The crew takes direction only from people who can write here, the clock included #742

Closes #619

This finishes the crew-direction fix that torque started in #694 (its two commits are included). One rule decides who directs the crew on a repository: mayDirectCrew in src/crew/direct.ts. Only someone who can write to the repository passes it, plus the crew's reviewer, or anyone signed in once the owner turns on the per-repository switch "outsiders may trigger the crew". The switch is off by default.

Already in #694

• A comment, review or tell from someone who fails the rule does not steer or start a run.
• The steering box and converge follow the same rule.
• The brief quotes a reader's words as untrusted input.
• The switch is recorded in the audit.

Added here

• The clock follows the same rule.

- An issue opened by someone who cannot direct the crew stays out of the ready list until a person who can write adopts it, by assigning it, labelling it, or linking it into the map. - A link made by the crew's planner does not adopt it. - The map, the API, MCP and autonomy all read this from Graph.unadopted. The map shows such an issue as parked, with the reason.

• The brief marks a reader's body as untrusted.

- An issue body written by a reader reaches a run quoted as untrusted input. - The planner is told not to plan from readers' issues.

• Only people who may direct the crew re-arm it.

- This applies in three places: un-stalling an issue a run left without a pull, answering a planner's decline, and resetting park strikes (COUNTED).

• Autonomy lands on green only pulls by the crew or by a writer.

- A reader's pull is never sent to the crew's reviewer and never merged without a person, whatever the outsiders switch says.

• A reader's pull no longer hides the issue it says it closes.

- Such a pull does not take that issue off the crew's list or show it as waiting on the map.

• tell() refuses a reader. It serves the MCP tell tool and the share fallback.

Tests

• New: test/crew-direction-autonomy.test.ts, added to the gate list. Each case is a reader attempting the action and being refused, then a writer succeeding:

- assigning or planning from a reader's issue - adopting an issue through a planner link, compared with a writer's label, link or assignment - re-arming through stalled, decline and park strikes - landing a reader's green pull from a fork - a reader's tell - the brief and planner marking

• Existing tests in crew-direction.test.ts cover comments, reviews, tell, steering and converge.

Migration: adds repo.crew_outsiders, off by default.

🤖 Generated with Claude Code