docs(design): fold channels into the agent tree (RIG-1622)

[rigel-mintaka]

Design record for RIG-1622 — folds comms channels into the agent tree, so a
channel can hang off an agent as a child node instead of living in the
separate folder hierarchy that PR #91 removed.

Docs-only: +1807 / -0 across two files. No code changes, no behaviour
change. The record is the contract that T1–T8 execute against, frozen on
merge per skill://design.

• docs/designs/ui/compass-channels-in-agent-tree/design.md (new, 1805 lines)
• docs/designs/DECISIONS.md (+2 — ledger rows DL-344/DL-345)

Two forks Matt ruled, now settled in the record

Both were asked mid-pass and are recorded as DECIDED in the record and the
ledger, so a later reader does not reopen them:

1. Membership is two modes, not one derived rule. ChannelMembershipMode
   (proto field 12, column channels.membership_mode): EXPLICIT = 0 keeps
   hand-managed members, TREE = 1 derives the member set from the subtree.
   Deliberately not a ChannelKind value — kind is the DM-vs-channel axis —
   and not implied by parent_agent_id IS NOT NULL, which would foreclose a
   hand-membered channel that lives in the tree.
2. The read grant is the owner set. By default every agent under an owner
   can read that owner's channels. Recorded as a product decision rather than
   as reuse of an existing precedent, because no such precedent exists for
   channels — the owner-set viewer CTE appears only in the two group
   queries (channels.sql:93, :118), never in the three channel predicates.
   A later ACL system is named as the successor, with its insertion point
   stated.

Review history

Five review rounds (skill://review), each one blocking on a real defect the
previous fix pass introduced or missed. The record grew 445 → 1805 lines
across them. The substantive finds, all driver-verified against code:

• A representational change recurs at every layer that reads the old
  representation. Adding tree-derived membership was first fixed only at the
  post gate (messages.go:59); the identical defect then reappeared at six
  more sites, every one of them FROM channel_members — the delivery fan-out
  (SubscribedAgents, ChannelAgentMembers, SeedChannelDeliveryCursors,
  SweepChannels), three missed membership-probe callers (topics.go:23,
  channels.go:550, channels.go:765), and the wire, where an empty
  member_account_ids makes deriveMembership return "none". Channel-keyed
  sites need subtree descent; account-keyed sites need ascent.
• RLS fails open for a new table. 0001_init.sql:939-950 enables row-level
  security by iterating a hardcoded tenant_tables array, so a table added
  outside that list ships with RLS off. The record calls the array edit out
  explicitly in T2.
• One construction site, structurally. CreateChannel returned a
  hand-written Channel{} literal after commit (channels.go:206-213),
  bypassing channelFromRow — so both new columns were silently dropped on the
  create path. Enumerated properly: 49 return Channel{ minus 47
  return Channel{} = exactly two field-populating sites. Fixed by re-reading
  through getChannel after commit, collapsing it to one, so no future column
  can miss create. The two-line shortcut is explicitly forbidden in the record,
  because the extra site is the defect.

One accepted limitation, stated rather than papered over: the post-commit
re-read is fallible where the literal was not. A fallback literal would
reintroduce the site the fix eliminated, and both siblings
(UpdateChannelMembers, SetChannelPolicy) already propagate this way.

Plan

T1 proto (attach edge, membership mode, ReparentChannel) · T2–T6
compass-server (schema + RLS, participant probe, visibility predicates and
read paths, subscriptions and delivery, comms RPC edge and events) · T7–T8
compass-ui (sidebar tree, live adapter and fixtures). Cross-lane: only T7–T8
are mine.

Five open questions remain in the record, each marked load-bearing or not.
One is load-bearing (whether the owner-set read grant extends to
OWNER-grouped channels) and is flagged for a decision before T4 starts.

Gates

• bun tools/design-ledger-gate/index.ts — OK — 310 ledger row(s), 130 record header(s) valid
• moon run root:markdownlint — 207 files, 0 errors
• CI 7 pass / 6 skipping / 0 fail

Rebased onto main 13a9e8f5. The DECISIONS.md conflict was resolved as the
union with my rows renumbered DL-338/339 → DL-344/345 (main had taken 338), and
the one prose citation of the old id updated with them.

RIG-1622

[linear-code]

RIG-1622

[trunk-io]

Merging to main in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here

[github-actions]

Compass engineering docs preview: https://compass-ui-rig-1622-channels.compass-eng-docs.pages.dev

Deployed from compass-ui/rig-1622-channels-in-agent-tree at e74ecab.

Changed pages:

• docs/designs/DECISIONS.md
• docs/designs/ui/compass-channels-in-agent-tree/design.md