Row 287: grant library collaborators with declared scopes

scripts/case2-install.sh

@@ -13,8 +13,8 @@
 # activate, starts no unit, writes no unit file and nothing under /etc, and
 # never writes the library token, which is Jason's step 4.
 #
-# FILE is the business document written for the host from the go. The
-# script adds only roles.bean.vars and roles.chet.vars persona.name and
+# FILE is the business document written for the host from the go. For a library,
+# the script adds chief identity/publish and roles.bean.vars and roles.chet.vars persona.name and
 # persona.sha256, from the staging manifest, and checks the input against
 # the precheck's profile rules first: library needs a library project,
 # bus.tester off and bean and chet as companion roles with no persona var;
@@ -109,6 +109,13 @@ if (profile === "factory") {
 } else {
   if (!library.length) stop("no-library-project", `${input} has no library project`);
   if (tester) stop("bus-tester-on", "the library profile needs bus.tester off");
+  // C2-21: the chief mints its own read grant after install; no token or grant is created here.
+  const chief = Object.values(doc.roles ?? {}).find((r) => r?.definition === "chief-of-staff");
+  if (!chief) stop("chief-missing", "the library profile needs a chief-of-staff instance");
+  const project = projects.books?.kind === "library" ? "books" : library[0];
+  chief.identity ??= { name: "Chief of staff", email: `${id}[email protected]`,
+    gitea: { url: new URL(projects[project].remote).origin, user: `${id}-chief` } };
+  chief.publish = [project];
   for (const instance of ["bean", "chet"]) {
     const role = doc.roles?.[instance];
     if (role?.definition !== "companion") stop("companion-roles", `roles.${instance} must have definition companion`);