P1: Enterprise channel, membership, discovery and governance parity

[jusso-dev]

Goal

Make Muster rooms/channels and membership management complete enough for a real enterprise security workspace while retaining Musters security-domain model. Use Block Buzz web as a React/TypeScript reference for humans and agents sharing persistent rooms, channel discovery, member identity, and event-oriented collaboration. Do not copy its branding, assets, or Nostr architecture.

Scope

• Public, private, incident, investigation, hunt, engineering, direct, and system room lifecycle.
• Create, browse, join, leave, archive, restore, rename, retopic, favourite, mute, reorder, and group rooms.
• Channel browser with search, purpose/topic, member count, activity, owner, visibility, join state, and safe previews.
• Human and agent membership through one actor model: owner, moderator, member, guest, and agent member.
• Invite/remove members, bulk membership changes, guest expiry, ownership transfer, and agent allowlists.
• Enterprise policies for who may create private/public rooms, invite guests/agents, use broad mentions, change retention, export content, and archive rooms.
• Room-level retention, TLP/classification display, linked investigation/Kelpie case metadata, integration bindings, pinned items, files, workflows, and audit tabs.
• Direct messages and group DMs with deterministic membership uniqueness and privacy enforcement.
• Member directory with search, profile cards, presence, timezone, role/capability context, agents clearly labelled, and deactivated-account handling.
• Unread/mention badges, notification level, last-read cursor, per-room preferences, sidebar organisation, and keyboard navigation.
• Admin views for invitations, active/deactivated users, guests, agents, room ownership, and membership audit history.
• Import/export interfaces suitable for future Slack migration without implementing a Slack-specific datastore.
• Strict organisation scoping, capability enforcement, IDOR protection, append-only audit, idempotency, and transactional outbox events.

Acceptance criteria

• Authorised users can create every supported room type and manage its complete lifecycle.
• Public discovery and private-room visibility obey server-side policy in UI, API, search, and notifications.
• Humans and agents use the same membership model with distinct allowed roles and capability checks.
• Ownership transfer prevents orphaned active rooms; archive/restore preserves durable history.
• Direct/group-DM creation is duplicate-safe and inaccessible to non-members.
• Guest and agent access can be time/room constrained and revoked immediately.
• Room details include About, Members, Agents, Pinned, Files, Workflows, Integrations, and Audit with working data.
• Sidebar unread, favourites, ordering, mute, and presence persist correctly across sessions.
• Cross-tenant, private-room discovery, invitation abuse, capability bypass, and IDOR tests pass.
• Responsive and keyboard-only flows cover room discovery and member management.

Verification

• Unit tests for room state transitions, policy, ownership, and membership roles.
• Database tests for uniqueness, tenant boundaries, private-room visibility, and direct-room membership.
• Integration tests for outbox/audit events and notification fan-out.
• Playwright tests for room creation, discovery, join/invite/remove, agent membership, archive/restore, and mobile navigation.

Dependency/order

Coordinate with #9 and the enterprise messaging issue. Build on #12 clean tenancy. Preserve Kelpie, Tawny, and Bower ownership boundaries.

[jusso-dev]

Implemented enterprise room governance end to end on main.

Commits:

• 7a279c0 — room policy, lifecycle, privacy, invitations, roles, ownership, directory, admin/import/export, APIs, UI, audit/outbox, migration, integration and E2E coverage
• 2535624 — LAN-safe browser identifiers, stronger lifecycle assertions, permanent homelab routing
• ae148b6 — exact dynamic-room identity resolution before governed detail/message/presence reads
• 25ea2d9 — explicit archived query flag parsing, preventing false from leaking archived rooms

Verification:

• pnpm check: 22/22 tasks passed
• room integration suite: 17/17 passed
• isolated clean install: all 27 operational tables empty and migration chain passed
• focused deployed room lifecycle: passed
• deployed cross-browser homelab matrix: 14 passed, 6 intentional capability skips across Chromium, Firefox, WebKit and mobile

Deployment:

• exact revision 25ea2d9
• exact image sha256:a2a8d7bc809fab39f46e46bf9db0deada849915e2bad3f9a6d0425dc9a4dcd92
• web, worker and agent gateway healthy with zero restarts and zero severe log matches
• preexisting message digest preserved exactly across migration/restart
• pre-update database dump and rollback image retained
• operator handbook updated and live-verified

Synthetic homelab verification data was used. External connector bindings remain unconfigured, as expected.