every route the router gives that controller and requires a token in the body

  only at the mint. A second route that renders a grant fails there.

  Amended 2026-08-24 (issue #205): "the account that opened the thread" is now

  the rule for every **write** and for the mint, and the default rule for

  reads. A thread carries a transparency tier, and a thread its owner opened

  at a wider tier is readable by the audience that tier names — see

  THREAD-002, which states what widens and what does not. The token clause is

  untouched: `fetch_readable/2` returns no grant, the reader's view of a thread

  carries `"grant": null`, and the mint still resolves through

  `get_for_user/2`.

Evidence: `OpenAgents.Threads`, `OpenAgents.Threads.Thread`,

`OpenAgents.Threads.Event`, `OpenAgents.Inference.mint/1`,

`OpenAgents.Inference.expire_elapsed_for_owner/1`,

`test/openagents_web/controllers/thread_controller_test.exs`, and

`test/openagents_web/live/thread_show_live_test.exs`.

### THREAD-002 — A thread is private until its owner widens it, and widening is a recorded act

Status: Current

A thread's transcript is the substrate the registry is meant to learn from

(`docs/2026-08-24-registry-network-strategy.md`, §5). The consent gate lands

before the collection volume, not after, so a transcript discloses nothing

until the account that opened it says so.

- **The vocabulary is the one this application already has.** A thread's

  visibility is a tier of the `dark`/`pulse`/`ledger`/`glass` ladder that

  `OpenAgents.Transparency` and `OpenAgents.Forge.Visibility` already use

  (`docs/taxonomy.md`). No parallel `public`/`private` enum is introduced, and

  `OpenAgents.Threads.VisibilityTest` holds `Thread.visibilities/0` to a subset

  of `Transparency.tier_atoms/0`, so a fifth word cannot enter through this

  door.

- **Only a tier with a read path behind it is offered.** `threads.visibility`

  admits `dark` and `ledger` and nothing else, by check constraint and by

  `Thread.open_changeset/3`. `pulse` would need a metadata-only projection of a

  transcript and `glass` a capability beyond reading one; neither exists, so

  neither is stored. `POST /api/v3/threads` refuses any other value —

  a tier of the vocabulary this surface cannot enforce, or a word that is not a

  tier — with the stable code `thread_visibility_unsupported`, because a client

  that meant to publish and did not must learn it from the code it branches on

  rather than from prose.

- **The default is owner-only.** The column defaults to `dark` in PostgreSQL

  and in the schema, so a thread opened by a caller that names no tier — and

  every thread written before the column existed — is readable by its account

  and nobody else.

- **Widening is explicit and recorded.** A wider tier reaches a thread only by

  being named at `open/3`; nothing derives one, and no other caller's action

  raises it. When one is named, `OpenAgents.Threads.open/3` appends

  `thread.visibility_set` to the transcript in the same transaction as the

  insert, carrying the tier and the default it replaced. The consent decision

  is therefore a fact in the same append-only log as the work it governs, not

  a column somebody can find changed with no account of when or why.

- **A tier widens reading and nothing else.** `fetch_readable/2` is the only

  lookup a tier reaches, and it serves exactly two surfaces: `GET

  /api/v3/threads/{thread_id}` with its `/events`, and `/threads/:id`. Every

  write — the transcript append, the cancel, the re-mint — resolves through the

  owner-scoped `get_for_user/2`, so a published transcript is never a thread a

  stranger may append to, end, or spend.

  `OpenAgents.Threads.GrantTokenReachTest` asserts the caller set of each

  lookup from the compiled import tables, so a write that starts resolving

  through the tier-scoped lookup fails there.

- **A tier does not disclose the owner's money.** A reader admitted by the

  thread's tier is served `"grant": null` by the API and no budget card in the

  viewer. The ladder is about the transcript; what the account is spending is

  not on it.

- **A refused reader learns nothing.** A thread at `dark` answers a stranger

  with the same plain `not_found` — and the same `PublicNotFoundError` in the

  browser — that an unknown id gets, so the tier withholds the thread's

  existence and not merely its contents.

- **The audience is the one the surface can enforce.** `ledger` admits *any

  signed-in account holding the thread's id*. Both read surfaces require an

  authenticated principal — the API route is bearer-authenticated and

  `/threads/:id` sits in the `:authenticated` live session — so no anonymous

  audience is claimed. A genuinely public thread would need a route outside

  that session, and until one exists the tier does not promise one.

- **The consent record leaves with the data.** `GET /data/export/account`

  carries each thread's `visibility` beside its objective, its repository, and

  its events, so a recipient reading the document offline has the terms

  alongside the transcript rather than only the transcript (DATA-004).

Plugin usage inherits this and adds nothing: a plugin run is recorded as a

`tool.ran` event on the thread that ran it, so the owning thread's tier already

governs it through the same read paths. No aggregate over `tool.ran` exists

today. When the registry's usage counter lands (issue #206), it must aggregate

by joining `threads.visibility` and counting only rows at a tier that permits

it; a counter that read `thread_events` without that join would republish, in

aggregate, transcripts their owners kept `dark`.

