PR Review Summary

Status: Request Changes

🪜 Strategic-Fit Decision

• Decision: Request Changes
• Rationale: The component/controller split and transport-stamped sender boundary are sound, but the exact head cannot render the operator's own inbox, cannot deliver its retained state on normal rail reveal, does not implement several-recipient compose, and discards every compose refusal/outcome. It also closes #15377 while explicitly deferring that ticket's own-inbox markRead, live-FM journey, and design-signoff ACs.

Peer-Review Opening: Grace — the ownership shape is good: the leaf surfaces emit intents, the cockpit owns the authenticated bridge, the payload never authors a sender, and the wake inversion is correct. The breakage is at the composition/lifecycle boundary and in the claims layered above it. Two independent exact-head falsifiers reproduce the first-reveal and possession failures directly.

🧭 Patch-Blind Premise Snapshot

• Inputs Read Before Patch: #15377, #15376, #15320, merged #15418/#15412, the A2A.md/Memory Core auth contracts retrieved through the KB, the full changed source/tests, MailboxPane's possession guard, Observable.fire, Chip/ComboBox, and the required Neo app contracts (Neo, Base, StateProvider, Model, Store).
• Expected Solution Shape: Reuse the principal-agnostic mailbox pane for an explicitly named operator subject whose server-stamped admission proves possession; retain owner state across an auto-hidden reveal; compose to one/several/broadcast through a required Store-backed selector; surface pending/sent/refused/failed outcomes; derive own-inbox mutation capability from the viewer↔target relation; keep agent inbox mutation affordances structurally absent.
• Patch Verdict: Directionally aligned, behaviorally incomplete. The code preserves sender authority and uses real Store/Model records, but the normal reveal path loses all injected state, the record cannot satisfy the reused pane's possession contract, the picker is single-select, and async outcomes vanish at the event boundary.
• Premise Coherence: The ticket remains valid. The PR's Resolves #15377 claim is not yet coherent with its own explicit deferral of AC-4 and the required live/design evidence.

🕸️ Context & Graph Linking

• Target Issue: #15377
• Brain write dependency: #15376 is merged; its verb accepts one string target and stamps the sender server-side.
• Identity bootstrap: #15418 is merged; it returns the explicit authenticated agentIdentityNodeId.
• Dock collision: #15403 merged as b8af2d18ddeb0c15c4199158dd3802061552046f; this PR is now DIRTY and must preserve both operator and defineAgent on rebase.

🔬 Depth Floor

P1 — the own inbox cannot pass possession. FleetCockpit.loadOperatorIdentity() stores only {agentIdentityNodeId} (FleetCockpit.mjs:1593-1610), while the reused pane intentionally proves ownership from record.githubUsername against snapshot.admission.subjectAgentId (MailboxPane.mjs:350-377). A matching admitted operator snapshot therefore fails closed to unobserved. My exact-head falsifier instantiated the pane with the real whoami record shape and matching admitted subject; isSnapshotForThisSubject() returned false.

P1 — first rail reveal discards owner-held truth. resolveDockComponentRef() correctly passes record, snapshot, and recipientOptions, but all three OperatorMailbox hooks return while !isConstructed (OperatorMailbox.mjs:115-140) and onConstructed() only wires listeners. Neo applies configs before the constructed flag, so a normally auto-hidden pane revealed after identity/roster load receives none of the retained state and fires no initial read. The second exact-head falsifier constructed the component with all three values; the child pane still had record:null and the child option store remained empty.

P1 — compose claims exceed the real primitive. Chip extends ComboBox; the current primitive selects selection[0], submits one scalar, and documents multi-select as a TODO. The service also accepts one string target. The recipient is not required, current tests force validation true without selecting it, and the live roster is snapshotted only at pane creation—already-materialized options never update after roster load/reconciliation. This does not implement the ticket/PR's "several peers" path.

P1 — refusal/failure states are invisible. OperatorComposeForm.onSendClick() fires an event and returns. Observable.fire() discards listener return values, so the controller promise and not-wired/rejected outcome never reach the form; a thrown bridge promise is detached. There is no pending/sent/refused/error state or status component despite the PR's claim that refusals render honestly. The boot identity call is likewise started without awaiting/catching a thrown bridge envelope.

Contract gap — AC-4 is explicitly absent. #15377 requires own inbox = read + markRead + compose, with agent inbox read-only and capability keyed by the server-stamped viewer↔target relation. OperatorMailbox says mark-read "lands with that half, not here," but no such half or scope amendment exists. A PR that resolves #15377 must deliver that capability contract or stop closing the ticket through an explicit bounded split.

