[saucam]

Stacked on #463 (W2) → #462 (W1) → #461 (W0). Design: docs/workstreams-design.md §5.3, §6.4, §7, and the new §12.1 "W3 as built". User guide: docs/CONFIGURATION.md → "Reading another workstream, and moving a session".

Everything enforced here is on only with workstreams.isolateGlobalServers, the same switch W1 uses.

What

• Read fence.
  • What it covers: every other workstream's folders. These are its path rules expanded on disk (workstreams/folders.ts; bounded, links followed only where a rule names them) plus the folders recorded as its sessions' homes. The fence is not "everything outside the home", which would refuse toolchains and system headers.
  • Nested folders: the more specific rule decides. Inside a foreign folder, only WorkstreamFence.readable stays open: the session's own workdir, its home's folders, and exactly what its references grant.
  • Sandbox: the project roots become the home's and references' folders, never the bare @parent. Everything else in a foreign folder is hidden (extraHidden, carveOut), and an added dir inside a foreign folder is never kept.
  • Gate: workstreams/gate.ts checks every tool call's read, search and write paths in every mode. Claude's PreToolUse hook refuses the same calls, because the CLI skips canUseTool for some of them.
• Memory.
  • Episodes record workstream_id when written.
  • recall, timeline and get_episode keep to the home and its references (MemoryEngine.scopeSession).
  • The session-map seed is filtered the same way. The frozen index is left out where the repository's memory is mixed.
• References and moves.
  • Protocol: session.create.references, session.add_reference, session.remove_reference and session.set_workstream.
  • The share policy of the workstream being read decides. open is granted; ask needs the owner's own undelegated approval, or a confirm on the session that is judged again when answered; closed is refused.
  • A move follows the policy of its old home and of every workstream it has read from (readFrom, kept for the session's lifetime). A home inside another workstream's folder counts as reading that folder.
  • Changes are saved at once and applied at the next turn.
  • A stored binding that can't be read back seals the session: no home, and it never moves.
• CLI: codeoid new --ref, codeoid workstream ref add|rm, codeoid workstream move.
• Web:
  • The new-session dialog has an "Also reads" picker.
  • The session header's chip opens a panel to read another workstream, remove a reference, or move the session.

Audits

Two deep rounds, folded in:

• Round 1 (fix: … round 1):
  • nested foreign folders weren't fenced;
  • path-limited references granted their whole folder;
  • a dotfiles ~ became a repository top;
  • moved sessions were fenced out of their own workdir;
  • path extraction missed Glob, ACP, pi;
  • added dirs could open the fence;
  • inputs could seal a binding;
  • the prompt-side memory wasn't filtered.
• Round 2 (fix: … round 2):
  • monorepo tops widened access;
  • reference paths could leave their workstream through .. or links;
  • changes applied mid-turn;
  • a move forgot the old home;
  • a home in a closed workstream's folder was allowed.

Known limits are listed in §12.1:

• recall isn't filtered by a reference's folders;
• remote-only workstreams are fenced once a session has been opened there;
• Bash in an unsandboxed session isn't asked about;
• the conductor's fleet reads are W4's.

Verification

• bun run typecheck and bun run lint: clean.
• Unit: 6147 pass, 1 fail. The failure is inside real bubblewrap > conversations are the session's own, which also fails on main on this machine.
• Web: build clean. 39 failures in auth-refresh, embed-refresh, handoff and prompt-drafts, the same set that was failing before; the new chip and dialog tests pass.
• e2e: 22/22, including workstreams-w3.spec.ts (CLI references and moves; the web UI's dialog and chip panel). It has screenshots at 375×667, 390×844, 768×1024, 1280×800, 1470×830, 1920×1080 and 1280×300, with the geometry asserted, and I opened and checked each one.
• CI runs only on PRs into main, so these checks run here once the stack below merges.

🤖 Generated with Claude Code