[nhathuy7611]

Summary

• Add Training Campus and Main Office as versioned organizational zones, with seven training areas and eleven default Main Office departments.
• Keep existing floors as project workspaces. Legacy floors resolve to Main Office / Software Engineering without changing floors.json.
• Add a shared Zone/Department browser to the 3D menu and /lite; admins can add/edit departments and assign projects.

Architecture changes

• New OfficeStructureStore persists zones.json with schema validation, atomic replacement and audit records for edits. Missing files create defaults once; malformed or unsupported files remain untouched and disable edits.
• New protocol types and authenticated HTTP routes expose the structure. Mutations require a server-derived admin identity and same-origin request.
• Existing worker, queue, provider, GitHub, floor travel and WebSocket protocols remain unchanged.
• See docs/ai-office-architecture.md for boundaries and phase sequence.

Migration notes

• No rewrite of existing data. Floors without an explicit assignment appear under Main Office / Software Engineering.
• New/removed floors are reconciled by ID when the structure is read. Restarting does not duplicate defaults.

Security notes

• Training Campus is organizational in this slice. Existing worktrees are not process sandboxes; workers still share an OS user and can see its credentials. Do not run untrusted training agents until execution isolation and tool policy are implemented.
• Promotion, evaluation and training restrictions are reserved for later phases.

Verification

• npm run typecheck — passed.
• npm run build — passed.
• Focused test run covering structure, migration, auth, client registries, floor behavior, docs and size guard — 46/46 passed.
• Headless Chrome: opened Zone browser in 3D and /lite, confirmed 11 Main Office departments, no page errors, /lite Esc close and 3D ✕ close. 3D modal screenshot · /lite screenshot.
• npm test was attempted twice. On this Windows host it stalled in existing fake-agent tests (dsh, repos, workers, worktrees). A broader run excluding those files still reports existing Windows-specific failures in clone, Codex usage and map fixture tests. client-registry.test.ts had a Windows path-separator failure; this PR fixes it.

Known limitations and next phase

• Zone selection organizes navigation; it does not enforce a security boundary or change the 3D map.
• Add persistent AgentProfiles, project stages and tool policies next. Then implement evaluation, human-approved promotion and Sandbox Lab execution isolation.