chore: keep widget sources only

2026-09-17 23:29:09 +03:00
commit e0404617d2
125 changed files with 8935 additions and 0 deletions
@@ -0,0 +1,26 @@
+---
+name: shd-organizations-acl
+description: Use when the user asks to inspect or change SHD organizations, members, invitations, roles, access audits or two-factor policies.
+---
+
+# SHD organizations and ACL
+
+See `references/organization-acl.md` for identity resolution and mutation
+boundaries.
+
+## Inspect
+
+- Resolve the canonical organization ID; never use a guessed name as a write
+  target.
+- Read members, invitations, audit entries and the current two-factor policy
+  before explaining access.
+- Report organization, user, role, invitation state and policy as separate
+  facts. A denied or incomplete list is not proof that a member is absent.
+
+## Change access
+
+Inviting, adding, updating or removing a member, changing a two-factor policy,
+or creating, archiving or restoring an organization requires explicit intent.
+Show the exact organization and user scope before the mutation. Preserve server
+authorization, conflict checks and audit readback; never broaden access to
+make a failed request succeed.
@@ -0,0 +1,5 @@
+interface:
+  display_name: "SHD organizations and ACL"
+  short_description: "Audit members, roles and access policies"
+policy:
+  allow_implicit_invocation: false
@@ -0,0 +1,13 @@
+# Organization and ACL contract
+
+Read with `shd_list_organization_members`, `shd_list_organization_invitations`,
+`shd_list_organization_audit` and
+`shd_get_organization_two_factor_policy`. Resolve users and organizations from
+server-returned IDs.
+
+Mutations include invitation operations, member add/update/remove,
+organization create/update/archive/restore and
+`shd_update_organization_two_factor_policy`. Every mutation needs explicit
+authorization, the latest relevant state, and final server/audit readback when
+available. Do not disclose invitation secrets or use an email/name match as a
+substitute for a returned user identity.