aimeat 1.20.2 → 1.20.4

package/dist/src/routes/organisms.js

@@ -37,6 +37,9 @@
  *   v1.10.0 -- 2026-06-09 -- Workspace-level read: GET /:id/workspace authorizes once on the manifest
  *     (creator / same-owner / a viewer|contributor grant) and then returns ALL content, not per record —
  *     so a contributor's writes are visible to the creator + every member of a shared workspace.
+ *   v1.11.0 -- 2026-06-09 -- Organism-level member management: a join request now notifies the
+ *     creator/admins (and the requester on review decision); new DELETE /:id/members/:ghii lets a
+ *     creator/admin revoke a member's access (notifies the removed member).
  */
 import { Router, raw } from 'express';
 import { v4 as uuidv4 } from 'uuid';
@@ -53,6 +56,8 @@ import { exportWorkspace } from '../services/workspace-export.js';
 import { importWorkspace } from '../services/workspace-import.js';
 import { exportOrganism } from '../services/organism-export.js';
 import { importOrganism } from '../services/organism-import.js';
+import { searchOrganismContent } from '../services/organism-search.js';
+import { canAccessWorkspaceComments, addComment, listComments, commentPrefix } from '../services/organism-comments.js';
 import { ZipSecurityError } from '../services/safe-zip.js';
 import { recordSecurityIncident } from '../services/security-incident.js';
 import { updateWorkspaceMeta, WorkspaceMetaError } from '../services/workspace-meta.js';
@@ -241,6 +246,10 @@ export function organismsRouter(config, storage) {
         }
         // Check if already a member
         const existing = await storage.getMembership(id, ghii);
+        if (existing && existing.status === 'banned') {
+            res.status(403).json(error(config.nodeId, 'BANNED', 'You have been blocked from this organism'));
+            return;
+        }
         if (existing && existing.status === 'active') {
             res.status(409).json(error(config.nodeId, 'ALREADY_MEMBER', 'You are already a member'));
             return;
@@ -249,6 +258,10 @@ export function organismsRouter(config, storage) {
             res.status(409).json(error(config.nodeId, 'ALREADY_PENDING', 'You already have a pending join request'));
             return;
         }
+        if (existing && existing.status === 'invited') {
+            res.status(409).json(error(config.nodeId, 'ALREADY_INVITED', 'You have a pending invitation — accept it instead of requesting to join'));
+            return;
+        }
         // Check capacity
         const members = await storage.listMembers(id, { status: 'active' });
         if (members.length >= organism.maxMembers) {
@@ -284,6 +297,18 @@ export function organismsRouter(config, storage) {
                 status: 'pending',
                 createdAt: now,
             });
+            // Notify the creator + admins so the request doesn't go unnoticed (mirrors the
+            // workspace-access request path). admins includes the creator, so dedupe.
+            const approvers = [...new Set([organism.creatorGhii, ...organism.admins])];
+            for (const approver of approvers) {
+                await notify(storage, `${approver}@${config.nodeId}`, {
+                    type: 'organism_join_request',
+                    title: `${ghii} requested to join "${organism.name}"`,
+                    body: typeof message === 'string' ? message : '',
+                    link: '/v1/profile#organisms',
+                });
+            }
+            emitChange('notifications');
             res.status(202).json(success(config.nodeId, { join_request: request, status: 'pending' }));
             emitChange('organisms');
         }
@@ -403,6 +428,15 @@ export function organismsRouter(config, storage) {
                 updatedAt: now,
             });
         }
+        // Notify the requester of the decision so it surfaces in their bell.
