Knowledge, review and coordination

Each employee has a private knowledge store as well as their mail and document index. The records are readable text files with metadata: title, author, revision, status, and update time. A separate full-text database makes those notes searchable. The records are authoritative; the search database can be rebuilt. Previous note versions are retained, and saved knowledge survives a browser session.

The company layer is separate. An employee chooses the text to promote and creates a company draft. The draft remains private to its author until submitted for review. A different employee with collection access must approve it. The agent cannot publish. Reviews expire after three days. Once approved, the note becomes searchable in the shared company collection or its department, with its author, reviewer, and revision recorded.

The application connects durable knowledge to the real assistant through search, read, private-save, and proposal tools. Every call checks the signed access grant. Employees can retrieve their own private notes and approved records from the shared company collection or their department. Citations reopen the authorized record. Conversation history is separate: these maintained notes remain available when the employee returns in a later browser session.

Suppose one employee asks a coworker’s assistant to check for matching project records. Rufous creates a signed message with an identity, a message identifier, and a correlation identifier. The durable message service routes it to the scoped recipient worker. That worker searches its own index. This handoff is a focused record lookup, not an autonomous negotiation between assistants.

The return path carries a limited aggregate: how many records matched, their source types, and the newest date. The reply carries the original correlation identifier so the requester can follow the outcome. It does not include the recipient’s mail bodies, document text, or snippets. Durable consumers acknowledge messages, and message identifiers suppress duplicates when delivery is retried.

Operations sees linked events and health evidence, while the shared audit omits private prompts and redacts the handoff query. Management and IT remain restricted from raw employee records, including through direct API calls. Persistent delivery supports restart and replay, but this single-node demo still needs backups for host loss. Temporary visitor workspaces expire, removing their owned artifacts and stopping active turns.