3da08d9d · zzmq.dev@gmail.com/zz
Commit
3da08d9d567925d715efb78ecc273494d2eeaec2
Separate changeset review from merge: a real Maintainer role, not just coordinators Until now a coordinator's own commit_changeset call was the only judgment applied to a proposed change -- there was no step asking "does this actually match what was asked, does it stay in scope, does it do anything unrequested." Mechanical merge and substantive review were the same unexamined step. Adds the Maintainer role from site/content/governance/index.md ("Reviews and decides; accountable for what merges") as a real, separate thing in the protocol instead of just prose in a doc: - Lane gains `maintainers: string[]`, distinct from `coordinators`. Defaults to the same set (existing autonomous flows keep working unchanged) but can be narrowed -- e.g. to a single human actor id -- to require real human sign-off on every changeset, not just any coordinator's say-so. - New "changeset_review" ask kind, scoped to maintainers (a third ASK_SCOPE tier alongside "open" and "coordinator"). A submit_changeset now depends_on a granted changeset_review and literally cannot be claimed or completed without one -- enforced in both agent/tools.ts's ask_claim and engine/lane.ts's answer(), not left to depends_on's previously-advisory-only filtering in claimableAsks. - agent/scriptedWork.ts's runChangesetReview judges a proposal against its own task description and real file contents (never trusting the contributor's self-reported summary -- the governance doc's "never trust self-declared scope" principle, now actually checked instead of just written down). - `zz review`: a minimal, focused command for a human to claim and answer changeset_review asks with the mechanical bits (claim, grant/deny) handled for them -- the concrete HITL slice of what was deferred earlier this session as "zz cowork," scoped to the one judgment call policy says must be reviewable, not a general interactive session manager. Also closes a real gap found while building this: depends_on was only ever checked by claimableAsks' query filter, which a direct ask_claim call bypassed entirely. ask_claim now re-verifies it structurally. Verified live: the full chain (work -> changeset_review, auto-approved since the default maintainer is the same coordinator -> submit_changeset -> commit) runs end to end with the review correctly gating the merge.
Troy Howard <thoward37@gmail.com> -- 2026-10-11T09:50:05.000Z