stack/agents/rocko/work/queue-73/BUILD.md

Row 73 (#1567): drop the coder's task.reassign grant, candidate packet, round 1

Author: Rocko. Reviewer: Dewey. Brief: docs/plans/2026-10-11_claude-pin-and-coder-grant.md, section "Coder role: drop the task.reassign grant the broker always refuses". Base: 324c064b (base.txt). At 23:16Z the checkout HEAD f6b9ea4e has no change since the base to any candidate path or to packages/{bus,business,tasks}/src or packages/harness/src/tools.mjs. build.patch applies to it cleanly. The packet is uncommitted. I made no commits, pushes or Gitea calls and read no token or private binding.

Files (files.txt, candidate-manifest.sha256)

File	Change
roles/coder.json	crossRole: ["task.reassign", "task.scope.change"] → ["task.scope.change"]. Nothing else in the file changes.
packages/business/tests/role.test.mjs	"shipped authority follows the note's table": asserts that the coder's crossRole is exactly ["task.scope.change"]
packages/business/tests/resolve.test.mjs	"classify": the coder's task.reassign is now gated and its task.scope.change is cross. "limits.authority narrows cross-role actions too" moves from the coder to the pm (see below).
packages/bus/tests/broker.test.mjs	+1 test built on the shipped role files: "the shipped coder role raises task.reassign as gated to the human; task.scope.change stays cross-role"
packages/harness/tests/tools.test.mjs	+1 test: "a coder with a tracker gets its own task tools and no task_reassign"
packages/tasks/tests/world.mjs	the fixture's coder crossRole now matches the shipped role
packages/tasks/tests/verbs.test.mjs	in "assign and reassign …": a coder's task.reassign refuses field-writer and records no action.allowed
agents/rocko/work/queue-73/mutants.sh	the mutant rerun: mutants.sh <tree>

No change to broker.mjs, PM_VERBS, the slice 1 field table or any other role's grants.

Why the narrowing test moved to the pm

Before this change, the test limited the coder to task.scope.change and watched task.reassign drop out of crossRole. With one cross-role action left, that limit drops nothing from crossRole. I checked this: with the new role file and the old test, the mutant resolve-cross-unnarrowed (crossRole ignores limits.authority) passes the test (out/old-narrow-test-under-mutant.txt). The pm still holds two cross-role actions. The test now limits the pm to task.create, task.close and task.priority.change. It checks that crossRole keeps task.priority.change and drops task.scope.change, and that withinRole narrows too.

Every place that read the old grant, and what it says now

Probe (out/probe-base.txt, out/probe-candidate.txt): the shipped roles through validateBusinessDocument, resolveInstance, busBusiness and a real Broker, as bootConfig assembles them.

Reader	Before (base)	After (candidate)
business/src/resolve.mjs resolveInstance	coder crossRole [task.reassign, task.scope.change]	[task.scope.change]. The resolved digest of every coder instance changes too. Only the bundle manifest records it, and nothing compares it.
business/src/resolve.mjs classify	cross	gated
bus/src/broker.mjs #classification (via cli/src/config.mjs bootConfig → busBusiness)	cross-role; decision.raise routes to the domain arbiter, pm by default (cto for technical)	gated; routes to human
harness/src/tools.mjs typedTools, with a tracker	the coder gets a task_reassign tool	no task_reassign tool; task_scope_change and task_update_assigned remain
harness/src/tools.mjs untypedActions → bundle.mjs prompt, without a tracker	the prompt lists task.reassign among "Actions you hold that have no bus tool yet"	not listed
tasks/src/verbs.mjs PM_VERBS	field-writer before authority	unchanged: field-writer before authority
tasks/tests/world.mjs fixture	copied the old grant	matches the shipped role
business, bus, harness and tasks tests	see Files	see Files

Readers I did not change (outside the brief's files; Sage's call):

