The fleet roster names three review bots and triage — and neither identity that opens every PR. Who is in it, now that the roster also spends actions: write?

[dan-claude-bot]

✅ RULED — option A, 2026-08-16 21:35Z by @danmt (the ruling, the close-out). Transcribed into #452, #453, incubator#257 and crew#458. The hard-block default never fired and nothing below is edited but this banner and the struck flag on the next line — the two Blocked: re-measures live in their own comments, as they did while the ask stood.

🧭 needs-ruling — Which logins belong in each governed repo's fleet roster, now that .github/labels.conf also decides who may spend actions: write through rerun-owed (#424)?
Options: A — add a per-author panel[<login>]= row for each live builder login to each governed repo's conf B — add a new rerun-actors= setting, so the rerun roster is explicit and separate from the review panel C — leave the conf as it is: only triage-actors can service the label, and triage sets rerun-owed on the builder's report
Recommend: A, because it is the only option that costs no consumer schema change, parses on every pin in the fleet today, and changes no required review set.
Blocked: Stops — nothing. #424 ships as specified, and its end-to-end criterion is met on a scratch repository, which is what the issue offers. Continues degraded — the moment #424 lands, the action refuses the exact actor LABELS.md names as the label's setter, in all three governed repos.
Default: none — hard block. Who these two identities are is a fact only you hold — they appear in no roster file in any of the three repos — and this is the same axis you ruled on today, where option C (granting fleet identities write) was refused.

Analysis

Where this came from. @cndgrr surfaced it mid-build on #424, measured against this repository, and correctly declined to edit the roster: "a builder quietly adding itself to the list of identities allowed to spend actions: write is precisely the move that list exists to prevent." That judgement is ratified on the issue. What follows is the same measurement taken across the fleet, which is wider than the builder's note claimed.

Measurement 1 — the three confs are identical, and none of them names a builder. ceremony, crew and incubator all carry exactly:

panel=claude-bot-andresmgsl codex-bot-andresmgsl kimi-bot-andresmgsl
triage-actors=dan-claude-bot

No panel[<login>]= row exists in any of them. So each repo's fleet, as .github/labels.conf defines it, is four identities: three review bots and triage.

Measurement 2 — the identities that open every PR are in none of it. The last twelve PRs here are cndgrr and andriujoseba; so are the last six in crew and the last six in incubator. Neither login is in any panel=, in any triage-actors=, or in CONTRIBUTING.md's roster table, which names five identities — dan-claude-bot, claude-bot-andresmgsl, codex-bot-andresmgsl, grok-bot-andresmgsl, kimi-bot-andresmgsl — and neither of these two.

What that costs the moment #424 lands. #424 D3's gate 1 measures the label's actor against .github/labels.conf. LABELS.md on main says of rerun-owed: "Set by the builder with its evidence; cleared by the reconciler." Against the shipped gate, that sentence is false in all three repos — a builder-set label is refused at gate 1, every time, and the only identity that can service the label is triage. The build is correct and the config is what disagrees with it.

A — a per-author row per live builder login. panel[<login>]= names the effective panel for PRs authored by exactly that login, minus the author (#224, 0.5.0 and later). Set to the base panel it is behaviour-neutral for review: the required set is the same three bots it is today. Its second effect is the one being asked about — #424's gate reads the bracketed login as a fleet identity, so the row is what lets that login's label be honoured. It parses on every pin in the fleet today (crew is pinned 0.6.2, incubator 0.7.3, ceremony is the source), so no pin bump is owed, and each repo's conf is its own repo's diff. The cost, named: it overloads one field. "Has a review-panel row" and "may spend actions: write" become the same fact, so a later edit to panel rows silently edits the rerun roster.

B — a dedicated rerun-actors= setting. Semantically the honest one: the rerun roster stops being a side effect of the review config, and the file says what it means. The cost: it is a consumer-facing schema change, and this file's own history is the warning — an unknown setting is a parse failure, not an ignored line (triage-actors= at 0.2.0, bracketed rows at 0.5.0, both documented in docs/CONSUMERS.md with the reconcile job dying on every event until the row is removed). It lands only with a pin bump in each consumer, never through mixed refs, and it is not reversible inside a PR — which is why no timed default can carry it.

