Owner decisions (2026-10-13), continued, with all recommendations
accepted:
- write mode per conversation (Read-only by default), user preference,
admin policy, confirmed writes, auto-confirm rules;
- the hard wall: the assistant client channel is denied every assistant_*
object and the security surfaces in core, plus a startup check;
- audit attribution: the human actor plus via=assistant/<turnId>;
- providers and models as data (OpenAI-compatible, Bedrock, Vertex),
local models, HIPAA/PHI routing, budgets, routing, RAG and scheduled
tasks.
Also the phase plan and its dependencies.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>