+        await notify(storage, `${request.ghii}@${config.nodeId}`, {
+            type: decision === 'approved' ? 'organism_join_approved' : 'organism_join_rejected',
+            title: decision === 'approved'
+                ? `You were approved to join "${organism.name}"`
+                : `Your request to join "${organism.name}" was declined`,
+            link: '/v1/profile#organisms',
+        });
+        emitChange('notifications');
         res.json(success(config.nodeId, { decision, request_id: requestId }));
         emitChange('organisms');
     });
@@ -472,6 +506,324 @@ export function organismsRouter(config, storage) {
         res.json(success(config.nodeId, { demoted: targetGhii, role: 'member' }));
         emitChange('organisms');
     });
+    /* ── DELETE /v1/organisms/:id/members/:ghii — Remove (revoke) a member ──
+     * Creator/admin removes another member's organism access entirely: deletes the
+     * membership and drops them from members[] (+ admins[] if applicable). The creator
+     * cannot be removed (they must delete the organism); an admin can only be removed by
+     * the creator. The removed member is notified. To leave voluntarily, use /leave. */
+    router.delete('/v1/organisms/:id/members/:ghii', requireAuth(), requireRole('agent'), async (req, res) => {
+        const callerGhii = req.auth.owner;
+        const id = req.params.id;
+        const targetGhii = decodeURIComponent(req.params.ghii);
+        const organism = await storage.getOrganism(id);
+        if (!organism) {
+            res.status(404).json(error(config.nodeId, 'NOT_FOUND', 'Organism not found'));
+            return;
+        }
+        const callerIsCreator = organism.creatorGhii === callerGhii;
+        const callerIsAdmin = callerIsCreator || organism.admins.includes(callerGhii);
+        if (!callerIsAdmin) {
+            res.status(403).json(error(config.nodeId, 'ACCESS_DENIED', 'Only the creator or an admin can remove members'));
+            return;
+        }
+        if (targetGhii === organism.creatorGhii) {
+            res.status(400).json(error(config.nodeId, 'CANNOT_REMOVE_CREATOR', 'The creator cannot be removed. Delete the organism instead.'));
+            return;
+        }
+        // Only the creator can remove an admin.
+        if (organism.admins.includes(targetGhii) && !callerIsCreator) {
+            res.status(403).json(error(config.nodeId, 'ACCESS_DENIED', 'Only the creator can remove an admin'));
+            return;
+        }
+        const membership = await storage.getMembership(id, targetGhii);
+        if (!membership || membership.status !== 'active') {
+            res.status(404).json(error(config.nodeId, 'NOT_MEMBER', 'Target is not an active member'));
+            return;
+        }
+        // `?ban=1` (or body { ban: true }) blocks the member from re-joining / being re-invited:
+        // keep the membership row but flip it to `banned` instead of deleting it. Plain remove just
+        // deletes the row (they can request to join again).
+        const ban = req.query.ban === '1' || req.query.ban === 'true' || req.body?.ban === true;
+        const now = new Date().toISOString();
+        if (ban) {
+            await storage.updateMembership(membership.id, { status: 'banned', role: 'member' });
+        }
+        else {
+            await storage.deleteMembership(membership.id);
+        }
+        await storage.updateOrganism(id, {
+            members: organism.members.filter(m => m !== targetGhii),
+            admins: organism.admins.filter(a => a !== targetGhii),
+            updatedAt: now,
+        });
+        // Let the removed member know their access was revoked.
