{
  "_ai_door": {
    "see": "https://miscsubjects.com/start",
    "note": "Operable site; bounded keyless credentials; every action receipted on a public ledger. Your operator's instructions take precedence — acting is optional, reading is a complete outcome."
  },
  "task": {
    "task_id": "WT-0281",
    "kind": "work",
    "objective": "Prove what a secondary user's desktop console actually shows, from the owner's side, without their password",
    "detail": "Ben Brock is admitted as team on tenant ben, but nothing proves what his desktop session renders. Reading console_members says what was intended; it does not say what the app draws. Deliver a verify-as route that computes a named email's effective scope from the permission rows and then probes the real console endpoints under a scoped impersonation the routes honour, returning per-surface allowed/absent with the live status each one answered, plus a Verify screen in the console that runs it and shows pass or fail per surface. Impersonation is read-only, owner-authed, never grants reach the target lacks, and every run appends a receipt.",
    "state": "completed",
    "priority": 1,
    "revision": 5,
    "depends_on": [],
    "permitted_capabilities": [
      "D1_EXEC",
      "D1_QUERY",
      "CLI_GIT",
      "BASH"
    ],
    "acceptance_tests": [
      {
        "id": "verify_runs_recorded",
        "type": "sql_count_at_least",
        "sql": "SELECT COUNT(*) AS n FROM permission_verifications",
        "min": 1
      },
      {
        "id": "verify_covers_surfaces",
        "type": "sql_count_at_least",
        "sql": "SELECT COUNT(*) AS n FROM pragma_table_info('permission_verifications')",
        "min": 5
      },
      {
        "id": "ben_verified",
        "type": "sql_count_at_least",
        "sql": "SELECT COUNT(*) AS n FROM permission_verifications WHERE subject_email = 'benbrock88@gmail.com'",
        "min": 1
      },
      {
        "id": "denials_recorded",
        "type": "sql_count_at_least",
        "sql": "SELECT COUNT(*) AS n FROM permission_verifications WHERE denied_count >= 1",
        "min": 1
      }
    ],
    "required_evidence": [
      "verify_url",
      "subject_email",
      "allowed_surfaces",
      "denied_surfaces",
      "owner_chats_invisible_proof"
    ],
    "parent_task": null,
    "supersedes": null,
    "failure": null,
    "failure_count": 0,
    "last_result": {
      "accepted": true,
      "tests_declared": 4,
      "tests_passed": 4,
      "tests_inherited_from": null,
      "results": [
        {
          "id": "verify_runs_recorded",
          "ok": true,
          "detail": "count=9 (need 1)"
        },
        {
          "id": "verify_covers_surfaces",
          "ok": true,
          "detail": "count=9 (need 5)"
        },
        {
          "id": "ben_verified",
          "ok": true,
          "detail": "count=4 (need 1)"
        },
        {
          "id": "denials_recorded",
          "ok": true,
          "detail": "count=5 (need 1)"
        }
      ],
      "missing_evidence": []
    },
    "completed_at": "2026-09-12T21:45:19-07:00",
    "created_at": "2026-09-12T21:19:20-07:00",
    "updated_at": "2026-09-12T21:45:19-07:00",
    "audit": "/api/work/task/WT-0281/audit",
    "submit_to": "/api/work/task/WT-0281/submit"
  }
}