feat(crews): custom seats default to Full access and the roster flags seats that will stop

[bryantderosier]

Important

⚠️ Merge order: merge these in this exact order

This PR is part of the Crews stack. Merge top to bottom, one at a time, and let each land on j5/main before the next. Everything before this PR has merged, so it can go next.

1. fix(crews): Crew notices report only what the platform measured #292: Crew notices report only what the platform measured (adds migration 020) ✅ merged
2. fix(crews): no seat launches into a retired Crew or under a gone Captain #271: No seat launches into a retired Crew or under a gone Captain ✅ merged
3. fix(crews): unit stop and archive finish over a seat that was never created #279: Unit stop and archive finish over a seat that was never created ✅ merged
4. fix(crews): a proposal launches once and reports every seat #313: A proposal launches once and reports every seat (adds migration 021) ✅ merged
5. fix(crews): Crew groups keep seats without thread facts as unknown #300: Crew groups keep seats without thread facts as unknown ✅ merged
6. fix(crews): J5 stream daemons start from the event store's high-water mark #352: J5 stream daemons start from the event store's real high-water mark (fixes fix(crews): J5 stream daemons replay all history on every boot (high-water reads an empty table) #349) ✅ merged
7. fix(crews): a Crew follows its Captain through every lifecycle step #315: A Crew follows its Captain through every lifecycle step (adds migration 022) ✅ merged
8. feat(crews): custom seats default to Full access and the roster flags seats that will stop #347: custom seats default to Full access ⬅️ this PR

Why #352 goes first: without it the finish notifier's stream starts at sequence 0 and replays every event on boot. #315's cascade also acts on thread.unarchived, thread.settled, and thread.unsettled, so a restart would settle, unsettle, and restore Crews from history (#349).

Problem

A custom Crew seat with no runtime_mode inherited its Captain's access. A Captain you supervise in Supervised mode handed that mode to every seat it didn't configure, and those seats stopped for approvals in threads nobody watches (#326).

What I changed

• apps/server/src/j5/a2a/CrewLaunchService.ts → resolveSeats: an unset custom seat resolves to full-access. Model, harness, and reasoning still come from the Captain. Saved-persona seats keep their persona's policy. The Captain-access lookup is gone.
• ACP: the refusal now fires only on an explicit Auto or Auto-accept edits choice. An unset ACP custom seat launches in Full access, which ACP can enforce.
• apps/web/src/j5/crew/crewSeatRuntime.ts → crewSeatStopsForApprovals: flags a seat whose resolved access isn't Full access. It skips a seat whose runtime hasn't loaded, and a saved persona left on its own policy.
• apps/web/src/j5/crew/CrewProposalCard.tsx: flagged seats get a Stops for approvals badge, with a line above the buttons ("N seats will stop for approvals in their own threads"). The card serves both the roster gate and the Inbox addition card.
• apps/server/src/j5/a2a/mcp/tools.ts: the propose_crew / request_crew_member descriptions and field descriptions now say access defaults to Full access.
• apps/server/src/provider/T3OrchestrationInstructions.ts (upstream, existing FORK.md case 8): the "Custom seats inherit your configuration" clause is reworded to match.
• Docs: crews.md (Definition, AC3, History), agent-tools.md (description copies re-synced with the shipped strings, seat tables list model_selection and runtime_mode, History), and docs/user/personas.md.

Screenshots

Both use the same seeded roster proposal on an isolated copy of real data, light theme, 1440×1000. The Captain runs in Supervised. code-reviewer sets no access, docs-writer asks for Supervised, and test-author asks for Auto-accept edits. Before is j5/main; #315, this PR's base, doesn't change the roster card.

Before: code-reviewer inherits the Captain's Approval required, and nothing says which seats will stop.

After: code-reviewer defaults to Full access. The two seats that will stop carry "Stops for approvals", and the footer counts them.

Why this shape

This is Jackson's decision on #326. Leaving it to each Captain to set access well is a footgun, because there are several ways a seat ends up in a mode that stops. The person still picks any seat's access on the card before approving. The warning is per seat, from the same resolved runtime the preview shows, so it can't disagree with the card.

Invariants

• A seat's resolved access, the preview, and the approval token all come from one resolution, so they stay in step.
• Saved-persona seats are unchanged.
• An explicit runtime_mode always wins.

Surfaces

Surface	Decision
Entry points (chat, Settings, command palette, keybinding)	Changed: the roster gate and the Inbox addition card, which share one component.
Clients (web, desktop, mobile)	Web and desktop. Mobile has no roster gate.
Providers	All custom seats; ACP now launches unset seats in Full access instead of refusing them.
Contracts (packages/contracts)	Unaffected.
Reverse states	The person can change any seat's access on the card before approving.
Connection modes (local, remote, tunnel)	Unaffected.
Upstream files / FORK.md	T3OrchestrationInstructions.ts under existing case 8; FORK.md updated.
Docs	Changed: crews.md, agent-tools.md, personas.md.

Out of scope

• Mentioning the Inbox in the warning copy. It's a one-line addition once feat(crews): answer a Crew thread's provider approvals and questions from the Inbox #309 (seat approvals in the Inbox) lands.
• The J5 editor's mode labels ("Approval required" → "Supervised"), handled by fix(crews): use upstream's access-mode names #344.

Upgrade and data

No migration. A proposal previewed before the upgrade and approved after it gets a token mismatch, because its resolved access changed, and the card asks for a fresh preview.

Verification

• apps/server, apps/web, and packages/contracts typecheck (exit 0).
• vp test run apps/server/src/j5 apps/web/src/j5 plus the orchestration-instructions test: 1,054 passed, 1 skipped.
• Lint and format are clean.
• New tests:
  • An unset custom seat resolves to Full access under Supervised, Auto, and Auto-accept edits Captains, on Codex and on ACP.
  • A persona seat keeps its policy.
  • An explicit Supervised choice wins.
  • An explicit Auto or Auto-accept edits choice on ACP is still refused.
  • crewSeatStopsForApprovals covers custom, persona, persona-default, and not-yet-loaded seats.

UI evidence: before/after screenshots of the roster card are under What I changed.

Review focus

• Whether a saved persona on its own default policy should also be flagged. It isn't now: a read-only persona reports Supervised but refuses rather than asks, so flagging it would warn about stops that never happen.

Closes #326

Claude Opus 5.5 via Claude Code in J5 Code

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Repository: Jacksondr5/j5code/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 8c48d8af-0c3f-4017-b527-51cf71c7cb4b

---

_{Comment @coderabbitai help to get the list of available commands.}