Team

Tenancy is a column, enforced on every query

A workspace belongs to exactly one org, and that org is a column on the row. Every read and every write MUST be scoped to the caller's VERIFIED org (apps/team/account_store.go:32, :65). Composite uniqueness is on (org, slug) and (workspace, user), so two orgs may hold the same workspace name and neither can address the other's.

The membership rows ARE the authorization. On the identity lane nothing about a workspace is signed, so what a caller may touch is decided per request against those rows and never by a claim the caller carries (apps/team/account.go:971-975).

Two lanes, and one of them carries no credential out

A caller resolves either from a verified identity token — narrowed to this deployment's own audience — or from a token this service minted itself.

On the identity lane the credential MUST NOT leave the resolution: the session RPC echoes a token back to page script, and an identity access token is an estate-wide bearer that reaches every other service. The login flow puts it in an HttpOnly cookie precisely so script cannot read it; echoing it would hand it back to the script the flag exists to keep it from. The lane therefore carries no credential out at all, structurally, so a future echo site cannot reintroduce the leak by forgetting (apps/team/account.go:976-992).

The minted arm exists because one read still answers for "the workspace the credential pins", and the identity lane pins none. Removing it is a client change: the client names the workspace and the server authorizes it against the rows, the way the document and file planes already do.

No signing secret means health only

When the signing secret is unset or is the public default, the subsystem serves HEALTH ONLY: every route under the address answers 503 and NO token is ever decoded or accepted (apps/team/team.go:293). A forged token cannot be used because nothing verifies one.

Mount MUST still SUCCEED. Erroring at mount fails the whole composition and takes every other subsystem in the binary down with it; refusing at the route is the same safety with none of the blast radius.

The refusal MUST be applied per route and MUST NOT wrap the liveness probe. A prefix-wide middleware risks catching it, and a degraded subsystem that also reports itself dead cannot be diagnosed.

The file plane repeats the boundary physically

A workspace blob's key embeds org, workspace and blob id (apps/team/files.go:289), so an identifier from another org or another workspace does not resolve. The caller MUST additionally be asserted a MEMBER of the named workspace — not merely same-org — before anything is stored or served, and every denial is a 404, so the plane is neither a membership oracle nor an existence oracle.

Three independent layers for one property is deliberate: the verified org, the membership assertion, and the key shape.

Login's billing check fails open, and says so

The single chokepoint every client passes on its way into a workspace asks whether the org's plan licenses this product. Two kinds of "no" are distinguished (apps/team/entitle.go):

• Cannot verify — an infrastructure absence — ADMITS. A login gate that fails closed during an outage bricks every session mid-rollout.
• A definitive "no entitlement" currently OBSERVES: it logs the denial and admits, because self-serve checkout does not exist yet and refusing sends a person to a dead end. Enforcement returns when the self-serve path ships.

This is stated in the specification rather than left in a comment because it is a live posture with a date-stamped reason, and a reader MUST NOT assume the presence of a gate implies enforcement.

Agent replies are off unless an operator opts in

The workspace's automated responder is DISABLED by default, and the model seam is wired only when explicitly enabled (apps/team/team.go:113-119). An unconfigured or misconfigured binary is provably inert: with no responder wired, no outbound model call can fire.

The document plane's wire is fixed

The live document transport carries one message per frame in the platform's own envelope, negotiates a text encoding, and pins the model version it reports. It is a data plane over an already-resolved caller, and it MUST NOT re-derive identity of its own.

Addresses, and which operations cannot be values

The capability answers at two prefixes, and the second is deliberate: /v1/team — the control plane, bots, files, billing reads and the transactor door — and /collaborator, the live document lane, app-level because the front derives its WebSocket address from an origin, not from the /v1/team base (manifest/apps.go:339-346). Operations are typed by default; the closed exception list names each one that cannot be a value, with its wire fact — the two WebSocket upgrades, the account plane's JSON-RPC envelope, the cookie write whose unparseable body is ignored rather than 400'd, the two browser redirects, the embedded billing page's bytes, and the file plane's multipart-in and raw-bytes-out (apps/team/typed_wire_test.go:152-178).

Store, money, events, stage, upstreams

The store this capability owns is the workspace store §1 describes: one encrypted SQLite file for the deployment (cek.Open(namespace.System(), "account", dir), apps/team/account_store.go:83), org isolation the column §1 states, holding workspaces, memberships and the roster — plus the workspace blob store §4 bounds. It is FREE: no meter, no debit through any plane (plugin/team/main.go, Price: cloud.Free); §5's login check is a licence read, not a meter. It publishes no event, so a customer's webhooks receive nothing from it, and it emits nothing to observability beyond the request span every route already gets. Its stage is ga.

It derives from no forked upstream. The live lane SPEAKS the Y.js sync protocol — the server is a relay and update log, not an embedded CRDT engine (apps/team/collabws.go:13) — and the document contract is the one the Team front's own collaborator client states (apps/team/collab.go:3-7).