the todo board leaves the platform

`/todos` is now the `kanban` plugin. removed here: the router, the screen, the
route, the TodoBoard panel, its AppRegistry entry and the `todos` permission.

WHAT STAYED, and it is a seam rather than an oversight: `todo/` and
`scripts/todo-index.ts`. that folder is the platform's OWN backlog, committed with
the platform's own code, and the CLI regenerates TODO.md from a terminal with no
Officer running. moving either would have made this repository's own documentation
depend on a plugin being installed.

so `todo-tree.ts` stays too, with one caller instead of two, and there are now two
copies of that logic which will drift. recorded in the file itself and in the
plugin's README rather than discovered in six months. the honest fix on the day it
matters is to delete the CLI and let the plugin own the format.

THE TOTALITY CHECK EARNED ITS KEEP. removing the router left `todos` in
permissions/registry.ts and the server REFUSED TO BOOT — exactly what that guard is
for. a stale permission naming a route that no longer exists is the kind of thing
that otherwise sits there for months granting access to nothing.

docs:check then caught two more: the generated platform skill still listed `/todos`,
and AGENTS.md claimed 21 permission entries against a registry now holding 20. both
fixed, and the AGENTS.md note now explains the drop the same way it already explains
caldav's.

verified: server boots, `bun todo:index` still regenerates TODO.md, 1665 tests pass
(up from 1657 — the ported tree tests run in the plugin now), typecheck clean,
docs:check green.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Officer-Session: 656f5c85-e49a-4f1f-b9f3-042a04b4d043

AGENTS.md

@@ -243,7 +243,7 @@ ahead of everything, and it re-verifies the token itself so it covers routes tha
 - `permissions/registry.ts` — the single enumeration of what the platform can do, in five kinds:
   `core` (every account, not deniable), `app` (**the grantable surface**), `confined` (grantable, but
   only to an account that has a Linux user), `execution` and `admin` (owner only, and `execution` is
-  never grantable at any level). **21 entries as of 2026-08-27** — verified by `bun run docs:check`, which fails if this number drifts again: 6 core, 2 app, 4 confined, 3 execution, 6 admin (`todos`, the todo board, is the sixth). It was 22 until caldav became a plugin and took `calendar` with it — a plugin's permission is registered at runtime from its manifest, so it is real but not in this file's count. `notify` moved from `app` to `core` on 2026-08-24: it was grantable, nothing granted it, and every Member's app was silently 403'd registering its own push token. It said 27 for nine days. The execution count dropped by one when Minesweeper became a plugin — see `plugins/minesweeper/manifest.ts` for why that was a fix rather than a downgrade.
+  never grantable at any level). **20 entries as of 2026-08-29** — verified by `bun run docs:check`, which fails if this number drifts again: 6 core, 2 app, 4 confined, 3 execution, 5 admin. It was 21 until the todo board became the `kanban` plugin and took `todos` with it — the same shape as caldav below, and for the same reason: a plugin's permission is registered at runtime from its manifest, so it is real but not in this file's count. It was 22 until caldav became a plugin and took `calendar` with it — a plugin's permission is registered at runtime from its manifest, so it is real but not in this file's count. `notify` moved from `app` to `core` on 2026-08-24: it was grantable, nothing granted it, and every Member's app was silently 403'd registering its own push token. It said 27 for nine days. The execution count dropped by one when Minesweeper became a plugin — see `plugins/minesweeper/manifest.ts` for why that was a fix rather than a downgrade.
 - `permissions/authorize.ts` — resolves "may this account do this". Owner short-circuits first; every
   other answer is role grants plus core, with `execution`/`admin` stripped even if a row grants them,
   and `confined` stripped for an account with no `osUser`.

