feat: add memory:read and memory:write scopes for team memory

Draft
SI
3h ago
+163-26

Requested by Sagar · project thread

Summary

  • Adds memory:read and memory:write to authz/scopes.go. Both are project-scoped (the memory family maps to ResourceKindProject, like log:read), user-visible, and owned by the access grant surface. memory:write satisfies memory:read.
  • Neither scope is in any system role, not even admin, and neither is agent-runtime-safe. Neither project:*, org:admin nor chat:* implies them. Tests pin all of this.
  • Registers both in ListScopes, the full-access grant list, the runtime-policy registry, the access design enums (regenerated Goa output), the dashboard SDK enums and the role matrix copy.
  • Documents both in docs/rbac.md.

No handler uses the scopes yet. The team memory tools (search_team_memory, remember, and the recall/zoom tools) will enforce them in follow-up PRs, behind the team-memory flag.

Motivation

Team memory exposes masked summaries of every member's sessions in a project, so reading it needs an explicit grant, following the chat:read / log:read precedent. Landing the scopes on their own keeps the tool PRs small.

The dashboard SDK enum files and .speakeasy/out.openapi.yaml were updated by hand to match the regenerated Goa output, because the SDK generator couldn't run in this environment. CI's SDK drift check will confirm they match.

Generated by Claude Code

Summary by cubic

Adds memory:read and memory:write authorization scopes so a project's team memory requires an explicit grant. No handler enforces them yet; the team memory tools will do so in follow-up PRs behind the team-memory flag.

  • Both scopes are project-scoped and user-visible; memory:write implies memory:read.
  • Neither is in any system role, including admin, and neither project:*, org:admin, nor chat:* implies them, since team memory summarizes every member's sessions.
  • The role matrix now shows the team memory entry as included when memory:write is granted.
  • Registers the scopes in the scope list, access grant list, runtime-policy registry, access design enums, dashboard SDK enums, and RBAC docs.
  • Dashboard SDK enum files and .speakeasy/out.openapi.yaml were updated by hand to match regenerated Goa output; CI's SDK drift check will confirm they match.