Every ticket as the root of its provenance graph — goal, patch, approval, runs and (as the ticket-class build lands) mandate, manifestations, guarantees, journey, artifacts and children. Rendered through the <<<TicketGraphList>>> tag.
Design how local agents get tools ONLY from MCP servers (no arbitrary shell/file access) — the least-privilege model requested. Inventory the tools agents need (ticket API read/write, file read/write, git, run-tests) and which MCP servers expose them or must be built. Design DISPATCH as strictly least-privilege: it may ONLY {ticket.queue, ticket.kind, ticket.assign, edge.record, ticket.progress} — NO code/file/shell. Determine the ENFORCEMENT point (per-role MCP allowlist) and contrast with pair_loop's current allowedTools approach. OUTPUT: a role->MCP-tool matrix + the enforcement mechanism. Spawns two build tickets.
patch
none
approval
unapproved
runs
no runs recorded
mandate (clauses)
not yet recorded — lands with the ticket-class build
manifestations
not yet recorded — lands with the ticket-class build
guarantees
not yet recorded — lands with the ticket-class build
journey (blunders & successes)
not yet recorded — lands with the ticket-class build
artifacts (forge)
not yet recorded — lands with the ticket-class build