feat(authority): hire, fire and role changes through pinned human decisions (#1873) #1930

2026-11-11T10:58:10Z

jason.woltje commented

2026-11-11 10:58:10 +00:00

Slice A4 (#1873): hire, fire and role changes go through pinned human decisions. Jason approved this slice as written in design section 13 and the invariant 7 amendment in section 12, at 21:31Z on 11-10.

A chief's hire and fire tools raise a seven-day decision for hire, fire or change, at org, project or root level. The broker computes flagged grants and credential lines against the live chief and pins revisions and a hash of the whole proposal. The chief cannot supply flags, credential lines, expiry or digest.
hire.resolve.console needs org.hire. Flagged or credential proposals also need the organization owner. Root proposals need the instance owner. Generic decision resolution refuses every authority action.
A one-use consume is written before the effect, so a crash cannot replay an approval. Denial, expiry, seen and withdrawal leave agent config untouched.
Approval writes the checked definition, instance and route through the existing level writer. Org fire reuses row 281's stop, revoke and delist executor. Root fire refuses while any other organization exists. Cross-bus revoke is deferred.
Console inbox shows flags, credential scopes and expiry. A person can start hire, fire or change in one step, and can narrow a chief proposal before approving. Widening needs a new decision.
Old instance.hire and instance.fire bus paths refuse decision-required. The direct hire writer, HIRE_ALLOWED and hireable are gone.
roles/: only roles/chief-of-staff.json and .md. AGENTS.md: the three section-12 passages, matching the design text exactly. Every new refusal code has a TI table entry.

Review: security (daybreak-blue) changes 1 (P3), re-check of the fix commit approve 0. Build (Opus) changes 4 (two P2, two P3), all fixed in 5e93356cf with regressions run red first.

Lane gate: 5633/0 across organization, business, bus, cli, webui, redaction and pins, test-config and test-task. Console shots at 1440x900 and 390x844, light and dark.

Lead gate on the rebase onto 634294063: 671 files, 7136/1. Two files went red under load 12 to 15. request-lifecycle hit the per-file time cap and passes 15/0 alone. claude-session row 66 (an unslop event with an empty entryId) failed twice. It does not import any file A4 touches. Run alone twice each on BASE and A4, alternating, it passed 14/0 all four times. Recorded as a load flake.

Deferred: plugin registries in the T1 and A2 validators, the cross-org root fire revoke protocol, and accounts integration for the Console verbs.

Slice A4 (#1873): hire, fire and role changes go through pinned human decisions. Jason approved this slice as written in design section 13 and the invariant 7 amendment in section 12, at 21:31Z on 11-10. - A chief's hire and fire tools raise a seven-day decision for hire, fire or change, at org, project or root level. The broker computes flagged grants and credential lines against the live chief and pins revisions and a hash of the whole proposal. The chief cannot supply flags, credential lines, expiry or digest. - `hire.resolve.console` needs `org.hire`. Flagged or credential proposals also need the organization owner. Root proposals need the instance owner. Generic decision resolution refuses every authority action. - A one-use consume is written before the effect, so a crash cannot replay an approval. Denial, expiry, seen and withdrawal leave agent config untouched. - Approval writes the checked definition, instance and route through the existing level writer. Org fire reuses row 281's stop, revoke and delist executor. Root fire refuses while any other organization exists. Cross-bus revoke is deferred. - Console inbox shows flags, credential scopes and expiry. A person can start hire, fire or change in one step, and can narrow a chief proposal before approving. Widening needs a new decision. - Old `instance.hire` and `instance.fire` bus paths refuse `decision-required`. The direct hire writer, HIRE_ALLOWED and `hireable` are gone. - roles/: only roles/chief-of-staff.json and .md. AGENTS.md: the three section-12 passages, matching the design text exactly. Every new refusal code has a TI table entry. Review: security (daybreak-blue) changes 1 (P3), re-check of the fix commit approve 0. Build (Opus) changes 4 (two P2, two P3), all fixed in 5e93356cf with regressions run red first. Lane gate: 5633/0 across organization, business, bus, cli, webui, redaction and pins, test-config and test-task. Console shots at 1440x900 and 390x844, light and dark. Lead gate on the rebase onto 634294063: 671 files, 7136/1. Two files went red under load 12 to 15. request-lifecycle hit the per-file time cap and passes 15/0 alone. claude-session row 66 (an unslop event with an empty entryId) failed twice. It does not import any file A4 touches. Run alone twice each on BASE and A4, alternating, it passed 14/0 all four times. Recorded as a load flake. Deferred: plugin registries in the T1 and A2 validators, the cross-org root fire revoke protocol, and accounts integration for the Console verbs.

jason.woltje added 2 commits 2026-11-11 10:58:10 +00:00

feat(authority): resolve hire, fire and role changes through pinned human decisions (#1873 ) 89205a6163

fix(authority): close chief grant and root fire review gaps (#1873 ) 5e93356cfa

jason.woltje merged commit 5e93356cfa into refactor

2026-11-11 10:58:17 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: mosaicstack/stack#1930