🏛 AGORA — Living App Breakdown

Where the team assembles — one board, everyone on it. The team-shaped app on the Kosmos engine. This doc is LIVING: update it in the same commit as the change it describes. The in-app twin renders at /breakdown from the real config + data.

• Version: config.js → version is the ONE version number (v0.13.0 · 2026-09-10). Shown in the ☰ menu footer; the refresh banner watches the app.js ETag for new deploys.
• Live: https://agora.appolis.app (custom domain live; the agora workers.dev URL stays on as a fallback)
• Run local: node server.js → http://localhost:3901 (open auth; data/db.json is a LOCAL copy of the real team_spartan board — scripts/push-db.js pushes it to production, so pull before you edit). Role gates and 🎫 tier are invisible locally by default — a null actor reads as full admin (lib/api.js:224) — so simulate a real one: AGORA_TIER=basic AGORA_ROLE=contributor AGORA_OWNS=0 node server.js (server.js:34-37). Unset is byte-identical to the old behaviour, which is why the escape hatch costs nothing.
• Test: node test/run.js — 14 zero-dependency harnesses, 365 assertions, green (re-measured 2026-09-10). node test/run.js trash filters to one harness. See §7 for what each covers.
• Deploy: npx wrangler deploy · master password: npx wrangler secret put PASSWORD (data fails CLOSED until set) · 🚦 kill switch: npx wrangler secret put BOARD_OFF = 1 reverts the board to direct KV in ~30 seconds with no deploy · before any rollback, check GET /internal/doc-status?teamId=… (§3c) — mirrorDirty means KV is BEHIND the Durable Object and a rollback would serve a stale board.
• Repo: F:\Claude Code\agora — a full COPY of Kosmos's engine (lib/*, shell) taken at Kosmos v6.40 so the team app can diverge safely (note_649 locked decision #1). Fixes that belong to both engines get applied twice, by hand.

1. What Agora is (and isn't)

The Teams layer's app (Kosmos board 562, design note_649). Kosmos is the SOLO space — one brain per account, hard isolation. Agora is the TEAM space — one shared board per team: every member reads and writes the same KV doc. Same engine, different shape. It is a separate app with its own name and skin (never a mode-flag on Kosmos), portaled from Hermes the way Phantasia portals from Kosmos.

Cross-app movement runs through the 🏛 Appolis hub button (v0.8.2, todo_683) — ONE button in every suite app opening a popup of exactly the apps YOUR Appolis ID opens, fed by GET /api/hub-apps → the ID service's /id/apps. Same-tab navigation, so BACK returns you where you were — the fetch and the tiles are in openAppolisHub(); the 🏛️ button and the ☰ entry render in renderNav()/buildMenu(). The dedicated Kosmos space link was RETIRED here when the hub shipped; dedicated portal buttons survive only inside Kosmos. Do not go looking for a Kosmos link in the ☰ menu — there isn't one.

Product steer (Tyler, 2026-07-16): Agora is a Basecamp-style remake with team-style Kosmos functions — NOT a CRM. Ecommerce-first: the first renditions of Hermes AND Agora are tailored to companies that sell things online; Flip My Life is tenant #1 of the hermes/agora/phantasia stack. Other presets come later. Lane boundary: Hermes owns the customer lane (support, retention, subscriptions, refunds) — Agora never duplicates customer-facing work (Customer Experience section cut on Tyler's reaction, v0.3.0).

Parity doctrine (Tyler, 2026-07-16): Kosmos trains Agora — new Kosmos engine features and fixes get evaluated for porting into Agora (team-shaped) as a standing step of every Kosmos ship. Same in reverse where it makes sense, but Kosmos leads.

No Studio here. The Studio portals from Kosmos/Hermes only (master-admin-only everywhere until Tyler says ready).

2. Identity — Appolis ID from day one

The Kosmos v6.28 pattern, plus four Agora-specific refinements that are all privilege or staleness fixes — a rewrite that follows the bare pattern literally re-opens them.

• APPOLIS_ID service binding + ID_SECRET var (must equal the appolis worker's secret).
• Dual-auth on Agora's own login form: deploy PASSWORD master secret → root (Tyler, master admin) — accepted ONLY when the email field is empty or is root's own email, so member@x.com + the master password can never land someone in the owner's space (worker.js:640). Otherwise the same credentials go to POST /id/check — an Appolis account with an agora (or *) entitlement signs in right here and gets the shared .appolis.app cookie.
• Silent SSO: the appolis_id cookie set by ANY suite app opens Agora via GET /id/resolve.
• 🔐 ROOT mapping requires at role admin. The ID service also hands hub INSIDERS an app:'' grant at role member, so a bare '' test mapped any insider with no Agora record onto Tyler's root account — full master-admin over a real team's board (fixed v0.9.0; worker.js:470-465). tierFromEnts() deliberately keeps the broader '' test: insiders stay exempt from tier stamping without becoming ROOT.
• Accounts provision LAZILY, from THREE paths, all producing the same record so assignment-chip ids stay stable: (1) first entitled sign-in / SSO resolve (provisionFromAppolis), (2) the Appolis Connector door POST /internal/mcp from the signed identity envelope (v0.12.2 — the bare x-appolis-email header stopped being proof; §3c) — with ents passed as undefined, never [], so it cannot clear a tier stamped by a web resolve (worker.js:844), and (3) teamRoster() reading the registry member list, which provisions a local record for every non-disabled member whether or not they have ever opened Agora (worker.js:326-331). An account here = identity + connector tokens + tier + lastTeamId; no board data. ⚠️ Operational consequence: the 👥 Accounts page and GET /api/admin/accounts are not a sign-in log.
• ⏳ A revoked grant lands in ~10 minutes, not 30 days (v0.12.0). Agora's own session token is self-contained — expiry baked in at issue time, no revocation list — so anyone who signed in through Agora's own form kept whatever entitlement they had for the full 30-day cookie. The SSO cookie re-stamps on every request; the local form did not, and the two doors disagreed by a month. Fix: when the appolis_id cookie is present, resolveAccount() resolves THROUGH it and lets the live entitlements win, falling back to the Agora session when the ID is unreachable or says no. Throttled by RESOLVE_EVERY_MS (10 min, per account), so it costs one service-binding round-trip per window, not one per request (worker.js:580-574). The 30-day session length is deliberately NOT shortened — that would force a weekly re-login on everyone. Known limit, not papered over: on the workers.dev host the appolis_id cookie is Domain=.appolis.app, which browsers reject there, so that host never re-resolves. Treat workers.dev as break-glass only.
• Sign-out clears both cookies — suite-wide by design.

3. Teams — the shared board

P1 CONTRACT IS LIVE (Appolis v0.6.0, 2026-07-16): /id/resolve + /id/check carry teams:[{id,name,role}], GET /id/teams?email= covers master/local sessions, and GET /id/teams/:id/members is the member directory — teamsFor() speaks all of it, and prod team_spartan ("Spartan Studios", Tyler = Owner, created with the stub's exact id) adopts the existing board with zero migration; teamsStub flips false on resolve. stubTeams() in worker.js + LOCAL_TEAMS in server.js remain ONLY as offline/local fallbacks (registry unreachable → the shell still walks); the menu chip shows "· offline fallback" only when one is actually in force — it used to say "stub (P1 pending)", a claim about a shipped feature, on every screen. ⚠️ STUB_TEAM_ID = 'team_spartan' in worker.js keeps its historical NAME but the VALUE has been production since 2026-07-16; renaming the constant would be the actual bug.

3a. 🎭 THE MIRROR RULE — a person's AI gets exactly that person's permissions

Tyler, 2026-07-24, now a platform doctrine: "people's AI connections should not be able to mess with other people's stuff unless you give them permission to do so… they should never be able to make any changes on anything that isn't theirs." Agora is the reference implementation.

The board enforces capability (v0.8.14): viewer reads · contributor works only ASSIGNED projects and their completions await approval · editor works anything they can see but NEW adds await a manager · manager/admin anything. Assigned-only projects are invisible to the unassigned. Until v0.9.1 the connector door enforced none of it — a person's AI could read and write what their own screen hid.

• ONE model, both doors. boardCaps(actor) is exported from lib/api.js and imported by lib/mcp.js. The web door's own gates are built from it, so the two doors cannot drift — a rule change lands on both in the same commit. Never re-inline these rules in mcp.js.
• The read half is a CHOKE POINT, not per-tool gates. handleMcp hands every tool a compartmentalized view (perm.viewOf): hidden projects — and their notes, todos and events — are simply not in the arrays. That closes all ten readers, every findProject probe and every error-path candidate dump at once, and any FUTURE tool starts safe instead of leaky. A hidden thing reads as not found, never as forbidden, so there is no existence oracle.
• Writers use ctx.raw. The view's arrays are Object.freezed, so a missed repoint throws loudly instead of silently dropping a teammate's work. Anything that allocates an id, counts for a cap, dedupes, or does an array-level write must use the raw doc.
• Write gates mirror the web door exactly, including the pending flows: an editor's connector adds land pending, and a contributor's connector completion returns awaiting_approval: true rather than lying that the item is done.
• Fail CLOSED. There is no local MCP door, so a missing role is a bug — and the safe answer to a bug is least privilege (contributor, never admin). The worker resolves the REAL role via agoraRoleFor at both connector entrances; the previous placeholder would have demoted every real manager.
• The roster is part of the mirror. A connector that offers a different set of PEOPLE than the person's own 👤 picker breaks the rule just as surely as a missing gate — it hands work to someone the person could not have chosen. One teamRoster() feeds both doors (see §3b).
• /breakdown is compartmentalized too (v0.11.2). The live doc renders REAL board data — projects, stages, sections, note and to-do counts — and until v0.11.2 it loaded the RAW doc: signed-in-gated, but with no capability view, so any viewer or contributor who typed the URL read every assigned-only project their own screen hides. It now applies the SAME perm.viewOf capability view the connector door uses, and AGORA_ROLE is resolved on that path as well as /api/* (worker.js:907). Deliberately not a boss-only gate: the live-doc rule makes the page teammate-facing on purpose. Compartmentalize it, don't hide it.
• Verified by test/test-mirror-rule.js — a role × project-shape matrix (31 assertions): each role against an open-unassigned project, an assigned project, and an assigned-only project it isn't on, proving both what must be blocked and what must keep working for managers. test/test-breakdown-gate.js covers the route above and carries a control leg that renders the RAW board and asserts it STILL leaks, so a green run can never be a fixture that stopped reproducing the bug. Run everything with node test/run.js (§7).

3a-ii. Who may START work (Tyler, 2026-07-24)

"You would only get added to Agora if you were part of a team… a normal user would not be able to add any projects at all. You can only see what projects get added to your board for you to work on that you are a part of. Unless you are one of the owners or managers of the team space."

Project creation is owner/manager only on BOTH doors — it had NO role gate at all before v0.9.1 (a viewer could create projects). Archiving, re-filing between pipelines, and — since v0.12.0 — deleting, restoring and emptying the Trash are all materially creation moves and carry the same gate (§3d). The front-end hides the ＋ New tiles from anyone who can't use them: a button that 403s is its own bug.

Per-stage pipeline locks by role (board 560) remain P3.

