Member, not owner: what a trusted account can do, in one table, and enforced so nobody takes over by accident #673

Owner, 2026-10-05: "jmoran and takea can be trusted, but what does trusted mean? I still don't want any of them to be able to take over, if that makes sense. Even by accident."

Today an account that may run things on this forge can, in effect, do anything the forge can: its runs fall back to the forge's own model credential, and its apps and checks run as plain child processes of the forge. So 'trusted' currently means 'trusted with the keys'. It must mean something much smaller.

Outcome. Three plain roles, shown and enforced: guest (a fresh account: read what is public, comment, follow, report), member (someone the owner trusts to build: own repos, apps and a crew, inside a sandbox, inside their own budget and quotas), admin (administers the forge; a separate account from the owner's everyday one). A member cannot take over, by intent or by accident.

Acceptance.

• [ ] one table in docs and on a page (/settings/people or the account page) saying what each role can do; the owner promotes guest → member in one action, with a starter allowance he chooses (default none)
• [ ] a member's code (apps, previews, checks, crew shells) cannot read the forge's data directory, its secret key, its environment, other accounts' repos or apps, or the cluster; has CPU, memory, disk and time limits; has no network beyond what its app declares (builds on #658)
• [ ] a member's runs never use the forge's own credential: they use the member's subscription or a capped allowance the owner granted, with a hard stop at the cap (builds on #656)
• [ ] a member cannot change forge-level settings, other accounts, the crew's standing instructions, or releases; cannot mint a token wider than their own things
• [ ] the outsider suite gains a 'member' actor that attempts each takeover path (read forge data from an app, a check and a crew shell; spend the forge credential; widen a token; touch another account's repo) and proves each is refused; it runs in the gate and after every release
• [ ] done means reachable: the page, an MCP read of 'what can I do here as me', the tests, a look

Until this ships the emergency database guards stay (only accounts the owner vouched for may own repos or have runs), and the owner has been told that vouching today means full trust.

Parked by the crew: the check failed ("make it yours > refused, by the action and the API: an agent, an unverified account, a suspended one, a stranger to a private repository, a stranger to a public repository's private app, and the owner") and the decider saw no point in another try (pull #2259 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Parked by the crew: the check failed ("previews of idle pulls sleep > a pull touched an hour ago keeps its preview; one idle past the age loses its process, and its page says so") and the decider saw no point in another try (pull #2273 closed).

Parked twice since a person last spoke here, so it is the planner's now. Every reason:

1. the check failed ("make it yours > refused, by the action and the API: an agent, an unverified account, a suspended one, a stranger to a private repository, a stranger to a public repository's private app, and the owner") and the decider saw no point in another try (pull #2259 closed)
2. the check failed ("previews of idle pulls sleep > a pull touched an hour ago keeps its preview; one idle past the age loses its process, and its page says so") and the decider saw no point in another try (pull #2273 closed)

The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.

Split into #2301 (roles and the one table, with promotion and no enforcement), #2302 (a guest cannot own or run, with older refusals keeping their reasons), #2303 (a member cannot touch forge settings, other accounts, the crew's instructions or releases, nor widen a token), #2304 (the MCP and the account page answer 'what can I do here as me') and #2305 (the outsider suite's member actor). The fresh issues differ from the two red tries in two ways. First, the table lands without enforcement, so make-it-yours keeps its refusal order. Second, enforcement comes later and is checked after the older refusals; pull #2273 found that ordering bug. The sandbox and budget items were already done in #658 and #1145. #663 now waits on #2305.