C — leave it. Costs nothing, grants nothing, and is not absurd: triage is in triage-actors=, so the servicing still happens one hop later — the builder reports the stall, triage sets the label, the workflow reruns. What it does not do is match the doctrine that just shipped, so C also owes an edit to LABELS.md's "set by the builder" sentence and to #424's D1.

One inconsistency the same edit should settle. CONTRIBUTING.md says "the review panel for any PR is every bench identity except its author" and lists grok-bot-andresmgsl among the bench; panel= names three and not grok-bot-andresmgsl. Doctrine and config already disagree about the panel, independently of this question. Whichever option you take, the file is open in front of you once.

What is not being asked. Nothing about repository permissions. Every option here leaves {"admin": false, "maintain": false, "push": false, "pull": true, "triage": true} exactly as it is — this is only about whose label the workflow honours, behind #424's other three gates (the run concluded failure, the head has not moved, run_attempt == 1). Setting the label already requires rights on the repository; the roster is a second lock behind that one.

Why this is a discussion and not an issue. Nothing on the board is blocked, so there is nothing to flag: #424 is claimed and completable as specified. When you rule, I mint the issue for whichever option, with the config content written into the spec so the builder transcribes a decision rather than choosing who is in the fleet.

[dan-claude-bot]

Cost re-measure — #424 landed 26 minutes ago, so this ask's Blocked: line has moved

Backlog-hygiene pass, 2026-08-15T23:5xZ. The ask above is unedited and stands — its five field lines are the shape check, and the question is unchanged. What follows corrects the one field that ages. Blocked: was written conditional on #424 landing; it has landed.

What moved

PR #433 merged 2026-08-15T23:29:49Z at d956a11, and #424 closed 23:39:17Z. main's own push CI at d956a11 is green — CI ✅, release ✅ — read on main rather than on the PR head. So actions/ci-rerun and self-ci-rerun.yml are live here, on pull_request_target: [labeled].

Blocked: re-measured, item by item

• "Stops — nothing" — still true, and re-measured rather than restated. #437, the only ready issue, declares this thread in its Dependencies and refuses the edge in writing. BUILDER.md — "one build at a time" never says across what, and disagrees with the park list about when a build ends #430 and TRIAGE.md — the collision rule orders by arrival and calls it priority: a precedence rule, so a defect that reds everyone's CI takes the front row instead of the tail #425 are claimed with open PRs and are untouched by it. LABELS.md + BUILDER.md + FLEET.md + actions/labels-reconcile — the red head nobody in the fleet can rerun: blocker:ci-red says the builder owes a fix, and twice today the only actor who could act was the operator #423 and actions/issueflow-reconcile — the sweep audits edges and never the shape they make: flag a board that is idle by construction, a chain that serializes the fleet, and a cycle #426 are post-merge on wake conditions this ruling does not gate. No needs-ruling mirror is owed on the board, which is why none is set.
• "Continues degraded — the moment actions/ci-rerun — the rerun no fork PR author can start: one base-repo workflow with actions: write, gated to the fleet and to one attempt per head #424 lands" — that moment has arrived. The clause overstated one half and understated the other.

Overstated: it is one repository today, not three

repo	ci-rerun present	rerun-owed in label set	refusal live?
ceremony	yes — main at d956a11	yes, D4C5F9	yes, now
crew	no — pinned @0.6.2	no — 404	at its pin bump
incubator	no — pinned @0.7.3	no — 404	at its pin bump

No tag carries #424: the newest is 0.7.3 and main is armed at 0.7.4-dev. The two consumers are not degraded and will not be until a cut and a pin bump each. I am not proposing a cut, and none is owed by this.

Understated: here, it is not hypothetical

The gate reads the actor of the labeled event against .github/labels.conf and returns REFUSE:actor at ci-rerun.sh:241, before it reads any evidence. Re-measured live at this write, all three confs are still byte-identical in the two fields it reads, and no panel[<login>]= row exists in any of them:

panel=claude-bot-andresmgsl codex-bot-andresmgsl kimi-bot-andresmgsl
triage-actors=dan-claude-bot

Two PRs are open here right now, authored by exactly the two logins in neither field — #438 (@cndgrr) and #436 (@andriujoseba). If either head goes red on an infrastructure failure and its author sets rerun-owed as LABELS.md instructs, the gate refuses the setter.

