ChatWell Gen-5 System atlas
P1

Workspaces

OWNERSHIP AND MEMBERSHIP·two separate facts about one workspace
WHAT IS STORED, AND WHAT IS NOT
Stored role
admin · member
Every member holds one of two roles: member or admin.
WS-ROLE-1
Ownership
a separate fact
Ownership is not a membership role.
WS-OWN-2
Owner's own role
reads admin
The owner is also a member.
WS-OWN-3
Project ownership
derived
The owner of a workspace owns every project in it.
WS-OWN-4XD-DER-1
THE OWNER'S STANDING MEMBERSHIP · ownership causes it, and is not it
Workspace OwnercausesActive project
membership, with the admin role — nobody grants it
PJ-ACC-6
Workspace Ownerno such relationMembership in an archived project
outside the guarantee; archiving ends it with everyone else's. What the owner still reaches there, outside tasks, is PJ-ARCH-5.
PJ-ACC-9PJ-ARCH-5
Workspace Ownerno such relationA project's tasks, without membership
ownership is never a way past membership
PJ-ACC-2
GETTING A WORKSPACE · two routes, and only one of them has gates
Personal Workspace
The account is created
no gate · nothing can withhold it
Personal Workspace
Every account gets one when it signs up — always, with nothing to qualify for.
WS-KIND-1
Any further workspace, during beta
A person asks to create one
1Account authorized to create an additional workspaceWS-KIND-3
2The particular template is permitted to that accountWS-KIND-3
and where it appliesWhere a template sets a limit on how many workspaces it may produce, that limit applies on top of both — being authorized never overrides it.WS-KIND-3
A user-created workspace
Creating any further workspace takes two separate permissions.
WS-KIND-3WS-KIND-6
Today
Today both permissions are arranged by ChatWell's operators, one account at a time.WS-KIND-6
Workspace templates are not offered to everyone.WS-KIND-7

Derived from the published System Guide. Every row cites the claim groups it renders, and every rule on it is quoted from one of them.

ShowFiltering hides nothing permanently; everything is present in the page.

You are in: Workspaces. This assumes only the core model (T1).

P1.1What a workspace isPermalink

WS-WHAT-1A workspace is the container that holds projects — and, through them, tasks — and that people take part in as members.

Gen-5 describes it as the scope in which obligations were incurred: the place where work was assigned, reviewed and approved.

There are two kinds, and they are genuinely different.

Why is this true?
ClaimWS-WHAT-1
CoversWhat a workspace is
StateWorks today
CoverageFulla fact about the sources, not a reader label
SourcesWorkspace & project lifecycle modelMembership modelAccepted Gen-5 implementation
Exact identity
ChatWellApp/chatwell-docs · architecture/workspace-lifecycle-model.md@cbab557b1b2fcanonical
§2.2 ('the scope in which obligations were incurred'); §4 containment
lines 86-89, 215-216
documentMembership modelD-MEM
ChatWellApp/chatwell-docs · architecture/membership-episodes-model.md@cbab557b1b2fcanonical
§3 Project-access policy ('Workspace membership never grants project access by itself.')
lines 251
migration-chainAccepted Gen-5 implementationB-MIG
ChatWellApp/chatwell-supabase · supabase/migrations/@3bf502a701e5
1of4 create table public.workspace
lines 813-819
WS-KIND-1Personal WorkspaceEvery account gets one when it signs up — always, with nothing to qualify for.

It is the baseline container every account starts from, and nothing that governs creating any other workspace can withhold it: not whether the account may create another, not permission for a template, not whether a template is on offer, not any limit. The account owns its Personal Workspace, and that ownership stays bound to the account for as long as the account exists: it cannot be handed to anyone else.

Why is this true?
ClaimWS-KIND-1
CoversPersonal Workspace, unconditional
StateWorks today
CoverageFulla fact about the sources, not a reader label
SourcesBeta workspace creation decisionDefault template contractWorkspace templates runbookAccepted runtime evidence (R1–R4)Gen-5 lifecycle decisionsWorkspace & project lifecycle modelAccepted Gen-5 implementation
Exact identity
ChatWellApp/chatwell-docs · decisions/ADR-2026-09-beta-workspace-creation.md@cbab557b1b2fadopted
G5-WC-01 — every account receives its Personal Workspace; independent of grants, creation eligibility, catalog availability and visibility, beta authorization and instance limits; the guarantee is fenced but does not promise signup cannot fail
lines 84-99
ChatWellApp/chatwell-docs · product/default-template-contract.md@cbab557b1b2fcanonical
§1.1 Provisioning guarantee — every account receives it, unconditionally (LOCKED — A4, G5-WC-01); independent of grants, creation eligibility, catalog availability and visibility, beta authorization and instance limits
lines 209
ChatWellApp/chatwell-docs · runbooks/workspace-templates.md@cbab557b1b2fcanonical
§2.0 — 'The Personal Workspace is outside this gate entirely.'
lines 52
ChatWellApp/chatwell-supabase · supabase/operator-runbooks/verify_gen5_r1r4_conformance.sql@3bf502a701e5
R4-1 Personal Workspace provisioned with ZERO grants — captured before any grant was written

Runtime evidence is never an authority of its own. An accepted document says the same thing first; the evidence says only that the running system agrees.

ChatWellApp/chatwell-docs · decisions/ADR-2026-08-gen5-lifecycle-domain.md@cbab557b1b2fadopted
G5-04 table — Created / Ownership / Transfer
lines 334-336
ChatWellApp/chatwell-docs · architecture/workspace-lifecycle-model.md@cbab557b1b2fcanonical
§6.5 Personal workspace — governance is fixed
lines 710
migration-chainAccepted Gen-5 implementationB-MIG
ChatWellApp/chatwell-supabase · supabase/migrations/@3bf502a701e5
20260904234359 public.handle_new_auth_user (last definition) — personal workspace provisioning; 2of4 trg_prevent_personal_workspace_owner_change
lines 431-446; 8451-8453
WS-KIND-5"Free" is a way of describing the Personal Workspace, not a setting in the system.

ChatWell has no plan, tier, price or subscription behind it. The rule is simply that every account gets one.

