@astram/guide 0.2.18 → 0.2.20

package/CAPABILITIES.md

@@ -501,8 +501,26 @@ imports: [
   change sends nothing; a notice failure never blocks the change. `bootstrap:org --apply` sends
   none. You do not register or post this kind (apps cannot use `shield.*`); label your permissions
   (`@ObjectType({ permissions })`) so the notices read well.
-- Not yet: admin tasks for new permissions (step 4), the frontend-core service and the scaffold
-  bell (step 5), email delivery.
+- **Admin tasks for new permissions (G-027 step 4, identity 0.22):** each company gets one open
+  task per active permission key with a first-seen date that no role owned by the company holds
+  (directly or through `identity:<type>:*` / `identity:*`). `GET /identity/permission-announcements
+  ?status=open|dismissed&page=&limit=&companyUuid=` lists the tasks the caller can act on: holders
+  of `identity:role:update` whose grant ceiling covers the key, for the companies below them (their
+  own company already holds what they can grant; this needs `scopeSubtreeResolver` wired in
+  `ShieldModule.forRoot`, which the scaffold does not do yet); root sees every company. On a fresh
+  install the keys from the very first catalogue pass raise no task (identity 0.23). Granting the key to any of the company's roles closes the
+  task on the next read; `POST /identity/permission-announcements/:companyUuid/:key/dismiss`
+  ("Reviewed, not needed", audited) closes it on purpose and `…/reopen` undoes that. A key removed
+  and re-added by a later release opens again. Framework keys count like yours. Tasks are not
+  notices: they never enter `/account/notifications`.
+- **Frontend (G-027 step 5, frontend-core 0.10):** `createNotificationService(http)`
+  (`listNotifications`, `unreadNotificationCount`, `markNotificationRead`, `markAllNotificationsRead`) and
+  `identity.{listPermissionAnnouncements,dismissPermissionAnnouncement,reopenPermissionAnnouncement}`. The scaffolded
+  header has a bell (personal notices) and an Announcements icon (announcement notices, plus admin tasks for holders of
+  `identity:role:update`); "Grant…" opens `/access/add?key=<key>` with the key ticked; the Access form marks keys
+  with a caution and asks to confirm before granting them. Counts refresh on focus and every 60 s while the tab is
+  visible, and right after the user's own actions. Delivery is polling; there is no server push yet.
+- Not yet: email delivery.
 
 ## Separation of duties (ADR-0048; core 1.12, engine 0.14, guard 0.21, identity 0.18)
 - **Declare it on the type** when the people who started or asked about a record must not

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astram/guide",
-  "version": "0.2.18",
+  "version": "0.2.20",
   "license": "MIT",
   "description": "Astram framework — the AI/dev GUIDE layer (ADR-0025). Ships the framework's hard rules + capabilities manifest as installed, upgrade-refreshed docs. A consumer app's CLAUDE.md references FRAMEWORK_RULES.md from this package; `npm update` replaces it wholesale so new rules arrive cleanly, while the app's own .astram/guide/ layer is never touched. This is the framework-owned FLOOR: an app rule may tighten it, never weaken it.",
   "type": "commonjs",