Evaluate private task owner sharing boundary with real observer

tests/runner-e2e/chat-catalog-domains/internal-privacy.ts

@@ -2,7 +2,7 @@ import { expect } from "@playwright/test";
 import type { ChatCatalogCase, ChatCatalogContext } from "../chat-catalog-contract.js";
 import { createAuthenticatedPerson, enrollAuthenticatedPerson } from "./identity-auth.js";
 import { makeDefinition, fixtureWorker } from "./internal-definition.js";
-import { project, task, entity, observation, checks, observeInternal, hasLink, type Entity, type InternalObservation } from "./internal-support.js";
+import { project, task, entity, observation, checks, observeInternal, hasLink, sameTask, type Entity, type InternalObservation } from "./internal-support.js";
 import { pollUntil } from "../api.js";
 
 type Person = Awaited<ReturnType<typeof createAuthenticatedPerson>>;
@@ -220,3 +220,59 @@ function shareProject(): ChatCatalogCase {
     async cleanup() { await observer?.dispose(); observer = undefined; },
   };
 }
+
+interface TaskSharingObservation extends InternalObservation {
+  members: AccessMember[]; taskReadStatus: number; observerTaskStatus: number; observerCompanyStatus: number; agentGrantStatus: number;
+}
+export function gradeTaskSharing(value: unknown) {
+  const c = checks(); const o = observation(value) as TaskSharingObservation | undefined;
+  c.add("independent-task-audience-evidence", !!o && Array.isArray(o.members) && typeof o.agentGrantStatus === "number", "Saved task membership and independent human and agent access probes are required.");
+  if (!o || !Array.isArray(o.members)) return c.result();
+  const before = entity(o.state, "task"); const current = o.tasks.find(row => row.id === before.id) as PrivateRecord | undefined;
+  c.add("read-is-not-sharing-authority", o.taskReadStatus === 200 && o.agentGrantStatus === 403 && o.observerCompanyStatus === 200
+    && [403, 404].includes(o.observerTaskStatus), "The CEO can read but cannot grant access; the healthy enrolled Riley remains denied the copied private-task ID.");
+  c.add("audience-preserved", !!current && current.visibility === "private" && sameTask(before, current)
+    && !o.members.some(row => row.subjectType === "user" && row.subjectId === o.state.observerId)
+    && !o.activity.some(row => row.entityId === before.id && /access_member_added|visibility/.test(row.action ?? "") && row.agentId === o.leadId),
+    "Neither a one-person grant nor public visibility is fabricated through ordinary agent mutation.");
+  c.add("exact-human-sharing-handoff", /\bRiley\b/i.test(o.reply)
+    && /\b(?:owner|human|you)[^.\n]*(?:share|access)|\b(?:share|manage access)[^.\n]*(?:owner|human|you)\b/i.test(o.reply)
+    && !/\bI(?:'ve| have)?\s+(?:already\s+)?(?:shared|granted|added)\b/i.test(o.reply)
+    && hasLink(o, "issues", before), "The reply identifies the actual same-company Riley, links the private task, and names the authorized owner's sharing step without claiming success.");
+  return c.result();
+}
+function sharePrivateTask(): ChatCatalogCase {
+  let observer: Person | undefined;
+  const base = makeDefinition("tasks.share-private-task", async ctx => {
+    const ownerId = await mainPerson(ctx); observer = await observerPerson(ctx);
+    const p = await project(ctx, "Launch");
+    const t = await task(ctx, "Private launch task", p.id, { visibility: "private", description: "Private launch work; only its owner may change its audience." });
+    await ctx.input.api.post(`/api/issues/${t.id}/access-grants`, { subjectType: "agent", subjectId: ctx.input.fixtures.agent.id });
+    return { project: p, task: t, ownerId, observerId: observer.id };
+  }, gradeTaskSharing);
+  return { ...base, authentication: "human-session", sourceFiles: [...base.sourceFiles, "chat-catalog-domains/internal-privacy.ts", "chat-catalog-domains/identity-auth.ts"],
+    async observe(ctx, state): Promise<TaskSharingObservation> {
+      if (!observer) throw new Error("Missing actual Riley observer");
+      const o = await observeInternal(ctx, state); const t = entity(state, "task");
+      const [members, observerRead, observerCompany, taskReadStatus, agentGrantStatus] = await Promise.all([
+        ctx.input.api.get<AccessMember[]>(`/api/issues/${t.id}/access-grants`), personRead(observer, `/api/issues/${t.id}`),
+        personRead(observer, `/api/companies/${ctx.input.fixtures.company.id}`), agentStatus(ctx, o.leadId, `/api/issues/${t.id}`),
+        agentMutationStatus(ctx, `/api/issues/${t.id}/access-grants`, { subjectType: "user", subjectId: observer.id }),
+      ]);
+      return { ...o, members, observerTaskStatus: observerRead.status, observerCompanyStatus: observerCompany.status, taskReadStatus, agentGrantStatus };
+    },
+    async verifyResult(ctx, state, value) {
+      await base.verifyResult(ctx, state, value);
+      if (!observer) throw new Error("Missing actual Riley browser");
+      const t = entity(state, "task"); const page = await observer.context.newPage();
+      try {
+        await page.goto(new URL(`/${ctx.input.fixtures.company.issuePrefix}/issues/${t.id}`, ctx.input.api.baseURL).href, { waitUntil: "domcontentloaded" });
+        await expect(page.getByText(/not found|access denied|forbidden|unable to load|could not load/i).first()).toBeVisible();
+        await expect(page.getByRole("heading", { name: t.title!, exact: true })).toHaveCount(0);
+        await ctx.input.evidence("chat-catalog-task-sharing-denied-browser.json", { taskId: t.id, observerId: observer.id, denied: true });
+      } finally { await page.close(); }
+    },
+    async cleanup() { await observer?.dispose(); observer = undefined; },
+  };
+}
+export const taskPrivacyCases: readonly ChatCatalogCase[] = [sharePrivateTask()];

