platform/TODO.md

TODO — the index

Deferred work. The items live in todo/, one file each, grouped by theme; this file is the map over them and is GENERATED — run bun run todo:index after any change rather than editing it here. Format and the two-way-sync contract: todo/README.md.

Context, corrected 2026-08-07. This list used to open by saying Officer was "collapsing from multi-tenant / open-source-ready to a single-user platform", and told you to treat multi-tenant indirection as accidental complexity. That direction was reversed. The permission model shipped on 2026-08-07 to serve a real goal — deploy to the company server, onboard people, give each one their own Gitea account through the platform. Per-user scoping is now a requirement, and the items that proposed deleting it have been removed rather than left to mislead the next reader.

What did NOT reverse: execution permissions (terminal, chat, tasks, files, desktop, browser) run as the owner's OS user and can never be granted. Indirection there really is accidental complexity.

Themes

77 open, 18 closed, across 28 themes.

Theme	Open	Closed
Affordances	1	0
Speaking into a session from the backend	2	0
Backburner	2	0
Background jobs	1	0
Chat interface	1	0
Code editor	1	0
Components — the shared UI layer	1	0
File watchers	1	0
Files app — routing	3	0
Fleet — one command across every server	2	0
Headscale	0	5
Infra (alpha)	5	0
Known bugs	2	1
Mobile apps	2	0
Multi-user	17	3
Notifications	1	0
Plugin ecosystem — before it opens to third parties (2026-08-18)	3	0
Plugin infrastructure	2	0
Plugin repos — what writing their READMEs turned up	10	9
Plugin system — gaps the email extraction found (2026-08-18)	3	0
Prompt library	1	0
Shell — spotlight and the dock	2	0
Sub-agents — agents spawning agents	2	0
Sudo terminal modal	1	0
Tooling — the list about the list	1	0
Transmission	6	0
Waiting on the owner to run it	2	0
Workspaces & Panels	2	0

Records — no items, kept for the reasoning

• Affordances (2026-08-19)
• Email
• Inputs outside forms (2026-08-19) — swept, fixed, closed
• Release-binary dependencies (2026-08-19)

Newest ten

• 2026-08-21 No way to see which affordances are reaching your agents, or to turn one off — affordances/no-way-to-see-which-affordances-are-reaching
• 2026-08-21 Generalise it: deliver a turn to a named session, from anywhere in the backend — agent-delivery/generalise-it-deliver-a-turn-to-a-named
• 2026-08-21 The cost of resuming grows with the transcript — agent-delivery/the-cost-of-resuming-grows-with-the-transcript
• 2026-08-21 Show how long a turn took, beside its cost and tokens — chat/show-how-long-a-turn-took-beside-its-cost
• 2026-08-21 Map every custom component, centralise it, and let a theme override it — components/map-every-custom-component-and-centralise-it
• 2026-08-21 Watch a directory, and attach actions to what lands in it — file-watchers/watch-a-directory-and-attach-actions-to-what
• 2026-08-21 A way to mark a commit "this one ships", so a release is not just master's tip — fleet/a-way-to-mark-a-commit-this-one-ships-so-a
• 2026-08-21 iPhone Action Button → run an Officer task from a locked phone — mobile-apps/iphone-action-button-run-an-officer-task-from
• 2026-08-21 The mobile recorder app, and the dispatcher agent behind it — mobile-apps/the-mobile-recorder-app-and-the-dispatcher
• 2026-08-21 A plugin's settings routes are reachable by anyone the plugin is granted to — multi-user/a-plugin-s-settings-routes-are-reachable-by