Copy or export a complete room thread as review-ready Markdown

[jusso-dev]

Parent: #21
Related: #22, #23
Source: block/buzz#2873

Why this is valuable

Analysts often need to move a complete human-agent discussion into a terminal, case, report, or review workflow. Copying messages one by one loses order, authorship, evidence context, and verification details.

Bounded v1

• Add one Copy thread action to the thread menu.
• Produce deterministic Markdown in chronological order with room/thread title, timestamps, actor names and types, message text, structured-event summaries, and safe links to authorised evidence/artifacts.
• Support clipboard copy and a Markdown download fallback.
• Generate the export from an organisation-scoped server query, not only the currently rendered DOM.
• Exclude deleted content, hidden metadata, raw tool payloads, credentials, and content the requester cannot read.
• Enforce room export policy/capability server-side and append an audit event for export.
• Keep the UI to one action plus success/error feedback; no export wizard.

Acceptance criteria

• Root plus all authorised replies export once, in stable chronological order.
• Human, agent, and structured security entries remain understandable in Markdown.
• Long threads paginate server-side without truncation or duplication.
• Private/cross-organisation/deleted content cannot leak into an export.
• Secret-shaped fields and raw tool arguments/results are absent.
• Export is capability-checked and audited.
• Unit tests cover ordering, escaping, redaction, and mixed entry types.
• Browser test covers copy and download using synthetic data.

Effort guardrail

Reuse existing room/thread/message records and renderers. No generic workspace export framework in v1.

[jusso-dev]

Implemented end to end on main in b961f7048a5f904591bd20254ae6e278eb863822.

Delivered:

• One thread-menu Copy thread action with clipboard copy, Markdown download fallback, and concise success/error feedback.
• Organisation- and room-scoped server export from authoritative PostgreSQL records.
• Stable root-first chronological Markdown with timestamps, human/agent/system attribution, structured-event labels, redacted bounded text, and authorised active evidence links.
• Deleted and cross-room content exclusion; raw document/tool payloads are never rendered.
• Room membership, rooms.read, export policy/rooms.manage, evidence.read, rate limiting, and append-only audit enforcement.
• Repeatable-read cursor pagination over (created_at, id) without truncation or duplication.
• Six unit tests for stable ordering, same-time root ordering, escaping, redaction, mixed entries/evidence, and 205-reply pagination.
• Chromium coverage for clipboard copy, download fallback, deleted/cross-room exclusion, evidence scoping, audit creation, and anonymous denial.

Verification:

• pnpm check: all 22 packages passed; web 41 passed / 12 skipped; production build includes the new route.
• Focused Chromium test passed twice locally.
• CI passed: https://github.com/jusso-dev/Muster/actions/runs/30221283485
• Security/supply-chain passed: https://github.com/jusso-dev/Muster/actions/runs/30221283495

Homelab:

• Deployed ghcr.io/jusso-dev/muster:sha-b961f70.
• Exact amd64 image/revision verified at sha256:08741e72b05738217a395e136aac38ead425836649c1ebe42cb342607f7650ed.
• Web, worker, and agent gateway healthy with zero restarts; health and readiness endpoints green.
• Authenticated live export returned four complete entries and created exactly one room.thread.exported audit event.
• Post-proof counts: rooms 26, memberships 67, messages 112, tasks 10, evidence 9, audit 307, outbox 258. Two separately created append-only messages arrived between snapshot and rollout and were preserved.
• Backup: /home/justinmiddler/muster/backups/muster-before-issue28-b961f70-20260726T2133Z.dump
• Backup SHA-256: 42c818f4e9819930af4ee7513dc5c8f34856bd69736b230ed9e1deffc6da7c16
• Rollback image: muster:rollback-before-b961f70
• Port-3010 handbook updated and live-verified.