The desk roles: the separation is the control

A fleet of coding agents does not fail the way a slow team fails. It fails the way an unaudited ledger fails: the work happens, the record of the work drifts from the truth, and by the time anyone looks, every entry was written by the same processes under examination. Our introduction to this series gave the property that answers this — work made checkable: derived, linted, re-verified — and spent one section on the loop that runs it. This article is that section unpacked, because the loop is where the property either holds or quietly stops holding. The question it answers is narrow and operational: who is allowed to advance a piece of work, and why is the answer never "whoever did it"?

The design fits in one sentence, and it is the oldest control in regulated finance running on new machinery: separation of duties across accountable identities. The identity that does the work never certifies it, and each role hands the next an artifact in a form the next role can check. Concretely, the loop is five standing roles — intake, dispatch, review, verification, coordination — each in its own session, each writing under its own machine identity, plus one act that belongs to none of them. The roles are roles, not people: a desk is a standing session with a queue, a small set of permitted writes, and one deliberate incapacity.

thirty-one minutes, four actors

Watch one unit of work cross the pipeline. A small change to our tracking tree, merged the day this article was drafted; the timestamps are from the forge's own record.

At 13:56 a worker identity opens a draft pull request. The worker was dispatched by the worker desk, ran in its own worktree, and its job ended where a worker's job always ends: change implemented, the work item's verification commands run and logged, PR left in draft. At 14:08 a different identity — the reviewer's — posts an approval: not a comment saying "looks good," a review object pinned to the exact head commit it examined. At 14:09 the same reviewer identity flips the PR from draft to ready, a distinct act with its own preconditions. At 14:27 a human merges. Later that afternoon a third machine identity, the verifier's, re-ran the same verification commands against merged main and committed a dated, attributed evidence row; the board's single automated writer, reading the approval pinned to the merged head, then advanced the record to done. Three desk identities, one automation, one human — and no actor appears twice on the same side of its own work.

The same afternoon shows the honest half of the picture. Two sibling changes merged within minutes of that one sit exactly where the pipeline says they sit: one verified and awaiting a human's review because its risk answers name a human, one still at implemented — merged, and not done. That gap is one role's entire reason to exist, and we will get to it.

intake: five exits and no sixth

Everything inbound — issues, raw ideas, requests, findings from other loops — arrives at one front door, and the intake desk's job is to make every item leave through exactly one of five tracked exits: a scoped unit of work; a filed bug; a finding that flags existing work as suspect; a decision routed to a human; or an explicit rejection or watch entry, reason mandatory. There is no sixth exit called "someone saw it." The desk's load-bearing distinction is a routing test: if a worker could act on it as-is, it is work; if it needs judgment first, it is intake, and the judgment happens on the record. An untriaged item older than three days trips an alarm, because an unwatched front door is precisely the invisibility this loop exists to kill. And the intake desk's own output obeys the pipeline it feeds: its writes leave as draft pull requests that the review desk judges like anyone else's, and it never flips its own work ready. What it hands on is the pipeline's raw material — a unit of work carrying an executable verification contract.

dispatch: a pool, not a wave

The worker desk keeps a standing pool of eight implementers full: one unit of work per worker, one isolated worktree per worker, one branch, one draft PR. The unit of operation is the slot — a worker finishing is not progress toward "the batch," it is a refill trigger — and claims on work are taken as atomic references visible across machines, so two dispatchers cannot hand out the same item twice. Two boundaries define the role. First, a worker stops at implemented: it runs the verification commands and logs its own results, and advances nothing, because a self-run table is a claim, not a certificate. Second, the desk may not report its queue empty without a fresh sweep proving it; "my workers finished" is a fact about its workers, not about the queue. What it hands on is a draft PR whose diff the next role can judge against the contract intake wrote.

