[tellaho]

Overview

Category: new-feature

User Impact: Channel owners can choose who can read and participate, while people with viewing-only access can read messages and threads without posting controls.

Problem: Channel audience, the default access for new people, and each existing member’s role are separate decisions, but the UI does not present them together and guest views still expose writing paths.

Solution: Keep the access row fixed below the scrolling member list, with independent audience and participation defaults and confirmed role changes. Keep guest history and permalinks readable while enforcing guest write restrictions in the session, including queued signing/publication, uploads and typing.

• Existing members keep their roles when the default changes. Owners/admins can explicitly add someone as Participant, View only or Admin from the split Add menu. The main Add action uses the channel's new-person default.
• Guests retain Leave and member-directory reading. Public channels with a viewing-only default open directly for reading without Join or implicit membership.
• Signed metadata readback confirms access changes; uncertain saves can be checked without resending. Missing admission defaults preserve the legacy Member default; malformed explicit defaults use Guest.
• Channel creation’s access picker and link-only sharing are outside this change.

Changes

File changes

browser-host/relay-broker-api.test.mjs
Check that admission defaults use only the purpose-bound details route and reject elevated or duplicate values.

docs/channels.md
Describe the fixed access footer, independent member roles, guest restrictions and save recovery.

docs/relay-queries.md
Document reading public guest-default channels and restoring previews after Leave.

src-tauri/src/relay/channel_writes.rs
Allow only Member/Guest admission defaults in details commands, with native signing/publication boundary coverage.

src/bundled/channels/ChannelDetailsEditor.test.tsx
Keep text/lifespan draft coverage while checking that access is preserved when editing details.

src/bundled/channels/ChannelDetailsEditor.tsx
Move access editing out of the text/lifespan form and preserve current access during reloads and saves.

src/bundled/channels/ChannelGeneralAccess.test.tsx
Cover independent choices, confirmation/cancellation, missing defaults, pending saves and uncertain-save recovery.

src/bundled/channels/ChannelGeneralAccess.tsx
Show editable access controls for authorized members and a discovery-backed explanation for readers, with a subtle lock backdrop and no duplicate section heading.

src/bundled/channels/ChannelHeaderMenu.test.tsx
Verify that a joined guest retains Leave without gaining administration controls.

src/bundled/channels/ChannelHeaderMenu.tsx
Keep lifecycle actions available to joined guests.

src/bundled/channels/ChannelMembersDialog.module.css
Keep the access footer outside member scrolling, align artwork with its two text lines, and match the 8px leading/artwork gaps. Support narrow search-result rows and enlarged-text overflow.

src/bundled/channels/ChannelMembersDialog.test.tsx
Cover role captions, General access and readable guest directories without invitation controls.

src/bundled/channels/ChannelMembersDialog.tsx
Compose General access with member management and confirmed role-specific additions.

src/bundled/channels/ChannelPrivacyConfirmation.test.tsx
Keep creation warnings covered while moving existing-channel changes to General access and matching the Channel members only label.

src/bundled/channels/ChannelPrivacyConfirmation.tsx
Share consequence wording between creation warnings and General access confirmations.

src/bundled/channels/ChannelSettingsPanel.test.tsx
Align settings expectations with access management in the members dialog.

src/bundled/channels/ChannelSettingsPanel.tsx
Leave description editing in settings and remove the duplicate visibility editor.

src/bundled/channels/ChannelsPage.tsx
Connect community artwork and guest reading/lifecycle states without mounting a guest composer.

src/bundled/channels/MemberAdministration.test.tsx
Exercise guest role changes and additions, identity, cancellation, focus and changed-authority/membership gates.

src/bundled/channels/MemberAdministration.tsx
Display role captions and checked role choices through the existing member action menu.

src/bundled/channels/index.tsx
Pass the existing community reader into the channel page.

src/features/channel-members/administration-protocol.ts
Authorize explicit additions only while the target is absent and the viewer retains management authority.

src/features/channel-members/administration.test.ts
Cover explicit additions and reject changed membership, changed authority and absent-target removal.

src/features/channel-members/members.test.ts
Check invitation availability separately from guest/default reading access.

src/features/channel-members/members.ts
Hide invitations for guests and guest-default public previews while preserving existing writers’ invitation access.

src/features/messages/ChannelJoinNotice.test.tsx
Cover read-only notices and suppressed Join actions for guest/default transitions.

src/features/messages/ChannelJoinNotice.tsx
Show a compact read-only notice instead of suggesting Join when it would not grant writing.

src/features/messages/ChannelTimeline.tsx
Avoid prompting read-only viewers to start a conversation below the timeline.

src/features/messages/ThreadPanel.test.tsx
Verify readable guest threads and composer suppression across default changes.

src/features/messages/ThreadPanel.tsx
Keep guest thread context readable, with read-only notice and appropriate focus handoff.

src/features/relay/channel-details-protocol.ts
Parse, validate and serialize admission defaults independently of visibility and existing roles.

src/features/relay/channel-details.test.ts
Check default preservation, command validation and matching signed readback.

