Estimate: 24m · Depends on: 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7
Prove the gate end-to-end — the same split the other epics use (unit/component + a focused E2E). Component / unit (vitest, real Postgres): the browse + edit policy for every access level × project role (incl. the owner/admin bypass), the workspace-role migration mapping + the open project default, the go-private member-seeding, the last-admin guard, and assignable-users scoping. E2E (Playwright) tests/e2e/project-access.spec.ts: set the project private; a non-member is denied (absent from switcher + no-access state on direct nav); add them → they get in; a viewer cannot edit; an admin can manage members. Reuses the real-Postgres harness + the seeded team.
pnpm test covers the browse/edit policy matrix (level × role + bypass), the migration defaults, the go-private seeding + last-admin guard, and assignable-users scoping.pnpm test:e2e --grep project-access runs green: private-project denial + grant, the no-access state, viewer-cannot-edit, admin-manages-members.tests/helpers/db.ts truncation + the seeded team; no mocks beyond getSession.tests/helpers/db.ts; motir-core/CLAUDE.md (real Postgres, no mocks)