[immakermatty]

The template side of M2 in plan DEV-6662 (Lazurio/LazurioPlatform#359): personal module creation with lazurio module create personalspace/<slug> (LazurioPlatform draft PRs Lazurio/LazurioPlatform#394, #396 and #399). This PR is independent of them; it can merge in any order.

Why

The Operator decided on 2026-10-13 (Lazurio root decision 0171, addendum of 2026-10-13) that personal module leases come from a module_port_pool declared in the Personalspace's modules.manifest.json. It is a reserved range that Organization pools never use, and the template carries it. The Platform chose 23000–23099 (decision F52):

• 100 ports, the size of an Organization pool;
• below every Organization pool on record (they start at 24000);
• clear of the Environment's own ports (443, 3773, 4102, 4103, 4174, 4180, 4789, 4848, 9222, 20000);
• below every operating system's ephemeral range.

What

• modules.manifest.json declares "module_port_pool": { "start": 23000, "end": 23099 }. Its layout is exactly what the Platform writes into an older Personalspace together with the slot of its first module.
• scripts/personalspace-lib.mjs has PERSONAL_MODULE_PORT_POOL and modulePortPoolIssues(manifest). The pool may be absent: a Personalspace created before this gets it in the pull request that declares its first module. When declared, it must be {start, end} inside 23000–23099. The rule is checked in three places:
  • check:template;
  • check:static-instance;
  • the Doctor's personalspace.profile_materialization, through validatePersonalState.
• .gitignore ignores .worktrees/. This is a safety net: the Platform puts the Personalspace's task worktrees beside it, in personalspace/.worktrees/<task>, never inside it. No check requires the line, so older instances are not failed for lacking it.
• AGENTS.md ("Osobní moduly") and README describe how a personal module is made: dry run, the person's confirmation, --confirm, the slot by pull request, where the task worktree goes, and the pool.
• Tests:
  • the pool rule;
  • bootstrap keeping the pool;
  • materialization refusing a pool outside the range;
  • a slot exactly as lazurio module create declares it (workspace/<slug>, slug, space, private, ["owner"], status: active, git.url of the owner's repository) passing both validatePersonalState and the Doctor's modules.repo_private with the pool.

Deliberately not here

• No check makes the pool or .worktrees/ mandatory. Instances made before would fail CI on every unrelated pull request. The Platform adds the pool with the first module.
• Nothing about naming the owner (personalspace install leaves the template's placeholders in the person's Personalspace LazurioPlatform#377).

Verification

• bun run check passes in this branch: template contract, history audit, doctor surface, and 28 + 46 tests.
• Simulated placeholder instance. A Personalspace exactly as lazurio personalspace install leaves it (owner placeholders, the example slot), plus the pool and two personal module slots written by a real run of the Platform's lazurio module create.
  • bun run check passes with both the scripts of main and those of this branch.
  • Its CI runs check:template, because the owner is still the placeholder, and accepts the slots and the pool.

Open (issues are disabled here, so noted for the reviewer)

1. The Doctor and placeholder instances (personalspace install leaves the template's placeholders in the person's Personalspace LazurioPlatform#377). On an instance that still has the template's placeholders, the live Doctor (bun run doctor, not CI) derives the owner from personal.gen3.json's placeholder login. It then reports:

   • personalspace.profile_materialization, github.session and personalspace.collaborators as fail (already true today);
   • modules.repo_private as fail for every personal module repository: GitHub lists the real owner among a user repository's collaborators, and the Doctor reads that owner as a "forbidden collaborator", as it already does for the Personalspace repository itself.

   This PR does not work around it. Naming the owner is #377's fix (the coordinator is shaping it).

2. "Organization pools never use 23000–23099" holds today by record, not by a check. The root doctor and the Organization template's pool check should refuse an overlap. That is tracked in Organization pools: refuse a module_port_pool overlapping the reserved personal range 23000-23099 HumanAndMachines/Lazurio#545.

🤖 Generated with Claude Code

Note

Reserve personal module port pool 23000-23099 and ignore .worktrees/

• Adds the canonical PERSONAL_MODULE_PORT_POOL constant (ports 23000-23099) and a modulePortPoolIssues validator in personalspace-lib.mjs. The optional module_port_pool manifest field must have integer start/end bounds inside the reserved range; an omitted pool stays valid.
• Wires the pool validator into validatePersonalState, check-instance-static.mjs, and check-template.mjs so invalid pools fail both static instance and template validation.
• Documents the personal-module workflow in AGENTS.md and README.md, and adds the reserved pool to modules.manifest.json.
• Ignores .worktrees/ directories in .gitignore.
• Adds unit and integration tests covering valid/invalid pool shapes, pool preservation in manifests, and doctor checks for private personal modules.
• Risk: manifests that declare module_port_pool outside 23000-23099 now fail validatePersonalState and the static/template checks.

^{Macroscope summarized dcd7a96.}

[agentrozjedemeai]

Exact-head review of dcd7a96 (DEV-6662 M2 template). The optional pool is restricted to 23000-23099 in the template check, static-instance check, and Doctor materialization; legacy manifests without the field remain valid. The generated personal slot and private-repository checks are exercised. In an isolated checkout, bun run check passed (28 Doctor tests; 46 library/skills tests), diff --check is clean, and the Ubuntu/Windows checks are green. Approved independently of Platform #394; this review does not approve that generator or the later CLI stack.