Rhetorical-Drift Audit: Fails on three material claims: "renders fail-closed refusals honestly," "one or several" recipients, and owner-held truth surviving reveal. Source and direct falsifiers contradict each.

🧠 Graph Ingestion Notes

• [RETROSPECTIVE]: Reusing a fail-closed pane is only safe when the new principal supplies the pane's exact possession authority. Passing a nearby identity field can make every security guard work correctly while the product remains permanently empty.

🎯 Close-Target Audit

• #15377 is a valid close-target only after AC-1 and AC-4 are delivered and witnessed.
• The current Post-Merge Validation defers the ticket's required live named/broadcast journey and both-theme design sign-off; those are pre-merge acceptance evidence, not post-merge smoke.
• #15373's component shard is already merged, so the required witness is not blocked infrastructure.

Findings: Does not yet justify Resolves #15377.

N/A Audits — 📑 📡 🔗

No AiConfig or OpenAPI surface changed. The relevant consumed contracts are the Fleet bridge verbs and mailbox admission envelope; their sender/viewer authority remains intact.

🧪 Test-Evidence & Location Audit

• Author evidence: 280 Fleet units and all exact-head CI are green.
• Reviewer falsifiers: isolated exact-head unit probe: 0/2 passed. It directly exercises construction-time passthrough on the real composed component and possession on the real reused pane; both fail.
• Coverage gap: shipped units assign values after construction, replace the real pane with spies, or manually fire payloads the real single-select field cannot produce. No live-FM named/broadcast journey or both-theme visual witness is present.
• Test location: existing locations are canonical; the missing scenarios belong beside operatorMailbox.spec.mjs / operatorComposeForm.spec.mjs plus the required AgentOS whitebox e2e.

Findings: Green CI does not exercise the failing product paths.

📋 Required Actions

1. Repair identity possession + reveal lifecycle together. Keep the pane's possession guard fail-closed; give it the canonical mailbox authority it expects (without substituting agentId), propagate retained record/snapshot/recipient state during OperatorMailbox.onConstructed(), and trigger exactly one initial read for a real construction-time identity. Add real-component tests for both boot-visible and revealed-later paths.
2. Make the recipient contract real. Require a recipient; implement one, several, and AGENT:* using semantics compatible with the one-target service (including per-target outcomes for several), keep an already-materialized option store current across roster load/reconciliation, and test through actual picker selection + submitted payload rather than hand-fired arrays.
3. Close the async outcome loop. Give compose an explicit pending/sent/not-wired/rejected/thrown state and render it; use a request/response seam that does not lose the controller promise through Observable.fire; catch bootstrap/compose transport failures so they cannot become detached rejections. Add discriminating refusal/throw witnesses.
4. Resolve AC-4 honestly. Implement own-inbox markRead from server-delivered viewer↔target capability while keeping it structurally absent from agent inboxes, or create an explicit bounded scope split and stop this PR from closing #15377.
5. Rebase and prove the delivered journey. Rebase onto merged #15403, preserving the operator + defineAgent rail superset and exact-index tests; then supply fresh exact-head CI, the live-FM named + several + broadcast whitebox journey with honest failure states, and both-theme design sign-off before re-review.

📊 Evaluation Metrics

• [ARCH_ALIGNMENT]: 58 — correct owner/intent/auth direction, but broken possession and lifecycle composition plus the absent capability contract.
• [CONTENT_COMPLETENESS]: 52 — strong narrative, but three delivered claims are contradicted by source and ticket ACs are deferred under a closing PR.
• [EXECUTION_QUALITY]: 48 — substantial unit volume, yet the normal reveal, real pane, real picker, and async outcome paths are untested and fail.
• [PRODUCTIVITY]: 55 — useful components exist, but merging now would install a visually present surface whose core read/write feedback paths do not work.
• [IMPACT]: 85 — operator steering is a high-value cockpit capability and the identity boundary is security-sensitive.
• [COMPLEXITY]: 66 — ten files and several asynchronous composition seams; the repair is bounded but cross-cuts view, owner, and evidence.
• [EFFORT_PROFILE]: Strategic Investment — high product value, but not a mergeable quick win at this head.

Request Changes at 9b57eed515. The sender-stamping and wake-default contracts should be preserved unchanged while repairing the five bounded areas above.

[review-budget-managed]

• outcome: within-budget
• ordinary-limit: 2
• activation-issue: 15257
• activation-pr: 15307
• activated-at: 2026-07-16T20:54:31Z