Roadmap

The problem

Every durable record is attributed to the task that is active in the checkout, because decision, checkpoint and question all read .majordomus/state/current.yaml to find out whose work they belong to. Several workers share one checkout, so the record names whoever started a task there rather than whoever ran the command. In one evening three sessions wrote under another session's active task, and one decision had to be dropped by hand after the fact because the premise it recorded belonged to somebody else. Attribution is the one property of a record that cannot be reconstructed later: the conversation that would settle it is gone.

The outcome

A durable record either names the worker that produced it or is refused, and a record written from one session can never arrive attributed to another session's task.

Where it stands

Not started. lib/decision.sh, lib/checkpoint.sh and lib/question.sh each resolve the active task from the checkout and write it into the record. Nothing distinguishes two workers sharing that checkout, and nothing reports that it cannot.

Where it should stand

Attribution is verifiable from the record alone. Where the tool cannot establish who wrote something, it says so and refuses rather than guessing from what happens to be active.

In scope

• lib
• share
• test/cases
• docs

Out of scope

• A registry of named workers, personas or agents
• Any identity the repository has to maintain, or that outlives the session that used it
• Locking a checkout to one worker

Proven when

• A record written while another worker's task is active is attributed correctly or refused by name
• The attribution can be checked from the record alone, with no conversation history
• No new record type and no registry of workers is introduced
• A behavioural case reproduces two workers writing in one checkout