operator-surface-authority-designer

name	operator-surface-authority-designer
description	Decide which single operator surface — Scout, FleetBar, or pd-console — owns each capability by its distance-from-work (intake/ambient/deep), and audit that placement for authority spread, unenforceable controls, evidence overflow into FleetBar, and hot/cool bus-subscription mismatches. Use when placing a new capability on one of Agent Harbor's three operator surfaces, reconciling a mockup that duplicates a capability across two surfaces, or auditing an existing operator-surface spec before implementation locks it in. NOT for choosing SDK/CLI/MCP/GUI surfaces for API-consuming developers (developer-surface-strategist), designing the concrete interaction flow within one already-assigned surface (agentic-coding-ux-designer), or the hot-bus/cool-bus transport mechanics themselves (swarm-invocation-designer).
license	Apache-2.0
allowed-tools	Read,Write,Edit,Bash,Grep,Glob
metadata	{"category":"Agent & Orchestration","tags":["operator-surfaces","authority-model","fleetbar","pd-console","human-gate"],"provenance":{"kind":"first-party","owners":["port-daddy"]},"pairs-with":[{"skill":"swarm-invocation-designer","reason":"Builds the hot-bus/cool-bus transport mechanics behind the busSubscription category this skill assigns."},{"skill":"human-gate-designer","reason":"Designs the actual approval UX for a human-gate capability once this skill places it on FleetBar."},{"skill":"agentic-coding-ux-designer","reason":"Designs the concrete interaction flow within a surface once this skill has decided which surface owns the capability."}],"io-contract":{"kind":"deliverable","consumes":["[Truncated]","[Truncated]"],"produces":["[Truncated]","[Truncated]"]}}

Operator Surface Authority Designer

Decide which one of Scout, FleetBar, or pd-console owns a capability — by distance-from-work, not by which surface was fastest to build it in.

Use This For

• Placing a new capability on Scout, FleetBar, or pd-console when speccing Agent Harbor's operator triad.
• Reconciling a mockup or prototype that built the same affordance on two surfaces before either was canonical.
• Deciding whether a capability's evidence weight means it belongs on pd-console instead of FleetBar's popover.
• Choosing a capability's hot-bus vs. cool-bus subscription so it matches its declared distance.
• Auditing an existing operator-surface spec for authority spread, ungated controls, or a surface quietly owning runtime state before implementation locks it in.

Do Not Use This For

• Choosing SDK/CLI/MCP/GUI/API/webhook surfaces for developers who consume the product programmatically (developer-surface-strategist).
• Designing the concrete interaction flow, copy, or motion within one already-assigned surface (agentic-coding-ux-designer).
• Implementing the hot-bus/cool-bus transport itself — the multiplexed WebSocket, message envelopes, latency budgets (swarm-invocation-designer).

Distance-Based Authority Model

flowchart TD
  A[New or disputed capability] --> B{What is its distance from the work?}
  B -->|inside the artifact, at observation| C[intake -> Scout]
  B -->|ambient, glanceable, consent-only| D[ambient -> FleetBar]
  B -->|seated, full-evidence inspection| E[deep -> pd-console]
  C --> F{Evidence screens > 1?}
  D --> F
  E --> F
  F -->|yes, and surface is FleetBar| G[Move to pd-console; FleetBar deep-links instead]
  F -->|no| H{Daemon can enforce every rendered control?}
  G --> H
  H -->|no| I[Do not ship the control yet]
  H -->|yes| J{Bus subscription matches distance?}
  J -->|intake/deep must be cool, ambient may mix| K[Fix subscription or reclassify distance]
  J -->|matches| L[Run scripts/surface_authority_audit.mjs]
  K --> L
  L -->|pass: true| M[Ship: exactly one owner, enforceable, no owned runtime state]

1. Classify the capability's distance. Is the operator acting at the point of observation (intake), glancing at ambient status or granting consent (ambient), or seated doing deep inspection (deep)? See references/distance-based-authority-model.md.
2. Assign the one canonical surface for that distance. intake → Scout, ambient → FleetBar, deep → pd-console. Never let a capability claim two surfaces, and never leave one with no valid surface at all.