Board settings are team-shared and the PATCH is ROLE-GATED (v0.8.15, lib/api.js:738-757): contributors and viewers may write only PER-PERSON keys — currently just hiddenSectionsBy — and only their own entry inside them; house tunables (rateCard, houseTemplates, stagePlaybook, calendarSubs) are editor+. The first per-member pref shipped in v0.8.15: 🙈 hide-any-category drops a section off YOUR dashboard only, via settings.hiddenSectionsBy[you], restorable from the 👁 chip row. A new personal preference added without registering its key in the PERSONAL allow-list will 403 for exactly the contributors and viewers it was written for. Broader per-member layout prefs remain a later refinement.

3b. Assignment (v0.4.0 — who's doing what)

Anyone on a project's board can work it; assignment makes ownership explicit.

Who may assign (v0.9.2, Tyler): deciding who does what is a LEAD's job. Handing work to ANOTHER person — or taking it off them — is owner/manager-only on BOTH doors: to-dos, list items (including the whole-array write that carries assignees), the project crew, and the connector's assign_work + add_todo(assignee). What stays open to everyone: claiming a free task for yourself and putting your own back down — that is working, not delegating. The 👤 picker offers a non-boss exactly those two choices instead of a roster they cannot use. One helper, canAssign(cur, next) inside boardCaps (lib/api.js:262-269), is the whole rule; both doors call it and nothing re-implements it.

• Project crew — project.assignees: [{id,name}], edited from the 👥 Crew row on the project page (chained styled picker: tap a name to add/remove). The ＋ Assign teammates control is manager-only — hidden from a non-boss (public/app.js:1811), refused client-side (public/app.js:199) and refused again on the server (lib/api.js:617).
• To-dos — todo.assignee: {id,name}|null; 👤 toggle on every todo row + an Assignee row in the editor.
• List items — listItems[i].assignee; same 👤 toggle on working-list rows, rollups, and the item editor.
• Assignees are stored denormalized ({id, name}) so rendering never needs a directory lookup; the picker reads GET /api/team/members — REAL since v0.6.0: the Appolis registry's GET /id/teams/<id>/members, with each registry member mapped onto a LOCAL account record (lazily provisioned by appolisId/email — the same record a first sign-in finds/creates, so assignment-chip ids stay stable), disabled IDs excluded from pickers, and the provisioned-accounts roster kept as the stub/offline fallback.
• ONE directory, every door (v0.11.1): that lookup is teamRoster(env, team, stub) (worker.js:313), called by the HTTP picker door AND both connector doors. Until v0.11.1 mcpOpts invented its own list from every provisioned account (Owner if root else Basic), so an AI could assign work to someone disabled in Appolis ID or on another team — the two doors disagreed about who exists. Never re-inline this; a second copy is that bug queued up again.
• 👤 My Work (v0.5.0, #/mine) — the assigned person's plate: every open to-do + list item handed to you, grouped by project, plus the crews you're on. ☰ menu entry with an open-count badge; a member select flips to any teammate's plate (#/mine/<accountId>) so a lead sees who's carrying what.
• Connector assignment (v0.5.0) — the team's AI is a dispatcher too: assign_work (todo or noteId+item → member, or unassign), add_todo(assignee), open_items(assignee) for one person's plate; outputs carry assignee names. The worker passes the roster as ctx.members.

3c. Cross-app + machine doors

Five /internal/* doors, all sharing one transport rule: header x-id-internal, and a 404 (never 401/403) without it — an unauthenticated caller must not learn the door exists. No cookies are involved. But it is not one trust model: the two ops doors (doc-status, doc-reload) accept ID_SECRET only and the header alone is their whole gate; the two READ doors (overview, project-feed) take ID_SECRET as transport but since v0.12.3 prefer a signed identity envelope whenever one is present, honoring the legacy unsigned subject only while INTERNAL_REQUIRE_ENVELOPE is unset (§7); while POST /internal/mcp accepts EITHER APPOLIS_APP_KEY or the legacy ID_SECRET as transport (hubOk()) and then additionally requires the signed identity envelope to say WHO the call acts as — holding the machine secret no longer lets a caller act as anybody there.

The two ops doors are independent of BOARD_OFF on purpose, so the roll-forward runbook still works while the kill switch is flipped. They 501 (not 404) when there is no BOARD_DO binding, and 501 locally.

3d. 🗑 The Trash — deleting a project (v0.12.0)

Agora had no project-delete path at all until v0.12.0. Delete is SOFT: PATCH /api/projects/:id {deleted:true} stamps p.deleted with a server-minted ISO timestamp plus p.deletedBy (lib/api.js:626). The project leaves every door immediately (Layer A) while staying fully restorable for config.trashDays (30), after which it is purged for good along with its notes, to-dos, events and uploaded blobs.

⏱ The clock is the server's, never the caller's — on both doors. A retention window handed to the client is a retention window that can be set to 1970.

🔐 Boss-only on both doors, gated on isBoss — never canWork()/effRole(). effRole is deliberately raisable per project via access.assignments, so gating on it would let a contributor holding manager on ONE project bin the team's work. Web: lib/api.js:622-623 (the 'deleted' in body branch) and lib/api.js:654 (the purge). Connector: delete_project / restore_project (lib/mcp.js:188-216), both first-line ctx.perm.isBoss, both resolving against ctx.raw because viewOf hides deleted projects from every handler — a view lookup could never find one to restore, and a name probe must see projects the caller cannot otherwise see.

Layer A — the seven read filters. A project visible on even ONE door after delete is worse than no feature, because the board and the AI then disagree about what exists.

📌 The key is projectTrash, never trash. db.trash is the deleted-NOTES ring buffer, and schema.nextId() scans it for id allocation — shadowing it breaks id minting board-wide.

🧹 The 30-day sweep runs on the WRITE path only (sweepTrash, lib/api.js:341, hooked onto store.load once for non-GET methods at lib/api.js:380-388 rather than at ~30 call sites). It is not on the read path, and that is not an oversight: a save inside GET /api/db makes N polling teammates race the same purge, every losing writer replays the whole handler under CAS, and 15 losses turn a plain board READ into a 503 storm. The cost of living on the write path is that a board with no writes for a month purges late — and after Layer A a deleted project is already invisible everywhere, so that costs storage and nothing else. The sweep returns immediately on a board with no deleted projects.

📎 Blob collection is deferred to post-commit. purgeProjects() (lib/api.js:306) collects the names of the project's logo, its notes' attachments and its items' screenshots and hands them back; handleApi has no KV access, so it parks them on store.dropBlobs and worker.js deletes them only after the doc write actually committed (worker.js:255, 274-279). Under CAS a rejected save is REPLAYED — deleting a teammate's screenshots for a write that never landed cannot be undone, and no rev check brings bytes back. Doc first, blobs after: a delete-first crash would leave the doc pointing at bytes that are already gone. Same contract the handled-bug media purge already used.

The quiet failures, each closed deliberately:

• 🔥 Forever is only reachable FROM the Trash. DELETE /api/projects/:id 409s if the project is not already soft-deleted (lib/api.js:657), so no path goes live → gone; every delete passes through the restorable window.
• A note restored out of the note-trash refuses to land in a grave (lib/api.js:563): a soft-deleted parent makes the undo visibly do nothing, and a purged one makes an orphan rendering under "🗂 No project" — someone's work silently relabelled as unfiled.
• Creating a project whose id clashes with a deleted one returns 409 {inTrash:true} with a message that says what to do (lib/api.js:672), instead of an "already exists" for something nobody can see.
• A stale ⏳ approval badge cannot act on a buried project — buried() in the approvals route (lib/api.js:837).
• Purging strips the dead ids from playbook.patterns[].seenIn but keeps the insights (lib/api.js:330): a shipped project's retro lesson should outlive its tile, while a purged id in seenIn would permanently inflate "seen in N projects" on the team's accumulated-intelligence surface.

The client (public/app.js:647-712): TRASH_DAYS = 30, viewTrash() at #/trash (☰ menu, boss-only, with a count badge), per-tile days-left and deleted-by, ♻️ Restore and 🔥 Delete forever. deleteProject() counts what goes with it — lists, to-dos, and how many teammates' plates it empties — and puts that number in front of the person BEFORE the confirm, because on a solo app a delete only ever affects the deleter. Undo is wired into the standard wrapUndo stack (public/app.js:4946) as a deleted:false PATCH.

Covered by test/test-trash.js (88 assertions), organised as: A every door hides it · B the write path · C the quiet failures · D the 30-day sweep · E the connector (the mirror rule on a destructive tool) · F the client is wired to all of it.

4. Team-shaped sections (v4 — ecommerce-first, per Tyler's reactions)

Eight online-store pipelines in config.js (colors reuse the engine's stage hues). Cut on Tyler's reactions: Clients & Deals + People (v0.2.0 — not a CRM) and Customer Experience (v0.3.0 — Hermes owns the customer lane). Added v0.3.0: Website Changes, Events, Partners & Affiliates. Split v0.4.0: Campaigns and Content are separate sections — Campaigns ends at Results, Content ends at Approved (Tyler's calls).

Every new project is born a working surface, scaffolded PER SECTION — seedProjectLists() + SECTION_SCAFFOLDS in lib/api.js:21-42, wired into BOTH the API create path (lib/api.js:683) and the connector's create_project (lib/mcp.js:179), so a project made by an AI looks like one made by a person:

Each list carries its scaffold LABEL (bugs, blockers, publish-queue…), and seeding skips any label already present on an unarchived note of that project — so a re-seed or a backfill cannot double up, and the labels are what the connector's report_bug and ai_worklist key off. sectionId is validated: filing a project into a section that does not exist is a 400 (lib/api.js:632), not a project silently stored where no grid can render it. That check shipped bundled with the v0.9.0 Basic cap and was deliberately KEPT when the cap was removed — it is real validation, not a cap.

Each section also carries one virtual EXAMPLE project (v0.8.0) — never a data row. It opens by default while the section is empty, auto-collapses once real projects exist, and is peekable/hideable from the section header (👁) or dismissable from the tile itself (✕, v0.8.4). Tapping it opens a read-only example project page with the pipeline lit at its stage, the scaffold lists filled with believable sample items, and a ＋ Create your own CTA. The eight store-team examples: Q3 Retention Push · Summer Bundle Drop · Back-to-School Email Blitz · September UGC Batch · Warehouse Restock Week · Homepage Hero Refresh · Farmers-Market Pop-Up · Fitness Influencer Collab. Adding a ninth section means adding its scaffold and its example too, or it will feel broken next to the other eight.

New team boards seed store-shaped AREAS (Ideas · To-Dos & Lists · Products · Marketing · Store Ops · Partners · Reference — emptyDb() in lib/schema.js) so the categorizer's fallbacks always land; normalizeAreas() remaps any unknown area id onto ideas on every load, in both doors. Categorizer keyword rules ship EMPTY (content-first rule): each team grows its own vocabulary. The 💰 rate calculator lost its section anchor and menu entry with the Clients & Deals cut (#/calc route remains, unlisted; defaultRateCard is engine ballast).

