chore(spec): agent access/permissions are live — correct stale liveness ledger

Investigating the next ADR-0049 "enforce now" item (#1884 agent access-control)
found it is ALREADY implemented and tested on main: evaluateAgentAccess()
(agent-access.ts) enforces the agent's declared `permissions` (caller must hold
all) and `access` allow-list at the chat route (agent-routes.ts:151). It landed
after the 2026-06 liveness audit, which still listed these dead — so the
audit-seeded ledger was stale.

- agent.access / agent.permissions: dead → live (evidence: agent-access.ts:50).
- agent.visibility: dead → experimental — intentionally NOT enforced
  (agent-access.ts:41); the list route doesn't filter by it, and gating listing
  needs owner/org semantics that aren't plumbed yet.

Note: the gate enforces classification *completeness*, not *correctness* — a
`dead` entry that silently becomes live (as here) doesn't fail CI. Catching
dead→live drift needs a periodic re-audit (cf. the docs monthly cron).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: os-zhuang

.changeset/agent-access-ledger.md

@@ -0,0 +1,4 @@
+---
+---
+
+chore(spec): correct the agent liveness ledger — `access`/`permissions` are LIVE (enforced by `evaluateAgentAccess` at the chat route, #1884, which landed after the 2026-06 audit that still listed them dead); `visibility` is `experimental` (intentionally not enforced). Repo-internal tooling; no package version impact.

packages/spec/liveness/agent.json

@@ -12,9 +12,9 @@
     "tools": { "status": "live", "evidence": "packages/services/service-ai/src/agent-runtime.ts", "note": "legacy direct-tool fallback." },
     "active": { "status": "live", "evidence": "packages/services/service-ai/src/agent-runtime.ts", "note": "gates listing + 403 on chat." },
     "planning": { "status": "live", "evidence": "packages/services/service-ai/src/agent-runtime.ts", "note": "PARTIAL — only planning.maxIterations live; strategy/allowReplan DEAD." },
-    "access": { "status": "dead", "evidence": "packages/services/service-ai/src/routes/agent-routes.ts:109", "note": "chat route hardcodes ['ai:chat','ai:agents'] — 'who can chat' is a no-op. ADR-0049 #1884." },
-    "permissions": { "status": "dead", "evidence": "packages/services/service-ai/src/routes/agent-routes.ts:109", "note": "display-only; not enforced." },
-    "visibility": { "status": "dead", "evidence": "no runtime reader", "note": "defaults 'organization' but gates nothing." },
+    "access": { "status": "live", "evidence": "packages/services/service-ai/src/routes/agent-access.ts:50", "note": "evaluateAgentAccess() — allow-list by userId/role; enforced at the chat route (agent-routes.ts:151). #1884 (landed after the 2026-06 audit, which still listed it dead)." },
+    "permissions": { "status": "live", "evidence": "packages/services/service-ai/src/routes/agent-access.ts:50", "note": "evaluateAgentAccess() — caller must hold ALL required permissions/roles; enforced at the chat route. #1884." },
+    "visibility": { "status": "experimental", "evidence": "packages/services/service-ai/src/routes/agent-access.ts:41", "note": "intentionally NOT enforced — the chat-access evaluator excludes it and the GET /ai/agents list route does not filter by visibility. Needs owner/org semantics before it can gate listing." },
     "tenantId": { "status": "dead", "evidence": "no runtime reader" },
     "knowledge": { "status": "dead", "evidence": "no runtime reader; AgentPreview reads knowledge.sources but spec defines {topics,indexes}", "note": "shape drift; RAG via service-knowledge." },
     "lifecycle": { "status": "experimental", "evidence": "no runtime reader (StateMachine)", "note": "aspirational autonomy." },