Why is this true?
ClaimWS-KIND-5
Covers"Free" is positioning, not a setting
StateWorks today
CoverageFulla fact about the sources, not a reader label
SourcesBeta workspace creation decisionDefault template contractAccepted Gen-5 implementation
Exact identity
ChatWellApp/chatwell-docs · decisions/ADR-2026-09-beta-workspace-creation.md@cbab557b1b2fadopted
G5-WC-01 Pricing and billing boundary — 'free' is positioning only; no plan, price, billing tier, entitlement tier or subscription; template-evolution.md §8's free|paid is not adopted
lines 110-121
ChatWellApp/chatwell-docs · product/default-template-contract.md@cbab557b1b2fcanonical
§1.1 Positioning, not pricing (LOCKED — A4) — free is positioning only; no plan, price, billing tier, entitlement tier or subscription; §1.1 Provisioning guarantee
lines 212-218; 209
migration-chainAccepted Gen-5 implementationB-MIG
ChatWellApp/chatwell-supabase · supabase/migrations/@3bf502a701e5
no plan, tier, price, subscription or entitlement object exists anywhere in the chain
WS-KIND-4Other people can be invited into a Personal Workspace.Partly defined

Accepting adds them to the workspace and to no project — the same rule that holds everywhere (P2.2). Its owner has that workspace's main project because the account's own setup gave it to them, not because joining a workspace hands anyone a project. Only the owner can give someone else access to that project. Partly defined.

Why is this true?
ClaimWS-KIND-4
CoversOthers in a Personal Workspace
StateWorks today
CoveragePartly defineda fact about the sources, not a reader label
SourcesProject access policy decisionMembership modelAccepted Gen-5 implementationWorkspace & project lifecycle model
Exact identity
ChatWellApp/chatwell-docs · decisions/ADR-2026-09-project-access-policy.md@cbab557b1b2fadopted
G5-PA-02 Personal Workspace — the owner receives the Personal project through provisioning; another admin or member does not, and needs an explicit project-level grant
lines 189-193
documentMembership modelD-MEM
ChatWellApp/chatwell-docs · architecture/membership-episodes-model.md@cbab557b1b2fcanonical
§3 Project-access policy — G5-PA-02 at the project layer; Personal Workspace provisioning is distinct from ordinary workspace invitation
lines 374-380
migration-chainAccepted Gen-5 implementationB-MIG
ChatWellApp/chatwell-supabase · supabase/migrations/@3bf502a701e5
2of4 public.accept_workspace_invitation — invitees to a personal workspace were never added to its default project; 20260911101829 removes the fan-out for every other type too; 20260905202219 public.add_project_member — PERSONAL_PROJECT_OWNER_ONLY
lines 6973-6979; 10-36; 1634-1637
ChatWellApp/chatwell-docs · architecture/workspace-lifecycle-model.md@cbab557b1b2fcanonical
§6.5 Personal workspace — other users may hold Project Admin or Project Member
lines 712
documentMembership modelD-MEM
ChatWellApp/chatwell-docs · architecture/membership-episodes-model.md@cbab557b1b2fcanonical
§3 Project-access policy — Default Personal Workspace: explicit project membership only
lines 256
WS-KIND-2User-created workspaceCreated by a person, who becomes its owner.
Why is this true?
ClaimWS-KIND-2
CoversUser-created workspace
StateWorks today
CoverageFulla fact about the sources, not a reader label
SourcesGen-5 lifecycle decisionsAccepted Gen-5 implementation
Exact identity
ChatWellApp/chatwell-docs · decisions/ADR-2026-08-gen5-lifecycle-domain.md@cbab557b1b2fadopted
G5-04 table — Created: by a member action
lines 334
migration-chainAccepted Gen-5 implementationB-MIG
ChatWellApp/chatwell-supabase · supabase/migrations/@3bf502a701e5
2of4 public.create_workspace_from_template — user_created insert, ownership episode
lines 7649-7660
WS-KIND-3Creating any further workspace takes two separate permissions.

During the current beta an account needs both: it must be authorized to create an additional workspace at all, and the particular template it wants to create from must be permitted to it. Neither substitutes for the other — being allowed to create one is not permission for a given template, and permission for a template is not authorization of the account. Where a template sets a limit on how many workspaces it may produce, that limit applies on top of both — being authorized never overrides it.

Why is this true?
ClaimWS-KIND-3
CoversA further workspace takes two permissions
StateWorks today
CoverageFulla fact about the sources, not a reader label
SourcesBeta workspace creation decisionWorkspace templates runbookAccepted Gen-5 implementationAccepted runtime evidence (R1–R4)
Exact identity
ChatWellApp/chatwell-docs · decisions/ADR-2026-09-beta-workspace-creation.md@cbab557b1b2fadopted
G5-WC-02 — an additional Workspace during beta requires BOTH account authorization (A) and template permission (B); 'These are two conditions, not one'; limits are unaffected and apply on top
lines 123-152
ChatWellApp/chatwell-docs · runbooks/workspace-templates.md@cbab557b1b2fcanonical
§2.0 What a grant authorizes during beta — conditions A and B, and that authorization never bypasses instance limits
lines 39-52
ChatWellApp/chatwell-docs · runbooks/workspace-templates.md@cbab557b1b2fcanonical
§3.7 Set / change / clear instance limits — per-slug provisioning caps, applied after visibility and grant
lines 319-321
migration-chainAccepted Gen-5 implementationB-MIG
ChatWellApp/chatwell-supabase · supabase/migrations/@3bf502a701e5
2of4 public.create_workspace_from_template step 4 — template must be accessible, then instance limits; 4of4 template seed (4 restricted, 1 disabled) and no template grants
lines 7577-7594; 96-97, 225, 236-240
ChatWellApp/chatwell-supabase · supabase/operator-runbooks/verify_gen5_r1r4_conformance.sql@3bf502a701e5
R4-5 authenticated has no INSERT on workspace; R4-6 create_workspace / _v2 absent — the gated function is the only path

Runtime evidence is never an authority of its own. An accepted document says the same thing first; the evidence says only that the running system agrees.

WS-KIND-6Today both permissions are arranged by ChatWell's operators, one account at a time.

