platform/TODO.md

TODO — the index

Deferred work. The items live in todo/, one file each, grouped by theme; this file is the map over them and is GENERATED — run bun run todo:index after any change rather than editing it here. Format and the two-way-sync contract: todo/README.md. Browse and edit it at /todos in the app.

Context, corrected 2026-08-07. This list used to open by saying Officer was "collapsing from multi-tenant / open-source-ready to a single-user platform", and told you to treat multi-tenant indirection as accidental complexity. That direction was reversed. The permission model shipped on 2026-08-07 to serve a real goal — deploy to the company server, onboard people, give each one their own Gitea account through the platform. Per-user scoping is now a requirement, and the items that proposed deleting it have been removed rather than left to mislead the next reader.

What did NOT reverse: execution permissions (terminal, chat, tasks, files, desktop, browser) run as the owner's OS user and can never be granted. Indirection there really is accidental complexity.

Urgent

• due 2026-08-22 — Settings to choose which server each feature uses — fleet/settings-to-choose-which-server-each-feature
• An affordance: a scoped agent warns when a request lands outside its scope — affordances/an-affordance-a-scoped-agent-warns-on-the

Themes

91 open, 29 closed, across 31 themes.

Theme	Open	Closed
Affordances	2	0
Agents coordinating agents	2	0
Speaking into a session from the backend	1	1
Backburner	3	0
Background jobs	2	1
Chat interface	1	0
Code editor	1	0
Components — the shared UI layer	1	0
File watchers	1	0
Fleet — one command across every server	5	2
Headscale	0	5
Infra (alpha)	7	0
Known bugs	3	2
Mobile apps	3	0
Multi-user	16	5
Notifications	1	0
Plugin ecosystem — before it opens to third parties (2026-08-18)	3	0
Plugin infrastructure	2	0
Plugin repos — what writing their READMEs turned up	10	9
Plugin system — gaps the email extraction found (2026-08-18)	3	0
Prompt library	1	0
SendOff	1	0
Settings — portable, and readable by an agent	2	0
Shell — spotlight and the dock	4	1
Sub-agents — agents spawning agents	0	2
Sudo terminal modal	1	0
Tooling — the list about the list	0	1
Transmission	6	0
URL state — routing, query strings and selection	4	0
Waiting on the owner to run it	3	0
Workspaces & Panels	2	0

Records — no items, kept for the reasoning

• Affordances (2026-08-19)
• Email
• Inputs outside forms (2026-08-19) — swept, fixed, closed
• Release-binary dependencies (2026-08-19)

Newest ten

• 2026-08-25 An affordance: a scoped agent warns when a request lands outside its scope — affordances/an-affordance-a-scoped-agent-warns-on-the
• 2026-08-25 Resurrect Projects/Apps — backburner/resurrect-projects-apps
• 2026-08-23 A worker cannot verify that the owner delegated to a manager, so it has to ask every time — agent-coordination/a-peer-cannot-verify-a-delegation
• 2026-08-23 An agent cannot learn its own transcript id, so it cannot sign its own work — agent-coordination/an-agent-cannot-learn-its-own-session-id
• 2026-08-23 The SendOff file size limit is one constant for everybody — sendoff/per-user-size-limit
• 2026-08-22 A commander picks the cheapest model that will do the job — for itself and for what it spawns — background-jobs/a-commander-picks-the-cheapest-model-that-will
• 2026-08-22 Revisit the bun 1.3 pin once 1.4 has been watched for a while — infra/revisit-the-bun-1-3-pin-once-1-4-has-been
• 2026-08-22 A plugin's permission should be on for every role by default, off only on request — multi-user/a-plugin-s-permission-should-be-on-for-every
• 2026-08-22 A user's settings should export and import as a plain file — settings/a-user-s-settings-should-export-and-import-as
• 2026-08-22 The same for system settings, owned by the Super Admin — settings/the-same-for-system-settings-owned-by-the