fix: stabilize canvas runtime and permission review (#3600)

2026-09-11 15:51:32 +01:00
parent 76ab362701
commit 86b96fd14e
67 changed files with 4829 additions and 644 deletions
@@ -97,6 +97,14 @@ apps/backend/
 │   └── worktree/         # Git worktree management for workspace isolation
 ```

+Canvas creation authority is recorded only by the trusted task authoring
+adapter. It binds the workspace owner, creating session, task scope, and
+policy version to a new draft. The first valid static web-app release may
+consume that single-use authority for exact task-scoped grants in the same
+transaction as release insertion and activation. Existing drafts, imports,
+later permission increases, and revoked grants remain on the human review
+path. Never use source metadata or a manifest trust field as authority.
+
 ## Key Concepts

 **Orchestrator** coordinates task execution: