Add LLM Agent UX specification document#11
Merged
Conversation
intendednull
added a commit
that referenced
this pull request
Apr 25, 2026
- Add Status header noting post-state-machine refactor alignment - §1: clarify PeerKind/SetProfile additions are NEW; spell out the proposed extended SetProfile event with optional fields - §2 Member List: correct section order (Infrastructure → Members today; Agents inserted between them) with explicit alternative considered - §2 Message Rendering: drop the non-existent "verified/role badge" comparison; note the bot badge is wholly new UI - §3 Threading: switch from legacy Content::Reply to canonical EventKind::Message reply_to field - §4 Permissions: rewrite table to match canonical willow_state::Permission (drop ReadMessages/ManageMessages/AttachFiles/BanMembers); flag that pin/moderate/attach require new Permission variants - §4 Trust Model: clarify Kick + RotateChannelKey are two separate events composed at the client layer, not atomic in the state machine; flag optional future EventKind::KickAndRotate - §5 Streaming: resolve internal contradiction by making chunks pure WireMessage (ephemeral) and the final body the only EventKind::Message - §6 Indicators: replace fictional EphemeralMessage enum with new WireMessage variants alongside existing TypingIndicator - §9 Worker Node: clarify WorkerRole is a trait and WorkerRoleInfo is a separate enum; rename Agent → Bot to match existing future-marker; keep WorkerRoleInfo capacity-only (identity stays on Profile); correct gossipsub topic claim (no per-channel topic; uses _willow_server_ops) - §10: state machine no longer carries stream variants on Content - §11: replace fictional ApplyResult::Skipped and "[unsupported message type]" claims with real bincode-tagged-enum behavior; propose EventKind::Unknown / WireMessage::Unknown forward-compat catch-alls - §12: add Phase 0 (forward-compat foundation) and Phase 6 (optional atomic Kick+Rotate); note current PR worktree has no agent crate - §9 Configuration: note crate state caveat (none in this PR worktree) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Covers identity (PeerKind), UI treatment (bot badges, streaming messages, collapsible responses), interaction model (@mention, threading, slash commands), permissions, privacy/encryption transparency, and the agent worker node implementation. Phased into 5 stages from foundation through discovery. https://claude.ai/code/session_01TgUPyTo1tN4UuwNbNXCR8j
- Agent dangerous permissions (Admin, KickMembers, etc.) are allowed but gated behind a confirmation dialog instead of hard-blocked. - Agents use the same E2E encryption as human members — no special cleartext mode. The only distinction is the data policy (local vs cloud) which determines what happens post-decryption. https://claude.ai/code/session_01TgUPyTo1tN4UuwNbNXCR8j
- Add Status header noting post-state-machine refactor alignment - §1: clarify PeerKind/SetProfile additions are NEW; spell out the proposed extended SetProfile event with optional fields - §2 Member List: correct section order (Infrastructure → Members today; Agents inserted between them) with explicit alternative considered - §2 Message Rendering: drop the non-existent "verified/role badge" comparison; note the bot badge is wholly new UI - §3 Threading: switch from legacy Content::Reply to canonical EventKind::Message reply_to field - §4 Permissions: rewrite table to match canonical willow_state::Permission (drop ReadMessages/ManageMessages/AttachFiles/BanMembers); flag that pin/moderate/attach require new Permission variants - §4 Trust Model: clarify Kick + RotateChannelKey are two separate events composed at the client layer, not atomic in the state machine; flag optional future EventKind::KickAndRotate - §5 Streaming: resolve internal contradiction by making chunks pure WireMessage (ephemeral) and the final body the only EventKind::Message - §6 Indicators: replace fictional EphemeralMessage enum with new WireMessage variants alongside existing TypingIndicator - §9 Worker Node: clarify WorkerRole is a trait and WorkerRoleInfo is a separate enum; rename Agent → Bot to match existing future-marker; keep WorkerRoleInfo capacity-only (identity stays on Profile); correct gossipsub topic claim (no per-channel topic; uses _willow_server_ops) - §10: state machine no longer carries stream variants on Content - §11: replace fictional ApplyResult::Skipped and "[unsupported message type]" claims with real bincode-tagged-enum behavior; propose EventKind::Unknown / WireMessage::Unknown forward-compat catch-alls - §12: add Phase 0 (forward-compat foundation) and Phase 6 (optional atomic Kick+Rotate); note current PR worktree has no agent crate - §9 Configuration: note crate state caveat (none in this PR worktree) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The Phase 1 checklist marked "Add collapsible long messages (already shipped)", but the body-collapse / "Show more" toggle does not exist in crates/web/src/components/message.rs on main. Re-flag it as net-new work so the phase plan reflects reality. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
intendednull
force-pushed
the
claude/llm-agent-ux-spec-H11cV
branch
from
718cbc1 to
8f01502
Compare
- Profile/UpdateProfile/ProfileDelta acknowledged; peer_kind/data_policy
added there (not on legacy SetProfile) following the established
serde-default extend-pattern from the 2026-04-19 profile-card work
- Permission: 5 actual variants; Administrator/KickMembers replaced
with governance via state.is_admin() + ProposedAction
- KickMember spelled as Propose { action: ProposedAction::KickMember }
in §4 trust model and §7 server settings
- ApplyResult: 3 actual variants (Applied/Rejected/AlreadyApplied)
- reply_to: Option<EventHash>; final_event_id: EventHash;
SetAgentConfig.peer_id: EndpointId
- Per-channel topics acknowledged (channel_topic, voice_topic);
prefer typed network::topics::* over string constants
- Distinguish proposed willow-bot worker (new crates/bot) from existing
willow-agent MCP crate (crates/agent)
- Encryption: open design question for EventKind::Message.body vs
SealedContent surfaced in §3 + §8
- Unknown variants: bincode tagged-enum limitation acknowledged;
versioned-envelope (Option B) preferred over custom Deserialize
- WorkerRoleInfo::role_name() non-exhaustive match arm + PartialEq
considerations called out
- SetAgentConfig admin gate routed through admin-only matches! block
in check_permission, NOT required_permission()
- Regenerate = DeleteMessage + new Message; author-only delete
contract documented (state machine currently lacks the gate)
- Phase 6 atomic Kick+Rotate framed as ProposedAction (preferred) vs
top-level EventKind tradeoff
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- State machine already enforces author-only DeleteMessage; spec proposal LOOSENS to moderators (not tightens) - Owner-override cite: check_and_apply_proposal at materialize.rs:188-209 - role_name() match wording: exhaustive today, new variant requires matching arm - UpdateProfile cite tightened to event.rs:150-168 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR introduces a comprehensive design specification for LLM-powered agents in Willow. The spec defines how agents integrate as first-class participants in servers, including their identity, UI treatment, interaction model, permissions, streaming responses, and privacy considerations.
Key Changes
PeerKindenum to distinguish agents from human members, with provider information and presence states (online, thinking, offline)StreamStart/StreamChunk/StreamEndcontent variants with UI behavior and replay semanticsThinking/StoppedThinkingmessages for real-time feedback during inferenceDataPolicyfield for data handling transparencyAgentRoleworker node architecture, TOML configuration format, new event kinds (SetAgentConfig), and content variantsNotable Implementation Details
SetAgentConfigeventhttps://claude.ai/code/session_01TgUPyTo1tN4UuwNbNXCR8j