+        await notify(storage, `${targetGhii}@${config.nodeId}`, {
+            type: ban ? 'organism_member_banned' : 'organism_member_removed',
+            title: ban
+                ? `You were blocked from "${organism.name}"`
+                : `Your access to "${organism.name}" was revoked`,
+            link: '/v1/profile#organisms',
+        });
+        emitChange('notifications');
+        res.json(success(config.nodeId, { removed: targetGhii, banned: ban }));
+        emitChange('organisms');
+    });
+    /* ── POST /v1/organisms/:id/members/:ghii/unban — Lift a ban ──
+     * Creator/admin removes the block on a previously-banned owner by deleting the banned
+     * membership row, so they can request to join (or be invited) again. */
+    router.post('/v1/organisms/:id/members/:ghii/unban', requireAuth(), requireRole('agent'), async (req, res) => {
+        const callerGhii = req.auth.owner;
+        const id = req.params.id;
+        const targetGhii = decodeURIComponent(req.params.ghii);
+        const organism = await storage.getOrganism(id);
+        if (!organism) {
+            res.status(404).json(error(config.nodeId, 'NOT_FOUND', 'Organism not found'));
+            return;
+        }
+        if (organism.creatorGhii !== callerGhii && !organism.admins.includes(callerGhii)) {
+            res.status(403).json(error(config.nodeId, 'ACCESS_DENIED', 'Only the creator or an admin can lift a block'));
+            return;
+        }
+        const membership = await storage.getMembership(id, targetGhii);
+        if (!membership || membership.status !== 'banned') {
+            res.status(404).json(error(config.nodeId, 'NOT_BANNED', 'Target is not blocked'));
+            return;
+        }
+        await storage.deleteMembership(membership.id);
+        res.json(success(config.nodeId, { unbanned: targetGhii }));
+        emitChange('organisms');
+    });
+    /* ── POST /v1/organisms/:id/transfer — Transfer ownership ──
+     * The creator hands the organism to an existing active member: the target becomes `creator`,
+     * the previous creator is demoted to `admin` (kept as a member). Only the current creator may
+     * call this. The new creator is notified. */
+    router.post('/v1/organisms/:id/transfer', requireAuth(), requireRole('agent'), async (req, res) => {
+        const callerGhii = req.auth.owner;
+        const id = req.params.id;
+        const { to } = req.body ?? {};
+        if (!to || typeof to !== 'string') {
+            res.status(400).json(error(config.nodeId, 'INVALID_INPUT', 'Body field "to" (an active member) is required'));
+            return;
+        }
+        const organism = await storage.getOrganism(id);
+        if (!organism) {
+            res.status(404).json(error(config.nodeId, 'NOT_FOUND', 'Organism not found'));
+            return;
+        }
+        if (organism.creatorGhii !== callerGhii) {
+            res.status(403).json(error(config.nodeId, 'ACCESS_DENIED', 'Only the current creator can transfer ownership'));
+            return;
+        }
+        if (to === callerGhii) {
+            res.status(400).json(error(config.nodeId, 'INVALID_INPUT', 'You are already the creator'));
+            return;
+        }
+        const targetMembership = await storage.getMembership(id, to);
+        if (!targetMembership || targetMembership.status !== 'active') {
+            res.status(404).json(error(config.nodeId, 'NOT_MEMBER', 'Target must be an active member of this organism'));
+            return;
+        }
+        const callerMembership = await storage.getMembership(id, callerGhii);
+        const now = new Date().toISOString();
+        // Promote the new creator, demote the old one to admin.
+        await storage.updateMembership(targetMembership.id, { role: 'creator' });
+        if (callerMembership)
+            await storage.updateMembership(callerMembership.id, { role: 'admin' });
+        const admins = [...new Set([...organism.admins.filter(a => a !== to), callerGhii])];
+        await storage.updateOrganism(id, { creatorGhii: to, admins, updatedAt: now });
+        await notify(storage, `${to}@${config.nodeId}`, {
+            type: 'organism_ownership_transferred',
+            title: `You are now the creator of "${organism.name}"`,
+            link: '/v1/profile#organisms',
+        });
+        emitChange('notifications');
+        res.json(success(config.nodeId, { creator: to, previousCreator: callerGhii }));
+        emitChange('organisms');
+    });
+    /* ── Invitations (invite_only flow; works for any policy) ──
+     * A creator/admin invites an owner by bare name. The invite is a membership row with
+     * status `invited` + `invitedBy`. The invitee is notified and accepts/declines. */
+    /* POST /v1/organisms/:id/invitations — invite an owner */
+    router.post('/v1/organisms/:id/invitations', requireAuth(), requireRole('agent'), async (req, res) => {
+        const callerGhii = req.auth.owner;
+        const id = req.params.id;
