Workbench store + brain write-permissions (t-243)

[mahoudeau]

bureau-internal/23 step 3. Mission: t-243. One knowledge.js mission, two outcomes per the mission body:

(a) /api/work — an ungitted per-mission evidence store

New hub/lib/work.js. Same attachment shape as /api/knowledge (base64 binaries, 5MB cap, same extension whitelist) but plain filesystem under BUREAU_WORK_DIR (default hub/work/) — no git commit, no provenance, no lint. Boss ruling: evidence is not knowledge.

Scoped under work/<t-id>/, wholesale garbage-collected the moment that mission's status becomes terminal (done/failed/discarded), wired into every door that can terminate a mission so cleanup never depends on which surface closed it:

• PATCH /api/tasks/:id
• the MCP update_mission tool
• the boss's approve capability-link (/r/:token)

(b) Per-compartment write permissions, hub-enforced

Same role-not-name pattern t-119 uses for gates (hub/lib/store.js gains isLibrarian, exported alongside the existing agentHasCapability/isLead/isCriticOrLead). knowledge/, recipes/ (global and entity), entities/*/PROFILE.md, and attic/ are writable via POST /api/knowledge only by a librarian-capability agent or author: "human" — refused with a 403 before it ever touches disk or git, nothing partially applies. journal/ and project trees are unaffected. The same wall applies to the MCP write_knowledge tool — consul is not a name-based exemption, it earns library write access the same way any other agent does.

Docs

docs/protocol.md: /api/work documented (table grows to "the eight calls"), the write-permission rule spelled out next to the existing boss-gate authorization paragraph it mirrors. docs/brain-format.md: the curation-law table marks which rows are now hub-enforced (⚙) vs. still convention-only; the binary-attachment paragraph now points evidence at /api/work instead of deliverables/.

Conformance

Two new sections in test/dummy-agent.sh:

• 6c: a plain agent refused on knowledge/, recipes/, entity knowledge/, entity PROFILE.md, and attic/; a librarian-capability agent and human both accepted; journal/ and project trees stay open — both the REST route and the MCP write_knowledge tool.
• 11: /api/work write/read/list/base64-attachment round-trip, off-whitelist refusal, not protected-compartment-gated, evidence survives while the mission is open, gone the instant it goes terminal, a 404 (not an error) reading a GC'd file, and GC firing from the MCP update_mission close path too.

Ran locally against a fresh scratch hub (BUREAU_DATA_DIR/BUREAU_BRAIN_DIR/BUREAU_WORK_DIR isolated, BUREAU_PUBLIC_URL unset so the MCP door resolves to localhost): 170/170 checks pass, 0 failures.

Deliberately not done here

A hub-side mechanical check of sol's provenance floor (refusing a knowledge write whose body carries no (source: [[...]]) link) — that's content validation, a different concern from the write-ACL this mission's own body actually asks for (two outcomes, (a) and (b) above, no third). Doc 23 mused it might "ride along... anyway" but the lead who cut this mission didn't put it in the Acceptance, so it isn't in this diff.

Gate is boss (protocol change) — same situation as t-242 (PR #78): this session can't clear a gate: boss mission into review itself (hub-enforced), so t-243 parks blocked with a note rather than forcing a status the hub would refuse.

---

Generated by Claude Code