EPIC: Cross-user collaboration (contacts + human collaborators + agent delegation + human DM)

[jaylfc]

Spec: docs/design/cross-user-collaboration.md (PR #2011). Owner decisions locked 2026-07-18. This is the SPINE of Collab GA; the hogne pilot is the Collab GA demo.

A remote taOS user is a hub friend edge + local contacts row (never an agent-registry row). Their agents join as normal external-selfjoin identities tagged sponsor_contact_id (revoking the human cascades to their agents). Delegation is an auto-mediated invite handshake, not bus federation. Human DM extends the chat store over an instance-to-instance peer channel.

Milestones (each links its own slice issues):

• A: contacts_store + peer_links + signed-envelope peer channel + rate limits
• B: member_kind=human + collab invite kind + two-sided consent
• C: transport T0 = headscale guest-node ACL-pinned to :6969 (C1 ACL-isolation spike is a HARD go/no-go gate)
• D: agent delegation (sponsor_contact_id, scope tiers, denylist files_write/decisions_write, cascades, kill-switch)
• E: human-to-human DM over the peer channel (store-and-forward outbox, dedupe)

Pilot demo path: A1,A2,A4(UI) -> B1 -> C1,C2 -> D1 -> E1. Lanes: lead=foundations/security, hognek=infra (relay, guest-preauth+ACL), fleet=bounded test/UI cards. Subsumes the hub doc's open friend-to-friend transport question; leaves the bus/multi-user-local/taOSgo alone.

[jaylfc]

@hognek the backend foundation slices are open for your agents - this is the flagship collaboration epic and rides the rails you already know. Suggested build order (each is its own issue, spec is docs/design/cross-user-collaboration.md):

1. Collab A1 (lead): contacts_store + peer_links + signed-envelope peer channel #2013 (A1) contacts_store + peer_links + signed-envelope peer channel - the unblocker, everything else needs it. Security-sensitive (new bearer peer-token plane, Ed25519 envelopes) so tests matter; reuse tinyagentos/hub/identity.py crypto, do not reinvent.
2. Collab A2 (lead): friend-accept -> contact row + peer-link handshake #2014 (A2) friend-accept -> contact row + handshake wiring.
3. Collab B1 (lead): member_kind=human + collab invite kind + two-sided consent #2016 (B1) member_kind=human + collab invite kind + two-sided consent (reuses the fix(invites): failed approve no longer burns the invite + scope validation at mint #2002 invite state machine).
4. Collab D1 (lead): agent delegation handshake + sponsor_contact_id + cascades #2019 (D1) agent delegation + sponsor_contact_id + cascades - the payoff.
5. Collab E1 (lead): human DM over peer channel (schema migration + outbox) #2020 (E1) human DM schema + outbox; Collab F: collaborator community view (stats + leaderboard + live kanban + community chat) #2021 (F1/F2) the community-view projection + leaderboard rollup.
   Plus the two already tagged you: Collab A3 (hognek): hub sealed-envelope relay on taos.my (T1) #2015 (A3 hub relay) and Collab C2 (hognek): guest-preauth mint + ACL automation + mesh-status guest links #2018 (C2 guest-preauth + ACL). The free-model fleet is taking the UI + test cards off the board in parallel. Claim what suits your agents, comment when you start so we do not collide, PR to dev, and I review + fold findings same-day. No rush - grab what you can.

[hognek]

Claiming for hognek's agent fleet — working on this.

📋 Build order per jaylfc: A1→A2→A3→B1→C1→C2→D1→E1→F