+        const { invitee } = req.body ?? {};
+        if (!invitee || typeof invitee !== 'string') {
+            res.status(400).json(error(config.nodeId, 'INVALID_INPUT', 'Body field "invitee" (an owner name) is required'));
+            return;
+        }
+        const organism = await storage.getOrganism(id);
+        if (!organism) {
+            res.status(404).json(error(config.nodeId, 'NOT_FOUND', 'Organism not found'));
+            return;
+        }
+        if (organism.creatorGhii !== callerGhii && !organism.admins.includes(callerGhii)) {
+            res.status(403).json(error(config.nodeId, 'ACCESS_DENIED', 'Only the creator or an admin can invite members'));
+            return;
+        }
+        const existing = await storage.getMembership(id, invitee);
+        if (existing && existing.status === 'active') {
+            res.status(409).json(error(config.nodeId, 'ALREADY_MEMBER', 'That owner is already a member'));
+            return;
+        }
+        if (existing && existing.status === 'invited') {
+            res.status(409).json(error(config.nodeId, 'ALREADY_INVITED', 'That owner already has a pending invitation'));
+            return;
+        }
+        if (existing && existing.status === 'banned') {
+            res.status(409).json(error(config.nodeId, 'BANNED', 'That owner is blocked — lift the block before inviting'));
+            return;
+        }
+        const now = new Date().toISOString();
+        const membership = await storage.createMembership({
+            id: uuidv4(),
+            organismId: id,
+            ghii: invitee,
+            role: 'member',
+            status: 'invited',
+            invitedBy: callerGhii,
+            joinedAt: now,
+        });
+        await notify(storage, `${invitee}@${config.nodeId}`, {
+            type: 'organism_invitation',
+            title: `${callerGhii} invited you to join "${organism.name}"`,
+            link: '/v1/profile#organisms',
+        });
+        emitChange('notifications');
+        res.status(201).json(success(config.nodeId, { invitation: membership, status: 'invited' }));
+        emitChange('organisms');
+    });
+    /* GET /v1/organisms/:id/invitations — list outstanding invitations (creator/admin) */
+    router.get('/v1/organisms/:id/invitations', requireAuth(), requireRole('agent'), async (req, res) => {
+        const callerGhii = req.auth.owner;
+        const id = req.params.id;
+        const organism = await storage.getOrganism(id);
+        if (!organism) {
+            res.status(404).json(error(config.nodeId, 'NOT_FOUND', 'Organism not found'));
+            return;
+        }
+        if (organism.creatorGhii !== callerGhii && !organism.admins.includes(callerGhii)) {
+            res.status(403).json(error(config.nodeId, 'ACCESS_DENIED', 'Only the creator or an admin can view invitations'));
+            return;
+        }
+        const invitations = await storage.listMembers(id, { status: 'invited' });
+        res.json(success(config.nodeId, { invitations, total: invitations.length }));
+    });
+    /* GET /v1/organisms/invitations/mine — the caller's own pending invitations (across organisms) */
+    router.get('/v1/organisms/invitations/mine', requireAuth(), requireRole('agent'), async (req, res) => {
+        const callerGhii = req.auth.owner;
+        const memberships = (await storage.listMembershipsByGhii(callerGhii)).filter(m => m.status === 'invited');
+        const invitations = [];
+        for (const m of memberships) {
+            const org = await storage.getOrganism(m.organismId);
+            if (org)
+                invitations.push({ membership: m, organism: { id: org.id, name: org.name, description: org.description, type: org.type, visibility: org.visibility } });
+        }
+        res.json(success(config.nodeId, { invitations, total: invitations.length }));
+    });
+    /* POST /v1/organisms/:id/invitations/accept — the invitee accepts */
+    router.post('/v1/organisms/:id/invitations/accept', requireAuth(), requireRole('agent'), async (req, res) => {
+        const callerGhii = req.auth.owner;
+        const id = req.params.id;
+        const organism = await storage.getOrganism(id);
+        if (!organism) {
+            res.status(404).json(error(config.nodeId, 'NOT_FOUND', 'Organism not found'));
+            return;
+        }
+        const membership = await storage.getMembership(id, callerGhii);
+        if (!membership || membership.status !== 'invited') {
+            res.status(404).json(error(config.nodeId, 'NO_INVITATION', 'You have no pending invitation to this organism'));
+            return;
+        }
+        const now = new Date().toISOString();
+        await storage.updateMembership(membership.id, { status: 'active', joinedAt: now });
+        await storage.updateOrganism(id, { members: [...new Set([...organism.members, callerGhii])], updatedAt: now });
+        // Notify the inviter that the invitation was accepted.
