[rigel-mintaka]

Summary

• This is the design record for the two Hermes fork patches Matt ruled on in RIG-8011 (Q1 A, Q2 B), for the RIG-7938 intake build.
• Q1 (DL-648): cotal turns may use the core discord toolset. On mesh turns, writes need discord.post_channels to hold the target. Reads refuse DM channels and channels outside the operator's guilds.
• Q2 (DL-649): a plugin with allow_origin_sessions may start a session at a bot-owned Discord thread, as plugin:<id>, under the session authority. The row is revalidated before it runs. Every row such a plugin injects runs in a fresh context with the cotal toolset list and the mesh scope. Its approval cards reach the operator as once or deny only.

Verification

• Every current-behaviour claim cites a file and function on rigel-release at c4093027.
• One design-critic pass found 3 high, 5 medium and 1 low; all are folded in.
• rumdl check, bun run ref-gate and bun run gate pass locally.

Risks

• Matt's condition is that approval prompts still reach him. The record states the preconditions (no yolo, mode not off, existing permanent grants still apply). Task 3 tests each one end to end.
• Decision 3 narrows plugin-injected turns to the cotal toolset. Matt can widen it at merge.

Compatibility

Nothing changes until the fork PR lands. The continuation path and native admission keep their behaviour.

Documentation

This PR is the documentation change.

Refs RIG-8011, RIG-7938
Ledger-impact: DL-648, DL-649

[linear-code]

RIG-8011

RIG-7938

[github-actions]

Rigel public design docs preview: https://nemo-intake-rig-8011-plugin.docs-2ui.pages.dev

Deployed from nemo-intake/rig-8011-plugin-origin at 71fcd77.

[rigel-mintaka]

Review note for head 71fcd77:

• review loop clean, 0 open high/medium;
• critic pass (3 high, 5 medium) and review round 1 (2 high, 2 medium) folded;
• head checks on a9c1995 (2 high, 2 medium) folded; the 71fcd77 head check is clean;
• check passes.