Repository navigation
T3 sign-off is trust-only: no record is read or verified #23
Description
Status: Verified during the Pick Your AI rollout (reproduced, or read directly in the code).
Part of epic: Epic: Make co-owner (T3) sign-off auditable and safe.
Summary
SKILL.md says --allow-t3 may be passed "only after an approved t3-metadata or t3-signoff row", but no code reads such a row. check_owner(..., allow_t3) only tests a boolean.
Evidence
Brand.check_ownerandResolver.check_ownertake a bool; nothing loads an approval row for T3.- A public checkout has no
decisions/orregistry/folder, so agents repeatedly asked where the sign-off was recorded. - During the rollout 17 agent sessions each demanded their own user's approval because the CLI gave them nothing to verify.
Impact
Anyone can pass the flag; reviewers cannot audit who approved which owner, repositories or period.
Proposed fix
Read a sign-off record (owner, scope, approver, date, optional expiry) and require the flag to match it.
Acceptance criteria
- Without a matching record the flag is rejected with a clear log code.
- Records can be scoped to repositories.
- Jobs and change records carry the sign-off id.
Tasks
Each task below is a sub-issue.
Prior work
Prior work: open PR #20 (opt-in --allow-t3 and the Pick Your AI family), open #7 and PR #13 (variant J badges), merged PRs #14 to #19 (icon art-direction path, UTF-8 output, registry-free org health and label planning, Windows test portability, footer URL repair) and closed issues #8 to #12. Nothing here duplicates those; where an item is already handled it is linked, not refiled.
Fresh VM verification: not run. Findings were verified on a Windows host; hosted CI is separate evidence.
Activity
check_ownerread and enforce the record #25Make T3 sign-off expiry optional, add approved:false withdrawal (revo…
Carry the T3 sign-off id into estate README jobs (#23)
Report a withdrawn in-scope grant as revoked, keep Acme from matching…
Document optional expires, withdrawal and t3-signoff:revoked; schema …
Test optional expiry, withdrawal, repos invalid, no-op flag pin and e…
Compare T3 withdrawal scopes alias-aware and report malformed repos a…
Report refused T3 orgs in estate-plan logs (#23)
20 remaining items
test(#23): remove three unused imports from copy-plan consent tests
test(#23): board owner grant leads README signoff ids with a distinct…
fix(#23): canonicalize requested repository in T3 sign-off evaluation
fix(#23): normalise README and --repos repository entries in copy-plan
test+docs(#23): repo canonicalization adjudication (t23-adjudication-…
fix(#23): authorize repo: qualifiers of view filters before emitting …
fix(#23): authorize and stamp repo: qualifiers of proposed view filte…
fix(#23): stamp proposals, regression matrix and docs for stored scop…
test(#23): drop extraneous f prefix on pins-order-held assert
test(#23): .github-scoped profile hold and captured Org option proven…
docs(#23): .github profile sign-off and README job ids of retained ca…
fix(#23): resolve captured T3 description and option name independent…
test(#23): regressions for independent captured T3 name/description r…
test(#23): grouped-filter repo regressions for missing, withdrawn and…
docs(#23): view-filter repo qualifiers are authorized inside grouping…