[webmixgamer]

Summary

PR 2 of abilityai/trinity-enterprise#837 (AC5 + AC7): the platform role on Agent Detail › Access, and a user assigned to a companion answers its asks in the Workspace Inbox.

• Role route. PUT /api/users/{username}/role refuses every key (reject_non_interactive_principal — require_admin alone admitted trinity-system's key and an admin's user-scoped key, so either could promote anyone to admin), writes a role_change audit row (from → to; no-ops and refusals write none), and points the person's whitelist row at the new role, so a demotion can't be undone by re-binding the account away and signing in with the old address.
• Access tab. For an admin whose role the server verified: a role select on every other Active row — every change confirmed; a cancel, Esc or refusal puts it back; one save at a time — and Give a platform account on a Pending row (confirmed: a platform account sees the team view; colleagues, not outside clients). Both sit in one fixed-width slot per row. "never signed in"; the list reloads in place (viewState; loading-gate baseline 1 → 0). Everyone else keeps the read-only label and the pointer to Settings.
• People this agent serves. Each person's role as a badge and in the pickers (Name · Workspace only). Assigning someone writes the assignment, then shares the agent with them (never the owner, yourself, or an account with no email; 409 = already shared) — an assignment alone isn't access: the Inbox lists asks only from agents on the person's roster. An admin sees "Not shared with …" + Share with them on an assignment the agent isn't shared for.
• Settings › Email Whitelist. Source reads "Access tab" for rows given from the Access tab and shows any other unlabelled source as stored, never "Manual".

Changes

• Backend: routers/users.py (gate, audit, whitelist sync), db/email_auth.py + database.py (set_whitelist_default_role)
• Frontend: AccessPanel.vue, AgentAssignmentsSection.vue, AgentDetail.vue, Settings.vue, new stores/users.js, utils/workspaceOnly.js, utils/emailWhitelist.js, loading-gate-baseline.json
• Tests: tests/unit/test_837_role_change_audit.py, tests/unit/test_837_assigned_user_inbox.py, accessPanelMembers.mount.spec.js, agentAssignmentsShare.mount.spec.js, emailWhitelist.spec.js; tests/registry.json
• Docs: requirements/auth.md §2.10, the workspace-only-role / role-model / agent-sharing / email-authentication flows, the API catalog + security area, the upgrade note, user docs, docs/security-reports/cso-diff-2026-10-12-ent837-access-role.*, two learnings fragments

Test Plan

• New unit tests: test_837_role_change_audit.py (15), test_837_assigned_user_inbox.py (2 — a real user JWT through the Workspace door and the real roster). Every gate, the audit, the whitelist sync and the assign-then-share order are mutation-proven.
• Related backend batch: 936 passed, 9 skipped; frontend: 5680 passed (the 3 host-only files markdownCodeBlocks, roomComposerChain, roomStopWork fail as on dev).
• /verify-local --skip-agent: build + import smoke, boot + health, test preflight OK; integration 69 passed, 13 skipped (agent-dependent with --skip-agent, no PostgreSQL), 2 deselected (known false fails). Unit stage: 25 479 passed; the 3 test_3262 system-seed failures appear only under TRINITY_DEFAULT_SYSTEM_MANIFEST=disabled (10/10 without).
• /cso --diff: 2 pre-existing findings fixed here (machine keys on the role route; a stale whitelist role undoing a demotion); report in docs/security-reports/.
• Eyeballed on localhost: all 11 recipe checks, including AC7 end to end (a new member given an account, made primary, answered an ask in the Inbox) and the six layout follow-ups (aligned slot, no caption, link-style "Share with them", compact Kind select, full-height Add, phone-width share box, Source "Access tab").

Merge order

The account endpoint behind Give a platform account is a private-module change, abilityai/trinity-enterprise#874. That PR merges first; this PR then gets one more commit bumping the enterprise submodule pointer to its merge commit (b5080b6 -> <merge>). Don't merge this PR before that commit lands. No DB migration.

Fixes abilityai/trinity-enterprise#837

🤖 Generated with Claude Code

[obasilakis]

Validated at e7350a9. Approving the content.

Checked:

• Tier 1 is green, plus journey-smoke and e2e.
• The 17 new backend tests pass, and each fix is mutation-proven: removing the interactive-principal gate fails 3 tests, removing the whitelist sync fails 2, inverting the audit condition fails 4.
• The two component specs mount the components (no source-text reads).
• AccessPanel.vue raw-color count is unchanged from dev (3), and the loading-gate baseline drops 1 → 0.
• No secrets, host paths, or enterprise-design disclosure in the diff.

Two notes for the author:

1. The whitelist sync runs on promotion as well as demotion. Raising someone to admin sets their address's row to admin, so if that account later re-binds to another address, the old address signs in as a new admin account. The CSO report covers the demotion direction only. Please confirm this is intended.
2. The role, the audit row and the whitelist row are written in sequence. A failure in the whitelist write returns 500 with the role already changed. Low severity.

Merge order per the PR body still applies: trinity-enterprise#874 merges first, then the submodule-bump commit lands here and Tier 1 re-runs on it. status-in-dev on trinity-enterprise#837 needs setting by hand after merge, since the closing reference is cross-tracker.

[webmixgamer]

Thanks for the review. Both notes are addressed in 5606b7dc7; the pointer bump is c39d737ce.

1. The whitelist sync on promotion. That was not intended. Raising someone to admin set their old address's whitelist row to admin, so after a re-bind that address could sign in as a second admin account. A later demotion of the first account would not reach it. The row is now capped at the new role: lowered, never raised (db.cap_whitelist_default_role, one conditional UPDATE). New tests replay the re-bind in both directions and cover a row that is already below the new role. Letting the row rise fails 2 tests.
2. Write order. The cap now runs before the role write. A failed whitelist write leaves the role unchanged, so the only partial state is a row that has already been lowered. A new test covers it, and moving the cap after the write fails it.

Pointer bump: b5080b6 -> f8d1d3c. That is trinity-enterprise#874's squash commit on private main, with the same tree as the reviewed 90c6b5f. The enterprise migration graph has one head.

status-in-dev on trinity-enterprise#837 will be set by hand after merge.