Wiki: editable task drafts, explicit thread dispatch and source backlinks

[oscarlehuu]

Outcome and current gap

From a private Wiki answer, create a task draft, edit its title/prompt, select a project channel and an available member agent, save or cancel, then explicitly Start thread. Only the reviewed prompt and chosen references enter the channel. The new thread links back to its origin without exposing the rest of the private question history.

Current WikiAskBox.tsx's 'Start thread with this plan' saves a channel draft using saveDraftEntry and navigates to the channel. That is a useful seam but not the prototype's selected-agent task dispatch, acknowledgement, durable recovery or exact source backlink. Reuse it and the actual root-message/agent mention/ownership pipeline; do not create a new task bus or a second thread registry.

Depends on #366's validated answer/origin contract, #364's source locators, existing #349 Project/channel relationships and #354 thread navigation/controls. Parent #344 records approved v0.9. #365's privacy constraints apply before sharing. #350/#355 role/contact work is not permission to assign a role or route to the contact point instead of the explicitly chosen agent.

Design contracts before coding

• A draft is private editable user state. Saving a draft publishes no event and wakes no agent. Cancel closes/discards only unsaved edits, preserves previously saved draft/history and does not clear a channel's unrelated existing composer draft.
• Source provenance is a structured immutable reference, not a private-history URL/token embedded for everyone. Channel members may inspect the shared source only under their actual repo access. The author can return to the exact private question/attempt; other viewers get the authorized Wiki page/context or an honest unavailable result, not the author's private transcript.
• Project/channel/agent choices use stable IDs and actual membership. A shared channel may be linked to multiple projects; use the verified Project relationships and request scope. Select only an authorized destination, never a guessed repo channel/name. Agent availability is rechecked at Start. A choice can be blocked with recovery; it never steals a busy session.
• One explicit Start represents one intended thread kickoff. Define the accepted point and acknowledge ambiguity: signed event accepted by relay, root recorded and agent wake are related but distinct. No exactly-once external-work claim follows solely from client debouncing.

Implementation order

1. Inventory production root-message creation, mention routing/assignment, thread workspace metadata and draft/outbox persistence. Name the actual command and event kind/tag contract. Identify the single authoritative kickoff event and the existing dedup/active-turn behavior; if agent acceptance requires additional durable work, record it explicitly. No new event kind without an evidence-backed decision.
2. Write RED at the real draft/dispatch seam: title/prompt edits and channel/member selection survive Save/reopen; Cancel does not publish; Start emits exactly the intended signed root payload with explicit chosen-agent mention and validated source references. It must not overwrite an unrelated draft.
3. Extend the existing draft persistence with a Wiki draft identity and versioned origin/reference fields. Keep snapshots atomic. Isolate community/viewer/project/repo keys; revalidate expired source and access rather than sending stale private data. Define retention/migration/corruption behavior with the approved private-history storage seam.
4. Prepare and persist the exact signed kickoff and pending operation before publication using the NEW or explicitly extended owner-local operation store accepted by PUB G-DURABLE; no existing generic message outbox is assumed. The same user action/retry reuses its event identity. Once relay acceptance is known, retain/reconcile the real root ID; a crash before UI navigation must recover that thread rather than create another.
5. Publish through normal channel-root/mention/ownership pathways with only the reviewed title/prompt and explicitly included citations. Do not dump full QA history, tool logs, hidden prompt context or runtime credentials into tags/body. Respect role/contact separation and existing permissions. Recheck membership and agent status immediately before handoff; stale picker state cannot authorize a send.
6. Render pending, accepted, rejected/retry and unknown/reconcile states. Disable duplicate Start during the same operation but do not rely on that UI flag for correctness. A timeout after send must reconcile the persisted event before offering a new kickoff. Cancellation after acceptance means closing the dialog or a separate explicit task-control action; it does not pretend to retract committed work.
7. Navigate to the confirmed existing root and show its chosen agent, channel, reviewed prompt and validated source references. No automatic worktree creation just to open the thread: use the existing task/workspace policy on actual execution. Add Back to Wiki with exact author-private origin restoration and safe behavior for non-author viewers.
8. Complete the real flow against Wiki: grounded private Ask, streaming and persistent question history #366 and Wiki: Project reading, full-text search and revision-bound source views #364, including reload after a saved draft and restart during ambiguous publication. Add all controls to CompanyOS: verify installed Hermes and second-runtime delivery workflow #357's installed acceptance inventory.

TDD and edge cases

• Save → navigate → reload → resume; edit → Cancel → reopen; empty title/prompt; very long prompt; no channels; new/removed/shared channel; project renamed/deleted; existing unrelated channel composer draft.
• Explicit agent selected while another contact is configured: only selected-agent mention drives this kickoff. Removed/renamed/busy agent, revoked viewer membership or repo access between open and Start cannot dispatch to an implicit fallback.
• Double click, Enter+click, repeated keyboard submit, two windows opening one saved draft, offline-before-send, timeout-after-acceptance, reconnect, app crash before/after each journal/publish/ack/navigation boundary. Assert stable signed event ID and one recovered root per intended action; document any remaining agent/external side-effect ambiguity.
• Source changed/unavailable; arbitrary URI/path; wrong repo/owner/source manifest; private question containing a canary. Shared payload contains only reviewed material. A second authorized channel viewer cannot follow the author's private origin into their history.
• Backlink after article change, another active question, deleted private history, deleted source page or another community login. Author returns to the exact origin when allowed; other paths fail safely and retain navigation recovery.
• Cancel draft creates no relay events, no assignment/session change and no worktree. Failed publish preserves a retryable draft/outbox record. Accepted publish with navigation failure still yields a recoverable real thread.

