I3282 — A workspace reference resolves to its message where the store holds it, and says 'not held here' where it does not
Resolve a workspace: reference through the one continuity-shaped workspaces capability (I1308) to the stored message, returning resolved, not-held-here or gone-upstream (tombstone), never failing a check because the store is absent.
BLOCKED wave 4 · p2 · implementation profile · parallel safe
Blocked. This issue cannot start until I3281, I1308 are done. The status is derived from that, not declared.
Objective
Resolve a workspace: reference through the one continuity-shaped workspaces capability (I1308) to the stored message, returning resolved, not-held-here or gone-upstream (tombstone), never failing a check because the store is absent.
Why
Drill-back is only useful if the reference opens something, and only safe if a checkout without the store stays green. Critique 2026-10-18: admits_remote admits every Effect::Read beyond loopback and the server can bind non-loopback addresses, so a resolve that returns message text must be local-only by policy, not by deployment. Proposed in ADR 0211 (A record promoted from a workspace cites the message it came from by a typed reference that validates in every checkout and resolves only where the store is held) (proposed; it carries no authority until the owner accepts it). Sources: chatgpt-majordomus:c267#0.
Current state
No workspaces capability exists (I1308 open).
Desired state
Resolution is an operation of I1308's one workspaces capability: a loopback caller gets the three states on CLI, HTTP and MCP from the registry, a caller beyond loopback gets 403 or the reference without text, and doctor counts unresolved references as information.
Scope
- apps/majordomus-cli/src/capability/model.rs
- apps/majordomus-cli/src/http
- apps/majordomus-cli/src/capability/builtin/mod.rs
- apps/majordomus-cli/src/capability/handler.rs
- apps/majordomus-cli/src/mcp/surface.rs
- apps/majordomus-cli/tests/remote_callers.rs
- lib/doctor.sh
Out of scope
- A second workspace capability beside I1308's
Dependencies
- I3281BLOCKED A workspace message is a typed provenance reference that validates in every checkout without the store
- I1308BLOCKED The executable's share is one capability, shaped like continuity
What waits on this
Acceptance criteria
- With the store present a reference returns the message's role, time and text to the local caller
- Without it the answer is not-held-here and every gate stays green
- A tombstoned message answers gone-upstream with the date it was seen last
- Resolution is an operation of I1308's single workspaces capability, not a separate capability
- The resolving read carries a local-only policy that ExecutionPolicy::admits_remote refuses
- A request arriving beyond loopback receives 403 or the reference without role, time or text; a loopback request receives the text
Validation
- cargo test --manifest-path apps/majordomus-cli/Cargo.toml --test remote_callers
- cargo test --manifest-path apps/majordomus-cli/Cargo.toml --lib capability::model
Evidence required
- case_a_workspace_reference_resolves_locally
- test_a_local_only_read_is_refused_beyond_loopback
Evidence
None recorded. Every token above needs a command or an artifact behind it before this issue can be completed; narrative is refused.
Timeline
- started
- —
- verified
- —
- completed
- —
Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.
Canonical record: .ai/repo/project/issues/I3282.yaml. Read it back with majordomus plan show I3282.