5. What diverged from the Kosmos engine

• Data keying: per-account (db, db:<acc>) → per-team (db:team:<id>); accounts.js gained teamDbKey/teamAttKey, lost studioTenant.
• Worker: teams context resolved once per request (teamsFor + activeTeam); /api/team switch route; admin account CRUD → 501 (membership lives in Appolis ID; GET roster stays, and it now carries tier — on that projection ONLY, because publicAccount() also feeds /api/login, /api/me and /api/profile and widening it there would put a billing attribute on the login response); /api/share* → 501 (the board IS shared); Studio proxy + /f/ passthrough removed; profile email/password edits point at the Appolis portal. Storage rewritten (v0.10.0): a TeamDoc Durable Object class lives in worker.js; kvStore() is a drop-in {load, save} over it exposing ONE new thing, store.conflicted; runOnBoard() wraps every handler call in CAS replay. Machine doors Kosmos has no analogue for: /internal/overview, /internal/project-feed, /internal/mcp, /internal/doc-status, /internal/doc-reload (§3c). Identity extras: agoraRoleFor() asks the HERMES binding for the person's rank on a business-linked team; tierFromEnts() stamps account.tier on every resolve; teamRoster() is the ONE member directory for the picker door and both connector doors; resolveAccount() re-resolves live entitlements on a throttle (§2). Extra bindings: KOSMOS_HUB (bug-report intake) and HERMES (rank lookup) alongside APPOLIS_ID.
• Front-end: Agora skin (warm plum ground #100e15, gold brand accent, portico icon — calm-mint buttons and coral-gold-for-destructive kept, house rule); team chip + switcher in ☰; share buttons removed; accounts page is a read-only roster; Studio nav/menu entries removed; section presets rekeyed; "Your Agora" bubbles reworded for the shared board.
• Cookie/session names: agora_auth / agora-session-v1 (an Agora session never opens Kosmos and vice versa; the shared appolis_id cookie is the suite-wide door).
• Icon: generated by node scripts/make-icon.js (zero-dep PNG writer) — gold portico on plum, mint ground line.
• Local dev parity (v0.12.0): server.js carries deliberate STUBS for hosted-only routes, because each one is load-bearing for a shipped feature that otherwise looks broken on someone's machine — /api/hub-apps (returns bugReporter:true on purpose: false would hide the 🐛 FAB and look identical to a broken stub), /api/bug-report (validates like the Worker and logs, plus a 40MB media cap the Worker does not have), /api/my-connector (a real message, not "unknown api route" — the popup prints whatever it returns straight at the user), the two pure-read /internal/* doors implemented for real, the two DO-backed ones as 501, and the OAuth discovery 404s (a 200 text/html from the SPA fallback is exactly what makes an MCP client start a flow that does not exist). The local me payload carries agoraRole and id — without agoraRole the client's myRole() falls back to admin so the role-trimmed header and the ⏳ Approvals gate can never be exercised locally; without id, p.access.assignments[DB.me.id] reads an undefined key so "assigned to me" is never true and the whole v0.8.14 assigned-only model is untestable.

Engine files that are STILL portable byte-for-byte: categorize.js, ics.js (bar the 🗑 deleted-project filter), md.js, store.js, auth.js. api.js and mcp.js have DIVERGED structurally and no longer port mechanically — api.js owns the Agora capability model (boardCaps, exported), the item-level op protocol (stampItemIds / resolveItem / applyItemOps), the per-section list scaffolds (SECTION_SCAFFOLDS), the Trash (purgeProjects / sweepTrash), the approvals collection and the role-gated settings PATCH; mcp.js imports boardCaps from it, splits every handler across a frozen db view and ctx.raw, and adds assign_work, delete_project/restore_project and the team-shared SCAN-FIRST instructions. Diff-and-copying a Kosmos api.js/mcp.js fix into Agora would silently drop all of that — reintroducing v0.9.1's connector-has-no-permissions bug and v0.11.0's vanishing-checkmark bug in one commit. lib/breakdown.js was never reskinned at all — it is still the Kosmos-era engine file (see §6).

6. House rules honored

• Living breakdown — this file AND the /breakdown twin update in the same commit as the change they describe. ⚠️ The twin has been in breach since v0.6.1: lib/breakdown.js is still the un-reskinned Kosmos engine file. It tells teammates the store is data/db.json, names sections ("deals … people") that were cut in v0.2.0, renders an empty Clients table and a video-production rate card, and documents /pf/ behaviour the worker no longer has. It is the higher-stakes half of the rule because teammates read it in-app and it is labelled LIVE. (v0.11.2 fixed the disclosure on that route — it now applies boardCaps().viewOf like every other read — but not a word of the content.)
• ONE version in ONE place (config.version) + refresh banner. Features deck (with __VERSION__ token) is born when the shell graduates — not yet.
• Styled inputs everywhere (askPrompt/askConfirm/askChoice twins — no bare prompt/confirm).
• Calm-mint normal buttons; coral/gold strictly destructive.
• A green suite is worth nothing unless the RED leg was seen first. Several harnesses under test/ carry an explicit control leg — the old code path, asserted to STILL fail — so a pass can never be a test that quietly stopped exercising the race or the hole it was written for. Add a concurrency or permission test, add its control leg (test/run.js states this as the house rule the directory exists to enforce).
• Cross-lane changes route via the Kosmos board (flagged todos), never edited from this repo: Hermes portal button → Hermes lane · teams registry + agora entitlement slug → appolis lane. The old "Kosmos→Agora switcher → Kosmos lane" item is superseded by the 🏛 hub button (§1). The lanes actually open: the Frame.io developer token (Tyler, v0.8.18), the "own at most 1 team" cap (appolis lane, v0.9.0 — Agora contains no team-creation code at all), and the Kosmos-side companies strip that consumes /internal/overview.

7. Deploy state & blockers

Everything below must exist for a deploy to work. A rebuild from an incomplete list produces a worker that 500s on every board read (no BOARD_DO), cannot resolve roles (no HERMES) and cannot forward bug reports (no KOSMOS_HUB).

What node test/run.js actually covers. Each harness prints its own tally and exits non-zero on failure, so it stays runnable alone (node test/test-trash.js) while you work on one thing.

8. Changelog

• (2026-08-20, no version bump — 🔑 ID_SECRET moves OUT of vars to a Wrangler secret, at the SAME value. Config only; no code changed, so nothing a person or another app can observe is different. Same precedent as the 08-18 entry below.)

WHY AGORA SPECIFICALLY, and why it was worth a window: after Kosmos's copy moved earlier the same day, agora was the last config that was both git-tracked and carrying the plaintext. Appolis keeps its copy deliberately (the weekly session's refusal checks grep that file specifically — verified, its scheduled task cds into the appolis repo before reading); hermes and phantasia gitignore their configs so theirs are disk-only; AWS has no vars block at all. So this closes the last one with no reason to be there.

⚠️ WHAT IT DOES AND DOES NOT BUY. It stops future re-exposure — a git-tracked vars value lands in commit history permanently, and wrangler deploy echoes every var into the terminal. It does NOT undo past exposure: the value is still in this repo's history and remains burned. Real retirement is runbook Step 2 (delete it once every room carries its own APPOLIS_APP_KEY).

THE ORDER, because the runbook's original one is impossible: Cloudflare refuses wrangler secret put while the name is still a plaintext vars binding ("Binding name already in use" [code: 10053]), so the var must be stripped and deployed first — which is what opens a fail-closed window. Chained deploy && secret put in one command, so the window measured two seconds (15:54:35 → 15:54:37). Opened only after a 90-second wrangler tail agora showed zero events — idleness measured, not assumed from the clock.

⚠️ THE PRECONDITION THAT ACTUALLY GATED THIS. Agora's last deploy (2026-08-19T02:32:39Z) sits between its two most recent commits (916a308 02:11:45Z, 8bddde2 02:37:57Z), both worker.js-only and therefore not observable from outside — so "is HEAD deployed?" could not be answered by probing, and a config-only deploy ships whatever is in the tree. Tyler confirmed HEAD was live before this ran. Do not repeat this move on another repo without answering that question first — the deploy is not optional, so an unverified tree means shipping someone else's work.

VERIFIED AFTER, and the distinction matters: wrangler secret list shows ID_SECRET alongside APPOLIS_APP_KEY + PASSWORD; agora.appolis.app 200. Those prove present, not correct — a typo is the one failure this move can introduce, and agora's login door hides it (a wrong secret and a wrong password both end at 401). The proof is the connector: appolis's hub sends 'x-id-internal': env.ID_SECRET || appKey and appolis's own copy is still set, so it always sends the shared value and never falls through to the app key; agora's hubOk() admits APPOLIS_APP_KEY or ID_SECRET, and those are different credentials. A post-cutover agora_overview returning the real board (16 projects across 8 sections) therefore means the newly-stored secret matched byte-for-byte at the transport gate.

• (2026-08-18, no version bump — two invisible support changes driven by the Appolis lane; nothing user-facing changed here, which is exactly why the version stayed put.) Both land in worker.js and both are documented in full in appolis/APP_BREAKDOWN.md (v0.9.0 and v0.9.1) and Kosmos note_1689.

① appolisResolve() no longer pre-verifies the shared SSO cookie locally. It used to call acct.verifySession(idToken, env.ID_SECRET) as a "cheap reject" and hard-return null before ever calling /id/resolve. That made Agora a second, silent authority on a signature only Appolis is entitled to judge — and it pinned the entire suite to one key: the moment Appolis signed sessions with its own ID_SESSION_KEY, every valid cookie would have failed here and SSO would have died without the request ever reaching /id/resolve, so the route would appear in no log and the cause would look like anything but a key change. Removed and deployed before Appolis flipped its key — the only order that works. Behaviour is unchanged by construction: a bad token used to be rejected locally, now /id/resolve rejects it; the cost is one subrequest for an invalid cookie. This is what unblocked the suite's biggest security fix — ID_SECRET had been the HMAC key signing every appolis_id cookie, and this file's own v0.12.3 entry already said "ID_SECRET is not a trust boundary". It no longer signs identity at all.

② /api/my-connector now forwards the person's own signed cookie. That route returns a credential, not information: the amt_ connector token acts fully as the person across every app they are licensed for, needs no header of its own, and no key rotation invalidates it (Appolis rotated its session key and those tokens were untouched). Agora now sends x-id-token alongside the existing ?email=, so Appolis can name the subject from proof. Appolis prefers the token when present and echoes proven: true. The email stays until Appolis's phase C, because a local (non-SSO) session carries no such cookie — that edge case is the reason C has not shipped.

⚠️ Still open on this board: worker.js:316 still sends the bare legacy secret to /id/teams/:id/members, and APP_CAPS.agora has teams: false, so that call is unauthorised-by-capability and Agora silently falls back to its stub roster with nothing logged. See todo_1692 — and verify the fix by opening a real assignee picker in a browser, because this caller swallows its own failures.

