morgana: row 193 design r4 (duckworth-0011): project files row and records in the user sentence (B3), message.receive and message.read on the messages row, gated raise settled by FED r4.5 with no guard (N5)

2026-10-20 14:24:16 -05:00
parent 76f4605e19
commit edc794933e
1 changed files with 12 additions and 10 deletions
@@ -1,6 +1,6 @@
 # Row 193 design: many humans per business, human roles, private and shared threads

-Morgana (Opus 5.5), 2026-10-20. Revision 3: duckworth-0008 B1, B2 and N1-N4, sage-1368. Revision 2: sage-1354 (5.7 private from the owner, 193b split) and gizmoduck-0018 (coverage and the R4 predicate in FED r4.1). Gitea #1691, queue row 193, brief `docs/plans/2026-10-20_human-users.md`
+Morgana (Opus 5.5), 2026-10-20. Revision 4: duckworth-0011 B3 and N5. Revision 3: duckworth-0008 B1, B2 and N1-N4, sage-1368. Revision 2: sage-1354 (5.7 private from the owner, 193b split) and gizmoduck-0018 (coverage and the R4 predicate in FED r4.1). Gitea #1691, queue row 193, brief `docs/plans/2026-10-20_human-users.md`
 (blob f7472d1e47b1). Reviewer Duckworth, gate owner Sage. Base: `refactor` at 53bb59462.

 Read for this design: COMMON.md (53bb59462), the brief, Gizmoduck's federation design r4.4 (b67bc6de9 on
@@ -293,22 +293,23 @@ Every read an owner or reader session has, and its side of the line:
 | `thread.list`, `thread.messages`, `thread.open` | own threads only, plus shares to the owner from 193b2 | private: other users' threads never appear |
 | `trail` | events, messages, decisions and deliveries by subject | messages filtered (below); decision rows and their events stay visible |
 | `replies` | messages replying to an id | filtered (below) |
-| `messages` | messages `to_role='human'` | private by construction: a user-thread run can't send to the human (`user-thread-human`, FED 3.6 item 7) |
+| `messages`, `message.receive`, `message.read` | messages `to_role='human'` (broker.mjs:1931-1936, :1953) | private by construction: a user-thread run can't send to the human (`user-thread-human`, FED 3.6 item 7) |
 | `inbox` | open decisions routed to the human | governance, visible |
 | `decisions {list: roles \| recent}` | decision rows with question, options and recommendation | governance, visible |
 | `agents` | role claims and each held role's state | governance, visible |
 | `tasks`, `state` | tracker tasks and launch state | governance, visible |
 | `credentials`, `usage` | credential state, usage records | governance, visible; neither holds message text |
+| `project.files`, `project.file` | project files, including records a run writes with `record.write` (broker.mjs:1395-1407, :1441-1450) | governance, visible |
 | `project.list`, `names` | projects and instance names | business-wide for the owner, visible |

 So a decision a user-thread run raises shows in the owner's `inbox` or `decisions`, with the free text the
-run wrote. That text can quote the user. 5.7 doesn't call it private. The users' help text (R5) and the
-Console's share and thread pages say so: "Decisions your thread's agent raises go to the business owner."
+run wrote, and a record it writes shows in the owner's `project.file`. Either can quote the user. 5.7 doesn't call it private. The users' help text (R5) and the
+Console's share and thread pages say so: "Decisions your thread's agent raises, and records it writes to the project, go to the business owner."

-The gated-raise route. A user-thread run's gated raise routes to the human at broker.mjs:1683, the same
-route the tester guard blocks (`tester-thread-human`). Under option (a) that is intended: the owner answers
-decisions made with the owner's authority. Whether FED adds a guard there is FED 3.6's call, and Duckworth has
-raised it with Gizmoduck. If FED adds one, row 193 follows it and this table changes for `inbox` only.
+The gated-raise route. A user-thread run's uncited gated raise or hard wait routes to the human (broker.mjs:1677-1680).
+FED r4.5 (acd5f1f42, B9) settled this with no guard: the tester guard at :1683 (`tester-thread-human`) is not
+copied, and the decision reaches the owner's inbox and no other (sage-1368, mos-1021, mos-1022). FED R3 tests it.
+Row 193 adds nothing here.

 The message filter. A message is hidden from a session when it is in a thread (`message_threads`) whose owner
 is a `user:<id>` other than the caller, and `#readable(s, t)` is false. Threads owned by the business human or
@@ -403,8 +404,9 @@ Bus, each in `packages/bus/tests/` (193b1: viewer, mixed grants, board reads, th
 - `thread.list` plain shape unchanged. `thread.list {shared: true}` returns only readable threads.
 - Board reads refuse users and viewers.
 - Governance pin (B1, sage-1368): a user-thread run raises a decision; it shows in the owner's
-  `decisions recent` with its question text, and `inbox` lists it when routed to the human, while the
-  user's message bodies stay hidden from the owner's `trail` and `replies`.
+  `decisions recent` with its question text, and `inbox` lists it when routed to the human; the run's
+  `record.write` shows in the owner's `project.file` (B3); the user's message bodies stay hidden from the
+  owner's `trail` and `replies`.
 - `trail`, for the owner, a reader session and the tester (193b1): a user's thread message as `subject`
  fails `message-not-found`; a decision trail that reaches such a message omits it, its deliveries and its
  events. Once the thread is shared with the owner, the owner's trail shows it.