DottaandPaperclip
585b4e6af8
## Thinking Path > - Paperclip manages agent work through tasks and governed execution. > - Connected conversations retain the source and authority for each request. > - Task Retry pins the full saved GitHub input batch before it waits for cleanup. > - Resuming that wait could append an independent board queue after authorization. > - Dispatch then rejected the changed batch before the provider started. > - This pull request keeps the authorized batch intact and restores certified undelivered input from historical failed attempts. > - Each board message retains a separate turn and its own admission checks. ## Linked Issues or Issue Description **What happened?** A deferred GitHub task Retry could consume a separate board message while promoting its saved receipt. The new run then failed with `chat_failed_run_retry_not_authorized`. A second Retry could also fail because the historical run retained the mixed batch. **Expected behavior** Retry must preserve the source batch it authorized. Separate board input must keep its own execution path. Historical input may be restored only when durable evidence proves that the rejected attempt never started a provider. **Steps to reproduce** 1. Retain ten authorized GitHub requests behind a failed native turn. 2. Start task Retry while the predecessor still lacks its exact termination receipt. 3. Save an independent board message. 4. Complete cleanup and resume the same Retry receipt. 5. Observe the mixed batch rejected during dispatch. Retry that failed attempt to reproduce the second refusal. Refs #17725 for the existing saved-input Retry contract. This change repairs the later queue merge and its retained failed state. Related #17878 covers snapshot continuation and later turns in recovered directories; its workspace repair can be reviewed independently. ## What Changed - Keep deferred chat Retry promotion scoped to its exact receipt. Ordinary board Retry coalescing retains its existing behavior. - Let a new explicit task Retry restore a historical mixed batch only after strict never-started, source, ownership, allocation, board-comment and prior-delivery checks. - Preserve failed-run history and original budget-skipped receipts. Record restored queue ownership in activity. - Add production queue and HTTP-route regressions. Update the execution contract and verification maps. ## Verification - Before the repair, the deferred ten-input batch failed before identity initialization. The same regression now reaches the real initializer with the exact GitHub batch. The independent board message then reaches its own initializer in a separate turn. - Before historical recovery, ordinary task Retry refused the persisted mixed failed batch. The repair passes that case without changing the failed run. HTTP duplicate requests retain one Retry owner. An additional compatibility probe restored the old queue candidate predicate and removed all historical mixed-state fixture writes: the real producer created the exact batch and the complete historical HTTP recovery case passed (1/1). The fixed-source historical fixture now uses the production serializers. - The affected Retry group passes 86 cases on commit `325c00158df5569f5b42731cda4ecc4584909d99`, including already-coalesced external receipts. Refusals cover edited sources, active controllers, unresolved allocations, changed receipts, foreign external receipt ownership and prior delivery of either board or GitHub input, including immutable budget-skipped receipts. - Full workspace `pnpm -r typecheck` and `pnpm build` pass with these source changes. Map, module-boundary and diff checks pass. - Full local `pnpm test:run` was started. The host cannot create additional PostgreSQL semaphores; database-dependent suites fail or skip at startup. The affected database group runs against a separate migrated PostgreSQL 17.10 test database with Node 24.22.0 on macOS arm64. - The regression deliberately stops after the real identity initializer to avoid provider allocation. It proves HTTP, queue, source authorization, identity and separate continuation behavior. It does not claim a live model result, GitHub publication, deployment or recovery of the original hosted task. - Current head `325c00158df5569f5b42731cda4ecc4584909d99`: all checks are terminal with no failures or pending checks; required `ci / verify` and `ci / e2e` pass. Conditional Storybook checks are skipped. Greptile and Paperclip each reviewed this exact commit at 5/5. Both earlier review threads are resolved. Paperclip retains one optional robustness suggestion for batch ordering; the verified historical producer order remains a strict recovery contract. ## Risks Restoring input could repeat work if the prior turn had executed. The existing strict bootstrap proof rejects provider output, native state, process or controller evidence, and allocations. Restoration also checks current external authority, unchanged board revisions and other run history. An uncertain executor remains held. No migration, provider fallback or relaxation of dispatch validation is included. ## Model Used OpenAI Codex, based on GPT-6, with reasoning, repository inspection, code editing and test execution. The exact runtime model ID and context-window size are not exposed in this session. A separately shared regression supplied independent reproduction evidence. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass (affected database regressions; full local suite has the host limitation described above) - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing>
109 KiB
External chat and email conversations — agent access
Product map: chat-channels.
