maestro: expose a constrained manager-agent orchestration API

[guicybercode]

Context

A manager agent can coordinate developers, reviewers, and testers, but granting it a generic shell or unrestricted daemon API would undermine local safety and user control.

Goal

Introduce a constrained Maestro capability API for managing a task team through typed, policy-checked operations.

Allowed operation candidates

• inspect task/team/status;
• create or assign an agent session from approved definitions;
• assign a role;
• connect agents or notes;
• send a structured message;
• request stop/close;
• mark task phase/result.

Acceptance criteria

• Maestro receives no generic shell-execution or arbitrary-path operation.
• Every mutation is validated against the current task and session generation.
• Destructive or data-affecting actions use the same user-confirmation gates as the UI.
• Policy limits bound spawned sessions, messages, retries, and orchestration depth.
• Infinite create/message loops are detected and stopped.
• Every action records actor, operation, target IDs, result code, and timestamp without sensitive payloads.
• The user can pause or revoke Maestro capability immediately.
• A failed Maestro process cannot leave mutation locks or half-created sessions.
• Integration tests use a deterministic fake manager agent.

Dependencies

Task aggregates, role profiles, adapter capabilities, and agent messaging must exist first.

Out of scope

Unsupervised cloud execution and organization-wide permissions.