Skip to content

PointSav Documentation

The engineering library for the PointSav platform — operating systems and services for regulated businesses that own their data, their AI, and their record-keeping outright. Where the monorepo holds the code, this wiki holds the reasoning: architecture, services, security, and the governance commitments that bind future development.

PointSav Digital Systems

Totebox session

← All revisions

2136c5f3 · PointSav Digital Systems ·

fix(architecture): remove false correction on totebox-session.md's permission-tier table, fix stale console-os wikilink

View the full record as of this revision →

@@ -14,7 +14,7 @@ editor: pointsav-engineering
paired_with: totebox-session.es.md
---

A Totebox Session is an AI-assisted contributor session opened within a single [[totebox-archive|Totebox Archive]]. It is scoped to the archive's declared repositories and cannot write outside them. From the contributor's perspective, opening a Totebox Session is how every development task in [[totebox-orchestration|Totebox Orchestration]] begins. The session protocol mirrors the customer experience: the contributor's entry point in the workspace and the customer's entry point through [[console-os|`os-console`]] perform the same function.
A Totebox Session is an AI-assisted contributor session opened within a single [[totebox-archive|Totebox Archive]]. It is scoped to the archive's declared repositories and cannot write outside them. From the contributor's perspective, opening a Totebox Session is how every development task in [[totebox-orchestration|Totebox Orchestration]] begins. The session protocol mirrors the customer experience: the contributor's entry point in the workspace and the customer's entry point through [[os-console|`os-console`]] perform the same function.

This article describes how a session is opened, what it can and cannot do, the four permission tiers, and the inbox-and-outbox protocol that coordinates work across archives.

@@ -28,7 +28,7 @@ The intended entry point is the `open-archive` console command, planned for invo
4. Set the `FOUNDRY_ARCHIVE` and `FOUNDRY_MODULE_ID` environment variables
5. Open an AI session at the archive's root directory

This mirrors the customer experience: a community member or customer opens a [[totebox-archive|Totebox Archive]] through [[console-os|`os-console`]]. The development workflow uses the same entry point, adapted for the workspace.
This mirrors the customer experience: a community member or customer opens a [[totebox-archive|Totebox Archive]] through [[os-console|`os-console`]]. The development workflow uses the same entry point, adapted for the workspace.

## Session scope

@@ -73,8 +73,6 @@ In the planned next phase, `app-orchestration-command` (CommandCentre) is intend

## Permission tiers

**Correction (2026-08-02, verified against canonical `origin/main`):** the real `PairingRole` enum (`app-orchestration-command/crates/orchestration-command-core/src/lib.rs`) has exactly **three** roles — `User`, `Admin`, `Interface` — not four. This table invents a fourth by splitting Admin into "System Administrator" + "Package Manager." Same systemic finding as several `how-to/` articles this session. **Flagged, not resolved.**

Four tiers govern what a contributor — and the session they open — can do:

| Tier | Label | Pairing set |
@@ -84,11 +82,16 @@ Four tiers govern what a contributor — and the session they open — can do:
| P3 | User | Specific archives; no Command pairing; read-only cross-archive |
| P4 | Interface | Read-only API surface only |

This is the contributor's own permission tier, a distinct concept from the role granted by
an individual archive-pairing token (see [[pair-a-new-device]]) — a contributor's tier
governs what they can do across the workspace; a pairing token's role governs what one
specific archive pairing grants.

Tiers are enforced by pairings, not string comparisons. A P3 contributor's `os-console` is not paired to the Command — the connection does not exist. See [[pairing-as-permission]] for the formal mechanism.

## Relationship to os-console

[[console-os|`os-console`]] is the customer-facing entry point for opening a [[totebox-archive|Totebox Archive]]. In the development workspace, the `open-archive` command is the equivalent. Both are intended to perform the same function: read the archive manifest, validate the contributor's permission scope, set the session context, and open a working session inside the archive. The development environment uses the same pattern the customer is intended to use.
[[os-console|`os-console`]] is the customer-facing entry point for opening a [[totebox-archive|Totebox Archive]]. In the development workspace, the `open-archive` command is the equivalent. Both are intended to perform the same function: read the archive manifest, validate the contributor's permission scope, set the session context, and open a working session inside the archive. The development environment uses the same pattern the customer is intended to use.

## See also
Important Information

Corporate structure. PointSav Digital Systems ("PointSav") is currently a trade name of Woodfine Capital Projects Inc. ("Woodfine"), planned to become a wholly-owned Woodfine subsidiary upon incorporation. PointSav does not itself offer, sell, or solicit any security. Any securities offering associated with Woodfine's real-property direct-hold solutions is made exclusively by Woodfine, and only by means of the applicable Private Placement Memorandum.

No investment advice. This wiki's content is provided for engineering, operational, research, and development purposes. Nothing on this wiki constitutes investment advice or a solicitation to invest in any Woodfine partnership or direct-hold solution.

Intellectual property. The PointSav name, trade name, wordmark, and marks, together with all current and future PointSav- and Totebox-branded products, services, and offerings — and the software, source code, documentation, design system, and all related materials — are proprietary to Woodfine and its affiliates, except for components identified as open source. No rights are granted except as expressly set out in a written license or agreement. The full trademark notice appears in the footer of every page on this site.

Open source components. Portions of the platform are made available under permissive open-source licenses identified in the accompanying repository. Use of those components is governed by their respective license terms.

No warranty; informational use. Content on this wiki is provided for general informational purposes only and does not constitute a representation, warranty, or commitment with respect to product functionality, availability, pricing, or roadmap. Some articles describe planned or intended features, capabilities, and milestones — language such as "planned," "intended," "targeted," "may," and "expected" marks this forward-looking content, which is subject to change and does not constitute a commitment regarding future performance.

Confidentiality. Where an article describes an operational or deployment detail that is not intended for public disclosure, that article is not published on this wiki. Content here is general-purpose engineering documentation, not customer-specific configuration.

Jurisdiction. Woodfine Capital Projects Inc. is organized in British Columbia, Canada. References to the Sovereign Data Foundation on this wiki describe a planned or intended initiative only, not a current equity holder or active governance body.

Changes to this notice. PointSav may update this notice from time to time; the version posted on this page governs.

Not a filing system. This wiki is not a securities filing system, an electronic disclosure repository, or a substitute for SEDAR+ or any other regulatory filing system. Formal securities filings are made through the applicable regulatory filing system, not through this wiki.

Full disclaimer. This notice supplements, and does not replace, the full Disclaimers article. In the event of any conflict, the full Disclaimers article governs.

Read the full disclaimer →