pm-dispatch step 8: triage-seat four-lens auto-adjudication of high-confidence decision cards — human floor for feature-add / ADR / protocol-change (maintainer-directed) #7899

Filed by the skills seat (session session_012Gg6rMAti8ZaueWb6BRsDn) on the maintainer's rulings, skills-seat PM session chat, 2026-08-12. Direct routing under the 2026-08-10 standing authorization.

Provenance (maintainer, verbatim, untranslated)

每次待我决裁的时候,我都是模型切换到 fable5 ,让他 帮我从实际业务需求出发,从平台长远合理性出发,从避免ai写代码犯错的角度出发,从创业阶段不扩散需求的角度出发综合分析,给我建议。很多时候ai会有明确的建议,大部分建议我都会接受,这个是不是可以让分诊就处理掉。他没把握的才找我

我同意你的意见,并补充功能新增类的,adr类别的,协议变化类别的,还是需要人工决裁,如果是代码整理或者bug修改,具体的代码细节其实ai看的比我清楚,让我判断我也判断不了。除了以上,你觉得还有哪些要补充

The four lenses named in the first quote are the four-lens block already mandatory on every needs-user-decision card (#7498): ① platform long-term coherence ② measured business pull ③ AI-agent error-resistance ④ startup scope discipline. This card changes who consumes the analysis for high-confidence cases: the triage seat decides and executes with a veto window; only low-confidence or floor-protected cases reach the maintainer.

RULED (execute as written — not re-litigable)

Human floor — always the maintainer, regardless of lens unanimity:

• 功能新增类 (new-capability additions)
• ADR 类 (ADR-class changes)
• 协议变化类 (protocol / public-contract changes)
• (existing escalation-bar floor, restated): destructive or hard-to-reverse actions — stored-data migration shape, deleting a shipped capability, force operations

Auto-adjudication lane — triage seat decides:

• 代码整理 (code cleanup / refactoring with unchanged behavior)
• bug 修复 (bug fixes) — per the ruling, the maintainer cannot judge code-level detail better than the AI can

Confidence gates (approved design, from the same chat): a card is auto-adjudicable only when ALL hold:

1. 四棱同向 — all four lenses point to the same option; any split ⇒ escalate;
2. not on the human floor above;
3. the decision does not narrow or overturn any existing maintainer ruling;
4. execution is veto-window, not permission-gate: decide → swap needs-user-decision for the working state in one label write → post the four-lens block + conclusion + an auto-adjudicated marker on the card → list every auto-adjudicated card in a dedicated round-report section (the aggregate drift brake);
5. the adjudication pass runs at claude-fable-5 (same tier as the maintainer's own manual workflow).

Seat-proposed additions (answering 「还有哪些要补充」 — to confirm in the design round; each one narrows the auto lane, never widens it)

1. Security / permission-boundary changes → human, even when shaped as a bug fix: anything relaxing access control, auth flows, RLS/sharing semantics, or audit trails. A "fix" that widens access is a product decision in disguise.
2. Gate-weakening → human: lowering a gate threshold, removing a required check, raising a ratchet ceiling, skipping/quarantining tests. AI agents have a structural incentive to make CI green; weakening the farm must stay a human act.
3. Spend / quota / fleet-shape / default model-tier changes → human: these move the maintainer's budget, not a technical judgment.
4. New runtime third-party dependency → human (supply chain, license, maintenance obligations).
5. Unified mechanical boundary test for the feature-vs-bug line, reusing the spec/spec-surface criterion: does the change grow the accepted input set or the public surface? Grows ⇒ 功能新增/协议变化 ⇒ human. Unchanged accept-set pulled back toward the declared contract (declared = enforced restored) ⇒ bug/cleanup ⇒ auto lane.
6. Flip-back clause: if implementation of an auto-adjudicated card discovers the contract must move after all, the dev stops and the card returns to needs-user-decision — the existing third-tier premise discipline (report the fork; ⛔ never silently re-decide), reused verbatim.

Guardrail carve-out

Step 8's 「Never answer a product/architecture question on the maintainer's behalf」 gains a bounded exception exactly coextensive with the auto lane above — no wider. The SKILL text change edits step 8, the triage-seat duties, and that guardrail line together.

Effect timing

• Immediate: a cross-seat notice with these rulings goes on the triage seat post ([PM seat] triage (objectstack-wide) — 🟢 Routine · session_01AavokzJ5DndAwitDXvKy4U · trig_01NcnCtMS2tH46nUg1a5TaMJ (hourly) · state = body + the round records newer than it #6015) so fired triage sessions can operate under it with on-card provenance quotes.
• Permanent: this card's SKILL.md change — the [finding] A skills-root PR was queued by a sibling session ~1h after the ADR-class ruling — a ruling recorded only on cards cannot bind sessions that haven't read it #7701 lesson applies (a ruling recorded only in chat or on cards cannot bind sessions that have not read it; the skill text is what binds every session).

Constraints

• Blocked-by: pm-dispatch SKILL structural optimization: role-split loading, issue-ID removal (lessons distilled in place), probe-first startup (maintainer-directed) #7885
• Same-file serial: SKILL.md hot-file queue position 5 (after PR docs(pm-dispatch): cloud-card comms is event-driven by ruling — notes-21 verify-before-toggle, PR subscription as hard step #7794 → pm-dispatch SKILL: 5-hour usage-limit outages — queryable signals, cross-wall recovery timer (hourly cron, not send_later chains), wall-death playbook anchor #7765 → pm-dispatch SKILL Guardrails: dangling sentence fragment "someone else, never dispatch a needs-user-decision issue." — the bullet it belonged to is lost #7767 → pm-dispatch SKILL structural optimization: role-split loading, issue-ID removal (lessons distilled in place), probe-first startup (maintainer-directed) #7885); the design round may be held jointly with pm-dispatch SKILL structural optimization: role-split loading, issue-ID removal (lessons distilled in place), probe-first startup (maintainer-directed) #7885's.
• Skills updates are ADR-class: draft PR, ⛔ no auto-merge, no queue entry; the maintainer merges by hand.
• Model tiering mandatory clause: dispatch with model: claude-fable-5.