Agora · v0.13.0

One board.
The whole team
on it.

The team-shaped app on the Kosmos engine — one shared board per team, eight store-shaped pipelines, work with a name on it, and every member's AI seeing exactly what that member sees.

Agora v0.13.0 · agora.appolis.app · source of truth: APP_BREAKDOWN.md

The problem

A team board is not a solo board with more people on it

Kosmos is one brain per account, hard-isolated. Agora is one JSON doc that a whole team — plus every member's AI connector — reads and writes at the same moment. Everything below is a bug that simply cannot happen when you are the only person holding the list.

✅→⬜

Two people tick the same list at the same moment. One tick survives. Nobody sees an error.

🎭

A person's AI reads and writes what their own screen hides — because the website enforced roles and the connector did not.

🗑

Work vanishes off a teammate's plate and they are never told — the app that deleted it only ever thought about the deleter.

Each one was reproduced as a failing test first. Several of those tests still carry a control leg running the OLD code, asserted to keep failing — so a green run can never be a test that quietly stopped reproducing the bug.

The board · eight ways a store team works

Eight sections. Each with its own pipeline — and its own way of stalling.

Ecommerce-first, shaped by what an online-store team actually does. Anything sitting in a section's stall stage for 7+ days wears a badge on its tile.

Section	Pipeline	Stalls at
🎯 Initiatives	Idea → Scoped → In Motion → Review → Shipped → Live	Review · Shipped
🛍️ Products & Drops	Idea → Sourcing → Listing → Launch → Selling	Sourcing · Listing
📣 Campaigns	Brief → Planned → Producing → Review → Live → Results	Review
🎬 Content	Idea → Brief → Producing → Review → Approved	Review
🏪 Store Ops	Intake → Next Up → Doing → Review → Done	Review
🌐 Website Changes	Request → Scoped → Building → Review → Live	Review
🎪 Events	Idea → Planned → Prep → Live → Wrapped	Prep
🤝 Partners & Affiliates	Prospect → Talking → Terms → Onboarding → Active	Terms

every new project is born with 4 working lists, shaped by its section 🎯 Initiatives → 📋 Action items · 🚧 Blockers · 📝 Decisions · 🔮 Ideas & later 🎪 Events → 📋 Planning checklist · 🎪 Day-of run sheet · 📦 Supplies & vendors · 📝 Wrap-up notes every stage carries its own playbook prompts

🎭 The mirror rule · platform doctrine

A person's AI gets exactly that person's permissions — never more.

Tyler's call, 2026-07-24, now the rule for the whole suite. Agora is the reference implementation: the board enforced five capabilities correctly on the website while the connector enforced none of them, so someone's AI could read and write what their own screen hid.

1

One capability model, both doors. boardCaps() is exported from lib/api.js and imported by lib/mcp.js — the web door's own gates are built from it, so a rule change lands on both in the same commit.

👁

The read half is one choke point, not per-tool gates. Every tool is handed a compartmentalized view: hidden projects — and their notes, to-dos and events — are simply not in the arrays. A hidden thing reads as not found, never forbidden, so there is no existence oracle. Future tools start safe.

🔒

Fail closed. A missing role resolves to contributor, never admin. Writers work the raw doc; the view's arrays are frozen, so a missed repoint throws loudly instead of silently dropping a teammate's work.

viewer

reads

contributor

works only ASSIGNED projects; completions await approval

editor

works anything they can see; NEW adds await a manager

manager · admin

anything, anywhere

31-assertion role × project-shape matrixthe roster is part of the mirror — one directory feeds both doors/breakdown is compartmentalized too, not hidden

Chain of command · Tyler's two calls

Starting work and handing work out are lead jobs.

Who may start work

Owner / manager only

You get added to Agora because you are on a team, and you see the projects you were put on. Creating a project — and archiving or re-filing one, which are creation moves wearing a different hat — is a lead's call, on both doors. Before this it had no role gate at all: a viewer could create projects. The ＋ New tiles hide from anyone who can't use them, because a button that 403s is its own bug.

Who may assign

Handing work out: lead. Picking work up: anyone.

Giving a task to another person — or taking it off them — is owner/manager only, across to-dos, list items, the project crew and the connector's assign_work. What stays open to everyone: claiming a free task for yourself and putting your own back down. That is working, not delegating. The 👤 picker offers a non-boss exactly those two choices instead of a roster they cannot use.

One helper — canAssign(current, next) inside boardCaps — is the whole rule, and both doors call it. Personal view preferences (like 🙈 hiding a section from your own dashboard) stay writable by everyone; house tunables are editor-and-up.

🚦 One write channel · v0.10.0

Eight teammates added a to-do at the same moment. One survived.

