Open a work session
Opens a work session (ws_) with a description, the agents to invite, the spaces it is linked to and its working set of files. Authorization: any authenticated member. With no spaceIds the session lands on the caller’s own private desk, created on demand — a desk session is private BY IDENTITY and can never be shared, so name a real space (here, or later with PATCH) for anything a colleague must see. Every named space must EXIST and is re-checked for space:contribute as the caller — either denial is 404, so a space’s existence is never leaked; an explicit me:* id is 400 cannot_target_desk (a desk is never a named target). An entry in spaceIds is a bare id or { spaceId, access }, where access is read or commit (default). Every id in fileIds is resolved the same way — it must exist and the caller must hold space:read on the space it lives in, otherwise 404. EVERY turn is scoped to this working set, so an id that cannot be read would refuse every later turn. The set is repairable: PATCH { fileIds } replaces it. Each agent must be published and not archived — a session pins its publishedVersionId — otherwise 422 agent_not_published. On success the caller is granted the work-session-owner role on the new work_session FGA resource.
Authentication
Bearer authentication of the form Bearer <token>, where token is your auth token.
Request
The session’s working set. EVERY turn the session runs is scoped to these files, plus whatever the comment that woke it attaches — a caller never has to re-send them.