feat(proto): org-management comms + spawn arms for agent gateway (RIG-2673)

packages/compass-agent/AGENTS.md

@@ -36,14 +36,25 @@ restatement of the role prompt.
 
 ## The comms toolset
 
-Five native comms tools ship (`src/comms.ts`), none of them ask-answering:
+Eight native comms tools ship (`src/comms.ts`), none of them ask-answering:
 
 - `comms_post_message` — post a markdown message to a channel topic.
 - `comms_post_ask` — raise a structured ask (async; the answer arrives on a
   later turn).
 - `comms_list_messages` — read a channel's recent messages.
 - `compass_roster` — list the agent's neighborhood/subtree/owner roster.
 - `compass_set_status` — set the agent's presence activity.
+- `comms_create_channel` — create a channel (born open and ownerless).
+- `comms_update_members` — add/remove members and flip a member's subscribe
+  opt-in on a channel.
+- `comms_create_channel_group` — create a channel group (a namespace for
+  channels and nested groups).
+
+Each tool executes under the server-resolved caller (D9) with the same authz as
+a human: the agent presents no token, the Server resolves session → account and
+runs under `WithActor`, so a non-member or otherwise unauthorized call comes
+back as an in-band error (rendered as a thrown tool failure), never a transport
+teardown.
 
 `comms_post_ask` mints each `AskOption.id` as the option's zero-based index
 (a decimal string) — the native SDK ask option carries no id, and the id is the

packages/compass-agent/src/cli.test.ts

@@ -1999,7 +1999,7 @@ describe("main wires the mounted agent-config into createAgentSession", () => {
 			...createLifecycleTools(new LifecycleBroker(fakeTransport)),
 			...createForgeTools(new ForgeBroker(fakeTransport)),
 		];
-		expect(natives).toHaveLength(17);
+		expect(natives).toHaveLength(20);
 		for (const tool of natives) {
 			expect({ name: tool.name, arity: tool.execute.length }).toEqual({
 				name: tool.name,
@@ -2049,7 +2049,7 @@ describe("main wires the mounted agent-config into createAgentSession", () => {
 		// natives are ALWAYS merged in (SEA-1741/RIG-2672) — so customTools carries
 		// exactly those, and never a discovered MCP tool.
 		expect(toolNames(seen[0].customTools)).toContain("agents_spawn_peer");
-		expect(seen[0].customTools).toHaveLength(17);
+		expect(seen[0].customTools).toHaveLength(20);
 		expect(seen[0].enableMCP).toBe(false);
 	});
 
@@ -2082,7 +2082,7 @@ describe("main wires the mounted agent-config into createAgentSession", () => {
 		// (SEA-1741/RIG-2672) — so customTools is exactly the comms/lifecycle/forge
 		// natives.
 		expect(toolNames(seen[0].customTools)).toContain("comms_post_message");
-		expect(seen[0].customTools).toHaveLength(17);
+		expect(seen[0].customTools).toHaveLength(20);
 	});
 
 	// ── SEA-1732 T10: COMPASS_ROLE → prompts/<role>/SYSTEM.md → customSystemPrompt ──