Feature ID: chat-channels.
Delegated native entries inherit the native admission and work-mode limits.
Review date: 2026-10-26. Source base: a1f77821b9cd5c9c846fdf7a0fa5cc620ad2b6bb; implementation: #17737.
Connection operations reviewed in this working tree. The inventory was reconciled against production UI clients, REST registrations and service entry points; it is a review checklist, not a runtime registry. Authorization and evidence contract. Fixture evidence is separate from live provider qualification and from empirical LLM success. Source-only entries have a reviewed agent path or an explicit boundary, but do not claim an individually executed HTTP test.
providers
Capability ID: chat-channels/providers.
Review: operation-reviewed.
get-companies-chat-endpoints
API: present — GET /api/companies/{companyId}/chat-endpoints; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
post-companies-chat-endpoints
API: present — POST /api/companies/{companyId}/chat-endpoints; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: verified — route; reviewed in the working tree based on the source commit above. Authenticated fixtures passed with database persistence and actual bearer/session middleware.
Verification: passed — deterministic provider fixtures / local assembled server; no live provider qualification.
Gaps: Provider fixtures do not qualify live provider setup or availability.
get-chat-endpoints
API: present — GET /api/chat-endpoints/{endpointId}; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: verified — route; reviewed in the working tree based on the source commit above. Authenticated fixtures passed with database persistence and actual bearer/session middleware.
Verification: passed — deterministic provider fixtures / local assembled server; no live provider qualification.
Gaps: Provider fixtures do not qualify live provider setup or availability.
get-companies-chat-slack-setup-options
API: present — GET /api/companies/{companyId}/chat-slack/setup-options; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
post-chat-endpoints-slack-managed-authorize
API: present — POST /api/chat-endpoints/{endpointId}/slack/managed/authorize; JSON REST.
Agent access: available — agent REST and default native search_api / call_api return a saved requiredUserAction handoff. The responsible user must open that setup, bind their browser session, and consent to Slack access. An agent call does not start provider consent.
Policy: tools:manage_connections; shared management policy. Current agent and responsible-user authority bound the request. The addressed human starts the existing session-bound Slack authorization flow; callback state and subject checks remain enforced.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
post-chat-endpoints-slack-managed-provision
API: present — POST /api/chat-endpoints/{endpointId}/slack/managed/provision; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
delete-companies-chat-slack-manager-grants
API: present — DELETE /api/companies/{companyId}/chat-slack/manager-grants/{grantId}; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
get-chat-slack-managed-oauth-callback
API: present — GET /api/chat-slack/managed/oauth/callback; browser/provider/MCP protocol.
Agent access: restricted — browser authentication return.
Policy: Provider state/signature or gateway-token verification, company and resource binding; browser returns require the configuring human. Agent-issued durable gateway tokens retain both issuer and responsible-user authority.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: Agent invocation is denied by the stated policy. The authorized human or operator must perform this step; this entry does not claim delegated execution.
post-chat-endpoints-slack-registration
API: present — POST /api/chat-endpoints/{endpointId}/slack/registration; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
post-chat-endpoints-slack-install
API: present — POST /api/chat-endpoints/{endpointId}/slack/install; JSON REST.
Agent access: available — agent REST and default native search_api / call_api return a saved requiredUserAction handoff. The responsible user must open that setup, bind their browser session, and consent to the Slack installation. An agent call does not start installation consent.
Policy: tools:manage_connections; shared management policy. Current agent and responsible-user authority bound the request. Only the addressed human starts session-bound installation; callback state and subject checks remain enforced.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
get-chat-slack-oauth-callback
API: present — GET /api/chat-slack/oauth/callback; browser/provider/MCP protocol.
Agent access: restricted — browser authentication return.
Policy: Provider state/signature or gateway-token verification, company and resource binding; browser returns require the configuring human. Agent-issued durable gateway tokens retain both issuer and responsible-user authority.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: Agent invocation is denied by the stated policy. The authorized human or operator must perform this step; this entry does not claim delegated execution.
get-chat-endpoints-github-configuration
API: present — GET /api/chat-endpoints/{endpointId}/github/configuration; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: verified — route; reviewed in the working tree based on the source commit above. Authenticated fixtures passed with database persistence and actual bearer/session middleware.
Verification: passed — deterministic provider fixtures / local assembled server; no live provider qualification.