There is no screen in the product for asking for them or granting them, and no account gives them to itself. Until an operator acts, an account has its Personal Workspace and cannot create another.

Why is this true?
ClaimWS-KIND-6
CoversOperator-conferred, no product screen
StateWorks today
CoverageFulla fact about the sources, not a reader label
SourcesBeta workspace creation decisionWorkspace templates runbookAccepted Gen-5 implementationAccepted runtime evidence (R1–R4)
Exact identity
ChatWellApp/chatwell-docs · decisions/ADR-2026-09-beta-workspace-creation.md@cbab557b1b2fadopted
G5-WC-02 Beta administration is the operator / direct-SQL channel — no application-level admin UI is required, planned, implied or promised; nothing creates self-service creation eligibility
lines 154-164
ChatWellApp/chatwell-docs · decisions/ADR-2026-09-beta-workspace-creation.md@cbab557b1b2fadopted
Runtime conformance — zero seeded grants, so on a freshly built Gen-5 database no account can create any additional Workspace until an operator writes a grant
lines 194-198
ChatWellApp/chatwell-docs · runbooks/workspace-templates.md@cbab557b1b2fcanonical
§1 Concepts — there is no in-app authorization surface for template writes; §3.4 the operator grant recipe
lines 15; 196-246
migration-chainAccepted Gen-5 implementationB-MIG
ChatWellApp/chatwell-supabase · supabase/migrations/@3bf502a701e5
4of4 seed — zero workspace_template_grant rows and zero limit rows
lines 225, 236-240
ChatWellApp/chatwell-supabase · supabase/operator-runbooks/verify_gen5_r1r4_conformance.sql@3bf502a701e5
R4-5 authenticated has no INSERT on workspace; R4-6 create_workspace / _v2 absent — the gated function is the only path

Runtime evidence is never an authority of its own. An accepted document says the same thing first; the evidence says only that the running system agrees.

WS-KIND-7Workspace templates are not offered to everyone.

Every template in use is permitted account by account: an operator names who may create from it. A template can also be retired, after which nobody can create from it. No template is open to everyone, and none is at this stage of the product.

Why is this true?
ClaimWS-KIND-7
CoversTemplate availability today
StateWorks today
CoverageFulla fact about the sources, not a reader label
SourcesWorkspace templates runbookBeta workspace creation decisionAccepted Gen-5 implementationAccepted runtime evidence (R1–R4)
Exact identity
ChatWellApp/chatwell-docs · runbooks/workspace-templates.md@cbab557b1b2fcanonical
§2.1 Visibility values — public Reserved, no template should be public at the current product stage; restricted default for beta; disabled retires a version
lines 54-64
ChatWellApp/chatwell-docs · decisions/ADR-2026-09-beta-workspace-creation.md@cbab557b1b2fadopted
G5-WC-02 Public templates — public remains reserved, none is public, and the grant-predicate observation is recorded as OPTIONAL future defence-in-depth hardening, not a requirement and not scheduled
lines 166-178
migration-chainAccepted Gen-5 implementationB-MIG
ChatWellApp/chatwell-supabase · supabase/migrations/@3bf502a701e5
4of4 template seed — four restricted, one disabled, zero public
lines 96-97, 225
ChatWellApp/chatwell-supabase · supabase/operator-runbooks/verify_gen5_r1r4_conformance.sql@3bf502a701e5
R4-2 zero PUBLIC templates

Runtime evidence is never an authority of its own. An accepted document says the same thing first; the evidence says only that the running system agrees.

WS-START-1A new workspace does not start empty.Partly defined

A workspace someone creates begins with a main project and a chat for it, and its creator is in that project. Partly defined: the main project is established; the rest of the starting structure comes from the template it was created from, whose wider definition is not settled. A Personal Workspace comes from no template — its starting structure arrives with the account.

Why is this true?
ClaimWS-START-1
CoversStarting structure
StateWorks today
CoveragePartly defineda fact about the sources, not a reader label
SourcesMembership modelDefault template contractAccepted Gen-5 implementation
Exact identity
documentMembership modelD-MEM
ChatWellApp/chatwell-docs · architecture/membership-episodes-model.md@cbab557b1b2fcanonical
§3 operation matrix — personal workspace provisioning / create workspace (P for the seeded default project)
lines 188, 194
ChatWellApp/chatwell-docs · product/default-template-contract.md@cbab557b1b2fcanonical
front note — P-1 amendment pending; do not treat either outcome as settled
lines 10-12
migration-chainAccepted Gen-5 implementationB-MIG
ChatWellApp/chatwell-supabase · supabase/migrations/@3bf502a701e5
2of4 public.create_workspace_from_template — main project, creator membership, default channel; 20260904234359 handle_new_auth_user — default project
lines 7674-7695; 466-473
WS-LIM-1Not decided. How many workspaces an account may end up with, how they are counted, and whether any limit attaches to the account at all rather than to the template it created from.Not decided
Why is this true?
ClaimWS-LIM-1
CoversHow many workspaces
StateNot decided
CoverageGapa fact about the sources, not a reader label
SourcesDecision IndexBeta workspace creation decision
Exact identity
documentDecision IndexD-IDX
ChatWellApp/chatwell-docs · decisions/index.md@cbab557b1b2fcanonical
Open questions — P-1: do the dev-only workspace-limits changes amend the Default template contract, or does the contract stand as written? status: proposed
lines 62
ChatWellApp/chatwell-docs · decisions/ADR-2026-09-beta-workspace-creation.md@cbab557b1b2fadopted
G5-WC-02 Limits are unaffected — authorization does not bypass accepted template instance limits; limit cardinality and counting semantics are untouched and P-1 is not resolved here
lines 148-152
WS-LIFE-1ChatWell offers no way to delete a workspace.

In the product a workspace is either active or archived; there is no deleted state. The normal Workspace lifecycle uses archival rather than physical deletion of its business history. No one can archive a workspace today.