The board is one JSON document. Every change used to be read-it, edit-it, put-it-back straight against storage — so two overlapping writes each took a copy and each put the whole thing back, and the slower one silently erased the faster one's work. With edge caching, "overlapping" could mean a minute apart. Nobody saw an error.

Before — reproduced as a failing test

1 of 8 survived

Seven people's work gone, seven success toasts shown.

After — same test

8 of 8 survived

And the harness fails itself if the old side ever stops losing writes, so a green can't be a test that skipped the race.

🚦

One Durable Object per board, named after the key it owns — so every server worldwide talks to the same one object for the same board.

↻ 15

Saves are compare-and-swap: a writer holding a superseded copy is rejected and the whole request replays on fresh data — up to 15 tries, then a loud 503. Never a success toast for a write that didn't land.

🔌

A conflict is a flag, never a thrown error — the connector wraps its whole reply in try/catch and would have swallowed a throw into a "200 OK", leaving the AI door quietly losing writes while the website looked fixed.

storage stays a write-through mirror, so external inspection and rollback stay correctkill switch: one secret reverts it in ~30s, no deploy

📌 Item-level writes · v0.11.0

The checkmark that kept disappearing

Ana ticks item 1. Ben ticks item 3, the same moment, on the same list. Ana's tick is gone — and neither of them is told. This is the most ordinary thing two people can do to a shared list, and it was broken.

Why it happened

Ticking a box sent the whole list back — built from a copy the browser had been holding for up to 45 seconds. So Ben's tick didn't just say "item 3 is done"; it also re-asserted "item 1 is not done", from a copy taken before Ana touched it. Fixing the storage race didn't help: the replay faithfully re-applied the same stale list, so the checkmark still vanished — just deterministically instead of racily.

What it does now

A tick sends one operation — "check this item" — not the list. Three verbs (set · add · remove) cover check, rename, flag and assign, so there is one resolver and one permission funnel. Operations resolve against the fresh document inside the replay, so a retry re-resolves rather than re-erases. Every reply carries the fresh list back, so each tap doubles as a mini-sync.

🆔

An id never falls back. A missing id means the item is gone, not licence to guess — duplicate text is normal on a 🐛 Bugs list, and guessing would tick the wrong task.

↻

An operation that can't resolve is a neutral "refreshed" nudge with the current list — never a silent no-op (that is the original bug in a new hat) and never a scary error.

↶

Undo was worse than the bug. It restored a snapshot taken minutes earlier, erasing every teammate change since while the person believed they'd undone one thing. Undo is now an inverse operation: un-check that item, restore that exact item at its index.

🗑 The Trash · v0.12.0

Delete is soft, for 30 days — and it tells you whose work it takes

Agora had no way to delete a project at all until v0.12.0, because on a shared board deleting is not a private act. A project leaves every door the instant it's binned, stays fully restorable for 30 days, then purges for good along with its notes, to-dos, events and uploaded images.

The confirm counts other people's plates

“Move Summer Bundle Drop to the Trash?

It takes 4 lists and 11 to-dos with it.

This takes it off 3 teammates' plates straight away — they will not be notified.

You can restore all of it for 30 days.”

Deleting in a solo app only ever affects the deleter. Here the number goes in front of the person before they press the button.

Seven doors, one rule

A project visible on even ONE door after delete is worse than no feature, because then the board and the AI disagree about what exists. So it disappears from the web board, the connector's view, the live /breakdown doc, the deleted-notes list, the cross-app teams strip, the linked-project feed and the calendar feed — that last one matters most, because a calendar subscription refreshes on its own with no in-app affordance to stop it.

boss-only on both doors the retention clock is the server's, never the caller's restore brings notes, to-dos and events back with it the 30-day sweep runs on writes only — a purge inside a page load would turn a board read into a 503 storm 88 assertions

👤 Assignment & My Work

Anyone on a project can work it. Assignment makes it explicit.

A 👤 toggle on every to-do, every working-list row and every rollup item; a 👥 Crew row on the project itself. Names are stored with the work, so a plate renders without asking a directory anything.

👤

My Work — every open to-do and list item handed to you, grouped by project, plus the crews you're on. Anyone can flip to a teammate's plate to see who's carrying what — bounded by what the server already lets them see.

📇

One directory, every door. The picker and both connector doors read the same roster from the Appolis teams registry — people disabled there drop out of every picker.

⏳

Approvals. A contributor's completion and an editor's new add wait for a manager, with a badge in the nav and a chip on the row — and the AI door says "awaiting approval" rather than claiming the item is done.

🔒

Access per project. Open, or assigned-only — and an assigned-only project, with everything filed under it, simply isn't there for the unassigned.

