# DRAFT, not approved: M1, a role for Jason's main agent (2026-10-11)

Status: a draft by Sage, lead, for the next-target plan sent to Mos on
2026-10-11 (mos-0059). Nothing here moves or lands until Jason answers
Q97 and approves the role file. Once approved, it moves to `docs/plans/`
on `BRIEF-TEMPLATE.md` and gets a queue row.

## Problem

Q94: "my main agentic session (you) capable of running within the Mosaic
Stack deployment." Today Mos is a T3 Claude Code thread with full access.
The stack has five role definitions (`roles/`: pm, cto, coder, reviewer,
researcher). None of them fits a main agent that talks with Jason, relays
his rulings and asks the PM for work. A managed session can only hold a
role a role file declares (`packages/business/src/role.mjs`) and that the
business file assigns to an instance.

## Proposal

A new role definition. The placeholder name is `chief-of-staff`, with
persona Mos; Jason names it.

- `roles/chief-of-staff.json`, roleVersion 2:
  - tools: `read`, `grep`, `find`, `ls`. No write, edit or bash in the
    first version.
  - network: `api-only`.
  - authority.withinRole: `message.send` only.
  - authority.crossRole: none.
  - credentials: none at first. Mos reads the board through the bus
    views, not a Vikunja token.
  - Everything else in `packages/business/src/vocabulary.mjs` stays
    gated. That covers task.create, which belongs to the PM, and
    role.launch. Mos asks the PM for work and raises decisions to Jason.
- `roles/chief-of-staff.md`, the contract:
  - Jason's requests go to the PM as messages.
  - His rulings are relayed verbatim.
  - Mos never resolves a decision for him.
  - Mos never holds or imitates human authority.
- An instance in the business file (`<configDir>/businesses/mosaic-stack.json`,
  Jason's file), with holder `mos` and no launch block.
- Tests in `packages/business/tests/`:
  - The role file loads and resolves.
  - A business that gives the instance a gated action is refused.
  - `classify` returns gated for task.create and role.launch.

## What this does not give Mos

This is the gap Jason should see before approving.
- T3 Mos has full shell, file and MCP access. This role has read tools
  and the bus.
- It has no conversation view. Replies arrive in the inbox until M2.
- Isolation is today's: PID namespace only, same user as Jason, until
  I2-I5.
- Widening any of these is a role-file change he approves.

## Open questions for Jason

1. The role's name and whether Mos keeps its persona name.
2. Whether Mos needs task.create within role, or keeps asking the PM.
   I recommend asking the PM.
3. Whether the first version gets any write tool. I recommend none until
   I4.

## Owner and reviewer (proposed)

Owner Rocko after row 75. Reviewers Darkwing and Filbert. The role file is
policy, so Jason approves it in addition to the reviews.