Playbook 07: a node-agent change runs under the node's real permissions before review approves, and a pull request whose safety is its check is approved only on its passing verdict (issue 1126, 2026-10-27)

00-META/process/07-feature-branches.md

@@ -40,6 +40,12 @@ A small fix (one repository, one issue, about an hour of work) follows
   and a check per fix round on an open pull request spent it several times over: every push to an open pull
   request asks a new check, of every member for a group. A release runs one check ("every release should only
   run 1 check or 1 try", the operator, 2026-10-26; ADR 0548).
+- **A switch of who composes, proven only by review.** On 2026-10-27 the placement seed of design 47 (issue 1126) was
+  merged on the operator's Approve while its check had no verdict yet, after two reviews that read the node agent's
+  code but never ran it under a node's real bus permissions. Every node's agent then asked for a consumer its grant
+  refuses and stopped composing; the grants part's list of the same minute dropped the subscriptions of the seats
+  held once for the mesh, the operator's channel among them, so the revert waited most of a day for an Approve that
+  could not be asked.
 - **A module proven only after it reached the machines.** The mail modules were delivered with unit tests
   only, then failed live three times (issues 859, 865, 868) and took five more hours of fixes.
 
@@ -282,6 +288,16 @@ issue whether it is being fixed in between, after the delivery, or waits, and on
    report to the second round naming a kind and one place only, followed by a third round on the same kind, is
    this rule skipped.
 
+10. **A change to what a node agent reads or who composes a node runs under the node's real permissions before the
+   review approves.** A unit test cannot show a bus grant, and a reviewer reading code does not see one. Such a change
+   carries an integration test that runs the node agent on a user with exactly the node principal's production
+   permissions (mesh-sdk `buscompose.PermissionsFor`, the node kind, with its production flags) against an embedded
+   bus, and that fails with the live refusal when the change's widest read is put back; the reviewer runs it. A
+   change that switches nodes to composing their own (a placement seed, a new self-composer path) is first answered
+   by every node in shadow on the live mesh (ADR 0559), each answer read, before its pull request is opened. How it
+   is checked: a review approving such a change with no run under the node's permissions named in its report is this
+   rule skipped (issue 1126, 2026-10-27).
+
 ## Step 3 — Check (no review)
 
 1. **Push the reviewed heads once, then open one pull request per repository, together** (ADR 0548; the operator,
@@ -418,6 +434,16 @@ its health check on the canary each wait for the operator's answer to the assign
 (`operator-channel.asks`) before telling the operator it waits, and adds it to the wait list. No session writes a
 want to get past a hold.
 
+**A pull request whose safety is its check merges only on its passing verdict.** The check gates no merge
+(`check-gates-merge` false, the operator's choice), and the Approve ask says it merges at once, before the check
+ends; for most pull requests that is right. For one whose check is the proof that it is safe (a placement change,
+ADR 0559; a change to every node's composition), the lead says so in the pull request's title, in its description
+and to the operator in the same turn it opens it, and the operator's Approve waits for the check; the lead opens it
+only while the operator can read that. A merge before the verdict is reverted at once, the revert asked for the
+operator's Approve with the same words. How it is checked: such a pull request merged with its check pending, with
+no such line before its opening, is this rule skipped. mesh-delivery holding the Approve ask of a pull request marked
+so until its check passes is the tool that would replace this rule (issue 1126 note 24).
+
 **A new module's first assignment is its first real composition.** The composition check composes every machine as
 it is assigned, so a module that no machine runs yet is composed by no check: on 2026-10-21 the build modules' first
 assignment found two faults no merge check could see (issue 1537, a template the controller filled for a value the

00-META/process/playbooks.html

@@ -461,10 +461,10 @@ const P = [
  {n:"07",name:"Features",kind:"build",c:"--build",
   trig:"Work that changes code across issues or repositories, too large for a small fix.",
   who:"A lead (larger model), one fixing agent per repository (smaller), one reviewer (larger).",
-  steps:["Prepare: name the branch, make the worktrees, settle every question.","Write one context file per repository.","Write the findings and acceptance criteria into each issue.","Survey every other reader and writer of each changed value. (new)","Answer three questions in the milestone file: who deletes each new key and stream, how the switch-over is tried on one node first, what the one check does not cover. The review checks them. (new)","List every part the change reaches; copy fixtures from the real writer.","Develop: one agent per repository, one commit per issue.","A test fails first on behaviour, not on compiling. (new)","Bring each branch up to the trunk; nothing is pushed, no try runs. (new)","Review all of it, reading the integration tests against the code; at most 3 rounds.","A group pins the group's own mesh-sdk head in every member. (new)","Push the reviewed heads once and read each forge head against the reviewed commit; no draft pull request, no fix round on an open one. (new)","Open one pull request per repository, together, with Reviewed-by and Pushed-by; the one check runs. A failed check is read, fixed, reviewed, pushed once more. (new)","The operator's Approve on Telegram; the group merges in one pass.","Follow the delivery in the status view (moving, settled, stuck, delivered) to done; resolve the issues; clean up. (new)","When the builder cannot deliver its own fix: revert, a build by a session's call, a registration at the terminal, copies kept outside the store; a broken controller is put back by a want the operator writes, a hand build by mesh-hand-compose and a want. (new)"],
+  steps:["Prepare: name the branch, make the worktrees, settle every question.","Write one context file per repository.","Write the findings and acceptance criteria into each issue.","Survey every other reader and writer of each changed value. (new)","Answer three questions in the milestone file: who deletes each new key and stream, how the switch-over is tried on one node first, what the one check does not cover. The review checks them. (new)","List every part the change reaches; copy fixtures from the real writer.","Develop: one agent per repository, one commit per issue.","A test fails first on behaviour, not on compiling. (new)","Bring each branch up to the trunk; nothing is pushed, no try runs. (new)","Review all of it, reading the integration tests against the code; at most 3 rounds.","A change to what a node agent reads runs under the node's real permissions before the review approves; a switch of who composes is answered by every node in shadow first. (new)","A group pins the group's own mesh-sdk head in every member. (new)","Push the reviewed heads once and read each forge head against the reviewed commit; no draft pull request, no fix round on an open one. (new)","Open one pull request per repository, together, with Reviewed-by and Pushed-by; the one check runs. A failed check is read, fixed, reviewed, pushed once more. (new)","A pull request whose safety is its check is approved only on its passing verdict. (new)","The operator's Approve on Telegram; the group merges in one pass.","Follow the delivery in the status view (moving, settled, stuck, delivered) to done; resolve the issues; clean up. (new)","When the builder cannot deliver its own fix: revert, a build by a session's call, a registration at the terminal, copies kept outside the store; a broken controller is put back by a want the operator writes, a hand build by mesh-hand-compose and a want. (new)"],
   prod:"One pull request per repository, one source revision delivered, resolved issues, no branch or worktree left.",
   next:"02 (when it ships)",bounds:"Prepare 15 min · 30 min per issue · review 15 min, ≤ 3 rounds · one check, pushed once",
-  prev:["Pull requests as scratchpads","Context bought again and again","Review rounds spent on what a run would show"],
+  prev:["Pull requests as scratchpads","Context bought again and again","Review rounds spent on what a run would show","A switch of who composes, proven only by review"],
   check:"The checker's one status, mesh/check; the review record; the tracker's move."},
  {n:"08",name:"Small fixes",kind:"build",c:"--build",
   trig:"One issue in one repository, about an hour of work.",