[chubes4]

Closes #3892. Docs only.

The pending-action handler docs disagreed with core. This rewrites the datamachine_pending_action_handlers section of development/hooks/core-filters.md and adds a Staging and authorization section to core-system/pending-actions.md. The two are cross-linked, and every claim cites its source file and method.

• can_resolve( $payload, $decision, $user_id, $context ): must return exactly true. $context['resolution_transport'] is set to signed_url only after token verification.
• apply( $apply_input, $payload, $receipt ): callables must accept ≥3 params. Return and failure shapes are documented.
• consume() before mutating. validate() alone allows replay. Receipt binding defaults: operation = kind, target = apply_input, subject = agent ?? creator, workspace from payload.
• PendingActionHelper::stage() arguments, return envelope and failure codes.
• Resolver grants: classification by transport and prefix, operator vs. agent grants, constraint keys. Notes that the CLI resolves as user:<id>, so CLI transport is not an operator identity.
• A complete worked mutating handler, plus pointers to the Stripe Payment Link and Facebook promotion approvals as reference implementations.

Spot-checked against core: the exact-true check, the ≥3-param reflection, array( 'value' => … ) wrapping, consume() → PendingActionStore::consume_authorization_receipt, the resolver-grants filter, stage error codes, resolver prefixes, and legacy *_resolvable flags.

---

Homeboy Cook (agent-task-3693a2e5, Pi / cook-heavy) produced the candidate. Its promotion gate went red inside Cook's sandbox. The same gate passes on the candidate patch applied to clean origin/main, so I (chubes-bot, Claude) reviewed it and finalized the PR by hand, outside Homeboy.

[homeboy-ci]

Homeboy Results — data-machine-business

Review lint

✅ review lint — passed

Deep dive: homeboy review lint data-machine-business --changed-since b679e8d

Artifacts and drill-down

• CI results artifact: homeboy-ci-results-data-machine-business-review-lint-homeboy-__Extra-Chill_homeboy-action-Linux-php8.2-node24 contains immediate command JSON for this action invocation.
• Observation artifact: homeboy-observations-data-machine-business-review-lint-homeboy-__Extra-Chill_homeboy-action-Linux-php8.2-node24 contains exported Homeboy run history for deeper queries.
• Drill-down: download the observation artifact, then run homeboy runs import <dir>, homeboy runs list, and homeboy runs findings <run-id>.
• Artifacts are attached to the workflow run: https://github.com/Extra-Chill/data-machine/actions/runs/41402282152

Tooling versions

• Homeboy CLI: homeboy 0.444.0+5fe8a2c38f67fb535625ca8f23d610463a45f042
• Extension: wordpress from https://github.com/Extra-Chill/homeboy
• Extension revision: 53de8bb
• Action: Extra-Chill/homeboy-action@v2

[homeboy-ci]

Homeboy Results — data-machine-events

Review lint

✅ review lint — passed

Deep dive: homeboy review lint data-machine-events --changed-since b679e8d

Artifacts and drill-down

• CI results artifact: homeboy-ci-results-data-machine-events-review-lint-homeboy-__Extra-Chill_homeboy-action-Linux-php8.2-node24 contains immediate command JSON for this action invocation.
• Observation artifact: homeboy-observations-data-machine-events-review-lint-homeboy-__Extra-Chill_homeboy-action-Linux-php8.2-node24 contains exported Homeboy run history for deeper queries.
• Drill-down: download the observation artifact, then run homeboy runs import <dir>, homeboy runs list, and homeboy runs findings <run-id>.
• Artifacts are attached to the workflow run: https://github.com/Extra-Chill/data-machine/actions/runs/41402282176

Review test

⏳ review test — timed out

• 10 passed

ℹ️ To run specific tests: homeboy review test data-machine-events -- --filter=TestName
ℹ️ Auto-fix lint issues: homeboy review lint data-machine-events --fix
ℹ️ Collect coverage: homeboy review test data-machine-events --coverage
ℹ️ Save test baseline: homeboy review test data-machine-events --baseline
ℹ️ Analyze failures: homeboy review test data-machine-events --analyze
ℹ️ Pass args to test runner: homeboy review test -- [args]
ℹ️ Full options: homeboy self docs commands/test