Evidence: `OpenAgents.Threads.fetch_readable/2`,

`OpenAgents.Threads.Thread.visibilities/0`, `OpenAgentsWeb.ThreadController`,

`OpenAgentsWeb.ThreadShowLive`, `OpenAgents.DataRights.AccountExport`,

`priv/repo/migrations/20260824210500_add_visibility_to_threads.exs`,

`test/openagents/threads/visibility_test.exs`,

`test/openagents_web/thread_visibility_test.exs`, and

`test/openagents/threads/grant_token_reach_test.exs`.

## Tenant deployment control plane

### DEPLOYPLANE-001 — A deployment intent carries no authority

| SELF-EDIT-001 | `test/openagents/tools/repository_mutation_tools_test.exs`, `test/openagents/coding_job_test.exs`, `test/openagents/dependency_boundary_test.exs` |

| SCV-001 | `test/openagents/scv/deployments_test.exs`, `test/openagents/dependency_boundary_test.exs` |

| THREAD-001 | `test/openagents/threads/grant_fence_test.exs`, `test/openagents/threads/grant_token_reach_test.exs`, `test/openagents/threads_test.exs`, `test/openagents/threads/credit_race_test.exs` |

| THREAD-002 | `test/openagents/threads/visibility_test.exs`, `test/openagents_web/thread_visibility_test.exs`, `test/openagents/threads/grant_token_reach_test.exs` |

| OUTCOME-001 | `test/openagents/accepted_outcome_test.exs`, `test/openagents/issues/completion_claims_test.exs`, `test/openagents_web/controllers/issue_completion_claim_controller_test.exs` |

| DEPLOYPLANE-001 | `test/openagents/deployments_test.exs`, `test/openagents_web/controllers/deployment_controller_test.exs`, `test/openagents_web/api_route_authority_test.exs` |

| DEPLOYPLANE-002 | `test/openagents/deployments_test.exs` |

repository-readability gate does not settle. Say "level" for the dial and

"schedule" for the field rules. Both use the same four tier words.

**Thread visibility** — the third user of those four words, and the only one an

account sets for itself: `threads.visibility` is the tier that governs who may

read one thread's transcript (THREAD-002). Say "visibility" for the column and

"tier" for the value, the way an `ArtifactLink` carries a `tier`. It admits

`dark` (the default — the account that opened the thread and nobody else) and

`ledger` (any signed-in reader holding the thread id), and refuses `pulse` and

`glass`, which no thread read path implements. It is not a *level*: a level is

operator-owned per-repository configuration, while a thread's visibility is the

opener's own decision, recorded in the transcript as `thread.visibility_set`

when it widens.

**Trajectory** — the ATIF schema name for the document (`AtifTrajectory`,

`trajectory.json`, `trajectory_id`). Use it in schema and code. Product copy

says trace.

    }

  end

  # The transparency tier travels with the thread. It is the consent record for

  # the transcript beneath it — what the account said may be read, and by whom

  # — so an export that carried the events without it would hand a recipient

  # the data and drop the terms (THREAD-002).

  defp thread_export(thread, events) do

    %{

      "id" => thread.id,

      "objective" => thread.objective,

      "repository" => thread.repository,

      "visibility" => thread.visibility,

      "status" => thread.status,

      "model" => thread.model,

      "reasoning_effort" => thread.reasoning_effort,

      issue: nil,

      note: "The API's own route and extension inventory."

    },

    %{

      family: :model,

      api?: true,

      status: :not_user_data,

      mechanism: nil,

      proof: nil,

      issue: nil,

      note:

        "The typed model catalog a thread is admitted against. It is the " <>

          "deployment's configuration — which models are served and at what " <>

          "ceilings — and carries no record an account authors. What an " <>

          "account did with a model is its threads, which export whole."

    },

    %{

      family: :capacity,

      api?: true,

     account's admission slot without anyone asking, so an abandoned thread

     cannot lock an account out of its own ceiling.

  ## The audience

  6. **A transcript is private until its owner says otherwise.** A thread

     carries a transparency tier from the shared `dark/pulse/ledger/glass`

     vocabulary (`OpenAgents.Transparency`, `docs/taxonomy.md`), defaulting to

     `dark` — the account that opened it and nobody else. `open/3` accepts a

     wider tier and records `thread.visibility_set` in the transcript when one

     is given, so widening is an act with a record rather than a column that

     drifted. `fetch_readable/2` is the only read that a wider tier reaches;

     every write stays on `get_for_user/2`, because publishing a transcript for

     reading is not handing anyone the thread's authority (THREAD-002).

  A thread's ceilings are its own: `ceilings/0` reads the `thread_grant_*`

  settings and passes them to `OpenAgents.Inference.mint/1`, which otherwise

  applies the delegation ceilings. A delegation is one probe run the server

  slot held by an abandoned thread is released before the count is taken, and

  an account already at `maximum_open_per_account/0` is refused with

  `:thread_quota_reached` rather than given a further grant.

  `:visibility` is the thread's transparency tier and defaults to

  `OpenAgents.Threads.Thread.default_visibility/0`, owner-only. A wider tier

  given here is recorded in the transcript as `thread.visibility_set`

  (THREAD-002).

