tasks, bus, harness, seat: the approved requirement ids as data (#1584)

Row 90, round 2. Dewey built it, Filbert approved it (comment 28068) on
manifest 95611274 (21 paths, base b8539480). The approved PRD's
requirement ids live in packages/tasks/requirements.json. task_create
refuses an id outside it, and the PM session gets a list_requirements
tool. Round 2 adds requirements.mjs to the sandbox's RUNNER_FILES
(decision 127). Sage gate on c047d028 plus the patch, 23:50:16Z to
23:54:26Z: tasks 89, bus 111, harness 66, webui 101, cli 123, seat 33,
business 60, control-board 124, queue 150, conversation 182, discord 178,
ledger 78, runs 43, mosaic 69, all fail 0. Every scripts/test-*.sh
exited 0.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/bus/src/broker.mjs

@@ -1,4 +1,5 @@
 import { randomUUID, randomBytes } from 'node:crypto';
+import { loadRequirements } from '../../tasks/src/requirements.mjs';
 
 // Kept closed while S1 lands; its vocabulary is the integration authority.
 export const ACTIONS = Object.freeze([
@@ -93,6 +94,7 @@ export class Broker {
   #ended = new Set();
   #secretCheck;
   #credentialStatus;
+  #requirements;
   #clock = 0;
   // credentialStatus is the runtime's metadata-only Credentials.status(); the broker never gets use().
   constructor({ store, businesses, secretCheck = () => {}, credentialStatus = () => [] }) {
@@ -101,6 +103,8 @@ export class Broker {
     this.#store = store;
     this.#secretCheck = secretCheck;
     this.#credentialStatus = credentialStatus;
+    // Row 90 (#1584): the approved PRD's requirement ids. A bad requirements.json refuses here.
+    this.#requirements = loadRequirements();
     for (const table of [
       'events',
       'role_claims',
@@ -894,6 +898,14 @@ export class Broker {
           ),
         };
       }
+      // Row 90 (#1584): the approved PRD's requirement ids, which task.create takes. A read for
+      // every session that can create tasks: task.create is an agent verb, so a human refuses
+      // agent-required here as there, and a reader read-only.
+      case 'requirements': {
+        keys(a, []);
+        this.#agent(s);
+        return this.#requirements;
+      }
       case 'inbox':
       case 'agents':
       case 'tasks':