feat(workspace): Workspace Projects — seams, MCP tools and gated UI (ent#661 v1–v3)

[dolho]

Summary

Workspace Projects: the open-core seams, the agent MCP tools, and the gated Workspace UI for Abilityai/trinity-enterprise#661 (v1–v3). The project logic lives in the private module, which lands in its own PR. This PR has the edition-agnostic seams and the surface the module fills in. On an OSS build every seam returns nothing, and the UI is hidden.

Fixes Abilityai/trinity-enterprise#661

Seams (backend)

• services/turn_context.py: a provider registry for extra lines on a Workspace chat or room turn. It carries whether the audience is internal. It's wired into both arms of portal_chat and into shared_sessions._wake_agent. With no provider, nothing changes.
• services/portal_capabilities.py: a capability registry for the Workspace roster, which fails closed. PortalRoster.projects_available is the only channel the UI reads (bug(workspace): multi-agent chat picker is offered on builds with no rooms backend — 404 dead end #2128).
• ask_service.raise_ask(addressee=): a gate raise may name exactly who is asked. An agent's raise still can't.
• raise_ask(platform_execution_id=): ask_operator forwards X-Trinity-Execution-Id (feat(pull): platform-injected execution id for the side-effect guard — Tier-6 T6.3, blocks default-ON for side-effect agents #2392). When the id is the raising agent's own execution, it's recorded as the ask's execution and wins over an agent-written context.execution_id. manual, an unknown id, or another agent's id changes nothing.
• enterprise-docs-guard.yml now also scans the two new seam files.

MCP (tools/projects.ts)

• Read: list_projects, get_project, list_project_tasks, get_project_log.
• Write: create_project_task, update_project_task, add_project_task_note, add_project_log_entry, link_to_project (a file, report, decision, or an ask the agent raised).
• Steward: get_steward_digest, set_project_health.

The tools are license-blind (404 means no module; a plain-string 403 means unlicensed). Every call forwards the platform-supplied X-Trinity-Execution-Id, never a tool parameter. The module answers only in a turn whose audience is internal.

Workspace UI (gated on projects_available)

• A Projects list with an "I steward" tab, and a project page with Overview, Tasks, Log, and Files & reports.
• Overview covers:
  • health, set by the steward or creator;
  • where it stands: tasks by status and what needs attention;
  • linked agent metrics: value, trend and the platform's stale verdict;
  • Needs you: the viewer's own asks on the project, answered in place. PortalAsks gains an askIds filter that can only narrow the viewer's own list.
• The members, guests and import dialogs.
• A rail tab and chat/room header controls (link, detach, make a project, Wrap up).
• A narrow guest view for invited outside clients.
• Tokens only. Light and dark. Fits a 390px phone.

Docs

docs/memory/requirements/public-access.md §48.4 (FR-1…FR-7), plus architecture/backend.md and architecture/workspace.md. They describe the seams only.

Screenshots

To be attached by the author: the v3 overview (health, where it stands, metrics); Needs you with an ask raised in a project chat; the I steward tab; an agent working inside a linked chat; the project log after Wrap up; the guest view; and an outside client asking the agent about the project and being refused.

Test plan

• Backend: ent661 unit tests (turn context, wiring, ask addressee, ask turn, roster capability) and the ask/queue/turn-audience set: 1,141 passed.
• MCP: 604 passed. tsc --noEmit is clean.
• Frontend: 3,889 passed, including mount tests for every write gate (Safety-critical UI logic keeps landing in the one tier with no executable coverage — and the stated reason is false #2918) and the raw-colour, loading-gate, source-text and theme-switch ratchets. The design-token check and npm run build both pass.
• Mutation checks: disabling the health gate and the "only my asks" filter each turns a test red.
• Live click-through on a local stack, with a real agent turn:
  • agents create tasks and write the log through the tools;
  • Wrap up;
  • import;
  • guest view;
  • an outside client is refused by the tools;
  • an ask raised in a project chat appears under Needs you;
  • an agent steward runs the digest and sets health.
• Enterprise docs guard grep over the diff: no hits.

🤖 Generated with Claude Code

[vybe]

merge-train: this PR is on today's train with #3122, #3120 and #3085. It validated READY at lane C: /review and /cso --diff found nothing blocking. The docs-guard change only adds coverage, and on its own this PR does nothing until the enterprise module registers projects.

Merge order: this PR, then abilityai/trinity-enterprise#732, then the submodule pin bump. ent#732 imports turn_context, portal_capabilities and raise_ask(addressee=) from here.

Follow-ups. None of them block:

• docs/memory/architecture/mcp-server.md has no row for projects.ts, which adds 11 tools.
• The chat arm's internal_audience=bool(include_owned) in client_portal/service.py is only asserted through inspect.getsource. It decides whether an internal-only project line can reach a turn a client can read, so a test that drives a turn through portal_chat would pin it.
• The strict is True in portal_capabilities.has isn't pinned: changing it to bool(...) leaves everything green.
• There's no feature-flow doc for Projects.
• abilityai/trinity-enterprise#661 needs status-in-dev set by hand after the merge, because cross-tracker keywords don't get promoted.

[vybe]

merge-train: batch validated on train/20260930-1429 (#3126, all gates green)