chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } }, coder:{authority:{withinRole:[],crossRole:[]}}}}},organization:{dir,rolesDir:f.roles,system:systemFor(root)},modelCatalogue});t.after(()=>host.close());
  const human=host.broker.bindHuman({business:'acme',human:'jason',via:'cli',outsideAgent:true});
  const call=async(verb,args)=>structuredClone(await host.broker.request(human,{verb,args}));
  const bus={messages:async()=>({messages:[],unread:0}),usage:async()=>{throw Error('no usage');},routes:()=>call('routes')};
@@ -187,7 +187,7 @@ test('Routing offers catalogue models only for compatible harnesses and saves a
 test('Routing switch writes the model-provider setting and keeps other modules', {timeout:60000}, async t => {
  const root=tmp(t,'provider-switch-'), f=fixture(root,'acme');
  const dir=join(root,'config'),file=join(dir,'businesses','acme.json');
- const host=await startBroker({dataRoot:f.dataRoot,businesses:{acme:{id:'acme',human:'jason',arbiters:{technical:'coder',delivery:'coder'},roles:{coder:{authority:{withinRole:[],crossRole:[]}}}}},organization:{dir,rolesDir:f.roles,system:systemFor(root)}});t.after(()=>host.close());
+ const host=await startBroker({dataRoot:f.dataRoot,businesses:{acme:{id:'acme',human:'jason',arbiters:{technical:'chief',delivery:'chief'},roles:{chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } }, coder:{authority:{withinRole:[],crossRole:[]}}}}},organization:{dir,rolesDir:f.roles,system:systemFor(root)}});t.after(()=>host.close());
  const human=host.broker.bindHuman({business:'acme',human:'jason',via:'cli',outsideAgent:true});
  const call=async(verb,args)=>structuredClone(await host.broker.request(human,{verb,args}));
  const bus={messages:async()=>({messages:[],unread:0}),usage:async()=>{throw Error('no usage');},routes:()=>call('routes')};
@@ -230,7 +230,7 @@ test('enabling a discovered harness refreshes Routing and offers its compatible
  const dir=join(root,'config');
  const offered={key:'fixture-pi',module:'cliproxy',upstream:'zai',provider:'zai',model:'fixture-pi',label:'Fixture pi',available:true,reason:null,harnesses:['pi']};
  const modelCatalogue={read:async()=>({status:'ready',observedAt:'2026-11-07T02:24:02.021Z',models:[offered],notices:[]}),invalidate(){}};
- const host=await startBroker({dataRoot:f.dataRoot,businesses:{acme:{id:'acme',human:'jason',arbiters:{technical:'coder',delivery:'coder'},roles:{coder:{authority:{withinRole:[],crossRole:[]}}}}},organization:{dir,rolesDir:f.roles,system:systemFor(root)},modelCatalogue});t.after(()=>host.close());
+ const host=await startBroker({dataRoot:f.dataRoot,businesses:{acme:{id:'acme',human:'jason',arbiters:{technical:'chief',delivery:'chief'},roles:{chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } }, coder:{authority:{withinRole:[],crossRole:[]}}}}},organization:{dir,rolesDir:f.roles,system:systemFor(root)},modelCatalogue});t.after(()=>host.close());
  const human=host.broker.bindHuman({business:'acme',human:'jason',via:'cli',outsideAgent:true});const call=async(verb,args)=>structuredClone(await host.broker.request(human,{verb,args}));
  const web=await startServer({port:0,board:'http://127.0.0.1:9',bus:{messages:async()=>({messages:[],unread:0}),usage:async()=>{throw Error('fixture')},routes:()=>call('routes')},reads:{settings:()=>({business:'acme',release:'fixture',notifier:{}})},log:()=>{}});t.after(()=>close(web));
  const b=await browser();t.after(()=>b.close());const settings=await call('plugins');

packages/webui/tests/routes.test.mjs

@@ -45,7 +45,7 @@ test('row 65 Console: the signed-in human saves a route through a real broker; e
   const dir = join(root, 'config');
   const host = await startBroker({
     dataRoot: f.dataRoot,
-    businesses: { acme: { id: 'acme', human: 'jason', arbiters: { technical: 'coder', delivery: 'coder' }, roles: { coder: { authority: { withinRole: [], crossRole: [] } } } } },
+    businesses: { acme: { id: 'acme', human: 'jason', arbiters: { technical: 'chief', delivery: 'chief' }, roles: {chief: { definition: 'chief-of-staff', authority: { withinRole: ['decision.resolve.technical', 'decision.resolve.delivery'], crossRole: [] } },  coder: { authority: { withinRole: [], crossRole: [] } } } } },
     organization: { dir, rolesDir: f.roles, system: systemFor(root) },
   });
   t.after(() => host.close());