review: approve at a head, flip, never merge

The review desk runs its own pool — five reviewer slots rather than eight, because reviewers lean hard on the forge's API and the fleet has measured where the rate limits live. Its verdict discipline is strict in specific places. CI is the first check, and a red rollup outranks any local trace. The verdict is a real review object posted by the reviewer identity at a specific head commit, never a text marker in a comment. A diff that touches risk-classed surfaces needs a second, separately dispatched security artifact at the same head, and any new push invalidates both. The role's hardest-won lesson is about merges themselves: a clean merge is the weakest evidence in the report — "no conflict" means the bytes combined, not that the combination is correct — so re-review runs against the main the work will actually join, not the main the review started on. When approval-at-head, green CI, and mergeability all hold, the review desk flips the draft ready for a human. That flip is the whole of its authority. The merge is not in it.

verification: merging is throughput, not completion

Merged work enters a visible awaiting queue — 42 units on it as this drafts — and the verify desk exists to drain it: for each merged unit, a verifier that did not implement it re-runs the verification commands against merged main and commits a dated evidence row under its own identity. A pass advances the record. A failure is a change failure — filed as its own tracked issue, never buried, and the unit does not advance — and the failure rate is a number the pre-merge review gets graded by. One class is carved out entirely: work marked irreversible cannot be closed by any model's verdict. The verifier still records the evidence, a sign-off issue lifts that evidence to a human, and the human's close — nothing else — writes the closing stamp, through the one workflow permitted to write it. What this desk hands on is the thing the whole system runs on: an attributed record a stranger can re-derive.

coordination: evidence in, never verdicts out

The fifth role arbitrates across streams and keeps the registers honest, and it is defined mostly by refusals. It never reviews work itself; needing a review, it files a request and stops, because a dispatcher judging what it dispatched folds two duties back into one actor. Its dispatch rule is the same discipline pointed inward: a dispatch carries evidence, never a verdict — "the artifact claims X; establish it from the primary source" — and at least one checker per contested fact gets the question without the coordinator's framing, because several agents agreeing with a premise they were handed is one observation, not several.

the shape of the graph is the argument

Lay the roles out and the control is visible as structure:

The third column is the argument. Every interface is either executable or pinned: a contract is literal commands with expected output, a review names its commit, an evidence row names its runner and date — and the record's linter mechanically rejects a certification whose runner matches its author. The separation is not politeness between agents. Part of it is enforced in tooling, and the rest is enforced by the fact that each identity's writes are attributed and the next role re-derives instead of believing.

what the separation does not buy

The strong form — "no desk can falsify the record" — is false, and the tooling's own documentation says so. The identities are attribution, not enforcement: whoever holds the signing keys can mint any of them, so the control's value is the trail, not a wall. Within its lane a single identity can still lie — the verifier's report is itself a claim, which is why evidence rows carry re-runnable commands rather than assurances. The watchers need watching: monitors here have died silently, and one such outage let the review desk report itself idle while nineteen actionable items sat unseen; the rule that grew from it — blind is not idle, and no state claim without a fresh sweep — is a patch on a real wound, not an immunity. And the separation is paid for in sessions and tokens, including duplicated work when two desks react to the same event; the recorded calibration on that cost was blunt: "we are catching them, and it isn't really affecting the integrity of the overall system (besides burning tokens)." Separated identities narrow the gap where one actor authors both the work and its record. They do not close it.

the roles travel; the desks are optional

None of this requires our tooling. The pipeline is an org discipline, installable on a stock forge in four decisions: give each role its own identity, so every write is attributed; define each hand-off as an artifact the receiver can check — executable commands, a verdict pinned to a commit, a dated and attributed record; deny each role exactly one act, the one that would let it advance its own work; and keep the merge human. Our desks are the worked example of those decisions, not a prerequisite for them. The identity that does the work never certifies it — and each role's output reaches the next in a form it can check. What that checking rests on when the work itself must be trusted to no one is the introduction's story: derived, linted, re-verified.