sage: M1 draft role brief and I1 survey dispatch (next-target, waits on Q97)

Co-Authored-By: Claude Opus 5.5 <[email protected]>

agents/sage/work/next-target/M1-draft.md

@@ -0,0 +1,67 @@
+# DRAFT, not approved: M1, a role for Jason's main agent (2026-10-11)
+
+Status: a draft by Sage, lead, for the next-target plan sent to Mos on
+2026-10-11 (mos-0059). Nothing here moves or lands until Jason answers
+Q97 and approves the role file. Once approved, it moves to `docs/plans/`
+on `BRIEF-TEMPLATE.md` and gets a queue row.
+
+## Problem
+
+Q94: "my main agentic session (you) capable of running within the Mosaic
+Stack deployment." Today Mos is a T3 Claude Code thread with full access.
+The stack has five role definitions (`roles/`: pm, cto, coder, reviewer,
+researcher). None of them fits a main agent that talks with Jason, relays
+his rulings and asks the PM for work. A managed session can only hold a
+role a role file declares (`packages/business/src/role.mjs`) and that the
+business file assigns to an instance.
+
+## Proposal
+
+A new role definition. The placeholder name is `chief-of-staff`, with
+persona Mos; Jason names it.
+
+- `roles/chief-of-staff.json`, roleVersion 2:
+  - tools: `read`, `grep`, `find`, `ls`. No write, edit or bash in the
+    first version.
+  - network: `api-only`.
+  - authority.withinRole: `message.send` only.
+  - authority.crossRole: none.
+  - credentials: none at first. Mos reads the board through the bus
+    views, not a Vikunja token.
+  - Everything else in `packages/business/src/vocabulary.mjs` stays
+    gated. That covers task.create, which belongs to the PM, and
+    role.launch. Mos asks the PM for work and raises decisions to Jason.
+- `roles/chief-of-staff.md`, the contract:
+  - Jason's requests go to the PM as messages.
+  - His rulings are relayed verbatim.
+  - Mos never resolves a decision for him.
+  - Mos never holds or imitates human authority.
+- An instance in the business file (`<configDir>/businesses/mosaic-stack.json`,
+  Jason's file), with holder `mos` and no launch block.
+- Tests in `packages/business/tests/`:
+  - The role file loads and resolves.
+  - A business that gives the instance a gated action is refused.
+  - `classify` returns gated for task.create and role.launch.
+
+## What this does not give Mos
+
+This is the gap Jason should see before approving.
+- T3 Mos has full shell, file and MCP access. This role has read tools
+  and the bus.
+- It has no conversation view. Replies arrive in the inbox until M2.
+- Isolation is today's: PID namespace only, same user as Jason, until
+  I2-I5.
+- Widening any of these is a role-file change he approves.
+
+## Open questions for Jason
+
+1. The role's name and whether Mos keeps its persona name.
+2. Whether Mos needs task.create within role, or keeps asking the PM.
+   I recommend asking the PM.
+3. Whether the first version gets any write tool. I recommend none until
+   I4.
+
+## Owner and reviewer (proposed)
+
+Owner Rocko after row 75. Reviewers Darkwing and Filbert. The role file is
+policy, so Jason approves it in addition to the reviews.