feat(pm): expand MCP, routines, work items, inbox, and skills

[Neonforge98]

Problem

The parity audit was written against develop@ee7860c31, while this branch had only landed the first vertical slices. Important product and safety boundaries were still open: external CLI agents could miss MCP policy, MCP secrets could be returned by read APIs, assignee escalation could wake or cancel against the wrong agent, legacy and portable routines could diverge, saved-view layout could bleed across users or views, typed properties and Inbox lifecycle were not end to end, Skills had no durable provenance/consent snapshot, and stale Work Item edits or context-overflow retries could corrupt user intent.

This PR intentionally completes the existing parity batch on the current branch so the eight audited areas are reviewable as one integrated checkpoint. True-device testing then found that the current Project-panel route still exposed only List/Kanban, detail entry points could retain a stale org, actor properties could offer non-member agents, Inbox mute controls could appear to save without a viewer identity, and local Inbox reads omitted the exact local actor/Git identities used by Work Item comments and subscriptions.

Solution

• MCP and provider harness: inject the resolved MCP set into Claude, Codex, and ACP new/load paths; fail closed for disabled servers/tools and empty Claude policy; use owner-only ephemeral provider config; keep command/args/cwd/url/env/headers write-only through scoped sentinels; atomically persist 0600 config; redact transport errors/logs; repair Antigravity resume identity and headless hooks.
• Discussion routing v2: keep member-only threads silent; make assignee fallback a five-minute pending outbox escalation; cancel it only when the bound session/agent/agent-org replies or its matching Run terminates; preserve the delay after context exhaustion; support revisioned comment edit and tombstone delete.
• Routine Phase 5: unify legacy UI/CLI operations with the portable Routine graph; support project, org, existing-root, and --root-work invocation; add projectless webhooks, one-time/policy conversion, durable cancellation, UUID Run ids, a single bounded scheduler pass, transactional activation CAS/leases, queued promotion, and minimum schedule watermark updates.
• Views, statuses, and typed properties: add seven canonical status categories including blocked; preserve historical archived statuses while rejecting new assignment; add org-shared saved queries with per-user display preferences and ?view= identity; prevent cross-view display inheritance; add Table columns, semantic sorting, property filter/group/batch update, member values, multi-select values, and __none__ filtering. The authoritative Project-panel route now exposes List/Table/Kanban/Gantt/Calendar, Saved Views, property controls, batch property editing, and status management rather than leaving those features on an unreachable legacy page.
• Quick Actions: provide org-scoped CRUD/edit/archive and Work Item execution, scoped Chat slash actions with bounded on-demand caching, atomic Discussion/Run invocation, and provider-backed follow-up suggestions that resolve the current Session account/model on the backend and re-enter the normal submit/secret-scan/queue dispatcher.
• Inbox lifecycle: preserve status/assignee/priority/date/run/child event semantics end to end; scope coalescing to the authoritative Work Item; add viewer-scoped archive/unarchive, semantic detail rows, category mutes, parent/child notifications, and live-source authorization on reads and receipt writes. Viewer aliases now include the exact local actor id and Git email emitted by Work Item mutations, in addition to project member ids and the cloud account id, so a local event cannot disappear solely because the same person is represented in two identity namespaces.
• Skills sharing and consent: use repository-native .orgii/skills workspace sharing; record credential-free origin and stable identity; refresh through staged atomic replacement; fail closed on provenance/consent drift; freeze the effective skill manifest digest at Run enqueue and verify it again before dispatch.
• Robustness: add Work Item and comment revision CAS with conflict UI, structured context-exhausted classification that forces a fresh session, and a persisted chat queue bounded by global count, per-session count, per-message bytes, and total bytes.
• Cross-org safety: enforce ownership before local upsert and remote apply for status/property/view/Quick Action ids, validate member-valued properties against authoritative membership, and validate Quick Action targets at write and invoke boundaries. Project detail now resolves the loaded project's org before cached tab state, and actor editors load active members from the exact owning project with generation/scope guards.

