From 807febf3798952e9bb2e55a7781bb2e252ec2357 Mon Sep 17 00:00:00 2001 From: Lily Shen <115414357+lilyshen0722@users.noreply.github.com> Date: Tue, 29 Sep 2026 20:40:21 -0700 Subject: [PATCH 1/4] =?UTF-8?q?docs(plans):=20matrix=20rows=20for=202026-0?= =?UTF-8?q?9-29=20=E2=80=94=20Discord=20listed,=20GitHub=20grant=20renewed?= =?UTF-8?q?,=20Rewire=20relay=20restored,=20hosted-MCP=20live?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Discord: C0 moves from "not offered" to "listed, not offered". #1826 is live, and the catalogue returns discord with offered:false, since commonly.me has no Discord keys. C1 stays red (TASK-104). - GitHub (app): a new owner grant (grant_3c4d6ad5, the same scope as 09-18) runs to 2026-10-06, so C3, C4 and C8 are walkable again; none has been walked on the current build. - Telegram walk notes: Rewire Live Demo relay restored by reactivating Sam's existing row. - New row: the hosted-MCP generic type (TASK-172). Every §10 build step is live on 2322de60; the catalogue is empty; the first entry is open for Sam (Linear if its tools/list annotates, else Sentry). - Decisions for Sam: item 4 (the #1826 renders) is done. Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_013geJsV4RJMujdvpf3JV2Cv --- docs/plans/integration-readiness-matrix.md | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/docs/plans/integration-readiness-matrix.md b/docs/plans/integration-readiness-matrix.md index 01b574afc..d715d3287 100644 --- a/docs/plans/integration-readiness-matrix.md +++ b/docs/plans/integration-readiness-matrix.md @@ -49,10 +49,11 @@ The matrix below is the definition of "ready". A row is ready when every cell is |---|---|---| | Telegram | yes | Re-walked live 2026-09-27 on `c941626b` with a real account (below). **C1 green**: the code typed exactly as the page shows it, spaces and a capitalised group included, binds on the first try (#1931 TASK-153, #1932 TASK-157); on `7ccc6ac2` the same form was refused. **More than one pod, green outbound**: a second pod switched on under "Pods that reach this channel" relayed its agent's line to the chat within the minute, and a line typed in the chat went only to the active pod, as the connector is built (one private chat binds one Commonly user, pods behind it as gates; TASK-154, ruled by Wren). **C3 green** (an agent line relayed) and **C5 inbound green** with sender identity ("Sam Xu (via Telegram)"). C10 green: both refusals are named, and since #1878 a dead chat is a named failure. Shipped since the re-walk: relayed lines now carry their pod's name (#1935, TASK-156; seen live on `19d1d3e2` as "[Connector walk 0926] Scout: PONG-TAG"), and a quote-reply routes to the quoted line's pod or is refused by name (#1935; unit-witnessed, not walked live). The catalogue row names the multi-pod model (#1957, TASK-158) | | Slack | yes | Walked live 2026-09-26/27 on `7ccc6ac2` with a real workspace (below). **C1, C3 and C5 green**: connect through consent, callback and confirm; a hosted agent's reply relays to Slack; a Slack mention reaches the agent and its answer comes back. C5 inbound was green only after two Slack app settings were fixed during the walk. Red for customers until the app was publicly distributed, which is now done, and the distribution attestation is now true of the running backend: #1929 (TASK-151) removed every `SLACK_BOT_TOKEN`/`SLACK_APP_TOKEN` read and injection, live on `f5eb5563`. A second authorize on a connected row is refused with 409 `slack_already_authorized` (measured through the API); the refusal copy on the page (#1890, Row C) is still unwalked in the UI. Before #1875 (09-04 to 09-25), every new install was refused at Authorize | -| Discord | partly | **red** in C0: not offered on the Connectors page (#1826, held for Sam's read of the renders). **red** in C1: not connectable (TASK-104). Two different fixes | +| Discord | partly | **C0 listed, not offered**: #1826 (Sam approved 2026-09-29) gives Discord its own row, live since `96cc9711` (2026-09-29 12:11Z). `/api/installables` returns `discord` under `channels` with `available: true, offered: false`, because commonly.me has no Discord keys set, so a stranger sees "Not enabled on this instance · ask your operator" rather than a merged "not yet" row. **red** in C1: not connectable (TASK-104) | | GroupMe | yes | **red**: TASK-101 | | X | yes (admin OAuth callback + feed) | unverified | -| GitHub (app) | yes | Walked 2026-09-25 and re-walked 