Per operator direction (no privileged mode; everything is perms /
capabilities), remove the socket-derived `privileged: bool` from the
unified dispatch and gate every verb on the caller's identity instead:
- serve/dispatch/dispatch_shared/dispatch_orchestration + all lifecycle
handlers drop the `privileged` param.
- lifecycle (start/kill/restart/update/init_config/apply_commit) + get_logs
gate on `topology::is_descendant_of` (a parent owns its whole subtree; the
root covers every agent as a consequence, no positional privilege). The
restart infra-branch stays InfraAdmin-gated (orthogonal).
- agent-state queries (loose-ends / reminder count + rollup): own subtree is
free, other agents + the hive-wide `"*"` sweep require QueryAgentState.
require_new_child + resolve_agent_state_target widened direct-child -> subtree.
- hive-wide orchestration verbs gate on the grantable tool-group via
tool_groups::groups_for: schedules -> `scheduling`, meta-inputs +
cancel-approval -> `approvals`. update_meta_inputs now attributes the
approval to the caller, not a hardcoded MANAGER_AGENT.
- #1834 cancel-guard unwind: handle_cancel_loose_end drops `privileged`
(agent path is never privileged); question/reminder cancels are
ownership-only, approval cancel checks the `approvals` tool-group.
The manager socket stays as pure transport (serves agent=ruth, no authority
of its own); collapsing it into ruth's per-agent socket is the #1825
follow-up. No is_root here — root-identity primitives are #1825's.
53b4e752ef