Why is this true?
ClaimWS-LIFE-1
CoversNo deletion; archival ends the lifecycle
StateWorks today
CoverageFulla fact about the sources, not a reader label
SourcesWorkspace & project lifecycle modelGen-5 lifecycle decisionsAccepted Gen-5 implementation
Exact identity
ChatWellApp/chatwell-docs · architecture/workspace-lifecycle-model.md@cbab557b1b2fcanonical
§1 Workspace status
lines 31-37
ChatWellApp/chatwell-docs · decisions/ADR-2026-08-gen5-lifecycle-domain.md@cbab557b1b2fadopted
G5-04 table — independent deletion not permitted; deletion is not in the lifecycle
lines 337
migration-chainAccepted Gen-5 implementationB-MIG
ChatWellApp/chatwell-supabase · supabase/migrations/@3bf502a701e5
1of4 type public.workspace_status (active, archived); 3of4 SECTION 6 no DELETE grant; 3of4 the only archiving writer (the scheduled closure executor) is granted to service_role only, and nothing in the chain creates a pending closure
lines 297-301; 1299-1302; 746

P1.2OwnershipPermalink

WS-OWN-1Every workspace has exactly one owner, at every moment.

There is never an ownerless workspace.

Why is this true?
ClaimWS-OWN-1
CoversExactly one owner
StateWorks today
CoverageFulla fact about the sources, not a reader label
SourcesWorkspace & project lifecycle modelAccepted Gen-5 implementation
Exact identity
ChatWellApp/chatwell-docs · architecture/workspace-lifecycle-model.md@cbab557b1b2fcanonical
§6.2 The ownership lifecycle is closed
lines 475-479
migration-chainAccepted Gen-5 implementationB-MIG
ChatWellApp/chatwell-supabase · supabase/migrations/@3bf502a701e5
1of4 unique index ux_woe_one_open
lines 1824-1826
WS-OWN-2Ownership is not a membership role.

A member's stored role is member or admin — never "owner". Who owns a workspace is recorded separately, and ChatWell states it for each workspace as a separate fact.

Why is this true?
ClaimWS-OWN-2
CoversOwnership is not a role
StateWorks today
CoverageFulla fact about the sources, not a reader label
SourcesWorkspace & project lifecycle modelAccepted Gen-5 implementation
Exact identity
ChatWellApp/chatwell-docs · architecture/workspace-lifecycle-model.md@cbab557b1b2fcanonical
§6.3a Stored role values — the complete set; gating compares effective authority
lines 538-547, 571
migration-chainAccepted Gen-5 implementationB-MIG
ChatWellApp/chatwell-supabase · supabase/migrations/@3bf502a701e5
1of4 type public.workspace_role and header; 2of4 public.bootstrap_account — is_owner stated per workspace
lines 289-291; 5761-5766
WS-OWN-3The owner is also a member.Partly defined

Whoever creates a workspace becomes its owner and is also recorded as a member with the admin role; the same holds for the Personal Workspace set up with the account, which nobody creates. So today an owner's stored role reads admin, and the role alone can never tell you who owns the workspace. Ownership does not depend on that role. Partly defined.

Why is this true?
ClaimWS-OWN-3
CoversOwner is also an admin member
StateWorks today
CoveragePartly defineda fact about the sources, not a reader label
SourcesWorkspace & project lifecycle modelAccepted Gen-5 implementation
Exact identity
ChatWellApp/chatwell-docs · architecture/workspace-lifecycle-model.md@cbab557b1b2fcanonical
§6.3a Role changes and the event boundary ('An incoming owner keeps whatever membership role they held; their owner authority is derived, not granted.')
lines 596-597
migration-chainAccepted Gen-5 implementationB-MIG
ChatWellApp/chatwell-supabase · supabase/migrations/@3bf502a701e5
2of4 public.create_workspace_from_template step 8b (creator stored as admin); 20260904234359 handle_new_auth_user (personal workspace)
lines 7662-7671; 456-458
WS-OWN-4The owner of a workspace owns every project in it.

This project ownership is derived: it is never assigned, stored or handed over on its own, and it changes only when the workspace's owner changes — for every project at once.

Why is this true?
ClaimWS-OWN-4
CoversDerived project ownership
StateWorks today
CoverageFulla fact about the sources, not a reader label
SourcesWorkspace & project lifecycle modelAccepted Gen-5 implementation
Exact identity
ChatWellApp/chatwell-docs · architecture/workspace-lifecycle-model.md@cbab557b1b2fcanonical
§6.1 Project Owner is derived
lines 426-435
migration-chainAccepted Gen-5 implementationB-MIG
ChatWellApp/chatwell-supabase · supabase/migrations/@3bf502a701e5
1of4 type public.project_role header (no owner value)
lines 208-209
WS-OWN-7The owner is a member of every active project in their workspace, with the admin role, for as long as they can reach the workspace.

This is a standing guarantee, not something anyone grants — and it is a membership like any other, never a role called "owner". It is described in full in P2.2.

Why is this true?
ClaimWS-OWN-7
CoversOwner is an admin member of every active project
StateWorks today
CoverageFulla fact about the sources, not a reader label
Sourcesrestates PJ-ACC-6
Exact identity

This restates PJ-ACC-6. It names no source of its own; the identity lives with the groups it restates.

WS-OWN-5Ownership is never simply given up or taken away.

No action ends a person's ownership without passing it to someone else, and nobody becomes an owner automatically — not an admin, not by seniority.

Why is this true?
ClaimWS-OWN-5
CoversOwnership never simply ends
StateWorks today
CoverageFulla fact about the sources, not a reader label
SourcesWorkspace & project lifecycle modelAccepted Gen-5 implementation
Exact identity
ChatWellApp/chatwell-docs · architecture/workspace-lifecycle-model.md@cbab557b1b2fcanonical
§6.2 Ownership moves only by explicit transfer; binding rules 1-3
lines 469-473, 491-498
migration-chainAccepted Gen-5 implementationB-MIG
ChatWellApp/chatwell-supabase · supabase/migrations/@3bf502a701e5
1of4 workspace_ownership_episode header
lines 966-967
WS-OWN-6The owner cannot leave their workspace, and nobody can remove them from it.Partly defined

Partly defined.