src/features/relay/channel-details.ts
Require readback of the chosen default and identify failures before publication without retrying writes.

src/features/relay/contracts.ts
Expose the signed viewer role and admission default as distinct channel-summary values.

src/features/relay/discovery-permissions.test.ts
Cover guest reading/writing, duplicate roles, cached evidence and public preview recovery.

src/features/relay/fold.test.ts
Keep exact discovery-summary assertions aligned with the legacy Member admission default.

src/features/relay/global-search.test.ts
Retain refusal assertions for writes from public search previews using the read-only access explanation.

src/features/relay/prepared.test.ts
Preserve exact hidden-channel summary coverage with the admission default included.

src/features/relay/discovery.ts
Separate reading, membership and writing; restore denied public previews only with fresh matching metadata.

src/features/relay/mentions.test.ts
Align the write-access rejection expectation.

src/features/relay/messages.ts
Gate direct message mutations on writing authority while retaining verified agent-owner edit/delete authorization.

src/features/relay/owned-agent-edits.test.ts
Exercise verified agent-owner edit/delete behavior for both Member and Guest viewers.

src/features/relay/send-to-channel.test.ts
Align direct-send rejection with the writing-access contract.

src/features/relay/session-attachments.test.ts
Align upload setup with the role-aware writing gate.

src/features/relay/session-permissions.test.ts
Exercise direct/queued writes, demotion during signing, signed retries, uploads and retained guest history/Leave.

src/features/relay/session.ts
Recheck guest writing at direct operations, signing and publication while preserving membership-based reads and lifecycle access.

src/features/relay/store.ts
Publish role/default summary changes and keep confirmed guests distinct from nonmember previews.

src/features/relay/typing.integration.test.ts
Check that demoted/guest viewers stop outgoing typing while incoming activity remains readable.

src/shared/design-system/DESIGN.md
Document the adopted compact text-link Select treatment.

src/shared/design-system/styles/components.css
Keep split-button segments aligned with joined corners and a centered caret while the menu is open.

src/shared/design-system/styles/forms.css
Use regular body-small text in the shared 24px text-link Select target while retaining its keyboard behavior.

src/shared/design-system/ui/Select.tsx
Expose the text-link appearance used by channel access without replacing Select keyboard or selection behavior.

src/shared/design-system/ui/SplitButton.tsx
Extend the existing SplitButton with compact size and independent menu availability while preserving its capsule, focus and agent-selection behavior.

src/shared/design-system/ui/controls.test.tsx
Check separate split-action activation, pending gates and menu focus return.

src/shared/design-system/ui/registry.ts
Record split-button and compact text-link Select support.

tests/browser/channel-header-menu.spec.mjs
Remove obsolete details-privacy assertions and verify Cancel is the next tab stop after duration in the details form.

tests/browser/channel-permissions.spec.mjs
Add three browser journeys for guest reading/Leave and old/nested permalinks without joining. Match the read-only dialog’s Channel access title.

tests/browser/fixture.mjs
Opt into signed guest/default metadata, nonmembership and bounded old-message/thread data for those journeys.

tests/fixtures/design-system/ui/ButtonSpecimens.tsx
Show the split Add control with its current role descriptions.

tests/fixtures/design-system/ui/FormSpecimens.tsx
Show the shared compact text-link Select treatment.

src/app/shell/SearchResults.test.tsx
Cover private Guest recents and labels using signed role discovery.

src/app/shell/SearchResults.tsx
Keep joined Guests distinct from public nonmember previews in search and recents.

src/bundled/channels/CanvasEditor.test.tsx
Keep archived read-only canvas and history coverage aligned with the general read-only explanation.

src/bundled/channels/CanvasEditor.tsx
Explain read-only canvas access without incorrectly describing every reader as archived.

src/bundled/channels/canvas-panel.test.tsx
Exercise the registered canvas panel through Guest promotion and demotion without granting saving.

src/bundled/channels/canvas-panel.tsx
Retain Guest canvas reading and subscribe to read-only state changes.

src/bundled/channels/useConversationTabs.test.tsx
Exercise the same panel-launcher lifecycle for Member and Guest viewers.

src/bundled/channels/useConversationTabs.tsx
Preserve live Guest panel context and readable tabs while keeping cached channels excluded.

src/features/channel-templates/capability.ts
Separate canvas reading/history authorization from contribution authorization; existing callers keep their default behavior.

tests/browser/duration-layout.mjs
Allow the current consumer to name its next focus target; creation retains its Private toggle assertion.

Reproduction steps

1. As an owner/admin, open an ordinary channel’s member dialog. The fixed footer below the scrolling member list shows an audience choice and a separate New people can choice. Scroll the member list; access remains below it.
2. Choose View only and cancel the confirmation; access stays unchanged. Confirm it, then check that existing participants retain their roles.
3. Search for someone outside the channel. Open Add’s caret menu and choose Participant, View only or Admin; verify the role-specific confirmation and Cancel path.
4. Open the channel as a Guest. Read history and a thread permalink; writing/Join/invitation controls are absent, while member-directory reading and Leave remain available.
5. Leave a public channel whose new-person default is Guest and reopen an old message or nested-reply link. History remains readable without publishing a join request.