src/apps/officer-web/App.tsx

@@ -107,7 +107,6 @@ export function App() {
             {/* TEMPORARY / EXPERIMENTAL — offline file transfer over animated QR codes */}
             <Route path="/qr-transfer" element={<Dashboard.QrTransferScreen />} />
             <Route path="/sendoff" element={<Dashboard.SendOffScreen />} />
-            <Route path="/todos" element={<Dashboard.TodosScreen />} />
             <Route path="/bots" element={<Dashboard.BotsScreen />} />
             {/* Route pair: `/bots` is the new-bot state, `/bots/:sessionId` is one of them. */}
             <Route path="/bots/:sessionId" element={<Dashboard.BotsScreen />} />

src/apps/officer-web/Screens/Dashboard/Todos/TodosScreen.tsx

@@ -1,12 +0,0 @@
-import type { LayoutNode } from 'officerdev';
-import { WorkspaceView } from 'officerdev';
-import { useDashboardState } from 'state/useDashboardState';
-import { defaultLayout } from './defaultLayout';
-
-// /todos — the Kanban board over the repo's own `todo/` tree (one file per item, todo/README.md).
-// Selection and the theme filter are `?selected=` / `?theme=`, read by the panel itself.
-export const TodosScreen = () => {
-  const workspace = useDashboardState<LayoutNode>('screens/todos', defaultLayout);
-
-  return <WorkspaceView workspace={workspace} locked appTypes={{ allowed: ['todo-board'], fallback: 'todo-board' }} />;
-};

src/apps/officer-web/Screens/Dashboard/Todos/defaultLayout.ts

@@ -1,8 +0,0 @@
-import type { LayoutNode } from 'officerdev';
-
-// One panel: the board carries its own filter bar and detail pane, driven by the URL.
-export const defaultLayout: LayoutNode = {
-  type: 'panel',
-  id: 'todo-board',
-  appType: 'todo-board',
-};

src/apps/officer-web/Screens/Dashboard/Todos/index.tsx

@@ -1 +0,0 @@
-export * from './TodosScreen';

src/apps/officer-web/Screens/Dashboard/index.tsx

@@ -21,5 +21,4 @@ export * from './Terminal';
 export * from './Jobs';
 export * from './QrTransfer';
 export * from './SendOff';
-export * from './Todos';
 export * from './Bots';

