Make the hive visible: deliberation UI, grammar installer, and an activity graph

docs/spec/runtime/events.md

@@ -67,6 +67,20 @@ naming the thread inside that channel since issue #1890),
 `WorkflowDeleted` (issue #259 — a saved graph was replaced wholesale or removed;
 neither carries the TOML body, deliberately, since the journal reaches readers
 that have no business holding agent prompts or destination addresses),
+`TeammateAdded` / `DeskCreated` / `DeskDeleted` / `DeskMembersChanged` /
+`DeskHiveConfigured` (the structural audit trail: a teammate or desk minted at
+runtime, a seat moved, or a desk's move grammar installed or restored). These
+exist because **no durable row otherwise records that any of it happened** — the
+company record carries current state and nothing carries the change, so "who
+created whom" was unanswerable from the journal and a console could only infer
+it from a redacted tool-call frame that does not survive a reload. Both teammate
+creation paths (the orchestrator's `add_agent` tool and `POST {scope}/team`)
+journal the same variant, because two paths answering that question differently
+is how the gap opened. None carries a configuration body — the same rule
+`WorkflowUpdated` follows, since the journal reaches readers with no business
+holding an agent's prompt or a desk's move table. All five are **permanent**
+under the retention rule; their lifetime cardinality is "how often does an
+operator author these by hand", so permanence costs almost nothing),
 `WorkflowRunFinished` (issue #228 — the durable record of what a run did, from
 every entry point) and, from issue #371/#382, `WorkflowRunStarted` /
 `WorkflowNodeStarted` / `WorkflowNodeFinished` (the per-node progress trail; see

docs/spec/runtime/hivemind.md

@@ -347,6 +347,48 @@ leaves somebody outside it* means a decision is never contingent on the whole
 room agreeing; for a pair that is exactly one supporter, which is the only
 number available.
 
+## Installing a grammar without editing the manifest
+
+`company.toml` is not the only way in. `PUT {scope}/desks/{id}/hive` installs or
+replaces a desk's whole `hive` block at runtime, `DELETE` on the same path drops
+the override and restores whatever the manifest declares, and `GET` reports the
+block in force alongside the numbers it derives.
+
+The override is a **sibling collection** (`CompanyRecord::overlay_desk_hive`),
+not a field on `OverlayDesk`, and that is the design rather than an accident:
+`OverlayDesk` covers only console-created desks, so hanging the grammar there
+would leave the interesting case — installing a table on a desk the manifest
+declares — needing a second mechanism. It mirrors `AgentOverride`, which is the
+layer that already exists for "the operator edited a manifest-declared thing".
+Reset is therefore a `retain` and nothing else, because
+`CompanyRecord::effective_desk_hive` falls through to `manifest.group_chats`.
+
+Replacement is **wholesale**, unlike `AgentOverride`'s field-wise merge. A
+`moves` table is a single artefact — merging one seat into a stored table is how
+a desk ends up running a grammar nobody authored — and every knob is an `Option`
+whose `None` already means something, so "clear `quorum` back to the derived
+default" is only expressible if the block is replaced entire.
+
+The route runs `manifest::hive_problems`, the **same** function the manifest
+loader calls, so the runtime cannot accept a block a `company.toml` carrying it
+would be refused for. It judges the table against the desk's **effective**
+roster rather than its declared one, so overlay additions and Team-API
+retirements count — which means it can legitimately refuse a table the manifest
+accepted, because a table valid when `company.toml` was written stops being
+valid once a seat retires.
+
+An episode already running is unaffected: `EpisodeDriver` holds its `HiveDesk`
+as a snapshot for the episode's life, so a room cannot have its quorum moved
+underneath it mid-argument. The change takes effect on the next message that
+opens one.
+
+Deleting a desk drops its installed grammar with it — without that, an overlay
+desk re-created under the same id silently inherits a table nobody installed.
+
+Each write journals a `DeskHiveConfigured` row carrying the desk, whether it was
+a reset, and who asked — but **not the table**, the same no-body rule
+`WorkflowUpdated` follows. See [`events.md`](events.md).
+
 ## How an episode ends
 
