stack/agents/sage/work/next-target/M1-draft.md

DRAFT, not approved: M1, a role for Jason's main agent (2026-10-11)

Status: a draft by Sage, lead, for the next-target plan sent to Mos on 2026-10-11 (mos-0059). Nothing here moves or lands until Jason answers Q97 and approves the role file. Once approved, it moves to docs/plans/ on BRIEF-TEMPLATE.md and gets a queue row.

Problem

Q94: "my main agentic session (you) capable of running within the Mosaic Stack deployment." Today Mos is a T3 Claude Code thread with full access. The stack has five role definitions (roles/: pm, cto, coder, reviewer, researcher). None of them fits a main agent that talks with Jason, relays his rulings and asks the PM for work. A managed session can only hold a role a role file declares (packages/business/src/role.mjs) and that the business file assigns to an instance.

Proposal

A new role definition. The placeholder name is chief-of-staff, with persona Mos; Jason names it.

• roles/chief-of-staff.json, roleVersion 2:
  • tools: read, grep, find, ls. No write, edit or bash in the first version.
  • network: api-only.
  • authority.withinRole: message.send only.
  • authority.crossRole: none.
  • credentials: none at first. Mos reads the board through the bus views, not a Vikunja token.
  • Everything else in packages/business/src/vocabulary.mjs stays gated. That covers task.create, which belongs to the PM, and role.launch. Mos asks the PM for work and raises decisions to Jason.
• roles/chief-of-staff.md, the contract:
  • Jason's requests go to the PM as messages.
  • His rulings are relayed verbatim.
  • Mos never resolves a decision for him.
  • Mos never holds or imitates human authority.
• An instance in the business file (<configDir>/businesses/mosaic-stack.json, Jason's file), with holder mos and no launch block.
• Tests in packages/business/tests/:
  • The role file loads and resolves.
  • A business that gives the instance a gated action is refused.
  • classify returns gated for task.create and role.launch.

What this does not give Mos

This is the gap Jason should see before approving.

• T3 Mos has full shell, file and MCP access. This role has read tools and the bus.
• It has no conversation view. Replies arrive in the inbox until M2.
• Isolation is today's: PID namespace only, same user as Jason, until I2-I5.
• Widening any of these is a role-file change he approves.

Open questions for Jason

1. The role's name and whether Mos keeps its persona name.
2. Whether Mos needs task.create within role, or keeps asking the PM. I recommend asking the PM.
3. Whether the first version gets any write tool. I recommend none until I4.

Owner and reviewer (proposed)

Owner Rocko after row 75. Reviewers Darkwing and Filbert. The role file is policy, so Jason approves it in addition to the reviews.