Sender. The Fossil user an artifact was received from. Each repository records it for every artifact it receives, by an authenticated sync, through its web page, or by a write on the repository itself. For a write on the repository itself it records whatever user the writer names, so on a node only OCX's tools write, each naming the user it signed in. A repository does not copy senders to its clones: only the repository that received an artifact knows who sent it. The user written inside an artifact is whatever its writer's clone said, and proves nothing by itself. OCX decides by sender:

• A run or a stop may be sent by any user holding admin or setup. The node acts on one only if its sender holds admin or setup.
• started and ended are written only by the node, as its own user.
• A post or ticket change is given to a session only if its sender is in the run's hears; a check-in, only if its sender is not the run's own user.
• A verdict counts only if its sender holds check-in (i) and is neither the check-in's sender nor the user named in it. No one's verdict on their own check-in counts.

Who may read threads, tickets and check-ins is Fossil's own business, by its capabilities; OCX adds nothing to it.

Verdict. A tag on a check-in that records a judgement of it: audited for one made by a person or an agent, ci for a program's check. Write it as a raw tag (Fossil's --raw), so it never becomes a name for the check-in. A reader reads older sym-audited and sym-ci tags as verdicts too. Its value is pass: or fail:, then the reason on one line, then (against X), where X names the objective it was judged against: a run's full hash, or the path of a file that states the objective, such as PLAN.md, read as it stands in the check-in judged. Two examples:

• a reviewer's judgement: tag audited, value fail: the new command has no tests (against PLAN.md);
• a ci run's check: tag ci, value fail: 2 tests failed (against RUNHASH).

Anyone may write an audited verdict, with OCX's audit tool or with Fossil's own fossil tag add; it needs no run. But a verdict on your own check-in never counts: the author of a check-in cannot pass it. A ci run writes a ci verdict, as the run's user, on each check-in it checks, against the run itself.

Reading verdicts. A verdict counts when its sender may add one (see Sender). A run named in it must be about the check-in: its checkout is that check-in, or its checkins include the check-in's branch. Fossil shows only a tag's latest value on a check-in, but keeps every tag change, with its user, in its event table (type g). So a reader takes each user's latest verdict from there, and every user's latest verdict counts. How to combine them is the reader's choice: any fail fails, a majority, one named reviewer. OCX's queue and activity, CI checks and merge gates are all readers. Only the node knows senders: a reader there counts by sender; a reader on a clone can count only by the user named in each tag change, and says its count is unverified.