fix: preserve shared groups in native proposal planning

.github/workflows/publish.yml

@@ -29,7 +29,7 @@ jobs:
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
         with: { node-version: 24 }
       - run: npm ci --ignore-scripts --no-audit --no-fund
-      - uses: treeseed-ai/sdk/.github/actions/install-exact-sdk@8536de5233983765a049392f307244d741470480
+      - uses: treeseed-ai/sdk/.github/actions/install-exact-sdk@b754118c8035913b20ca9663ca418d48fa4dce05
         with: { github-token: "${{ github.token }}" }
       - run: npm run capacity-provider:build -- --prepare-only
       - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
@@ -69,7 +69,7 @@ jobs:
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
         with: { node-version: 24 }
       - run: npm ci --ignore-scripts --no-audit --no-fund
-      - uses: treeseed-ai/sdk/.github/actions/install-exact-sdk@8536de5233983765a049392f307244d741470480
+      - uses: treeseed-ai/sdk/.github/actions/install-exact-sdk@b754118c8035913b20ca9663ca418d48fa4dce05
         with: { github-token: "${{ github.token }}" }
       - run: npm run capacity-provider:build -- --prepare-only
       - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f

.github/workflows/verify.yml

@@ -76,7 +76,7 @@ jobs:
           mkdir -p node_modules/@treeseed/deployment/node_modules/@treeseed/sdk
           tar -xzf .treeseed/tools/deployment-build-sdk/treeseed-sdk-0.13.0-rc.122.tgz --strip-components=1 -C node_modules/@treeseed/deployment/node_modules/@treeseed/sdk
           npm install --prefix node_modules/@treeseed/deployment/node_modules/@treeseed/sdk --omit=dev --ignore-scripts --package-lock=false --no-save --no-audit --no-fund
-      - uses: treeseed-ai/sdk/.github/actions/install-exact-sdk@8536de5233983765a049392f307244d741470480
+      - uses: treeseed-ai/sdk/.github/actions/install-exact-sdk@b754118c8035913b20ca9663ca418d48fa4dce05
         with:
           github-token: ${{ github.token }}
       - name: Prepare disposable native relay CA

package.json

@@ -68,7 +68,7 @@
   "dependencies": {
     "@openai/codex": "0.158.0",
     "@treeseed/deployment": "https://github.com/treeseed-ai/deployment/releases/download/0.1.0-rc.243/treeseed-deployment-runtime-0.1.0-rc.243.tgz",
-    "@treeseed/sdk": "0.13.0-rc.122",
+    "@treeseed/sdk": "0.13.0-rc.124",
     "esbuild": "0.28.2",
     "typescript": "^5.9.3",
     "yaml": "^2.8.1"

tests/modern/kernel/architecture/custody/context-custody-readback.test.ts

@@ -1,7 +1,7 @@
 import { describe, expect, it } from 'vitest';
 import { state } from '../golden-readback-fixture.ts';
 import { verifyDraftProposalHandoff, verifyUnfinishedDraftHandoff, verifyExactContextSource, verifyKnowledgeBookSource } from '../../../../acceptance/workday/support/assignment-authority.ts';
-import { stringify } from 'yaml';
+import { parse, stringify } from 'yaml';
 import { exactContext } from '../portable/context-fixture.ts';
 import { createHash } from 'node:crypto';
 import { prepareTreeDxContent } from '../../../../../src/kernel/treedx-content-commit.ts';
@@ -210,3 +210,30 @@ function knowledgeFixture(status = 'review') {
 		expect(state.calls).toEqual([]);
 	});
 });
+
+
+const target = { store: 'treedx' as const, model: 'proposal', id: 'complete-scoped-snapshots',
+	repository: 'treeseed-ai/ui-library', commit: 'a'.repeat(40), path: 'proposals/complete-scoped-snapshots.mdx' };
+const frontmatter = { schemaVersion: 'treeseed.proposal/v1', id: target.id, projectId: 'ui',
+	title: 'Support complete scoped activity snapshots in UI', status: 'draft',
+	request: 'Replace complete snapshots, including empty results, while retaining incremental activity updates.',
+	groupIds: ['portfolio-atlas'] };
+
+describe('kernel proposal group custody', () => {
+	it('retains the shared team group when preparing a real planning product for TreeDX', () => {
+		const input = { frontmatter, body: 'The shared UI component owns snapshot replacement; Admin consumes the same contract.' };
+		const before = structuredClone(input), result = prepareTreeDxContent(target, input);
+		expect(parse(result.content.split('---')[1]!)).toEqual(frontmatter);
+		expect(result.content).toContain(input.body);
+		expect(result.digest).toMatch(/^sha256:[a-f0-9]{64}$/u);
+		expect(input).toEqual(before);
+	});
+
+	it('rejects individual targeting and malformed shared membership before any write', () => {
+		for (const extra of [{ agentIds: ['ui/engineer'] }, { agentSlugs: ['engineer'] },
+			{ groupIds: ['portfolio-atlas', 'portfolio-atlas'] }, { groupIds: ['bad group'] }]) {
+			expect(() => prepareTreeDxContent(target, { frontmatter: { ...frontmatter, ...extra }, body: 'Bounded real UI work.' }))
+				.toThrow('treedx_content_invalid');
+		}
+	});
+});