+        if (membership.invitedBy) {
+            await notify(storage, `${membership.invitedBy}@${config.nodeId}`, {
+                type: 'organism_invitation_accepted',
+                title: `${callerGhii} accepted your invitation to "${organism.name}"`,
+                link: '/v1/profile#organisms',
+            });
+            emitChange('notifications');
+        }
+        res.json(success(config.nodeId, { status: 'joined' }));
+        emitChange('organisms');
+    });
+    /* POST /v1/organisms/:id/invitations/decline — the invitee declines */
+    router.post('/v1/organisms/:id/invitations/decline', requireAuth(), requireRole('agent'), async (req, res) => {
+        const callerGhii = req.auth.owner;
+        const id = req.params.id;
+        const membership = await storage.getMembership(id, callerGhii);
+        if (!membership || membership.status !== 'invited') {
+            res.status(404).json(error(config.nodeId, 'NO_INVITATION', 'You have no pending invitation to this organism'));
+            return;
+        }
+        await storage.deleteMembership(membership.id);
+        res.json(success(config.nodeId, { status: 'declined' }));
+        emitChange('organisms');
+    });
+    /* ── Agent attachment (manage organism.agentGaiis) ──
+     * An owner attaches one of their OWN agents to an organism they belong to, so the agent shows
+     * as an organism participant and passes the workspace membership gate in its own right. */
+    /* POST /v1/organisms/:id/agents — attach an agent GAII (caller must own it + be a member) */
+    router.post('/v1/organisms/:id/agents', requireAuth(), requireRole('agent'), async (req, res) => {
+        const callerGhii = req.auth.owner;
+        const id = req.params.id;
+        const { agent_gaii } = req.body ?? {};
+        if (!agent_gaii || typeof agent_gaii !== 'string') {
+            res.status(400).json(error(config.nodeId, 'INVALID_INPUT', 'Body field "agent_gaii" is required'));
+            return;
+        }
+        const parsed = parseGaiiLoose(agent_gaii);
+        if (!parsed.agent || parsed.owner !== callerGhii) {
+            res.status(403).json(error(config.nodeId, 'ACCESS_DENIED', 'You can only attach your own agents'));
+            return;
+        }
+        const organism = await storage.getOrganism(id);
+        if (!organism) {
+            res.status(404).json(error(config.nodeId, 'NOT_FOUND', 'Organism not found'));
+            return;
+        }
+        const membership = await storage.getMembership(id, callerGhii);
+        const isMember = !!membership && membership.status === 'active';
+        if (!isMember && organism.creatorGhii !== callerGhii) {
+            res.status(403).json(error(config.nodeId, 'NOT_MEMBER', 'You must be a member to attach an agent'));
+            return;
+        }
+        if (organism.agentGaiis.includes(agent_gaii)) {
+            res.status(409).json(error(config.nodeId, 'ALREADY_ATTACHED', 'That agent is already attached'));
+            return;
+        }
+        await storage.updateOrganism(id, { agentGaiis: [...organism.agentGaiis, agent_gaii], updatedAt: new Date().toISOString() });
+        res.status(201).json(success(config.nodeId, { attached: agent_gaii }));
+        emitChange('organisms');
+    });
+    /* DELETE /v1/organisms/:id/agents/:gaii — detach an agent (its owner, or creator/admin) */
+    router.delete('/v1/organisms/:id/agents/:gaii', requireAuth(), requireRole('agent'), async (req, res) => {
+        const callerGhii = req.auth.owner;
+        const id = req.params.id;
+        const agentGaii = decodeURIComponent(req.params.gaii);
+        const organism = await storage.getOrganism(id);
+        if (!organism) {
+            res.status(404).json(error(config.nodeId, 'NOT_FOUND', 'Organism not found'));
+            return;
+        }
+        const parsed = parseGaiiLoose(agentGaii);
+        const ownsAgent = parsed.owner === callerGhii;
+        const isAdmin = organism.creatorGhii === callerGhii || organism.admins.includes(callerGhii);
+        if (!ownsAgent && !isAdmin) {
+            res.status(403).json(error(config.nodeId, 'ACCESS_DENIED', 'Only the agent owner or an organism admin can detach it'));
