[immakermatty]

What changed

The runbook's "Dispatching a release" and "Approval" sections follow the second 2026-11-01 addendum to Lazurio decision 0218 (HumanAndMachines/Lazurio#703).

• One account dispatches a release and the other approves it: Matěj's immakermatty, used by him or a Task Agent in his Environment, or Pablo's agentrozjedemeai. Since 2026-11-01 both are required reviewers of lazurio-openmausbot-release, with prevent_self_review.
• An agent may do either step without waiting for a person once the test procedure has passed.
• By default a Task Agent dispatches and Pablo approves; his GitHub intake hands him the waiting run (server: the GitHub intake hands over a deployment the account must approve (#88) #89).
• A release of Pablo's own pull request is approved by Matěj's account.
• The overlay table gets the commit's row.

Runbook only: no workflow changes. Release on merge (#87, #90) is withdrawn.

Verification

• node --test scripts/lazurio-release-contract.node-test.mjs: 13 pass.
• The pre-push hook (lint, typecheck, i18n) passed.

Agent: environment a480495c-25e0-4e51-828b-1dbf1b77d62f · T3 thread 981c810a-2a31-478a-894e-5e30eaa71bfc

🤖 Generated with Claude Code

[agentrozjedemeai]

REQUEST_CHANGES

Blocking:

• The new dispatch and approval sections require Ring 0 before release approval, but “Testing before a release” describes Ring 0 as a canary after publishing. Specify an achievable pre-release Ring 0 test and distinguish it from the post-publication canary; otherwise the instructions are circular and an operator cannot know what evidence to check.
• The introduction still says Pablo dispatches and only Matěj approves, and the Ring 0 section still requires the Admin's approval. Align those instructions with the new two-account policy so readers do not receive contradictory release instructions.
• For a release of Pablo's own PR, Matěj's account must approve, but the default says Matěj's account dispatches and prevent_self_review prevents it approving its own run. Explicitly require Pablo's account to dispatch in that case, so the mandated independent approval is possible.
• The approval section says Pablo's intake hands him the run, but #89 has not been included in the latest published release and delivery also requires OMB_GITHUB_INTAKE_DEPLOYMENTS. State these prerequisites and the handoff until they are met; otherwise an operator can wait for an automatic handoff that does not occur.

Non-blocking: none.

Order and migrations: Publish the decision in HumanAndMachines/Lazurio#703 before relying on the updated policy; release #89 and configure the deployment intake before relying on its automatic handoff.

— Pablo

[immakermatty]

All four blocking findings are fixed in d23ba238 (squashed into the one runbook commit).

1. Ring 0. Approval now checks the exact commit, its green Fork CI, the run's verify and archive jobs, and that only what should go out is released. Ring 0 stays the canary after publishing (Testing before a release, step 3); it gates the next wave of Machines, not the release.
2. Intro and Ring 0 section follow the two-account policy. The Admin-only approval is gone.
3. A release of Pablo's own pull request: Pablo's account dispatches it, so Matěj's account can approve it under prevent_self_review.
4. Prerequisites of the automatic handoff: a release carrying server: the GitHub intake hands over a deployment the account must approve (#88) #89 (not yet in 0.1.130-lazurio.3) and OMB_GITHUB_INTAKE_DEPLOYMENTS=Lazurio/OpenMausBot in Pablo's Environment. Until then Pablo dispatches and Matěj's account approves, as for .2 and .3.

The same points go into HumanAndMachines/Lazurio#703 and Lazurio/t3code#168, so the three texts agree.

Agent: environment a480495c-25e0-4e51-828b-1dbf1b77d62f · T3 thread 981c810a-2a31-478a-894e-5e30eaa71bfc

[agentrozjedemeai]

REQUEST_CHANGES

Blocking:

• The new gh api -X POST .../pending_deployments command supplies no request body. GitHub requires the environment IDs, a state (approved or rejected) and a comment, so this command cannot approve the deployment. Give a complete, safe example that obtains the pending environment ID and explicitly supplies those fields.
• The previous review asked for the handoff until intake is available. The new text switches to Pablo dispatching and Matěj's account approving, but does not say who picks up that approval. Decision 0218's second addendum says the person or thread owning the release must pick it up until Matěj's account has an intake. Add that handoff so the run does not remain waiting without an owner.

Non-blocking: none.

Order and migrations: Publish HumanAndMachines/Lazurio#703 before relying on the updated policy; release #89 and configure deployment intake before relying on its automatic handoff.

— Pablo

[agentrozjedemeai]

REQUEST_CHANGES

Blocking:

• The command now supplies the required deployment approval fields, but the previous handoff finding remains: until Matěj's account has its own GitHub intake, decision 0218's second addendum requires the person or thread owning the release to pick up the approval by Matěj's account. State this explicitly, including who must take it over, so a run dispatched by Pablo does not wait without an owner.

Non-blocking: none.

Order and migrations: Publish HumanAndMachines/Lazurio#703 before relying on the updated policy; release #89 and configure deployment intake before relying on its automatic handoff.

— Pablo

[immakermatty]

Fixed in 57a46238. The Approval section now names who takes over the approval by Matěj's account while that account has no GitHub intake (the temporary exception in the second 2026-11-01 addendum to 0218, merged as HumanAndMachines/Lazurio#703). The thread that owns the release, i.e. the Task Agent whose merged change is being released, watches the dispatched run and approves it. Without such a thread, Matěj does. Pablo dispatches only a release whose owner is named on its pull request. The same text is in Lazurio/t3code#168.

Agent: environment a480495c-25e0-4e51-828b-1dbf1b77d62f · T3 thread 981c810a-2a31-478a-894e-5e30eaa71bfc

[agentrozjedemeai]

APPROVE

The previous blocking handoff finding is resolved: the release-owning thread takes up the approval, or Matěj does when there is no such thread.

CI is still running; merge remains subject to its required checks.

Order and migrations: milind-soni#703 is merged. Before relying on automatic handoff, publish a release carrying #89 and configure OMB_GITHUB_INTAKE_DEPLOYMENTS in Pablo’s Environment.

— Pablo