Why is this true?
ClaimWS-OWN-6
CoversOwner cannot leave or be removed
StateWorks today
CoveragePartly defineda fact about the sources, not a reader label
SourcesAccepted Gen-5 implementation
Exact identity
migration-chainAccepted Gen-5 implementationB-MIG
ChatWellApp/chatwell-supabase · supabase/migrations/@3bf502a701e5
20260905202219 public.leave_workspace (WORKSPACE_OWNER_CANNOT_LEAVE); 20260907173509 public.remove_workspace_member (WORKSPACE_OWNER_IMMUTABLE)
lines 1461-1463; 199-208
FIG-P1-2Ownership is a separate fact from rolescurrent behaviour only
PersonAnna
PersonLeo
WorkspaceNorthstar Studio
ProjectWebsite Redesign
Relations · ownership overlay
PersonAnnarelationWorkspaceNorthstar Studio
owns it (a separate fact) and is a member with the admin role
PersonLeorelationWorkspaceNorthstar Studio
member with the member role
PersonAnnaderived — worked out, never assignedProjectWebsite Redesign
owner of every project — derived, never assigned
PersonAnnarelationProjectWebsite Redesign
member with the admin role — a standing guarantee while it is active (PJ-ACC-6)
Illustrates WS-OWN-1

P1.3MembershipPermalink

WS-MEM-1A membership is how a person belongs to a workspace.

You become a member by creating a workspace, by accepting an invitation, or — for your Personal Workspace — by creating your account. An invitation on its own is not a membership; the membership starts when the invitation is accepted.

Why is this true?
ClaimWS-MEM-1
CoversHow membership starts
StateWorks today
CoverageFulla fact about the sources, not a reader label
SourcesMembership modelAccepted Gen-5 implementation
Exact identity
documentMembership modelD-MEM
ChatWellApp/chatwell-docs · architecture/membership-episodes-model.md@cbab557b1b2fcanonical
§3 operation matrix — personal provisioning, create workspace, invite user, accept invitation
lines 188, 194, 200-201
migration-chainAccepted Gen-5 implementationB-MIG
ChatWellApp/chatwell-supabase · supabase/migrations/@3bf502a701e5
20260904234359 public.create_workspace_invitation; 2of4 public.accept_workspace_invitation
lines 147; 6851, 6889-6890
WS-MEM-2Membership comes in periods.

A period starts when someone joins and ends, with a recorded reason, when they leave or are removed. An ended period is never reopened: if the person comes back, a new period starts. A person has at most one current period in a workspace, and in a project, at a time.

Why is this true?
ClaimWS-MEM-2
CoversMembership periods
StateWorks today
CoverageFulla fact about the sources, not a reader label
SourcesMembership modelAccepted Gen-5 implementation
Exact identity
documentMembership modelD-MEM
ChatWellApp/chatwell-docs · architecture/membership-episodes-model.md@cbab557b1b2fcanonical
§1.0 What an episode IS; §3 reactivation and rejoin never reopen; §9.1 end_reason
lines 95, 209-210, 420-422, 1523-1524
migration-chainAccepted Gen-5 implementationB-MIG
ChatWellApp/chatwell-supabase · supabase/migrations/@3bf502a701e5
1of4 unique indexes ux_wme_one_open, ux_pme_one_open
lines 1805-1807, 1687-1689
WS-MEM-3Ending a membership does not erase the person.

ChatWell keeps who belonged when, and a departed person's name still shows on what they created.

Why is this true?
ClaimWS-MEM-3
CoversWho belonged when is kept
StateWorks today
CoverageFulla fact about the sources, not a reader label
SourcesMembership modelIdentity invariantsAccepted Gen-5 implementation
Exact identity
documentMembership modelD-MEM
ChatWellApp/chatwell-docs · architecture/membership-episodes-model.md@cbab557b1b2fcanonical
§5.2 Three data classes
lines 665
ChatWellApp/chatwell-docs · architecture/identity-invariants.md@cbab557b1b2fcanonical
invariant 8
lines 94-96
migration-chainAccepted Gen-5 implementationB-MIG
ChatWellApp/chatwell-supabase · supabase/migrations/@3bf502a701e5
2of4 public._c2_resolve_display_name header
lines 723
WS-MEM-4A membership alone is not enough to act.

The account must also be active, and so must the workspace.

Why is this true?
ClaimWS-MEM-4
CoversMembership is not enough to act
StateWorks today
CoverageFulla fact about the sources, not a reader label
SourcesMembership modelAccepted Gen-5 implementation
Exact identity
documentMembership modelD-MEM
ChatWellApp/chatwell-docs · architecture/membership-episodes-model.md@cbab557b1b2fcanonical
§1.0 binding definition ('Entitlement requires an OPEN episode.')
lines 56, 79-80
migration-chainAccepted Gen-5 implementationB-MIG
ChatWellApp/chatwell-supabase · supabase/migrations/@3bf502a701e5
20260905175604 public.workspace_effective_access — workspace active, account ACTIVE, open episode
lines 127-129
WS-MEM-5Leaving a workspace ends that person's project memberships in it too.

Their workspace membership stays on record with the time they left.

Why is this true?
ClaimWS-MEM-5
CoversLeaving ends project memberships
StateWorks today
CoverageFulla fact about the sources, not a reader label
SourcesMembership modelAccepted Gen-5 implementation
Exact identity
documentMembership modelD-MEM
ChatWellApp/chatwell-docs · architecture/membership-episodes-model.md@cbab557b1b2fcanonical
§3 Workspace departure closes BOTH layers
lines 438-450
migration-chainAccepted Gen-5 implementationB-MIG
ChatWellApp/chatwell-supabase · supabase/migrations/@3bf502a701e5
20260905202219 public.leave_workspace; 20260907173509 public.remove_workspace_member — cascade
lines 1500-1519; 490-505
WS-MEM-6The owner and admins can remove other members — never themselves, and never the owner.Partly defined

Removing someone who is the reviewer of an active task in an active project needs a replacement reviewer named as part of the removal: without one, the removal does not go through; with one, each affected task takes the replacement and its history records the change. Partly defined.

