browser/openspec/changes/implement-role-scoped-server-access/proposal.md

Why

The current login and server management flow authenticates users but does not enforce the product rule that platform administrators can manage every server while server owners and server administrators only see their assigned servers. The platform also needs bootstrap-safe registration so the first real account becomes the platform administrator and later registrations remain server-scoped until invited or approved.

What Changes

• Make the first registered account an active platform administrator with an authenticated session.
• Keep subsequent self-registrations server-scoped and pending until a platform administrator activates them.
• Add owner and administrator membership fields to server instances and expose them in bounded API responses.
• Scope server list/detail/lifecycle APIs by current user: platform administrators see all servers; owners and administrators see only owned or managed servers.
• Add server owner APIs to invite and remove server administrators without exposing platform administrators as invite candidates.
• Add frontend contracts, client methods, server detail UI, and tests for owner-managed administrator membership.

Capabilities

New Capabilities

• role-scoped-server-access: Registration bootstrap, server ownership, server administrator membership, and role-scoped server visibility/actions.

Modified Capabilities

Impact

• Affects platform/ domain, DTOs, validation, repository filters, service authorization helpers, API handlers, route docs, and tests.
• Affects platform_web/ API types/client methods, server list/detail pages, user/admin display logic, and tests.
• Preserves existing platform/run/plugin boundaries; no raw credentials, host paths, direct sockets, or AI provider keys are exposed to plugins or the frontend.