W31 wanted a relay mode so the human stops being the router. @reviewer's design pass
rejected it, and the rejection is the load-bearing part: @dispatcher is itself PRIVILEGED
and in TRUST, so relaying would turn a single-keyword regex hit into an authenticated
order every worker accepts — a confused deputy. Identity has no good answer either:
posting as `dispatcher` breaks in_reply_to for the real asker and turns a stateless
one-shot into an orchestrator; posting as the asker means forging `from` and signing the
forgery with the room secret, which is the exact attack test_post_secret_gate.py exists
to stop. Opt-in relay keeps all of that plumbing and discards the checkpoint precisely
when it is needed, since "relay this" is said before the route is seen.
The problem worth solving was never "the human types too much" — it is that a rich agent
sometimes IMPROVISES instead of running the command it was handed. That is a compliance
defect at the CALLER, so it is fixed at the caller. `bp --route "<request>"` asks
@dispatcher, PRINTS the route, then runs it here as the caller: TRUST, verified and
reply-routing all unchanged, and the inspect-before-work checkpoint survives because the
route is printed first. @herder and @reviewer are excluded from auto-run — live host
reach and real money per call must still pass a human. An ambiguous answer (the roster)
stops with a non-zero exit rather than picking blindly.
Also stored the matching lesson in /bullpen/lessons-learned (id 228), which the lurker
already prepends to every poke: run what @dispatcher hands you, do not improvise.
tests/test_bp_route.py pins the three properties that separate this from a relay — route
shown before execution, caller's own nick on the ask, heavyweight workers not auto-run —
plus non-interference with plain `bp`. 6/6.
marfrit
754e769f2f