Why is this true?
ClaimWS-MEM-6
CoversRemoving members
StateWorks today
CoveragePartly defineda fact about the sources, not a reader label
SourcesAccepted Gen-5 implementationMembership modelTask lifecycle & assignment modelTask operation contract
Exact identity
migration-chainAccepted Gen-5 implementationB-MIG
ChatWellApp/chatwell-supabase · supabase/migrations/@3bf502a701e5
20260907173509 public.remove_workspace_member — owner or admin; not self; not the owner; Check 6 completeness (REPLACEMENT_REQUIRED without a mapping); replacement rewrites and one reviewer_changed event per affected task
lines 181-186, 199-208, 365-374, 430-465
documentMembership modelD-MEM
ChatWellApp/chatwell-docs · architecture/membership-episodes-model.md@cbab557b1b2fcanonical
§3 operation matrix — remove workspace member
lines 204
ChatWellApp/chatwell-docs · product/task-lifecycle-and-assignment-model.md@cbab557b1b2fcanonical
§3.5 Trigger — require replacement before the operation completes
lines 815-826
ChatWellApp/chatwell-docs · architecture/task-domain-rpc-contracts.md@cbab557b1b2fcanonical
§6A.1 — remove_* carry the replacement and replace atomically; missing replacement refuses the whole departure
lines 622-623, 639-641
WS-MEM-7One replacement stands for a whole project, and it must be someone who is not already doing the work.

The replacement named for a project takes over every affected task in it at once, so a person who is the assignee of any one of those tasks cannot be the replacement for that project — a task's assignee is never its reviewer (P3.4). Where no one can be named, the removal does not go through at all: nothing is half-done. This can even rule out the workspace owner, who can otherwise always be named as the replacement.

Why is this true?
ClaimWS-MEM-7
CoversOne replacement per project, never its assignee
StateWorks today
CoverageFulla fact about the sources, not a reader label
SourcesTask reviewer authority decisionTask lifecycle & assignment modelTask operation contractAccepted Gen-5 implementationAccepted runtime evidence (R1–R4)
Exact identity
ChatWellApp/chatwell-docs · decisions/ADR-2026-09-task-reviewer-authority.md@cbab557b1b2fadopted
G5-TR-02 operation table — a replacement identity must not become the reviewer of a task where it is the current assignee; replacement is one identity per project, so a candidate who is the assignee of ANY affected task is invalid for the whole project and the departure is refused all-or-nothing
lines 200
ChatWellApp/chatwell-docs · decisions/ADR-2026-09-task-reviewer-authority.md@cbab557b1b2fadopted
Consequences — 'A departure can be refused for a new reason'; the Workspace Owner fallback is unavailable for that project where the owner is that assignee
lines 438-446
ChatWellApp/chatwell-docs · product/task-lifecycle-and-assignment-model.md@cbab557b1b2fcanonical
§3.5b — the owner-is-always-a-valid-replacement note, narrowed per project by G5-TR-02; §9.1 Reviewer removal from project row, narrowed to match
lines 906-907; 1408
ChatWellApp/chatwell-docs · architecture/task-domain-rpc-contracts.md@cbab557b1b2fcanonical
§6A.1 Departure replacement — a replacement that would review its own work is invalid for that project and the whole departure is refused, under the existing all-or-nothing rule
lines 643-650
migration-chainAccepted Gen-5 implementationB-MIG
ChatWellApp/chatwell-supabase · supabase/migrations/@3bf502a701e5
20260911102134 public.remove_project_member (261-272) and public.remove_workspace_member (627-638) — a replacement that is the assignee of an affected task is refused, project-wide and all-or-nothing
lines 261-272; 627-638
ChatWellApp/chatwell-supabase · supabase/operator-runbooks/verify_gen5_r1r4_conformance.sql@3bf502a701e5
R3-13 departure replacement collision refused — asserted on the project-level removal; the workspace-level removal rests on the same migration patching both writers

Runtime evidence is never an authority of its own. An accepted document says the same thing first; the evidence says only that the running system agrees.

points toSD-1

Sources disagree. What happens when a member who is the reviewer of an active task, or a project's default reviewer, in an active project leaves on their own. See SD-1 in P3.4. Nobody can choose a project's default reviewer today (DNA-11).

FIG-P1-3A membership period opens and closes; it never reopenscurrent behaviour only
Not a memberMemberFormer member
FromToWhat happensMade by
Not a memberMemberjoins — creates the workspace, or accepts an invitationperson
MemberFormer memberleaves, or is removed — the period ends with a reasonperson
Former memberMembercomes back — a new period starts; the old one stays endedperson
Illustrates WS-MEM-2

P1.4Roles and what they let you doPermalink

WS-ROLE-1Every member holds one of two roles: member or admin.

Projects use the same two values. There is no third stored role.

Why is this true?
ClaimWS-ROLE-1
CoversTwo stored roles
StateWorks today
CoverageFulla fact about the sources, not a reader label
SourcesWorkspace & project lifecycle modelAccepted Gen-5 implementation
Exact identity
ChatWellApp/chatwell-docs · architecture/workspace-lifecycle-model.md@cbab557b1b2fcanonical
§6.3a Stored role values — the complete set
lines 540-545
migration-chainAccepted Gen-5 implementationB-MIG
ChatWellApp/chatwell-supabase · supabase/migrations/@3bf502a701e5
1of4 types public.workspace_role, public.project_role
lines 289-291, 208-213
WS-ROLE-2Authority is compared on a three-step ladder: member, then admin, then owner.

The owner's step comes from owning the workspace — and, in each of its projects, from being the workspace's owner — never from a stored role.

Why is this true?
ClaimWS-ROLE-2
CoversAuthority ladder
StateWorks today
CoverageFulla fact about the sources, not a reader label
SourcesWorkspace & project lifecycle modelSource of Truth Map
Exact identity
ChatWellApp/chatwell-docs · architecture/workspace-lifecycle-model.md@cbab557b1b2fcanonical
§6.3a Effective authority — what gating compares against
lines 552-567
documentSource of Truth MapD-SOT
ChatWellApp/chatwell-docs · source-of-truth-map.md@cbab557b1b2fcanonical
Registry row 'Workspace & project lifecycle and governance' (effective-authority derivation member < admin < owner)
WS-ROLE-3Authority is not access.

