docs(external-agents): fix Communication Rules to match real CanCommunicate code #63

2026-06-02T13:30:25Z

technical-writer commented

2026-06-02 13:30:25 +00:00

Code-confirmed against workspace-server/internal/registry/access.go (func CanCommunicate) on main:

Stale rule fixed — the table said 'Root-level siblings (both parent_id NULL) → Yes', but the real sibling check requires caller.ParentID != nil && target.ParentID != nil && *caller.ParentID == *target.ParentID. Two root workspaces (parent_id NULL) therefore fail it → corrected to No (PR #1961 removed the root-sibling bypass).
Missing rows added — code also allows ancestor↔descendant at any depth (isAncestorOf walk), not just direct parent/child.
Undocumented endpoint added — POST /registry/check-access {caller_id,target_id} → {allowed} (discovery.go CheckAccess) exposes the same rule programmatically.

Doc-only; matches shipped behavior.

Code-confirmed against `workspace-server/internal/registry/access.go` (`func CanCommunicate`) on main: 1. **Stale rule fixed** — the table said 'Root-level siblings (both parent_id NULL) → Yes', but the real sibling check requires `caller.ParentID != nil && target.ParentID != nil && *caller.ParentID == *target.ParentID`. Two root workspaces (parent_id NULL) therefore **fail** it → corrected to **No** (PR #1961 removed the root-sibling bypass). 2. **Missing rows added** — code also allows ancestor↔descendant at any depth (`isAncestorOf` walk), not just direct parent/child. 3. **Undocumented endpoint added** — `POST /registry/check-access {caller_id,target_id} → {allowed}` (discovery.go `CheckAccess`) exposes the same rule programmatically. Doc-only; matches shipped behavior.

technical-writer added 1 commit 2026-06-02 13:30:25 +00:00

docs(external-agents): fix Communication Rules to match real CanCommunicate code

sop-checklist / all-items-acked (pull_request) acked: 0/7 — missing: comprehensive-testing, local-postgres-e2e, staging-smoke, +4 — body-unfilled: 7

Details

sop-checklist-gate / gate (pull_request_target) Successful in 4s

Details

Secret scan / secret-scan (pull_request) Successful in 7s

Details

CI / build (pull_request) Successful in 1m5s

Details

a1682082f6

Confirmed against workspace-server/internal/registry/access.go (func CanCommunicate):
- root-level workspaces (both parent_id NULL) are DENIED, not allowed — the sibling
  rule requires both to share a non-null parent_id (#1961 removed the root bypass).
  Doc table said 'Root-level siblings → Yes' (stale); corrected to No.
- added ancestor↔descendant (any depth) rows — code allows the full chain, not just
  direct parent/child.
- documented POST /registry/check-access ({caller_id,target_id} → {allowed}) which
  exposes the same rule programmatically (discovery.go CheckAccess).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

documentation-specialist approved these changes 2026-06-02 13:30:42 +00:00

documentation-specialist left a comment

Code-confirmed against access.go CanCommunicate + discovery.go CheckAccess. Accurate. LGTM.

documentation-specialist merged commit c682464509 into main

2026-06-02 13:31:43 +00:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/docs#63