# ADR 0021 — Offer Review Visibility

Status: Accepted
Date: 2026-09-12

## Context

The initial public observer encrypted a single review-needed bit. This hid
ordinary queue status while leaving the steward without a usable way to read
temporary offers. A direct D1 check on 2026-09-12 found zero pending offers
before this observer change. The encrypted signal and public key did not
provide a review channel: the matching private key was not available to the
connected assistant.

## Decision

The existing hourly public GitHub observer reports the count of unexpired
offers in `received`, `grouped`, `synthesized`, or `deferred` state and whether
that count exceeds zero. These are the pilot's unresolved review states;
`surfaced`, `withdrawn`, and `expired` are not in this queue count.
No text, offer IDs, references, receipt data, or granular timestamps appear in
public workflow output. Invalid database responses fail the run rather than
being reported as an empty buffer. The old RSA signal is retired.

Offer content may be exported only by a separate workflow in a private
companion repository accessible to intended reviewers and the connected
GitHub app. Its short-lived artifact is a disposable review projection of D1,
not canonical publication or a second authoritative store. The public
repository contains only the exporter and a workflow template, not a running
content-export workflow. The private repository must be created and granted
access separately before content review through GitHub works.

The private packet selects only current unresolved offers and expires as a GitHub
Actions artifact after one day. A withdrawn offer can still appear in an
earlier packet until that artifact expires; reviewers must consult the newest
packet and verify live state before consequential action. The packet does not
grant authority to surface, publish, or change an offer's handling state.

The packet compresses **identical text only**, retaining each offer's separate
ID, reference, question, state, and timestamps. Related ideas, disagreement,
corrections, and outliers require review under ADR 0019; no semantic grouping
or automated D1 state transition is claimed by this exporter.

## Consequences

Anyone can observe the pending count in a public workflow run. People with
access to the private companion can download review packets containing offer
text, so repository membership and GitHub app access are part of the private
review boundary. Provider-side artifact retention/deletion behavior should be
checked during companion activation. Neither mechanism changes Phase 2E
ingress rights, Phase 3 authorization, or the canonical admission boundary.