a commander's bound is a rule, not a list

the allow list shipped an hour ago was a snapshot. plugin permissions
register at mount, so a plugin installed after a commander was created was
missing from its list and failed as a bare 403 with nothing saying why —
and every future thing a commander is meant to do is exactly that shape:
notify a device, send mail, spawn a sub-agent, hand a transcription to an
idle one, reach a plugin that does not exist yet.

so a credential now narrows two ways, and both only subtract:

  permissions   an ALLOW list. exact, a snapshot. right for a credential
                with one job.
  excludedKinds kinds it may never reach, resolved against the LIVE
                registry on every request. right for a credential whose
                job is open-ended.

a commander gets the second: every kind except admin. bounded away from
installing plugins, managing users and roles and changing server settings,
forever — and open to everything the platform learns to do, with nothing
to re-issue. still intersected with the account, so for a member it
narrows itself against their role.

verified against the running server with a commander-shaped key: tasks,
notify, file-browser and the transcribe PLUGIN all reach their routes;
/api/users, /api/plugins and /api/roles are 403. the plugin case is the
one an allow list could not have passed — it was mounted long after any
key was minted.

the commander's CLAUDE.md says what it cannot do in the rule's own terms,
and that a 403 is an answer rather than a problem to route around.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Officer-Session: 656f5c85-e49a-4f1f-b9f3-042a04b4d043

src/servers/api/tasks/task-api-env.ts

@@ -1,4 +1,5 @@
 import { sign } from '@@/jwt';
+import type { CredentialScope } from '@@/auth-token';
 import { PORT, OFFICER_API_URL } from '../../officer-url.mjs';
 
 const { PUBLIC_URL } = process.env;
@@ -24,7 +25,7 @@ type TaskApiUser = {
    * back through the API with the owner's full authority and the limit would have bought nothing. The
    * script gets exactly what its caller had — never more.
    */
-  permissions?: string[] | null;
+  scope?: CredentialScope | null;
 };
 
 // Environment that lets a script task call Officer's own API instead of reimplementing server-side
@@ -45,7 +46,7 @@ export async function buildTaskApiEnv(user: TaskApiUser): Promise<Record<string,
       username: user.username ?? '',
       // Only when narrowed. An absent claim is what every ordinary run already signs, and `resolveAuthToken`
       // spreads the payload onto the identity, so this reaches both doors with no further wiring.
-      ...(user.permissions ? { permissions: user.permissions } : {}),
+      ...(user.scope ? { scope: user.scope } : {}),
     },
     '12h',
   );