+            return;
+        }
+        if (!organism.agentGaiis.includes(agentGaii)) {
+            res.status(404).json(error(config.nodeId, 'NOT_FOUND', 'That agent is not attached'));
+            return;
+        }
+        await storage.updateOrganism(id, { agentGaiis: organism.agentGaiis.filter(g => g !== agentGaii), updatedAt: new Date().toISOString() });
+        res.json(success(config.nodeId, { detached: agentGaii }));
+        emitChange('organisms');
+    });
     /* ── GET /v1/organisms/:id/workspace — Manifest-driven workspace read ──
      *
      * Generic over ANY manifest: reads `organism.{id}.meta.manifest`, then for each
@@ -610,6 +962,129 @@ export function organismsRouter(config, storage) {
             { description: 'Publish a draft', method: 'POST', url: `/v1/organisms/${id}/publish` },
         ]));
     });
+    /* ── GET /v1/organisms/:id/search — Search organism / workspace content ──
+     * Full-text-ish (case-insensitive substring) search across the records + documents of every
+     * workspace the caller can read (or one workspace if ?ws=). Returns matches with the workspace,
+     * space (objectType), instance id, a title, and a snippet around the hit. Honours the same
+     * workspace-level read authorization as GET /:id/workspace (manifest gate) — a member only
+     * searches workspaces they may read; drafts, version history and meta records are skipped. */
+    router.get('/v1/organisms/:id/search', requireAuth(), async (req, res) => {
+        const id = req.params.id;
+        const q = (typeof req.query.q === 'string' ? req.query.q : '').trim();
+        const onlyWs = typeof req.query.ws === 'string' ? req.query.ws : undefined;
+        if (q.length < 2) {
+            res.status(400).json(error(config.nodeId, 'INVALID_INPUT', 'Query "q" must be at least 2 characters'));
+            return;
+        }
+        const organism = await storage.getOrganism(id);
+        if (!organism) {
+            res.status(404).json(error(config.nodeId, 'NOT_FOUND', 'Organism not found'));
+            return;
+        }
+        // Membership gate (same as workspace read): an org agent or an active member.
+        const callerSub = req.auth.sub;
+        const ownerName = req.auth.owner;
+        let isMember = !!callerSub && organism.agentGaiis.includes(callerSub);
+        if (!isMember && ownerName) {
+            const m = await storage.getMembership(id, ownerName);
+            isMember = !!m && m.status === 'active';
+        }
+        if (!isMember) {
+            res.status(403).json(error(config.nodeId, 'ACCESS_DENIED', 'Not an active member of this organism'));
+            return;
+        }
+        const callerGaii = resolveIdentity(req.auth, config.nodeId);
+        const { results, truncated } = await searchOrganismContent(storage, config, organism, callerGaii, q, onlyWs);
+        res.json(success(config.nodeId, { query: q, results, total: results.length, truncated }));
+    });
+    /* ── Comments / threads on workspace records + documents ──
+     * A comment targets one workspace object (record or document) by (ws, space, instance_id), can be
+     * anchored to a part of a document (anchor.section or anchor.quote) or left general (no anchor),
+     * and can reply to another comment (parent_id) to form threads. Comments are memory-backed under
+     * `organism.{id}.w.{ws}.meta.comments.{space}~{instance}.{commentId}` — the meta.* prefix keeps
+     * them OUT of the workspace read + content search. Authoring is open to any member or organism
+     * agent (so agents can comment); read requires the same workspace-read authorization as the
+     * content; a comment can be deleted by its author or a creator/admin. */
+    /* POST /v1/organisms/:id/comments — add a comment */
+    router.post('/v1/organisms/:id/comments', requireAuth(), requireRole('agent'), async (req, res) => {
+        const id = req.params.id;
+        const { ws, space, instance_id, body, anchor, parent_id } = req.body ?? {};
+        if (!ws || !space || !instance_id || typeof body !== 'string' || !body.trim()) {