src/servers/api/todos/router.ts

@@ -1,93 +0,0 @@
-import { existsSync, readFileSync, writeFileSync } from 'node:fs';
-import { join, resolve } from 'node:path';
-import { createRouter } from '../../create-router';
-import * as errors from '@@/custom-errors';
-import { isSuperAdmin } from '../../super-admin';
-import { TODO_STATUSES, bodyOf, frontmatter, patchFrontmatter, readTree, writeIndex } from './todo-tree';
-
-/*
-  /api/todos — the board over `todo/`, the platform's own backlog (one file per item, todo/README.md).
-
-  The FILESYSTEM is the database, deliberately: the items are already versioned, reviewed and synced
-  between machines by git, and a second store would be a second truth. So this router is thin — read the
-  tree, splice frontmatter — and everything it writes is a small, reviewable git diff.
-
-  Two rules from the format's contract, enforced here rather than trusted to callers:
-
-  - The BODY is the owner's half and is never rewritten. Only `patchFrontmatter` touches a file, and it
-    stops at the closing fence.
-  - `TODO.md` is generated output. Every write regenerates it via `writeIndex()`, so the index cannot
-    drift from the tree — the board never edits it directly.
-
-  ── Owner only, explicitly ──
-
-  `todos` is `kind: 'admin'` in the permission registry, so the global gate already refuses a non-owner.
-  This is the same belt-and-braces the other admin routers add: a registry mistake must not turn into
-  members reading — or editing — the platform's own backlog.
-*/
-
-export const todosRouter = createRouter();
-
-todosRouter.use(async (ctx, next) => {
-  if (!(await isSuperAdmin(ctx.get('user')))) throw errors.FORBIDDEN('The todo board is owner-only');
-  return next();
-});
-
-/** `<theme>/<slug>`, both kebab-case — also the path traversal guard, since it admits no dot or slash pair. */
-const ID_SHAPE = /^[a-z0-9][a-z0-9-]*\/[a-z0-9][a-z0-9-]*$/;
-
-const fileForId = (id: string): string => {
-  if (!ID_SHAPE.test(id)) throw errors.BAD_REQUEST(`not a todo id: ${id}`);
-  const [theme, slug] = id.split('/');
-  const path = resolve(process.cwd(), join('todo', theme!, `${slug}.md`));
-  if (!existsSync(path)) throw errors.NOT_FOUND(`no todo at ${id}`);
-  return path;
-};
-
-/** GET /api/todos — the whole tree, no bodies. What the board renders. */
-todosRouter.get('/', (ctx) => ctx.json(readTree()));
-
-/** GET /api/todos/item?id=<theme>/<slug> — one item, body included. Query param because the id holds a slash. */
-todosRouter.get('/item', (ctx) => {
-  const text = readFileSync(fileForId(ctx.req.query('id') ?? ''), 'utf8');
-  return ctx.json({ meta: frontmatter(text), body: bodyOf(text) });
-});
-
-/**
- * PATCH /api/todos/item — update an item's frontmatter: `{ id, status?, priority?, due?, order? }`.
- * Regenerates TODO.md on every write. The body is untouchable through this API, on purpose.
- */
-todosRouter.patch('/item', async (ctx) => {
-  const { id, status, priority, due, order } = await ctx.req.json<{
-    id: string;
-    status?: string;
-    priority?: string;
-    due?: string;
-    order?: number;
-  }>();
-  const path = fileForId(id);
-
-  const updates: Record<string, string> = {};
-  if (status !== undefined) {
-    if (!(TODO_STATUSES as readonly string[]).includes(status)) throw errors.BAD_REQUEST(`not a status: ${status}`);
-    updates.status = status;
-  }
-  // `urgent` or nothing — the format deliberately has no scale (todo/README.md).
-  if (priority !== undefined) {
-    if (priority !== '' && priority !== 'urgent') throw errors.BAD_REQUEST(`not a priority: ${priority}`);
-    updates.priority = priority;
-  }
-  if (due !== undefined) {
-    if (due !== '' && !/^20\d\d-\d\d-\d\d$/.test(due)) throw errors.BAD_REQUEST(`not a date: ${due}`);
-    updates.due = due;
-  }
-  if (order !== undefined) {
-    if (!Number.isInteger(order) || order < 0) throw errors.BAD_REQUEST(`not an order: ${order}`);
-    updates.order = String(order);
-  }
-  if (Object.keys(updates).length === 0) throw errors.BAD_REQUEST('nothing to update');
-
-  writeFileSync(path, patchFrontmatter(readFileSync(path, 'utf8'), updates));
-  writeIndex();
-  return ctx.json({ ok: true });
-});

src/servers/api/todos/todo-tree.ts

@@ -10,8 +10,20 @@ import { join, resolve } from 'node:path';
 //     the closing fence.
 //   - `TODO.md` at the repo root is GENERATED output (`writeIndex`), never a write target.
 //
-// This module is the one reader and one writer. `scripts/todo-index.ts` (the CLI) and the `/api/todos`
+// ── This module has ONE caller now, and that is deliberate ──
-// router both import it, so the board and the generated index cannot disagree about what the tree holds.
+//
+// `scripts/todo-index.ts` — the CLI behind `bun todo:index`, which regenerates TODO.md from a terminal
+// with no Officer running. The `/api/todos` router and the board are gone: they became the `kanban`
+// plugin on 2026-08-29, which generalised this reader over a root so it can show any project's folder
+// rather than only the one the server was started in.
+//
+// This copy stayed because the folder it reads is the PLATFORM'S OWN backlog, committed with the
+// platform's own code. Moving it would have made regenerating this repository's TODO.md depend on a
+// plugin being installed, which is the wrong way round for a repo's own documentation.
+//
+// So there are two copies of this logic now, and they will drift. That is a known cost, recorded here
+// and in the plugin's README rather than discovered later. The honest fix, on the day it matters, is to
+// delete the CLI and let the plugin own the format outright.
 
