I3282 — A workspace reference resolves to its message where the store holds it, and says 'not held here' where it does not

✕BLOKOVÁNO vlna 4 · p2 · profil implementation · bezpečné paralelně

Part of a-promoted-record-opens-its-message — Every record promoted from a workspace cites the message it came from, and the UI opens it for the operator who holds it.

Cíl

Resolve a workspace: reference through the one continuity-shaped workspaces capability (I1308) to the stored message, returning resolved, not-held-here or gone-upstream (tombstone), never failing a check because the store is absent.

Proč

Drill-back is only useful if the reference opens something, and only safe if a checkout without the store stays green. Critique 2026-10-18: admits_remote admits every Effect::Read beyond loopback and the server can bind non-loopback addresses, so a resolve that returns message text must be local-only by policy, not by deployment. Proposed in ADR 0211 (A record promoted from a workspace cites the message it came from by a typed reference that validates in every checkout and resolves only where the store is held) (proposed; it carries no authority until the owner accepts it). Sources: chatgpt-majordomus:c267#0.

Aktuální stav

No workspaces capability exists (I1308 open).

Cílový stav

Resolution is an operation of I1308's one workspaces capability: a loopback caller gets the three states on CLI, HTTP and MCP from the registry, a caller beyond loopback gets 403 or the reference without text, and doctor counts unresolved references as information.

Rozsah

• apps/majordomus-cli/src/capability/model.rs
• apps/majordomus-cli/src/http
• apps/majordomus-cli/src/capability/builtin/mod.rs
• apps/majordomus-cli/src/capability/handler.rs
• apps/majordomus-cli/src/mcp/surface.rs
• apps/majordomus-cli/tests/remote_callers.rs
• lib/doctor.sh

Mimo rozsah

• A second workspace capability beside I1308's

Závislosti

• I3281✕BLOCKED A workspace message is a typed provenance reference that validates in every checkout without the store
• I1308✕BLOKOVÁNO Sdílení spustitelného souboru je jedna schopnost, utvářená jako continuity

Co na tom čeká

• I3283✕BLOCKED The UI opens the message a record cites, and the published snapshot shows only the reference

Kritéria přijetí

• With the store present a reference returns the message's role, time and text to the local caller
• Without it the answer is not-held-here and every gate stays green
• A tombstoned message answers gone-upstream with the date it was seen last
• Resolution is an operation of I1308's single workspaces capability, not a separate capability
• The resolving read carries a local-only policy that ExecutionPolicy::admits_remote refuses
• A request arriving beyond loopback receives 403 or the reference without role, time or text; a loopback request receives the text

Validace

• cargo test --manifest-path apps/majordomus-cli/Cargo.toml --test remote_callers
• cargo test --manifest-path apps/majordomus-cli/Cargo.toml --lib capability::model

Požadované důkazy

• case_a_workspace_reference_resolves_locally
• test_a_local_only_read_is_refused_beyond_loopback

Důkazy

Nic nezaznamenáno. Za každým tokenem výše musí stát příkaz nebo artefakt, než lze tento úkol dokončit; vyprávění se odmítá.

Časová osa

zahájeno

—

ověřeno

—

dokončeno

—

Tato tři pole, důkazy výše a stav závislostí jsou vše, z čeho se stav skládá. Neexistuje žádné pole stavu, které by s nimi mohlo být v rozporu.

Canonical record: .ai/repo/project/issues/I3282.yaml. Read it back with majordomus plan show I3282.