  """

  @spec open(User.t() | Visitor.t(), String.t(), keyword()) ::

          {:ok, Thread.t()} | {:error, :thread_quota_reached | Ecto.Changeset.t()}

    attributes = %{

      objective: objective,

      repository: Keyword.get(options, :repository),

      visibility: Keyword.get(options, :visibility) || Thread.default_visibility(),

      model: Keyword.get(options, :model) || Models.default_id(),

      reasoning_effort:

        OpenRouter.reasoning_effort(Keyword.get(options, :reasoning, @default_reasoning)),

    end)

    |> Multi.insert(:thread, Thread.open_changeset(attributes, visitor_id, now))

    |> Multi.run(:opened_event, fn _repo, %{thread: thread} ->

      insert_event(thread, "thread.opened", %{"objective_bytes" => byte_size(objective)}, now)

      insert_event(

        thread,

        "thread.opened",

        %{"objective_bytes" => byte_size(objective), "visibility" => thread.visibility},

        now

      )

    end)

    # Widening is an act, so it leaves a record rather than only a column value

    # (THREAD-002). The event is written only when the opener asked for a tier

    # wider than owner-only: a default thread was never widened, and an event

    # saying so on every open would make the record meaningless.

    |> Multi.run(:widened_event, fn _repo, %{thread: thread} ->

      if Thread.wide?(thread) do

        insert_event(

          thread,

          "thread.visibility_set",

          %{"visibility" => thread.visibility, "from" => Thread.default_visibility()},

          now

        )

      else

        {:ok, nil}

      end

    end)

    |> Multi.update(:counted, fn %{thread: thread} ->

      Thread.event_count_changeset(thread, thread.event_count + 1)

    |> Multi.update(:counted, fn %{thread: thread, widened_event: widened} ->

      appended = if widened, do: 2, else: 1

      Thread.event_count_changeset(thread, thread.event_count + appended)

    end)

    |> Repo.transaction()

    |> case do

  def get_for_user(_user, _thread_id), do: nil

  @doc """

  A thread this account may **read**, and whether it is the account's own.

  Reading is the only thing a transparency tier widens. Every other verb —

  appending to the transcript, cancelling the thread, re-minting its

  authority — stays on `get_for_user/2`, because a thread its owner published

  for reading is not a thread a stranger may write to or spend.

  Returns `{:ok, thread, :owner}` for the account's own thread, `{:ok, thread,

  :reader}` for somebody else's thread at a tier that admits this reader, and

  `:error` otherwise. The two cases are distinguished at the query rather than

  by a second read, so a caller that must withhold the owner's budget from a

  reader has the fact without asking again.

  The audience of a wide tier is *any signed-in account holding the thread's

  id*: both surfaces that call this — `GET /api/v3/threads/{thread_id}` and

  `/threads/:id` — require an authenticated principal, and this function does

  not invent an anonymous one (THREAD-002).

  """

  @spec fetch_readable(User.t(), String.t()) :: {:ok, Thread.t(), :owner | :reader} | :error

  def fetch_readable(%User{id: user_id}, thread_id) when is_binary(thread_id) do

    wide = Thread.wide_visibilities()

    with {:ok, id} <- Ecto.UUID.cast(thread_id),

         {%Thread{} = thread, owner_user_id} <-

           Repo.one(

             from(t in Thread,

               join: v in Visitor,

               on: v.id == t.owner_visitor_id,

               where: t.id == ^id,

               where: v.user_id == ^user_id or t.visibility in ^wide,

               select: {t, v.user_id}

             )

           ) do

      {:ok, thread, if(owner_user_id == user_id, do: :owner, else: :reader)}

    else

      _unreadable -> :error

    end

  end

  def fetch_readable(_user, _thread_id), do: :error

  @doc """

  The account's threads, newest first, bounded.

  @objective_bytes 32_768

  @repository_bytes 200

  # The disclosure vocabulary is `OpenAgents.Transparency`'s — `dark`, `pulse`,

  # `ledger`, `glass` (`docs/taxonomy.md`) — and a thread offers the two rungs

  # this surface can enforce, not a fifth word of its own.

  # `ThreadVisibilityTest` proves the set stays a subset of that vocabulary.

  @visibilities ~w(dark ledger)

  @default_visibility "dark"

  schema "threads" do

    belongs_to :owner_visitor, Visitor

    field :objective, :string, redact: true

    field :repository, :string

    field :visibility, :string, default: "dark"

    field :status, :string, default: "open"

    field :model, :string

    field :reasoning_effort, :string

  def permission_profiles, do: @permission_profiles

  def reasoning_efforts, do: @reasoning_efforts

  @doc """

  The transparency tiers a thread may be opened at, narrowest first.

  Two rungs of the shared `dark/pulse/ledger/glass` ladder, because two are

  what a thread read path enforces. `pulse` would need a metadata-only

  projection of the transcript and `glass` would need a capability beyond

  reading it; neither exists, so neither is offered (THREAD-002).

  """

  def visibilities, do: @visibilities

  @doc "The tier a thread takes when its opener names none: owner-only."

  def default_visibility, do: @default_visibility

  @doc """

  The tiers that admit a reader who is not the account that opened the thread.

