Clarify configuration scopes and ownership

DEVLOG.md

@@ -2,6 +2,39 @@
 
 > Append-only session log. Read at session start. Update at session end.
 
+## 2026-07-14 — Configuration scope hierarchy and safety fixes
+
+Completed a screenshot-first Product Design audit of Mission Control,
+Personal/global settings, named Workspace settings, and Instance Admin at
+desktop and mobile viewports. The durable audit now inventories every route and
+control family by authoritative scope, audience, risk, prerequisites,
+inheritance/default source, duplication, and navigation; it also records the
+target sitemap, role model, ownership rules, redirects, deep links, and a
+P0/P1/P2 backlog with acceptance criteria.
+
+Implemented the highest-confidence safety and navigation slice without changing
+Forge's design language. Global Settings now opens a Personal overview with an
+explicit scope header and coherent Personal/Resources groups. Workspace
+settings name the tenant, collapse navigation behind a mobile Browse control,
+expose current-page semantics and a labeled search, and own canonical API access
+and developer-client routes. Instance authentication moved to
+`/admin/auth` as Identity & sign-in, with `/settings/auth` preserved as a
+redirect. The workspace dispatch page now persists its master toggle and
+fall-through mode at the point of explanation; runtime cards use the
+authoritative home workspace and no longer crowd four telemetry columns into a
+half-width card. The workspace operations shelf is now Activity, and its
+preferences control exposes dialog/expanded semantics, Escape close, and focus
+return.
+
+Verification: current-state and implemented-state screenshots were captured
+and inspected; TypeScript typecheck and production build passed; lint passed
+with existing native-select/type-import warnings; focused workspace router
+coverage passed **21/21**; the complete serial Vitest gate passed **1,264/1,264**
+with one skipped test; and the complete Playwright gate passed **39/39**. The
+browser run also exposed a pre-existing `/clear` race that could issue the
+command before its mock response stream finished; the test now waits for the
+completed stream and agent reply and passes with the full suite.
+
 ## 2026-07-14 — Manual GitHub retry persistence and release context hygiene
 
 Addressed the post-merge Codex review on PR #29 before production deployment.
@@ -85,6 +118,28 @@ fresh production build passed; and the full serial Playwright suite passed
 hard-coded two rail columns despite the existing work-count threshold; the
 assertion now follows the rendered layout mode and passed both alone and in the
 full suite.
+## 2026-07-14 — Settings scope and information-architecture review
+
+Mapped Forge's personal/global, workspace, Mission Control/Activity, and
+instance-admin configuration surfaces against their routes, permission gates,
+and Prisma ownership model. The review proposes one settings frame with an
+explicit Personal / Workspace / Instance scope control, preserves Mission
+Control as the cross-workspace operating home, renames the in-workspace dock to
+Activity, and reorganizes workspace configuration around work management,
+agents and automation, integrations, and governance.
+
+The code inventory also found two functional dead ends to address in the first
+implementation slice: auto-dispatch fall-through is displayed read-only and
+points to a workspace control that does not exist, and the global runtime
+inventory can link through a non-home workspace even though the runtime detail
+router requires the home `workspaceId`. The durable review records current
+ownership, naming changes, a phased migration, accessibility risks, and P0/P1/P2
+priorities under
+`docs/audits/settings-information-architecture-2026-07-14/`.
+
+The first draft was code-grounded while browser permission was pending. The
+implementation task subsequently received explicit Playwright permission and
+replaced that limitation with a fresh, inspected desktop/mobile evidence set.
 
