decisions: 104, Q101 agreed, the M1 role file as drafted

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/plans/2026-09-26_lead-decisions.md

@@ -2285,3 +2285,38 @@ which stay with him. Each item names who decided it and what happened.
       one, with the same command and the hex guard.
     - Row 83 is closed, and its brief stays as pinned. This decision
       is the record of the cutover install steps.
+104. **Q101 agreed: the M1 role file as drafted (2026-10-12).** Jason,
+    relayed by Mos (sage-0073, recorded in jason-master-restart
+    DECISIONS.md): "Q101: agreed". Q101 asked him to approve
+    `agents/sage/work/next-target/M1-draft.md` as drafted (blob
+    3b32148f, commit a3d17005), with the role named `chief-of-staff` and
+    persona Mos kept. This is the M1 half of what decision 96 left with
+    Jason.
+    - The approved role, `roles/chief-of-staff.json`: tools `read`,
+      `grep`, `find`, `ls`; network `api-only`; authority.withinRole
+      `message.send` only; no crossRole authority; no credentials.
+      Every other action in `packages/business/src/vocabulary.mjs`
+      stays gated, including task.create and role.launch. The contract,
+      `roles/chief-of-staff.md`, says Mos sends Jason's requests to the
+      PM, relays his rulings verbatim, never resolves a decision for
+      him, and never holds or imitates human authority.
+    - The draft's three open questions resolve to its recommendations.
+      The name is as above. Mos has no task.create and asks the PM for
+      work. There is no write tool until I4.
+    - The approval covers a role file that matches the draft. Reviewers
+      check the landed `roles/chief-of-staff.json` against the list
+      above. A file that grants anything more, whether a tool, a network
+      mode, an action or a credential, goes back to Jason before it
+      lands.
+    - The instance (holder `mos`, no launch block) belongs in Jason's
+      business file under the config directory, which the stack never
+      writes. The row ships the role files, tests against a fixture
+      business, and the exact instance entry in its docs. Adding it to
+      the live file is Jason's step, or a step he names.
+    - Timing as planned: on 2026-10-13, after the cutover, the draft
+      moves to `docs/plans/` on `BRIEF-TEMPLATE.md` and gets a queue
+      row. Owner Rocko (row 75 is done), reviewers Darkwing and
+      Filbert, gate Sage. It follows S7 in decision 96's order.
+    - Unchanged: isolation stays PID namespace only under Jason's uid
+      until I1 is ratified and built, and T3 Mos keeps running, since
+      decision 96 needs both M1 and I1 before M3 retires it.