2026-09-26 on `5561a1dd` (both below). Live on our own repository since 09-18. **red** in C1 until per-person GitHub: a team cannot connect its own repository. C2 at 390 is green since #1874, shown on `5561a1dd`. C3 (a hosted agent gets the broker, #1880) shipped and has not been walked. C8 was green on `9a32fca5`. C3, C4 and C8 on the current build wait on a new grant; the only grant lapsed 2026-09-25 11:32Z | +| GitHub (app) | yes | Walked 2026-09-25 and re-walked 2026-09-26 on `5561a1dd` (both below). Live on our own repository since 09-18. **red** in C1 until per-person GitHub: a team cannot connect its own repository. C2 at 390 is green since #1874, shown on `5561a1dd`. C3 (a hosted agent gets the broker, #1880) shipped and has not been walked. C8 was green on `9a32fca5`. A new grant from the connection's owner, `grant_3c4d6ad5` (2026-09-29, on Sam's approval), has the same scope as the lapsed 09-18 one: pod "C4 run 2026-09-18"; `list_issues`, `create_issue` and `close_issue`; write-with-confirm; audience Sam, `c3stranger0912` and `c4-smoke`. It runs to 2026-10-06, so C3, C4 and C8 are walkable again. None has been walked on the current build | +| Hosted MCP (generic type, TASK-172) | no entry yet | **Built and live, nothing offered.** Every build step in `hosted-mcp-connection-scope.md` §10 is on `2322de60` (live 2026-09-30 02:57Z): the connection row (#1976); catalogue entry, projection and drift (#1993, #2014, #2023); intake with browser-bound OAuth and rate-limited public routes (#1995, #1999, #2006, #2007); credential and refresh fence (#2001, #2004, #2009); mint and broker (#2002, #2005, #2010); the owner-credential trail (#2028); the banned/missing/bot-owner refusal (#2029, TASK-181); and removal with TASK-147's per-path witnesses (#2035). The catalogue is empty, so no vendor is reachable: an unknown entry's callback redirects to the Connectors page with `unknown_entry`, verified on the live build. **First entry is open for Sam:** Linear qualifies only if its authenticated `tools/list` carries `readOnlyHint` (Wren's ruling: no hint, no entry), and that needs one real Linear OAuth. Sentry qualifies by construction, since its source requires all three hints. Vera gates the entry, and C0–C10 are walked once end to end on it | | next app | no | Sam's decision; see below | ## Walk of 2026-09-25 @@ -125,7 +126,7 @@ Walked by the Connectors session, 2026-09-27 02:43Z to 02:47Z, with `lily-shen` | C5 inbound | green, with sender identity preserved | | pod tags and quote-reply routing | shipped after the walk (#1935, TASK-156). Pod tags seen live on `19d1d3e2`; quote-reply routing is unit-witnessed and not yet walked live | -The test gate on "Scout (Default)" was switched back off after the walk. On Sam's word (2026-09-27 ~10:30Z) the test binding on "Connector walk 0926" was then removed, so the chat is free: Sam's Rewire Live Demo pod relays nothing until he binds it from his own account. +The test gate on "Scout (Default)" was switched back off after the walk. On Sam's word (2026-09-27 ~10:30Z) the test binding on "Connector walk 0926" was then removed, so the chat is free: Sam's Rewire Live Demo pod relays nothing until he binds it from his own account. **Restored 2026-09-29** on Sam's approval: his existing Aug-26 pod-scoped row was reactivated (`isActive: true`; `liveRelay` was already on), not re-bound with a new code. It is the only active row on that chat, and the outbound selector picks it for Rewire Live Demo. The walk row stays inactive. **Membership, hardened across every connector write path (2026-09-27).** A connector now writes only where its owner is a listed pod member, the same rule `createMessage` uses (`isListedPodMember`): relay, inbound, the gate PATCH, install, bind confirm and the gate reconciler (#1940, TASK-161). A pod's creator cannot leave it (#1945, TASK-166), so `createdBy` no longer stands in for membership; the Discord/Slack owner routes follow (#1946, TASK-168); `agent-admin` pods are not a gate target (#1954, TASK-171); the PG chat path reads Mongo membership rather than its own mirror (#1942, TASK-162); and a seat whose own declaration cannot confine a broker is refused at the broker call — every dispatch except the native runtime's in-process one, which is exempt because a hosted turn has no shell, web or file tool to confine (#1971, TASK-175, ruled by Wren). This bears on C9 (authority is bounded) for every channel row above. @@ -167,7 +168,7 @@ Recommendation: verify GroupMe and X inside the freeze, since they are existing 1. Release the GitHub App credentials on commonly.me, installed on our own repository only, and widen once the GitHub row is green. **Done:** live on our repository since 09-18. The only room grant lapsed 2026-09-25 11:32Z, and a new grant from the connection's owner is what C3 and C4 now wait on. 2. Provide a dedicated Slack workspace and a Telegram account on a spare number, for the automated C1 checks. **Ruled 2026-09-26:** the test accounts are set up by Sam in his own browser. Agents do not create accounts or enter credentials, so C1 with a real account waits on those sign-ins. 3. Choose the next app. **Ruled 2026-09-26:** Linear, one build only, and only after Slack, GitHub and Telegram are green. No Linear code exists on main, so Wren scopes it first. **Re-ruled 2026-09-27 (74820):** "Start now, Linear first", as the first entry of the `hosted-mcp` type, with no wait on those three rows ([hosted-mcp-connection-scope.md](hosted-mcp-connection-scope.md)). That type has no inbound path, so it does not exercise C6. -4. Read the #1826 renders, which unblock the Discord page row. Open. +4. Read the #1826 renders, which unblock the Discord page row. **Done 2026-09-29:** approved, merged as `96cc9711` and live; see the Discord row. **Goal scope, ruled 2026-09-26:** drive Slack, GitHub and Telegram to green across C0–C10 first. GroupMe and Discord come after them; X and Instagram are deprioritised. From b5aa91a5a25e3ed36e1261a5ed3cd66f7004eefa Mon Sep 17 00:00:00 2001 From: Lily Shen <115414357+lilyshen0722@users.noreply.github.com> Date: Tue, 29 Sep 2026 21:09:41 -0700 Subject: [PATCH 2/4] docs(plans): the hosted-MCP row names step 6b as open (Rhea's hold on #2041) #2035 shipped step 6a, the removal sequence. The admin account-delete 409 and TASK-147's remaining per-path witnesses (step 6b) are not on main: admin/users.ts deletes the User without the 409. The row said every step had shipped; it now says step 6b is still open. Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_013geJsV4RJMujdvpf3JV2Cv --- docs/plans/integration-readiness-matrix.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/plans/integration-readiness-matrix.md b/docs/plans/integration-readiness-matrix.md index d715d3287..93b9efd8b 100644 --- a/docs/plans/integration-readiness-matrix.md +++ b/docs/plans/integration-readiness-matrix.md @@ -53,7 +53,7 @@ The matrix below is the definition of "ready". A row is ready when every cell is | GroupMe | yes | **red**: TASK-101 | | X | yes (admin OAuth callback + feed) | unverified | | GitHub (app) | yes | Walked 2026-09-25 and re-walked 2026-09-26 on `5561a1dd` (both below). Live on our own repository since 09-18. **red** in C1 until per-person GitHub: a team cannot connect its own repository. C2 at 390 is green since #1874, shown on `5561a1dd`. C3 (a hosted agent gets the broker, #1880) shipped and has not been walked. C8 was green on `9a32fca5`. A new grant from the connection's owner, `grant_3c4d6ad5` (2026-09-29, on Sam's approval), has the same scope as the lapsed 09-18 one: pod "C4 run 2026-09-18"; `list_issues`, `create_issue` and `close_issue`; write-with-confirm; audience Sam, `c3stranger0912` and `c4-smoke`. It runs to 2026-10-06, so C3, C4 and C8 are walkable again. None has been walked on the current build | -| Hosted MCP (generic type, TASK-172) | no entry yet | **Built and live, nothing offered.** Every build step in `hosted-mcp-connection-scope.md` §10 is on `2322de60` (live 2026-09-30 02:57Z): the connection row (#1976); catalogue entry, projection and drift (#1993, #2014, #2023); intake with browser-bound OAuth and rate-limited public routes (#1995, #1999, #2006, #2007); credential and refresh fence (#2001, #2004, #2009); mint and broker (#2002, #2005, #2010); the owner-credential trail (#2028); the banned/missing/bot-owner refusal (#2029, TASK-181); and removal with TASK-147's per-path witnesses (#2035). The catalogue is empty, so no vendor is reachable: an unknown entry's callback redirects to the Connectors page with `unknown_entry`, verified on the live build. **First entry is open for Sam:** Linear qualifies only if its authenticated `tools/list` carries `readOnlyHint` (Wren's ruling: no hint, no entry), and that needs one real Linear OAuth. Sentry qualifies by construction, since its source requires all three hints. Vera gates the entry, and C0–C10 are walked once end to end on it | +| Hosted MCP (generic type, TASK-172) | no entry yet | **Built through step 6a and live, nothing offered.