Cold Review

Cold review

A cold reviewer is not an extra panelist. It is a control on the panel.

A panel converges. Reviewers read each other, findings get confirmed by seats already looking in the same direction, and the group arrives somewhere with more confidence than any member earned alone. That convergence is usually right, which is why it is dangerous when it is wrong: a panel of three has approved a head carrying a defect all three missed, and what surfaced it was a differently framed read, not a fourth verifier.

This file is read by the person who WRITES the brief, not by the seat being briefed. The value is in the brief, not in the seat's context. A cold seat that never loaded a skill file, never joined the mesh and received nothing but a persona has produced three blockers that two fully-briefed lenses missed. So nothing here requires the graded seat to have access to this document, and no rule below may be written so that it does.

The isolation

• Never joins the review channel. Not muted, not quiet. Not joined.
• Never shown the panel's findings, verdict, or round count, including as a list of things already ruled out so it can skip them. Skipping-instructions are findings shaped like scope.
• DM-only or file-only input from the author or manager. Its verdict goes first-hand to the dedicated record destination itself.
• Never shares a model family with whoever WROTE the change.

Why never join, stated correctly. Joining exposes the seat to the panel's live traffic for as long as it is subscribed, and the panel is active during a cold read. Replay of history is a second exposure path but not a guaranteed one: replay is channel.replay ?? defaults.replay ?? true, a default-true policy with a per-channel override, so a replay=false channel would not replay. The rule does not depend on that setting in either direction, and a brief that justifies it by replay alone is resting on a config it cannot rely on.

Prefer the ACL to the request. subscribe: [] plus an allowSubscribe that excludes the panel channel makes non-join a property of the seat rather than an instruction it must follow. Where a fence exists, use the fence.

If you catch yourself wanting to tell it something so it does not waste effort, that is the anchor forming. Let it waste the effort; that is the price of the control, and it is cheap next to a laundered verdict.

What the brief contains

It must be executable without a follow-up question, because a follow-up is the contact the isolation forbids. A brief that omits the operational half forces the seat to come back and ask.

The substance, and nothing beyond it:

• the artifact at a named exact commit, and the instruction to re-resolve that sha itself;
• the bounded question, stated so it cannot be answered by agreeing with someone;
• for a delta re-grade, the exact sha range and an explicit scope boundary naming what is out of scope and already settled.

The operations, all of which are required and none of which anchor:

• the absolute path of its own detached worktree, which is never the graded tree;
• where the verdict goes, by exact destination (see below);
• the prohibitions it operates under, and the verdict shape;
• its own model and effort line, to be stated in the verdict.

What must never appear: the issue's own diagnosis, the author's rationale, "the tricky part is X", the panel's findings in any form, or a question phrased as confirmation. Ask "what does this change accept that it should not, and what does it reject that it should not" and let the seat derive the set. Never "do you agree that".

If the author believes something is weak, that belief goes to the panel, which benefits from it. The cold seat's job is to find what nobody framed.

Where the verdict goes

A verdict that exists only in a manager's context is not a verdict. It must land somewhere that survives the seat and the manager, and the seat must put it there itself, because a relayed verdict cannot be distinguished from an invented one.

The broker-attested destination is a Cotal mesh post on one dedicated record channel that the cold seat may publish only to and the panel cannot read. The cold persona keeps subscribe: [] and allowSubscribe: [], and grants allowPublish only for that record channel. Publishing the verdict does not require joining it.

A file at an absolute path written into the seat's persona remains an explicit fallback when the record-channel route is unavailable. It is first-hand delivery only as a norm and cannot satisfy a gate that requires broker-attested poster identity. A GitHub comment is not a substitute: it identifies the workstation's GitHub account, not the Cotal seat, and a shared gh credential lets the manager post the same comment.

Poster is a control only on the Cotal broker-attested destination. A mesh post carries the Cotal principal the broker records. A GitHub comment carries a GitHub account and does not bind that account to the Cotal seat. A file at an absolute path carries neither: any process that can write that path can produce the artifact, including the manager who later "confirms" it by re-reading it. First-hand file delivery is therefore a norm on the seat and the briefer, not a control a later stranger can verify. A gate that treats the file's existence as proof the seat posted has accepted a relay. When the brief must use a file, say so in the verdict record, and do not list poster or channel membership among the checkable controls for that delivery.

