Skip to content
PETROVA

A pending human countersign keeps a decision open

Date: 2026-08-10 Status: open Supersedes: none — resolves the operator question raised in 2026-08-06-petrova-host-apex-re-root.md Superseded-by: none — current

Context

Section titled “Context”

cli/src/verbs/validate.ts enforced MR-7 by requiring that a doc at Status: closed or superseded carry a ## Sign-off heading. The check was satisfied by the heading’s mere presence. Nothing looked at whether anyone had actually signed.

So a document could declare itself closed while its human countersign sat unchecked. Two did:

DocStatusSign-off
2026-08-06-petrova-host-apex-re-root.mdclosed- [ ] pending
2026-08-10-airtable-retirement-dsn-substrate.mdclosed- [ ] pending

The first of those raised the contradiction itself, in a note appended 2026-08-09, and deliberately declined to resolve it: “Either the status should have been accepted until the countersign landed, or the validator should treat an uncountersigned Sign-off block on a closed doc as its own finding rather than accepting the heading’s mere presence.” The second reproduced the same shape a day later, which is what turned a one-off into a convention question.

There is already a precedent pointing one way: 2026-08-06-petrova-blue-apex-landing.md sits at Status: open with a pending countersign, and always has.

Decision

Section titled “Decision”

A decision doc with an unchecked countersign in its ## Sign-off block stays Status: open. closed is an attestation that the gate was passed, and in this playbook that gate is human — “It does not replace human judgement at phase boundaries.” An unsigned decision has not passed it.

petrova validate now reports an MR-7 error when a closed or superseded doc has an unchecked box in its Sign-off section. The check reads only from the ## Sign-off heading to the next ## heading, because several older docs carry unchecked task checklists in their bodies that are not sign-off gates (2026-05-10-governance-audit-completeness.md has six).

open here does not mean the work is unfinished. It means the countersign is outstanding. Where that distinction matters, the doc says so in its own text.

Alternatives considered

Section titled “Alternatives considered”
  • A new accepted status between open and closed — the first option that doc offered. Rejected: it adds a fourth value to a vocabulary used by walkDecisions, the dashboard, the consumer-facing docs-invariants.yml, and eight *-hq repos, to encode something the existing open already means. Cost of the migration exceeds the precision gained.
  • Let an agent tick the box — never. A countersign is an attestation, and an agent attesting to human review is the exact failure the gate exists to prevent.
  • Leave it as a warning — a warning that never blocks is how both docs reached main already claiming closed.

Consequences

Section titled “Consequences”

For code:

  • cli/src/verbs/validate.ts — new exported pendingCountersign(text) helper and an MR-7 error using it.
  • cli/tests/verbs/validate-countersign.test.ts — covers the pending case, the signed case, the body-checklist false positive, and a doc with no Sign-off block at all.

For docs:

  • The two docs above are moved closed → open, each with a dated appended note recording the change and pointing here. Their prose is otherwise untouched.
  • docs/decisions/_template.md states the convention where an author will meet it.

For in-flight phases:

  • None. No phase gate depends on either doc’s status field.

For invariants:

  • No new MR-N. This tightens how MR-7 is checked; it does not amend MR-7, which is authored in eva-hq and governed by its own footer.

For consumers:

  • Not propagated. core/templates/.github/workflows/docs-invariants.yml runs the consumer-side MR-7 check and is unchanged, so no *-hq repo starts failing on this. If the convention proves out here, propagating it is a separate change against the templates submodule.

References

Section titled “References”
  • 2026-08-06-petrova-host-apex-re-root.md — raised the question; note appended 2026-08-09.
  • 2026-08-06-petrova-blue-apex-landing.md — the existing open + pending countersign precedent.
  • 2026-08-10-airtable-retirement-dsn-substrate.md — reproduced the shape.
  • cli/src/verbs/validate.ts — the MR-7 implementation.

Sign-off

Section titled “Sign-off”
  • Subagent: petrova-control-plane (2026-08-10)
  • Human countersign — the convention above, and the status change applied to the two docs it names.

This document is Status: open with a pending countersign, which is the convention it establishes. It is the first doc to comply with its own rule.