Summary

• Feature-flagged (cedar-task-admin-view PostHog flag, off by default) picker letting org owners/admins view a teammate's tasks , List, Kanban, and Agenda , reusing the real row/card/column components with every write path removed, rather than a parallel interactive surface.
• userTasks.listUserTasks and taskGroups.listGroups accept targetUserId, authorized through the existing task:user (SELF_OR_ORG_ADMIN) policy in services/auth/authorize.ts , no policy table changes needed.
• Agenda required the most care: editor.setEditable(false) alone doesn't stop a keymap-bound transaction from syncing to the teammate's live Y.Doc, so every mutating handler and keyboard shortcut in AgendaTaskNode/DateHeadingNode (8 + 2 handlers) now also checks editor.isEditable directly, and the drag extensions aren't mounted at all while administering.
• Both read-only views wire useScopeHonoured/ScopeNotHonouredNotice , the existing runtime check (already used by /brain/playbooks) that catches a route silently answering with the caller's own rows instead of the teammate's.

Test plan

• pnpm --filter @zero/mail run types , clean (only pre-existing unrelated errors in conversationTool.ts)
• pnpm --filter @zero/server run types , clean (same pre-existing errors)
• pnpm --filter @zero/mail exec jest tests/modules/administeredUser/contract-coverage.test.ts , 3/3 passing
• pnpm deps:check , 0 violations
• Manually traced every addKeyboardShortcuts() handler in AgendaTaskNode.tsx/DateHeadingNode.tsx for the editor.isEditable guard
• Manual click-through in a running dev app (not done in this session , no browser access)
• Create the cedar-task-admin-view PostHog flag in prod and roll out to a pilot admin before wider release

🤖 Generated with Claude Code

Confidence Score: 3/5

The PR is not safe to merge until the read-only agenda stops exposing self-scoped mutations and the administered task views preserve tasks when group metadata is unavailable.

Findings

1.  Footer Mutates Wrong Agenda ▶
2.  Group Loading Hides Tasks ▶
3.  Assertions Bypass Inferred Types ▶

### Issue 1
apps/mail/modules/agentCanvas/components/AgendaDocument.tsx:1601-1603
When an administrator views a teammate's current agenda, this footer remains interactive even though the surface is read-only. Its count query and `agenda.refill`/`agenda.rerun` mutations do not carry `targetUserId`, and both server mutations operate on `ctx.sessionUser.id`. The footer therefore combines the teammate's displayed agenda with the administrator's task count, and clicking “Pull in more” or “Re-execute” unexpectedly modifies the administrator's own agenda. Hide or fully scope these controls while administering another us