Human review

A reviewer confirms what a field should say. If the confirmation names a different value, that same act is also the correction. The trail records who confirmed which value and when. Quorum rules — two people must confirm a field under 50% confidence, for example — are yours to define: the platform records signed confirmations rather than enforcing a policy.

Confirmations that change a value append reviewer agents, review.confirm activities, corrected value entities, and derivations to a projection of the machine graph. Confirmations that name the current value add standing on that entity without minting a new one.

The review endpoint rebuilds this projection from the immutable machine lineage and durable review events. Treat review.lineage as read-only. Extend a copy in your own system when adding normalization, calculations, inference, or application-specific review history.

Who stands behind a value

The lineage document still carries an approvals assertion on the entity whose value was confirmed, naming the reviewer agent and the time. Standing is derived from confirmations rather than stored as its own event: an actor counts when their newest live confirmation on that path names the value the entity currently holds. Several people can stand behind the same entity, and each agent appears at most once — a later confirmation from the same person that still names this value replaces the earlier standing.

Confirming a different value mints a new entity, and standing on the predecessor is left behind. That is why a sign-off never describes a value nobody confirmed. A confirmation on an overlapping path — a parent or a child — has the same effect, because it changes what this path holds.

Standing is per entity and does not propagate. Confirming a field says nothing about the region it was read from; that region carries its own standing if someone confirms it. Any entity can carry standing, so a workflow that reviews pages or regions rather than fields uses the same assertion.

Every review response also carries viewer_actor_id, the actor the request authenticated as. It describes the caller rather than the review, which is identical for everyone. Compare it against an entity's standing to tell this reviewer's own confirmation from a colleague's: offer to withdraw only a confirmation this reviewer gave, and keep offering a confirmation on a value somebody else has already signed.

A reviewer may take back their own most recent confirmation on a path, and only while nothing else depends on it — no later overlapping confirmation, and no one else standing on that value. The projected graph omits that confirmation's value, activity, and derivation when it had corrected the field, and outputs point at the predecessor as though the confirmation had never been made. The event log still records that the retraction happened.

The review snapshot that gathers the current fields carries a digest of the corrected output, not a second copy of the value. Read the value from review.corrected_output.