@astram/guide 0.2.17 → 0.2.19

package/CAPABILITIES.md

@@ -493,8 +493,26 @@ imports: [
   name only what concerns its recipient.
 - Retention: read notices are deleted after `NOTIFICATION_READ_RETENTION_DAYS` (90), every notice
   after `NOTIFICATION_MAX_RETENTION_DAYS` (365), counted from posting; an hourly job does it.
-- Not yet: personal notices when a user's access changes (G-027 step 3), admin tasks for new
-  permissions (step 4), the frontend-core service and the scaffold bell (step 5), email delivery.
+- **Access-change notices (G-027 step 3):** the framework posts its own `shield.access_changed`
+  notices (category `personal`, title "Your access changed", body "You can now: …" / "You can no
+  longer: …" with permission labels) when a user's effective keys change. The triggers are role
+  grant/revoke, bundle grant/revoke, role delete, posting replace/add and switching or creating the
+  active membership. They are written on the same transaction as the change, so a rolled-back
+  change sends nothing; a notice failure never blocks the change. `bootstrap:org --apply` sends
+  none. You do not register or post this kind (apps cannot use `shield.*`); label your permissions
+  (`@ObjectType({ permissions })`) so the notices read well.
+- **Admin tasks for new permissions (G-027 step 4, identity 0.22):** each company gets one open
+  task per active permission key with a first-seen date that no role owned by the company holds
+  (directly or through `identity:<type>:*` / `identity:*`). `GET /identity/permission-announcements
+  ?status=open|dismissed&page=&limit=` (root may add `companyUuid`) lists the tasks the caller can
+  act on: holders of `identity:role:update` whose grant ceiling covers the key, in their active
+  company only; root sees every company. Granting the key to any of the company's roles closes the
+  task on the next read; `POST /identity/permission-announcements/:companyUuid/:key/dismiss`
+  ("Reviewed, not needed", audited) closes it on purpose and `…/reopen` undoes that. A key removed
+  and re-added by a later release opens again. Framework keys count like yours. Tasks are not
+  notices: they never enter `/account/notifications`.
+- Not yet: the frontend-core service and the scaffold bell and Announcements icon (step 5), email
+  delivery.
 
 ## Separation of duties (ADR-0048; core 1.12, engine 0.14, guard 0.21, identity 0.18)
 - **Declare it on the type** when the people who started or asked about a record must not

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astram/guide",
-  "version": "0.2.17",
+  "version": "0.2.19",
   "license": "MIT",
   "description": "Astram framework — the AI/dev GUIDE layer (ADR-0025). Ships the framework's hard rules + capabilities manifest as installed, upgrade-refreshed docs. A consumer app's CLAUDE.md references FRAMEWORK_RULES.md from this package; `npm update` replaces it wholesale so new rules arrive cleanly, while the app's own .astram/guide/ layer is never touched. This is the framework-owned FLOOR: an app rule may tighten it, never weaken it.",
   "type": "commonjs",