[#234] Control plane: token-free channel metadata for hosted rooms

[realproject7]

Fixes #234

EPIC Alignment

• Parent epic: [EPIC] Agent Gather Platform Pivot #77 — [EPIC] Agent Gather Platform Pivot.
• This ticket's role (per Control plane: token-free channel metadata for hosted rooms #234): Expose sanitized hosted-room channel metadata so the companion unified-rail UI (Unify dashboard and boardroom shell navigation into a three-panel workspace #218) can render real channel navigation from the existing local boardroom store — without central accounts, remote proxies, or token exposure.
• Contracts respected: GET /rooms and GET /rooms/<id> now expose hosted-room channels as exactly {id, name, type}, sourced from readBoardroom; removed channels omitted; missing store falls back to #general; owner not_found semantics unchanged; joined rooms get no channel fetch or projection.
• Boundaries honored: no src/browser/* (Unified workspace left rail: single host-tagged boardroom list with 1/3-2/3 navigation split #233/Unify dashboard and boardroom shell navigation into a three-panel workspace #218) and no src/cli/* (Launcher UX: make bare agentgather open the local dashboard #232) changes. No remote-room proxy/fetch path added.

Self-Verification

Adversarial diff re-read

• readRoomResponse runs the owner check (room.owner_user_id !== owner → not_found) before any channel read, so a non-owner never triggers a boardroom read and cannot learn another owner's channel metadata. listRoomsResponse filters by owner before attaching channels.
• readPublicChannels catches only ENOENT (no host boardroom store / no room-state record) and returns the legacy [#general] default — matching the room server's own runtime projection. Any other failure (e.g. a corrupt store) propagates as a 500 rather than being masked. Verified readRoomState throws native ENOENT so the no-store path is exercised by a real test.
• Projection is filter(lifecycle !== "removed").map({id,name,type}) — internal fields (lifecycle, createdAt) and any token/URL are structurally dropped; PublicChannel is the only channel shape the payload can carry.

Kill-list scan

• Scanned diff: no TODO/FIXME, no console.*, no any/as any, no stub/placeholder markers. Changes limited to src/platform/api.ts, src/platform/types.ts, and the two named test files.

Acceptance criteria (1:1)

• GET /rooms and GET /rooms/<id> return hosted-room channels with exactly id, name, type — projection + deepEqual tests.
• Removed channels omitted; legacy rooms fall back to #general — dedicated tests at API and HTTP layers.
• Non-owners receive not_found without metadata disclosure — owner-scope test asserts 404 and no channel leak.
• Public responses contain no token, invite/card URL, Authorization/Bearer, lifecycle, cursor, or file-path fields — token-free assertion tests (non-vacuous: channels asserted present first).
• Tests in test/platform-api.test.ts and test/platform-http.test.ts.
• pnpm build, lint, typecheck, kit-guard, no-stub, test all pass.

Evidence

• pnpm build — clean (tsc + copy-assets).
• pnpm lint — clean.
• pnpm typecheck — clean.
• pnpm kit-guard — 4 pane stylesheets clean.
• pnpm no-stub — clean.
• pnpm test — 402/402 pass (added 5 API + 1 HTTP channel tests).

Security invariants

• Token-free public payload; channel reads are local file reads (no remote fetch); no new runtime dependencies; localhost-only binding and platform-server auth behavior untouched.

Design Fidelity

N/A — control-plane API only; no UI surface in this ticket (#218 owns rendering).

Deviations

None. src/platform/http.ts was not modified: the HTTP layer forwards the API handlers' response body verbatim, so the channel projection lives entirely in src/platform/api.ts (logic) and src/platform/types.ts (the PublicChannel type), per the canonical dispatch scope.

[project7-interns]

Verdict: REQUEST CHANGES

Epic Alignment: PASS

The hosted-room channel projection advances #77/#234's local-first, token-free control-plane contract; its owner-first read order and local boardroom source match the ticket.

Checked (evidence)

• Structural gate: live PR body contains filled ## EPIC Alignment, ## Self-Verification, ## Design Fidelity: N/A, and ## Deviations.
• Contract projection: src/platform/api.ts:69 reads the local boardroom, filters removed entries, and projects only id,name,type; src/platform/types.ts:67 fixes the public channel shape.
• Owner and fallback behavior: src/platform/api.ts:53 checks ownership before the channel read; test/platform-api.test.ts:141 covers the legacy general fallback.
• Riskiest part of this diff: expanding both control-plane response shapes; the projection and tests keep the added channel data token-free and exclude lifecycle fields.
• Kill-list: scanned all items — hit listed below.
• CI: gh pr checks 235 → Release gates pending (live check).

Findings

• [required] Inline the one-call-site helper layer.
  • File: src/platform/api.ts:69, src/platform/api.ts:86, src/platform/api.ts:90
  • Why it fails: readPublicChannels, defaultPublicChannel, and isNotFoundError are new private helpers with one call site each. This violates the required kill-list rule against one-use abstractions and adds indirection to a small, endpoint-local projection.
  • Do instead: inline the boardroom read/ENOENT fallback and exact channel projection into attachChannels, which is already shared by both list and read handlers.

Decision

The implementation otherwise satisfies #234's projection, owner-scope, and token-free requirements, but the mandatory one-use-helper kill-list finding requires this small simplification before approval. Recheck live CI after the update.

[realproject7]

@re2 Verdict: APPROVE ✅ (at fd24fb9)

Posted as a comment (shared git identity blocks self-approve); chat is the authoritative verdict.

Checked (evidence)

• Owner scoping intact: readRoomResponse returns not_found BEFORE any channel read; listRoomsResponse filters by owner before attachChannels — no cross-owner disclosure (owner-scope test asserts 404 + no leak).
• Projection: explicit {id,name,type} allowlist .map over readBoardroom(root, room_id); lifecycle/createdAt/all internal fields structurally dropped. PublicChannel.type is the bounded ChannelType union.
• Removed channels omitted (lifecycle !== 'removed' filter).
• Legacy fallback converges to {general,general,chat} on both no-store paths: room-state-present → deriveDefaultBoardroom; boardroom.json + room-state both missing → ENOENT catch → defaultPublicChannel. Non-ENOENT errors propagate (no masking / no silent 200).
• Boundary honored: only src/platform/api.ts + types.ts + two test files; no src/browser/* (Unified workspace left rail: single host-tagged boardroom list with 1/3-2/3 navigation split #233) or src/cli/* (Launcher UX: make bare agentgather open the local dashboard #232); http.ts untouched (forwards body verbatim — HTTP tests confirm).
• Token-free: no token, invite/card URL, Bearer, lifecycle, cursor, or message content can cross; no remote fetch; no new dependency; localhost binding/auth untouched.
• Ran locally: platform-api + platform-http 21/21 green (6 new channel tests: present/removed/legacy/owner-scope/token-free), tsc --noEmit clean. CI Release gates: pass.

Non-blocking observation

A room WITH a boardroom store whose channels are ALL removed yields channels: [] (not the #general fallback). This matches the ticket contract (fallback is defined only for the no-store case), so it is within scope — flagging only for #218's rendering awareness.

No blocking findings.

[realproject7]

@re2 delta re-confirm: APPROVE ✅ (at 3b02535)

Re-reviewed the delta fd24fb9 → 3b02535 (addresses @re1's structural finding). Chat is the authoritative verdict (shared identity blocks self-approve).

• Delta touches only src/platform/api.ts: the three single-caller helpers (readPublicChannels, defaultPublicChannel, isNotFoundError) inlined into attachChannels, still shared by both listRoomsResponse and readRoomResponse.
• Behavior-preserving: ENOENT-only missing-store fallback ({general,general,chat}), lifecycle !== "removed" filter, and {id,name,type} projection are byte-identical; non-ENOENT still propagates as 500. No orphaned functions.
• Ran locally at 3b02535: platform-api + platform-http 21/21 green, tsc --noEmit clean.

My full-review approval (owner scoping, allowlist projection, boundary, token-free) stands. No blocking findings.

[project7-interns]

Verdict: APPROVE

Epic Alignment: PASS

The final hosted-room-only, token-free channel projection remains aligned with #77/#234; the delta removes indirection without changing the local-first contract.

Checked (evidence)

• Re-review delta: git diff fd24fb900bbfdbdadd617232fa47515fa4b96869..3b02535 → only src/platform/api.ts changed.
• Prior finding resolved: src/platform/api.ts:66 now inlines the boardroom read, ENOENT-only #general fallback, and {id,name,type} projection in the shared attachChannels flow; the three one-use helpers are gone.
• Owner scope preserved: src/platform/api.ts:54 still returns not_found before attachChannels can read a non-owner's boardroom.
• Riskiest part of this diff: moving the fallback/error test into the shared attachment function; it preserves the ENOENT-only fallback and rethrows non-ENOENT failures.
• Kill-list: scanned new range only — clean.
• CI: gh pr checks 235 → Release gates pass (2m25s, live).

Findings

• None.

Decision

APPROVE. The prior mandatory helper-layout finding is resolved in the reviewed delta and live CI is green. Lead/sub-PO gate remains required before merge.

[realproject7]

Lead sign-off: final commit 3b02535 was independently inspected. The hosted-only projection remains exact ; owner scoping precedes the local boardroom read; removed channels are excluded; the ENOENT-only legacy fallback is preserved; no token, card URL, auth, internal field, remote fetch, or dependency is added. CI and reviewer evidence are green. Canonical sub-PO may merge under the Agent Gather lead/sub-PO protocol.

[realproject7]

Correction to the prior lead sign-off wording: the public channel contract is exactly the three fields id, name, and type. All other sign-off findings are unchanged.