GV Team Assistant · Full system spec · committed 4ff1acf
“I don’t know. From what I can tell, Ben and Cara — maybe Eve — would know this. I’d need to talk to them to get the detail. Should I?” — the moment every other CRM, dashboard, and agent product guesses through. This one asks, with consent, vets the answer with the human, returns it with provenance, and never asks twice.
Mobile digest of the 8,263-line spec suite in docs/spec/ — 7 documents, 6 research files, 5 preserved source docs, 80 evidence-gated proof items.
Violating one means building the wrong thing. Every doc references them by ID.
Everything speaks the Control API (/api/v1, REST + WebSocket, OpenAPI published). Hard rule: no GUI-only actions — if it can only be clicked, the harness can’t test it.
Per-user Claude Agent SDK runtime (query() + Postgres SessionStore, Opus orchestrator + Sonnet/Haiku search subagents), connector layer with per-user OAuth from a KMS-encrypted vault, org-graph engine, federation broker, notification engine, PreToolUse governance gate, full audit trail.
Canonical surface: chat with provenance panel, the vetting screen, inbox, org-graph explorer, settings — plus the /admin control plane: ask-lifecycle inspector, notification outbox, sim-clock control, audit browser, test-run trigger.
Connectors, chat surface, notifier, clock, and model each have a live and a fixture backend — switchable per proof item (mock / live). This is what makes the product self-testable.
V1 runs both assistants inside one service as a governed internal state machine, kept mappable to A2A v1.0 (Linux Foundation) so external federation is a later adapter, not a rewrite.
| Surface | Carries |
|---|---|
| SUR-SLACK | Primary ambient surface (~80% of use). Native streaming (chat.startStream), /ask, message shortcut, App Home, Block Kit asked-flow cards. |
| SUR-WEB | Canonical app + control plane. Everything works here, always. |
| SUR-DESKTOP | Tauri: menubar/tray, global hotkey quick-ask, native notifications. |
| SUR-MOBILE | Capacitor: push, the 30-second approve-and-go card, share-sheet, voice. |
| SUR-EXT | Chrome side panel: ask-about-this-page, highlight-to-ask, pending-ask badge, quick approve. |
| SUR-EMAIL | Universal fallback; reaches the not-yet-onboarded. |
Notifications are the hinge: asymmetric urgency, batch-by-default, an “earn the interrupt” budget, timezone-aware outbound holds, every notification actionable inline. Any mute = design failure.
Every transition is an audit event; the harness asserts on these states, never on prose.
A fully seeded fictional org. Each gap’s answer exists in exactly one person’s private world — so honest-IDK, routing, consent, vetting, and write-back are all objectively checkable. TEST_MODE persona auth (compiled out of prod builds) lets one harness be each person.
| Persona | Role | In the tests |
|---|---|---|
| ava | Founder/CEO | The asker; can’t see engineering privates |
| ben | Backend, owns auth/ | Primary asked persona; holds GAP-1 & GAP-5 |
| cara | Frontend, co-deployer | Wrong-domain decoy: newer commits, ui/ only |
| dan | Advisor | Stale-historical decoy: heavy core/, 14 months quiet |
| eve | PM/ops | Holds GAP-2; write-back reuse asker |
| finn | Sales · Sydney | Holds GAP-3; quiet-hours hold target |
#meridian-private; flagged uncertainty “is seed_staging.sh current?”; then eve gets it instantly from write-back.make sim-up && make sim-seed → docker-compose full stack, fixture connectors, simulated clock, Playwright with one browser context per persona, API-driver suites. Runs on Cloud Build; blocks merge.
A Claude session using the Claude-in-Chrome tools executes scripted scenarios (SCN-*, covering S0–S7 and beyond) as each persona — real clicks, screenshots, network and console capture — then fills the proof checklist. It also runs the UXE-* experiments: asked-flow framing, friction placement, notification timing, staged side-by-side for human judgment — the harness never scores feelings.
Every run writes testing/evidence/<run-id>/ (RESULTS.md, shots, HAR, console, DB snapshots) and mirrors into test_runs/test_results. A checkbox flips only from a run. Failures stay unchecked as BLOCKED — never reclassified.
All FULL-SPEC PART G IDs preserved for-ID and extended. Each item declares mode (mock/live), numbered steps, objective pass criteria, named evidence.
#meridian-private content — only the vetted answer. String-absence probe end-to-end.
Evidence: per-step screenshots + HAR + audit query in testing/evidence/<run>/
org_graph_query with evidence + recency, metadata/content boundary. Gate: P1-*.chat.startStream/appendStream, higher rate tier) + new agent_view AI-app surface supersede the old placeholder-and-update pattern. 3-second ack rules unchanged.query() with resume + a Postgres SessionStore adapter. Per-user memory = in-process MCP tool over Postgres (memory tool is Messages-API level, not an SDK built-in).