Authenticate scoped personal-agent connections with existing delegation policy

PROJECT.md

@@ -8,6 +8,15 @@ architecture lives in [docs/architecture.md](docs/architecture.md) and
 Current stage and priorities: [ROADMAP.md](ROADMAP.md). How decisions are made:
 [docs/governance.md](docs/governance.md). Dated decisions: [decisions/](decisions/README.md).
 
+## Agent connection authorization — 2026-11-03
+
+#2183 adds scoped agent credentials over the existing member-session HTTP channel,
+reuses per-participation safe/watch grants, and persists Task-origin provenance.
+Owner's closure confirmation remains personal; native/external personal agents may
+suggest closure without a Task. Real TCP contract tests are separate from actual
+provider adapters/login. Full operation receipts/events and transaction migration
+remain #2185/#2182; runtime cancellation remains #2184. No live rollout.
+
 ## Independent personal-agent foundation — 2026-11-02
 
 #2170 introduces user-owned identities, per-Project participation/default routing,

ROADMAP.md

@@ -1,5 +1,14 @@
 # FlyBot — Roadmap
 
+## Agent connection authorization — 2026-11-03
+
+#2183 adds scoped agent credentials over the existing member-session HTTP channel,
+reuses per-participation safe/watch grants, and persists Task-origin provenance.
+Owner's closure confirmation remains personal; native/external personal agents may
+suggest closure without a Task. Real TCP contract tests are separate from actual
+provider adapters/login. Full operation receipts/events and transaction migration
+remain #2185/#2182; runtime cancellation remains #2184. No live rollout.
+
 ## Independent personal-agent foundation — 2026-11-02
 
 #2170 introduces user-owned identities, per-Project participation/default routing,

changelog.d/2183-agent-auth.added.md

@@ -0,0 +1 @@
+Add scoped personal-agent connection credentials, safe proposal approval, existing watch delegation reuse and authenticated Task provenance.

core/index.js

@@ -10,6 +10,7 @@ import * as projectSources from './src/host/project-sources.js'
 import * as projectExecutionBoundary from './src/host/project-execution-boundary.js'
 import * as harness from './src/host/harness.js'
 import * as memberAuth from './src/host/member-auth.js'
+import * as personalAgentAuth from './src/host/personal-agent-auth.js'
 import * as platformIdentity from './src/host/platform-identity.js'
 import * as projectChiefControl from './src/host/project-chief-control.js'
 import * as projectScheduledTasks from './src/host/project-scheduled-tasks.js'
@@ -81,7 +82,7 @@ export const inject = ['llm', 'tools', 'systemPrompt', 'sessionController', 'ses
 // the functions other modules call; they call them through `rt` at run time, never during
 // install. Listeners run and tools are listed in registration order, so this order holds:
 // usage meters model requests after every listener that rewrites them.
-const MODULES = [diagnostics, store, projectEffects, projectInputs, harness, memberAuth, platformIdentity, projectAccess, projectDevelopment, projectExecutionBoundary, projectResources, projectHarness, projectRuntimeSetup, projectDelivery, projectDelegations, projectAgents, projectCredentials, projectGithubRead, projectPools, projectScheduledTasks, projectSources, projectChiefControl, projectScheduler, workbenchState, authz, models, permissions, turns, busyAck, steeringInterrupt, delivery, roster, folders, agents, prompt, timeContext, tools, decisions, projectState, meetings, chatIndex, groups, roomMembership, reach, tasks, projectBoard, taskDrive, approvals, resume, memory, parts, images, secrets, connectors, connectorAccess, capabilities, schedules, projectAssistant, projectChief, projectTeam, automationDefault, browser, usage, update, dshUpdate, hooks, remoteChat, workflowStore, channel]
+const MODULES = [diagnostics, store, projectEffects, projectInputs, harness, memberAuth, platformIdentity, projectAccess, projectDevelopment, projectExecutionBoundary, projectResources, projectHarness, projectRuntimeSetup, projectDelivery, projectDelegations, projectAgents, projectCredentials, projectGithubRead, projectPools, projectScheduledTasks, projectSources, projectChiefControl, projectScheduler, workbenchState, authz, personalAgentAuth, models, permissions, turns, busyAck, steeringInterrupt, delivery, roster, folders, agents, prompt, timeContext, tools, decisions, projectState, meetings, chatIndex, groups, roomMembership, reach, tasks, projectBoard, taskDrive, approvals, resume, memory, parts, images, secrets, connectors, connectorAccess, capabilities, schedules, projectAssistant, projectChief, projectTeam, automationDefault, browser, usage, update, dshUpdate, hooks, remoteChat, workflowStore, channel]
 