• v0.13.0 (2026-09-10) — 🚫 NO SCROLLBARS — the bar is hidden, the scrolling never is (cmp_4739e5e09f, template appolis v0.35.0). Tyler, 2026-09-10: "Get rid of any and all simple scroll bars, vertical or horizontal. If you do not know that you can scroll. or swipe in today's day and age then you shouldn't even be on the app to begin with. They're unnecessary and take up space and cause spacing problems sometimes." Appolis built the template first (no app had it), Agora is the second room to carry it. ONE SHARED PLACE, THREE ENGINES: public/style.css gains {scrollbar-width:none;-ms-overflow-style:none} and ::-webkit-scrollbar{width:0;height:0;display:none} — the standards property, the WebKit pseudo-element and the legacy Edge property, because any two leave a bar on the third's engine — and LOSES html{scrollbar-color:#3a2f52 var(--bg)}, a colour for a bar that no longer exists (an old rule left to fight the new one by specificity is a regression waiting for one edit). features.html links no stylesheet and /breakdown is assembled in lib/breakdown.js, so both carry the identical block inline with a comment naming the shared place: every served page either links the shared sheet or carries the block itself. ⚠️ THE INVARIANT: the cheap fake is turning an overflow to hidden — that removes CONTENT, not chrome. Nothing was traded: .menupop, .iconpick, .stageswitch, .stepper, .modal, the app.js roster lists and the breakdown tables all still scroll, and html.menulock,body.menulock{overflow:hidden} — the derived overlay lock cmp_8c8134e18f requires — is untouched. 🧪 test/test-no-scrollbars.js (the 14th harness, 8 assertions summed by test/run.js), written before the change and PROVEN TO FAIL on the old tree (A1, A2 naming features.html, A2b naming breakdown.js, A7 naming the colour rule), pins: the shared sheet covers every engine · every served page and every code-assembled page is covered · the named scroll containers still say auto · the space-reserving property appears nowhere · the overlay lock survives · all five version strings agree · no older custom bar remains. → 365 passed, 0 failed across 14 harnesses. ✅ VERIFIED LIVE after deploy: served /style.css carries both rules · /features and /breakdown carry the block · the ☰ menu footer reads v0.13.0 · measured in the pane on a pointer viewport, a scrollable element's bar went from 15px to 0px on both axes while still scrolling both ways.
• v0.12.4 (2026-08-17) — 🧪 The v0.12.3 test harness could not fail, so an adversarial review broke it four ways and it stayed green. v0.12.3 was committed but never deployed; this is what a pre-deploy review found, and it is the more useful release of the two. The finding. test-internal-doors.js was the only evidence offered that the three guards worked, and it never executed worker.js. Every assertion was a regex over the file's TEXT or a hand-written re-implementation declared inside the test itself. Its three legs labelled RED CONTROL — the thing the house rule says makes a green trustworthy — were tautologies: const oldResolve = (params) => params.key || … then asserting it returns params.key proves nothing about the shipped code. The reviewer mutated the worker and the harness reported 43/43 green while: the method guard was wrapped in an env flag; the raw ?key= read was restored using double quotes (the grep only matched the single-quoted form); the guard was moved to AFTER idFromName with a comment containing the text status: 405 left in its place, which satisfied the assertion literally named "ordering, not just presence" because it compared source-text indices; and the teamId pattern was replaced with /^.{1,4096}$/ while the real pattern stayed in a nearby comment — the harness built its own copy of the regex from a hand-typed literal rather than the reMatch it had just captured, so all six "REJECTS …" assertions stayed green. The rewrite. The harness now boots the real code. worker.js is imported and its exported fetch() is invoked against a fake env whose BOARD_DO.idFromName records every name it is handed — which is the exact thing the ?key= oracle abused and the exact thing no source-grep can see. The dev server is spawned as a real child process and probed over real HTTP. Proven by mutation, not by assertion count: deleting the method guard → 4 failures; restoring the raw ?key= → 3; moving the guard after idFromName → 1 (the recorded idNames is not empty); relaxing the pattern → 10; reverting listen(PORT, HOST) to listen(PORT) → 1; swapping the local gate back behind the method check → 1; dropping the new project-feed bound → 4. One mutation still slips through and it is named here rather than hidden: wrapping a guard in if (env.SOME_FLAG !== '0') is inert under the test env, so behaviour is unchanged and no behavioural test can see it. That is a backdoor, not a regression, and it is a different problem from the one this harness exists to solve. The bind test needed a real network. Every probe to 127.0.0.1 succeeds whether the server bound loopback or 0.0.0.0, so reverting the bind was invisible — the first rewrite still passed it. It now connects to the machine's own non-loopback IPv4 from os.networkInterfaces() and asserts the connection is REFUSED when loopback-bound and ACCEPTED under HOST=0.0.0.0, which is the only way to tell the two apart. On a machine with no non-loopback interface it fails loudly rather than skipping quietly. Three real code fixes came out of the same review. ① /internal/project-feed took an unvalidated, unbounded teamId to BOARD_DO.idFromName via kvStore() — v0.12.3 bounded the narrow ops door and left the wider read door raw, twenty lines apart. idFromName accepts anything and TeamDoc._adopt() does a durable storage.put on first touch, so every unique string an attacker sent permanently allocated a Durable Object; it was reachable by any signed-in Kosmos account, because that side forwards ?teamId= verbatim. Storage pollution rather than disclosure, so LOW — but it was the last caller-supplied idFromName input in the worker, every other call site passing a server-resolved id. The pattern is now one shared TEAM_ID_RE constant referenced by both doors, because two copies is precisely how they drifted. ② EXPOSED treated IPv6 loopback ::1 as exposed, so HOST=::1 printed a false "reachable off this machine" warning and closed the internal reads while actually private. ③ The local gate ran AFTER the method check, so an ungated caller got a 405 and learned the route exists — §3c's own rule is 404 and never a hint. Also: nine worker.js:NNN citations in this doc were re-anchored (v0.12.3 added ~70 lines and moved six of them; two more had been pointing at a bare } since before this release), and test-one-write-channel.js learned to strip export const — v0.12.3's shared constant crashed it, which the full suite caught and a single-harness run would not have. 357 green across 13 harnesses. The review also dismissed 11 findings after verification, including three separate reports that the local 405-before-gate ordering was an information leak — dismissed on impact, fixed anyway because it cost one line.

• v0.12.3 (2026-08-17) — 🔒 **THE REST OF todo_1096: the /internal/ machine doors. v0.12.2 closed the impersonation hole on /internal/mcp and left three findings from the same 2026-07-26 audit open. All three are closed here, and they share one premise worth stating plainly: ID_SECRET is not a trust boundary. It is the HMAC signing key for every appolis_id SSO cookie, and its value sits in the git history of three repos (appolis, kosmos, agora) — ROTATION_RUNBOOK says so in as many words. Every door below was gated on "presents the shared secret" and treated that as "is a trusted caller naming a truthful subject". ① The local dev server was serving a real board to the network. server.js returns LOCAL_ROOT for every request whenever PASSWORD is unset — deliberate, frictionless, and completely unauthenticated — and data/db.json is a real copy of a real board (scripts/push-db.js pushes it to production). The only thing between the two was the bind, and server.listen(PORT) with no host binds 0.0.0.0*: on any shared office, hotel or cafe network that open board was readable and writable by anyone who could route to the port. No Worker hardening ever touched this, because it is not the Worker. Now HOST defaults to 127.0.0.1, binding outward is a deliberate opt-in, and the startup line says so loudly when it happens. Same file, same class: /internal/overview and /internal/project-feed were implemented locally in v0.12.0 (so their payload shape stays testable off the hosted door) with no gate whatsoever — not even the machine secret production requires. They now mirror production when ID_SECRET is set, and when it is not they are served only while loopback-bound — so local testing keeps the doors v0.12.0 added, while binding outward closes them rather than exposing the board. Both are GET-only. ② /internal/doc-reload had no method guard, so a GET performed the reload. It is a mutation: it makes a warm TeamDoc drop its copy and re-adopt from KV. Without a verb check, a link, a browser prefetch, or a pasted address bar could fire an ops mutation against the live board — the entire attack is visiting a URL. doc-reload is POST-only now (which is what the runbook in scripts/push-db.js always used anyway), doc-status stays GET, and the guard lands before idFromName rather than merely existing. ③ The same block took a caller-supplied ?key= straight to BOARD_DO.idFromName. ?key=accounts confirmed that key existed and handed back its bytes and updatedAt through /doc-status — an existence-and-size oracle over the whole namespace, and a way to poke any Durable Object by name. The key is now derived from teamId through acct.teamDbKey(), with teamId validated against ^team_[A-Za-z0-9_-]{1,64}$ (bounded on purpose: idFromName will happily accept a 200-character string). Nothing legitimate loses a door — the documented runbook and APP_BREAKDOWN §3c have only ever used ?teamId=. ④ The two READ doors now prefer a SIGNED subject — staged, not flipped. /internal/overview named a person from an unsigned ?email=; /internal/project-feed carried no person identity at all and would read any team's project dues for anyone holding the secret. Both now resolve appolisIdentity(request, env, 'agora'): on overview a signed envelope overrides ?email= rather than merely agreeing with it, and on project-feed a signed caller must be a member of the teamId they ask about — membership taken from the envelope Appolis signs, never from anything the caller asserts. Deliberately not yet mandatory, and this is the honest part: the only caller of either door today is Kosmos (mission-control/worker.js, the your-companies strip and the linked-project feed), it sends ?email= alone, and it cannot mint an envelope — only Appolis ID holds this app's key. Making the envelope mandatory unilaterally would have broken a live cross-app surface, which is exactly the failure mode the carry-over rule was written after. So the legacy path stays until the callers move, behind one new secret: INTERNAL_REQUIRE_ENVELOPE=1 makes both doors envelope-only, in seconds, with no deploy — the same self-flipping shape as the APPOLIS_APP_KEY cutover, and the Agora half of ROTATION_RUNBOOK Step 4. Until that flip, ① ② and ③ are closed and ④ is prepared, not closed — the doc says so rather than letting a changelog imply otherwise. Tests: a new 13th harness, test-internal-doors.js, 43 assertions. ⚠️ CORRECTED IN v0.12.4 — that harness did not do what this sentence originally claimed. It asserted regexes over worker.js's text and re-declared each guard as a local copy inside the test, so its "RED control legs" were hand-typed literals that read nothing from the source and could never go red. An adversarial review mutated the shipped worker four ways and it reported 43/43 green every time. The rewrite, and the mutation testing that proves it now fails, are in v0.12.4. Verified by reproduction rather than by grep: the dev server was booted three ways and probed eight times — netstat confirms 127.0.0.1 on the scratch port used for that probe (3921; the app's own default is 3901) where it used to be 0.0.0.0; loopback with no secret still serves the internal reads (200); POST to one is 405; with ID_SECRET set the right header is 200 and a wrong or missing one is 404; and bound to 0.0.0.0 with no secret the doors are 404 while the app itself still serves 200.

