The Brain half of surface S1 from the graduated FM design-first record (D#15249, closed RESOLVED → #15254 Surface Registry). The operator reads raw A2A mailbox traffic by hand today; the cockpit's detail view has no communication surface. The cockpit pane (sibling leaf under #14560) consumes THIS adapter — blocked-by edge set.
The Problem
Cross-inbox reads are identity-bound: an operator/control-plane viewer reading agent X's mailbox is not agent X. No Fleet-side surface exposes a mailbox mirror with viewer admission today; the cockpit cannot render one honestly without it.
The Architectural Reality
MailboxService already discovers bounded pagination (limit, offset) and thread metadata (partOfThread); its public summary must carry that discovered thread fact so the adapter can project the real service contract rather than an enriched test double.
The graduated record's binding boundary ACs (verbatim authority): read-only Body→Brain adapter; explicit operator/control-plane viewer admission (CAN_READ_INBOX_OF + audit policy); canonical identity mapping (viewer, subject-agent); bounded pagination; no markRead exposure on the adapter surface — operator-side mark-read would mutate the agent's own turn-start signal and silently swallow peer handoffs (the record's MUST-NOT, a correctness rule).
Admission authority is the server-stamped request identity used by MailboxService. A viewerIdentity field is an audit fact only: wiring must derive or verify it against that same trusted request binding; caller text never grants access. This surface accepts one direct Agent subject, not the AGENT:* broadcast sentinel.
Default view = active/non-archived inbox (archive stays opt-in per the mailbox contract); archive browsing is out of v13.2 scope unless explicitly specced later.
Any subject or diagnostic projected toward the Body is bounded and secret-safe, including bearer and PAT-shaped credentials.
Acceptance Criteria
A Fleet-side read adapter exposes a per-agent mailbox mirror: {viewerIdentity, subjectAgentId, limit, offset} → immutable message rows (timestamped facts) + thread metadata, active/non-archived by default.
Viewer admission enforced fail-closed: no CAN_READ_INBOX_OF grant → no rows, an honest admission error (never an empty-success); admission checks are auditable and tied to the same trusted request identity that enforced the read.
The adapter surface carries NO markRead/mutation verbs — structurally absent, not merely unused.
Canonical identity mapping documented and tested (viewer ≠ subject; direct Agent subject only; agent-reading-own-inbox stays on the existing path, untouched).
Unit coverage: admission fail-closed, trusted viewer/subject validation, pagination bounds, active-vs-archived default, real MailboxService thread metadata pass-through, and secret-safe projected text.
Structurally absent — read/projection exports only
n/a
Module JSDoc
Export-surface witness
Archive exposure
Ticket active/non-archived default
Adapter does not expose or forward includeArchived
Service default governs
Module JSDoc
Exact forwarded-key witness
Out of Scope
The cockpit pane rendering this (sibling leaf, blocked on this one) · reply-as-operator (deferred v13.3 per the record — needs the operator-as-sender authority contract) · archive browsing.
Related
Epic #13015 (parent — the C-lane services home per the D#15209 placement default) · D#15249 (graduated record, S1 resolution tokens + boundary ACs) · #15254 / PR #15255 (Surface Registry citation target) · #15253 (the markRead divergence bug — adjacent evidence for the MUST-NOT).
Sweeps: latest-open checked 2026-07-16T15:05Z (latest #15267) — no equivalent; the fleet service tree carries no mailbox read adapter (grep-verified during the D#15249 STEP_BACK). A2A herd-window clean.
Context
The Brain half of surface S1 from the graduated FM design-first record (D#15249, closed RESOLVED → #15254 Surface Registry). The operator reads raw A2A mailbox traffic by hand today; the cockpit's detail view has no communication surface. The cockpit pane (sibling leaf under #14560) consumes THIS adapter — blocked-by edge set.
The Problem
Cross-inbox reads are identity-bound: an operator/control-plane viewer reading agent X's mailbox is not agent X. No Fleet-side surface exposes a mailbox mirror with viewer admission today; the cockpit cannot render one honestly without it.
The Architectural Reality
limit,offset) and thread metadata (partOfThread); its public summary must carry that discovered thread fact so the adapter can project the real service contract rather than an enriched test double.CAN_READ_INBOX_OF+ audit policy); canonical identity mapping (viewer, subject-agent); bounded pagination; no markRead exposure on the adapter surface — operator-side mark-read would mutate the agent's own turn-start signal and silently swallow peer handoffs (the record's MUST-NOT, a correctness rule).viewerIdentityfield is an audit fact only: wiring must derive or verify it against that same trusted request binding; caller text never grants access. This surface accepts one direct Agent subject, not theAGENT:*broadcast sentinel.Acceptance Criteria
{viewerIdentity, subjectAgentId, limit, offset}→ immutable message rows (timestamped facts) + thread metadata, active/non-archived by default.CAN_READ_INBOX_OFgrant → no rows, an honest admission error (never an empty-success); admission checks are auditable and tied to the same trusted request identity that enforced the read.Contract Ledger
readFleetMailboxMirror(options)admissionaudit factCAN_READ_INBOX_OFdeniedonly for the named capability failure; other failures areunavailablelistMessages()summary contractpartOfThread; adapter projects it without inventionnull, never guessedincludeArchivedOut of Scope
The cockpit pane rendering this (sibling leaf, blocked on this one) · reply-as-operator (deferred v13.3 per the record — needs the operator-as-sender authority contract) · archive browsing.
Related
Epic #13015 (parent — the C-lane services home per the D#15209 placement default) · D#15249 (graduated record, S1 resolution tokens + boundary ACs) · #15254 / PR #15255 (Surface Registry citation target) · #15253 (the markRead divergence bug — adjacent evidence for the MUST-NOT).
Sweeps: latest-open checked 2026-07-16T15:05Z (latest #15267) — no equivalent; the fleet service tree carries no mailbox read adapter (grep-verified during the D#15249 STEP_BACK). A2A herd-window clean.
Origin Session ID: b42c5667-db78-4a0c-83a0-ce66c95ee0d9 Retrieval Hint: "fleet mailbox read adapter viewer admission CAN_READ_INBOX_OF S1"