Reviewer Kind#
A review outcome names its reviewer by actor, a label the producer chose. A
host that needs a person to decide certain items, such as routed contradictions
in accumulated memory, could not tell from the record whether a person or
another agent did.
The host attests a reviewer kind (2026-11-03)#
ReviewOutcome, ReviewDecision and ReviewSessionEvent carry
reviewerKind: "human" | "agent" | "rule". The host that authenticated the
reviewer sets it on the session snapshot; the reviewer, the browser and a posted
event cannot. Replay and apply read the kind from the snapshot only, and the
stored event log records the snapshot's value over whatever a poster sent.
The kind decides Surface confidenceBasis.reviewerAuthority for a verified or
assumed claim (human is operator, agent and rule are system) and is
carried as metadata.survey.reviewerKind beside reviewerKindInferred. It
extends the one reviewer-authority derivation in buildSurveyTrustBundle; there
is no second mechanism. evidenceStrength is still driven by the auto-accept
policy actor alone.
A record with no kind keeps the authority it always had (the policy actor is a
rule, any other actor a human) and is marked reviewerKindInferred: true. An
inferred human is a default for an unlabelled actor, not an attestation, so a
consumer that requires a human decision refuses it. An unknown value is refused,
and human on auto-accept-policy is refused as a contradiction. These checks
live in assertReviewerKind, called from the gate every review-building and
review-projecting site already used (assertReviewResolutionConsistency).
Oversight metrics add byReviewerKind; the pooled aggregate is not a measure of
human review. Entity review outcomes carry the kind through the decision they
bind, so it is part of the outcome identity, and their mapping claims project
the same authority.
The kind is per session, so it attests the authenticated principal writing to
it. Neither shipped server authenticates anybody, so survey_review_decide and the
console's POST /api/events refuse a session attested human rather than stamp
whoever posted as a person. The console refuses even with a producer-owned apply,
which runs only after the events are stored. Decision events in a kind-attested
session must carry a stamp, so decisions written by an earlier Survey version's
writer, which preserves the snapshot's field but never stamps events, are refused
at apply instead of reading as explicit human. This is a compatibility guard, not
authentication: a stamp proves nothing about the writer, and binding the writer
and its event stream to the session stays with the host's authenticated ingress.
Producer confidenceBasis overrides cannot raise an attested agent or rule to a
human authority. The review proof binds an attested kind (absent kind, same
digest), and calibration counts human labels only.
Not decided#
- Survey does not require a human for any record. Which items need one is the host's policy; Survey makes the requirement checkable.