Editor ownership and contracts

Owner: Execute Editor. Operating authority: Wonffice operating model, #496.

Responsibility

Native model/editor/input/selection/history/serialization and Note/Word/Slides/Site consumers. Default families include model/datastore/extensions/editor-core/editor-view/renderer and office-note/word/slides/site plus their apps. Exact Issue/file claims are required; these families are not blanket ownership of every shared file. Office shell/auth/servers belong to Workspace; shared configuration/local develop belong to Integration.

Contract to retain

Preserve full original native IDs/content/attributes/marks/resources/references/pins/definition texts; root and last nested input; current authority/session/resource checks; selection/focus/scroll and operated history; fixed-request versus later-draft recovery. Codec admission, materialized editor behavior, real browser behavior and current server authority are separate evidence. A new readonly context does not migrate old engine history or confer edit rights.

Manuals and task record

Maintain supported commands/API/limits, executable usage with exact source/build/consumer evidence, and native save/reopen/refusal examples. Reuse existing package README and docs/specs; do not invent support from test names or turn a proof fixture into ordinary product activation. Link each change to its Issue/current integrated receipt. Live progress is in Issues.

Current #495 native consumer readiness is separately assessed after the explicit read bridge is qualified. Ordinary native2 activation, old pending migration and account retirement are not granted by role creation. Earlier accepted #432 common UI and #435 native marks remain bounded original results; role setup does not rerun or broaden them. #434 remains human-held.

Authenticated Note native2 consumer boundary

The bounded readonly Office/Note host is locally integrated at 383ac5ac under #497. Controlled source/compiled browser and native checks passed; genuine OIDC/API/privatePG and original whole acceptance remain pending. The current exact follow-up repairs terminal read retirement without a host rerender. See the detailed Editor roadmap and completion criteria. Workspace owns the Office-private read bridge and its current server authority checks. Its private result contains an immutable validated document head, complete raw native2 snapshot, exact ordered pins and definition texts, and a read-only provenance/currentness lease. The lease has permanent retirement after an observed account, session, request, expiry or host-authority change. It grants no editing permission. Equal role names cannot prove that an unseen revoke and restore did not occur.

The smallest Editor consumer stages a separate noneditable Note native2 model only after explicit user intent. It first captures the actual source and host authority, root, session, document epoch, nested resource and current read lease. It checks these again after each asynchronous step. A failed or retired stage closes its own model and leaves the source mounted. This scope does not replace the source, transfer old engine history, acknowledge pending input, save, adopt, issue a receipt request or turn on ordinary native2 discovery. Any Office host binding is a separate named Workspace file lease; Editor owns only its exact Note files.

Before a producer, the linked child/scope record must name its immutable accepted base, exact files and interface receipt. Independent expected values must cover the complete original native body, IDs, attributes, marks, resources, references, raw bytes, ordered pins and full definitions. Include the last root and nested draft, fixed request and later draft, actual source model/history operation references and index, selection, focus and scroll. Check source and staged lifetimes through authority retirement and request replacement. Supported A1/A2/B stages must preserve their full independent expectations. An unsupported variant must refuse explicitly while its read data and source remain exact. Verify no hidden model execution on a mere bundle read and no source, pending, network write or receipt effects. Controlled fixtures, genuine login/API/PostgreSQL, integrated code and release are separate evidence rows. The complete #495 criteria remain open until their own applicable checks pass.

Latest human continuation rule — 2026-10-09

Execute Editor directly maintains Editor-Roadmap, selects the next ready in-scope existing Issue, or creates a deduplicated roadmap Issue if none exists. It informs Planner of newly created Issues. Every exact file/interface claim, original acceptance, meaningful checks and the unique Integration runtime responsibility remain. Live implementation and verification state stays in the Issue records.