Potential risks

• This is a deliberately large parity checkpoint. The eight areas share Work Item execution, routing, and persistence boundaries, but the review surface is substantially larger than the repository default PR size.
• Schema changes are additive and old serde payloads default safely. Rollback should revert the eventual PR merge commit; the new inert tables/columns can remain on disk. No destructive backfill or historical cleanup runs.
• MCP read/modify/write serialization is process-local, so two independent application processes editing the same config can still resolve as last-writer-wins. Secret-bearing fields are now write-only and UI callers must preserve, replace, or explicitly clear them via sentinel semantics.
• Repository-native Skills are shared through Git/workspace sync; this PR does not introduce a new orgtrack service artifact or release/version/rollback system.
• Agent reply persistence and deferred-escalation cancellation are two transactions. A process crash between them can leave the fallback pending until another matching receipt/terminal event.
• Queue persistence is bounded and crash-safe, but a crash after an external backend accepts a send and before local acknowledgement can still require explicit dispatch recovery.
• The OpenAI/Codex OAuth account and gpt-5.6-sol were true-device exercised successfully. Live Claude and ACP provider launches were not available in this profile, so those provider-specific MCP launch paths remain covered by their owning automated suites.
• Context-overflow recovery was not forced with an oversized paid-provider payload. Provider-backed Follow-up Suggestions are best-effort and isolated from the main transcript. They use the current Session provider through the shared provider factory; unavailable provider responses fail silently without delaying the completed turn.
• A valid actor-property assignment could not be exercised because the test project has no active member rows.
• The macOS binary and bundle contents were produced and launched, but final Developer ID signing failed because the required certificate is not installed on this machine.
• Worktree-per-task execution mode remains a separate evaluation item, not part of this parity batch.

Architecture and performance audit

The Rust/TypeScript ownership, wire, persistence, initialization, resolver, failure, and compatibility layers were checked across the affected paths. For the Inbox identity fix, the write path and read path now consume the same local identity resolver output: project aliases, the actual local mutation actor id, Git email, and the active cloud account id are deduplicated into one viewer set. No new wire format or schema was introduced by the true-device fixes.

Performance verdict: pass for the changed UI paths. Work-item and property reads are event-driven with generation/unmount guards; no timer, polling loop, hidden-tab worker, cache, or subscription was added by the identity fix. Property snapshots and derived Sets/Maps are limited to the active project, refresh bursts coalesce to one active plus at most one trailing read, saved-view preferences retain the existing 128-entry bound, and Table/Gantt/Calendar chunks mount only after first visit. The configured frontend-ui-audit skill was unavailable, so the rendered Tauri UI was manually checked for design-system use, keyboard/a11y labels, scope isolation, loading/empty states, and narrow-header layout.

Verification

Automated

• cargo test -p project_management --lib --no-fail-fast — 662 passed.
• cargo test -p agent_core --lib --no-fail-fast — 3198 passed, 2 explicitly ignored stress tests.
• cargo test -p key_vault --lib — 357 passed.
• cargo clippy --workspace --all-targets -- -D warnings — passed; only the existing future-incompatibility notice for block v0.1.6 remains.
• cargo check -p org2 — passed.
• MCP targeted suites — config 15, scope/update/test 11, connect 6, error-redaction 10, external-import 23, and TS schema 3 all passed.
• pnpm test -- --reporter=dot before the final true-device fixes — 1126 files and 8826 tests passed.
• After the true-device fixes and merging current develop@b9331da7e: pnpm run typecheck passed; 29 focused frontend files / 184 tests passed; cargo test -p orgtrack_core sources::codex::app --lib passed 59 tests with 1 fixture-dependent test explicitly ignored.
• Follow-up provider refactor: 4 focused frontend files / 21 tests passed; cargo test -p agent_core follow_up_suggestions --lib passed 6 tests; cargo test -p org2 follow_up_suggestions --lib passed 1 test; cargo check -p org2, changed-file ESLint, scoped pre-commit TypeScript, and scoped Clippy all passed.
• Inbox identity/lifecycle follow-up: pnpm test -- src/modules/MainApp/TeamInbox — 23 files / 157 tests passed; pnpm run typecheck, changed-file ESLint, and git diff --check passed.
• Changed JSON files passed jq empty; staged files were inspected for secrets, personal paths, debug artifacts, generated output, and unrelated formatting.

