mirror of
https://github.com/Memo-2023/mana-monorepo.git
synced 2026-05-14 23:21:08 +02:00
49935c9628
Scaffold the unified visibility/privacy layer introduced by docs/plans/
visibility-system.md. No module adopts it yet — this is the foundation
PR (M1). Module rollout lands in follow-ups starting with Library (M2).
What ships:
- @mana/shared-privacy package
- VisibilityLevel enum ('private' | 'space' | 'unlisted' | 'public')
- VisibilityLevelSchema + UnlistedTokenSchema (zod)
- defaultVisibilityFor(spaceType): personal → private, else → space
- predicates: canEmbedOnWebsite, isReachableByLink,
isVisibleToSpaceMember, canAiAccessCrossUser (always false in P1)
- generateUnlistedToken() — 32-char base64url, CSPRNG, ~192 bits
- VISIBILITY_METADATA: German labels + descriptions + phosphor icon
names so non-UI surfaces (audit logs, CLI) label levels consistently
- <VisibilityPicker> svelte component: compact lock/globe trigger with
4-option menu, full descriptions, optional compact + disabledLevels
- VisibilityChangedPayload type for the domain-event catalog (consumer
registers it when the first module adopts the system)
- .claude/guidelines/visibility.md — step-by-step for module authors
(schema migrations + store wiring + picker placement + embed resolver +
legacy isPublic migration), with a pre-PR checklist
- Plan-doc "Offene Fragen" section rewritten as "Designentscheidungen"
with the seven resolutions the user approved
- CLAUDE.md: shared-privacy listed in the packages table; visibility.md
listed in the guidelines table
- 15 unit tests covering predicates (one-and-only-one 'public' for
embed; phase-1 AI always-deny), defaults (personal vs multi-member,
null fallback), token uniqueness + schema round-trip
Key constraints honored:
- `visibility` stays plaintext (NOT added to the encryption registry)
so RLS predicates and publish resolvers can read it without the user's
master key
- Publish flow remains "decrypt client-side, inline plaintext into
snapshot" — the pattern picture.board already uses in embeds.ts
- Deny-by-default everywhere (personal default = private; unknown space
type defaults to private; cross-user AI always false)
Not in this PR (per plan):
- No schema migrations in any module (M2–M6)
- No RLS predicate updates (arrives with M2)
- No /settings/privacy overview (M7)
- No unlisted share routes (M8)
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|---|---|---|
| .. | ||
| agent-loop-improvements-m1.md | ||
| ai-mission-key-grant.md | ||
| articles-homepage.md | ||
| articles-module.md | ||
| broadcast-module.md | ||
| data-export-v2.md | ||
| destructive-tools-opt-in.md | ||
| event-discovery.md | ||
| invoices-module.md | ||
| library-module.md | ||
| mail-module-plan.md | ||
| mana-mcp-and-personas.md | ||
| mana-research-service.md | ||
| me-images-and-reference-generation.md | ||
| me-images-space-scope-migration.md | ||
| multi-agent-workbench.md | ||
| news-research-module.md | ||
| onboarding-flow.md | ||
| per-space-vs-user-global-tags.md | ||
| planner-function-calling.md | ||
| README.md | ||
| scene-scope-empty-state.md | ||
| shared-space-smoketest.md | ||
| social-relay-module.md | ||
| space-scoped-data-model.md | ||
| spaces-foundation.md | ||
| team-workbench.md | ||
| tipps-module.md | ||
| visibility-system.md | ||
| wardrobe-module.md | ||
| website-builder-smoketest.md | ||
| website-builder.md | ||
| workbench-cards-migration.md | ||
| workbench-templates.md | ||
Plans
Design + rollout plans, grouped by topic. Plans are long-form docs with baked-in decisions, phasing, open questions, and (when shipped) a history section with commit refs.
AI / Workbench roadmap
The Mana AI Workbench has evolved in three successive planned waves — each one laying foundations the next one relies on:
User hat einen Companion (v0 — shipped before these docs)
│
▼
AI Missions + Proposals + Policy + Revert
│
▼
Mission Key-Grants ← ai-mission-key-grant.md ✅
(encrypted inputs decryptable by the server runner)
│
▼
Multi-Agent Workbench ← multi-agent-workbench.md ✅
(named agents, per-agent policy/memory/budget,
identity-aware Actor, scene→agent lens)
│
▼
Team Workbench ← team-workbench.md 📝 (not started)
(multi-user + shared AI context,
admin lens on team members)
| Plan | Status | Scope |
|---|---|---|
ai-mission-key-grant.md |
✅ Shipped | Per-mission RSA-wrapped key grant so mana-ai can decrypt allowlisted encrypted records when user opts in. |
multi-agent-workbench.md |
✅ Shipped | Identity-aware Actor + named AI agents owning missions + per-agent policy + scene lens. 28 tools across 11 modules including server-side web-research. |
workbench-templates.md |
✅ T1 Shipped | Generalised templates: 3 agent-templates + 3 non-AI workbench starter-kits. Seed-handler registry for per-module data seeding. |
team-workbench.md |
📝 Forward-looking | TeamSpace with membership, team-encrypted records, admin lens on team members. Reuses Actor.principalId + key-wrapping patterns from the two above. |
Cross-references:
- Architecture narrative:
docs/architecture/COMPANION_BRAIN_ARCHITECTURE.md§20 (AI Workbench base), §21 (Mission Grants), §22 (Multi-Agent), §23 (Reasoning Loop + Research + Debug) - Non-plan ideas backlog:
docs/future/AI_AGENTS_IDEAS.md - Service-internal notes:
services/mana-ai/CLAUDE.md - Webapp-internal notes:
apps/mana/CLAUDE.md→ "AI Workbench" section
Other plans
| Plan | Topic |
|---|---|
mail-module-plan.md |
Mail module — IMAP/SMTP integration |
news-research-module.md |
News + research pipeline |