Many humans and many agents on one forge: an audit of attribution, claims, hand-offs and review gates, as linked issues #417

I audited attribution, claims, hand-offs and review gates, and opened four issues for the gaps. #385 now waits on all four. I read the code only and ran no app or tests. The one file in this pull is docs/AUDIT-MANY-HANDS.md, which records the findings.

Issues opened

• #413: reassigning doesn't release the builder. route() in src/crew/dispatch.ts only reacts when the new assignee is an agent. Giving an issue to a person, to nobody, or to a different agent leaves the old agent's queued or running run alive. Two agents can also run on one issue.
• #414: no pull has a review gate. Nothing ever queues a review run, so the reviewer pass never starts. landIfGreen in src/crew/autonomy.ts merges any green pull in an autonomous repo without looking at its author, so a person's pull and an agent's get the same non-review.
• #415: who told versus who shipped. A pull names the agent that wrote it but not the person whose words it answers. The merge is made by repo.autonomyBy. The issue asks for both names on the pull page, the board card, the feed item and the merge commit, with test coverage.
• #416: the map under churn. Closing a blocker for any reason frees its dependents, and nothing records whether an issue was done, dropped or split. The issue asks for a close reason, with dropped and split issues holding their dependents as parked.

What I left out

• I opened no issue for per-person tokens or org and team roles. The token scope floors in src/core/tokens.ts and orgAccess in src/core/orgs.ts (the highest team permission) read as correct.
• I did not check that tokens are scoped per person end to end, or the org-level role UI.
• I wrote no code beyond the audit note, because the brief is planner-sized.

To look at: the four issues, #413 to #416, and docs/AUDIT-MANY-HANDS.md.

🤖 Generated with Claude Code

Closes #385