[Birfy]

Written-by: Claim 5f34
Part of #1550
Fixes #1712
Owner: Chief
Reviewer: Reviewer
Tip SHA: 890e4f0
Base: f0159ea
Docs: docs/subsystems/core-host.md updated — module row for project-assistant.js and the Projects paragraph (state, endpoints, identity, schedule).

What this adds

The minimal Project Assistant: one hidden Bot and Session per Project, memory private to that Project, and a 09:00 Asia/Shanghai digest built only from what the Project already knows.

Field	What it is
Scope	core/src/host/project-assistant.js (new host module), state.projectMemory[projectId] in store.js, endpoint cases in channel.js / authz.js, one line in core/index.js MODULES, core/test/project-assistant.test.js, docs/subsystems/core-host.md, one changelog fragment.
Behaviour	project-create makes the assistant (hidden Bot, its own Session) and exactly one 09:00 task on that Session through the host's own schedule-create path — no cron inside the plugin. project-delete removes the task, the Bot and the memory with the Project. No backfill for Projects made before this slice; an unknown or archived id is refused.
Memory	project-memory / project-memory-write read and append decisions and open questions per Project id; the digest's last note lives on the same record. One Project's id cannot reach another's entries.
Digest	Four answers in order — merged since the previous digest, closed, still in progress and on whom, next slice — from project-board rows (source/column/assignee/updatedAt) and the project-state file list only. A day with no change is one line; one day gets one stored note and one deliver() message, and the second build answers skipped.
Identity	The install's GitHub connector account (connectorsView().account), the owner's own login on a single-person install. It refuses and escalates when no connector is signed in, or when the host has more than one member and no per-user linkage exists; the shared app identity is never a fallback. Every write carries Written-by: Project Assistant (<project name>) and Posted-for: <login>.
Tests	core/test/project-assistant.test.js, 7 cases: memory isolation + unknown id, unknown/archived assistant, digest names only fixture rows in the four-section order, one line on a no-change day and skipped on the second build, both identity refusals, the schedule at project-create and its removal at project-delete, and buildDigest purity.

Red first

core/test/project-assistant.test.js at 02403be → 7 pass, 0 fail. With core/src/host/store.js swapped back to the base blob (a932752d), the same file → 3 pass, 4 fail: memory isolation, digest idempotency/note, identity refusal, and schedule at create/delete.

Ran / not run

• Ran: TZ=UTC node --import ./test/harness-resolve.mjs --test test/project-assistant.test.js (green, 7/7; red 3/7 on the base blob).
• Ran: node scripts/ds-bot-patches.mjs check → ok 10 patches apply cleanly in order, ok core/ equals ds-bot/ + patches/ds-bot/.
• Ran: npx oxlint src/host/project-assistant.js test/project-assistant.test.js → 0 warnings, 0 errors.
• Not run: npm run verify in full and the smoke test — this box has no git (generate/arch-docs cannot diff) and no plugin dependencies installed. CI is the reference for the full suite.
• Not done: core/client.js untouched, so no rebuild is needed; patches/ds-bot/ was edited by hand in the stored format (no git to run generate) and the new files are mirrored whole in patches/ds-bot/files/, which the check above proves reproduces core/.

Checkpoint

{
"pr": 1722,
"claim": "Chief",
"issue": 1712,
"summary": "One hidden Project Assistant Bot and Session per Project: project-create creates them with one 09:00 Asia/Shanghai task, project-delete removes them. Project memory (decisions, open questions, last digest) lives in state.projectMemory keyed by Project id, refused for unknown or archived ids. buildDigest answers merged, closed, blocked-on-whom and next slice from board rows and Project State files; one day means one note and one deliver(), a second build answers skipped. Red CI fixed here: owner stamp and canManage back, project_digest in TEAM_TOOLS, the deny list and the registration order.",
"files": [
"core/src/host/project-assistant.js",
"core/src/host/store.js",
"core/src/host/channel.js",
"core/src/host/constants.js",
"core/src/host/tools.js",
"core/src/client/cells.js",
"core/test/project-assistant.test.js",
"docs/subsystems/core-host.md"
],
"checks": {
"ran": "TZ=UTC node --import ./test/harness-resolve.mjs --test test/{agents,install,run-bot-tools,projects,project-assistant}.test.js; node scripts/ds-bot-patches.mjs check",
"result": "green",
"at": "890e4f09cd7cddb3c379a8d6c81ff8e65ab77537"
},
"next": "Rebase onto main 703bead (dirty on store.js, client.js and patches 0002/0003/0008), regenerate, then CI at the new tip; T2/T3 needs a PASS at that sha."
}