  Every rung above the default, derived rather than restated, so adding a rung

  to `visibilities/0` cannot leave the read path enforcing the old set.

  """

  def wide_visibilities, do: @visibilities -- [@default_visibility]

  @doc "Whether `thread` is readable by somebody other than its owner."

  @spec wide?(t()) :: boolean()

  def wide?(%__MODULE__{visibility: visibility}), do: visibility in wide_visibilities()

  @spec open?(t()) :: boolean()

  def open?(%__MODULE__{status: "open"}), do: true

  def open?(%__MODULE__{}), do: false

  repository table: a thread may concern a repository the forge does not host,

  so the field records the opener's `owner/name` string, bounded, with no

  foreign key and no format rule beyond non-blank.

  `visibility` is optional and defaults to `dark`, the owner-only rung. It is

  the one field here a caller can use to widen who reads the transcript, so it

  is cast rather than put: naming it is the explicit act, and omitting it

  leaves the thread private (THREAD-002).

  """

  def open_changeset(attributes, owner_visitor_id, now) do

    %__MODULE__{}

    |> cast(attributes, [:objective, :model, :reasoning_effort, :permission_profile, :repository])

    |> cast(attributes, [

      :objective,

      :model,

      :reasoning_effort,

      :permission_profile,

      :repository,

      :visibility

    ])

    |> put_change(:owner_visitor_id, owner_visitor_id)

    |> put_change(:status, "open")

    |> put_change(:generation, 0)

    |> put_change(:started_at, now)

    |> validate_required([:objective, :model, :reasoning_effort, :permission_profile])

    |> validate_required([

      :objective,

      :model,

      :reasoning_effort,

      :permission_profile,

      :visibility

    ])

    |> validate_length(:objective, min: 1, max: @objective_bytes, count: :bytes)

    |> validate_length(:model, min: 1, max: 200)

    |> validate_length(:repository, min: 1, max: @repository_bytes, count: :bytes)

    |> validate_inclusion(:reasoning_effort, @reasoning_efforts)

    |> validate_inclusion(:permission_profile, @permission_profiles)

    |> validate_inclusion(:visibility, @visibilities)

    |> foreign_key_constraint(:owner_visitor_id)

    |> check_constraint(:status, name: :threads_status_check)

    |> check_constraint(:objective, name: :threads_objective_bound_check)

    |> check_constraint(:repository, name: :threads_repository_bound_check)

    |> check_constraint(:visibility, name: :threads_visibility_check)

    |> check_constraint(:reasoning_effort, name: :threads_reasoning_effort_check)

    |> check_constraint(:permission_profile, name: :threads_permission_profile_check)

  end

    # and its own code — never a silent substitution.

    "model_unavailable" => {503, "The model's provider is not configured on this deployment"},

    "thread_terminal" => {422, "This thread is terminal and its transcript is closed"},

    # Thread disclosure (THREAD-002). Widening a transcript is a consent

    # decision, so a tier that did not take is its own code rather than a field

    # message inside the generic 422: a client that meant to publish and did

    # not should learn that from the code it branches on. It covers both an

    # unknown word and a tier of the shared vocabulary this surface has no read

    # path for, because to a caller the effect is identical — the thread stayed

    # as private as it was.

    "thread_visibility_unsupported" =>

      {422, "That transparency tier is not one a thread can be opened at"},

    # A transcript writer meets two refusals that cannot change: a closed

    # thread, and an event the server has called invalid. `thread_terminal`

    # already carries a code; these give the other refusals of the append route

              "match, so a resume picker filters structurally instead of " <>

              "parsing the objective back."

        },

        "visibility" => %{

          "endpoint" => "POST /api/v3/threads",

          "type" => "string",

          "enum" => OpenAgents.Threads.Thread.visibilities(),

          "default" => OpenAgents.Threads.Thread.default_visibility(),

          "description" =>

            "The transparency tier that governs who may read the thread's " <>

              "transcript, from the same dark/pulse/ledger/glass vocabulary " <>

              "the forge uses for disclosure. Optional and owner-only by " <>

              "default: `dark` keeps the thread to the account that opened " <>

              "it, and `ledger` opens GET /api/v3/threads/{thread_id} and its " <>

              "events to any signed-in reader holding the thread id. Widening " <>

              "is recorded in the transcript as `thread.visibility_set`. The " <>

              "`pulse` and `glass` tiers have no thread read path behind them " <>

              "and are refused with `thread_visibility_unsupported`, as is any " <>

              "value that is not a tier. A wider tier widens reads only: the " <>

              "transcript append, the cancel, and the re-mint stay owner-only, " <>

              "and a reader admitted by the tier is served `\"grant\": null`."

        },

        "model" => %{

          "endpoint" => "POST /api/v3/threads",

          "type" => "string",

  - **Revocation does not wait to be asked.** `DELETE` revokes immediately, and

    every request first retires the account's elapsed authority, so a grant

    past its expiry stops being live whether or not anyone presents it.

  - **Disclosure is opt-in and narrow.** A thread opens `dark` — owner-only —

    unless the caller names a wider transparency tier, and a tier this surface

    cannot enforce is refused with `thread_visibility_unsupported`. A wider

    tier reaches `show/2` and `events/2` and nothing else: the writes and the

    mint stay owner-only, and a reader admitted by the tier is not shown the

    owner's grant (THREAD-002).