 ## 2026-07-13 — AXI-102 patient-wait spam + expandable Command Center cards
 

docs/audits/settings-information-architecture-2026-07-14/screenshots/README.md

@@ -0,0 +1,65 @@
+# Current-state screenshot log
+
+Captured 2026-07-14 from the seeded Forge E2E instance after the user explicitly
+approved Playwright CLI for this audit. The app ran against the isolated
+`forge_e2e` Postgres database and Redis stack. Desktop captures use 1440×900;
+mobile captures use 390×844. Every accepted image was opened and visually
+inspected at original resolution.
+
+Artifact directory:
+
+`/home/bailey/.codex/visualizations/2026/07/15/019f6345-3f4d-7f72-8ff8-d13cb01139af/configuration-ia-current`
+
+## Accepted evidence
+
+| # | File | Viewport | Evidence |
+|---|---|---:|---|
+| 1 | `01-mission-control-desktop.png` | 1440×900 | Cross-workspace Mission Control and its global navigation entry points. |
+| 2 | `02-account-settings-agents-desktop.png` | 1440×900 | Mixed-ownership Account rail and agent-profile definition copy. |
+| 3 | `03-global-runtime-inventory-desktop.png` | 1440×900 | Global runtime inventory, scope wording, detail links, and card crowding. |
+| 4 | `04-workspace-settings-overview-desktop.png` | 1440×900 | Named-workspace overview, duplicated rail/index, and account scope jump. |
+| 5 | `05-workspace-general-desktop.png` | 1440×900 | Overloaded Workspace General page. |
+| 6 | `06-dispatch-fall-through-desktop.png` | 1440×900 | Read-only fall-through mode and dead-end instruction. |
+| 7 | `07-workspace-agent-bindings-desktop.png` | 1440×900 | Definition → binding → instance-policy model. |
+| 8 | `08-workspace-connections-desktop.png` | 1440×900 | Workspace mapping/policy surface and integration naming. |
+| 9 | `09-authentication-in-account-shell-desktop.png` | 1440×900 | Instance-wide authentication rendered inside Account settings. |
+| 10 | `10-instance-admin-overview-desktop.png` | 1440×900 | Strong instance scope/risk signal and admin hierarchy. |
+| 11 | `11-instance-agent-policy-desktop.png` | 1440×900 | Instance agent governance and destructive controls. |
+| 12 | `12-workspace-mission-control-preferences-desktop.png` | 1440×900 | Duplicate Mission Control name and mixed local/personal/workspace preferences. |
+| 13 | `13-workspace-settings-overview-mobile.png` | 390×844 | 16rem settings rail before content and nested scrolling. |
+| 14 | `14-account-settings-agents-mobile.png` | 390×844 | Account rail exposes only two destinations before its capped scroll region. |
+| 15 | `15-instance-admin-overview-mobile.png` | 390×844 | Admin navigation height plus clipped/crowded data tables. |
+| 16 | `16-workspace-mission-control-preferences-mobile.png` | 390×844 | Near-full-screen operations shelf and preferences popover reflow. |
+| 17 | `17-developer-access-in-account-shell-desktop.png` | 1440×900 | Workspace API keys presented in the Account shell. |
+| 18 | `18-agent-clients-in-account-shell-desktop.png` | 1440×900 | Clients derived from workspace keys but labeled as account-level. |
+
+## Rejected and recaptured states
+
+- The first workspace-overview capture was rejected because the PWA offline
+  prompt obscured the page. The prompt was dismissed through its documented
+  local state and the image was recaptured.
+- The first fall-through capture did not include the audited control. The
+  exact section was centered and recaptured.
+- The first mobile workspace capture inherited the expanded operations shelf
+  from the desktop walkthrough. Persisted shelf state was reset and the page
+  was recaptured.
+
+## Audit boundary
+
+Screenshots support visible hierarchy, reflow, naming, density, and obstruction
+findings. They do not by themselves prove screen-reader behavior, contrast
+ratios, focus order, permission behavior for every role, or full WCAG
+conformance. Those require DOM/axe, keyboard, and role-specific E2E checks.
+Figma and Orca were not used.
+
+## Implemented-state comparison
+
+After the first P0/P1 slice, four additional captures were inspected at the
+same viewports under:
+
+`/home/bailey/.codex/visualizations/2026/07/15/019f6345-3f4d-7f72-8ff8-d13cb01139af/configuration-ia-after`
+
+They show the new Personal overview and scope header, editable authoritative
+Dispatch & routing defaults, Instance Identity & sign-in inside the admin
+shell, and the collapsed mobile settings navigation that exposes content
+immediately.

playwright.config.ts

@@ -36,7 +36,7 @@ export default defineConfig({
     url: BASE_URL,
     reuseExistingServer: !process.env.CI,
     // First boot migrates + seeds + runs a full `next build`, so allow headroom.
-    timeout: 360_000,
+    timeout: Number(process.env.E2E_WEB_TIMEOUT_MS ?? 360_000),
     stdout: "pipe",
     stderr: "pipe",
   },

src/app/(app)/admin/auth/page.tsx

@@ -0,0 +1,14 @@
+import { AdminPage } from "@/components/admin-shell/admin-shell";
+import IdentitySettings from "@/components/admin-shell/identity-settings";
+
+export default function AdminIdentityPage() {
+  return (
+    <AdminPage
+      activePath="/admin/auth"
+      crumbs={["Instance", "Identity & sign-in"]}
+      contentClass="overflow-hidden bg-background text-foreground"
+    >
+      <IdentitySettings />
+    </AdminPage>
+  );
+}

src/app/(app)/settings/access/page.tsx

@@ -28,6 +28,7 @@ import {
   type McpOnboardingProvider,
 } from "@/components/mcp-integration-blocks";
 import { trpc } from "@/lib/trpc";
+import { useMaybeWorkspace } from "@/hooks/use-workspace";
 import { relativeTime } from "@/lib/utils";
 
 const ALL_SCOPES = [
@@ -141,6 +142,8 @@ type RevealKeyState = {
 };
 
 export default function AccessPage() {
+  const workspace = useMaybeWorkspace();
+  const clientsHref = workspace ? `/w/${workspace.slug}/settings/clients` : "/settings/clients";
   const searchParams = useSearchParams();
   const handledDeepLinkRef = useRef<string | null>(null);
   const { data: keys, refetch } = trpc.access.list.useQuery();
@@ -497,7 +500,7 @@ export default function AccessPage() {
     <>
       <Topbar
         title="Developer access"
-        subtitle="API keys + MCP endpoint for external agents."
+        subtitle={workspace ? `${workspace.name} · workspace API keys and MCP access` : "API keys + MCP endpoint for the current workspace."}
         actions={
           <Button variant="ember" size="sm" onClick={openCreate}>
             Register agent
@@ -506,7 +509,7 @@ export default function AccessPage() {
       />
       <div className="min-h-0 flex-1 overflow-y-auto">
         <div className="mx-auto max-w-3xl space-y-6 p-6">
-          <Intro baseUrl={baseUrl} />
+          <Intro baseUrl={baseUrl} clientsHref={clientsHref} />
 
           {/* ── Registered Agents ── */}
           <Section
@@ -1300,7 +1303,7 @@ function ScopeSelector({
   );
 }
 
-function Intro({ baseUrl }: { baseUrl: string }) {
+function Intro({ baseUrl, clientsHref }: { baseUrl: string; clientsHref: string }) {
   return (
     <Section
       title="Connect an external agent"
@@ -1323,7 +1326,7 @@ function Intro({ baseUrl }: { baseUrl: string }) {
       <div className="mt-2 rounded-md border border-ember/30 bg-ember/5 px-3 py-2 text-meta text-muted-foreground">
         Use this page to issue or rotate secrets. Use{" "}
         <Link
-          href="/settings/clients"
+          href={clientsHref}
           className="font-medium text-foreground underline decoration-border underline-offset-2 hover:decoration-foreground"
         >
           Agent Clients