+            res.status(400).json(error(config.nodeId, 'INVALID_INPUT', 'ws, space, instance_id and a non-empty body are required'));
+            return;
+        }
+        const organism = await storage.getOrganism(id);
+        if (!organism) {
+            res.status(404).json(error(config.nodeId, 'NOT_FOUND', 'Organism not found'));
+            return;
+        }
+        const callerGaii = resolveIdentity(req.auth, config.nodeId);
+        if (!(await canAccessWorkspaceComments(storage, config, organism, req.auth.sub, req.auth.owner, callerGaii, ws))) {
+            res.status(403).json(error(config.nodeId, 'ACCESS_DENIED', 'You cannot comment in this workspace'));
+            return;
+        }
+        const comment = await addComment(storage, id, callerGaii, { ws, space, instanceId: instance_id, body, anchor, parentId: parent_id });
+        emitChange('organisms');
+        res.status(201).json(success(config.nodeId, { comment }));
+    });
+    /* GET /v1/organisms/:id/comments?ws=&space=&instance_id= — list a target's thread */
+    router.get('/v1/organisms/:id/comments', requireAuth(), async (req, res) => {
+        const id = req.params.id;
+        const ws = req.query.ws;
+        const space = req.query.space;
+        const instanceId = req.query.instance_id;
+        if (!ws || !space || !instanceId) {
+            res.status(400).json(error(config.nodeId, 'INVALID_INPUT', 'ws, space and instance_id query params are required'));
+            return;
+        }
+        const organism = await storage.getOrganism(id);
+        if (!organism) {
+            res.status(404).json(error(config.nodeId, 'NOT_FOUND', 'Organism not found'));
+            return;
+        }
+        const callerGaii = resolveIdentity(req.auth, config.nodeId);
+        if (!(await canAccessWorkspaceComments(storage, config, organism, req.auth.sub, req.auth.owner, callerGaii, ws))) {
+            res.status(403).json(error(config.nodeId, 'ACCESS_DENIED', 'You cannot read this workspace'));
+            return;
+        }
+        const comments = await listComments(storage, id, ws, space, instanceId);
+        res.json(success(config.nodeId, { comments, total: comments.length }));
+    });
+    /* DELETE /v1/organisms/:id/comments/:commentId?ws=&space=&instance_id= — delete (author or creator/admin) */
+    router.delete('/v1/organisms/:id/comments/:commentId', requireAuth(), requireRole('agent'), async (req, res) => {
+        const id = req.params.id;
+        const commentId = req.params.commentId;
+        const ws = req.query.ws;
+        const space = req.query.space;
+        const instanceId = req.query.instance_id;
+        if (!ws || !space || !instanceId) {
+            res.status(400).json(error(config.nodeId, 'INVALID_INPUT', 'ws, space and instance_id query params are required'));
+            return;
+        }
+        const organism = await storage.getOrganism(id);
+        if (!organism) {
+            res.status(404).json(error(config.nodeId, 'NOT_FOUND', 'Organism not found'));
+            return;
+        }
+        const callerGaii = resolveIdentity(req.auth, config.nodeId);
+        const callerOwner = req.auth.owner;
+        const key = `${commentPrefix(id, ws, space, instanceId)}${commentId}`;
+        const scan = await storage.listAllMemory({ prefix: key, limit: 5 });
+        const rec = scan.items.find(r => r.key === key);
+        if (!rec) {
+            res.status(404).json(error(config.nodeId, 'NOT_FOUND', 'Comment not found'));
+            return;
+        }
+        const isAuthor = rec.ownerGaii === callerGaii;
+        const isAdmin = organism.creatorGhii === callerOwner || organism.admins.includes(callerOwner);
+        if (!isAuthor && !isAdmin) {
+            res.status(403).json(error(config.nodeId, 'ACCESS_DENIED', 'Only the comment author or an organism admin can delete it'));
+            return;
+        }
+        await storage.deleteMemory(rec.ownerGaii, key);
+        emitChange('organisms');
+        res.json(success(config.nodeId, { deleted: commentId }));
+    });
     /* ── Gate primitive (Phase 4) — PendingApproval ──
      *
      * Generic over any organism/manifest. The gate ENGINE is here; the gate CONDITIONS are data