Project Wiki subtrees through Agent-scoped internal MCP

[LanicBlue]

Context

Wiki Service authenticates and authorizes the single configured T3 Wiki Client. It remains unaware of T3 Agents and Sessions.

T3 owns internal Agent delegation inside the Wiki namespace already visible to that Client.

V1 projection

Default each logical Agent to a subtree derived from its stable ID:

configured Wiki Client bound root
  /agents/<agentId>/...

The exact physical prefix may be implementation-defined, but identity is based on agentId, never agentName.

Rules:

• Agent rename does not move or rename its subtree.
• Wiki Service receives only the T3 Client identity.
• Agent tools use subtree-relative paths.
• Agent inputs cannot select rootId, subtree anchor, clientId, or another Agent.
• T3 resolves/constrains the path before calling the Wiki SDK.
• Absolute paths, traversal, foreign NodeRefs, and aliases that escape the projection fail closed.

MCP surface

Expose an explicit allowlist, for example:

wiki_list(relativePath?)
wiki_read(relativePath)
wiki_search(query)
wiki_create(relativePath, content)
wiki_update(relativePath, content, revision)

No generic Wiki client facet is exposed. Backend, mount, maintenance, client-admin, access-admin, root lifecycle, and destructive purge operations stay unavailable to Agents.

Read/write capability is derived from the trusted Agent context, not a caller argument.

Lifecycle and future UI

V1 uses the default agentId route without complex per-Agent permission UI.

Preserve an internal configuration seam so a later T3 Settings UI can add:

• custom subtree mapping;
• read-only vs read-write;
• shared read-only areas;
• explicit aliases.

That future projection remains T3-owned and does not require Wiki Service to learn Agent identity.

Agent removal must not silently delete Wiki content. Define a recoverable retain/archive policy; destructive cleanup is separate and explicit.

Acceptance criteria

• Wiki Service authenticates only the configured T3 Wiki Client.
• Default Agent subtree is derived from stable agentId.
• Agent rename does not change the subtree.
• MCP tools accept only business/query data and subtree-relative paths.
• Agent cannot select Wiki root/subtree/client/Agent identity.
• Paths and stable references are confined before SDK calls.
• Explicit tool allowlist excludes infra/admin/destructive facets.
• Read/write capability comes from trusted MCP context.
• Agent removal preserves content by default.
• Tests cover absolute paths, traversal, foreign refs, sibling Agents, aliases, and read-only mode.
• Future permission UI can extend T3 projection without changing Wiki Service authorization.

Non-goals

• Do not add Agent/session identity to Wiki Service.
• Do not create one Wiki service client per Agent.
• Do not implement advanced subtree permission UI in v1.