Decide what the interactive marker does to the creation-record ownership gate

[devantler]

🤖 Generated by the Agentic Engineer

Evidence

A Codex P1 on #194 identified a genuine gap in the ownership gate, which that PR deliberately does not change.

The engineer's ownership test is the creation record: a maintainer-login PR the engineer has no record of creating is the human's and is hands-off. The surveyor's disclosure hint is explicitly not a gate on driving — it tells the orchestrator whose control channel a comment on that PR is.

Those two rules leave one state unresolved. When the engineer created a PR and the maintainer later takes it over by driving it interactively, the creation record still says "the engineer's" while the body now carries the interactive marker. Nothing in the plugin resolves the disagreement, so an orchestrator may still update-branch, rebase, or merge a head the maintainer is working on.

Why this is not a fix to make inside #194

#194 is about the hint's shape: three-valued, matched by which literal appears rather than where it sits, and reaching the orchestrator on every row that needs it. Making the marker override the creation record for driving actions is a change to the ownership gate itself, and it is a decision consuming deployments legitimately differ on:

• A deployment whose contract keeps hands-off wants interactive to revoke driving.
• A deployment that has retired hands-off — as at least one consumer has, deliberately giving the engineer every PR in the portfolio to drive to a terminal state — wants interactive to change attribution only, which is exactly what the current text says.

Imposing the override in the plugin would break the second deployment; leaving it unstated leaves the first exposed. So the plugin needs to say which it is, and most likely to make it a contract-declared choice rather than a fixed behaviour.

Acceptance criteria

• The plugin states explicitly what interactive does to the creation-record gate for PR-driving actions (update-branch, rebase, promote, merge).
• If the answer is deployment-dependent, the consumer contract gains a named fact for it and the engineer fails closed when it is absent.
• The engineer entrypoint's ownership rule and the surveyor's disclosure rule agree in wording, so neither can be read as settling the question alone.
• A validator assertion pins whichever rule is chosen.

Rough size: S for the wording, M if it becomes a declared contract fact.