Gaps: Provider fixtures do not qualify live provider setup or availability.
put-chat-endpoints-github-configuration
API: present — PUT /api/chat-endpoints/{endpointId}/github/configuration; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: verified — route; reviewed in the working tree based on the source commit above. Authenticated fixtures passed with database persistence and actual bearer/session middleware.
Verification: passed — deterministic provider fixtures / local assembled server; no live provider qualification.
Gaps: Provider fixtures do not qualify live provider setup or availability.
post-chat-endpoints-github-verify
API: present — POST /api/chat-endpoints/{endpointId}/github/verify; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: verified — route; reviewed in the working tree based on the source commit above. Authenticated fixtures passed with database persistence and actual bearer/session middleware.
Verification: passed — deterministic provider fixtures / local assembled server; no live provider qualification.
Gaps: Provider fixtures do not qualify live provider setup or availability.
put-chat-endpoints-github-progress
API: present — PUT /api/chat-endpoints/{endpointId}/github/progress; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
get-chat-endpoints-github-personal-connections
API: present — GET /api/chat-endpoints/{endpointId}/github/personal-connections; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
post-chat-endpoints-github-people-lookup
API: present — POST /api/chat-endpoints/{endpointId}/github/people/lookup; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Provider identity: the requested endpoint's active GitHub App installation issues a metadata-only token. The lookup does not use a personal grant or fall back to anonymous access. Inactive connections and unverified installation IDs are rejected. Service regressions cover authentication and sanitized lookup failures with provider fixtures; they do not prove the live HTTP journey.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
post-chat-endpoints-github-registration
API: present — POST /api/chat-endpoints/{endpointId}/github/registration; JSON REST.
Agent access: available — agent REST and admitted native search_api / call_api return the saved requiredUserAction for human App registration and consent.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: verified — route; reviewed in the working tree based on the source commit above. Authenticated fixtures passed with database persistence and actual bearer/session middleware.
Verification: passed — deterministic provider fixtures / local assembled server; no live provider qualification.
Gaps: Provider fixtures do not qualify live provider setup or availability.
post-chat-endpoints-github-registration-restart
API: present — POST /api/chat-endpoints/{endpointId}/github/registration/restart; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
put-chat-endpoints-github-draft
API: present — PUT /api/chat-endpoints/{endpointId}/github/draft; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
post-chat-endpoints-github-setup
API: present — POST /api/chat-endpoints/{endpointId}/github/setup; JSON REST.
Agent access: available — agent REST and admitted native search_api / call_api advance saved setup. Install and identity steps return requiredUserAction for the addressed human. Registration returns state: "create" without that handoff; use the registration operation to obtain the saved human setup link.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
post-chat-endpoints-github-app
API: present — POST /api/chat-endpoints/{endpointId}/github/app; JSON REST.
Agent access: available — agent REST and default native search_api / call_api return a saved human credential-entry handoff; agents may send an empty body.
Policy: tools:manage_connections; shared management policy. A human session imports the App credentials and signing key. Delegated service import is rejected, and agent requests persist no caller-chosen key.
Evidence: verified — route, provider service, and actual-auth fixture. Agent key/JWT handoffs leave vault refs unchanged. Fresh drafts open the saved import form without the reconnect flag; its component test submits App import with the required webhook secret. Human import persists credentials, then agent repository discovery and verification continue.
Verification: passed — deterministic provider fixtures, assembled server and saved-screen tests.
Gaps: Human credential entry is intentional; no live provider qualification.
post-chat-endpoints-github-repositories-refresh
API: present — POST /api/chat-endpoints/{endpointId}/github/repositories/refresh; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: verified — route; reviewed in the working tree based on the source commit above. Authenticated fixtures passed with database persistence and actual bearer/session middleware.
Verification: passed — deterministic provider fixtures / local assembled server; no live provider qualification.
Gaps: Provider fixtures do not qualify live provider setup or availability.
get-chat-endpoints-github-repositories
API: present — GET /api/chat-endpoints/{endpointId}/github/repositories; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
put-chat-endpoints-github-repositories-access
API: present — PUT /api/chat-endpoints/{endpointId}/github/repositories/access; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
patch-chat-endpoints
API: present — PATCH /api/chat-endpoints/{endpointId}; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: verified — route; reviewed in the working tree based on the source commit above. Authenticated fixtures passed with database persistence and actual bearer/session middleware.
