Live rights propagation: role/permission/channel changes must reach connected sessions without reconnect

[antra-tess]

Need

Operator workflow is now: create a channel, grant a persona a role, expect the agent to see it — frequently, and live. Today none of that reaches a connected session: per-persona channel sets are computed at identify and never updated, so every rights change requires reconnecting the client (for resident agents: a full framework restart, ~30s + an interrupted turn).

Observed (2026-07-27, persona rhys-982b1d)

• Operator created a channel in the Connectome guild and added a live access role (rhysrole, channel-scoped) to the persona while its session was connected.
• Relay-side was immediately correct: permissions.json hot-reloads, capsFor resolves per-call — an RPC like list_channels would have shown the new channel.
• But no event reached the session: the client's cached channel set and the downstream agent-framework channel registry (654 entries) did not contain the new channel until the agent was restarted and the session re-identified. Confirmed by diffing the registry before/after restart.

What already exists (this is mostly a relay-trigger gap)

• Client wire + API already handle channel change: PortalClient emits channelChange(channel) and maintains a cache (portal-client/src/client.ts).
• portal-mcpl can forward to host frameworks: mcpl-core now has CHANNELS_CHANGED / ChannelsChangedParams (feat(mcpl): extend channel lifecycle protocol, pushed 2026-07-27).
• Config stores are WatchedFiles — the relay already knows the moment permissions/roles/guilds change.

Proposed

On any of:

1. permissions/roles/invites/guilds hot-reload,
2. Discord channelCreate/channelDelete/channelUpdate (and role/permission-overwrite updates affecting mirrors),
3. admin-panel mutations,

recompute affected personas' channel sets (mirror cache invalidation already exists from the 0.4.0 mirrorCaps work), diff against each connected session's last-delivered set, and emit channelChange adds/removes (with caps) to those sessions. portal-mcpl forwards them as MCPL channels/changed so agent registries update in place — channels appear/disappear for residents in real time, no reconnect, no restart.

Nice-to-have: an admin-panel "resync persona" button that force-emits a full set diff, as a manual fallback.

Also worth folding in

• Enroll-time snapshot semantics of inline grant+mirrorRole (RFC-004 note): snapshotted personas can never benefit from live propagation — consider warning at mint time, since this bit twice now (lighthouse-mythos 2026-07-14, and it's why rhys-982b1d's base grant is frozen while rhysrole tracks live).

🤖 Generated with Claude Code