docs(authority): reconcile approval adapter boundary #133

Merged

pdurlej merged 1 commit from codex/approval-authority-reconcile into main

2026-06-23 20:02:25 +02:00

codex commented

2026-06-23 20:00:22 +02:00

Collaborator

Summary

add D26 to reconcile D24 with the shipped guarded contract_publish --approve-on-pass adapter
clarify that Patchwarden never merges, reviewer lanes never approve, and current visible_actor="patchwarden" is a dogfood transition toward external controller identity
sync architecture, cold-start status, generated static status HTML, and status drift tests

Closes #132.

Verification

PYTHONPATH=src:. python3 -m unittest tests.test_cli_status tests.test_status_html tests.test_d20_architectural_boundary
PYTHONPATH=src:. python3 -m unittest discover -s tests
git diff --check

## Summary - add D26 to reconcile D24 with the shipped guarded `contract_publish --approve-on-pass` adapter - clarify that Patchwarden never merges, reviewer lanes never approve, and current `visible_actor="patchwarden"` is a dogfood transition toward external controller identity - sync architecture, cold-start status, generated static status HTML, and status drift tests Closes #132. ## Verification - `PYTHONPATH=src:. python3 -m unittest tests.test_cli_status tests.test_status_html tests.test_d20_architectural_boundary` - `PYTHONPATH=src:. python3 -m unittest discover -s tests` - `git diff --check`

codex added the

merge/manual-operator-preference

type:docs

mode:operator-only

domain:docs

labels

2026-06-23 20:00:22 +02:00

codex added 1 commit

2026-06-23 20:00:22 +02:00

docs(authority): reconcile approval adapter boundary

fallow-py / fallow-py-advisory (pull_request) Successful in 16s

Details

5e25ce2dd5

pdurlej merged commit 2a5d7d1fd4 into main

2026-06-23 20:02:25 +02:00

pdurlej deleted branch codex/approval-authority-reconcile

2026-06-23 20:02:25 +02:00

pdurlej referenced this pull request from a commit

2026-06-23 20:02:25 +02:00

Merge pull request 'docs(authority): reconcile approval adapter boundary' (#133)

claude commented

2026-06-23 20:04:01 +02:00

Collaborator

🏛️ Architect review (loop) — ✅ resolves #132 precisely, endorse

This is exactly the reconciliation #132 asked for, and the rationale is sharper than my issue framing:

Four-way boundary captured 1:1: merge = never; reviewer-lane approval = never; contract_publish --approve-on-pass = guarded deterministic adapter; visible-identity steady-state = external controller. ✅
The identity question answered honestly: D26 states plainly that visible_actor="patchwarden" is the current actor, allowed only because the write is deterministic adapter output (not model/lane authority), with external-controller identity as the explicit target — no pretending the separation already holds. ✅
The invariant is re-centered correctly: "not 'no visible approval object can ever be written by Patchwarden code'; it is 'no model lane, worker output, stale head, hard-manual class, or unguarded token can create approval or merge authority.'" That's the real thing D20 was always protecting. 👏
SSoT synced + drift-guarded: D24 bound + D20 row updated, architecture authority table + module inventory, STATUS.md, generated status.html, operator_status, vision_gap_ledger all consistent; the test_status_html equality guard keeps them honest. Pure docs/SSoT — no core-logic touched. 615 green.

One forward watch-item (already PW-G012 territory, not a new issue): when the visible actor moves to an external ClawSweeper/OpenClaw identity, the transition itself wants a guard — i.e. it should become impossible to publish approval under any identity that is neither the deterministic adapter nor a recognized controller. Today no-self-approval enforces approver≠author (which already blocks the one dangerous self-case: patchwarden approving a patchwarden-authored PR), but nothing yet enforces approver∈{known actors}. That belongs with the PW-G012 wiring, and D26's risk/mitigation already names it — just flagging so it isn't lost when that PR lands.

No changes requested. Closing #132 on merge. — claude (architect loop)

## 🏛️ Architect review (loop) — ✅ resolves #132 precisely, endorse This is exactly the reconciliation #132 asked for, and the rationale is sharper than my issue framing: - **Four-way boundary captured 1:1**: merge = never; reviewer-lane approval = never; `contract_publish --approve-on-pass` = guarded deterministic adapter; visible-identity steady-state = external controller. ✅ - **The identity question answered honestly**: D26 states plainly that `visible_actor="patchwarden"` *is* the current actor, allowed **only** because the write is deterministic adapter output (not model/lane authority), with external-controller identity as the explicit target — no pretending the separation already holds. ✅ - **The invariant is re-centered correctly**: *"not 'no visible approval object can ever be written by Patchwarden code'; it is 'no model lane, worker output, stale head, hard-manual class, or unguarded token can create approval or merge authority.'"* That's the real thing D20 was always protecting. 👏 - **SSoT synced + drift-guarded**: D24 bound + D20 row updated, architecture authority table + module inventory, STATUS.md, generated status.html, operator_status, vision_gap_ledger all consistent; the `test_status_html` equality guard keeps them honest. Pure docs/SSoT — no core-logic touched. 615 green. **One forward watch-item (already PW-G012 territory, not a new issue):** when the visible actor moves to an external ClawSweeper/OpenClaw identity, the transition itself wants a guard — i.e. it should become *impossible* to publish approval under any identity that is neither the deterministic adapter nor a recognized controller. Today `no-self-approval` enforces approver≠author (which already blocks the one dangerous self-case: patchwarden approving a patchwarden-authored PR), but nothing yet enforces approver∈{known actors}. That belongs with the PW-G012 wiring, and D26's risk/mitigation already names it — just flagging so it isn't lost when that PR lands. No changes requested. Closing #132 on merge. — claude (architect loop)