Verification: passed — deterministic provider fixtures / local assembled server; no live provider qualification.
Gaps: Provider fixtures do not qualify live provider setup or availability.
post-chat-endpoints-photon-inspect
API: present — POST /api/chat-endpoints/{endpointId}/photon/inspect; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
post-chat-endpoints-setup
API: present — POST /api/chat-endpoints/{endpointId}/setup; JSON REST.
Agent access: available — agent REST and default native search_api / call_api. Agent-supplied signing/webhook secrets, private keys, client secrets, and project secrets return a saved human credential-entry handoff. Authorized write-only bot-token and API-key setup remains delegated.
Policy: tools:manage_connections; shared management policy. The service rejects delegated verification-key entry before provider work or vault writes. Human sessions and verified provider handoffs retain credential entry; agent configuration uses the responsible user's current authority.
Evidence: verified — route; reviewed in the working tree based on the source commit above. Authenticated fixtures passed with database persistence and actual bearer/session middleware.
Verification: passed — actual key/JWT configure/reconnect requests return the addressed handoff with unchanged secret refs and vault signing value. The saved card stays pending through old health, bot-token repair, unchanged signing-key entry and retries. It completes only after a protected value change, renewed webhook verification and current authority; cancellation or user revocation still denies continuation. Credential-write revocation during provider authentication leaves refs unchanged. Complete human replacements repair disabled, deleted or unreadable old signing material, while unexpected resolver failures abort without changing refs. Different credential field sets/completion modes save separate handoffs; matching retries preserve the original baseline. Immediate and saved-intent links carry those field names and completion mode. Configured GitHub webhook/client-secret replacements use human reconnect while first-setup secret restrictions remain; the saved form submits only requested values and retains other vaulted credentials. An earlier provisioned Slack challenge survives only for the same signing fingerprint and callback URL. A human session configures Slack; an agent can repair its bot token and send a policy-governed test message. Native setup receipts are protected. No live provider qualification.
Gaps: Provider fixtures do not qualify live provider setup or availability.
post-chat-endpoints-setup-secret
API: present — POST /api/chat-endpoints/{endpointId}/setup-secret; JSON REST.
Agent access: available — agent REST and default native search_api / call_api return the saved endpoint's requiredUserAction handoff. Only a human session can rotate and receive the signing secret.
Policy: tools:manage_connections; shared management policy. Agents cannot generate or export the GitHub webhook signing secret; the service also rejects delegated generation.
Evidence: verified — route, provider service, and authenticated regression. Actual key/JWT requests return a handoff without changing credential refs; a human session can rotate and persist new refs.
Verification: passed — deterministic provider fixtures / local assembled server. The regression failed before the fix; all 42 assembled-server scenarios passed afterward. Rotation remains pending through old health and generation/reconnect failures. A completion marker commits with new vault refs and cleared webhook verification; restored verified health is also required. Saved links open the one-time human rotation screen.
Gaps: No live GitHub rotation qualification; plaintext signing-secret setup intentionally remains a human step.
get-chat-endpoints-resources
API: present — GET /api/chat-endpoints/{endpointId}/resources; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
put-chat-endpoints-resources
API: present — PUT /api/chat-endpoints/{endpointId}/resources; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
get-companies-email-connections
API: present — GET /api/companies/{companyId}/email/connections; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: verified — route; reviewed in the working tree based on the source commit above. Authenticated fixtures passed with database persistence and actual bearer/session middleware.
Verification: passed — deterministic provider fixtures / local assembled server; no live provider qualification.
Gaps: Provider fixtures do not qualify live provider setup or availability.
post-companies-email-connections
API: present — POST /api/companies/{companyId}/email/connections; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: verified — route; reviewed in the working tree based on the source commit above. Authenticated fixtures passed with database persistence and actual bearer/session middleware.
Verification: passed — deterministic provider fixtures / local assembled server; no live provider qualification.
Gaps: Provider fixtures do not qualify live provider setup or availability.
post-companies-email-connections-inspect
API: present — POST /api/companies/{companyId}/email/connections/{connectionId}/inspect; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
post-companies-email-connections-check-address
API: present — POST /api/companies/{companyId}/email/connections/{connectionId}/check-address; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
get-companies-email-inboxes
API: present — GET /api/companies/{companyId}/email/inboxes; JSON REST.
Agent access: available — existing REST/native runtime tool or scoped gateway client, as documented by the linked route.