  The model is admitted here and nowhere else. A request body sent to the proxy

  still cannot select a model — the proxy pins the grant's — so the one place a

  def create(conn, params) do

    with {:ok, objective} <- objective(params),

         {:ok, repository} <- repository(params),

         {:ok, visibility} <- visibility(params),

         {:ok, options} <- execution_shape(params) do

      open(conn, objective, options ++ repository)

      open(conn, objective, options ++ repository ++ visibility)

    else

      {:refused, field, message} -> ApiError.validation_failed(conn, %{field => [message]})

      {:unavailable, model_id} -> unavailable_model(conn, model_id)

      {:unsupported_visibility, value} -> unsupported_visibility(conn, value)

    end

  end

  reading one thread see one transcript rather than two that have diverged.

  """

  def events(conn, %{"thread_id" => thread_id} = params) do

    with_thread(conn, thread_id, fn thread ->

    with_readable_thread(conn, thread_id, fn thread, _relation ->

      events = Threads.list_events(thread, listing_options(params))

      conn

    end

  end

  @doc """

  One thread, with the grant it holds.

  This and `events/2` are the two reads a wider transparency tier reaches. The

  grant is not part of what a tier discloses: it is the owner's money, so a

  reader admitted by the thread's tier gets `"grant": null` rather than the

  account's ceilings and spend (THREAD-002).

  """

  def show(conn, %{"thread_id" => thread_id}) do

    with_thread(conn, thread_id, fn thread -> render_thread(conn, :ok, thread) end)

    with_readable_thread(conn, thread_id, fn thread, relation ->

      render_thread(conn, :ok, thread, relation)

    end)

  end

  def delete(conn, %{"thread_id" => thread_id}) do

  # Expiry is retired before the lookup, so a read reports what is true now

  # rather than what was true when the grant was minted.

  #

  # Owner-only, and deliberately so: this is what every write and every

  # authority-bearing route resolves through. A thread published for reading is

  # not a thread a stranger may append to, cancel, or re-mint.

  defp with_thread(conn, thread_id, continue) do

    user = conn.assigns.current_user

    _reaped = Threads.reap_expired(user)

    end

  end

  defp render_thread(conn, status, %Thread{} = thread) do

  # The read half. A thread the account owns, or somebody else's thread at a

  # tier that admits this reader; anything else is the same plain 404 a

  # non-owner has always received, so a `dark` thread's existence is still not

  # confirmed to a stranger.

  defp with_readable_thread(conn, thread_id, continue) do

    user = conn.assigns.current_user

    _reaped = Threads.reap_expired(user)

    case Threads.fetch_readable(user, thread_id) do

      {:ok, thread, relation} -> continue.(thread, relation)

      :error -> ApiError.not_found(conn)

    end

  end

  defp render_thread(conn, status, %Thread{} = thread, relation \\ :owner) do

    conn

    |> put_extension_header()

    |> put_status(status)

    |> json(%{

      "thread" => thread_view(thread),

      "grant" => grant_view(Threads.latest_grant(thread))

      "grant" => grant_view(thread, relation)

    })

  end

  defp repository(_params), do: {:ok, []}

  # The consent gate. Absent means owner-only, because the tier a caller did

  # not ask for is the narrow one. A value outside the admitted set — a tier

  # this surface cannot enforce, or a word that is not a tier at all — is

  # refused with its own code rather than folded into the generic 422: a client

  # widening a transcript is making a disclosure decision, and it should learn

  # that the decision did not take, not guess from a field message.

  defp visibility(%{"visibility" => value}) when is_binary(value) do

    trimmed = String.trim(value)

    if trimmed in Thread.visibilities() do

      {:ok, [visibility: trimmed]}

    else

      {:unsupported_visibility, trimmed}

    end

  end

  defp visibility(%{"visibility" => value}) when not is_nil(value) do

    {:refused, "visibility", "#{inspect(value)} is not a string."}

  end

  defp visibility(_params), do: {:ok, []}

  defp unsupported_visibility(conn, value) do

    sentence =

      "#{inspect(value)} is not an admitted thread visibility. " <>

        "Admitted: #{Enum.join(Thread.visibilities(), ", ")}. " <>

        "A thread's visibility is the transparency tier that governs who may read its " <>

        "transcript: #{Thread.default_visibility()} keeps it to the account that opened it, " <>

        "and ledger opens it to any signed-in reader holding the thread id. " <>

        "The pulse and glass tiers of the shared vocabulary have no thread read path " <>

        "behind them, so this surface does not offer them."

