platform/TODO.md

TODO — the index

Deferred work. The items live in todo/, one file each, grouped by theme; this file is the map over them and is GENERATED — run bun run todo:index after any change rather than editing it here. Format and the two-way-sync contract: todo/README.md. Browse and edit it at /todos in the app.

Context, corrected 2026-08-07. This list used to open by saying Officer was "collapsing from multi-tenant / open-source-ready to a single-user platform", and told you to treat multi-tenant indirection as accidental complexity. That direction was reversed. The permission model shipped on 2026-08-07 to serve a real goal — deploy to the company server, onboard people, give each one their own Gitea account through the platform. Per-user scoping is now a requirement, and the items that proposed deleting it have been removed rather than left to mislead the next reader.

What did NOT reverse: execution permissions (terminal, chat, tasks, files, desktop, browser) run as the owner's OS user and can never be granted. Indirection there really is accidental complexity.

Urgent

• due 2026-08-22 — Settings to choose which server each feature uses — fleet/settings-to-choose-which-server-each-feature
• An affordance: a scoped agent warns when a request lands outside its scope — affordances/an-affordance-a-scoped-agent-warns-on-the

Themes

96 open, 30 closed, across 32 themes.

Theme	Open	Closed
Affordances	2	0
Agents coordinating agents	2	0
Speaking into a session from the backend	1	1
Backburner	3	0
Background jobs	2	1
Chat interface	1	0
Code editor	1	0
Components — the shared UI layer	1	0
File watchers	1	0
Fleet — one command across every server	5	2
Headscale	0	5
Infra (alpha)	7	0
Known bugs	5	3
Memory — one store instead of per-harness files	1	0
Mobile apps	4	0
Multi-user	17	5
Notifications	1	0
Plugin ecosystem — before it opens to third parties (2026-08-18)	3	0
Plugin infrastructure	2	0
Plugin repos — what writing their READMEs turned up	10	9
Plugin system — gaps the email extraction found (2026-08-18)	3	0
Prompt library	1	0
SendOff	1	0
Settings — portable, and readable by an agent	2	0
Shell — spotlight and the dock	4	1
Sub-agents — agents spawning agents	0	2
Sudo terminal modal	1	0
Tooling — the list about the list	0	1
Transmission	6	0
URL state — routing, query strings and selection	4	0
Waiting on the owner to run it	3	0
Workspaces & Panels	2	0

Records — no items, kept for the reasoning

• Affordances (2026-08-19)
• Email
• Inputs outside forms (2026-08-19) — swept, fixed, closed
• Release-binary dependencies (2026-08-19)

Newest ten

• 2026-08-25 An affordance: a scoped agent warns when a request lands outside its scope — affordances/an-affordance-a-scoped-agent-warns-on-the
• 2026-08-25 Resurrect Projects/Apps — backburner/resurrect-projects-apps
• 2026-08-25 Refresh mid-turn folds the live tool call — it reads as finished while still running — known-bugs/refresh-mid-tool-call-renders-the-turn-folded
• 2026-08-25 The model picker shows claude-code instead of the model that is running — known-bugs/the-model-picker-shows-the-bare-harness
• 2026-08-25 Understand how Claude and opencode do memory, then centralize both into one vector database — memory/understand-and-centralize-agent-memory-into-a
• 2026-08-25 Deep-link a todo notification straight to that item's markdown — mobile-apps/deep-link-a-todo-notification-to-its-file
• 2026-08-25 Add a favorites tab/panel to the file browser — multi-user/add-a-favorites-tab-panel-to-the-file-browser
• 2026-08-23 A worker cannot verify that the owner delegated to a manager, so it has to ask every time — agent-coordination/a-peer-cannot-verify-a-delegation
• 2026-08-23 An agent cannot learn its own transcript id, so it cannot sign its own work — agent-coordination/an-agent-cannot-learn-its-own-session-id
• 2026-08-23 The SendOff file size limit is one constant for everybody — sendoff/per-user-size-limit