A connector that offers a different set of PEOPLE than the person's own picker breaks the mirror rule just as surely as a missing gate — it hands work to someone that person could not have chosen. It did, once. Now it can't: there is only one roster function.

🔌 The connector · the AI door

Three doors, one set of rules.

Every account gets a private connector URL, and the suite-wide Appolis Connector opens the same room — those two build identical options from one function, so a permission or roster change cannot land on one entrance and miss the other. The third is a read-only calendar token. It shares no code with them, but since v0.12.1 it answers to the same capability view, so your .ics feed carries exactly the work you can see. Getting that one wrong was invisible for months: a calendar refreshes on its own schedule, with nothing in the app to notice.

💬 “Cass finished the PDP copy”

→

☑ check_item

→

📱 the whole team's board updates

28

tools — overview, projects, stages, notes & lists, to-dos, assignment, import, search, decision forms, trash

🎭

every one of them behind the same capability model as the website — read view and write gates both

📜

the door hands every AI client the house rules first: scan the board, read the item's full text, prefer additive moves — this board takes concurrent writes from several sessions

45s

the app polls for changes, so an AI's edits appear without anyone refreshing

📥 Bring the work in · 🗓 take the dates out

Arrive with a tracker. Leave with your calendar.

📥

Tracker import. Drop a Basecamp or Trello JSON export, a CSV (project · list · item · due · assignee · done — Monday lands via its CSV export), or paste lists straight out of a Google Doc. Assignee emails auto-map onto real team members.

👀

Nothing writes until you approve the preview. Always a dry run, untickable per project; existing projects and lists are reused and duplicate items skipped, so a second run doesn't double the board.

🗓

A live calendar feed. A read-only token subscribes Google, Apple or Outlook to the board's due dates and milestones — and external calendars can be pulled in the other way.

20

21

Bundle drop live

22

PDP copy due

23

Creator terms

Restock check

24

25

Campaign review

26

🏛 the Appolis hub button — one popup of exactly the apps your ID opens, same-tab so BACK returns you one login for the whole suite a revoked grant now lands in about ten minutes, not a month

Changelog · v0.1.0 → v0.13.0

Every version, one page.

Three consecutive releases — v0.10.0, v0.11.0, v0.11.1 — are one overhaul: making a shared board tell the truth about who wrote what.

