@haneinfo/delegation

Human-managed, time-bounded, one-hop delegation for Assignment. The implementation follows approved decision 202610-6b1f. Register delegation() in the plugin inventory, use configRef delegation, and migrate prisma/delegation.prisma plus Assignment's two new nullable task columns before loading the updated packages. The initial package version is 0.0.0 with a minor changeset for its first 0.1.0 release.

DelegationModule.register({ maxDurationDays: 90, appName: 'app' }) exports DelegationService, DelegationMcpTools and the plugin-api DELEGATION_RESOLVER token. Identity-store is required; RBAC and notification-inbox are optional. Without notifications, delivery is skipped, following Assignment's existing degradation policy. Without RBAC, users can only manage their own records.

The Delegation table owns id, delegatorId, delegateId, startsAt, endsAt, status, assignmentCodes, reason, createdBy, revokedAt, revokedBy and createdAt. It uses snake_case table/column names and indexes on (delegatorId, status), (delegateId, status), and (startsAt, endsAt). Status is ACTIVE or REVOKED. Expiry never changes status: effective means ACTIVE and startsAt <= now < endsAt.

See agent-guide.md for rules, routes, MCP, errors and integration limitations.

Instance access lists

Implemented against approved decision 202610-c8e3.

Delegated tasks now receive permanent DELEGATED READ entries through Assignment. Their source is separate from original ASSIGNED readers and from revocable GRANTED access. Ending delegation still leaves the permanent entry. There are no new delegation management routes or MCP tools.

Upgrade the affected mechanisms together after applying the App migration. The maintained model, HTTP routes, read-only list_instance_access MCP tool, errors and permission contract are documented in @haneinfo/state-machine/agent-guide.md. Its prisma/instance-access.sql migrates the existing reader table to USER/ROLE, READ/WRITE and ASSIGNED/DELEGATED/GRANTED rows while retaining timestamps. The maintainer selected (instanceId, principalType, principalId, source) uniqueness. Manual grants are limited to 100 by default; permanent READ entries survive manual removal. See the package repository validation/equipment-loan/instance-access/report.md for SQL, tests and App restoration evidence.