Make ordinary workspaces group shareable

docs/internal/workspace.md

@@ -16,6 +16,13 @@ consume those helpers instead of rebuilding relative paths.
 `internal/pathsafe` and application cleanup helpers enforce confinement for
 relative destinations and deletion targets.
 
+`internal/fileops` owns the ordinary workspace mode contract. On POSIX,
+`WorkspaceDirectoryMode` is setgid `02775` and `WorkspaceFileMode` is `0664`.
+`EnsureWorkspaceDirectory` reapplies the directory mode after creation so a
+restrictive umask cannot remove group access, while retaining existing ownership
+and group. Credential paths are outside this contract; the platform-specific
+operational requirements are in [Operations](../operations.md#workspace-permissions).
+
 ## Run-Local Stage Layout
 
 `internal/stage/run_local.go` maps stage outputs and diagnostics into an
@@ -58,6 +65,8 @@ deletion scope belong in [CLI](../cli.md#clean) and
 - campaign-aware session root is mandatory.
 - manifest-driven stage state is durable across runs.
 - cleanup guardrails prevent destructive root/out-of-scope deletion.
+- ordinary workspace paths retain group-writable directory and file modes across
+  nested creation, replacement, and Notarius promotion.
 
 ## Implementation And Tests
 
@@ -65,10 +74,11 @@ deletion scope belong in [CLI](../cli.md#clean) and
   `internal/artifacts/local.go`
 - Run-local materialization: `internal/stage/run_local.go`
 - Immutable bundle promotion: `internal/fileops/directory.go`
+- Workspace modes: `internal/fileops/modes.go`
 - Cleanup confinement: `internal/app/cleanup_targets.go`,
   `internal/app/post_publish_cleanup.go`
 - Tests: `internal/artifacts/paths_model_test.go`,
   `internal/artifacts/local_test.go`, `internal/stage/run_local_test.go`,
-  `internal/fileops/directory_test.go`,
+  `internal/fileops/directory_test.go`, `internal/fileops/modes_posix_test.go`,
   `internal/app/cleanup_targets_test.go`,
   `internal/app/post_publish_cleanup_test.go`

docs/operations.md

@@ -284,6 +284,26 @@ Cache layout (durable S3 audio cache):
 
 - `{cache.root}/s3/{bucket}/...`
 
+### Workspace Permissions
+
+Ordinary Narratio workspace content is intentionally shareable with the
+workspace group. On POSIX systems, Narratio-created workspace, spool, and cache
+directories converge on setgid `02775`; ordinary files, including manifests,
+transcripts, generated configuration, logs, reports, and Notarius artifacts,
+converge on `0664`. Narratio explicitly applies these modes so a restrictive
+caller umask does not remove group write or setgid. It does not change file or
+directory ownership: the configured workspace's existing group is inherited.
+
+Windows does not implement POSIX mode bits or setgid semantics. Configure the
+workspace, spool, and cache locations with an ACL that grants the collaborating
+group read/write access, and configure credential locations with an ACL limited
+to the intended credential owner. Do not use POSIX mode displays as evidence of
+Windows access control.
+
+API keys are credentials, not ordinary workspace data. Store them outside the
+shared workspace or in a separately restricted credential location; ordinary
+workspace group access must never be treated as authorization to read keys.
+
 ## Cleanup
 
 Session-scoped cleanup:

docs/policy/architecture.md

@@ -180,9 +180,19 @@ only when explicitly configured, and only through the path-safety guardrails.
 
 ## Security, Privacy, And Diagnostics
 
-Narratio handles private campaign material. Transcripts, prompts, generated
-artifacts, reports, logs, manifests, and diagnostic files are potentially
-sensitive.
+Narratio distinguishes ordinary workspace data from credentials. Campaign and
+session material—including manifests, transcripts, prompts, generated
+configuration, logs, reports, diagnostics, and Notarius artifacts—is
+intentionally shareable with the configured workspace group. API-key material
+is sensitive and is not covered by the ordinary workspace-sharing policy.
+
+On POSIX systems, Narratio-created ordinary workspace directories converge on
+setgid `02775` and ordinary workspace files on `0664`, even when the caller's
+umask is restrictive. This preserves the existing workspace group for nested
+creation and atomic replacements without changing ownership. API-key storage
+uses a separate restrictive contract. On Windows, POSIX mode bits and setgid
+are not authoritative; operators must provide the equivalent shared-group and
+credential-restricted ACLs described in [Operations](../operations.md#workspace-permissions).
 
 Raw secrets must not be stored in pipeline, campaign, or session YAML or written
 to manifests, logs, generated configuration, reports, publish metadata,

docs/roadmap/implementation.md

@@ -16,7 +16,7 @@ All stages are pending when this plan is created.
 
 | Stage | Summary | Primary findings | Status |
 | ---: | --- | --- | --- |
-| 1 | Align data classification and group workspace modes | RSK-004 | Pending |
+| 1 | Align data classification and group workspace modes | RSK-004 | Completed |
 | 2 | Enforce safe identifiers and fuzz path/source contracts | COR-002, TST-013 | Pending |
 | 3 | Consolidate crash-durable atomic file replacement | RSK-002, DUP-001, DUP-005 | Pending |
 | 4 | Add confined destination and download/install capabilities | COR-003, DUP-003, TST-003 | Pending |