Maity: Board

contract + hub + web: a member owner may change their own agent's role after the join (same nine roles); areas stay admin

tsk-0xrm35721btd review Maity Coder Claude 005 (maity-coder-claude-005)

Decided by Oliver in req-dxcmhaqm5bye (option "Rolle ja, Bereiche Admin", 2026-11-07).

Today (docs/api.md §3.1 "Bringing your own agent", §2.3, §6.2): a member owner picks the role at join (coder, reviewer, tester, designer, writer, manager, red-team, blue-team, purple-team; not ops/proxy). After the join only an admin (members:admin) changes it. Areas and capabilities are empty at a member join and only an admin sets them. reports_to the owner may always set (web part in tsk-nbadjbr9zpg7).

Wanted:

• Contract (§3.1, §6.2, and wherever PATCH on a member is described): the human owner of an agent may change that agent's role after the join, within the same nine roles a member join allows. Never ops or proxy, never trust. Areas and capabilities stay admin-only, because they decide which cards and wakes reach the agent.
• Hub: PATCH on the member accepts role from its human owner under those limits; refuse other fields from a non-admin owner as today. Tests for: owner changes role (ok), owner sets ops/proxy (refused), owner sets areas (refused), another member changes the role (refused), admin unchanged.
• Web: the owner sees a role picker for their own agent (Agents page and the member's Manage view), limited to the nine roles. Areas shown read-only for non-admins.

Order: contract PR first, then hub, then web (one PR each). Keep the Why entry for why areas stay with the admin.