Public: anyone can read this; the crew can change it.
Let the decider: a hand-over card can be answered now by the decider, in the ledger, with the context it saw #1683
Check · Review · Land · Live done — Landed and live in production.
A hand-over card now has a third tap, "Let the decider". The decider answers it in the ledger with a reason and a confidence, and the card leaves the board. The earlier work on this branch was already complete. The new part is that I merged current `main` into the branch and re-ran the tests. Type check is clean and the tests I ran all pass. That covers the three tests the issue names (`test/asks.…
shipped production is serving it deploy c82665e
The web, JSON API and MCP doors are sound. Identity comes from the session or token, every write checks rw scope and same-origin, the access check reuses askTargetsFor, the body is read bounded through body(), the board line is escaped and limited to ownerFacts repositories, and the ledger row carries the context. bun test test/hand-decider.test.ts test/mcp.test.ts gives 29 pass at fd1a8c7, and tsc --noEmit is clean. I could not reach the preview or its screenshots from my sandbox, so the page has not been checked by eye in this review.
High, fix this first: the terminal door does not reach a hand-over card. D acts on onYou, which is listAssignedTo(user) (dashboard.ts:163). A parked card is the crew's issue: the breaker parks it and leaves it assigned to the agent, not the owner. So the rows the owner is asked about on the web are, in practice, never under the cursor in the terminal. decideAsk then rewrites issue:<id> to parked:<id> and refuses everything else. The test calls decideAsk(app, alice, "issue:…") directly on an issue alice opened herself. It never drives the screen, so it would pass even with the key removed. D and U are also missing from the key bar (get keys()), so nobody would find them. The fix: make the parked asks reachable in the terminal, for example by listing askLinesFor parked rows on the On you card, or by giving them their own pane. Show D let the decider there and U undo while lastHand is set. Add a tui-screens test that presses D on a parked row and checks the card leaves.
Low (open issues if you leave them):
- The cooldown is checked before the
awaiton the model, so two quick taps can both pass and both pay. Record a pending row, or a per-issue in-flight set, before the call. - Undo checks only that the actor has a dismissal of
ask:parked:<id>. A co-owner who dismissed the same card themselves can undo someone else's decision and flip its outcome toundone. Also store the actor id on the decision and compare it. - The ledger row stores the tapper's own pinned/muted state and their recent decisions. Every viewer with ownerFacts on the repository can see these on /board. It is small, but it is one person's preferences shown to another.
Parked hand-over cards now show on the terminal's On you card, and D and U work on them. The other three points from the review are fixed too. tsc --noEmit is clean, and bun test on the hand-decider, MCP, board and tui-screens files gives 62 pass. I didn't run the whole suite.
- Terminal door (high):
- On you now lists parked cards that ask the user, after their own assigned work. The list comes from askLinesFor, the same source as the web, and only appears when a decider is set up.
- The key bar and the card footer show D let the decider while the cursor is on one of those rows. They show U undo decider while there is something to undo.
- Mark, close, mute and ship skip these rows, since they aren't the user's assigned issues. D on any other row says so.
- A new test boots the dashboard, presses D on a parked row and checks the card leaves the asks. It then presses U and checks the card returns.
- Double tap (low):
decideAskclaims the card in an in-flight set before it awaits the model and releases it in afinally. A test fires two concurrent taps and checks the model is called once. - Undo by someone else (low): the ledger state now stores
actor, andundoHandledrequires it to match the person undoing. A test has a co-owner who dismissed the same card try to undo, and it comes back not found. - Preferences on /board (low): the ledger row still records what the decider saw, including the tapper's pinned and muted state. The /board line no longer shows "pinned" or "muted" to other owners.
Left out: the ledger row still stores the tapper's pins and mutes and recent decisions, so the API's context for the tapper's own decision still shows them. Only /board hides them. Also, the cursor is not moved to a parked row on entry, so the user moves to it with j/k.
The feature works in the code and in the tests. The web form, JSON API, MCP and terminal all go through decideAsk, and that function uses the card's own access check (askTargetsFor). Bodies go through the byte-capped body()/readForm. Output on /board and in the home receipt is escaped through html. Two taps on the same card cost one model call, and a co-owner can't undo someone else's set-aside. At 1e33171b, bun test test/hand-decider.test.ts test/mcp.test.ts passes 31/31 and tsc --noEmit is clean. I could not open the preview or the screenshots from my sandbox, so this verdict comes from the code and the tests.
