Developers
Spaces and membership
Membership is never stored as a flag. It is computed from records admins and members write.
Permissioned spaces
A space is at://<authority>/space/<type>/<key>. Records live in each author's own repository under the space. The authority's PDS mints space credentials and asks the managing app who may read and write.
Pairs
Each group is a pair: us.off-the-clock.management/<tid> (its grants, feeds, labels, pins) and us.off-the-clock.community/<tid> (its content). Plus the self management space us.off-the-clock.management/self for the community's own records: space records, community admins, community-wide grants, and labels.
Diagram: the self management space, general's pair, and one group's pair, with which records live where (deck: "pairs" and "data-mgmt").
Grants and acceptances
us.off-the-clock.community.membership (member, spaces, note) in a management space; it counts while its author is an effective admin. membershipAcceptance (key self, in general) turns invited into joined (D60). Team grants name a pair's management half (space admins, D35).
The projection
The AppView projects members, admins, space admins, and invited people from the management spaces as they sync; checkUserAccess answers from it. The feed generator projects its own copy. Show the grant sequence diagram (deck: "seq-grant").
Delegated access
The spaces' read and write policies are managingAppPolicy naming <appview did>#otc_membership: the PDS asks the AppView on every credential mint and every notifyWrite.