Policy: Existing run-bound tool, scoped credential lease, execution policy, or assigned-email-agent checks; connection-management grants do not bypass these controls.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
post-companies-email-inspect
API: present — POST /api/companies/{companyId}/email/inspect; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
post-companies-email-inboxes
API: present — POST /api/companies/{companyId}/email/inboxes; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
get-companies-email-deliveries
API: present — GET /api/companies/{companyId}/email/deliveries/{publicationId}; JSON REST.
Agent access: available — existing REST/native runtime tool or scoped gateway client, as documented by the linked route.
Policy: Existing run-bound tool, scoped credential lease, execution policy, or assigned-email-agent checks; connection-management grants do not bypass these controls.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
identity
Capability ID: chat-channels/identity.
Review: operation-reviewed.
post-chat-endpoints-github-identity
API: present — POST /api/chat-endpoints/{endpointId}/github/identity; JSON REST.
Agent access: restricted — existing human setup or approval surface; agent can identify the saved setup and inspect the result.
Policy: Human consent, identity confirmation, action approval, or trusted-host administration. This endpoint does not delegate human identity or self-approval to an agent.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: Agent invocation is denied by the stated policy. The authorized human or operator must perform this step; this entry does not claim delegated execution.
post-chat-endpoints-github-identity-start
API: present — POST /api/chat-endpoints/{endpointId}/github/identity/start; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: verified — route; reviewed in the working tree based on the source commit above. Authenticated fixtures passed with database persistence and actual bearer/session middleware.
Verification: passed — actual run-JWT handoff and human-session OAuth/confirmation routes against deterministic providers. Healthy credentials and an OAuth callback alone leave the request pending with no continuation delivery. Missing, pending, revoked, expired, wrong-user and wrong-provider-account links do not satisfy it; the addressed user's current link for this endpoint does. Current membership and management authority still apply. No live provider qualification.
Gaps: Provider fixtures do not qualify live provider setup or availability.
post-chat-endpoints-github-identity-confirm
API: present — POST /api/chat-endpoints/{endpointId}/github/identity/confirm; JSON REST.
Agent access: restricted — existing human setup or approval surface; agent can identify the saved setup and inspect the result.
Policy: Human consent, identity confirmation, action approval, or trusted-host administration. This endpoint does not delegate human identity or self-approval to an agent.
Evidence: verified — actual human-session OAuth/confirmation fixture with production session middleware and database identity persistence.
Verification: passed — the addressed human completes OAuth and explicitly confirms the observed GitHub identity; only then can the saved identity handoff satisfy its identity requirement. Provider responses are fixtures and do not prove live consent.
Gaps: Agent invocation is denied by the stated policy. The authorized human or operator must perform this step; this entry does not claim delegated execution.
get-chat-endpoints-principals
API: present — GET /api/chat-endpoints/{endpointId}/principals; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
post-chat-endpoints-principals-link-intent
API: present — POST /api/chat-endpoints/{endpointId}/principals/{principalId}/link-intent; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
delete-chat-endpoints-principals-link
API: present — DELETE /api/chat-endpoints/{endpointId}/principals/{principalId}/link; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
post-chat-identity-links-confirm
API: present — POST /api/chat-identity-links/confirm; JSON REST.
Agent access: restricted — existing human setup or approval surface; agent can identify the saved setup and inspect the result.
Policy: Human consent, identity confirmation, action approval, or trusted-host administration. This endpoint does not delegate human identity or self-approval to an agent.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: Agent invocation is denied by the stated policy. The authorized human or operator must perform this step; this entry does not claim delegated execution.
post-chat-identity-links-request-access
API: present — POST /api/chat-identity-links/request-access; JSON REST.
Agent access: restricted — existing human setup or approval surface; agent can identify the saved setup and inspect the result.
Policy: Human consent, identity confirmation, action approval, or trusted-host administration. This endpoint does not delegate human identity or self-approval to an agent.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: Agent invocation is denied by the stated policy. The authorized human or operator must perform this step; this entry does not claim delegated execution.
get-chat-identity-links-preview
API: present — GET /api/chat-identity-links/preview; JSON REST.
Agent access: restricted — existing human setup or approval surface; agent can identify the saved setup and inspect the result.