True-device Tauri app

• Built and cold-launched the generated macOS .app; verified Project-panel layout at 1350 px without tab/toolbar overlap.
• OpenAI/Codex provider: bound builtin:sde to the existing OpenAI OAuth account and gpt-5.6-sol; Quick Action Run wir_cf996c9d561946c9a026d29493adc03d succeeded and the real agent wrote PARITY_CODEX_OK.
• Follow-up Suggestions: invoked the new provider-agnostic side-query path against the existing Codex OAuth account and gpt-5.6-sol; the real Responses API round-trip returned exactly three valid suggestions with one primary in 5.28 seconds. The temporary live-test hook was removed before commit.
• MCP: configured pinned @modelcontextprotocol/server-everything@2026.7.4; Test Connection discovered 13 tools. A second real Codex Run wir_476bd281f3774a33b4c068302a2ae9fd called mcp__parity-smoke-20260819__echo and persisted PARITY_MCP_CODEX_OK. Only synthetic smoke-test secret values were used.
• Routine: ran cu-routine-timezone-0808 against root ORG-0841, created step Work Item ORG-0842, cancelled Run run_f9918c6645704e32908bdf9242c70e7a, then cancelled it again to verify the idempotent changed: false result.
• Busy-session queue: while a 12-second MCP operation was active, submitted a second message; the UI showed 1 queued, then automatically dispatched it after the first turn. Durable event order was first user → MCP tool → BUSYFIRSTOK → queued user → BUSYSECONDOK.
• Skills: verified workspace skill discovery from .orgii/skills.
• Work Item/Discussion/Quick Actions: created ORG-0841, created and edited a comment, created then tombstone-deleted disposable comment parity-delete-20260820-0136, created and invoked Quick Actions through the Discussion/Run path, and verified real Codex success rather than treating the initial unbound-agent error as a provider absence.
• Views: opened List, Table, Kanban, Gantt, and Calendar from the real Project panel; verified property columns/grouping, saved and reapplied a Calendar view, and applied the typed-property No value (__none__) filter.
• Statuses: created a custom Blocked status, archived/restored it, applied it to the Work Item, verified the raw status through org2-pm, and restored Todo.
• Typed properties: verified authoritative-org definition loading and that a project with no active members offers no agent impostors for an actor value.
• Inbox: the real status_changed event for ORG-0841 appeared as 1 unread after the viewer-alias fix; opening it marked it read and rendered Status changed / In review. Archive moved it into Archived, and Restore to inbox returned it to Updates. Mute categories were also persisted and read back through pm_inbox_prefs.
• Revision CAS: exercised the real Tauri comment command with an outdated revision and observed PM_ERR:REVISION_CONFLICT:expected=2:actual=3; the rejected content did not persist. The modal's two-version choice is covered by frontend tests but was not claimed as a stable true-device race reproduction.

The smoke-test MCP server, Routine, Work Item, Quick Actions, Saved View, status, and property definitions remain in the local test profile for inspection; no destructive cleanup was performed without confirmation.

Compatibility and rollback

Existing Work Item/Routine/Run payloads remain readable through serde defaults and the legacy-to-portable Routine bridge. Custom statuses continue to store raw text, so no Work Item status backfill is needed. Saved-view display preference is best-effort local state and shared query identity is unchanged. Revert the eventual PR merge commit to roll back code; additive schema objects may remain unused without deleting user data.