66 lines
4.3 KiB
Markdown
66 lines
4.3 KiB
Markdown
|
---
|
||
|
|
kind: task
|
||
|
|
slug: agent-channel-membership
|
||
|
|
title: Add agents to workspace channels
|
||
|
|
plan_slug: workspace-communications
|
||
|
|
epic_slug: agent-participation
|
||
|
|
status: ready
|
||
|
|
priority: P1
|
||
|
|
tenant_id: global
|
||
|
|
owner: unassigned
|
||
|
|
cursor_todo_id: null
|
||
|
|
updated_at: "2026-10-22"
|
||
|
|
---
|
||
|
|
|
||
|
|
# Task summary
|
||
|
|
|
||
|
|
Let authorized chat senders mention a saved registry agent to request addition, review any new access, and enqueue only after authorized idempotent confirmation.
|
||
|
|
|
||
|
|
## Description
|
||
|
|
|
||
|
|
Use the single registry's immutable IDs/versions, not fake users or a channel-local registry. Follow the [plan's context/role/mention contract](../Plan-workspace-communications.md). Membership scopes exact channel/context, approved history boundary, invokers, tools and invocation policy. This task owns mention resolution, review/confirmation, membership and enqueueing; execution/delivery are separate.
|
||
|
|
|
||
|
|
An authorized sender can request an eligible active agent by mention. An absent agent cannot join, read history, run or gain tools until confirmation. Review shows version, context, default post-confirmation history boundary (older history only by explicit grant), tools, budget and policy. Confirmer must manage the channel AND hold context delegation authority; `admin`/`owner` is additionally required for new shared/tool grants, with sensitive grants owner-only. A channel owner may confirm an already-approved ordinary agent without tool expansion only within context authority. Workspace role alone never delegates private-object access. Unauthorized requesters get approval-required, not silent escalation; missing installations route to Agents.
|
||
|
|
|
||
|
|
Confirmation revalidates actor/access/lifecycle/version and scope, then atomically stores membership, scoped grant, audit and optional invocation. Bind request keys to channel/context + agent/version + grant revision and dedupe source-message jobs. Stale reviews, denial/dismissal and changed scope grant nothing. Existing authorized membership with a sufficient current grant may enqueue an explicit invocation once without a fresh dialog. Recheck grants before enqueue, claim, tools and delivery; removal stops pending use. Workspace channels can integrate first; object support waits for contextual authorization.
|
||
|
|
|
||
|
|
## Subtasks
|
||
|
|
|
||
|
|
- [ ] Add scoped membership/grant/review contracts and registry-backed eligible mention lookup with no private-draft leakage.
|
||
|
|
- [ ] Add mention-to-add and add/remove UI with safe approval-required, review, confirm, deny and stale-review states.
|
||
|
|
- [ ] Implement transactional confirmation/audit and idempotent enqueue; no membership or job before authority is validated.
|
||
|
|
- [ ] Test private-context denial, role-versus-delegation rules, absent/already-present agents, deny/dismiss, stale version/scope, concurrent confirmation, retries, revocation and reply-loop prevention.
|
||
|
|
|
||
|
|
## Owner or assignee
|
||
|
|
|
||
|
|
`unassigned`
|
||
|
|
|
||
|
|
## Status
|
||
|
|
|
||
|
|
`ready`
|
||
|
|
|
||
|
|
## Estimation
|
||
|
|
|
||
|
|
`M`
|
||
|
|
|
||
|
|
## Acceptance criteria
|
||
|
|
|
||
|
|
- [ ] A sender can mention-to-request; only an approver with channel management AND context delegation authority may confirm scoped access. Required workspace/tool approval roles are enforced server-side.
|
||
|
|
- [ ] Eligible absent agents can be discovered safely for review; existing membership/grants are required for invocation. No private-draft or cross-tenant existence leaks.
|
||
|
|
- [ ] New memberships/expanded grants require confirmation; retry/concurrent confirmation yields one membership/grant and at most one requested job, with audit.
|
||
|
|
- [ ] Private-context access, older history and tools cannot be silently granted; stale/denied reviews grant nothing and revocation stops future use/delivery.
|
||
|
|
- [ ] Mention-only is the default; no agent autonomously reads every channel.
|
||
|
|
- [ ] A valid invocation passes a pinned agent/version and authorized source to the durable job layer exactly once.
|
||
|
|
- [ ] `pnpm lint && pnpm type-check && pnpm test` pass.
|
||
|
|
|
||
|
|
## Dependencies
|
||
|
|
|
||
|
|
- `../Epic-workspace-chat/Task-chat-persistence.md`, `Task-agent-registry-api.md`, `Task-agent-install-lifecycle.md`, and `Task-agent-identities-and-jobs.md`.
|
||
|
|
- Object contexts additionally require `../Epic-workspace-chat/Task-contextual-chat-authorization.md`.
|
||
|
|
- Unified notifications consumes durable outcomes later; it is not required to authorize addition.
|
||
|
|
|
||
|
|
## Links to related Epic / Plan
|
||
|
|
|
||
|
|
- Epic: `./Epic-agent-participation.md`
|
||
|
|
- Plan: `../Plan-workspace-communications.md`
|