[DoodleBears]

Refs #4 · Claim

Why the change

An independent Agent can read and reply in one cloud channel using its own revocable identity, without receiving a Human session or organization privileges.

Special things to note

• Stacked on Direct channel guest invitations without organization membership #21. Draft, UAT only, no Prod or merge. First T3 sub-slice: HTTP Agent identity and harmless echo; WebSocket, fixed work, organization-wide Agents and two-Host integration remain open. Agent-Task: codex/local/01a148ae-ec7f-74b2-8157-961411ce54c9.
• Merge risk: two-way code door, additive Channel schema3 (D1/Org stay5/4). Revert disables Agent routes but retains grants. Large permission blast radius: review issuer qualification, hash-only persistence, local revoke recheck after external I/O and author identity.
• 45 workerd and 26 Node/CLI checks plus typecheck/build passed. UAT runtime31e3a4a deployed/smoke passed; independent HTTP reply, separate-process replay, scope/refusal and revoke denial passed. Mobile Batch17 creation/private handoff/reply/restart/revoke/logout passed in DeepSeekBot #2152. No email, Hosted AuthKit or local execution claim.

Change outline

Owner phone / CLI → public owner route → Channel DO Agent + hash + join floor
Independent Agent → credential verification → current issuer qualification
                  → Channel DO rechecks grant → existing message log
Owner revoke → subsequent old-key reads/sends denied

• CLI persists a random secret privately before issuing its hash; replay retains identity and secret, stdout returns only a file path and safe metadata.
• Agent read/send cannot use Human or other-channel routes. No caller-supplied author or management scopes.
• One-page reference echo client uses public HTTP, ignores Agent messages and uses deterministic reply keys; it executes no local work.
• Contract and proof boundaries. Phone UI/evidence is tracked separately in DeepSeekBot #2151.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}