    ApiError.refuse(conn, "thread_visibility_unsupported",

      message: sentence,

      errors: %{"visibility" => [sentence]}

    )

  end

  defp execution_shape(params) do

    with {:ok, model} <- admitted(params, "model", Models.ids(), Models.default_id()),

         :ok <- serving(model),

      "status" => thread.status,

      "objective" => thread.objective,

      "repository" => thread.repository,

      "visibility" => thread.visibility,

      "reasoning_effort" => thread.reasoning_effort,

      "permission_profile" => thread.permission_profile,

      "generation" => thread.generation,

    }

  end

  # A reader admitted by the thread's tier is not admitted to the owner's

  # balance. The tier discloses the transcript; the grant is what the account

  # is spending, and no rung of the ladder names it.

  defp grant_view(%Thread{}, :reader), do: nil

  defp grant_view(%Thread{} = thread, :owner), do: grant_view(Threads.latest_grant(thread))

  defp grant_view(nil), do: nil

  defp grant_view(%Grant{} = grant) do

  @moduledoc """

  One thread's transcript, read-only, live.

  Owner-only: an unknown id and another account's id both raise the plain 404

  (`OpenAgentsWeb.PublicNotFoundError`), matching how the API's

  `Threads.get_for_user/2` scopes reads — existence is never confirmed to a

  non-owner.

  Private by default: an unknown id and another account's `dark` thread both

  raise the plain 404 (`OpenAgentsWeb.PublicNotFoundError`), matching how the

  API scopes the same read — existence is never confirmed to a reader the

  thread's transparency tier does not admit.

  A thread opened at a wider tier is readable here by any signed-in account

  holding its id, which is the audience this route can actually enforce: it

  sits in the `:authenticated` live session, so there is no anonymous reader to

  admit and none is invented. What the tier does not disclose is the owner's

  money — the budget card is the account's grant, and it renders for the owner

  only (THREAD-002).

  The snapshot-to-live order follows the projection protocol the issue names:

  subscribe to the thread's topic first, then read the snapshot, then let

    user = socket.assigns.current_user

    _reaped = Threads.reap_expired(user)

    case Threads.get_for_user(user, thread_id) do

      nil ->

    case Threads.fetch_readable(user, thread_id) do

      :error ->

        raise OpenAgentsWeb.PublicNotFoundError, message: "thread not found"

      thread ->

      {:ok, thread, relation} ->

        # Attach the live subscriber before reading the snapshot: an append

        # that lands between the two arrives as a buffered message and is

        # deduped below by id, so the gap cannot lose an event.

        if connected?(socket), do: Threads.subscribe(thread)

        events = transcript(thread)

        owner? = relation == :owner

        {:ok,

         socket

         |> assign(:page_title, "Thread · OpenAgents")

         |> assign(:thread, thread)

         |> assign(:grant, Threads.latest_grant(thread))

         |> assign(:owner?, owner?)

         |> assign(:grant, owner? && Threads.latest_grant(thread))

         |> assign(:last_event_id, last_id(events))

         |> assign(:events_empty?, events == [])

         |> stream(:events, events)}

              <dt>Permissions</dt>

              <dd>{@thread.permission_profile}</dd>

            </div>

            <div class="flex gap-1.5">

              <dt>Visibility</dt>

              <dd id="thread-visibility">{visibility_label(@thread.visibility)}</dd>

            </div>

            <div class="flex gap-1.5">

              <dt>Events</dt>

              <dd id="thread-event-count" class="tabular-nums">{@thread.event_count}</dd>

  defp dollars(microusd), do: "$#{:erlang.float_to_binary(microusd / 1_000_000, decimals: 2)}"

  # The tier word plus what it means for a reader, because "dark" alone tells

  # the owner nothing about who can see the page they are looking at.

  defp visibility_label("dark"), do: "dark · only you"

  defp visibility_label("ledger"), do: "ledger · anyone signed in with the link"

  defp visibility_label(visibility), do: visibility

  defp status_variant("open"), do: :info

  defp status_variant("succeeded"), do: :success

  defp status_variant("failed"), do: :danger

defmodule OpenAgents.Repo.Migrations.AddVisibilityToThreads do

  @moduledoc """

  The transparency tier that governs who may read a thread's transcript.

  The vocabulary is the one this application already uses for disclosure —

  `dark`, `pulse`, `ledger`, `glass` (`OpenAgents.Transparency`,

  `OpenAgents.Forge.Visibility`, `docs/taxonomy.md`) — not a second ladder. The

  check constraint admits only the two rungs this surface can enforce today:

    * `dark`   — the account that opened the thread, and nobody else. Default.

    * `ledger` — content and metadata: any signed-in reader holding the

      thread's id may read the transcript.

  `pulse` (metadata only) and `glass` (full access) are in the vocabulary and

  have no thread surface behind them, so the column refuses them rather than

  storing a tier no read path applies. Widening is a deliberate act at open

  and is recorded in the transcript as `thread.visibility_set` (THREAD-002).

  The default is the narrow rung, so every thread written before this migration

  becomes owner-only rather than inheriting a widening nobody asked for.

