Memory
# 014 — Worksphere integration: boards as window first, work surface later Date: 2026-09-11. Status: Proposed. ## Context Worksphere's direction (operator-stated 2026-09-11, not yet code): each worksphere is a DO giving multiple external agents a place to track work AND, where the task suits, do the work — MCP access for external agents is the point. Work that cannot run inside stays outside, and worksphere keeps coordination, provenance, tracking, and evidence for it. Where the task fits, the tool surface (codemode) lets the external agent perform the work or direct an internal agent to do it. Code check, same day: worksphere's MCP/codemode surface is not built — `README.md:13` lists chat UI, MCP, browser, codemode as stripped later slices, and every session handover carries `Do not: … OAuth/MCP/…`. What exists is the seam it will plug into: `canonical-callsign-mechanics.md` §9 already mandates every identity-requiring tool take an explicit `callsign`, and the framework deps already carry `@cloudflare/codemode` + MCP SDK transitively (lockfile only — capability present, surface not). Treat "worksphere serves MCP" as operator direction, not verified state. Edge-boards today is the mirror image: MCP live (9 tools, `src/mcp.ts`), versioned panels + views, `directory` index, `callerOf()` token/access/service gate — but only a shared-secret identity (006's own caveat) and no notion of callsigns, approvals, or attribution. An earlier draft of this note laid out display/integration/peer postures without the MCP keystone. This revision corrects that: the integration seam is tool-level (two MCP surfaces + callsign on every tool), not DO-level. No repo merge is proposed (D5: deliberate duplication stands). ## Decision Phased combination, in this order. Each phase ships and rolls back independently; no phase smuggles the next one's coupling. **Phase 0 — boards as window (now).** Boards render worksphere state, read-only: approvals queue, decisions log, attribution log, project file summaries → `datagrid`/`json`/`markdown` panels + views. Agents use boards to display data to the user and to see what a worksphere contains. Sync is a service-token reader doing `write_panels`; no identity merge, no write coupling, estate/canary untouched beyond a read tap. This is the "simpler piece" and it stands alone as useful. **Phase 1 — peer contract.** Thin ID conventions both sides honor without synchronous calls: board slug ↔ project slug, `senderId` ↔ callsign, `revision` ↔ event cursor; `board_url` attached to approvals/projects, worksphere refs inside `json` panels. Dangling refs warn, never fail (precedent: 002 index staleness). **Phase 2 — boards as work surface (gated).** Callsign-attributed, approval-gated board mutations — only after the B-spikes (in-worker verify, fail-closed vs fail-open semantics, D1 per-client mapping) go green. Vehicle is a `BoardWorkSphere` child facet, not a merge: facets ride the existing `WorkSphereAdmin` binding with no new DO class or migration bump (proven by `ProjectWorkSphere`, which has no binding of its own yet spawns live). **Boundary rule.** Window reads cross freely (both sides are reads-open). Surface writes cross only with callsign + approval. This one sentence keeps 004/006/013 and the callsign/credential rules compatible without either side bending. ## Consequences - D5 respected literally until the evidence earns otherwise. Re-decide trigger: a joint provision-pipeline or joint verify path appears — that day a shared surface is proposed as its own brief, never executed mid-brief. - Recorded alternatives, not pursued now: (a) display-only forever (keeps lag + dual-source reads permanently); (b) identity-plane-first (strongest coupling before the contract is proven); R1 boards inside the parent DO (rejected: all boards serialize through one instance, single blast radius for registry + content). - Spikes (dead-code / canary-only discipline throughout): S0 window prototype — one board projecting the canary approvals queue (static or service-token sync; proves display value with zero coupling); S1 Think + `@cloudflare/computer` coexistence in one bundle through the canary dispatch path, adapter dead-code only; S2 child facet serving a board live socket under the router prefix with the `grep -c` absolute-URL attestation at 0; M1 MCP contract — callsign arg shapes on both tool surfaces per canonical §9. - Open: push vs poll for window sync (AD-G `notify`/`ingest` is the hook); per-client board deployment under D1; projection lag tolerance for approvals immediacy. - Dual navigation (proven 2026-09-11, vendor-access thread): one routing layer, two navigators. Agents traverse `/v/` specs (state, revisions, bindings); users traverse `/b/` pages (rendered components) — same nodes, same edges, different projections. With the graph in place, both navigate one topology: agents follow `derived_from` to gather context, users follow the same edge to see lineage. The view spec is the shared contract; revision-pinned summary panels beside machine payloads are the replicable capsule shape. [Digest: a4687774-1193-41be-a5b0-a5532055f0ae]
Tags: filename:014-worksphere-integration.md, type:markdown, kind:semantic, rolled-up — Source: document — 2026-09-11 16:40:22 UTC