Memory
# S0 spike spec: automated window projection (for the worksphere coordinator queue) Companion to `docs/worksphere-coordinator-note.md` (filed as-is, do not amend). This file is the queueable unit: pass alongside the note when the time comes. No action until v12 lands, clear of v13. ## Goal `VERIFIED` — a worksphere queue projected onto an edge-boards board without a human driving the loop, proving the Phase-0 "window" can run unattended. Estate and canary code untouched; the only writes anywhere are board DATA on edge-boards (separate deployment, separate DO namespace — zero shared state with worksphere). ## Proven substrate (why this is low-risk) 2026-09-11, edge-boards production: an external agent built `vendor-access-1` → `vendor-access-rules-1` → revision-pinned `vendor-access-run-1` + rendered `overview` view entirely through the live MCP surface (`runs/2026-09-11-compliance-phase0-1.md`). The manual loop is proven; S0 automates it. `check_board` pre-write validation held; `register_panel`/`render_view` confirmed live in `tools/list`. ## Scope authorisation - Reads: canary `GET /api/approvals` (+`?for=`), `GET /api/approvals/decisions` — read-only, no state change. - Writes: edge-boards `write_panels`/`render_view` on ONE board only (suggested slug `worksphere-approvals-window`), authenticated by our `WRITE_TOKEN` — never a worksphere credential, never reversed. - Explicitly out: any POST to worksphere, any migration/binding/config change on either side, any estate deploy, any `worksphere-test` or canary residue touched. Residue on our board left in place (P8 mirror). ## Steps 1. Tier 1 — static projection (no credential question): hand-copy one canary queue snapshot into the window board (`queue` datagrid + `as_of` markdown with canary version id + timestamp). Proves rendering + prefix-safe board URL sharing with zero coupling. 2. Tier 2 — sync reader (only with a coordinator-named credential): poll `GET /api/approvals` on an interval, `write_panels` on change, `as_of` updated per sync. Credential class is the coordinator's call — the endpoint is owner-scoped, so "which presenter" needs their ruling, not our invention. Until named, Tier 1 stands as the window. 3. Verify: projected rows == canary queue rows (count + ids `<type>:<subject>`); `as_of` fresh within the poll interval; board URL renders behind no login; scoping negative re-run (no cross-owner items — the v11 standing green, re-attested on new markup). 4. Record (our `runs/`) + push; close-out exchanged to the coordinator in their run-record shape, mirrored. ## Evidence bar (suggested — coordinator amends) - Verbatim: one canary queue fetch, one window-board `get_board`, counts equal; `grep -c` absolute-URL attestation on any new markup → 0; scoping negative green; dry-run sizes if any code is touched (none expected — harness/script only). - Hard-gate candidate: break the `as_of` update → projection shows stale-with-warning → red → restore. (Staleness-visible, never silent — the 002 precedent applied to projections.) ## Known constraints (decided, do not rediscover) - v12/v13 absolute priority; this waits. - D5 duplication stands: contract + scripts only, no shared repo, no cross-deployment transactions. - Credential for Tier 2 is decided by the coordinator (or deferred with owner + trigger per P10). The executor builds compensation (Tier 1), never invents a presenter. - Spike configs stay uncommitted (F-7); commit-before-deploy (P6) if a deploy ever enters scope (none planned). [Digest: a4687774-1193-41be-a5b0-a5532055f0ae]
Tags: filename:worksphere-s0-spike.md, type:markdown, kind:episodic, rolled-up — Source: document — 2026-09-11 16:44:43 UTC