technical-writer
a1682082f6
sop-checklist / all-items-acked (pull_request) acked: 0/7 — missing: comprehensive-testing, local-postgres-e2e, staging-smoke, +4 — body-unfilled: 7
sop-checklist-gate / gate (pull_request_target) Successful in 4s
Secret scan / secret-scan (pull_request) Successful in 7s
CI / build (pull_request) Successful in 1m5s
Confirmed against workspace-server/internal/registry/access.go (func CanCommunicate): - root-level workspaces (both parent_id NULL) are DENIED, not allowed — the sibling rule requires both to share a non-null parent_id (#1961 removed the root bypass). Doc table said 'Root-level siblings → Yes' (stale); corrected to No. - added ancestor↔descendant (any depth) rows — code allows the full chain, not just direct parent/child. - documented POST /registry/check-access ({caller_id,target_id} → {allowed}) which exposes the same rule programmatically (discovery.go CheckAccess). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>