** Steps 1–5 of `hosted-mcp-connection-scope.md` §10, and step 6's removal half, are on `2322de60` (live 2026-09-30 02:57Z): the connection row (#1976); catalogue entry, projection and drift (#1993, #2014, #2023); intake with browser-bound OAuth and rate-limited public routes (#1995, #1999, #2006, #2007); credential and refresh fence (#2001, #2004, #2009); mint and broker (#2002, #2005, #2010); the owner-credential trail (#2028); the banned/missing/bot-owner refusal (#2029, TASK-181); and the removal sequence (#2035, step 6a). **Still open, step 6b:** the admin account delete's 409 for a person who owns a hosted row (plan step 6; `admin/users.ts` deletes the User without it today), and TASK-147's remaining per-path witnesses (the pod-delete tripwire and the reconciler/admin paths). Both must land before the first entry. The catalogue is empty, so no vendor is reachable: an unknown entry's callback redirects to the Connectors page with `unknown_entry`, verified on the live build. **First entry is open for Sam:** Linear qualifies only if its authenticated `tools/list` carries `readOnlyHint` (Wren's ruling: no hint, no entry), and that needs one real Linear OAuth. Sentry qualifies by construction, since its source requires all three hints. Vera gates the entry, and C0–C10 are walked once end to end on it | | next app | no | Sam's decision; see below | ## Walk of 2026-09-25 From 1be37dc73aa5e8d240fbba3f9f3854421b3f452e Mon Sep 17 00:00:00 2001 From: Lily Shen <115414357+lilyshen0722@users.noreply.github.com> Date: Tue, 29 Sep 2026 21:20:59 -0700 Subject: [PATCH 3/4] docs(plans): Decisions item 1 records the renewed GitHub grant (Rhea's second hold on #2041) Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_013geJsV4RJMujdvpf3JV2Cv --- docs/plans/integration-readiness-matrix.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/plans/integration-readiness-matrix.md b/docs/plans/integration-readiness-matrix.md index 93b9efd8b..525ef4365 100644 --- a/docs/plans/integration-readiness-matrix.md +++ b/docs/plans/integration-readiness-matrix.md @@ -165,7 +165,7 @@ Recommendation: verify GroupMe and X inside the freeze, since they are existing ## Decisions for Sam -1. Release the GitHub App credentials on commonly.me, installed on our own repository only, and widen once the GitHub row is green. **Done:** live on our repository since 09-18. The only room grant lapsed 2026-09-25 11:32Z, and a new grant from the connection's owner is what C3 and C4 now wait on. +1. Release the GitHub App credentials on commonly.me, installed on our own repository only, and widen once the GitHub row is green. **Done:** live on our repository since 09-18. The 09-18 room grant lapsed 2026-09-25 11:32Z. **Renewed 2026-09-29** on Sam's approval: `grant_3c4d6ad5`, the same scope, runs to 2026-10-06 (see the GitHub row). C3 and C4 now wait on the walk, not on a grant. 2. Provide a dedicated Slack workspace and a Telegram account on a spare number, for the automated C1 checks. **Ruled 2026-09-26:** the test accounts are set up by Sam in his own browser. Agents do not create accounts or enter credentials, so C1 with a real account waits on those sign-ins. 3. Choose the next app. **Ruled 2026-09-26:** Linear, one build only, and only after Slack, GitHub and Telegram are green. No Linear code exists on main, so Wren scopes it first. **Re-ruled 2026-09-27 (74820):** "Start now, Linear first", as the first entry of the `hosted-mcp` type, with no wait on those three rows ([hosted-mcp-connection-scope.md](hosted-mcp-connection-scope.md)). That type has no inbound path, so it does not exercise C6. 4. Read the #1826 renders, which unblock the Discord page row. **Done 2026-09-29:** approved, merged as `96cc9711` and live; see the Discord row. From 2cc56b658238fa1f5b470e9d61900c6c7f3efc56 Mon Sep 17 00:00:00 2001 From: Lily Shen <115414357+lilyshen0722@users.noreply.github.com> Date: Tue, 29 Sep 2026 22:10:37 -0700 Subject: [PATCH 4/4] docs(plans): Discord's offered:false is the roster, not missing keys (Rhea's third hold on #2041) offered comes from installableCatalogService's offeredByRoster (an active builtin Installable row exists); commonly.me has no discord Installable row. available is manifest readiness and reads true. Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_013geJsV4RJMujdvpf3JV2Cv --- docs/plans/integration-readiness-matrix.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/plans/integration-readiness-matrix.md b/docs/plans/integration-readiness-matrix.md index 525ef4365..02a988b78 100644 --- a/docs/plans/integration-readiness-matrix.md +++ b/docs/plans/integration-readiness-matrix.md @@ -49,7 +49,7 @@ The matrix below is the definition of "ready". A row is ready when every cell is |---|---|---| | Telegram | yes | Re-walked live 2026-09-27 on `c941626b` with a real account (below). **C1 green**: the code typed exactly as the page shows it, spaces and a capitalised group included, binds on the first try (#1931 TASK-153, #1932 TASK-157); on `7ccc6ac2` the same form was refused. **More than one pod, green outbound**: a second pod switched on under "Pods that reach this channel" relayed its agent's line to the chat within the minute, and a line typed in the chat went only to the active pod, as the connector is built (one private chat binds one Commonly user, pods behind it as gates; TASK-154, ruled by Wren). **C3 green** (an agent line relayed) and **C5 inbound green** with sender identity ("Sam Xu (via Telegram)"). C10 green: both refusals are named, and since #1878 a dead chat is a named failure. Shipped since the re-walk: relayed lines now carry their pod's name (#1935, TASK-156; seen live on `19d1d3e2` as "[Connector walk 0926] Scout: PONG-TAG"), and a quote-reply routes to the quoted line's pod or is refused by name (#1935; unit-witnessed, not walked live). The catalogue row names the multi-pod model (#1957, TASK-158) | | Slack | yes | Walked live 2026-09-26/27 on `7ccc6ac2` with a real workspace (below). **C1, C3 and C5 green**: connect through consent, callback and confirm; a hosted agent's reply relays to Slack; a Slack mention reaches the agent and its answer comes back. C5 inbound was green only after two Slack app settings were fixed during the walk. Red for customers until the app was publicly distributed, which is now done, and the distribution attestation is now true of the running backend: #1929 (TASK-151) removed every `SLACK_BOT_TOKEN`/`SLACK_APP_TOKEN` read and injection, live on `f5eb5563`. A second authorize on a connected row is refused with 409 `slack_already_authorized` (measured through the API); the refusal copy on the page (#1890, Row C) is still unwalked in the UI. Before #1875 (09-04 to 09-25), every new install was refused at Authorize | -| Discord | partly | **C0 listed, not offered**: #1826 (Sam approved 2026-09-29) gives Discord its own row, live since `96cc9711` (2026-09-29 12:11Z). `/api/installables` returns `discord` under `channels` with `available: true, offered: false`, because commonly.me has no Discord keys set, so a stranger sees "Not enabled on this instance · ask your operator" rather than a merged "not yet" row. **red** in C1: not connectable (TASK-104) | +| Discord | partly | **C0 listed, not offered**: #1826 (Sam approved 2026-09-29) gives Discord its own row, live since `96cc9711` (2026-09-29 12:11Z). `/api/installables` returns `discord` under `channels` with `available: true, offered: false`. `offered` is the roster decision (`installableCatalogService.ts` `offeredByRoster`: an active builtin Installable row exists), and commonly.me has no `discord` Installable row, so it is not offered. `available` is the manifest readiness (`manifests.ts`: missing required keys would make it `false`), and it reads `true`. A stranger sees "Not enabled on this instance · ask your operator" rather than a merged "not yet" row. **red** in C1: not connectable (TASK-104) | | GroupMe | yes | **red**: TASK-101 | | X | yes (admin OAuth callback + feed) | unverified | | GitHub (app) | yes | Walked 2026-09-25 and re-walked 2026-09-26 on `5561a1dd` (both below). Live on our own repository since 09-18. **red** in C1 until per-person GitHub: a team cannot connect its own repository. C2 at 390 is green since #1874, shown on `5561a1dd`. C3 (a hosted agent gets the broker, #1880) shipped and has not been walked. C8 was green on `9a32fca5`. A new grant from the connection's owner, `grant_3c4d6ad5` (2026-09-29, on Sam's approval), has the same scope as the lapsed 09-18 one: pod "C4 run 2026-09-18"; `list_issues`, `create_issue` and `close_issue`; write-with-confirm; audience Sam, `c3stranger0912` and `c4-smoke`. It runs to 2026-10-06, so C3, C4 and C8 are walkable again. None has been walked on the current build |