Steward and agent API: Tessera briefs the board, agents talk through it

[data-angel]

Replaces #3, which GitHub closed when its stacked base (fleet-band, #2) merged and was deleted. Same commit (6d07368).

Stacked on #2 (Fleet).

Phase 1: steward. Any OpenAI-compatible endpoint can be the model; by default it's a LLooM gateway, using a tessera alias on a local model.

• Each tile gets a one-line summary on its footer.
• A brief sits at the head of the Needs-you lane:
  • what is going on;
  • what finished, failed or started asking since you last looked (read off the board, not guessed by the model);
  • what needs you;
  • what can be put away, with Close all and Undo.
• Each Keep or Close is logged to steward-feedback.ndjson, for tuning later.
• Safety:
  • credentials are redacted before sending;
  • nothing is sent in privacy mode;
  • tile text is marked as untrusted data in the prompts;
  • output is limited to known ids, and nothing working or waiting is ever offered for closing;
  • the headline renders as plain text;
  • it suggests only.

Phase 2: agent API. A tessera command, which is also a stdio MCP server, talks to the app over 127.0.0.1 with a 0600 token file. Browser requests are refused.

• Tools: board, read_tile, whoami, send_message, inbox, ask_human, get_answer, notify_human.
• Questions land in the lane, alerts and the phone, with one-tap options plus a reply field.
• A message is typed into a terminal agent's prompt only with your OK, unless you allow it.
• tessera install (Settings → Agents) puts tessera on PATH, installs skills/tessera into ~/.agents/skills (linked from ~/.claude/skills), and registers the MCP server with Claude Code and Codex (backing up ~/.codex/config.toml first).

Verification

• swift test: 195 pass. New tests cover redaction, steward parsing and guardrails, the MCP handshake and tools, and ask/answer, messaging and privacy through a real Workspace. They also run the bundled tessera-cli end to end against the in-app server (token, 401, 403 on Origin, exit codes 0/2/3, mcp over stdio).
• A live debug run with the steward on a local LLooM gateway showed the brief, footer summaries, and an agent's question and note in the lane.

🤖 Generated with Claude Code