A role says what you may do; whether you can act at all depends on a current membership, an active account and an active workspace. Admin powers count only while the person is a current member.

Why is this true?
ClaimWS-ROLE-3
CoversAuthority is not access
StateWorks today
CoverageFulla fact about the sources, not a reader label
SourcesWorkspace & project lifecycle modelAccepted Gen-5 implementation
Exact identity
ChatWellApp/chatwell-docs · architecture/workspace-lifecycle-model.md@cbab557b1b2fcanonical
§6 Governance; §6.3a Authority is not entitlement
lines 420-424, 572
migration-chainAccepted Gen-5 implementationB-MIG
ChatWellApp/chatwell-supabase · supabase/migrations/@3bf502a701e5
2of4 public.is_workspace_owner_or_admin header — admin requires the open membership episode
lines 572-578
WS-ROLE-4The role is chosen when someone is invited.Partly defined

The owner or an admin sends the invitation and chooses member or admin; accepting it gives that role. An admin may invite someone as an admin. Partly defined. The governance model describes granting the admin role as the owner's act; no registered document describes admins granting it through an invitation.

Why is this true?
ClaimWS-ROLE-4
CoversRole chosen at invitation
StateWorks today
CoveragePartly defineda fact about the sources, not a reader label
SourcesAccepted Gen-5 implementationMembership modelWorkspace & project lifecycle model
Exact identity
migration-chainAccepted Gen-5 implementationB-MIG
ChatWellApp/chatwell-supabase · supabase/migrations/@3bf502a701e5
20260904234359 public.create_workspace_invitation — role admin|member; owners and admins only; 2of4 accept_workspace_invitation
lines 165-170; 6960-6961
documentMembership modelD-MEM
ChatWellApp/chatwell-docs · architecture/membership-episodes-model.md@cbab557b1b2fcanonical
§3 operation matrix — invite user / accept invitation
lines 200-201
ChatWellApp/chatwell-docs · architecture/workspace-lifecycle-model.md@cbab557b1b2fcanonical
§6.3 Workspace Owner grants Workspace Admin; §6.4 'normally the Owner'; §6.6 the Owner may assign Workspace Admin
lines 519, 667-668, 736-741
WS-ROLE-5Roles belong to one workspace, or one project.

The same person can be an admin in one workspace and an ordinary member in another — and a workspace admin can be an ordinary member of a project, or not in it at all.

Why is this true?
ClaimWS-ROLE-5
CoversRoles are per place
StateWorks today
CoverageFulla fact about the sources, not a reader label
SourcesWorkspace & project lifecycle modelAccepted Gen-5 implementation
Exact identity
ChatWellApp/chatwell-docs · architecture/workspace-lifecycle-model.md@cbab557b1b2fcanonical
§6.3a Admin is one value; scope carries the meaning
lines 575-585
migration-chainAccepted Gen-5 implementationB-MIG
ChatWellApp/chatwell-supabase · supabase/migrations/@3bf502a701e5
1of4 role stored per workspace_member / project_member row (types)
lines 208-213, 289-291
WS-ROLE-6This concerns only the workspace role after joining.

Choosing the role at invitation works today, and changing a person's role inside a project works today, for the workspace owner (P2.2).

Why is this true?
ClaimWS-ROLE-6
CoversWhat the role change does not affect
StateWorks today
CoveragePartly defineda fact about the sources, not a reader label
Sourcesrestates WS-ROLE-4, PJ-ROLE-1
Exact identity

This restates WS-ROLE-4, PJ-ROLE-1. It names no source of its own; the identity lives with the groups it restates.

WS-MX-1What each authority level may do in a workspace today, for the actions this pilot covers.Partly defined

Partly defined. How to read: ✓ may, — may not; a cell that says more than yes or no says it in words, and a cell naming a state label carries that state. "Admin" means a workspace admin. Every action also needs a current membership.

ActionMemberAdminOwner
Rename the workspace
Invite someone, as member or admin
Remove another member (never the owner) ²
Create a project
Leave the workspace ¹
Change a member's workspace role after joiningDecided — not currently available (DNA-6)

¹ Sources disagree on what happens when the person leaving is the reviewer of an active task, or a project's default reviewer, in an active project (SD-1, P3.4). ² Removing someone who reviews active tasks needs a replacement reviewer named as part of the removal, and not everyone can be that replacement: a removal can fail for want of a valid one (WS-MEM-6, WS-MEM-7).

Why is this true?
ClaimWS-MX-1
CoversWorkspace actions by level
StateWorks today
CoveragePartly defineda fact about the sources, not a reader label
SourcesAccepted Gen-5 implementationWorkspace & project lifecycle model
Exact identity
migration-chainAccepted Gen-5 implementationB-MIG
ChatWellApp/chatwell-supabase · supabase/migrations/@3bf502a701e5
2of4 rename_workspace (owner only); 20260904234359 create_workspace_invitation; 20260907173509 remove_workspace_member; 2of4 create_project; 20260905202219 leave_workspace
lines 2902-2903; 169-170; 181-186; 5614-5615; 1461-1463
ChatWellApp/chatwell-docs · architecture/workspace-lifecycle-model.md@cbab557b1b2fcanonical
§6.6 — the Owner may assign / remove Workspace Admin (decided, not implemented)
lines 736-742

What this means for a prototype — WorkspacesPermalink

Every entry names the claim groups or records it derives from. It carries no state of its own; the state shown on each chip is that of the group or record cited.