  """

  use Ecto.Migration

  def change do

    alter table(:threads) do

      add :visibility, :text, null: false, default: "dark"

    end

    create constraint(:threads, :threads_visibility_check,

             check: "visibility IN ('dark', 'ledger')"

           )

  end

end

    {:ceilings, 1} => :no_thread,

    {:default_permission_profile, 0} => :no_thread,

    {:default_reasoning, 0} => :no_thread,

    {:fetch_readable, 2} => :scoped_by_tier,

    {:finish, 2} => :thread_struct,

    {:get_for_user, 2} => :scoped_by_owner,

    {:latest_grant, 1} => :thread_struct,

  # One controller, serving one route: the mint.

  @grant_token_holders [OpenAgentsWeb.ThreadController]

  # The one function that resolves a thread from an identifier, and every

  # module that calls it. It takes the acting account, so another account's

  # thread id resolves to `nil` (THREAD-001, IDENTITY-002). The web thread

  # viewer resolves through the same lookup and renders a `nil` as the plain

  # 404 an absent id gets.

  @thread_resolver_callers [OpenAgentsWeb.ThreadController, OpenAgentsWeb.ThreadShowLive]

  # The two functions that resolve a thread from an identifier, and every

  # module that calls each. Both take the acting account, so neither can be

  # handed a bare id (THREAD-001, IDENTITY-002), and they differ in exactly one

  # way: `get_for_user/2` admits the owner and nobody else, while

  # `fetch_readable/2` also admits a reader the thread's transparency tier

  # names (THREAD-002).

  #

  # The split is the enforcement. Every verb that writes to a thread or mints

  # its authority resolves through the owner-scoped lookup, so widening a

  # transcript for reading can never widen what may be done to it. The one

  # controller serves both, because it serves both the reads and the writes;

  # the web viewer only reads.

  @owner_resolver_callers [OpenAgentsWeb.ThreadController]

  @tier_resolver_callers [OpenAgentsWeb.ThreadController, OpenAgentsWeb.ThreadShowLive]

  test "the modules that mint a grant token are exactly the set THREAD-001 accounts for" do

    assert_exact_set(

           """

  end

  test "a thread resolves by identifier only through the owner-scoped lookup" do

    resolvers = for {key, :scoped_by_owner} <- @threads_api, do: key

    assert {:get_for_user, 2} in resolvers

  test "a thread resolves by identifier only through the two account-taking lookups" do

    owner_scoped = for {key, :scoped_by_owner} <- @threads_api, do: key

    tier_scoped = for {key, :scoped_by_tier} <- @threads_api, do: key

    assert {:get_for_user, 2} in owner_scoped

    assert tier_scoped == [{:fetch_readable, 2}]

    assert_exact_set(

      callers_of([{OpenAgents.Threads, :get_for_user, 2}]),

      @thread_resolver_callers,

      "resolves a thread by identifier"

      @owner_resolver_callers,

      "resolves a thread by identifier, owner-scoped"

    )

    assert_exact_set(

      callers_of([{OpenAgents.Threads, :fetch_readable, 2}]),

      @tier_resolver_callers,

      "resolves a thread by identifier through its transparency tier"

    )

  end

defmodule OpenAgents.Threads.VisibilityTest do

  @moduledoc """

  THREAD-002: a thread's transcript is private until its owner says otherwise.

  The tier vocabulary is not this module's invention — it is the

  `dark/pulse/ledger/glass` ladder `OpenAgents.Transparency` and

  `OpenAgents.Forge.Visibility` already use (`docs/taxonomy.md`), and the first

  test here holds the thread's admitted set to it, so a fifth word cannot enter

  through this door.

  """

  use OpenAgents.DataCase, async: false

  import OpenAgentsWeb.ConnCase, only: [github_user: 1]

  alias OpenAgents.DataRights.AccountExport

  alias OpenAgents.Threads

  alias OpenAgents.Threads.Thread

  alias OpenAgents.Transparency

  defp owner(key), do: github_user("thread-visibility-#{key}")

  defp event_types(thread) do

    thread |> Threads.list_events() |> Enum.map(& &1.event_type)

  end

  describe "the vocabulary" do

    test "a thread's tiers are rungs of the shared transparency ladder" do

      shared = Enum.map(Transparency.tier_atoms(), &Atom.to_string/1)

      assert Thread.visibilities() -- shared == [],

             "a thread must not invent a tier word the transparency ladder does not have"

      assert Thread.default_visibility() == "dark"

      assert Thread.wide_visibilities() == ["ledger"]

    end

    test "the tiers with no thread read path behind them are not offered" do

      refute "pulse" in Thread.visibilities()

      refute "glass" in Thread.visibilities()

    end

  end

  describe "open/3" do

    test "a thread defaults to owner-only" do

      {:ok, thread} = Threads.open(owner("default"), "Keep it to myself")

      assert thread.visibility == "dark"

      refute Thread.wide?(thread)

    end

    test "an explicit tier is accepted and recorded as an act" do

      {:ok, thread} =

        Threads.open(owner("explicit"), "Share the transcript", visibility: "ledger")

      assert thread.visibility == "ledger"

      assert Thread.wide?(thread)