 | Ending | Means | The `hive-report` line |

examples/live_company_turn.rs

@@ -82,6 +82,7 @@ async fn main() -> anyhow::Result<()> {
 
     let manifest: CompanyManifest = toml::from_str(MANIFEST)?;
     let record = CompanyRecord {
+        overlay_desk_hive: Vec::new(),
         overlay_retired_agents: Vec::new(),
         overlay_agent_edits: Vec::new(),
         id: CompanyId::new("demo"),

frontend/README.md

@@ -23,7 +23,7 @@ and survives a refresh.
 | View | What it does |
 |---|---|
 | **Overview** | The company's knowledge graph, full-bleed — see [`src/views/overview/README.md`](src/views/overview/README.md) |
-| **Chat** | A channel-and-DM workspace: channel rail, threaded timeline, composer, thread panel, and the roster in a side pane — see [`src/views/chat/README.md`](src/views/chat/README.md) |
+| **Room** | A channel-and-DM workspace: channel rail, threaded timeline, composer, thread panel, and the roster in a side pane — see [`src/views/room/README.md`](src/views/room/README.md) |
 | **Tasks** | A built-in Kanban board (drag cards between columns) |
 | **Approvals** | The inbox of things parked for your decision, with approve/decline |
 | **Workflows** | A read-only [React Flow](https://reactflow.dev) canvas of how work is routed (lazy-loaded) |

frontend/pnpm-workspace.yaml

@@ -2,4 +2,5 @@
 # production build needs esbuild's platform binary, including when Tauri runs
 # this command as its `beforeBuildCommand`.
 allowBuilds:
+  '@sentry/cli': false
   esbuild: true

frontend/src/api/client.ts

@@ -40,6 +40,8 @@ import {
   type ConnectionState,
   type CreateDeskInput,
   type DeskDto,
+  type DeskHiveDto,
+  type DeskHiveDeclared,
   type EditAgentInput,
   type FeedbackInput,
   type FeedbackResponse,
@@ -779,6 +781,48 @@ export class OpenCompanyClient {
    * Delete an operator-created desk. A manifest (blueprint) desk cannot be
    * deleted at runtime and returns a 409; an unknown id is a 404.
    */
+  /**
+   * A desk's move grammar (`GET {scope}/desks/{id}/hive`).
+   *
+   * Its own call rather than a field on `listDesks`, because the payload
+   * carries the whole seat table and the derived numbers — an N+1 the desk list
+   * has no reason to pay on every render.
+   */
+  getDeskHive(deskId: string, company?: string | null): Promise<DeskHiveDto> {
+    return this.request<DeskHiveDto>(
+      "GET",
+      `${this.scope(company)}/desks/${encodeURIComponent(deskId)}/hive`,
+    );
+  }
+
+  /**
+   * Install or replace a desk's move grammar, without rewriting `company.toml`.
+   *
+   * Returns the derived result of what was installed, so the caller renders the
+   * effective numbers without a second round trip. A refusal comes back as an
+   * `ApiError` carrying the host's own sentence — rendered verbatim, because the
+   * host is the authority on why a table is invalid.
+   */
+  putDeskHive(
+    deskId: string,
+    declared: DeskHiveDeclared,
+    company?: string | null,
+  ): Promise<DeskHiveDto> {
+    return this.request<DeskHiveDto>(
+      "PUT",
+      `${this.scope(company)}/desks/${encodeURIComponent(deskId)}/hive`,
+      declared,
+    );
+  }
+
+  /** Drop the installed grammar and fall back to the manifest's own block. */
+  resetDeskHive(deskId: string, company?: string | null): Promise<DeskHiveDto> {
+    return this.request<DeskHiveDto>(
+      "DELETE",
+      `${this.scope(company)}/desks/${encodeURIComponent(deskId)}/hive`,
+    );
+  }
+
   deleteDesk(deskId: string, company?: string | null): Promise<void> {
     return this.request<void>(
       "DELETE",

