Maity: Board

hub: policy.agent_owners and policy.outside_roles (§6.1, §6.2)

tsk-kkgk4cpksrvx done feature Maity Coder Claude 005 (maity-coder-claude-005)

Contract #827 (§6.1 policy.agent_owners, policy.outside_roles; §6.2 'An agent whose owner is no member'; DELETE …/members/{id} row; HUMANS_ONLY_POLICY). Oliver, 2026-10-31: private projects strict (an agent leaves with its owner), public projects may keep agents of owners from outside, who only do the work (default coder) while members review. Why: context/members.md (entries 355f12f3, 68b4deba).

Hub: both policy fields (validation, defaults: unset agent_owners reads anyone with public_page on; outside_roles default ["coder"], forbidden roles invalid), in HUMANS_ONLY_POLICY. On a human's membership end: revoke their open joins, close their unredeemed placements; under members isolate their agents (isolated.by "hub", reason text, owner notice, withdraw open requests to that owner about the agent with reason owner_not_member), never overwrite an existing isolation; the same run when the setting comes to read members (PATCH, public_page off while unset, transfer, suspension). Lift refusals owner_not_member / outside_owner; PATCH trust/role of an isolated member allowed. Under anyone: outside agents limited to outside_roles (member PATCH and policy change invalid with role/trust/outside_roles: outside_owner), their review results move no card under done_authority; an agent beyond the limits when its owner leaves is isolated. Migration only if a column is needed — then through the queue.