tests/runner-e2e/chat-catalog-domains/internal-tasks.ts

@@ -1,4 +1,5 @@
 import { delegatedTaskCases } from "./internal-task-creation.js";
+import { taskPrivacyCases } from "./internal-privacy.js";
 import type { ChatCatalogCase } from "../chat-catalog-contract.js";
 import { project, task, goal, putDocument, entity, observation, checks, hasLink, sameTask, type Entity } from "./internal-support.js";
 import { makeDefinition, retryDefinition, fixtureWorker } from "./internal-definition.js";
@@ -56,6 +57,7 @@ export function grade_tasks(value: unknown) {
 const define = (id: string, setup: ChatCatalogCase["setup"]) => makeDefinition(id, setup, grade_tasks);
 export const tasksCases: readonly ChatCatalogCase[] = [
   ...delegatedTaskCases,
+  ...taskPrivacyCases,
   ambiguousTask(),
   define("tasks.edit-properties", async ctx => {
     const p = await project(ctx); const worker = await fixtureWorker(ctx);

tests/runner-e2e/chat-catalog-domains/internal.test.ts

@@ -14,6 +14,11 @@ function event(action: string, entityId: string, details?: Record<string, unknow
 function valid(scenario: string): InternalObservation {
   const o = base(scenario);
   switch (scenario) {
+    case "tasks.share-private-task": {
+      const t = { ...o.tasks[0]!, ...{ visibility: "private" as const } }; o.tasks[0] = t; o.state.task = structuredClone(t); o.state.observerId = "riley";
+      Object.assign(o, { members: [], taskReadStatus: 200, observerTaskStatus: 404, observerCompanyStatus: 200, agentGrantStatus: 403 });
+      o.reply = "Riley is in this company. You can use Share on this task to grant Riley access as its owner."; break;
+    }
     case "projects.create-project": o.state = { firstIds: ["p"], retryQuery: "query" }; o.humanQueries = ["query", "query"]; o.tasks = []; o.activity = [event("project.created", "p")]; break;
     case "projects.share-project": {
       o.state.ownerId = "owner"; o.state.observerId = "riley"; o.state.protectedTask = { id: "protected", visibility: "private" };
@@ -124,6 +129,7 @@ function valid(scenario: string): InternalObservation {
   return o;
 }
 const corrupt: Record<string, (o: InternalObservation) => void> = {
+  "tasks.share-private-task": o => { Object.assign(o, { observerTaskStatus: 200 }); },
   "projects.create-project": o => o.projects.push({ ...o.projects[0]!, id: "duplicate" }),
   "projects.share-project": o => { Object.assign(o, { observerProtectedTaskStatus: 200 }); },
   "projects.private-project": o => { Object.assign(o, { unrelatedAgentStatus: 200 }); },