feat(organization): arbiters must hold their domain's resolve right (#1873) #1911

2026-11-10T22:53:54Z

jason.woltje commented

2026-11-10 22:53:54 +00:00

Roles round 2, slice RR (#1873). Jason approved the section 13 slices at 21:31Z on 11-10.

An arbiter must hold decision.resolve.<domain> for its domain. Writing an organization file that names an arbiter whose role lacks the right refuses, and so does a narrowing of that role. At resolve, every decision now checks the right, not only PRD decisions. An arbiter whose role lost the right after the file was written refuses not-resolver.
decision.resolve.delivery joins the vocabulary next to decision.resolve.technical.
Fixed domains: git.merge.protected is technical and policy.change is delivery, whatever domain the raiser sends. A raiser can't pick its arbiter.
roles/chief-of-staff.json gains both resolve rights, since org-template.json names the chief arbiter for both domains. roles/pm.json and roles/pm.md gain decision.resolve.delivery, a Lead decision during the lane: test organizations name the PM delivery arbiter, and the design's role rails give the PM that domain. No other role changed.
A version 2 contract with no ## Authority section refuses. All shipped contracts have one.
Most of the test diff updates pinned role hashes and fixture arbiters for the new rights.

Lane: Sol. Gate on the rebased tree: 310 files, 3252/0, 1 skipped (the federation entrypoint that points to its own script). New refusal tests fail on BASE (organization 0/5, bus 1/7, where the one pass is a control). Review: Opus, approve with four P3s. Two were fixed, including the writer-narrowing check. Two are deferred as outside RR: a generic prd.approve raise can carry the delivery domain, and a merge landing does not recheck a resolver right removed after approval. A Case 1 host timeout (row253 C4 P10 outer reason) reproduces on BASE and is not counted.

Roles round 2, slice RR (#1873). Jason approved the section 13 slices at 21:31Z on 11-10. - An arbiter must hold `decision.resolve.<domain>` for its domain. Writing an organization file that names an arbiter whose role lacks the right refuses, and so does a narrowing of that role. At resolve, every decision now checks the right, not only PRD decisions. An arbiter whose role lost the right after the file was written refuses `not-resolver`. - `decision.resolve.delivery` joins the vocabulary next to `decision.resolve.technical`. - Fixed domains: `git.merge.protected` is technical and `policy.change` is delivery, whatever domain the raiser sends. A raiser can't pick its arbiter. - `roles/chief-of-staff.json` gains both resolve rights, since `org-template.json` names the chief arbiter for both domains. `roles/pm.json` and `roles/pm.md` gain `decision.resolve.delivery`, a Lead decision during the lane: test organizations name the PM delivery arbiter, and the design's role rails give the PM that domain. No other role changed. - A version 2 contract with no `## Authority` section refuses. All shipped contracts have one. - Most of the test diff updates pinned role hashes and fixture arbiters for the new rights. Lane: Sol. Gate on the rebased tree: 310 files, 3252/0, 1 skipped (the federation entrypoint that points to its own script). New refusal tests fail on BASE (organization 0/5, bus 1/7, where the one pass is a control). Review: Opus, approve with four P3s. Two were fixed, including the writer-narrowing check. Two are deferred as outside RR: a generic `prd.approve` raise can carry the delivery domain, and a merge landing does not recheck a resolver right removed after approval. A Case 1 host timeout (row253 C4 P10 outer reason) reproduces on BASE and is not counted.

jason.woltje added 2 commits 2026-11-10 22:53:54 +00:00

feat(organization): enforce arbiter domain resolve rights (#1873 ) 7de9cfccc3

fix(organization): validate narrowed arbiter resolve authority (#1873 ) e9a079fcc4

jason.woltje merged commit e9a079fcc4 into refactor

2026-11-10 22:54:00 +00:00

jason.woltje referenced this pull request

2026-11-11 00:34:58 +00:00

test(webui): v1 business golden carries RR's resolve rights (#1873) #1914

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: mosaicstack/stack#1911