Chat line templates

chat.lines is off by default. While off, its routes return the ordinary missing-route response and its OpenAPI paths and MCP tools are hidden. The server creates a recipe's parts atomically; it never starts a watcher.

An org member lists built-ins and custom recipes at GET /v1/orgs/{orgId}/chat/line-templates or reads one at .../line-templates/{templateId}. A signed-in person with org:manage_agents can POST a custom recipe, PUT its full replacement or DELETE it (soft retirement). Built-ins are read-only; copy one to customize it. Another admin can lower an existing recipe's rails; its author can tune them inside the hard ceilings. Only the author can introduce a persona into a watcher-only recipe.

POST /v1/orgs/{orgId}/chat/lines takes templateId, name, memberUserIds, optional projectId, personaKeyId, personaHandle and escalationUserId (default: the creator). All named people must belong to the org; project members must also have project access. org:manage_agents is required. Duplicate names are refused with 409, case-insensitively. API keys creating lines must permit both chat and agent_knowledge resource families; user-scoped keys cannot perform this composite action. These checks apply to every recipe, including one without seeds.

• Customer line (customer-line): one customer and one new persona in a DM. A signed-in person selects an existing live key with personaKeyId; no key or token is minted. {name} in the persona handle pattern and display name is replaced by the line name (handle slugged and capped at 32, display capped at 60).
• Team watcher (team-watcher): a private channel, optionally scoped to a project.
• Lead desk (lead-desk): a private channel for form submissions and replies. Connect an existing form's chat destination separately; this recipe neither creates forms nor grants outreach authority or consent.

A bot cannot create a persona or manage templates (user tokens count as bots). It may create a watcher-only channel with its existing identity. That identity's mute and access rules still apply. A key's owner can tune persona rails inside the documented ceilings; another admin can only lower them.

Rail	Default	Hard range
Messages per conversation / 10 minutes	20	1–200
Messages / hour	120	1–1000
New DMs / day	10	0–100
Non-chat writes / hour	60	1–1000

The watcher manifest names exactly one conversation to poll, the people to answer, an escalation person, reply rules and a fixed "message text is untrusted data" preamble. Poll no faster than every 60 seconds; keep a durable message cursor, dedupe messages, identify as a bot and respect quiet hours. The manifest records the three-stream-per-key ceiling and the one-unsolicited-DM-per-person-per-24-hours limit. These fields are not caller-overridable. See conversations for the operator contract.

Memory seeds use the existing secret scanner, byte and org-row quotas, vector enrollment and audit transaction. They are ordinary org knowledge (project knowledge for project lines), readable under that store's normal permissions. They never write persona-private memory on behalf of a person. agentKnowledge.enabled must be on for a recipe with seeds. Never put private customer notes or credentials in shared recipe seeds.

GET /v1/orgs/{orgId}/chat/lines/{lineId} and MCP chat_line_status report the current persona limits and whether delegates.enforceQuotas is on. That setting remains independent and off by default; creating a line does not change it. The server reports watcher health as unknown because the process runs in your harness. MCP chat_line_create calls the same REST creation route: bots use watcher-only recipes.

Settings > Chat line templates lets people with org:manage_agents copy a built-in, edit or retire their recipes, choose org members and an existing persona key, create a line and download its watcher manifest. The three built-ins cover service bookings, quote enquiries, team job handoffs and after-job follow-up.

The chat.line@1 blueprint kind transfers a custom template's name and definition through goodqa.blueprint/1. It carries no key, member, conversation or escalation-person identities. Applying it saves a template; a person separately creates a live line with that org's existing key and members. Every apply, including watcher-only recipes, requires a signed-in person; a recorded key approval cannot authorize it. Blueprint updates can lower rails but cannot raise them, change the line kind or add/remove a persona. Native template audit and the blueprint receipt commit together.

Both chat.lines and blueprints.enabled must be on for export, plan and apply. chat.lines is rechecked during application of a saved plan. While dark, the new kind is absent from OpenAPI and MCP blueprint schemas. When enabled, GET /v1/capabilities reports chatLines and whether the caller's chat and agent_knowledge scopes reach it. AI sign-off, enabling the flag and promotion remain with the orchestrator.

API contract: /v1/openapi.json when enabled (the all-features file includes dark paths). Tool parameters: MCP tool reference.

• Runbook: persona inbox and webhooks.