MUST PRESERVE

  • Ownership is its own fact about a workspace, separate from anyone's role; an interface must never derive it from, or present it as, a role value.fromWS-OWN-2WS-OWN-3
  • Every workspace has exactly one owner at every moment.fromWS-OWN-1
  • The Personal Workspace and user-created workspaces are distinct kinds.fromWS-KIND-1WS-KIND-2
  • Roles belong to one workspace or one project; the same person can hold different roles in different places.fromWS-ROLE-5
  • An ended membership stays ended; coming back is a new membership.fromWS-MEM-2
  • Every account has its Personal Workspace unconditionally; nothing an operator, a catalogue or the beta programme controls can withhold it.fromWS-KIND-1
  • Authorization to create a further workspace and permission for a template are two separate permissions; an interface must not merge them into one idea of "access".fromWS-KIND-3

MUST NOT ASSUME

  • That a member's role can read "owner", or that the owner can be found from roles.fromWS-OWN-2WS-OWN-3
  • That an owner can hand over, or leave, their workspace today.fromWS-OWN-6DNA-1
  • That a workspace can be archived, or deleted, from inside ChatWell today.fromWS-LIFE-1DNA-2
  • That an owner can change a member's workspace role after they joined, today.fromDNA-6
  • That a workspace role is fixed forever: Gen-5 has decided the owner may change it, though that is not available today.fromDNA-6
  • That an account can create a further workspace: during beta it needs authorization and a permitted template, and an account has neither until ChatWell's operators grant them.fromWS-KIND-3WS-KIND-6
  • That the product offers a way to ask for, or grant, that authorization.fromWS-KIND-6
  • That "free" describes a plan, a tier or a price. It describes only that every account has a Personal Workspace.fromWS-KIND-5
  • That a template is available to everyone: none is, at this product stage.fromWS-KIND-7
  • That removing a member always succeeds without naming a replacement reviewer, or that any member can be that replacement.fromWS-MEM-6WS-MEM-7
  • That leaving always succeeds: the owner cannot leave, and for a reviewer of active tasks the sources disagree.fromWS-OWN-6SD-1

Where this comes from — WorkspacesPermalink

Where this comes from32 claim groups
Claim groupCoversStateCoverageSources
WS-WHAT-1What a workspace isWorks todayFullWorkspace & project lifecycle model · Membership model · Accepted Gen-5 implementation
WS-KIND-1Personal Workspace, unconditionalWorks todayFullBeta workspace creation decision · Default template contract · Workspace templates runbook · Accepted runtime evidence (R1–R4) · Gen-5 lifecycle decisions · Workspace & project lifecycle model · Accepted Gen-5 implementation
WS-KIND-5"Free" is positioning, not a settingWorks todayFullBeta workspace creation decision · Default template contract · Accepted Gen-5 implementation
WS-KIND-4Others in a Personal WorkspaceWorks todayPartly definedProject access policy decision · Membership model · Accepted Gen-5 implementation · Workspace & project lifecycle model
WS-KIND-2User-created workspaceWorks todayFullGen-5 lifecycle decisions · Accepted Gen-5 implementation
WS-KIND-3A further workspace takes two permissionsWorks todayFullBeta workspace creation decision · Workspace templates runbook · Accepted Gen-5 implementation · Accepted runtime evidence (R1–R4)
WS-KIND-6Operator-conferred, no product screenWorks todayFullBeta workspace creation decision · Workspace templates runbook · Accepted Gen-5 implementation · Accepted runtime evidence (R1–R4)
WS-KIND-7Template availability todayWorks todayFullWorkspace templates runbook · Beta workspace creation decision · Accepted Gen-5 implementation · Accepted runtime evidence (R1–R4)
WS-START-1Starting structureWorks todayPartly definedMembership model · Default template contract · Accepted Gen-5 implementation
WS-LIM-1How many workspacesNot decidedGapDecision Index · Beta workspace creation decision
WS-LIFE-1No deletion; archival ends the lifecycleWorks todayFullWorkspace & project lifecycle model · Gen-5 lifecycle decisions · Accepted Gen-5 implementation
WS-OWN-1Exactly one ownerWorks todayFullWorkspace & project lifecycle model · Accepted Gen-5 implementation
WS-OWN-2Ownership is not a roleWorks todayFullWorkspace & project lifecycle model · Accepted Gen-5 implementation
WS-OWN-3Owner is also an admin memberWorks todayPartly definedWorkspace & project lifecycle model · Accepted Gen-5 implementation
WS-OWN-4Derived project ownershipWorks todayFullWorkspace & project lifecycle model · Accepted Gen-5 implementation
WS-OWN-7Owner is an admin member of every active projectWorks todayFullvia PJ-ACC-6
WS-OWN-5Ownership never simply endsWorks todayFullWorkspace & project lifecycle model · Accepted Gen-5 implementation
WS-OWN-6Owner cannot leave or be removedWorks todayPartly definedAccepted Gen-5 implementation
WS-MEM-1How membership startsWorks todayFullMembership model · Accepted Gen-5 implementation
WS-MEM-2Membership periodsWorks todayFullMembership model · Accepted Gen-5 implementation
WS-MEM-3Who belonged when is keptWorks todayFullMembership model · Identity invariants · Accepted Gen-5 implementation
WS-MEM-4Membership is not enough to actWorks todayFullMembership model · Accepted Gen-5 implementation
WS-MEM-5Leaving ends project membershipsWorks todayFullMembership model · Accepted Gen-5 implementation
WS-MEM-6Removing membersWorks todayPartly definedAccepted Gen-5 implementation · Membership model · Task lifecycle & assignment model · Task operation contract
WS-MEM-7One replacement per project, never its assigneeWorks todayFullTask reviewer authority decision · Task lifecycle & assignment model · Task operation contract · Accepted Gen-5 implementation · Accepted runtime evidence (R1–R4)
WS-ROLE-1Two stored rolesWorks todayFullWorkspace & project lifecycle model · Accepted Gen-5 implementation
WS-ROLE-2Authority ladderWorks todayFullWorkspace & project lifecycle model · Source of Truth Map
WS-ROLE-3Authority is not accessWorks todayFullWorkspace & project lifecycle model · Accepted Gen-5 implementation
WS-ROLE-4Role chosen at invitationWorks todayPartly definedAccepted Gen-5 implementation · Membership model · Workspace & project lifecycle model
WS-ROLE-5Roles are per placeWorks todayFullWorkspace & project lifecycle model · Accepted Gen-5 implementation
WS-ROLE-6What the role change does not affectWorks todayPartly definedvia WS-ROLE-4, PJ-ROLE-1
WS-MX-1Workspace actions by levelWorks todayPartly definedAccepted Gen-5 implementation · Workspace & project lifecycle model

Coverage is a fact about the sources, not a reader label. Gap is not one of the five labels.