feat(agent-org): add read-only Member conversations with one FIFO

[ShiboSheng]

Stack position

• Delivery order: 4 of 5
• Intended PR: PR 4 — MemberConversation, Group routing, hard read-only capability, and one FIFO
• Depends on: feat(agent-org): enforce Coordinator-only Task graphs and atomic activation #704
• Next: feat(agent-org): complete long-lived Team UI, E2E, and performance hardening #706
• Design source of truth: docs/architecture/agent-org-long-lived-team-session-design.md, especially sections 8, 12–15, 17–21, 24, and 25.6

This PR opens Member direct and Group @Member conversation only after lifecycle, gates, Task authority, and generation receipts are available. It must not create a second dispatcher, queue, runtime lane, or Worker work authority.

Problem / Motivation

Users must be able to ask a specific Member questions in Working, Idle, or Paused. The current direct page uses generic Build/intervention semantics, while Group mentions use a normal Worker work Inbox and can auto-resume work. Those paths can steer a running Task, expand Worker authority, leak direct messages into Group, or start a second runtime.

Goal

Introduce a persisted hard-read-only MemberConversation Turn. Direct and Group surfaces may render differently, but both target the canonical Member, share one FIFO with TaskExecution, preserve Paused/Team/Task state, and never gain work capabilities from model judgment.

Required scope

• Persist backend-derived member_conversation kind, canonical target, direct_member/group surface, source provenance, and causal reply id in Turn Intent/EventStore/Queue.
• Add one persisted member_dispatch_sequence allocator per Member. TaskExecution, direct Conversation, and group Conversation share this sequence and the same uniqueness/replay rules.
• Route the actual Member composer through generic send to a canonical backend direct resolver; remove generic intervention/Build/auto-resume behavior.
• Allow direct and explicit Group @Member in Working/Idle/Paused; reject Starting/Failed/Archived.
• Reuse one Worker identity, Scheduler, FIFO, and runtime slot. Conversation queues behind running TaskExecution; no steering, Force Send, interruption, or second runtime.
• Reuse PR 1/3 Pause receipts: a Member whose old work runtime has not yielded keeps Conversation queued; other Members may answer independently; Resume continuation joins the same FIFO under a new work generation.
• Enforce hard read-only policy in schema visibility and execute-time gate. Exclude file/shell/Build/Task/org-send/delegation/side-effect MCP, work Inbox drain, Task lifecycle hooks, goal loop, recovery-budget clear, MemberIdle, and self-Wake.
• Make Working/Idle/Paused Group @Member claim exactly one conversation input for the explicit canonical Member; never auto-resume or fall back to Root.
• Keep direct events out of Group feed; associate Group replies through stable causal ids rather than timestamps.
• Replace N-member history fan-out with a bounded cursor Group projection.
• Release runtime on Conversation terminal using its turn generation, lease id, and CAS; a concurrent work Wake must not lose its new runtime.
• Support the canonical Rust Worker path only; legacy CLI/noncanonical Members fail closed without a compatibility adapter.

Locked invariants

• MemberConversation can read and explain but cannot change files, Tasks, Team state, work Inbox, or external systems.
• Capability comes from persisted Turn kind plus backend policy, never from Prompt/model discretion.
• One Member has one FIFO and at most one runtime across TaskExecution/direct/group.
• Surface changes history/projection only; it cannot expand permissions or change the canonical recipient.
• Working/Idle/Paused do not change an explicit member target.
• Direct messages never appear in Group feed.
• Conversation completion never runs work finalization/recovery/self-Wake side effects.

Acceptance criteria

• Direct and Group Member questions work in Working, Idle, and Paused without changing Team/Task/generation/revision.
• Direct/group Conversation never auto-resumes Paused or creates an intervention.
• Build/Task/org-send/file/shell/delegation/side-effect MCP are absent from schema and rejected at execution; unknown future tools default deny.
• A busy Member queues the question without steering, interrupting, terminating TaskExecution, or creating another runtime.
• Stop/Force Send on a direct page cannot hit TaskExecution; stopping Conversation cannot cancel a Task.
• Conversation consumes only its source input and cannot drain TaskAssigned, clear recovery budget, requeue, or self-wake.
• Source/surface discriminant mismatch fails closed with zero downstream side effects.
• Crash/restart preserves kind, source receipt, and cross-surface FIFO without duplicate answers.
• TaskExecution/direct/group ordering remains stable across concurrent enqueue, Pause/Resume, and restart.
• Pause-yield timeout keeps only the affected Member queued and never creates a second runtime.
• Direct+group queued Conversation limit is 16; overflow consumes no sequence and preserves accepted ordering.
• Missing canonical Member identity never creates a replacement identity as send fallback.
• Fast Group mentions attach each reply to the correct causal message; direct output stays private.
• Unknown, removed, multiple, or ambiguous member mention returns typed rejection with no fan-out or Root fallback.
• Frontend target and persisted backend recipient match in Working/Idle/Paused.
• Archive prevents queued/running Conversation from starting a new Provider or publishing late output.
• Conversation release racing with work Wake cannot clear the new work runtime.
• Legacy CLI/noncanonical member conversation rejects with no Build side effect.

Verification

• Targeted Cargo and session-persistence tests for route, policy, FIFO, source receipt, recovery, lease CAS, and queue limits.
• Tool allowlist/schema and execute-time escape tests.
• Focused Vitest for direct/group routing, responder identity, typed failures, and causal Group projection.
• Rewrite old intervention and Paused-auto-resume E2E expectations.
• Add at least one rendered production-path direct Member E2E plus Group mention coverage in all three allowed Team states.
• Architecture audit for Turn kind, capability ownership, FIFO, runtime lease, and projection boundaries.
• Frontend UI audit for touched component refactors.
• Performance guard remains blocked until single-runtime release, FIFO behavior, and bounded Group projection are measured.

Out of scope

• Any Member Task creation/admin authority or Manager-to-report Task assignment.
• A second queue, dispatcher, Provider lane, surface-specific FIFO, or parallel runtime for questions.
• Proposal/confirmation/work-request lifecycle or new Team/Task states.
• Legacy CLI/noncanonical Member adapter.
• Complete release UI, 13 locales, full performance matrix, and SDE/multi-instance sign-off (PR 5).

Effort and budget

• Labels: Effort: High, UX
• P50 range: 1,800–2,600 review lines; planning point: 2,600
• P90 cap: 4,300 review lines
• Expected substantive files: 20–30
• At 70% of P50, review the diff and risks. Above 1.25× P50, explain new entry points/test surface; at 1.5×, stop and re-spike before expanding scope.