• v0.12.2 (2026-08-06) — 🚧 THE CHECK-BEFORE-WORK ECHO ON WRITES — the board tells a writer what it may be about to trample. Ported from Kosmos (which has had it since v7.11), because Agora had NO mechanical backstop against concurrent sessions — only the instructions string asking nicely. runOnBoard's CAS stops two writers RACING, but it cannot stop an informed-looking write from a session that simply never read what a teammate did an hour ago: that is an ordinary sequential write, and no conflict check can catch it. A shared team board is exactly where that costs most, so a landed connector write whose target project saw cowork/stage activity in the last 72h now carries a concurrent_activity block naming up to 3 of those events — {when, who, what} plus the CHECK-BEFORE-WORK rule text — with the project resolved from the write's own result (projectId/id) or its project argument (a quiet project, or a write that resolves no project, gets no block — silence means nobody was there, not that the guard is off). It lives on the dirty-save path inside handleMcp, so BOTH doors get it at once (/mcp/<token> and the Appolis Connector room stay one brain via mcpOpts, per §3), and it is advisory by construction: the whole echo is wrapped so it can never fail a write that already landed, and image results are left alone. Took the bug fix with it: Kosmos's version filtered on e.ts — but only log_work writes a ts; every stage event carries date alone, so that branch was DEAD CODE and the guard silently reported nothing for any session that had not hand-logged (Kosmos's live board as measured on port day: 36 stage events, 0 with a ts). Agora accepts either field, so it does not inherit the blind spot on day one. Suite unchanged: 309 green across 12 harnesses. Also in this release window, committed as-found: the /internal/mcp signed identity envelope hardening (todo_1060/todo_1096, authored by the 2026-07-26 suite-audit session, deployed and verified live before committing — an impersonation POST with the bare header now 403s with "a signed Appolis identity envelope is required"). The suite hub used to forward a person as a bare x-appolis-email header and this worker took it as proof, so anyone holding the shared machine secret could act as ANYBODY on their team's board, with no connector token and no hub involved. Identity on that door is now a short-lived HMAC envelope (x-appolis-id, keyed to THIS app, audience-checked, carrying the person's entitlement role/type and real team memberships — which also frees the door from the stub roster); hubOk() is transport trust only and never says WHO a call acts as; and the cutover self-flips on APPOLIS_APP_KEY — the bare header is honored while it is unset and dead the moment it is set (it is set in prod). §§2, 3 and 3c stopped describing the bare-header trust this closed; NOT fixed by this and still open as todo_1096: /internal/overview, which identifies its subject from an unsigned ?email=, and /internal/project-feed, which carries no person identity at all — a pure machine-secret door, arguably the wider hole. Ritual note, on the record: this entry was written 2026-08-13 by the weekly session — v0.12.2 shipped WITHOUT it and the changelog lagged the shipped release by a week, caught by weekly check #2 (the check that exists because Kosmos once shipped two releases without bumping its badge; here the badge was right and the changelog lied). Honesty compels the fuller record: the same-commit ritual had already been bent once before — v0.12.0's bump (fcb7134) carried no §8 entry either; its entry arrived 28 minutes later in the v0.12.1 commit. This was the first time the gap was days rather than minutes, which is the difference between a ritual bent and a doc that lies. Same slip, fixed in the same late commit: config.js versionDate still said 2026-07-26, so the ☰ menu and /breakdown header showed "v0.12.2 · 2026-07-26" for a release that shipped 08-06.

• v0.12.1 (2026-07-26) — 🔍 Three holes, all found by fact-checking the docs against the code. §§1-7 and the /breakdown twin were rewritten against the source this release; then two adversarial readers were pointed at the rewrites with one instruction — go read the code and confirm every sentence. What came back was not a list of typos. Writing down what an app does turns out to be a very good way to discover that it does something else. ① /ics never compartmentalized at all. Same class as the /breakdown hole closed in v0.11.2, on the door nobody looks at: read-only, token-authed, and loading the RAW board. A contributor's calendar feed carried dues and events from assigned-only projects their own screen hides — and a calendar subscription refreshes on its own schedule with no in-app affordance, so there was nothing to notice and no way to notice it. It now resolves the real agoraRole (failing CLOSED to contributor) and renders through the same viewOf as every other read. Both verifiers found this independently, from different starting points. ② viewOf's zero-copy fast path was skipping the Trash. It returned the raw doc for any boss on a non-frozen call, which was exactly right while visibility was the only thing this filtered — a boss sees every project anyway. v0.12.0 quietly made it also the place a deleted project is hidden, and /breakdown calls viewOf(db, {}), so a manager's live doc still listed the entire Trash. A correct optimization became a leak the moment the function grew a second job. The fast path now fires only when there is nothing deleted to hide, so the zero-copy case survives for the board that has never deleted anything. ③ Four write routes had never met the capability model. POST/DELETE /api/events, POST /api/playbook/insights, POST/PATCH /api/clients and POST /api/import/notes predate v0.8.14 and were never brought in, so a viewer — read-only by definition — could write to the team calendar, author the team's playbook, add clients, and bulk-import notes onto the shared board. The bulk-import one is the widest, because it writes N notes per call. All four now use the same canWork/cap gates every other write already uses, so there is one rule rather than five. Writing the gate exposed a fourth bug on the spot: denyWork was never destructured out of boardCaps, so the new events gate would have thrown a ReferenceError — a 500 on a live route — the first time a non-boss touched it. The test caught it before the deploy did. Also: the last live copy of the Kosmos section id (sectionFor() defaulting to 'apps') is gone — harmless today because the fallback landed on Initiatives anyway, but it is the function that decides stall stamping, and a silent wrong default in a stall path is the kind of thing discovered a quarter later. The /breakdown twin now filters null rows at the source arrays rather than sprinkling p && downstream (which is how one call site was still throwing on a corrupt doc), and the worker finally passes it the viewer argument it has always accepted — so the page says "you are signed in as X — capability editor" instead of describing capabilities in the abstract. The features deck moved from assets/ to public/, because assets/ is not the directory the deployed Worker serves and the deck was therefore unreachable in production. 33 new assertions, including a control leg that renders the raw ICS feed and asserts it still leaks. 309 green across 12 harnesses.

• v0.12.0 (2026-07-26) — 🗑 DELETE PROJECTS + A 30-DAY TRASH, plus the v6.99 port and the four cleanups. Built in three layers, each safe to ship alone. Layer A — every door learns to hide it, and lands first. Seven reads filter p.deleted: viewOf (the connector choke point, which closes all ten readers and every future tool in one line), both branches of GET /api/db, /internal/overview, /internal/project-feed, the ICS feed, /breakdown, and local /pf/. A project still visible on even one door is worse than no feature, because then the board and the AI disagree about what exists. Two things fell out of this. Bosses used to take a raw-doc shortcut through GET /api/db — they can't any more, because they are exactly the people who can delete. And the same rewrite closed a pre-existing leak: the note-trash shipped unfiltered, so deleted notes from assigned-only projects reached people who cannot see those projects. Invisible only because nothing rendered DB.trash; the moment Trash became a surface it would have been a real disclosure. The response key is projectTrash, never trash. db.trash is already the deleted-NOTES ring buffer, it is filtered by projectId, and schema.nextId() scans it for id allocation. Kosmos reused trash for deleted projects and silently shadowed all three — it never noticed, because its client never reads DB.trash. Layer B — the write path. Delete is gated on isBoss, never effRole: that is deliberately raisable per project, so a contributor holding manager on ONE project could otherwise bin the team's work. The timestamp is minted server-side — Kosmos writes the client's value straight through, which hands a 30-day retention window to whoever's browser fired the request (a skewed clock, a stale tab, or a hand-crafted deleted:'1970-01-01' purges on the next sweep; a non-ISO value makes Date.parse NaN and the project sits in Trash forever). DELETE /api/projects/:id is the hard purge and requires p.deleted already set, so no path goes live → gone. It cascades notes/todos/events, drops note-trash rows for the same project, and scrubs the dead ids from playbook seenIn while keeping the accumulated insights — a shipped project's retro lesson should outlive its tile. Blobs are collected, never deleted inline: under CAS a rejected save is replayed, and deleting a teammate's screenshots for a write that never landed cannot be undone, so the purge hands the names back on the store and the worker drops them after the doc write commits. The 30-day sweep rides the WRITE path. Not GET /api/db: a save inside a read makes N polling teammates race the same purge, each losing writer replays the whole handler, and 15 losses turn a plain board read into a 503. The cost of that choice is that a board with no writes for a month purges late — which, after Layer A, costs storage and nothing else. Hooked on load once rather than at thirty call sites, because "mostly swept" is the kind of half-truth that becomes a support question nobody can reproduce. Also fixed in the write path, each its own quiet bug: restoring a note into a deleted project (an undo that visibly does nothing) or a purged one (an orphan silently relabelled "🗂 No project"); the bare 409 on a name a deleted project still holds, which now names the Trash; and approvals acting on a buried project from a stale ⏳ badge. Layer C — the surfaces. delete_project / restore_project on the connector, gated isBoss as their first line — gating on canWork would let an editor's AI bin a project its person cannot bin on screen, which is the mirror rule broken in the most expensive direction available. restore_project reads ctx.raw, because after Layer A a deleted project is by definition absent from every handler's db. No hard-purge tool exists: forever stays a deliberate human two-step. The client gets 🗑 inside the amBoss() tier, a boss-only Trash view with days-left, Ctrl+Z support, an inline Undo toast — and a confirm that counts what it takes off teammates' plates and says they will not be notified, because Kosmos is solo and deleting there only ever affects the deleter. 🧹 The v6.99 Kosmos bundle, all four present here and all four worse on a shared board for one reason: Agora's 45s poll re-renders on any teammate's write, so each fired unprovoked while you were merely reading. Scroll restore (the worst — a teammate ticking a box 40 lines up threw you to the top of a long board), collapsed-panel width, clear-search-on-hashchange, hide-undo-on-login. Took only the four collapsed-width lines from Kosmos's fitPGrids: its 589#48 user-sized-panel branch depends on data-hset and .gsized CSS Agora does not have, and dragging it in would silently break every panel's height. Agora-only addition beyond the bundle: showLogin() also clears the undo stack — reverts here are inverse ops against a SHARED note, and showLogin fires on a mid-session 401, so a populated stack could otherwise be replayed by whoever signs in next. 🎫 (a) tier on the master-admin roster only — publicAccount also feeds /api/login, /api/me and /api/profile, and a billing attribute has no business on a login response. ⏳ (b) a revoked grant used to take up to 30 days to land for anyone who used Agora's own login form: the session token is self-contained, with no revocation list, while the SSO cookie re-stamps every request. Rather than shortening the session (a weekly re-login for everyone, regressing a length chosen on purpose), resolveAccount now prefers the live Appolis ID resolve when its cookie is present, throttled to one service-binding round-trip per 10 minutes, falling back to the local session when the ID is unreachable. Known limit, documented rather than papered over: on the workers.dev host the appolis_id cookie is Domain=.appolis.app, which browsers reject there, so that host never re-resolves — treat it as break-glass only. 🧽 (c) comments that actively misled. The dangerous one: scripts/push-db.js line 1 called production "the stub team's board" while line 3 warned it overwrites the live board — and it never mentioned that since v0.10.0 a push does nothing until you poke /internal/doc-reload, because a warm TeamDoc re-mirrors its own older copy straight over it. Also: server.js hardcoded teamsStub:true so local dev permanently badged the real production board "stub (P1 pending)", and worker.js's header claimed role enforcement was "read/write basics only" forty lines above the code that disproves it. 🔧 (d) server.js drift that made local testing LIE about shipped features — the worst kind, because it doesn't fail, it misinforms. The gating fix is the body cap: 20e6 bytes of base64 decodes to ~14.3 MiB, so an 18 MB screen recording was rejected before the handler ran and the regex and cap fixes were dead code without it. Plus video MIME types (a stored recording was served as octet-stream and <video> refused it silently), and the three routes that 404'd locally: /api/hub-apps — which gates both the 🐛 FAB and the 🏛 hub popup — /api/bug-report, and /api/my-connector, whose 404 printed the raw string "unknown api route" at the user. The two pure-read /internal doors are now implemented locally and the two DO-backed ones answer 501; OAuth discovery 404s like production, because a 200 text/html is exactly what makes an MCP client start a flow that does not exist. And agoraRole + id now ride the local me payload — without them myRole() fell back to admin and p.access.assignments[DB.me.id] read an undefined key, so the ⏳ approvals gate and the entire assigned-only model were untestable on a developer's machine. 📖 The docs caught up too. §§1-7 had not tracked reality since v0.6.1 — eight releases existed only as changelog lines — and the /breakdown twin was worse, because teammates read it in-app: it was still the un-reskinned Kosmos engine file, naming data/db.json as the production store and advertising "deals" and "people" sections cut in v0.2.0. Both rewritten against the code. And docs.appolis.app now renders each app's living markdown at build time instead of copying whatever stale HTML sat next to it, so a published breakdown can no longer lag the doc it came from. 276 assertions green across 11 harnesses — 88 new for Trash (including the connector mirror-rule cases and a client-wiring pass), 49 for the bundle and cleanups. Verified end to end in a browser: delete → Trash → restore returns the project, its to-do and all four scaffold lists; purge leaves no orphans.

