feat(agent-org): flatten team capabilities

[ShiboSheng]

Problem

Fixes #757.

PR1 establishes the authoritative long-lived Team lifecycle, but the persisted Team definition still models a recursive hierarchy and does not provide trusted, independently configurable Writer grants and Member communication links. Later TaskGraphWriter and peer-messaging work needs stable flat Member identities and immutable launch-time capability facts; it must not infer authority from role, hierarchy, UI state, or a mutable template.

The rollout also exposed two upgrade-boundary failures that prevented the PR1+PR2 product from being exercised safely on existing installations:

• the published v1.2.3-v1.2.5 15-column agent_org_runs schema cannot serve the new lifecycle columns;
• after the accepted old Agent Org runtime reset, retained historical Team Sessions still carry org_member_id and could consume standalone SDE page capacity, producing an empty filtered page with hasMore=true and a visible Retry state.

Solution

This stacked PR targets fix/issue-756-authoritative-team-lifecycle and delivers the PR2 definition/capability boundary:

• Replace recursive hierarchy with one Coordinator plus 1..=50 flat Members carrying stable member_id values. role is display/expertise only.
• Persist additional TaskGraphWriter Member IDs independently from canonical undirected Member communication links. Writer grants never imply links and links never imply Writer authority.
• Materialize every new Team's default full connectivity as explicit canonical pair edges. The Coordinator is excluded from pair rows and remains bidirectionally reachable with every Member by invariant.
• Preserve surviving IDs and policy during model-driven roster edits, connect new Members to existing Members by default, and remove dangling grants/links when a Member is deleted.
• Route trusted settings through a dedicated full-replace command whose actor is constructed inside Rust. Model tools cannot submit grants or links, and disk success precedes the in-memory replacement.
• Freeze flat roster, Writer allowlist, and canonical links into AgentOrgLaunchSnapshot; runtime capability indexes compile to HashSet membership checks. Running Teams never reread mutable templates.
• Replace the communication matrix with per-Member connection summaries and a right-side peer panel. The panel edits the main Team draft, renders at most 49 peers, synchronizes both views of one canonical pair, and has no independent Save action.
• Keep Writer activation and peer messaging closed until PR7 and PR9 respectively.

For the upgrade boundary, schema initialization recognizes only the exact published 15-column legacy run fingerprint. A match resets exactly agent_org_initial_inputs, agent_org_member_materializations, agent_org_run_progress, and agent_org_runs in one transaction, then recreates the single canonical schema. Current schemas remain idempotent; unknown or locally modified layouts fail closed and are never destructively reset. Ordinary Rust/CLI Sessions and other data are untouched.

Standalone SDE pagination now excludes any Session with org_member_id in SQL before LIMIT. This preserves page capacity and keyset cursor semantics without deleting or modifying retained historical Sessions; valid current Team roots continue to use the Agent Org stream.

Potential risks

• The exact official legacy-schema match intentionally abandons old Agent Org run envelopes. The four runtime tables are rebuilt without backup, and that runtime state cannot be restored by reverting the code. This product decision preserves ordinary Sessions but may leave historical Coordinator/Member Sessions, messages, Tasks, Inbox rows, usage, WorkItem/Routine references, and other artifacts as retained history.
• Unknown legacy/internal schemas are deliberately not guessed or reset. They remain available for diagnosis and may continue to fail canonical reads until handled explicitly.
• Old recursive Team definitions are not heuristically converted. The persistence path backs up the old bytes and resets to validated flat defaults rather than inventing Member identity or capability policy.
• This is a stacked PR and must be reviewed/merged after PR feat(agent-org): add authoritative team lifecycle #781. Its base should be retargeted to develop only after PR1 lands and the resulting diff is reverified.
• The redesign remains fail-closed behind ORGII_AGENT_ORG_REDESIGN=1; enabling the incomplete stack early exposes configured/frozen Writer and communication facts but intentionally does not activate PR7 graph-write or PR9 peer-send behavior.
• The packaged application and user acceptance passed, but the full WDIO rendered E2E suite was not rerun on the final follow-up commit. The relevant specs were updated and reviewed, and the final packaged real-data pagination path was exercised directly. UI screenshots are not attached yet, so the PR remains Draft.
• Rollback before enabling the gate is to disable the flag and revert the PR. After an exact legacy runtime reset, rollback cannot recover the abandoned four-table data; retained ordinary Session data remains available.

Verification

• cargo test -p agent_core agent_org -- --nocapture — 227 passed.
• cargo test -p agent_core core::session::persistence -- --nocapture — 34 passed.
• cargo test -p org2 agent_sessions::session_directory::aggregation::tests -- --nocapture — 13 passed.
• npm test -- --run src/scaffold/WizardSystem/variants/AgentOrg/MemberCommunicationPanel.test.ts src/scaffold/WizardSystem/variants/AgentOrg/orgTree.test.ts src/api/tauri/rpc/schemas/agentOrgs.test.ts — 16 passed.
• npm test -- --run src/store/session/sessionAtom/__tests__/sidebarLoaders.test.ts src/api/tauri/rpc/__tests__/sessionAggregateSchemas.test.ts — 28 passed.
• cargo check -p agent_core --all-targets && cargo check -p org2 --all-targets — passed.
• cargo clippy -p agent_core -p org2 --all-targets -- -D warnings — passed.
• npm run lint — passed.
• npm run check:circular — no circular dependencies across 6,350 modules.
• cargo fmt --all -- --check and git diff --check — passed.
• ORGII_AGENT_ORG_REDESIGN=1 npm run tauri:build:fast — passed; produced the packaged ORG2.app from this worktree.
• Packaged real-data verification against ~/.orgii: the standalone SDE stream advanced 10 -> 20 -> 21 rows, then exhausted normally with no Retry, empty page, cursor stall, or new pagination/schema error in the log. No historical Session was deleted or modified by the pagination fix.
• User manually verified the latest packaged version and reported it passed.

Architecture review covered compilation, structure/dead code, naming, semantic ownership, default branches, domain leakage, developer clarity, wire shape, initialization parity, and resolver symmetry. No new wire or duplicate lifecycle owner was introduced by the follow-up.

Performance verdict: pass. Pagination remains one bounded keyset query using the existing ordered sidebar and root-membership indexes; no polling, cache, retained state, dependency, or frontend retry path was added.

frontend-ui-audit could not be rerun during final handoff because its referenced SKILL.md is absent from both the workspace and user skill directories. Existing UI unit/rendered specs and packaged manual acceptance are recorded above; the PR remains Draft for review evidence completion.

[ShiboSheng]

orgii://cloud/session/ref?v=1&org=bfa7b134-2486-45fa-81ad-a369441fafb4&owner=776dbd69-ac1d-4f72-a0d4-69cb4f2667dd&session=codexapp-rollout-2026-08-12T00-30-58-019ff1a9-b497-7f60-9e6e-2086cceb7a6d