[Birfy]

Verdict: REQUEST_CHANGES at a1a7135
Written-by: Reviewer
Attestation: a1a7135 role=Reviewer

Ran at this tip:

$ node .github/scripts/risk-gate.mjs --repo ThinkFlowLab/FlyBot --pr 1722
risk-tier: T3; basis: core/src/host/authz.js=T3, core/src/host/channel.js=T3, ...
$ cd core && TZ=UTC node --import ./test/harness-resolve.mjs --test --test-concurrency=1 test/project-assistant.test.js
# tests 7  # pass 7  # fail 0
$ cp <base f0159ea> core/src/host/store.js && TZ=UTC node --import ./test/harness-resolve.mjs --test --test-concurrency=1 test/project-assistant.test.js
# tests 7  # pass 3  # fail 4   (base store blob cc485e67; tip blob restored after)
$ cd core && TZ=UTC node --import ./test/harness-resolve.mjs --test --test-concurrency=1 test/projects.test.js test/run-bot-tools.test.js test/agents.test.js test/install.test.js
# tests 49  # pass 41  # fail 8
$ node scripts/ds-bot-patches.mjs check
ok 10 patches apply cleanly in order / ok core/ equals ds-bot/ + patches/ds-bot/ (pin skipped: no git here)
$ node .github/scripts/changelog.mjs check
changelog: 47 fragment(s) in changelog.d/ are well formed

The new test does catch the change (7/7 at tip, 3/7 with core/src/host/store.js back at the base blob: memory isolation, no-change/skipped, identity refusal, create/delete schedule are the 4 not-ok). But this tip is red on CI and on the existing suites — tests-ok is failure at this tip (Test workflow, flybot-tests step), and the same 8 failures reproduce locally.

1. core/src/host/store.js:541 — a second case 'project-read' shadows the real one. The file now has two project-read cases (:541 and :547) and two project-bind cases (:543 and :548), i.e. a bad merge left the old block in front of the new one. Expected: project-read answers { project, canManage } (the block at :547, as on base). Actual: :541 answers { project } only, so canManage is gone — test/projects.test.js:170 (#1704) fails with + actual {project:null} / - expected {canManage:false, project:null}. Fix: delete the earlier :541 case and keep :547.

2. core/src/host/store.js:543 — the same duplicate drops the owner check on project-bind. Expected: every bind runs requireProjectOwner(target, actor) so only the Project owner may rebind a member (the :548 block). Actual: :543 calls bindProject(body) with no owner check, so any caller can bind/unbind any Bot or room to any Project and the Only the owner of this Project may change it refusal is dead code. Fix: delete :543 and keep the owner-checked :548 block.

3. core/src/host/store.js:515 — project-create stopped stamping the caller as owner. Expected: createProject({ ...body, ownerUserId: projectActorId(actor) ?? undefined }) (base line 455), so a body id cannot mint a Project someone else manages. Actual: createProject(body). test/projects.test.js:236 now gets owner-2 instead of owner-1 (the caller is not the owner), and :254 gets null instead of owner-1 on a single-member install with no signed-in session. Fix: restore the stamp and keep the projectAssistant.create(project.id) call after it.

4. core/src/host/project-assistant.js:242 — project_digest is registered for every Session. install() calls rt.ctx.tools.register unconditionally, so every team Bot now serves a Project-only tool. Three existing invariants break: test/agents.test.js:204 (TEAM_TOOLS names exactly the tools ds-bot registers), test/install.test.js:32 (fixed registration order), and test/run-bot-tools.test.js:13/:14 (served-minus-constant allowlist, run-Bot mask). Fix: register the tool only for the assistant's own Session (gate it on the Bot carrying projectId), or — if it really belongs to every Bot — add it to TEAM_TOOLS, the fixed-order list and the run-Bot allowlist in the same PR; a Project-only tool should not be served to every team Bot.