• v0.11.2 (2026-07-26) — 🎭 /breakdown was leaking assigned-only projects, and the test suite was fiction. The hole. The live breakdown page is a REAL-DATA surface — it renders the team's actual projects, stages, sections and note/to-do counts. It was signed-in-gated but never applied the capability view, so any viewer or contributor who typed the URL read every assigned-only project their own screen hides. §3a promises those "VANISH" for the unassigned; on this one route they did not. The role wasn't even resolved on the path (AGORA_ROLE was computed only for /api/*), so there was no actor to compartmentalize against. Fixed with the SAME viewOf every other read uses — deliberately not a boss-only gate, because the live-doc rule makes this page teammate-facing on purpose. Compartmentalize it, don't hide it. Found by an adversarial recon pass over the v0.12 surface, unrelated to the feature being planned. The bigger problem it exposed: test/ did not exist. Ten changelog entries cite assertion counts (31, 20, 19, 21, 18…) and every one of those harnesses lived in a session scratchpad — unrunnable by anyone else, gone when the session ended, and impossible to regression-check. The counts were true when written and unverifiable forever after. All eight are now committed under test/, relativized so they run from any checkout, with a zero-dependency runner: node test/run.js (or node test/run.js roster to filter). 127 assertions, green. Plus 12 new ones for the hole above — including a control leg that renders the RAW board and asserts it STILL leaks, so a green run can never be a fixture that stopped reproducing the bug.

• v0.11.1 (2026-07-25) — 🧹 Finishing v0.11.0, plus two real bugs it sat next to. (1) The last eleven whole-array writers are ops. v0.11.0 converted the high-frequency paths and named the rest; they are done: item delete in the note modal, item→to-do, to-do→list, tracker-import append, move-item-to-project, add-via-modal, single-line and extract-all line pulls, and the three quick-add paths. Two earned more than a mechanical swap. extract-all used to keep only the checked rows — so an item a teammate added while the to-dos were being created was swept away with the extracted ones; it now removes exactly the rows it extracted, by id. The 🐛 bug quick-add shipped a stale attachments array alongside the stale list, losing screenshots on a second bug filed minutes later; screenshots now ride inside the add op, which appends them server-side. flushNoteEdits — the note modal's save-on-close — carried the whole array to save item TEXT, so typing in one row re-asserted every other row, including a checkbox someone had just ticked; it now sends one set per row actually retyped, alongside title/text in the same request. Still whole-array, by design: vault seal/release and note⇄list conversion, where the array genuinely IS the change. (2) 🔐 The vault could eat a sentence, permanently. Sealing encrypted whatever the note held when the modal opened. Type a paragraph, hit 🔐, and the plaintext was never saved — and was now behind a key applied to the OLDER copy. Unlike every other write bug in this app, nothing recovered it: no poll, no replay, no undo. Same pass, same class: 📌 Pin, Archive, 🗑 Delete and both line-extraction paths also tore the overlay down without saving — Delete matters more than it looks, because it is undoable, so restoring returned a note missing its last line. All now flush through flushIfOpen(id), which flushes only when the open editor belongs to that note — flushNoteEdits reads #ed-title/#ed-text straight off the DOM, so an unguarded call from a non-modal context would stamp the open note's text onto a different note, a worse bug than the one being fixed. (3) 👤 An AI could assign work to the wrong person. mcpOpts built its member list from every provisioned account and stamped everyone Owner-if-root-else-Basic — a leftover from before the teams registry shipped. So assign_work, add_todo(assignee) and open_items(assignee) ran against a DIFFERENT list from the 👤 pickers: it included people disabled in Appolis ID and people on other teams entirely, with roles nobody granted. That breaks the platform rule directly — a person's AI gets exactly that person's permissions, never more — because the picker and the connector disagreed about who exists. The real directory is now one function, teamRoster(), read by both connector doors and the HTTP picker door, so there is no second copy to drift. Registry unreachable or a stub team still falls back to the provisioned roster rather than throwing. Tests: 19 new call-site cases (each converted shape run against a doc a teammate has already changed, with a red control leg proving the old whole-array write still erases the tick) + 21 roster cases + 18 flush-before-teardown cases. Existing suites re-run green: mirror-rule 31, v0.9.2 20, worker-tier 16, one-write-channel 8/8, item-ops A/B.

