[saucam]

Stacked on #464 (W3) → #463 → #462 → #461. Design: docs/workstreams-design.md §10, plus §12.2 "W4 as built". User guide: docs/CONFIGURATION.md, under "The conductor and workstreams".

What W4 enforces is on only with workstreams.isolateGlobalServers.

What

• Reading:
  • Fleet tools name each result's workstream, and fleet_list, fleet_find and fleet_recall take a workstream filter.
  • A closed workstream gives the conductor status and metadata only:
    • fleet_find and fleet_recall never return its sessions, not even a count of withheld matches;
    • fleet_summary gives status only, and machine_map leaves out its branches;
    • a worker of a closed workstream reports that it finished, not what it found.
  • Episodes from before workstreams are judged by their session's recorded home.
  • An orchestrator's own children (same workstream) still see their results. The conductor's tenant-wide board withholds them.
• Acting:
  • fleet_spawn takes workstream and is judged as a create is:
    • a folder with no workstream, or one whose remote changed, must name one;
    • an exclusive workstream's folder, or an ask workstream's, needs confirming;
    • a closed workstream's folder never takes another workstream's worker;
    • a closed workstream's workers stay in its own folders.
  • The check runs before queueing, and again at claim.
  • Confirmation (G3): the card names the workstream it would pass. Only the session owner's own approval of that card adds a one-time token to that very call. Its handler accepts the token only for exactly the verdict and config revision the card showed. The revision is stored on the task and checked at claim.
  • Every send-class card names its workstream: web, Telegram, the TUI, codeoid approve and the terminal.
• Egress: workstreams/egress.ts planEgress is a tested stub (G6). A message names its workstream and is sent by a worker homed there.
• Fixes:
  • The conductor now recalls its own episodes under isolation.
  • The fleet rail docks from md up, so a phone's approval card is no longer covered.

Audits

Two deep rounds, folded in.

• Round 1:
  • untagged pre-workstreams text was shown;
  • digests were withheld from same-workstream collaborations;
  • an unnamed spawn skipped the remote-changed guard;
  • an ask folder needed no confirmation;
  • delegated tokens could confirm, and the CLI didn't show the card's workstream;
  • query results leaked through counts.
• Round 2: a confirmation wasn't one-to-one with its card. Stale or denied approvals, approval-time revisions and leftover confirmations could all count. Now it's a token on the approved call. Round 2 also caught a URI-based "conductor-created" check, and confirmations from non-owner members.

Known limits (§12.2):

• No session cards exist yet (memory/cards.ts has no caller), so a closed workstream gives status rather than a rolling summary. This is on the backlog.
• Closing a workstream doesn't reach back: what the conductor was told before stays in its transcript and on fleet_tasks.
• The rail's board has no phone view.

Verification

• bun run typecheck and bun run lint are clean.
• Unit: 6158 pass and 1 fails. The failure is inside real bubblewrap > conversations are the session's own, which also fails on main on this machine.
• Web: the build is clean. 39 tests fail in auth-refresh, embed-refresh, handoff and prompt-drafts, the same set as before; the new ApprovalBar test passes.
• e2e: 23/23. workstreams-w4.spec.ts drives a real conductor's fleet_spawn card. It has screenshots at 375×667, 390×844, 768×1024, 1280×800, 1470×830, 1920×1080 and 1280×300, with on-screen geometry asserted, and I opened and checked each one.

🤖 Generated with Claude Code