Validation and limits

• Current head: b4fcc19f2b0e70a8b854afc4561fa9a32b9b970f, based on main 61695ec6e365f7ba002b09a51d7b040cd2935f2a. Preserves main's linked-message edits/deletes, roster recovery, existing SplitButton consumers and navigation behavior.
• Final access-footer app checks passed on 5376f6851 plus the artwork-centering change subsequently committed as 13b2bbcdb: two Chromium owner/Guest cases, both themes, wide/narrow and 150% text, actual scrolling, keyboard menus and confirmation/cancel. Geometry checks verify no gap above the separator, 4px between text lines, equal 8px leading/artwork gaps and artwork centered within 0.02px. The later changes are a comment correction and browser-test focus expectations.
• All 42 checks across the complete channel-header-menu and navigation-sidebar files passed Chromium and WebKit (2.0m) on the repaired tree committed as b4fcc19f2. This exercises both the corrected details focus order and the unchanged creation Private control.
• Mandatory push gates passed at b4fcc19f2: TypeScript/related units (132.27s), design checks (5.35s), Rust Clippy (1.97s) and destination/history checks. All 52 feature commits passed author/trailer audit. Hosted CI on the updated head remains separate.
• All six permission journeys passed Chromium and WebKit at 711582fc5, including the complete Guest canvas menu/host/tab/capability path, read-only editor and disabled Save. These run the actual app and production broker against a modeled signed relay; deployed enforcement remains separate.
• Earlier full-file unit/component batches passed 149 checks at 50d86b8b7, then 81 checks after separating canvas reading from writing; TypeScript and mandatory push gates passed at 711582fc5. The final UI iteration adds no persistent browser cases; it uses temporary captures of the real app.
• The prior hosted browser/flake failures all expected the removed Private toggle after the details duration control. The corrected details focus assertion now targets Cancel; creation still checks Private. New-head hosted CI is separate from local checks.
• The requested source review assessed 27c5744ab at 7/10. Membership, Guest search/canvas and default-copy repairs are published; no review of this final head has been assigned. The compact policy footer, split Add action menu and channel-default main Add behavior remain intentional.
• The owner accepted the latest UI iteration. Live role-add, live Guest Leave/reopen, Guest CLI/MCP rejection by the deployed relay, broad native validation and overall human acceptance remain open. This PR stays draft.
• This feature adds three browser journeys overall and removes none. The joined-Guest journey covers actual registered menu, host, tab owner and canvas wiring; role/default matrices remain in unit tests. The Guest canvas path failed before its host/context/read-authorization fixes and then passed both engines.

Screenshots

Actual app with neutral signed-relay fixtures. The private-access owner/Guest pair shows the final footer layout captured at 13b2bbcdb; later changes are comments and browser focus assertions. The Guest canvas capture remains from 711582fc5. Images do not establish deployed-relay acceptance.

Owner access controls	Guest reading access

Guest canvas reading

[tellaho]

🤖 Carl (AI agent): Princess Donut completed the requested adversarial source review of 27c5744ab against main 61695ec6e, scoring that snapshot 7/10. She traced production paths and the current relay contract; she did not run tests or assess the deployed relay.

Repairs in 711582fc53a6a1f24613614ed95f540c8f3d3ff6:

• Membership commands retain their relay-specific authorization, allowing a Guest's agent-removal workflow to publish and confirm a fresh roster while contribution writes remain blocked (d833df2b4).
• Joined Guests retain private-channel search/recents and can open/read canvas content and history. The complete menu → channel host → tab owner → canvas capability path now distinguishes reading from writing; saving stays denied (30c0fd187, b35d34603, 28ce9fbde, 711582fc5). The browser journey exposed both host/context rejection and capability read rejection before the fixes.
• The private access summary explicitly describes new members, documentation matches current reader copy, and the unused ghost Select variant is removed (e1e3c2222, eb88e8dcb).

Dispositions: retain the requested compact policy footer and split Add action menu. Plain Add continues to use the channel's admission default. Bot remains presented as Participating; its documented menu choices now match the UI (d97e38efc). Fresh signed metadata continues to restore public reading after Leave without restoring membership. The optional comment-position, cached-recovery-focus and incoming-typing presentation suggestions are deferred.

Validation: all six permissions journeys passed Chromium/WebKit at 711582fc5 (14.7s), using the actual app/production broker with a modeled signed upstream. Targeted full-file batches passed 149 checks at 50d86b8b7, then 81 checks on the canvas-read repair working tree. Final TypeScript and all mandatory push gates passed at 711582fc5 (types/related units, design checks and Rust Clippy). The shared-fixture typecheck passed at 50d86b8b7; that catalog is unchanged. The browser journey count is unchanged by the repairs.

Final-head independent re-review, human acceptance, live role-add, deployed-relay Guest CLI/MCP rejection and broad native acceptance remain pending. The PR remains draft.