• v0.11.0 (2026-07-25) — 📌 ITEM-LEVEL WRITES: a teammate's checkmark stops disappearing. v0.10.0 closed the STORAGE race; this closes the PAYLOAD one it deliberately left. Ticking a box used to send the WHOLE list back, built from a snapshot up to 45s old — so your tick re-asserted 'unticked' for every item you hadn't touched, and the CAS replay faithfully re-applied that stale array. Reproduced as a red test (Ana ticks item 1, Ben ticks item 3, same moment → Ana's is erased) and now green, with the whole-array control leg still losing one so a pass can't be a test that skipped the race. The protocol: one new body key on the existing route — PATCH /api/notes/:id { ops: [...] } — with three verbs (set / add / remove; check, rename, flag and assign are all set with a different value key, so there is ONE resolver and ONE permission funnel). Ops resolve against the FRESH doc inside the CAS replay, so a replay re-resolves rather than re-erasing. Items gained stable non-numeric i_ ids, stamped lazily on every server write path — non-numeric on purpose, because the connector's findItem treats a numeric ref as an array index and a bare number would silently resolve to the WRONG item. Identity is the safety property: an id NEVER falls back. A missing id is proof the item is gone, not licence to guess — duplicate item text is normal on a 🐛 Bugs list, and guessing would tick the wrong task, which is worse than the bug being fixed. A pre-stamp snapshot (every item on the live boards today) resolves transitionally by index VERIFIED against text, then by unique text, then refuses. Verified live: a stale id returns gone and does not touch the item that happens to sit at that index. The client self-heals: every reply carries the fresh note and the browser absorbs it in place, so each tap doubles as a mini-sync and the 45s poll window stops mattering on a busy list. An unresolvable op is a neutral ↻ toast plus a refreshed list, never a silent no-op (that is the original bug in a new hat) and never a scary error. Also fixed here — a worse bug than the tick: all four UNDO paths reverted by PATCHing a whole-array snapshot captured before the action. An undo step can sit on the stack for minutes, so Ctrl+Z rolled the list back to that moment and erased every teammate change since, while the person believed they had undone one thing. They are now INVERSE OPS (un-check that item; restore that exact item, id and all, at its index). Converted: all four check-a-box implementations, the item editor, add/delete/assign on the main surfaces, the decision form (the channel an AI polls for a 🛑 STOP verdict — a stale overwrite there could un-check someone's STOP), and the four undos. Still whole-array, by design: vault seal/release and note⇄list conversion genuinely replace a list. Still whole-array, to convert next (~11): item delete in the note modal, item→to-do, to-do→list, tracker import append, move-item-to-project, add-via-modal, line extraction, and the quick-add paths — lower-frequency than ticking, same class of bug. The legacy array path stays supported for them and for any tab running older code mid-deploy; sending both ops and listItems is a 400.
• v0.10.0 (2026-07-25) — 🚦 ONE WRITE CHANNEL (Tyler greenlit). Agora's board is ONE JSON doc shared by a whole team plus every member's AI connector, and every mutation was read-modify-write straight against KV — so two overlapping writes each read a copy and each put the whole doc back, and the slower one SILENTLY erased the faster one's work. KV's ~60s edge cache meant 'overlapping' could mean a minute apart. Kosmos reproduced the identical bug live on 2026-07-24. Reproduced here first as a RED test: 8 teammates each adding one to-do at the same moment left 1 of 8 surviving, with no error shown to anyone. The fix: a per-board Durable Object (TeamDoc) whose NAME IS THE KEY it owns, so every isolate worldwide resolves the same object for the same board. Loads come back fresh carrying a rev; saves are compare-and-swap on that rev, so a writer holding a superseded copy is REJECTED and the whole request is replayed on fresh data (runOnBoard, jittered backoff, 15 attempts, then a loud 503 — never a success toast for a write that didn't land). KV stays a write-through mirror so pull-db.js, external inspection and a rollback all keep seeing the real board. Same A/B test after: 8 of 8 survive, and the harness fails itself if side A stops losing writes, so a green can never be a test that skipped the race. Beyond Kosmos's HubDoc, deliberately: (1) rev/CAS — HubDoc's unconditional put narrows the race but still lets both writes land, which Kosmos's own changelog flags as owed; Agora is the workload that makes it mandatory. (2) Reconcile on cold start instead of seed-once, adopting KV only when STRICTLY newer by meta.updatedAt — monotone, so a stale edge read can never win while a real out-of-band push-db.js always can. (3) blockConcurrencyWhile around boot. (4) The doc moves as text with the rev in a header. The load-bearing detail: a CAS conflict is a FLAG on the store, never a throw — lib/mcp.js wraps its whole envelope in try/catch and would have swallowed a thrown conflict into a 200, leaving the AI door silently losing writes while the web door looked fixed. Neither handler file changed by a character. Ops: /internal/doc-status (the rollback gate — mirrorDirty means KV is BEHIND the DO) and /internal/doc-reload (the poke a WARM DO needs after any out-of-band KV write). Kill switch: wrangler secret put BOARD_OFF = 1 reverts to direct KV in 30 seconds with no deploy. ⚠️ WHAT THIS DOES NOT FIX, be straight about it: two people checking items off the SAME list at once. The browser PATCHes the whole listItems array from a snapshot up to 45s old, so the staleness is in the PAYLOAD, not the storage — CAS rejects it, the replay re-applies the same stale array on fresh data, and the checkmark still vanishes, now deterministically instead of racily. This release is the correctness FLOOR everything else stands on; item-level operations (or If-Match on the item) are what actually fix the checkmark case, and that is the next increment. Do not tell the team that one is fixed yet.
• v0.9.2 (2026-07-24) — Tyler's two calls. (1) Deciding who does what is a LEAD's job. Handing work to another person — or taking it off them — is now owner/manager only, on BOTH doors: to-dos, list items (including the sneaky whole-array write that carries assignees), the project crew, and the connector's assign_work + add_todo(assignee). What stays open for everyone: claiming a free task for yourself and putting your own back down — that is working, not delegating. The 👤 picker now offers a non-boss exactly those two choices instead of a roster they cannot use. (2) The Basic project cap is REMOVED from Agora (deliberately reversing v0.9.0, one day old). Once creation went owner/manager-only in v0.9.1 the cap could only ever bite a Basic-tier team OWNER — a business owner trying the product — while costing nothing to allow, since the whole team's board is one KV doc either way. The limit that would actually matter for a team app is teams OWNED or seats, and both are minted in Appolis ID where Agora cannot see them. is still STAMPED on every ID resolve (the suite contract other apps read) — the enforcement is gone, not the stamp. The unknown-section 400 that shipped bundled with the cap is KEPT: it is real validation, not a cap. 20 new assertions; the 31-case mirror matrix still green.
• v0.9.1 (2026-07-24) — 🎭 THE MIRROR RULE: a person's AI gets exactly that person's permissions, never more (Tyler, now a platform doctrine — see §3a). The connector door enforced NOTHING across 26 tools while the website enforced roles correctly, so a person's AI could read and write what their own screen hid. Fixed by extracting the capability model into an exported boardCaps() that BOTH doors import (one implementation, so they cannot drift), a single READ CHOKE POINT that hands every tool a compartmentalized frozen view (hidden projects and everything filed under them are not in the arrays — closing all ten readers, every findProject probe and every error-path candidate dump at once, with future tools safe by default), and per-handler WRITE gates that mirror the web door including its pending flows (an editor's connector add lands pending; a contributor's completion returns awaiting_approval instead of lying that it is done). The worker now resolves the REAL role at both connector entrances and fails CLOSED to contributor. Also: project creation is owner/manager-only on both doors (it had NO role gate at all — a viewer could create projects), archiving/re-filing carry the same gate, and the ＋ New tiles hide from those who cannot use them. Three traps the design pass caught before they shipped: check_item was defined TWICE and the later copy won (gating the first would have shipped a check that never ran), the role placeholder would have demoted every real manager, and the frozen view turns a missed write-repoint into a loud throw instead of silent data loss. 31-assertion role × project-shape matrix, plus the earlier 31 tier + 16 identity assertions still green.
• v0.9.0 (2026-07-24) — 🎫 BASIC TIER (todo_1013; suite contract in appolis note_1012, Kosmos v6.97 = reference impl). An Appolis ID agora grant with type:'basic' is a USAGE-capped preview: every feature stays open, the volume is small. tierFromEnts() stamps account.tier on the registry at every ID resolve (masters and hub insiders — who carry an app:'' grant — are exempt; an unknown type fails OPEN), re-stamped each time so an upgrade in the ID admin lands at next login. basicCap() in lib/api.js enforces 1 ACTIVE project per pipeline, gated on ownsBoard so a Basic account is only ever capped on a board it OWNS and never while contributing to someone else's team. Enforced on BOTH doors — web (POST /api/projects, plus any PATCH that lands a project active in a pipeline) and connector (create_project via ctx.tier/ctx.ownsBoard from mcpOpts, which covers /mcp/<token> and the Appolis Connector room at once) — with friendly 403s that say what to do. One honest caveat: the connector door never sees an entitlement list (it passes undefined deliberately, so it can't clear a stored tier), so a Basic account that has ONLY ever used the connector carries no tier until its first web/SSO sign-in stamps one. 20/20 cap-matrix cases tested, including every case where the cap must NOT fire. Three deliberate divergences from the Kosmos reference, all structural: (1) the ownsBoard gate, because an Agora board is shared and a teammate's projects must never consume your allowance; (2) no archived-project cap — Agora has no project-delete path, so capping archives would wall a pipeline shut with no way out; it lands with the 🗑 Trash port, and basicCap already ignores p.deleted so that's a zero-line change; (3) "own at most 1 team" is NOT enforced here — Agora contains no team-creation or ownership-granting code at all (the only team-shaped write in the repo is the lastTeamId pointer move), so that cap belongs to the Appolis ID lane and is flagged there. Known gap, same as Kosmos: a live native agora_auth session isn't re-stamped, so a tier change applies at next login — a non-issue in practice because Agora's real door is the shared SSO cookie, which re-stamps on every request. An adversarial review of this diff found five real defects before it shipped; all five are fixed and regression-tested (47 assertions). (1) The cap was defeated in ONE UI CLICK: PATCH /api/projects/:id moved a project between pipelines with no re-check, so creating in an empty pipeline and re-filing via the "Filed under" dropdown gave unlimited projects — the gate now evaluates where a project ENDS UP (destination section + final archived state, so a combined unarchive-and-move is caught) and rejects an unknown sectionId with a 400 instead of silently storing a section no grid can render. (2) basicCap counted TEAMMATES' projects, so a Basic owner's first-ever create could 403 while pointing at work that wasn't hers — projects now carry createdBy (both doors) and only your own consume your allowance; pre-existing projects have no stamp and so cap nobody. (3) type is a FREE-TEXT field in the ID admin and that same screen labels a hub role "Basic" with a capital B, so an exact-match on 'basic' would have silently stamped the account unlimited — matching is now case- and whitespace-insensitive. (4) The note flush was wired only to closeModal, while the phone/browser BACK button (the code's own comment calls it the primary close path) tore the overlay down without saving — the flush now runs on the popstate path too, snapshots synchronously, covers checklist ITEM text, and sends one request instead of two. (5) Pre-existing privilege escalation, fixed here: the ROOT mapping tested for any app:'' grant, but the ID service also gives hub INSIDERS a '' grant at role member — so any insider who had never used Agora landed on the master account with admin over a real team's board. It now requires '' at role admin (the master's own grant shape); insiders stay exempt from the cap without becoming root. Shipped alongside, all confirmed-broken before this change: silent data loss on the note modal — title/body saved on onchange (blur only), so closing or converting a note with the caret still in the box threw the typing away, and on a shared board that text is a teammate's; flushNoteEdits() now runs before close, BACK, note↔list conversion, move and promote. The area repair is self-healing — fixing the writer alone would have left every existing row pointing at the phantom apps area, so normalizeAreas() runs on load in both doors and remaps any unknown area to ideas, persisting on the next write (no separate migration burst, which also respects the one-write-channel rule on a shared board). Verified against the live board: both projects and all 15 notes — including 🐛 Bugs, 📋 Action items and 🚧 Blockers — were invisible in the ✅ Lists view and the 🗃 Everything-else dashboard, and now resolve. The --mintSoft CSS variable was never declared despite three v0.8.14 buttons using it (✓ Approve, 🌐 Whole team, Save access), so the calm-mint affirmative fill never rendered on the Approvals and Access modals. The connector wrote areaId:'apps', a Kosmos area that doesn't exist in Agora, making connector-made work invisible in the 🗃 Everything-else dashboard — now 'ideas', with the same fix on five other defaults, plus 🎬 Content added to the create_project section list (an AI literally could not file content work). The connector's initialize instructions now lead with a 📜 SCAN-FIRST rule — read overview + ai_worklist + the item's full text before writing, re-scan each burst, prefer additive moves — because this board takes concurrent writes from many humans and several AI sessions. And local dev gained an actor escape hatch (AGORA_TIER=basic node server.js) so role gates and caps are testable locally instead of only in production; unset, local behaviour is byte-identical to before.