frontend/src/api/types.ts

@@ -230,6 +230,94 @@ export interface DeskDto {
   overlayCreated?: boolean;
 }
 
+/**
+ * `GET/PUT/DELETE {scope}/desks/{deskId}/hive` — a desk's move grammar.
+ *
+ * Mirrors `DeskHiveDto` in `src/server/operator.rs`.
+ *
+ * The `declared` / `effective` split is the reason this is its own payload
+ * rather than a field on {@link DeskDto}. A single `turnBudget: 9` on a
+ * three-seat desk is either an operator's decision or the derived `3 x members`,
+ * and the two behave differently the moment somebody joins — so one number
+ * cannot tell the editor whether adding a seat will change it.
+ */
+export interface DeskHiveDto {
+  deskId: string;
+  /** Where the block in force came from. */
+  source: "overlay" | "manifest" | "default";
+  /**
+   * Whether an episode would actually open right now.
+   *
+   * A one-member desk with `enabled: true` is still `false` — the flag says what
+   * the operator wants, not what the desk can do.
+   */
+  deliberates: boolean;
+  /** The block as authored. Snake_case: this field **is** the manifest block. */
+  declared: DeskHiveDeclared;
+  /** What the runtime will use, every default resolved against membership. */
+  effective: {
+    turnBudget: number;
+    quorum: number;
+    blindRound: boolean;
+    dominanceCap: number;
+    repetitionCap: number;
+    requireGrounded: boolean;
+    requireEvidential: boolean;
+    refutationCap?: number | null;
+  };
+  /** Every move a table may name, and the three no table can take away. */
+  moveKinds: string[];
+  ungatedKinds: string[];
+  seats: DeskHiveSeatDto[];
+  /**
+   * How many seats may deposit a distinct supporter, and whether that clears
+   * the effective quorum. `propose` counts — in the fold a proposal is already
+   * its own author's support.
+   */
+  eligibleSupporters: number;
+  reachesQuorum: boolean;
+}
+
+/**
+ * The `[[group_chat]].hive` block as authored — snake_case, because it is the
+ * TOML block verbatim and a camelCase twin would be a second shape to keep in
+ * step with it. Every key absent means "not said", which is distinct from any
+ * value it could hold.
+ */
+export interface DeskHiveDeclared {
+  enabled?: boolean;
+  turn_budget?: number;
+  quorum?: number;
+  blind_round?: boolean;
+  moves?: Record<string, string[]>;
+  require_evidential?: boolean;
+  refutation_cap?: number;
+  dominance_cap?: number;
+  repetition_cap?: number;
+  referral?: {
+    enabled?: boolean;
+    max_hops?: number;
+    reach?: string;
+    returns?: boolean;
+    peer_cap?: number;
+  };
+}
+
+/** One seat, and the moves it may open a line with. */
+export interface DeskHiveSeatDto {
+  agentId: string;
+  label: string;
+  role: string;
+  /** Already ordered and already unioned with the ungated three. */
+  moves: string[];
+  /**
+   * Whether the table governs this seat at all — invisible from `moves` alone,
+   * since "named with every kind" and "not named" produce the same list and
+   * only one of them is a decision somebody made.
+   */
+  governed: boolean;
+}
+
 /**
  * `GET {scope}/operator-channel` — the identity of the company's
  * always-present, durable Operator feed (issue #1757 rework): a read-only
@@ -1161,6 +1249,19 @@ export interface TeamMemberDto {
    * guessing one from `tier`.
    */
   isOrchestrator?: boolean;
+  /**
+   * The desks this teammate may hand work to (`[[agent]].delegates_to`), as
+   * declared — `["*"]` meaning every desk.
+   *
+   * The company's **delegation address space**: the edges a teammate *could*
+   * traverse, as opposed to the ones it has. The comms graph draws it so a
+   * company that has not run yet still shows its wiring rather than a set of
+   * unconnected dots.
+   *
+   * Absent when the teammate delegates nowhere, and on a host that predates the
+   * field — in which case the graph draws observed traffic only.
+   */
+  delegatesTo?: string[];
   /**
    * This teammate's tool grants (issue #601) — the **same** three lists, from
    * the same host-side constructor, that `GET .../team/{agentId}` serves.