Timeout triage

• Phase: test; elapsed/budget: 1563s / 1500s
• Selected: unknown; counts: complete: 10 passed, 0 failed, 0 skipped of 10

npm warn install-scripts 4 packages have install scripts not yet covered by allowScripts: npm warn install-scripts @parcel/watcher@2.5.1 (install: node scripts/build-from-source.js) npm warn install-scripts core-js@3.47.0 (postinstall: node -e "try{require('./postinstall')}catch(e){}") npm warn install-scripts core-js-pure@3.47.0 (postinstall: node -e "try{require('./postinstall')}catch(e){}") npm warn install-scripts unrs-resolver@1.11.1 (postinstall: napi-postinstall unrs-r

• CI results artifact: homeboy-ci-results-data-machine-events-review-test-homeboy-__Extra-Chill_homeboy-action-Linux-php8.2-node24
• Observation artifact: homeboy-observations-data-machine-events-review-test-homeboy-__Extra-Chill_homeboy-action-Linux-php8.2-node24
• homeboy review ci triage https://github.com/Extra-Chill/data-machine/pull/3893
• homeboy runs import --from-gh-actions --component data-machine-events --repo Extra-Chill/data-machine --artifact-glob 'homeboy-observations-data-machine-events-review-test-homeboy-__Extra-Chill_homeboy-action-Linux-php8.2-node24' --run-id 41402282176

Deep dive: homeboy review test data-machine-events

Artifacts and drill-down

• CI results artifact: homeboy-ci-results-data-machine-events-review-test-homeboy-__Extra-Chill_homeboy-action-Linux-php8.2-node24 contains immediate command JSON for this action invocation.
• Observation artifact: homeboy-observations-data-machine-events-review-test-homeboy-__Extra-Chill_homeboy-action-Linux-php8.2-node24 contains exported Homeboy run history for deeper queries.
• Drill-down: download the observation artifact, then run homeboy runs import <dir>, homeboy runs list, and homeboy runs findings <run-id>.
• Artifacts are attached to the workflow run: https://github.com/Extra-Chill/data-machine/actions/runs/41402282176

Tooling versions

• Homeboy CLI: homeboy 0.444.0+5fe8a2c38f67fb535625ca8f23d610463a45f042
• Extension: wordpress from https://github.com/Extra-Chill/homeboy
• Extension revision: 53de8bb
• Action: Extra-Chill/homeboy-action@v2

[homeboy-ci]

Homeboy Results — data-machine-socials

Homeboy

No files changed since b679e8d
⚡ Scope: changed files only (since b679e8df2be12d45d7c7f570cbc6ef5a9078b00e)

0 finding(s) across 2 stage(s)

✅ lint

Deep dive: homeboy review lint data-machine-socials --changed-since=b679e8df2be12d45d7c7f570cbc6ef5a9078b00e

✅ test

Deep dive: homeboy review test data-machine-socials --changed-since=b679e8df2be12d45d7c7f570cbc6ef5a9078b00e

Artifacts and drill-down

• CI results artifact: homeboy-ci-results-data-machine-socials-review-lint-review-test-homeboy-__Extra-Chill_homeboy-action-Linux-php8.2-node24 contains immediate command JSON for this action invocation.
• Observation artifact: homeboy-observations-data-machine-socials-review-lint-review-test-homeboy-__Extra-Chill_homeboy-action-Linux-php8.2-node24 contains exported Homeboy run history for deeper queries.
• Drill-down: download the observation artifact, then run homeboy runs import <dir>, homeboy runs list, and homeboy runs findings <run-id>.
• Artifacts are attached to the workflow run: https://github.com/Extra-Chill/data-machine/actions/runs/41402282201

Tooling versions

• Homeboy CLI: homeboy 0.444.0+5fe8a2c38f67fb535625ca8f23d610463a45f042
• Extension: wordpress from https://github.com/Extra-Chill/homeboy
• Extension revision: 53de8bb
• Action: Extra-Chill/homeboy-action@v2