changelog.d/5260-agent-data-producers-owner-only.md

Rama main · réplica de lectura del repositorio original.

- **Only a page's owner lets agents push its data, by any route (#5260).** Naming `agent/<slug>` as a panel's producer and granting a crew `produce` are now owner-only, like an agent `produce` grant. A workspace admin, an Edit grantee or an agent that saves a spec newly naming an agent producer gets 403. An edit that keeps a panel's producer unchanged is still allowed. A crew `produce` grant from anyone but the owner gets 403 (CLI exit 4), and the Access form offers non-owners only `read` and `write` for a crew. Migration `20261109152536_agent_data_delegation_owner_only` reads who designated each stored agent producer from the page's version history and ends every agent producer designation and crew `produce` grant the owner did not make. Designations and grants also end when the page changes owner, the designator leaves the owning crew, or the owning crew is deleted or moves workspace. Each ending writes an audit entry, `page.agent_producer.retired_not_owner` or `page.agent_grant.retired_not_owner`. A panel whose agent producer ended reads "Producer not authorized by the owner", names the agent and says only the owner can authorize it; the grants list shows the reason for a crew grant. Nothing revives them implicitly, including saving the page again with the same producer. The owner authorizes the producer explicitly with the panel's **Authorize producer** button, `crewship page authorize-producer <page> <panel>` or `POST /api/v1/pages/{slug}/panels/{panelId}/producer/authorize` (audited as `page.agent_producer.authorized`; anyone else gets 403), or grants the agent `produce`, or points the panel at another producer. A person importing a bundle they own keeps its agent producers live; an import naming a crew the importer is not in, an import by an agent, and a page an agent saves for its own crew are stored with their agent producers ended. A designator the version history no longer shows (trimmed history, agent-authored versions) counts as nobody. A page an agent creates for its own crew has no human owner behind its agent producers, so they push only once a member of the crew grants the agent `produce`.