 export function apply(ctx, config = {}) {
   const rt = createRuntime(ctx, config)

core/src/host/authz.js

@@ -58,7 +58,7 @@ const SESSION_TARGETED = new Set(['earlier', 'send', 'answer-question', 'dismiss
 // Task channel names. Requester checks live on the record in tasks.js; listing them
 // here keeps a future `task-*` from auto-allowing for any signed-in actor (#111).
 const TASK_ENDPOINTS = new Set([
-  'personal-agent-history', 'personal-agent-create', 'personal-agent-read', 'personal-agent-list', 'personal-agent-join', 'personal-agent-default', 'personal-agent-participations', 'personal-agent-leave', 'personal-agent-retire',
+  'personal-agent-token-create', 'personal-agent-token-list', 'personal-agent-token-revoke', 'personal-agent-delegation-set', 'personal-agent-propose-task', 'personal-agent-history', 'personal-agent-create', 'personal-agent-read', 'personal-agent-list', 'personal-agent-join', 'personal-agent-default', 'personal-agent-participations', 'personal-agent-leave', 'personal-agent-retire',
   'tasks', 'task-create', 'task-update', 'task-accept', 'task-start', 'task-return', 'task-accept-result', 'task-send-back', 'task-cancel',
   'task-wait-input', 'task-answer-input',
   // Saving a workflow definition writes `workflows/<id>.json` in the workspace (#1272 step 3): the

core/src/host/channel.js

@@ -229,7 +229,7 @@ export function install(rt) {
   // What a host that only reads the team may still answer.
   // Updates change the dsh profile, not the team, so a reading host may run them too.
   // auth-whoami is a read of the already-resolved actor; invite/redeem/revoke/remove-member write.
-  const READS = new Set(['project-roles', 'project-role-proposals', 'personal-agent-history', 'personal-agent-read', 'personal-agent-list', 'personal-agent-participations', 'project-repositories', 'project-rooms', 'project-room-read', 'project-task-pools', 'project-chief-state', 'project-github-read', 'auth-mode', 'workbench-state', 'project-resources', 'projects', 'project-read', 'project-board', 'project-members', 'project-task-detail', 'project-attempt-log', 'project-detail', 'state', 'models', 'efforts', 'earlier', 'room-progress', 'room-history', 'exchange', 'usage', 'schedules', 'memory-view', 'browser-wait', 'browser-result', 'diagnostics', 'diagnostics-log', 'diagnostics-clear', 'update-check', 'update-install', 'dsh-update-install', 'repo-stars', 'approval-answer', 'auth-whoami', 'workflows'])
+  const READS = new Set(['project-roles', 'project-role-proposals', 'personal-agent-token-list', 'personal-agent-history', 'personal-agent-read', 'personal-agent-list', 'personal-agent-participations', 'project-repositories', 'project-rooms', 'project-room-read', 'project-task-pools', 'project-chief-state', 'project-github-read', 'auth-mode', 'workbench-state', 'project-resources', 'projects', 'project-read', 'project-board', 'project-members', 'project-task-detail', 'project-attempt-log', 'project-detail', 'state', 'models', 'efforts', 'earlier', 'room-progress', 'room-history', 'exchange', 'usage', 'schedules', 'memory-view', 'browser-wait', 'browser-result', 'diagnostics', 'diagnostics-log', 'diagnostics-clear', 'update-check', 'update-install', 'dsh-update-install', 'repo-stars', 'approval-answer', 'auth-whoami', 'workflows'])
 
   // A chat reference chip names a Session whose snapshot rides to every recipient of
   // the message, so the author must be able to read what they share (#53, #106).
@@ -822,6 +822,11 @@ export function install(rt) {
         case 'project-terminal-close':
         case 'project-execution-input':
         case 'project-resource-environment-check':
+        case 'personal-agent-token-create':
+        case 'personal-agent-token-list':
+        case 'personal-agent-token-revoke':
+        case 'personal-agent-delegation-set':
+        case 'personal-agent-propose-task':
         case 'personal-agent-history':
         case 'personal-agent-create':
         case 'personal-agent-read':