      # Widening leaves a record in the transcript, not only a column value.

      assert event_types(thread) == ["thread.opened", "thread.visibility_set"]

      assert thread.event_count == 2

      widened = thread |> Threads.list_events() |> List.last()

      assert widened.payload == %{"visibility" => "ledger", "from" => "dark"}

    end

    test "a default thread records no widening" do

      {:ok, thread} = Threads.open(owner("unwidened"), "Nothing to declare")

      assert event_types(thread) == ["thread.opened"]

      assert thread.event_count == 1

    end

    test "an unknown tier is refused, and nothing is opened" do

      user = owner("unknown")

      assert {:error, changeset} = Threads.open(user, "Widen me", visibility: "public")

      assert "is invalid" in errors_on(changeset).visibility

      assert Threads.list_for_user(user) == []

    end

    test "a tier the surface cannot enforce is refused like any other" do

      for tier <- ~w(pulse glass) do

        assert {:error, changeset} =

                 Threads.open(owner("unenforceable"), "Widen me", visibility: tier)

        assert "is invalid" in errors_on(changeset).visibility

      end

    end

  end

  describe "fetch_readable/2" do

    test "the owner reads their own thread at either tier" do

      user = owner("owner-reads")

      {:ok, dark} = Threads.open(user, "Private work")

      {:ok, wide} = Threads.open(user, "Shared work", visibility: "ledger")

      assert {:ok, %Thread{id: id}, :owner} = Threads.fetch_readable(user, dark.id)

      assert id == dark.id

      assert {:ok, %Thread{}, :owner} = Threads.fetch_readable(user, wide.id)

    end

    test "a stranger reads a wide thread and is named a reader, not an owner" do

      {:ok, thread} = Threads.open(owner("wide"), "Shared work", visibility: "ledger")

      assert {:ok, %Thread{id: id}, :reader} =

               Threads.fetch_readable(owner("stranger-wide"), thread.id)

      assert id == thread.id

    end

    test "a stranger cannot read an owner-only thread" do

      {:ok, thread} = Threads.open(owner("dark"), "Private work")

      assert Threads.fetch_readable(owner("stranger-dark"), thread.id) == :error

    end

    test "an unknown id is the same refusal as somebody else's private thread" do

      assert Threads.fetch_readable(owner("missing"), Ecto.UUID.generate()) == :error

      assert Threads.fetch_readable(owner("missing"), "not-a-uuid") == :error

    end

    test "writing stays owner-only however wide the tier" do

      {:ok, thread} = Threads.open(owner("write-fence"), "Shared work", visibility: "ledger")

      stranger = owner("stranger-write")

      # The read admits the stranger; the owner-scoped lookup every write and

      # every mint resolves through does not.

      assert {:ok, _thread, :reader} = Threads.fetch_readable(stranger, thread.id)

      assert Threads.get_for_user(stranger, thread.id) == nil

    end

  end

  describe "the account export" do

    test "carries the account's threads, their events, and the tier that governs them" do

      user = owner("export")

      {:ok, thread} =

        Threads.open(user, "Export this transcript",

          repository: "OpenAgentsInc/openagents.com",

          visibility: "ledger"

        )

      {:ok, _thread} =

        Threads.record_event(thread, "tool.ran", %{"tool" => "bash", "status" => "ok"})

      assert {:ok, export} = AccountExport.build(user)

      assert %{"records" => [record]} = export["threads"]

      assert record["id"] == thread.id

      assert record["objective"] == "Export this transcript"

      assert record["repository"] == "OpenAgentsInc/openagents.com"

      # The consent record travels with the data it governs.

      assert record["visibility"] == "ledger"

      types = Enum.map(record["events"], & &1["event_type"])

      assert "thread.opened" in types

      assert "thread.visibility_set" in types

      assert "tool.ran" in types

      # A plugin run is a thread event, so the export reaches it through the

      # thread rather than through a second collection (#206).

      tool_ran = Enum.find(record["events"], &(&1["event_type"] == "tool.ran"))

      assert tool_ran["payload"] == %{"tool" => "bash", "status" => "ok"}

    end

    test "an owner-only thread exports with its default tier stated" do

      user = owner("export-dark")

      {:ok, _thread} = Threads.open(user, "Private work")

      assert {:ok, export} = AccountExport.build(user)

      assert [%{"visibility" => "dark"}] = export["threads"]["records"]

    end

  end

end

defmodule OpenAgentsWeb.ThreadVisibilityTest do

  @moduledoc """

  THREAD-002 at the two doors a thread is read through: the API and the web

  transcript viewer.

  Both doors answer the same three questions the same way — an owner reads

  their own thread, a reader admitted by the thread's tier reads it without the

  owner's budget, and a stranger at an owner-only thread gets the plain 404

  that never confirms the thread exists.

  """

  use OpenAgentsWeb.ConnCase, async: false

  import Phoenix.LiveViewTest

  alias OpenAgents.Threads

  defp signed_in(conn, user), do: Plug.Test.init_test_session(conn, %{"user_id" => user.id})

  describe "POST /api/v3/threads" do

    test "a thread opens owner-only when the caller names no tier", %{conn: conn} do

      thread =

        conn

        |> put_chat_api_token("visibility-default")

        |> post(~p"/api/v3/threads", %{"objective" => "Keep it to myself."})

        |> json_response(201)

        |> Map.fetch!("thread")

      assert thread["visibility"] == "dark"

    end

    test "an explicit tier is accepted and published", %{conn: conn} do

      thread =

        conn

        |> put_chat_api_token("visibility-explicit")

        |> post(~p"/api/v3/threads", %{

          "objective" => "Share the transcript.",

          "visibility" => "ledger"

        })

        |> json_response(201)