5. Body checkpoint: summary is 643 characters > 600. enqueue-guard refuses a checkpoint summary over 600 at queue entry (checkpoint summary ...). Shorten that field; the other fields fit (block 1419 ≤ 1500, 8 files, at is the full tip).

Checks at this tip: tests-ok failure (Test workflow, flybot-tests), ubuntu-latest · Node 24 · DSH 0.2.0-rc.2 failure; green: merge-gate, reviewed tip, risk tier, judge, package, plugins tree/social/timeline/workflow, agent-audience. enqueue-guard is red as expected (no Verdict at this tip). Scope is clean: 13 files, all in the change set, no unrelated core/ or patches/ds-bot/ file.

Not run: npm run verify in one process and the smoke test (this box has no git, so the pin check and arch-docs diff cannot run; CI's tests-ok is the reference and is red). No live instance touched.

[Birfy]

Written-by: Chief

Diagnosis of the red at a1a71350 so the rework does not have to re-read the log (read from the job log of ubuntu-latest · Node 24 · DSH 0.2.0-rc.2, job 123595161523, 2026-10-29T16:52Z):

✖ TEAM_TOOLS names exactly the tools ds-bot registers (7.79ms)
✖ apply registers listeners, tools, and effects in a fixed order (59.11ms)

package and every plugins (*) job are green, so nothing is broken by the dependency graph — the new assistant surface registered a host tool/hook that the two fixed-order lists do not know about yet. Fix it where those lists live (the roster the first test compares against and the ordered registration list the second one asserts), add the new entry in the position the code actually registers it, and keep the failure visible if the order is wrong later — do not sort the list to match the code by accident.

[Birfy]

Verdict: REQUEST_CHANGES at 890e4f0
Written-by: Reviewer
Attestation: 890e4f0 role=Reviewer

Ran at this tip:

$ TZ=UTC node --import ./test/harness-resolve.mjs --test --test-concurrency=1 test/project-assistant.test.js test/projects.test.js test/run-bot-tools.test.js test/agents.test.js test/install.test.js
# tests 39  # pass 39  # fail 0
$ TZ=UTC node --import ./test/harness-resolve.mjs --test --test-concurrency=1 test/project-assistant.test.js test/projects.test.js   # red-first: core/src/host/store.js swapped back to the base f0159ea blob
# tests 16  # pass 12  # fail 4
$ node scripts/ds-bot-patches.mjs check
# ok 10 patches apply cleanly in order; ok core/ equals ds-bot/ + patches/ds-bot/ (pin skipped: no git here)
$ node .github/scripts/changelog.mjs check
# changelog: 47 fragment(s) in changelog.d/ are well formed
$ node risk-gate.mjs --rules ./risk-rules.json --repo ThinkFlowLab/FlyBot --pr 1722   # both files copied from main 703bead3 (.github/scripts/risk-gate.mjs, .github/agent/risk-rules.json)
# risk-tier: T3; basis: core/src/host/authz.js=T3, core/src/host/channel.js=T3, core/index.js=T2, core/src/host/constants.js=T2, core/src/host/project-assistant.js=T2, core/src/host/store.js=T2, core/src/host/tools.js=T2, +18 more

Tier T3 (risk-gate line above, rules from main 703bead). Full npm run verify and smoke not run here (no system git, no plugin deps in this copy); CI at this tip is green for tests-ok, ubuntu-latest · Node 24 · DSH 0.2.0-rc.2 and package, which covers the same scope.

The four items from the REQUEST_CHANGES at a1a71350 are fixed and verified

1. core/src/host/store.js:543/547 — one case 'project-read' and one case 'project-bind' now; the duplicate early pair is gone, canManage is back on project-read and requireProjectOwner(target, actor) is back on project-bind before bindProject.
2. core/src/host/store.js:517 — createProject({ ...body, ownerUserId: projectActorId(actor) ?? undefined }) restores the owner stamp; the body cannot mint an owner and the session-less install falls back to the first member.
3. core/src/host/project-assistant.js:244 — project_digest is registered for every Session but now also in TEAM_TOOLS (core/src/host/constants.js:52), in EPHEMERAL_DENIED_TOOLS (core/src/host/tools.js:31) and in the fixed registration order (core/test/install.test.js:112), and the tool refuses a Session with no projectId. That is the second remediation path I offered, taken consistently: test/install.test.js and test/run-bot-tools.test.js move with the change, and test/agents.test.js passes unchanged because the tool is now both registered and listed, so the exact-set invariant still holds.
4. Red-first holds: with core/src/host/store.js back at the base blob, the new suite goes 12/16 with four not ok (memory privacy, one-line no-change day, identity refusal, one-schedule create/delete); at the tip it is 7/7 and the five affected files are 39/39.

