fix: the PM owns board triage — onboarding becomes scan-and-report only

[mabry1985]

Found live, in dogfooding (companion to projectBoard-plugin#63)

Spun up a team via Roxy, dispatched one feature. The team's board ended up with two beads for the same work, twice over:

bd-2kx / bd-8or   "Create PROTO.md grounding doc..."     (the team's own onboarding task)
bd-1bf / bd-2h6   "Rollup surfacing: priority + stuck"   (my dispatched task)

The team's own audit log showed the immediate cause: its agent called board_create_feature twice, ~7-9s apart, same title each time — fixed at the tool level in projectBoard-plugin#63 (a dedup guard on board_create_feature itself).

But that's the symptom, not the root cause

The onboarding instruction (_onboard_instruction) told the team to both "auto-fix the safe, deterministic gaps directly" and "board the judgment gaps... as features if they need real work." That's a judgment call — and a freshly-booted agent, under its own steam, didn't reliably keep the two modes apart: everything it found, even the "safe" items, ended up as a board feature (both PRs #33 and #34 exist — the "safe direct auto-fix" PROTO.md doc got boarded + PR'd exactly like the real dispatched feature).

Patching the dedup at board_create_feature stops the duplicate creation, but leaves the team deciding what goes on its own board — which is the PM's job, not the team's.

Fix

Onboarding is now read-only: scan and report PASS/GAP per item — no board writes, no code changes, full stop. portfolio_spinup_team's result surfaces the summary plus an explicit next nudge to review it and portfolio_dispatch whatever needs real work — the same dedup-guarded path (#25) every other feature already goes through. The PM decides what's on the board; the team never self-boards.

Changes

• _onboard_instruction: rewritten to forbid board/code writes explicitly; still runs the onboard-project skill, just to scan.
• portfolio_spinup_team docstring + onboard arg doc: reflect the new contract.
• The next field in the spinup result: nudges the caller to review the onboarding summary and dispatch, when onboarding ran.
• Tests: test_onboard_instruction_forbids_board_writes_and_code_changes, test_onboard_instruction_defers_the_call_to_the_pm.

Gate: ruff check . && ruff format --check . && pytest -q — 127 passed.

Version bumped 0.15.0 → 0.15.1 (behavior change to an existing tool's side effects).

Companion PR (bundle soul update): portfolio-manager-stack#26.

🤖 Generated with Claude Code

[protoquinn]

👀 Quinn is reviewing — verdict (PASS / WARN / FAIL) + findings to follow.

[protoquinn]

QA Audit — PR #35 | fix: the PM owns board triage — onboarding becomes scan-and-report only

VERDICT: WARN (non-blocking — CI not yet terminal)

---

CI Status

• test: queued

Diff Review

• _onboard_instruction rewritten to forbid board writes + code changes; still invokes onboard-project for the scan (__init__.py:645-668)
• _spinup_team next field now conditionally prompts the PM to review the onboarding summary + portfolio_dispatch gaps themselves, rather than assuming the team did it (__init__.py:1241-1248)
• Docstrings for portfolio_spinup_team and its args updated to reflect the read-only contract (__init__.py:1604-1647)
• Version bump 0.15.0 → 0.15.1 consistent across protoagent.plugin.yaml and pyproject.toml
• Two new tests verify the instruction forbids board writes, forbids code changes, and defers to the PM (tests/test_team_spawn.py:1025-1041)

Observations

• LOW: clawpatch structural review skipped — repo not in project registry. Diff-based review only; no cross-file concerns identified.
• LOW: CI still queued. Formal PASS/FAIL deferred until checks are terminal.

— Quinn, QA Engineer

[protoquinn]

Submitted COMMENT review on #35.