Which makes this a live disagreement on main, between two things that both shipped today

LABELS.md:102 ships "Set by the builder with its evidence". ci-rerun refuses that builder. Neither is wrong against its own issue — #423 named the setter, #424 built the roster gate — and the seam between them is precisely what this ask asks. It is worth saying plainly that this is now readable in the tree rather than predicted.

What inaction selects, which is new since the ask

Before the merge, the hard block held nothing behind it. It is no longer neutral. With no conf edit, the only identity that can set rerun-owed and be admitted is dan-claude-bot — so the fleet is operating under option C by default, unruled: the builder posts the evidence, triage sets the label, the gate admits, and ci-rerun reads the evidence from the PR author anyway, which it already does by design (:351-353). C therefore works today at zero file cost. Its price is a triage round-trip on every stall — which is a smaller version of the human round-trip #423 exists to remove — plus a LABELS.md correction, since the shipped row would name the wrong setter.

Recommendation unchanged — A. A per-author panel[<login>]= row enrols the bracketed login as fleet and sets that author's panel; written with the same three reviewers, it changes no required review set, needs no consumer schema change, and parses on every pin in the fleet today. What has changed is only that C is now the status quo rather than a third option, so choosing C is ratification rather than a change.

Default unchanged — none, hard block, and structurally: who these two identities are is a fact only you hold, and no elapsed time can make that default fire. Nothing here is a re-ask or a second venue — the answer belongs on this thread.

[dan-claude-bot]

Cost re-measure — the degraded set is two of three repositories as of today, not one. The ask is unedited and still yours

Backlog-hygiene pass, 2026-08-16T19:0xZ. The ask above stands unedited, its options and recommendation are unchanged, and its Default: is none — hard block — so nothing fires by inaction and this comment is not a pick. One field has aged again, and it is the one that prices the wait.

What moved since my 2026-08-15 23:56Z re-measure

• 0.7.4 published 2026-08-16T16:38:11Z — the first tag carrying #424's actions/ci-rerun and #423's rerun-owed.
• heavy-duty/incubator pinned it at 18:00:38Z (PR #232), and adopted the ci-rerun.yml caller in #233, merged today.

The table, re-measured live rather than restated

repo	ci-rerun caller	rerun-owed in label set	builder login in FLEET	refusal live?
ceremony	yes	yes, D4C5F9	no	yes (since 2026-08-15)
incubator	yes — .github/workflows/ci-rerun.yml on main	yes, D4C5F9, byte-identical to the shipped row	no	yes — as of today
crew	no — still pinned @0.6.2	no	—	not yet

Measured at heavy-duty/incubator's own .github/labels.conf:

panel=claude-bot-andresmgsl codex-bot-andresmgsl kimi-bot-andresmgsl
triage-actors=dan-claude-bot

No panel[<login>]= row, so load_fleet at the pin builds a FLEET containing three review bots and triage and no builder login. Gate 1 of ci-rerun.sh measures the label's actor against exactly that list, so on that board a builder-set rerun-owed is refused by name, and the day-one servicing path is: the builder posts the 🔁 rerun owed at head <sha> evidence on its own PR, asks triage, triage applies the label, gate 1 admits triage-actors. One round trip per stalled head.

Why that changes the price rather than just the count

The second repository is the one the whole arc came from — incubator#212, the red head nobody in the fleet could rerun, twice in a day. The refusal is now live in the repository whose incident produced it, and the humans building there hit it on the next unrerunnable red rather than on the next pin bump. That is not an argument for any of A, B or C; it is the wait's cost, and it stopped being hypothetical today.

Nothing else moves. Stops — nothing is still true and re-measured: this board's only open issue is #423, post-merge on a wake condition this ruling does not gate, and no open issue anywhere declares this thread as a blocker. No needs-ruling mirror is owed on the board, which is why none is set. Options A, B, C and the recommendation of A are exactly as written; the decision is still yours, @danmt, and the hard-block default means it cannot be taken by anyone else, including me.

[danmt]

A is fine @dan-claude-bot

[dan-claude-bot]

Ruled: A. Recorded as a decision, transcribed into four mints, and the flag comes down

@danmt ruled A at 2026-08-16T21:35:41Z — "A is fine". Closing this out per TRIAGE.md: the decision, what it means read literally, what was written, and the one thing it did not settle.

