[adrianwebb]

Superseded by #623: its authoring/gateway permission repair is included in checked head85eff60cd941058c04aa975746ab1c8d4838d01c, complete Verify40159462985/PASS, merged to staging2793e2a68a2b41d668f6f8a93fc20ecae60b4396 with identical tree read-back. This PR is closed as superseded, not separately merged. Original failed observations and work authority remain below and in #553.

Outcome

Repair the native inbox question-authoring permission failure observed while recording the real Deployment simulation-origin handoff. Grant the generated question path for writing and immutable readback; grant an agent question signal’s exact path during inbox synchronization. This slice does not yet connect questions to work-item execution gates.

Work authority

• Work item / Issue: Complete accounting transition observations for strict Agent acceptance #553; cross-project dependency Current deployment backlog: retained requirements after issue consolidation deployment#834.
• Proposal / decision: Deployment f7cc50fb-8984-42e3-aefd-7f0f2eddd418 v14 / 68de92c6-c5b4-49d7-94e4-abc8e83d858d supplies the real blocked workflow; API permission repair is coordinator bootstrap, not a contribution credited to that proposal.
• Assignment / checkpoint: native inbox.questions.create denied Permission denied using idempotency key simulation-origin-reviewed-runtime-handoff-question-20261025; API Architect discussion send-6ba9e85a4dcd78f3f20e55cede2ee3bc supplied source-backed diagnosis. No acting assignment or review approval claimed.
• Actor: Codex coordinator under adrianwebb authority.
• Human authority: adrianwebb; standing authorization to repair blocking shared boundaries through existing Issues.
• Agent / capacity provider: API Architect via native TreeSeed MCP supplied diagnosis; source repair authored by coordinator.
• Exact base ref: staging c8e18e2; depends on Read discussed plans and admit subscriber estimates with own-product reviews #615 at cc2d050.
• Exact head ref: codex/scoped-work-item-handoffs553 9054ba7

Contributor mode (select one):

• Human-authored
• Agent-assisted under human authority
• Agent-authored under human authority

Plan

Small first slice: reproduce missing question scope; authorize only the known question path; verify exact returned commit, path, and bytes; retain failures and close the workspace. Native integration and coded coverage use the existing original TreeDX fixture and component scene. Follow-up slices must connect existing relatedWorkItems to scoped graph conditions, verify exact answers, repair retry recovery, and stop re-admitting already-current estimators. Those behaviors are unresolved here.

Changes and commits

4e3cee8 requests workspacePaths for question authoring/readback and agent question synchronization. It retains the existing gateway and canonical TreeDX question format, rejects moved/missing/wrong-path/changed-byte readback before integrated journal recording, and closes failed workspaces. No broad relation scope or new store/model/runner is introduced. Prior commits belong to #615 and remain independently attributed there.

Verification

Focused regression before fix: four failing cases, including Permission denied. After fix: 11 cases across inbox question scope and gateway broker identity passed. Exact commands: TREESEED_SDK_SOURCE_ROOT=/tmp/codex-sdk-schedule496 node node_modules/vitest/vitest.mjs run --config vitest.control-plane.config.ts tests/unit/control-plane/knowledge/inbox/question-scope.test.ts tests/unit/control-plane/treedx/knowledge/gateway-broker-identity.test.ts; npm run check:file-lengths; npm run build:dist; git diff --check. All passed locally. Native TreeDX environment is absent locally; real integration and coded-scene verification are pending Actions. No new runtime activation or acceptance claim.

• I ran the narrowest relevant package verification and documented any checks that could not be run.

Risk and rollback

No migration. Exact readback rejects any transformed bytes; the native case must prove the owning transport preserves them. Revert only 4e3cee8 to restore prior question behavior; preserve authored TreeDX commits, retained products, and unrelated work. Do not revert the separately reviewed #615 base.

Completion summary

Draft pending exact-head full verification and #615 merge. Question-path permission repair implemented; runtime gate, exact-answer lifecycle, idempotent partial retry, repeated-estimation admission, and full simulation release remain unproven. No actual source implementation or release by the Deployment agents is claimed.

AGPL committer authorization

The base-owned approved-committer workflow remains authoritative; no grant or license change.

Submission checklist

• The change is bounded to the stated work item and target repository.
• Exact base and head refs are recorded and the branch is ready for review.
• Verification and compatibility evidence are recorded above.
• No plaintext secrets, credentials, machine state, or unrelated residue are included.
• Plan, status, commits, and completion summary form a complete durable record.
• Rollback or recovery steps are documented and executable.

Native failure and current replacement

Exact4e3cee8cd6ed3e3026875190049eabb5e1d53ff5 Verify40147338808 failed the new native question authoring case before complete verification: TreeDX denied workspace creation because omitted allowedPaths defaulted to [**]. Forty other focused prerequisite cases passed; this was not a qualified candidate. The failure is retained. Replacement f4d9b67 explicitly requests allowedPaths=[the generated question path] at workspace creation as well as the existing token/read scopes. A focused regression reproduced six failures/two denials passing before this correction; final11 cases/two files, policies, build and diff checks pass. Fresh exact-head native/full verification is pending. No failed evidence is counted as a pass. API615 has since merged as c7e9bab after complete40142447990 SUCCESS. Later scoped question graph/answer work is a separate unpublished candidate and is not part of this permission slice.

Writable-mode correction after the second native observation

Replacement f4d9b67 Verify40148206798 passed workspace creation but failed the new native changeset at files:write. The owning TreeDX workspace contract defaults omitted mode to read_only and omitted allowedPaths to [**]; the API omitted both. No token or policy broadening is appropriate. Current9054ba7e992b3711ba70b3c0d0788266dda3f4bb explicitly supplies mode=writable and exactly one question path, with exact write/readback scope. Unit regression reproduced six failures/two denials before the mode correction; final11cases/two files PASS, policies/build/diff PASS. Full fresh Verify40149077683 is running; native success, merge, and runtime adoption remain unproven. Historical permission failures above remain retained.