Recheck the session after the read so a sign-out dispatches no write.
Take the enabled set and its revision from one plugins read. Let the
owner clear an inactive-only selection when nothing is enabled. Keep
role tools as the hard ceiling in the toolset design, name only
vocabulary tools in the mapping, and intersect mission and task over
the final set.
The org dashboard lists the installed system-type modules with their own
labels and descriptions, marks which are enabled, and gives the owner an
enable or disable control through plugins.set behind the owner fence, with
the revision and the transaction receipt. The project page selects from the
organization's enabled set through project.system-types.set and shows a
disabled selection as inactive, as system-types.console reports. Both routes
go through the per-org Console call path and its admission checks.
docs/plans/2026-11-10_system-type-toolsets-design.md proposes how a launch
turns a project's active system types into toolsets under the role, mission
and task ceilings. Design only; no roles/ or contract change is applied.
Route merge, policy, hire, fire and credential decisions to the human and
keep merge and policy cross-role only. A person-started hire is a decision
record. Restructure the usability table by who acts, list template roles
explicitly, add the arbiter threat row and slice tests.
Roles become templates plus organization copies built from known parts. A hire is a decision the chief raises and a human with org.hire approves. Rails listed with their enforcement points. Proposal only: no change to AGENTS.md, roles/, contracts/ or code.
Two independent reviews (Sol, daybreak-blue) asked for changes.
- An organization's own assistant instance is scoped to that
organization. Only the root assistant, which no union holds, is
cross-organization.
- A root opt-out or project exclude whose name a more specific level
defines is no longer listed as unavailable.
- A malformed root agents.json refuses with "not valid JSON" only; the
parser's text, which can quote the file's bytes, is dropped.
- A refused root or project var names its key, never its value; an id
check's quote of a root value is dropped too. A value can be a secret
typed in the wrong place, and these refusals reach the Console.
- The root assistant's row shows the model the root file sets.
Tests cover each case, with a sentinel value checked absent from the
route body. The design doc records the behavior.
Phase A slice A1, no authority change. Agents are defined at three levels:
the user's root (<configDir>/agents.json), the organization (roles) and the
project (projects.<p>.agents in the organization file). A project's agents
are their union, the most specific level winning.
- organization: agent-levels.mjs loads and checks the root file (no link,
owner uid, no group or other write) and project entries (define, narrow
intersect keys only, exclude), and resolves the union. The organization
file checks project agents for every reader and leaves them out of the
loaded business, so buses see what they saw before. Old-path re-export
in packages/business.
- webui: GET /api/agents/levels, owner only, with no host path, credential
reference or var other than the model in its body. display.js leaves it
unscoped. SERVER_PROJECT_KEYS holds agents.
- Agents grid: the level band, a project picker, and per agent its level,
the file that defines it, memory, status and model, with narrowed keys,
overrides and what the project does not get.
- Design: docs/plans/2026-11-10_agent-levels-design.md. The roles/ change is
a proposal outside this branch.
Member task writes use the person verbs tasks.* instead of the agent task
path. A member's console cap never carries the org's human, and only the
decide handlers and request reads gain a member branch. VERB_RIGHTS pins
every BOARD_VERBS entry. request.write is reserved, decide excludes
credential mints, and the lead-confirm list becomes decided choices.
Applies Jason's three rulings of 2026-11-10. Named rights, role bundles
and per-member grants replace the fixed owner and member split. A member
holds org.view, thread.read and board.read by default. decide and
task.write are grantable. The rights table lands first as slice M1.
Applies the luna review (3 changes) and the sol review (10 changes):
per-role transport table with member reads limited to threads, ownsOrg
over every subject of the owning account, memberGrant adapter, verified
snapshot read after the check, authGen session invalidation, one lock
order, random org incarnation, explicit invite callback exception, a
build stamp that refuses the dev owner in stamped copies, and a rollback
that keeps OIDC. Member board reads and task writes move to slice M8
behind an owner ruling.
Jason approved draft 2 on 2026-11-09 at 22:57Z: "The file looks fine
other than that." The exception is the Montage module name, deferred
since 19:26Z. Amends REQ-ASSIST-1, REQ-USER-1, REQ-TASK-1 and REQ-WEB-3
and adds 17 requirements (101 to 118): REQ-WS-1..8, REQ-AGENT-1..3,
REQ-SYS-1..2, REQ-ACCT-1..2, REQ-SETUP-1..2. requirements.json and the
tasks and bus count pins follow.
Tests: 68 pass, 1 fail. The failure is stack-copy.test.mjs (20/1), which
fails the same way on origin/refactor 483eccb3d: npm's pinned install
can't find node-gyp/bin/node-gyp.js in the test Node installation.
Jason approved the U0 screens on 11-09 with one change: keep the temporary
logo the site already uses. The samples drew the design system's Relay
placeholder; they now draw the WebUI's four-tile mark with the same fills
as processing.css. The direction doc records the approval verbatim, the
deferred Montage name, and the open-question defaults phase U takes.
Unclaimed files left in the canonical checkout. Inventory: canonical-cleanup-inventory.md (commit-as-evidence groups). detect-secrets scan clean on 2026-11-02: hits are sha256 pins, git object ids, test sentinels already in tracked tests and unit-file lines.
Source-candidate: poe d9a564e6d20f5f0fd75ce45b12cbbf8bb4c9d568\nSource-candidate: magica38ba5762b06716db1dee00d0afec162656488f5c\nValidated321whole-file phase plus whole bus1349/model-proxy100/webui490; final gate tooling checks pending, not landed.
A builder's whole-file run list for a row comes from imports, not a text
grep, and goes in the builder's report before the run. Files on the
mos-1592 list stay off unless Mos approved the run. Row 329 round 2's
path grep matched fixture text and reran case1-accept.
Mos approved the P4 brief with upstream API keys added: a human-only write-only verb, z.ai-only allowlist, apikey-invalid and provider-not-allowed refusals, a canary test and an echo mutant. Account ids hash the proxy's own credential identifier, never a token or key value. Account removal stays out of P4.
Jason's Q46 and Q47 (DECISIONS Q250, mos-1606): accounts are entered in the Console's own proxy page and D8's /proxy/ forward to the upstream panel is dropped. The new P4 brief is its own file so the rows doc blob that rows 329 and 331-333 pin stays unchanged. Design D5-D8, D10, D20, migration step 4, J3-J5, the rows table and the Mos rulings list are amended.
jason.woltje