feat(agent-org): flatten Team definitions and freeze capabilities

[ShiboSheng]

Problem

Replaces #825.

Fixes #757.

Agent Org Team definitions still used the recursive hierarchy contract while the long-lived runtime introduced by the PR1 stack needs a stable, flat launch contract. Writer grants and Member communication policy were not represented as independent, validated capabilities, the legacy Agent Org runtime schema could prevent upgraded installations from starting a new Team, and cached workstation tabs could retain a pre-flat Team snapshot after an upgrade.

Solution

This PR is stacked directly on #834 (codex/issue-756-pr1-selected-rebuild) and contains exactly three adapted commits.

• Replace recursive Team definitions with Coordinator + flat Members, assign stable Member IDs, persist independent additional TaskGraphWriter grants and canonical undirected Member communication links, and freeze roster/grants/links into the immutable launch snapshot.
• Replace the communication matrix with per-Member connection summaries and a right-side peer panel backed by one canonical draft pair set. The main Team form remains the single trusted full-replace save boundary.
• Recognize and transactionally reset only the exact official 15-column legacy Agent Org runtime envelope, while preserving ordinary Rust/CLI Sessions and failing closed for unknown layouts.
• Exclude orphan Agent Org Member sessions from standalone SDE pagination.
• Validate cached Agent Org tab snapshots against the current RPC schema, discard stale legacy snapshots, and prefer the canonical definition loaded by ID.

Writer grants and communication links are stored and frozen but remain inactive until their later feature slices.

Potential risks

• This PR depends on feat(agent-org): add authoritative team lifecycle #834 and must not merge before it.
• An exact legacy 15-column agent_org_runs fingerprint causes the four Agent Org runtime envelope tables to be rebuilt. Old Team runs are intentionally abandoned and cannot be recovered by reverting; ordinary Rust/CLI Sessions remain outside the reset scope.
• Legacy recursive Team definition files are backed up byte-for-byte and reset to the new built-ins rather than guessed into a flat topology.
• The stacked packaged restart test exposed a real frontend rehydration defect. The canonical file and direct agent_orgs_list RPC retained Planner Writer=true and the removed Planner↔Implementer edge, but a restored Workstation Team tab rendered its stale, current-schema pre-save entitySnapshot (Writer=false, all four Members connected to 3 peers). The restored form also became dirty without user input, so an accidental Save could overwrite the correct canonical definition.
• The defect is isolated to the editable Workstation-tab cache fallback. It does not change the Rust definition store, RPC payload, database/DDL, immutable running-Team snapshot, or PR fix(agent-org): isolate runtime persistence namespace #836 compatibility behavior.
• To avoid repeatedly rebasing the remaining long PR stack, this UI correction is intentionally deferred to one dedicated stabilization PR based on the tip after all ten planned PRs are assembled. This PR remains Draft and must not be represented as independently ready until that follow-up exists and the stacked restart acceptance is rerun.
• A live-provider recovery walkthrough was not run; the packaged interaction used the isolated fake provider.

Architecture and performance audit

Reviewed ownership, flat types, lifecycle integration, persistence, RPC schema compatibility, initialization parity, resolver symmetry, naming, and removed recursive surfaces. No new polling loop, timer, subscription, worker, or cache was added. Team payloads remain bounded at 50 Members and 1,225 canonical edges, and the communication panel renders at most 49 peers.

The local UI-consistency pass found design-system Buttons, explicit dialog labeling, icon-only labels, and no newly added arbitrary pixel Tailwind values. The repository's declared frontend-ui-audit skill file is unavailable, so no skill-format audit report was generated.

Verification

Passed on this PR tip:

• cargo check -p agent_core -p org2 -p session_persistence --all-targets
• cargo test -p agent_core agent_org -- --nocapture — 227 passed.
• cargo test -p org2 orphan_org_members_do_not_break_standalone_cursor_or_has_more -- --nocapture — 1 passed.
• pnpm run typecheck
• focused Vitest across Agent Org RPC schemas, canonical pair helpers, communication panel, Run View store/hooks, and workstation tab storage — 7 files, 50 tests passed.
• node --check on the three changed Agent Org E2E/support files.
• git diff --check codex/issue-756-pr1-selected-rebuild...HEAD
• Commit hooks, including scoped Rust Clippy.

The complete stacked tip was also verified after PR3 was added; those results are recorded in #836.

Packaged true-machine checks on the stacked tip:

• The rendered Team form showed one Coordinator plus four peer Members with stable IDs and no recursive hierarchy.
• Toggling Planner Writer from false to true left all communication counts at 3.
• Removing Planner↔Implementer changed both endpoints from 3 connections to 2 while Reviewer and Tester stayed at 3; Cancel restored Writer=false and all counts to 3.
• Saving the same draft persisted sde-planner as an additional Writer and removed only the canonical undirected Planner↔Implementer pair.
• The already-running Team snapshot remained unchanged after the template save, confirming launch-snapshot immutability.
• Restart preserved the canonical file and direct RPC result but failed to rehydrate that canonical value into the restored editor, as described under Potential risks.

cargo fmt --all -- --check reports formatting differences already present on origin/develop in untouched files. No changed hunk in this PR contributes to that output.

Deferred stabilization

After all ten planned PRs are stacked, add one top-of-stack fix PR that:

• stops using an unversioned cached Team entitySnapshot as the source for an editable form;
• loads the canonical Team definition by ID before mounting the editor, with explicit loading/error/retry states;
• preserves genuine unsaved user edits rather than force-remounting on every same-ID refresh;
• adds rendered coverage for a valid-but-stale cache followed by canonical same-ID hydration; and
• reruns packaged Save -> quit -> restart -> restored tab acceptance while correlating canonical file, direct RPC, and rendered DOM state.

Commit provenance

Selected source commit	Adapted commit	Purpose
b0ceb1df39bc05f4818802585b94a2d80d3dca5a	710ee9b59433f48ae9a1eed6afc3507848a25d0c	Flat Team capabilities, immutable launch snapshot, and communication UI.
ba47fe237d2b0d71d4c0bd2c00566274aacff972	a73d12d7b86782c5e0e8cb5459ce4a825a3c965c	Exact legacy runtime reset and orphan Member-session pagination fix.
34e7e973a4de33042e6ae244c1376e8b2ef13c2e	c28004e1b7a9f5c460dd670fefdff987291110d9	Reject legacy cached Team snapshots.

Rollback

The branch can be reverted as a unit before merge. After an exact legacy runtime reset has committed, reverting cannot reconstruct discarded old Team run envelopes; recovery is to continue with newly created Team runs. Ordinary Session data is outside the reset scope.