The decision

Each governed repository's .github/labels.conf gains one panel[<login>]= row per live builder login, written with the base panel's reviewers. Read against the option's own text — "for each live builder login" — and the census in the ask, that resolves to exactly two logins and no judgement of mine: cndgrr and andriujoseba, the only two identities that have opened a pull request in any of the three repositories. Re-measured at this write across the last twenty merged PRs per board: ceremony 14 / 6, crew 8 / 12, incubator 11 / 9, and no third login anywhere. The rows are:

panel[cndgrr]=claude-bot-andresmgsl codex-bot-andresmgsl kimi-bot-andresmgsl
panel[andriujoseba]=claude-bot-andresmgsl codex-bot-andresmgsl kimi-bot-andresmgsl

A's central claim is now measured rather than argued. I ran both shipped parsers over each repository's real conf, before and after the two lines, at each board's own pin — labels-reconcile@0.6.2 for crew, @0.7.4 for incubator, main for ceremony:

	before	after
required verdicts, cndgrr / andriujoseba / a panel bot / any other login	3 / 3 / 2 / 3 identities	byte-identical, all four cases, all three pins
gate 1 (is_fleet_actor) for the two builder logins	REFUSE	ADMIT
gate 1 for triage, the three panel bots, an unlisted login	ADMIT / ADMIT / REFUSE	unchanged

So the review side does not move and the rerun side does, which is what A promised. The cost A was chosen with also stands unchanged: one field now carries two facts, and a later edit to a panel row is silently an edit to the rerun roster.

What was written

repo	issue	state	note
ceremony	#452	ready	the refusal has been live here since 2026-08-15
heavy-duty/incubator	#257	ready	live there since today's 0.7.4 pin; this is the issue #233's D5 deferred
heavy-duty/crew	#458	blocked	inert until that board adopts a caller, and a non-member of its standing 0.1.3 window, so it names #327 as its blocker and waits
ceremony	#453	ready	fell out of the measurement — see below

Each carries the file content in its spec, so the builder transcribes a decision instead of choosing who is in the fleet. None of the four blocks another.

#453 is A's one measured side effect. fleet_roster() joins the roster without dedup and the gate-1 refusal comment prints it to a human — the sentence whose whole job is to say who to ask. With A's rows applied, that list becomes twelve entries with the three bots repeated three times. No admission changes, which is why it is a separate ordinary issue and not a defect in the transcription; but it gets worse with every per-author row, and a per-author row is exactly what docs/CONSUMERS.md's skeleton hands every adopter.

What A does not touch, restated so nothing is read into it

• No repository permissions change. Every identity's rights are {"admin": false, "maintain": false, "push": false, "pull": true, "triage": true}, exactly as before. Setting the label still requires rights on the repository; the roster remains a second lock behind that one.
• No LABELS.md edit is owed. "Set by the builder with its evidence" was the sentence A was chosen to make true; it becomes true at each merge rather than needing a correction. That was C's bill, and C was not taken.
• No cut and no pin bump. crew stays at 0.6.2 and incubator at 0.7.4; bracketed rows parse at both. I am not proposing a release.
• docs/CONSUMERS.md stays as docs/CONSUMERS.md — the roster precondition says the governed repos name "no builder in any field", and all three name two #437 left it — a directive to the reader about their own file, stating no repository's live roster, this fleet's included.
• incubator#233's open post-merge criterion is not discharged by any of this. It wants one real service attempt recorded on that board; actions/issueflow-reconcile — a failed board read sweeps an empty board and reports a full pass: the issue-list gather at main() suppresses errexit too #257 only changes which gate that attempt meets.

The one thing the ruling did not settle, which is not being dropped

The ask's analysis raised a second, independent disagreement in the same file pair: CONTRIBUTING.md says the panel is "every bench identity except its author" and lists five identities including grok-bot-andresmgsl; panel= names three and not that one. "A is fine" answers the rerun-roster question and not that one, and folding a roster call into a transcription issue would put a decision that is yours into a builder's round. So it is asked on its own, with its own measurement — 113 reviews from that identity, none since 2026-08-04, twelve days — at discussion #451. Unlike this one it carries a reversible 24-hour default (align the guide to the config, documentation only), so it will not sit here waiting: if you say nothing, I take that option and record the pick.

Flag state

This ask carried no needs-ruling label on any board, because nothing was blocked behind it — re-verified at this write: no open issue in ceremony, crew or incubator carries needs-ruling, and the ask's Stops — nothing line held for the whole window. Marking this answered; #435 stays the venue of record and is not closed, so every citation into it keeps resolving.