docs(decisions): 85, agent teams on Jason's projects, svc out (sage)

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/plans/2026-09-26_lead-decisions.md

@@ -1783,3 +1783,31 @@ which stay with him. Each item names who decided it and what happened.
       screen, so fail-closed holds. It becomes a queue row after the Q14
       hold ends, with a test that a bus refusal keeps queue rows and a
       queue refusal drops them.
+85. **Agents reach Jason's projects through two teams, and svc stays out
+    of them (2026-10-11, Q58a and Q60).** Jason approved, relayed by Mos,
+    full agent access to his projects through team shares. Agents may
+    close, archive and move, and only he deletes tasks or projects.
+    - On tasks.woltje.com, svc-mosaic-stack created `mosaic-agents`
+      (team 1: the pm, cto, coder and reviewer bots) and `mosaic-sync`
+      (team 2: the sync bot), and added jason.woltje to both as team
+      admin. Jason shares team 1 at admin and team 2 at read on his
+      projects.
+    - svc then left both teams. Vikunja makes a team's creator an admin
+      member, so staying would have given svc admin on every project
+      Jason shares with the team. The cost is that membership changes now
+      go through Jason, not through me.
+    - The pm key is now key 7, with projects read_all, read_one and
+      update added. Key 2 is revoked and answers 401. No bot key has
+      delete on tasks or projects or a share route. I confirmed that from
+      the GET /tokens list, not by trying a delete. All keys expire
+      2027-01-07. Evidence: `agents/sage/work/vikunja-setup/2026-10-11_teams.json`
+      (20735a37).
+    - Scopes can't split rename, archive and move, since all three are
+      projects.update. Worker keys can close a task through the API.
+      Jason allowed agents to close (Q60), so only the adapter keeping
+      "pm closes" is accepted for now. Before the bus binds a project
+      the pm can update, the adapter needs a guard against archiving its
+      own bound project. That goes in the multi-project sync row.
+    - Open: projects.create for the pm (asked of Jason via Mos), and Q61
+      (which project the bus watches). Project 32 stays deleted. Jason
+      removed it as a duplicate of #19, and recreate.mjs is gone.