• v0.8.24 (2026-07-18) — 🐛 honest listening cadence (Kosmos parity): Blitz/Flow = LIVE "you are here" modes; Cruise/Drift = AWAY background modes. The 7s is the browser pop-up refresh, not agent polling.
• v0.8.23 (2026-07-18) — ↩️ listening modes back to Blitz/Flow/Cruise/Drift/custom (Kosmos parity).
• v0.8.22 (2026-07-18) — 📥 TRACKER IMPORTS P1 (todo_562 / note_729): the ☰ menu gains "Import a tracker" (editors+) — drop a Basecamp or Trello JSON export, a CSV (project/list/item/due/assignee/done headers; Monday lands via its CSV export), or paste Google-Doc-style lists. Always a DRY-RUN PREVIEW (untick per project) before anything writes; assignee emails auto-map onto team members (unmatched kept as @text); existing projects/lists reused, duplicate items skipped. All four parsers unit-tested. P2 (OAuth live pulls) stays on the design note.
• v0.8.21 (2026-07-18) — 🏛 GREEK LISTENING MODES (Kosmos parity): Kairos · Zephyros · Helios · Selene · Proteus (custom).
• v0.8.20 (2026-07-18) — ⚡ LISTENING MODES + FORM POLISH (Kosmos parity): Blitz/Flow/Cruise/Drift poll cadences + custom seconds from the form pop-up; the pill back at the TOP of the board; Delay/Reschedule pickers with quick chips + custom box; Continue/Stop confirm first.
• v0.8.19 (2026-07-18) — ❓ DECISION FORMS v2 (Kosmos parity): slim floating pill instead of the top banner; tapping opens the clean form pop-up (picks, your answer, ▶ Continue · 🔁 Reschedule · ⏳ Delay · 🛑 Stop). Same data model, so listening sessions keep working unchanged.
• v0.8.18 (2026-07-18) — 🩹 CORRECTION + 🎞 FRAME.IO (todo_760 + todo_759): the quick-add 🐛 Bug tab is now 🩹 Correction (team language; lists/labels/AI plumbing unchanged). And content projects can port a Frame.io review: 🎞 Link Frame.io (editors+) stores the share link as a header button and seeds a 🎞 Frame.io remarks list on the project — view there, remark here, all synced. Deeper API port (pulling comments/assets in) needs a Frame.io developer token from Tyler.
• v0.8.17 (2026-07-18) — 🔒 CALM DEFAULT VIEW (note_589 #45 ‼️): the project header now trims to the role — viewers/contributors see ▶ Live + 📌 Pin (+ read links) only; editors add the working buttons (calculator, AI lane, arrange, Phantasia); Archive + 🔒 Access stay manager/admin. Summary ✎ hides below editor. Server gates were already in (D2) — now the UI stops advertising buttons a role can’t use.
• v0.8.16 (2026-07-17) — 🎞 SCREEN RECORDINGS IN THE BUG REPORTER (note_589 #43, Kosmos parity): 🐛 pop-up + quick-add take recordings (mp4/webm/mov, ≤18MB) and multiple files; media-only reports with no text are valid — the media IS the report. Bug media pins to the item and auto-deletes from the team’s KV the moment the item is checked (handled).
• v0.8.15 (2026-07-17) — 🙈 HIDE ANY CATEGORY (note_589 #44, Kosmos parity): 🙈 hide on every dashboard section header — hidden categories drop off YOUR dashboard only (per-person on the shared board: settings.hiddenSectionsBy[you]) and the 👁 chip row restores any with one tap. Plus the settings route is now role-gated (D2 follow-through): contributors/viewers can only save their own view prefs — never house tunables like rateCard/houseTemplates — 5/5 gate scenarios tested.
• v0.8.14 (2026-07-17) — 🎭 ENFORCEMENT LAYER (Tyler chain-of-command block D2): the board now COMPARTMENTALIZES by capability. viewer = read-only; contributor = works only ASSIGNED projects/items; editor = works freely but NEW adds wait for a manager to approve (pending); managers/admins do anything. project.access = {visibility: open|assigned, assignments: {accountId:{role}}} — assigned-only projects (+ their notes/todos/events) VANISH from the board for the unassigned. Contributor completions wait for editor/manager approval. New Approvals surface (nav badge + modal) and a manager Access control on each project (visibility toggle + per-person role picker). Server-enforced (handleApi gets the actor); 7/7 role scenarios tested. IMPORTANT: Agora/Phantasia access stays a SEPARATE per-person grant — a Hermes user (e.g. basic CS) gets NOTHING here unless granted agora; verified the FML CS crew is hermes-only.
• v0.8.13 (2026-07-17) — 🎭 AGORA ROLE FOUNDATION (Tyler chain-of-command, block D1): each person now has a board capability — admin | manager | editor | contributor | viewer — derived from their HERMES rank on a business-linked team (overall_admin→admin · dept_head→manager · dept_manager→editor · dept_user→contributor, asked live over a new HERMES binding), or the Appolis team role on a plain team. Carried in /api/me + /api/db me. Enforcement (assigned-only visibility, write-gates, editor/contributor approval queue) is the next increment — design note on the tile.
• v0.8.12 (2026-07-17) — 🪪 HUB ROLES v2 (Tyler's ladder): Owner | 🎟 Insider | 🐛 Dev | Basic — the 🐛 reporter fab gates on the hub role via /api/hub-apps — Basic users never see it.
• v0.8.11 (2026-07-17) — 🔌 one connector only (Kosmos parity): profile presents only the Appolis connector; lane/group briefs + cowork copy say "your Appolis connector." 🧶 group cowork configurable — cadence / form-vs-scheduler / auto-stop / behavior toggles with a live brief preview.
• v0.8.10 (2026-07-17) — 📸 REPORTER SCREENSHOTS (todo_731): the 🐛 popup takes an image now — attach + passthrough to the intake.
• v0.8.9 (2026-07-17) — 🐛 USER BUG-REPORT FEED (todo_681, first cut): REFERENCE IMPLEMENTATION — the always-there bottom-left 🐛 button opens a styled report popup (🐛 broken / 💡 feature toggle, description, auto device basics + page); POST /api/bug-report forwards it over the new KOSMOS_HUB binding to the master board. Screenshots ride in a later cut.
• v0.8.8 (2026-07-17) — 🧶 GROUP COWORK (todo_679): Kosmos parity port — the 🧶 group-brief builder on the cowork page, worded for the team board.
• v0.8.7 (2026-07-17) — 🔗 KOSMOS↔AGORA PROJECT LINKING (todo_676): new machine-only GET /internal/project-feed (teamId+projectId, ID_SECRET) hands a linked Kosmos project this team project's open todos (due/assignee), open list items, and stage. Reverse linking (Agora showing a PERSONAL board) is deliberately absent — personal boards stay private from team surfaces.
• v0.8.6 (2026-07-17) — 🎬 VIDEO→PHANTASIA LINKS (todo_721): video projects carry the 🎬 Phantasia deep-link button (Kosmos parity).
• v0.8.5 (2026-07-17) — ❓ DECISION FORMS PRODUCTIZED (todo_722+725, Tyler's invention): full Kosmos parity port — urgent banner + card styling, 🛑/▶ control rendering, post/read_decision_form connector tools, ✅ auto-archive. Team sessions ask the BOARD, anyone on the team answers.
• v0.8.4 (2026-07-17) — 🐛 example tiles hide from the TILE itself (Kosmos 589 #43 parity): a ✕ on the example card; the header 👁 link brings it back.
• v0.8.3 (2026-07-17) — 🔌 CONNECTOR P2 (todo_674): the Appolis Connector now mounts the WHOLE suite — Agora joins as a room: lib/mcp.js mounted behind POST /internal/mcp (identity by x-appolis-email, lazy provisioning, ACTIVE-team board — shared mcpOpts keeps /mcp and the room one brain); /api/my-connector + Appolis-first profile panel + hub-popup connector entry.
• v0.8.2 (2026-07-17) — 🏛 THE HUB BUTTON (todo_683, Tyler steer): ONE Appolis button in every suite app — a shared popup of exactly the apps YOUR Appolis ID opens (data: the ID service's new internal GET /id/apps — entitlements ∩ catalog + suite baseline), same-tab navigation so the BACK button returns you to the app you left. Agora: /api/hub-apps + the 🏛️ nav button; the dedicated Kosmos space link in the menu is replaced by the hub (dedicated portal buttons retire outside Kosmos).
• v0.8.1 (2026-07-17) — 🤖 AI-features gate (Kosmos v6.53 lockstep): accounts with no minted connector get the friendly "these are AI features" popup with a door to the profile, instead of silent 🤖 toggles.
• v0.8.0 (2026-07-17) — 👁 EXAMPLE PROJECTS per team section (lockstep with Kosmos v6.51): every section carries one virtual example (never a data row) — dashed EXAMPLE tile, open by default while the section is empty, auto-collapses once real projects exist, always peekable/hideable from the section header; tapping opens a read-only example project page (pipeline lit at its stage, scaffold lists with believable sample items, sample to-dos + note, ＋ Create your own CTA). Eight store-team examples: Q3 Retention Push · Summer Bundle Drop · Back-to-School Email Blitz · September UGC Batch · Warehouse Restock Week · Homepage Hero Refresh · Farmers-Market Pop-Up · Fitness Influencer Collab.
• v0.7.1 (2026-07-17) — scaffolds SHAPED per team section (Tyler's todo_686 correction): the dev four stay on 🌐 Website Changes only; the other seven sections seed their own intuitive sets — initiatives (📋 Action items · 🚧 Blockers · 📝 Decisions · 🔮 Ideas & later), products (📦 Sourcing · ✅ Listing · 🚀 Launch · 🔮 Product ideas), campaigns (✍️ Copy & creative · 📣 Channels · 📊 Results · 🔮 Ideas), content (💡 Ideas · ✍️ Drafts · ✅ Approval · 📅 Publish queue), ops (🐛 Issues · 🔧 Process fixes · 📦 Inventory · 🔮 Improvements), events (📋 Planning · 🎪 Run sheet · 📦 Supplies · 📝 Wrap-up), partners (🤝 Prospects · 📄 Terms · 📋 Onboarding · 📝 Touchpoints). team_spartan board re-seeded (mis-seeded empty dev lists swapped for the right set via their seed marker).
• v0.7.0 (2026-07-17) — todo_686: the LOCKSTEP release (Kosmos-trains-Agora, applied). (1) Kosmos v6.47 engine parity ported: scheduleFit() replaces rAF-scheduled grid fits (rAF never fires in hidden tabs — the unfitted-grid holes bug), outer grid rows quantize at 12px w/ data-colw carrying column width (panels hug content, Tetris-dense backfill), collapsed-panel span clamp 4→16, width-only resize on collapsed cards (kills snap-back), ‼️ IMPORTANT flag on to-dos + list items (editors, quick-add, row markers, sorts first, important through the connector's ai_worklist + API whitelists), 📸 screenshots on quick-add bug reports (team-scoped uploads, thumbnails in the item editor), finished items ALWAYS start collapsed ("show N done" in the note popup + full to-dos view). (2) Five-list scaffold (the Tyler ask): every project of EVERY section now seeds 🐛 Bugs · ⚙️ Function changes · 🎨 Design changes · 🔮 Future Updates at creation (seedProjectLists in lib/api.js, wired into the API + connector create paths — same code shipped to Kosmos v6.49); existing team_spartan board backfilled (4 lists).
• v0.6.1 (2026-07-16) — 👑 master = the master Appolis ID (Tyler's steer): provisionFromAppolis maps an Appolis account carrying the * (master) entitlement onto ROOT even when the emails diverge — Kosmos parity; the deploy PASSWORD key is break-glass only, never the identity. Tyler's one login opens Agora as the master account by construction (his ID was already email- and appolisId-linked to root; this makes it doctrine).
• v0.6.0 (2026-07-16) — sheds the P1 stubs (todo_667): GET /api/team/members now reads the REAL Appolis registry directory (GET /id/teams/<id>/members over the binding) — registry members map onto local account records (lazy provisioning by appolisId/email, so existing assignment chips + My Work ids stay valid), disabled registry IDs drop out of the pickers, roster kept as the stub/offline fallback; teams themselves were already real the moment Appolis v0.6.0 shipped (teamsFor() spoke the contract from day one — prod team_spartan adopted the existing board, teamsStub false). Also CONFIRMED no-op on the deploy-window stale-shell bug (todo_669): Agora serves a plain unhashed /app.js from the static shell — no hashed bundles ever get deleted, so the Hermes v0.76.1 404 mode can't occur; the ETag refresh banner covers plain staleness.
• v0.5.0 (2026-07-16) — the assigned person's side of assignment: 👤 My Work view (#/mine, menu badge, per-member plates via the select), and the connector becomes a dispatcher — assign_work tool, add_todo(assignee), open_items(assignee) with assignee names in outputs (roster rides ctx.members).
• v0.4.0 (2026-07-16) — Tyler's third reaction: Campaigns/Content SPLIT (📣 Campaigns ends at Results; 🎬 Content ends at Approved); 👤 ASSIGNMENT layer — project crew (assignees), per-todo + per-list-item assignment with styled pickers and name chips, GET /api/team/members stub directory; cross-app door GET /internal/overview (ID_SECRET-gated) so Kosmos can show your Agora teams/projects.
• v0.3.0 (2026-07-16) — pipeline v3 on Tyler's second reaction: Customer Experience CUT (Hermes owns the customer lane — lane boundary recorded); added 🌐 Website Changes (Request→Scoped→Building→Review→Live), 🎪 Events (Idea→Planned→Prep→Live→Wrapped), 🤝 Partners & Affiliates (Prospect→Talking→Terms→Onboarding→ Active); Customers area → Partners area.
• v0.2.0 (2026-07-16) — pipeline v2 on Tyler's reaction: ecommerce-first sections (Initiatives · Products & Drops · Campaigns & Content · Store Ops · Customer Experience); Clients & Deals + People cut; rate calculator de-anchored (menu entry + section link removed); store-shaped default areas; product steer + parity doctrine ("Kosmos trains Agora") recorded.
• v0.1.0 (2026-07-16) — P2 shell bootstrap: engine copied from Kosmos v6.40; team-keyed shared boards; Appolis ID dual-auth + SSO from day one; teams stub against the P1 contract; team switcher + role chip; team-shaped sections draft + seeded areas; Agora skin + generated portico icon; Studio/share/account-CRUD removed; zero-dep local server on :3901.