Link node type: global links, public links (/l/{publicId}) with delegated read, and an org-wide group partition

[rbuergi]

What

A platform Link node type (Essentials): LinkContent { target, publicId?, expiresAt?, note }. The link's page renders the target's default view through the target's own hub as the link's viewer — a link grants nothing by itself: whoever can read the target reads it here, nobody else. Safe to put in any home, space or course.

• Public link: an unguessable publicId, an Anonymous Viewer grant on the link node, and /l/{publicId} serving the target's rendered view through a delegated read — the creator's right to the target captured at creation, re-checked at each render, expiring with expiresAt. Revoking the link revokes the read; the target's grants are never widened.
• Governed creation: link.publish as a Governance standard (inputs target / audience / expiry; gates Manual("content-reviewed") + a passkey-backed signature by the target space's admin; executor CreateLink as System) and link.revoke unattended for the creator — see Systemorph/MeshWeaver.Plugins#1848's design § "Global links, public links, and a /public-link skill".
• /public-link skill: propose, follow, hand back the URL; audit every public link (target, audience, expiry, signer).
• Org-wide audience: group grants resolve only inside the partition holding the group (Skill/group), so "share with Systemorph employees" needs a platform-level group partition (Groups/{org}) whose grants resolve cross-partition.

Why

Maintainer, 2026-09-14: "some global link feature? would come in handy … including public link skill … with approval steps and all the sh-bang" — today a design page can only be shared by copying it into a space and granting there.

🤖 Generated with Claude Code

https://claude.ai/code/session_016r2xu5Mebm6MnUUQSfbro3

[rbuergi]

Status from a read-only sweep: slice 1 has landed as data in MeshWeaver.Plugins; nothing in the code half exists yet

Checked origin/main of both repos on 2026-09-15 (core b8da52e054, MeshWeaver.Plugins at its origin/main).

Landed — Governance/Standards/link.publish.json exists in MeshWeaver.Plugins (4f9700677, 2026-09-14 11:59, "docs(Governance): anyone proposes; the catalogue of every governed act …"). It carries the three inputs from this issue verbatim (target, audience, expiresAt), the manual:content-reviewed gate, and names this issue in its own description. Governance/Catalogue.md:101 lists the row person / agent → Manual("content-reviewed") → the space's admin (passkey) → CreateLink (System), and Governance/Design.md:505-515 is the design of record. So the governed act is declared; the standard's own text says "Slice 2's CreateLink executor runs as System; slice 1 records".

Not landed — everything the standard would drive:

• no Link node type and no LinkContent anywhere in code: LinkContent matches only Governance/Design.md; there is no nodeType: Link node in either repo;
• no CreateLink executor — the only CreateLink* hits in src/ are CancellationTokenSource.CreateLinkedTokenSource;
• no /l/{publicId} route, no delegated-read capture, no link.revoke standard file (only the catalogue row), no /public-link skill node;
• the org-wide group partition (Groups/{org}) is unbuilt, and it is the piece with no design detail beyond one paragraph — worth splitting out, since "anonymous" and "signed-in" audiences do not need it but "share with Systemorph employees" is blocked on it alone.

Cross-reference: the passkey half of the link.publish gate is #4305, which is in the same state — design of record at Governance/Design.md:473-494, nothing implemented (no WebAuthn endpoint, no {user}/_Passkey node; the only passkey hits in core src/ are FluentIcons.cs and two doc pages). So link.publish cannot be satisfied as specified until #4305 ships, and slice 2 should say which assurance it requires in the interim rather than shipping a link feature whose gate silently degrades to a plain click.

Leaving this open — it is a design item, not a defect; this comment is only so the next reader does not re-derive which half exists.