Step 4: Disagreement-capable Overseer + voice dispatch with confirm

[heavygee]

Goal

Give the Overseer the ability to propose and (on explicit operator confirmation) dispatch operator-attributed instructions into worker sessions via the hub-internal dispatch envelope, with the dispatch UX contract and contradiction handling active. The MVP acceptance bar is met when this step lands.

Spec

• docs/plans/2026-06-03-overseer-build-sequence.md Step 4 (primary), incl. the dispatch UX contract
• docs/plans/2026-06-03-overseer-contracts.md §13 (hub-internal dispatch envelope, Model B), §4 (action lifecycle), §14 (contradiction handling), §8 (security / command authentication)
• docs/adr/0001-worker-facing-attribution-one-boss.md (one-boss principle + invariant test activation)

Acceptance

• Overseer can propose dispatches in voice convo.
• Operator confirms in voice (or via UI button for noisy environments).
• Overseer drafts a dispatch envelope (§13, Model B: only Overseer/standing-order dispatches enveloped); the hub renders the operator-attributed message into the target worker session. Idempotency-keyed; dispatched-only-once invariant prevents double-fire.
• A dispatched event is created, linked via related_event_id to the convo that produced it; action lifecycle (§4) fully tracked.
• Contradiction handling (§14) active: when sources disagree (CI fail vs. worker self-report pass, etc.) the Overseer surfaces the conflict rather than picking one.
• Dispatch UX contract: no auto-navigate to target session; persistent "↓ recent Overseer dispatch" badge on the target session card (TTL DISPATCH_BADGE_TTL_MINUTES); ephemeral source-side confirmation toast/marquee (DISPATCH_TOAST_SECONDS); never dispatches silently.
• One-boss invariant test (Step 2.75: Replay harness v0 + CI gate #24 stub) now activates against real dispatches: worker-facing messages row carries no Overseer attribution; rendered instruction reads operator-from-operator.

Out of scope

• Standing-order autonomy (Stage 2) and open-loop heartbeat autonomy (Stage 3) — post-MVP. All dispatches require per-action operator confirmation.
• Model A (all worker instructions normalized through the envelope) — future uniform-audit pass; MVP is Model B.
• Chrome-button move + per-session retirement (Step 5: Chrome-button move + per-session button retirement #27).

Dependencies

• Blocks: Step 5: Chrome-button move + per-session button retirement #27 (chrome-button move)
• Blocked by: Step 3: Read-only Overseer wired to voice #25 (read-only visibility must be reliable first)
• Part of: Fleet Overseer architecture — umbrella #19

Suggested PR breakdown

2-3 PRs: dispatch envelope schema + writer; voice-confirmation UX; dispatch UX contract (indicators + marquee); contradiction handling; one-boss invariant test activates against real dispatches.

Risks

• The one-boss invariant must be enforced by the schema, not just by convention: the worker-facing renderer accepts only the envelope's rendered_instruction plus operator metadata, with the envelope itself never reachable from the worker-facing API surface. CI test required (ADR-001).
• Voice security defaults need to be tight on day one (contracts §8): voice dispatch opt-in per device, disabled by default on mobile-web/bluetooth, read-back-before-dispatch for risky actions. Easier to loosen later than to tighten after the first accidental-dispatch incident.
• Failure modes to avoid by design: "Yes-man dispatcher", "Very stupid Skynet", "Bullshit cannon".

Implementer note: defer-and-split

This issue is an umbrella covering 2-3 PRs (see suggested breakdown above). Before writing code, file sub-issues here for each PR you intend to open, then close those sub-issues as their PRs merge. This keeps issue-to-PR mapping 1:1 for cleaner upstream-friendly review, and lets the slicing reflect what you discover in the code rather than the architecture-time guess. Reference this issue as Part of: #26 on each sub-issue.