agent-exec-transport
e7b345e127
Why: After the role-authority cutover a role could only carry the single project.create boolean, so every project-scope action resolved as undefined and project conversations plus member collaboration were rejected. Owner product intent: a role carries one project-management toggle, and holding it grants the in-project defaults (read, write, members, traces, stage, archive, audit); three-duty and knowledge publishing stay duty-gated. Evidence: go test ./internal/store ./internal/app ./internal/server -count=1 passes; TestRoleCarriesProjectScopeDefaults covers the write, the snapshot projection and the unchanged invariant that a role enabling project.create may not deny a linked management action. The agent-exec transport diff is identical to the owner-accepted revision deployed on imc-tx-ecs (binary 941f8eef). Impact: ReplaceRolePermissions accepts project-scope actions while protected system actions stay refused, RolePermissions projects project-scope rows plus the project-management implied defaults into the role policy snapshot, and an explicit capability-association gate runs before each write. Refs: feature/role-project-scope-permissions