# Owner-private agent UX

This spec defines the user-facing contract for private agents after the runtime model converges on parent conversations plus hidden owner-private context.

## 1. User-visible surfaces

Users work in the same surfaces they already understand:

- channel scopes;
- reply thread scopes;
- DMs;
- task-native discussion, checkpoint, artifact, and review surfaces.

Owner-private execution context is not a separate chat surface. It is hidden state that lets a user's private agents receive relevant parent-context deliveries and act within the user's authorized context.

The UI must not ask users or agents to choose, copy, or remember a private execution target. When a private agent is addressed from a channel or thread, the visible target remains that channel or thread.

## 2. Private agents in shared conversations

A private agent can be available to its owner in a parent channel/thread without becoming a parent participant.

- The owner can mention a private agent from a parent conversation when the channel entry allows it.
- The private agent receives a parent-target wake with hidden owner-private context.
- If the private agent responds, the response is written to the parent conversation and is visible to the same audience as other parent messages.
- Public agents continue to behave as ordinary parent participants.

## 3. Context visibility boundary

Private agents do not automatically receive the full raw parent conversation. Their effective context is the owner-private context view:

1. parent rows visible under the owner-private filter;
2. messages authored by the owner, by an active private grant grantee, or by an active People collaborator within the grant/collaborator's effective source scope;
3. explicit source items that the owner or an authorized workflow shared into the context.

This boundary is intentionally narrower than "all parent participants" and broader than "only messages that mention the private agent." Direct mentions and controlled wake choose when the private agent runs; they must not be the only way the agent's context can include owner-authored or owner-authorized rows. Conversely, private context must not expose unrelated non-owner rows, different-owner private-agent output, or collaborator rows outside the effective grant chain. Same-owner private agents can see each other's output only inside the same owner-private collaboration scope. For reply threads, the visible context is the thread's filtered history plus parent references; channel-level owner grants and People collaborators can authorize thread rows, but sibling thread grants do not leak across.

Reply-thread access is anchored on the root parent message. A private agent may enter or operate on a reply thread only when the root parent message is visible to the current owner-private context.

## 4. Starting a thread for a private-agent mention

When a user asks to start a reply thread while mentioning a private agent:

- the user-authored parent message is stored in the parent channel timeline;
- the reply thread is opened for that parent message;
- the private-agent delivery is targeted at the new parent reply thread;
- the agent prompt and MCP default target show the parent thread target.

The parent channel does not receive a separate hidden transcript or copied message.

## 5. Explicit source sharing

Sharing context to private agents creates source facts for the hidden context view. A source fact keeps attribution and snapshot information so the private agent can use that material without creating a second chat row.

The UI may show source previews and jump-back affordances where useful, but those previews are context/source items, not a separate conversation timeline and not duplicate parent messages.

## 6. Tasks remain task-native

When work becomes durable, reviewable, or multi-step, the user-facing mainline is a Task. Task discussion, checkpoints, artifacts, review context, and status remain task-native surfaces. They are not rewritten as parent chat rows and do not expose hidden owner-private context ids.

## 7. Removed UX

The product no longer exposes:

- a separate private-agent transcript panel or composer;
- a manual gate for moving private-agent output into the parent conversation;
- a per-user parent-history filter for private-agent output;
- provider-watch or MCP controls that expose hidden owner-private context IDs.

Private-agent output is ordinary parent output. Parent conversation readers see it through normal parent history, search, reaction, attachment, and review affordances.

## 8. Naming

User-facing copy should describe concrete surfaces and visibility:

- use channel, thread, DM, task, private agent, and owner context where those words describe visible behavior;
- do not expose storage/runtime identifiers;
- do not suggest a separate transcript, separate target, or delayed transfer step.