Verify at the destination, never at the source. Re-fetch the landed artifact and grep it for content you expect, with a positive control so an empty fetch cannot pass as a clean result. Writes that report success and do not land are common, including an edit that reports nothing and changes nothing or a file write that does not persist while the tree reports clean.

What the verdict says

APPROVE, or named blockers. Never an open-ended re-read, never "looks fine so far", never a list of things it might check next.

It must separate what it EXERCISED from what it INSPECTED, and the split is defined by the OBJECT, not the verb: exercised means the reviewed artifact itself ran through a real entry point. Running a tool to read the artifact, testing against a mock, compiling, or a dry run are inspection. A verb list cannot settle those cases and two seats will classify them differently.

Where it could not exercise something, it names the gap and why. A named gap is a limit of the ENVIRONMENT, not a licence for a limit of EFFORT. "I graded this by reading because running it would take the fleet down" is a boundary on what is knowable; "I did not get to that part" is a boundary on what was attempted, and the two must never be written in the same words.

A blocking finding must enumerate the attacks that FAILED. Without the survey, one success reads as a lucky hit; with it, the finding is a surveyed surface with one hole, and the fixer learns which ground is already covered.

What a cold verdict binds, and who may override it

A cold verdict is not a veto. It is binding as a question that must be answered at the artifact, publicly.

This matters because isolation defends against panel anchoring and not against error anchoring. If the panel disproved claim C with evidence E, the cold seat may re-derive C and report it with fresh confidence, and every route back to it is forbidden: showing E is showing findings, saying "C is settled" is a skipping-instruction, and asking it to recheck is confirmation framing.

The resolution never required talking to the seat:

• A manager may override only if it neither authored the change nor graded or supervised the panel. It verifies the claim against the artifact itself and publishes the refutation with its own evidence, under its own name, leaving the cold finding standing in the record beside it. Nothing flows back to the seat, so isolation holds; the override is auditable, so the control survives. The forbidden act is a PRIVATE override, not an override.
• An author may not override a cold verdict on their own change. They may fold it, or request a fresh permitted stand-in, who overrides publicly under their own name. Publication separates override from launder only when the publisher and the accused are different parties: an author refuting a finding about their own work has produced a document, not a check.
• A permitted stand-in is an independence test, not a signature. It had no part in authoring, grading or supervising the change, never shares a model family with the author, and verifies the claim at the artifact without the author's account of it as input. A coordinator may provision a fresh referee in an isolated worktree and give it only the artifact, the finding and the exact sha; whoever provisions the referee does not thereby become the referee. A prior panelist, lane manager or supervising coordinator is not a stand-in. A clean byline on the author's reasoning is the original hole with a different name.
• Every public refutation names the exact sha it answers and closes the blocker only at that sha. A moved head requires a new verification and a new public record; a refutation is never carried across a sha any more than a verdict is.
• A cold blocker is closed by the seat's own APPROVE or by a permitted public refutation, and by nothing else. Any completion gate must first require a landed terminal verdict, APPROVE or named blockers, before it evaluates closure. A silent, failed, or non-verdict lifecycle cannot pass on an empty finding set. After that prerequisite, the gate must accept both closure routes. A gate that demands the seat's approval alone deadlocks the override the first time it is used correctly, because the seat is one-delivery and may never be told to reconsider: the only exits left are satisfying a finding that was just publicly refuted, or a zero-delta re-pin to manufacture an approval, which is laundering.

When the vendor set is short

Availability is a property of the moment, not of the vendor: the same model has joined and delivered one hour and failed to join the next, on the same host with the same tooling. A rule that can be broken by the clock gets quietly ignored rather than obeyed, so the requirement is ordinal, never a headcount.

The property: no two seats whose agreement is load-bearing may share a model family, and the cold seat must not share a family with whoever wrote the change.

Degrade in this order, most expendable first: panel-internal separation, then cold-versus-panel separation, and never cold-versus-author.

