From c175440f0e15bf6841984e2558bfb0cccb84211a Mon Sep 17 00:00:00 2001 From: Jason Woltje Date: Sun, 11 Oct 2026 12:56:59 -0500 Subject: [PATCH] docs(decisions): 85, agent teams on Jason's projects, svc out (sage) Co-Authored-By: Claude Opus 5.5 --- docs/plans/2026-09-26_lead-decisions.md | 28 +++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/docs/plans/2026-09-26_lead-decisions.md b/docs/plans/2026-09-26_lead-decisions.md index 44d56edc0..dcceaf9a4 100644 --- a/docs/plans/2026-09-26_lead-decisions.md +++ b/docs/plans/2026-09-26_lead-decisions.md @@ -1783,3 +1783,31 @@ which stay with him. Each item names who decided it and what happened. screen, so fail-closed holds. It becomes a queue row after the Q14 hold ends, with a test that a bus refusal keeps queue rows and a queue refusal drops them. +85. **Agents reach Jason's projects through two teams, and svc stays out + of them (2026-10-11, Q58a and Q60).** Jason approved, relayed by Mos, + full agent access to his projects through team shares. Agents may + close, archive and move, and only he deletes tasks or projects. + - On tasks.woltje.com, svc-mosaic-stack created `mosaic-agents` + (team 1: the pm, cto, coder and reviewer bots) and `mosaic-sync` + (team 2: the sync bot), and added jason.woltje to both as team + admin. Jason shares team 1 at admin and team 2 at read on his + projects. + - svc then left both teams. Vikunja makes a team's creator an admin + member, so staying would have given svc admin on every project + Jason shares with the team. The cost is that membership changes now + go through Jason, not through me. + - The pm key is now key 7, with projects read_all, read_one and + update added. Key 2 is revoked and answers 401. No bot key has + delete on tasks or projects or a share route. I confirmed that from + the GET /tokens list, not by trying a delete. All keys expire + 2027-01-07. Evidence: `agents/sage/work/vikunja-setup/2026-10-11_teams.json` + (20735a37). + - Scopes can't split rename, archive and move, since all three are + projects.update. Worker keys can close a task through the API. + Jason allowed agents to close (Q60), so only the adapter keeping + "pm closes" is accepted for now. Before the bus binds a project + the pm can update, the adapter needs a guard against archiving its + own bound project. That goes in the multi-project sync row. + - Open: projects.create for the pm (asked of Jason via Mos), and Q61 + (which project the bus watches). Project 32 stays deleted. Jason + removed it as a duplicate of #19, and recreate.mjs is gone.