 /** Resolved per call, not at module load: the server asserts its cwd is the repo root at boot. */
 const todoDir = () => resolve(process.cwd(), 'todo');

src/workspaces/officerdev/src/apps/TodoBoard/TodoBoardPanel.tsx

@@ -1,215 +0,0 @@
-import type { DragEvent } from 'react';
-import { useState } from 'react';
-import { Link, useSearchParams } from 'react-router';
-import ReactMarkdown from 'react-markdown';
-import remarkGfm from 'remark-gfm';
-import { AlertTriangle, CalendarClock, X } from 'lucide-react';
-import { cn } from '@/lib/utils';
-import type { TodoItem } from './useTodos';
-import { useTodoItem, useTodoPatch, useTodoTree } from './useTodos';
-
-/**
- * The board over `todo/` — the platform's own backlog, one file per item (todo/README.md).
- *
- * Selection and the theme filter live in the URL (`?selected=`, `?theme=`), per the navigation audit:
- * a card is a real link, a filtered board is an addressable page, and back means what it should.
- *
- * Writes go through PATCH /todos/item, which touches frontmatter only and regenerates TODO.md — this
- * board never holds state the files do not; a drag is a file edit and a refetch.
- */
-
-const COLUMNS = [
-  { status: 'open', label: 'Open' },
-  { status: 'doing', label: 'Doing' },
-  { status: 'blocked', label: 'Blocked' },
-  { status: 'backburner', label: 'Backburner' },
-  { status: 'done', label: 'Done' },
-] as const;
-
-export const TodoBoardPanel = () => {
-  const { data, isLoading, error } = useTodoTree();
-  const patch = useTodoPatch();
-  const [params] = useSearchParams();
-  const selected = params.get('selected');
-  const themeFilter = params.get('theme');
-  const [dragOver, setDragOver] = useState<string | null>(null);
-
-  const href = (changes: Record<string, string | null>): string => {
-    const next = new URLSearchParams(params);
-    for (const [key, value] of Object.entries(changes)) {
-      if (value === null) next.delete(key);
-      else next.set(key, value);
-    }
-    const qs = next.toString();
-    return qs ? `?${qs}` : '.';
-  };
-
-  if (error) {
-    return (
-      <div className="flex h-full items-center justify-center p-8 text-center text-sm text-muted-foreground">
-        The todo board is owner-only, and this account was refused. Nothing here is broken — there is simply nothing to
-        show.
-      </div>
-    );
-  }
-  if (isLoading || !data) {
-    return <div className="flex h-full items-center justify-center text-sm text-muted-foreground">Reading todo/…</div>;
-  }
-
-  const themes = data.themes.filter((t) => t.items.length > 0);
-  const items = themes.flatMap((t) => t.items);
-  const visible = themeFilter ? items.filter((i) => i.theme === themeFilter) : items;
-
-  const drop = (status: string) => (ev: DragEvent) => {
-    ev.preventDefault();
-    setDragOver(null);
-    const id = ev.dataTransfer.getData('text/todo-id');
-    if (id) patch.mutate({ id, status });
-  };
-
-  return (
-    <div className="flex h-full min-h-0">
-      <div className="flex min-w-0 flex-1 flex-col">
-        <div className="flex flex-wrap items-center gap-1.5 border-b border-border px-4 py-2">
-          <Link
-            to={href({ theme: null })}
-            className={cn(
-              'rounded-full px-2.5 py-0.5 text-xs',
-              !themeFilter
-                ? 'bg-primary text-primary-foreground'
-                : 'bg-muted text-muted-foreground hover:text-foreground',
-            )}
-          >
-            All · {items.filter((i) => i.status !== 'done').length}
-          </Link>
-          {themes.map((t) => {
-            const open = t.items.filter((i) => i.status !== 'done').length;
-            return (
-              <Link
-                key={t.theme}
-                to={href({ theme: t.theme === themeFilter ? null : t.theme })}
-                className={cn(
-                  'rounded-full px-2.5 py-0.5 text-xs',
-                  themeFilter === t.theme
-                    ? 'bg-primary text-primary-foreground'
-                    : 'bg-muted text-muted-foreground hover:text-foreground',
-                )}
-              >
-                {t.heading.split('—')[0]?.trim()} · {open}
-              </Link>
-            );
-          })}
-        </div>
-
-        <div className="flex min-h-0 flex-1 gap-3 overflow-x-auto p-4">