Test actual signed-event/root-message/outbox seams, not a mocked onStart callback. Mutation: remove persisted action/event identity or switch to a freshly signed retry and the acceptance-loss/double-submit test must fail. Verify private-origin authorization with two identities on isolated staging. Keep required CI and the real installed walkthrough separate from mock dialog screenshots.

Current WikiAskBox.tsx:136 saves under the channel composer key, overwriting its unrelated draft. Add an explicit private wiki: draft key namespace scoped to the full viewer/community/project/repository identity, analogous to existing thread: keys, or the accepted G-DURABLE equivalent. useDrafts.ts:350 drops empty text and its eviction caps the shared map at 100: define empty/title-only draft handling and protected/partitioned retention so a Wiki save does not silently evict unrelated active composer drafts. Bind these tests to actual save/eviction code.

Definition of done

• Editable private drafts persist atomically; Save/Cancel cannot post or destroy unrelated drafts.
• Start explicitly targets an authorized channel and chosen member agent through existing Buzz contracts.
• Lost ACK/crash/retry resolves to the intended persisted kickoff/root without accidental duplicate submission.
• Shared content is exactly the reviewed material and validated citations; private history is not exposed.
• Author-safe and other-viewer-safe backlinks work with permission/missing-data recovery.
• Real runtime/thread evidence, production-bound tests/mutation, CI and docs meet CompanyOS: verify installed Hermes and second-runtime delivery workflow #357's inventory.

Durable storage and compatibility gate: consume PUB G-DURABLE; no generic message outbox/private-history store is assumed to exist. Any new store is an explicit Crew-owned seam on existing Buzz events, with private data kept separate from shared publish records. Record the D-061 item 4 successor/amendment for real private Ask and explicit signed dispatch instead of the old Auto/Q&A/Plan prefill-only behavior.

Execution and review contract

Follow #344's shared execution/review contract and its v0.9 source gate. Canonical local reference is design/companyos/; #344 must publish its exact immutable public-safe commit before dependent UI work. Prototype approval is not backend evidence. Preserve existing 30023 company knowledge and reachable access until its replacement entry is resolved.

Use full repository coordinates within the canonical relay/community boundary, existing Buzz models and the approved G-DURABLE seam. Follow the issue's production-bound RED/GREEN/edge-case/mutation steps, narrow checks then required final just ci, isolated staging #348 and CI registration. No daily-data fault fixtures or parallel heavy suites; incorporate #359/#360 hook isolation before Git fixtures once merged. Executors produce signed-off PRs; coordinator and an independent GPT-5.6 Luna reviewer at Max reasoning both approve the exact final head before merge. #357 owns installed/release acceptance.

Handoff: exact source/base/head SHAs; accepted seam/decision; RED/GREEN/test counts and mutation/restoration; real revision/identity-scoped runtime/readback evidence; updated living docs; explicit unresolved gates/limits. Do not hide approved controls or substitute sample success.

Plan review: reviewed on 2026-09-09 by the coordinator against production source and through actual Claude Code CLI Fable Medium (--model claude-fable-5-1 --effort medium; returned main model claude-fable-5-1). Initial findings and the bounded correction review are incorporated. READY for issue publication; named implementation/proof/source gates remain open. This review did not implement or test the feature.

[oscarlehuu]

Feasibility checkpoint — 2026-09-10

This is a source-only status update. No signed root was published, no channel dispatch was attempted, and no issue is complete.

Status: GATED by #366 and the #349/#361 native transport/access seam. The current WikiAskBox.tsx Start path calls saveDraftEntry(target) in the ordinary channel composer namespace and navigates to the channel. It can overwrite an unrelated composer draft and does not persist an exact signed root, reconcile an ACK, or protect private Ask history. It must not be treated as the production handoff contract.

Safe independent work is limited to an inert review projection: edit/display the reviewed public title, prompt, and validated source references while keeping Start unavailable. No private question, omitted context, tool output, runtime configuration, credentials, or history token may enter a shared event. The native snapshot verifier’s signed page/manifest references can be displayed only after current access is separately checked.

The approved eventual handoff requires one explicit action UUID and one exact signed kind-9 root, private authorization persisted before shared intent, the same sanitized payload in the owner-operation recovery record, and a native cancellation CAS that wins before the transport send-permit or reports too_late_may_have_sent afterward. Retries must reconcile or reuse the same signed event; they may not re-sign after the relay’s timestamp window expires. These are design requirements, not shipped behavior.

The decision-changing gap is a validated #366 answer/origin plus an integrated native owner transport that can recheck scope, membership, selected agent, source access, and the private cancellation/send-permit boundary. Until that is proven with real signed events and recovery readback, #367 must not dispatch, create a thread, or expose a private backlink.

[oscarlehuu]

Current source correction — 2026-09-12

PR #395 removed the Start-thread projection and its saveDraftEntry/channel-navigation fallback. Current main does not overwrite a channel composer draft from Wiki Ask. The previous comment describes the older implementation.

#367 remains GATED by the private Ask/origin contract. No signed root dispatch, durable owner-operation recovery record, cancellation/send-permit boundary, ACK reconciliation or private backlink has been implemented or proven by this unavailable projection. No channel event or thread was created during this source audit.