I'm parked on you

Pick an option on each card and press Done; your answer goes straight back to the session. The raiser's pick is marked. "I'm not sure" and "Take it to the engineering bridge" are real answers.

14 questions on this

In plain terms. Trinity audited Smith's 662 fix PRs: they ship fast, but the three that did harm all silenced an alert, and most were written without reading the design. Four rules for how Smith works are Gera's call: saying yes tightens how Smith ships fixes; saying no keeps Smith working as today. Which way should each go?

0 of 4 answered

1Policy 1 — a Smith fix that quiets an alarm, widens an alert exception, or loosens a check: may it merge only with proof in the PR that the replacement signal fires in production today, and otherwise be raised as a decision instead of merged? (Audit: all 3 harmful Smith fixes quieted an alarm; one left Western Slope's robot locked out 21h.)

In plain terms. When Smith wants to turn off an alert or make a check less strict, should Smith first have to show that something else will still catch the problem today, and ask Gera if it cannot?
Why the raiser recommends it
The session raising this recommends: Yes — prove the replacement fires, else ask Gera
Every harmful fix in the audit was a silenced alarm with nothing proven to replace it; a machine-checkable receipt keeps 'fixes never wait on a human' intact while closing that hole.

2Policy 2 — one alert claims exactly one fix PR across both machines (mini + Fede's Mac) and both sources (Sentry + marked alerts), and Smith stands down when a person already owns the red main? (Audit: 82 of 120 closed-unmerged Smith PRs were duplicates.)

In plain terms. Should Smith start only one fix per alert, no matter which machine or alert feed saw it first, so two copies of the same fix stop being opened?
Why the raiser recommends it
The session raising this recommends: Yes — one fix per alert, shared
82 duplicate PRs are pure review and CI cost with zero product value; a shared claim is the same mechanism the one-driver rule already uses for red main.

3Policy 3 — Smith's alert-fix prompt loads the area's planning doc, Gera's portfolio design and the testing ladder before coding, and the PR body cites the plan it follows or states none exists? (Audit: 18 of 183 Smith PRs named a plan.)

In plain terms. Before Smith writes a fix, should Smith have to read the design notes for that part of the product and say in the PR which plan it is following?
Why the raiser recommends it
The session raising this recommends: Yes — every fix names its plan
The audit's 'shallow but harmless' and 'wrong' PRs share one cause: the fix was written without the design it sits inside; reading it costs a minute, re-doing it costs a day.

4Policy 4 — Smith's decider says 'high risk waits for a human', but since Sep 12 its merge loop merges anything green with no risk check (identity and Clara-behavior changes merged that way). Make the tier real as a MACHINE gate (identity, AppFolio writes, Clara behavior need a real-data replay receipt before arming), or delete the promise?

In plain terms. Should risky fixes (identity, AppFolio writes, Clara's behavior) have to pass a replay against real data before Smith ships them, or should Smith drop its claim that risky fixes wait for a person? Today Smith makes that claim but ships them without any wait.
Why the raiser recommends it
The session raising this recommends: Make it real — replay on real data first
A promise the code does not keep is worse than no promise; a replay receipt is a machine gate, so it does not break Fede's 'fixes never wait on a human'.
Why, and what was tried
Tried first, unsuccessfully: fable-decide ran on each of the four questions (task smith-deep-dive); all four were killed at my 170s timeout with the mini at 74/70 sessions, receipts stayed PENDING — no model verdict, so these go to Gera as Trinity's audit asked

b1d758e4 is parked on this.

Pick an option above, then press Done.
PropFlow Docs