-          {COLUMNS.map((col) => {
-            const cards = visible
-              .filter((i) => i.status === col.status)
-              .sort((a, b) => (b.priority === 'urgent' ? 1 : 0) - (a.priority === 'urgent' ? 1 : 0));
-            return (
-              <div
-                key={col.status}
-                onDragOver={(ev) => {
-                  ev.preventDefault();
-                  setDragOver(col.status);
-                }}
-                onDragLeave={() => setDragOver(null)}
-                onDrop={drop(col.status)}
-                className={cn(
-                  'flex w-64 shrink-0 flex-col rounded-lg border border-border bg-muted/30',
-                  dragOver === col.status && 'border-primary bg-primary/5',
-                )}
-              >
-                <div className="flex items-baseline justify-between px-3 py-2 text-xs font-semibold text-muted-foreground">
-                  <span>{col.label}</span>
-                  <span>{cards.length}</span>
-                </div>
-                <div className="flex min-h-0 flex-1 flex-col gap-2 overflow-y-auto px-2 pb-2">
-                  {cards.map((item) => (
-                    <TodoCard
-                      key={item.id}
-                      item={item}
-                      href={href({ selected: item.id })}
-                      selected={selected === item.id}
-                    />
-                  ))}
-                </div>
-              </div>
-            );
-          })}
-        </div>
-      </div>
-
-      {selected ? <TodoDetail id={selected} closeHref={href({ selected: null })} /> : null}
-    </div>
-  );
-};
-
-type TodoCardProps = { item: TodoItem; href: string; selected: boolean };
-
-const TodoCard = ({ item, href, selected }: TodoCardProps) => (
-  <Link
-    to={href}
-    draggable
-    onDragStart={(ev) => ev.dataTransfer.setData('text/todo-id', item.id)}
-    className={cn(
-      'block rounded-md border border-border bg-card p-2.5 text-left shadow-sm hover:border-primary/50',
-      selected && 'border-primary',
-    )}
-  >
-    <div className="text-xs leading-snug text-card-foreground">{item.title}</div>
-    <div className="mt-1.5 flex flex-wrap items-center gap-1.5 text-[10px] text-muted-foreground">
-      <span className="rounded bg-muted px-1 py-px">{item.theme}</span>
-      {item.priority === 'urgent' && (
-        <span className="flex items-center gap-0.5 rounded bg-destructive/15 px-1 py-px text-destructive">
-          <AlertTriangle className="h-2.5 w-2.5" /> urgent
-        </span>
-      )}
-      {item.due && (
-        <span className="flex items-center gap-0.5">
-          <CalendarClock className="h-2.5 w-2.5" /> {item.due}
-        </span>
-      )}
-      <span>{item.created}</span>
-    </div>
-  </Link>
-);
-
-type TodoDetailProps = { id: string; closeHref: string };
-
-const TodoDetail = ({ id, closeHref }: TodoDetailProps) => {
-  const { data, isLoading } = useTodoItem(id);
-  const patch = useTodoPatch();
-  const status = data?.meta.status ?? 'open';
-
-  return (
-    <div className="flex w-[28rem] shrink-0 flex-col border-l border-border">
-      <div className="flex items-center justify-between gap-2 border-b border-border px-4 py-2">
-        <span className="truncate font-mono text-xs text-muted-foreground">{id}</span>
-        <div className="flex items-center gap-2">
-          <select
-            value={status}
-            onChange={(ev) => patch.mutate({ id, status: ev.target.value })}
-            className="rounded border border-border bg-background px-1.5 py-0.5 text-xs"
-          >
-            {COLUMNS.map((c) => (
-              <option key={c.status} value={c.status}>
-                {c.label}
-              </option>
-            ))}
-          </select>
-          <Link to={closeHref} className="text-muted-foreground hover:text-foreground">
-            <X className="h-4 w-4" />
-          </Link>
-        </div>
-      </div>
-      <div className="file-viewer-md min-h-0 flex-1 overflow-y-auto px-4 py-3 text-sm">
-        {isLoading || !data ? (
-          <span className="text-sm text-muted-foreground">Reading…</span>
-        ) : (
-          <ReactMarkdown remarkPlugins={[remarkGfm]}>{data.body}</ReactMarkdown>
-        )}
-      </div>
-    </div>
-  );
-};