v0.13.0 — 🚫 No more scrollbars. The grey bars down the side and along the bottom of a panel are gone everywhere on the board. Everything that scrolled still scrolls exactly as it did — swipe on a phone, wheel on a desktop — the bar itself just stopped taking up room and nudging things out of line. It is one rule in one shared place rather than a patch per panel, a test now goes red the moment anything brings a bar back, and it is a rule every app in the city owes from today: Appolis built the example, Agora is the second to carry it.
v0.12.4 — 🧪 The test that was supposed to prove the last release actually proved nothing. An independent review broke the security fixes four different ways and the tests still reported everything green — because they were checking that the fix was written down, not that it worked. Rewritten to boot the real code and watch what it actually does, then verified by deliberately re-breaking each fix and confirming the tests go red. The same review found three more real gaps, including one door that had been left unguarded twenty lines from its guarded twin
v0.12.3 — 🔒 The doors between the apps got locked properly. Running the app on your own machine was quietly offering the board to the whole network — anyone on the same office or cafe wifi could read and change it. It now listens only to your own computer unless you deliberately say otherwise. A maintenance command that reloads the live board could be fired just by visiting a web address; it now takes a real submission. And a diagnostic page could be used to probe for other internal storage by name — it only accepts a proper team name now. A fourth gap is half-closed on purpose: two doors now use a signed ID whenever one is offered, with a single switch to make it compulsory the moment the other apps can supply one — doing it unilaterally would have broken a working feature
v0.12.2 — 🚧 The board warns you before you trample a teammate. Saving through the AI now answers back with what changed on that project in the last three days and who did it — because the safeguard against two people writing at once cannot catch the ordinary case of someone who simply never looked. Shipped alongside it: the AI door stopped believing a caller who merely claimed to be you, and now demands a signed identity
v0.12.1 — 🔍 Writing the documentation down found three real holes. The docs were rewritten against the code, then two reviewers were told to go check every sentence — and came back with defects, not typos: the calendar feed had never hidden other people’s projects, the Trash was visible to managers through the live doc, and four write routes had never met the permission model at all, so a read-only viewer could edit the team calendar and bulk-import notes
v0.12.0 — 🗑 Delete a project, and the 30-day Trash: soft delete, boss-only on both doors, a confirm that counts what it takes off teammates' plates, and seven read filters so no door keeps showing it — the calendar feed included · ⏳ a revoked grant now lands in ~10 minutes instead of surviving for the full 30-day session, because the SSO cookie re-stamped and the local login didn't · 🧹 the Kosmos v6.99 port plus four cleanups
v0.11.2 — 🎭 /breakdown was leaking assigned-only projects: the live doc renders real board data but never applied the capability view, so anyone who typed the URL read the projects their own screen hides. Fixed with the same view every other read uses — compartmentalized, deliberately not boss-only, because the page is teammate-facing on purpose. And the test suite was fiction: ten changelog entries cited assertion counts for harnesses that lived in session scratchpads and no longer existed. All of them are now committed and runnable by anyone.
v0.11.1 — 🧹 The last eleven whole-array writers became operations — and two earned more than a mechanical swap: "extract all" swept away an item a teammate added mid-extraction, and the note editor's save-on-close re-asserted every row to save the text of one · 🔐 The vault could eat a sentence, permanently: sealing encrypted whatever the note held when the editor opened, so a paragraph typed since was never saved and was now behind a key applied to the older copy — nothing recovered it · 👤 an AI could assign work to someone disabled in Appolis ID or on another team entirely
v0.11.0 — 📌 Item-level writes: a teammate's checkmark stops disappearing. One operation per tap instead of the whole list, resolved against fresh data inside the retry. Undo became inverse operations — it used to roll the list back to a snapshot from minutes ago and erase every teammate change since
v0.10.0 — 🚦 One write channel. A Durable Object per board with compare-and-swap saves and a full replay on conflict. 8 simultaneous adds went from 1 surviving to 8
v0.9.2 — Tyler's two calls: handing work to another person is a lead's job; claiming a free task for yourself stays open to everyone · the Basic project cap was removed a day after shipping, because once creation went lead-only it could only ever bite a team owner trying the product
v0.9.1 — 🎭 The mirror rule. The connector enforced nothing while the website enforced roles correctly. One capability model imported by both doors, one read choke point, write gates that mirror the web door's pending flows, and project creation gated at last
v0.9.0 — 🎫 Basic tier as a usage-capped preview · an adversarial review of the diff found five real defects before it shipped, including a privilege escalation that put any hub insider on the master account
v0.8.22 → v0.8.24 — 📥 Tracker imports: Basecamp, Trello, CSV and pasted lists, always behind a dry-run preview, assignee emails mapped onto real members · ⏱ honest listening cadence — the 7s is the pop-up refresh, not agent polling
v0.8.15 → v0.8.21 — 🙈 Hide any category from YOUR dashboard only (per-person prefs on a shared board) and the settings route gated so contributors can't write house tunables · 🎞 screen recordings in the reporter, media-only reports valid · 🔒 the project header trims to your role — the UI stops advertising buttons you can't use · 🩹 the bug tab becomes Correction in team language · 🎞 Frame.io review links on content projects · ❓ decision forms v2
v0.8.13 → v0.8.14 — 🎭 Board capability derived from a person's real rank, then the enforcement layer: assigned-only projects vanish for the unassigned, contributor completions wait for approval, every project gets a visibility toggle and per-person roles
v0.8.0 → v0.8.12 — 👁 A virtual example project in every section, open while the section is empty · 🏛 the Appolis hub button — one popup of exactly the apps your ID opens · 🔌 Agora joins the suite-wide Appolis Connector as a room · ❓ decision forms productized: a session asks the board, anyone on the team answers · 🐛 the user bug-report feed · 🔗 Kosmos↔Agora project linking
v0.7.0 → v0.7.1 — 🧩 Kosmos engine parity ported, and every project born with a working-list scaffold shaped to its section
v0.6.0 → v0.6.1 — 🪪 Real teams and a real member directory from the Appolis registry; the stubs become offline fallbacks
v0.4.0 → v0.5.0 — 👤 Assignment: project crew, per-to-do and per-item owners, My Work, and a connector that dispatches · 🔗 the cross-app door so Kosmos can show your team work
v0.1.0 → v0.3.0 — 🏛 The shell: engine copied from Kosmos, team-keyed shared boards, Appolis ID from day one — then two rounds of pipeline reshaping on Tyler's reactions (not a CRM, not a customer-service app, ecommerce-first)

Shipped · v0.13.0

One board.
Nobody's work erased.

Live at agora.appolis.app on Cloudflare — one Durable Object per board, storage as a write-through mirror, Appolis ID as the door. Eight sections, five capabilities, 28 connector tools, a 30-day Trash.

357

assertions across 13 zero-dependency harnesses — node test/run.js, green

🔴→🟢

the concurrency and permission harnesses carry control legs running the OLD code, asserted to still fail

📄

a living breakdown doc that renders from real board data — and is compartmentalized like every other read

next · per-stage pipeline locks by role next · realtime sync & chat next · broader per-member layout preferences