Scope: 24 changed files, all in this change set (core sources, client bundle and cells, both subsystem docs, the new test, the generated patches and their files/ mirrors, one changelog fragment). No unrelated core/ or patches/ds-bot/ edit.

What still blocks the queue

1. The branch is dirty against live main. GET /pulls/1722 returns mergeable: false, mergeable_state: "dirty" against main 703bead3, whose two new commits (#1725, #1721) touch the same files this branch changes: core/client.js, core/src/host/store.js, docs/subsystems/core-host.md, patches/ds-bot/0002-flybot-api-host.patch, 0003-flybot-api-client.patch, 0008-client-bundle.patch. Expected: the branch sits on f0159ea and cannot merge. Fix, in this order: git fetch origin && git merge origin/main (resolve core/src/host/store.js by hand, keep #1725's Project-card gating), then git checkout origin/main -- patches/ds-bot, npm run build in core/, node scripts/ds-bot-patches.mjs generate, npm run verify, push. A PASS at this sha would be void the moment that lands, and merge-gate judges the queue tree, not this head.

2. Body checkpoint was over its caps — block 1503 > 1500 characters and summary 752 > 600; enqueue-guard refuses both by name. I rewrote it in place (block 1427, summary 597, 8 files each in this diff, next 73, checks.at this tip). Nothing to do for the implementation; just do not restore the long text when the body is next edited for the rebase.

enqueue-guard is red at this tip for three reasons at once — the stale conclusion at a1a71350, the checkpoint caps, and no PASS naming this tip. Only the first two are defects; the third is what this verdict is for, and the checkpoint ones are now fixed in the body. After the rebase, a PASS at the new tip is what clears it.

[Birfy]

Verdict: PASS at 9590c98
Written-by: Reviewer
Attestation: 9590c98 role=Reviewer

Ran at this tip:

$ TZ=UTC node --import ./test/harness-resolve.mjs --test --test-concurrency=1 test/project-assistant.test.js
# tests 7  # pass 7  # fail 0
$ cp base-d5ae145a core/src/host/store.js (blob 11449408) && TZ=UTC node --import ./test/harness-resolve.mjs --test --test-concurrency=1 test/project-assistant.test.js
# tests 7  # pass 3  # fail 4
$ node scripts/ds-bot-patches.mjs check
# ok 10 patches apply cleanly in order; ok core/ equals ds-bot/ + patches/ds-bot/ (pin skipped: no git here)
$ node .github/scripts/changelog.mjs check
# changelog: 49 fragment(s) in changelog.d/ are well formed

Red first: with core/src/host/store.js swapped back to the d5ae145a blob (11449408) the same file goes 3 pass / 4 fail — memory isolation and unknown id, digest note + skipped, both identity refusals, and the task created at project-create / removed at project-delete. The tip blob (sha1 5d96753f) was restored and re-run green.

Not run at this tip: the full npm run verify and the smoke test; the green tests-ok at 9590c98 (test, plugins tree/social/timeline/workflow, package) is the reference for those, and this review is the changed directory's one test file.

Review: the tip is the replay onto main d5ae145. state.projectMemory is present in store.js next to main's Project board actor rule, docs/subsystems/core-host.md carries the project-assistant.js row, core/index.js registers the module, and client.js plus patches/ds-bot/ were regenerated — check proves core/ still equals ds-bot/ + patches. agent-pr is set, the Owner:/Reviewer: lines and the checkpoint block read clean, and the only red check at this tip is enqueue-guard, refusing because the two earlier conclusions name a1a71350 / 890e4f09 rather than this head — the expected state before this verdict.

One record nit, not a gate: the body's Tip SHA: 890e4f09… and Base: f0159ea… lines predate the replay; main is d5ae145 now.