src/workspaces/officerdev/src/apps/TodoBoard/index.ts

@@ -1,10 +0,0 @@
-import type { AppRegistryMeta } from '../../AppRegistry';
-import { SquareKanban } from 'lucide-react';
-import { TodoBoardPanel } from './TodoBoardPanel';
-
-export { TodoBoardPanel } from './TodoBoardPanel';
-export { useTodoTree, useTodoItem, useTodoPatch } from './useTodos';
-
-export const appRegistryMetas: AppRegistryMeta[] = [
-  { key: 'todo-board', name: 'Todo board', icon: SquareKanban, component: TodoBoardPanel },
-];

src/workspaces/officerdev/src/apps/TodoBoard/useTodos.ts

@@ -1,52 +0,0 @@
-import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
-import { useClient } from 'hooks/useClient';
-
-export type TodoItem = {
-  id: string;
-  title: string;
-  theme: string;
-  status: string;
-  created: string;
-  priority: string;
-  due: string;
-  order: number;
-  file: string;
-};
-
-export type TodoTheme = { theme: string; heading: string; note: string; items: TodoItem[] };
-
-export type TodoPatch = { id: string; status?: string; priority?: string; due?: string; order?: number };
-
-export const useTodoTree = () => {
-  const client = useClient();
-  return useQuery({
-    queryKey: ['todos'],
-    queryFn: () => client.get<{ themes: TodoTheme[] }>('/todos'),
-    // The tree is files on disk that other agents edit while the board is open; refetch keeps the board
-    // honest without a watcher, which the sync contract allows (todo/README.md — poll is the cheapest
-    // thing that works).
-    refetchInterval: 30_000,
-  });
-};
-
-export const useTodoItem = (id: string | null) => {
-  const client = useClient();
-  return useQuery({
-    queryKey: ['todos', 'item', id],
-    queryFn: () =>
-      client.get<{ meta: Record<string, string>; body: string }>(`/todos/item?id=${encodeURIComponent(id!)}`),
-    enabled: id !== null,
-  });
-};
-
-export const useTodoPatch = () => {
-  const client = useClient();
-  const queryClient = useQueryClient();
-  return useMutation({
-    mutationFn: (patch: TodoPatch) => client.patch<{ ok: boolean }>('/todos/item', patch),
-    onSuccess: (_data, patch) => {
-      void queryClient.invalidateQueries({ queryKey: ['todos'] });
-      void queryClient.invalidateQueries({ queryKey: ['todos', 'item', patch.id] });
-    },
-  });
-};