• packages/business/README.md, lines 30-43: the version 2 example is the shipped coder file and still shows "crossRole": ["task.reassign", "task.scope.change"]. It goes stale with this change. Suggested fix: drop "task.reassign", from the example.
• packages/tasks/README.md, lines 193-196: "A coder role's crossRole grant of task.reassign can't be used. The writer check refuses it before authority is looked at. …" This will be stale too. Suggested text: "The coder role holds no task.reassign grant (row 73). The writer check refuses a non-pm task.reassign before authority is looked at anyway. If a coder should hand work on, that's a change to the field table, not to the role file."
• packages/tasks/live/run.mjs, line 32: the live run's own copy of the slice 1 authority still gives the coder task.reassign. Nothing runs it in the suites. It never has the coder call task.reassign, so its result doesn't change. It should match world.mjs.
• Unaffected: scripts/test-task.sh line 279 and business/tests/role.test.mjs line 115 are role-validation fixtures, not the coder's grant. Historical notes are left as they are: the slice 1 plan, the Darkwing and Filbert work notes, and lead decision 90.

What a coder's task.reassign does end to end after the change

1. A pi coder session has no task_reassign tool, so it can't make the call through the harness.
2. It can still raise_decision with action: task.reassign, because the tool's action enum is every action. The broker classes it gated and routes it to the human, where before it went to the pm as cross-role. The human is then asked a question that can only end in field-writer.
3. If the human approves and the coder calls the verb directly on the bus, the broker's authorize passes as gated; the bus test shows that. The task verbs refuse first with field-writer, before authorize, so nothing is consumed and nothing is written (tasks test).

The brief names the follow-up but doesn't make it, and nor does this row. To refuse a non-pm task.reassign (or any PM_VERBS action) at decision.raise, before a decision opens, is a broker change and would be its own row.

A bus that is already running keeps the authority it loaded at boot. The change reaches it on its next restart.

Mutants (out/mutants-candidate.txt, out/mutants-base.txt)

Mutant	Edit	Base 324c064b	Candidate
role-keeps-reassign	roles/coder.json puts task.reassign back	n/a (the base is this mutant)	killed by role, classify, bus and harness tests
broker-unlisted-cross	#classification: an action in neither list → cross-role	survived	killed by the new bus test
resolve-cross-unnarrowed	resolveInstance: crossRole ignores limits.authority	killed	killed (by the narrowing test and the harness test "an action outside the instance's authority has no tool")
classify-unlisted-cross	classify: an unlisted action → cross	killed	killed
tools-all-task-verbs	typedTools: a task tool for every verb, held or not	killed	killed (now also by the new harness test)

The script saves each file, applies the sed and checks it changed something. It then runs the five test files and restores the file from the saved copy, so it works on an uncommitted tree. out/mutants-*/ holds each diff and log. I ran the candidate twice. The run recorded here uses the final script; the first run used the same script before a comment-only reflow, with the same results.

Gate (out/gate/, sequential, scratch worktree at 324c064b with the candidate, node_modules linked, 23:09:50Z-23:14:34Z)

Suite	Result
tasks node --test 'packages/tasks/tests/*.test.mjs'	71 pass, 0 fail
bus	81 pass, 0 fail
business	60 pass, 0 fail
harness	58 pass, 0 fail, 0 skipped
cli	112 pass, 0 fail
webui	50 pass, 0 fail
seat	27 pass, 0 fail
test-auth	15 passed, 0 failed
test-conductor	17 passed, 0 failed
test-config	24 passed, 0 failed
test-discord	66 passed, 0 failed
test-extension-package	18 passed, 0 failed
test-foundation	44 passed, 0 failed
test-queue	27 passed, 0 failed
test-release	14 passed, 0 failed
test-task	98 passed, 0 failed (Docker)

cli, webui and seat go beyond the gate the brief names. I ran them because they read the shipped roles. After the gate I removed the rocko-r73_default network.