diff --git a/docs/swarm/archetypes.md b/docs/swarm/archetypes.md
index 3b58317f..c9708a6c 100644
--- a/docs/swarm/archetypes.md
+++ b/docs/swarm/archetypes.md
@@ -13,9 +13,9 @@ fields as the form shows them. Nothing records which archetype you picked.
 
 The hyperhive flake ships these:
 
-| archetype  | what it sets                                                                                                                                        |
-| ---------- | --------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `reviewer` | permissions `messaging`, `meta`, `inbox`: the default set without `execution`. It has no shell, so it can't run `hive-forge`, `git` or any command. |
+| archetype  | what it sets                                                                                                                                       |
+| ---------- | -------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `reviewer` | permissions `messaging`, `inbox`, `execution`: the default set without `meta`. With `execution` it can run `hive-forge`, `git` and other commands. |
 
 ## Where an archetype comes from
 
@@ -26,7 +26,7 @@ hyperhiveArchetypes.reviewer = {
   module = { };
   meta = {
     description = "Reviews what it is sent.";
-    permissions = [ "messaging" "meta" "inbox" ];
+    permissions = [ "messaging" "inbox" "execution" ];
     limits = { memory_max = "4G"; };
     inference = { effort = "high"; };
   };
@@ -79,7 +79,7 @@ The stored value:
   "archetypes": {
     "reviewer": {
       "description": "…",
-      "permissions": ["messaging", "meta", "inbox"]
+      "permissions": ["messaging", "inbox", "execution"]
     }
   },
   "refused": { "broken": "limits: …" }
diff --git a/nix/archetypes/default.nix b/nix/archetypes/default.nix
index 718b42b6..fbde8638 100644
--- a/nix/archetypes/default.nix
+++ b/nix/archetypes/default.nix
@@ -9,11 +9,11 @@
   reviewer = {
     module = { };
     meta = {
-      description = "Reviews what it is sent. No shell: it holds the default permissions minus execution, so it cannot run hive-forge, git or any other command.";
+      description = "Reviews pull requests and replies. It can run hive-forge and git (execution), and holds messaging and inbox; it has no get_agent_meta (meta).";
       permissions = [
         "messaging"
-        "meta"
         "inbox"
+        "execution"
       ];
     };
   };
diff --git a/nix/module-eval/builder.nix b/nix/module-eval/builder.nix
index 4249d087..42b2aa87 100644
--- a/nix/module-eval/builder.nix
+++ b/nix/module-eval/builder.nix
@@ -126,7 +126,7 @@ let
       # output and prints it as JSON. A derivation or a path in `meta` would
       # make that evaluation build or copy something; a function would not
       # print at all.
-      name = "the built-in archetypes carry a module and a meta of plain data, and reviewer has no shell";
+      name = "the built-in archetypes carry a module and a meta of plain data, and reviewer can run commands";
       ok =
         let
           plain =
@@ -146,7 +146,9 @@ let
         lib.all (a: a ? module && a.meta.description != "") (lib.attrValues archetypes)
         && plain metas
         && lib.elem "messaging" reviewer
-        && !(lib.elem "execution" reviewer);
+        && lib.elem "inbox" reviewer
+        && lib.elem "execution" reviewer
+        && !(lib.elem "meta" reviewer);
     }
     {
       # The responder denies a client id it does not know, and a NATS denial