High, fix first: one person's private preferences leak to every reader of the repository. A hand row's state holds the tapper's repository.pinned, repository.muted, recent (their last ten ask endings there) and actor (their user id). GET /api/v1/repos/:owner/:name/decisions returns state for every row, and it is gated only by read access to the repository (loadRepo plus mayViewId). On a public repository, an anonymous visitor can see who muted the app and how they dismissed their recent asks. The pull hides this on /board on purpose ("One person's pins and mutes stay out of a line other owners read"), and the follow-up comment says the API still shows it, so the gap is known and still open. Fix it at the boundary: when the decisions API (and anything else that serialises Decision.state) returns a hand row, return pinned, muted, recent and actor only when the caller is the actor. The cleaner option is to keep the per-person part out of the shared ledger row and store only what's safe for every reader. Add a test that has a second user (and an anonymous caller) on the public repo GET /api/v1/repos/alice/shelf/decisions and checks that none of those fields come back.
GET /api/v1/repos/:owner/:name/decisions no longer returns one person's private preferences to other readers. tsc --noEmit is clean, and bun test on the hand-decider, MCP and board files gives 55 pass.
- What changed: the new
forReader(decision, user)insrc/crew/handover.tsrewrites ahandrow's state for every caller except the person who tapped. Others getreason,direction,spendandevidenceplus the repository name.actor,recent, andrepository.pinnedandrepository.mutedare removed. The tapper still gets the full row. The decisions route runs each row through it after its existingmayViewIdfilter. - Why this fix: I redacted at the API instead of changing what the ledger stores. Undo needs
actoron the row. "The context it saw" is the feature's point, so the stored row keeps the full context and only what other readers get is trimmed. - Other places that return a hand row's state: the tapper's own
decideAskresult, the home receipt (which shows onlyreason, to the tapper), and /board (which showsreasonand counts only). - Test: a new test in
test/hand-decider.test.tsreads the ledger as the tapper, anonymously, and as a second signed-in user with a read-only token on the public repo. The tapper seesactor,recent,pinnedandmuted. The other two see none of them but still seereason.
Approved. Every door checks who is acting: the web form goes through readForm (rw scope and same-origin), the JSON routes use requireScope rw, and both MCP tools are marked writes. Access to a card is decided by askTargetsFor, the same check the card itself uses. Undo needs the stored actor and the person's own dismissal, and the decisions API now runs each row through forReader, so other readers don't get the tapper's pins, mutes or recent decisions. Bodies go through the byte-bounded body() and the cooldown keys on the issue id. No header is trusted, the SQL is parameterized and the board line is escaped. The terminal has parity: hand-over rows show only when a decider is set up, D and U call the same action, the tests cover it, and the README documents it. The direction scopes this as command pillar (1): fewer decisions for the owner, with undo.
I could not see the preview or the screenshots: the sandbox refused the preview host and /data/looks. This verdict comes from the diff and its tests (test/hand-decider.test.ts is in the gate). One non-blocking point is inline.
The full gate on land was red and named no test; the pull is open again.
A hand-over card now has a third tap, "Let the decider". The decider answers it in the ledger with a reason and a confidence, and the card leaves the board. The earlier work on this branch was already complete. The new part is that I merged current
maininto the branch and re-ran the tests. Type check is clean and the tests I ran all pass. That covers the three tests the issue names (test/asks.test.ts,test/asks-expiry.test.ts,test/check-list.test.ts), the newtest/hand-decider.test.tsandtest/mcp.test.ts. I also ranhome-feed, thestudio*tests,data-home,crew-brief-gateandreview-gate. I did not run the whole suite. I don't know why the check went red on pull #1645, because I never saw its log.src/crew/decide.ts. It is also reachable through the JSON API, MCP and the terminal, and the MCP tool list names its two tools.test/hand-decider.test.tsis listed inGATEinscripts/gate.ts.To try it, open a hand-over card on the asks page and tap "Let the decider".
Closes #1604