The floor is a refusal, not a degradation. A cold read whose seat shares a family with the author is not a cold read and must not be recorded as one. Below the floor the review does not run and says so, because a silently-degraded panel is precisely a fallback: it returns a verdict shaped like a full one.

Name a collision mechanically, never apologetically. Not "vendors were short so this may be weaker", which a reader cannot act on. Instead: "seats X and Y are both family F, so any finding they agree on is one observation and not two, and the class left uncovered is what only a different family would have framed."

Grade the artifact, never the account of it

• A reported sha is a claim. Resolve a PR or branch head from its Git ref first, for example git ls-remote origin refs/pull/<n>/head, then positive-control the object with git cat-file -t. Use a known-missing full-width object id as the negative control, for example forty zeroes. Do not append a character to a valid object id: Git accepts an overlong hex string when its leading full object id resolves, so that apparent negative can return the original object and pass falsely. Fetch the exact ref first if that object is not local. When a PR exists, cross-check with gh pr view <n> --json headRefOid rather than treating it as authority: a head field can lag after a push, while a mergeability field may be answering a different strategy question. A branch-only lane has no PR API cross-check; gh pr view <branch> may select an old closed PR and is not a substitute. If two instruments disagree, reproduce the exact question each asks before calling either one stale. Re-resolve the ref when you grade and again if you act.
• A measurement over a mutable ref is only true as of a revision. Report it as "at <sha>, read <time>". A ref name is not an identifier.
• A quoted argument is not the call's arguments. Diagnose from the recorded entry, not from prose describing it, including your own.
• A green from a check that structurally cannot see the failure reads exactly like a real green. Ask what question the check actually answers.
• Positive-control the instrument before believing a zero. A path that does not exist returns a clean zero, indistinguishable from an unmodified one.
• A count is not a set. Quote the set.
• Evidence built the same way as the bug inherits the bug's blind spot. A checker configured like the thing under test cannot detect a divergence between "configured like" and "actually used".

Re-grades

• A one-delivery limit must carry an explicit written exception for a re-grade, or a re-pin silently becomes a verdict the seat forms and never posts, leaving a stale block on the record against a head that no longer exists.
• Never carry a verdict across a sha. Re-pin, or revert to the graded head.
• Base freshness matters when the base delta INTERSECTS the graded surface. Compute the intersection rather than rebasing reflexively or accepting reflexively.
• For a delta re-grade, name the scope boundary. A reviewer that has to guess where its licence ends will either re-audit everything or stop too early, and the verdict will not say which.

Which of these are controls, and which are norms

Stated plainly, because a norm presented as a control is the false assurance this whole discipline exists to prevent:

• Controls, mechanically enforced while the seat runs: a read ACL that excludes the panel channel, the pinned model and effort, and broker-attested poster identity on a dedicated Cotal record channel. The sha named in the verdict and the destination it landed on are retrospective evidence. A later stranger can call non-join auditable only when launch-time ACL evidence was retained; a current subscription snapshot cannot prove historical non-join, and a GitHub comment says nothing about channel membership.
• Norms, resting entirely on the briefer's discipline and not auditable after the fact: that the brief carried no findings, no diagnosis and no confirmation framing, and that a file destination was written by the seat rather than by the manager.

There is no artifact proving a brief was clean. That is why the briefer, and not the seat, is the party this file addresses.

When to spend a cold seat

Worth it: security-sensitive surfaces, hard-to-reverse changes, anything where the panel converged fast, anything you wrote yourself, and any change to the rules by which other work is graded.

Not worth it: a typo, a version bump, a change whose entire surface one reviewer can hold.

The cold seat is a second axis, not a fourth panelist: it does not substitute for panel breadth and panel breadth does not substitute for it.

The failure modes

• Anchoring by kindness. Telling the seat what has been ruled out, to save its time.
• Anchoring by vendor. Seating it on the same family that wrote or graded the change.
• Laundering. Reporting a head as reviewed when the verdicts name a superseded commit.
• Relay. Someone else posting the verdict on its behalf.
• Vacuous completion. Applying blocker-closure logic before a terminal APPROVE or named-blocker verdict has landed, so a silent or failed seat appears to have no open findings.
• Confirmation framing. Any question answerable by agreeing.
• Self-certification. An author publishing a refutation of a finding about their own work.