Policy: Human consent, identity confirmation, action approval, or trusted-host administration. This endpoint does not delegate human identity or self-approval to an agent.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: Agent invocation is denied by the stated policy. The authorized human or operator must perform this step; this entry does not claim delegated execution.
get-api-chat-github-manifest-callback
API: present — GET /api/chat-github/manifest/callback; browser/provider/MCP protocol.
Agent access: restricted — browser authentication return.
Policy: Provider state/signature or gateway-token verification, company and resource binding; browser returns require the configuring human. Agent-issued durable gateway tokens retain both issuer and responsible-user authority.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: Agent invocation is denied by the stated policy. The authorized human or operator must perform this step; this entry does not claim delegated execution.
get-api-chat-github-cloud-callback
API: present — GET /api/chat-github/cloud/callback; browser/provider/MCP protocol.
Agent access: restricted — browser authentication return.
Policy: Provider state/signature or gateway-token verification, company and resource binding; browser returns require the configuring human. Agent-issued durable gateway tokens retain both issuer and responsible-user authority.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: Agent invocation is denied by the stated policy. The authorized human or operator must perform this step; this entry does not claim delegated execution.
get-api-chat-github-identity-callback
API: present — GET /api/chat-github/identity/callback; browser/provider/MCP protocol.
Agent access: restricted — browser authentication return.
Policy: Provider state/signature or gateway-token verification, company and resource binding; browser returns require the configuring human. Agent-issued durable gateway tokens retain both issuer and responsible-user authority.
Evidence: verified — route; reviewed in the working tree based on the source commit above. Authenticated fixtures passed with database persistence and actual bearer/session middleware.
Verification: passed — deterministic provider fixtures / local assembled server; no live provider qualification.
Gaps: Agent invocation is denied by the stated policy. The authorized human or operator must perform this step; this entry does not claim delegated execution.
conversation
Capability ID: chat-channels/conversation.
Review: operation-reviewed.
get-chat-endpoints-github-review-detail
API: present — GET /api/chat-endpoints/{endpointId}/github/reviews/{reviewId}; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user. Linked task and project visibility apply to every review row in addition to endpoint and credential visibility.
Evidence: verified — production-authenticated integration fixture with real database persistence and deterministic provider responses where required.
Verification: passed — Actual agent-key reads return the visible review and omit or return 404 for a review linked to an inaccessible private task. Real database persistence; no live GitHub call.
Gaps: Fixture evidence does not qualify live provider behavior or an empirical model success rate.
get-chat-endpoints-github-reviews
API: present — GET /api/chat-endpoints/{endpointId}/github/reviews; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user. Linked task and project visibility apply to every review row in addition to endpoint and credential visibility.
Evidence: verified — production-authenticated integration fixture with real database persistence and deterministic provider responses where required.
Verification: passed — Actual agent-key reads return the visible review and omit or return 404 for a review linked to an inaccessible private task. Real database persistence; no live GitHub call.
Gaps: Fixture evidence does not qualify live provider behavior or an empirical model success rate.
get-chat-endpoints-conversations
API: present — GET /api/chat-endpoints/{endpointId}/conversations; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user. Every conversation row is filtered by current access to its linked task, in addition to endpoint access.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — list conversations with an actual agent that can manage the endpoint but cannot read one linked private task; omit that conversation while retaining readable rows. Revoke endpoint authority and assert denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
post-chat-endpoints-conversations-publications
API: present — POST /api/chat-endpoints/{endpointId}/conversations/{conversationId}/publications; JSON REST.
Agent access: restricted — existing human setup or approval surface; agent can identify the saved setup and inspect the result.
Policy: Human consent, identity confirmation, action approval, or trusted-host administration. This endpoint does not delegate human identity or self-approval to an agent.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: Agent invocation is denied by the stated policy. The authorized human or operator must perform this step; this entry does not claim delegated execution.
get-chat-endpoints-conversations-publications-status
API: present — GET /api/chat-endpoints/{endpointId}/conversations/{conversationId}/publications/{publicationId}/status; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:use; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
get-issues-chat-binding
API: present — GET /api/issues/{issueId}/chat-binding; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections, responsible-user ceiling, task privacy, endpoint resource scope and target-agent visibility.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
post-api-chat-webhooks
API: present — POST /api/chat-webhooks/{publicId}/{provider}; provider webhook ingress.
Agent access: not-applicable — provider-signed inbound events; agent keys and gateway tokens cannot authenticate this route.
Policy: The provider verifies the payload signature and binds the endpoint/company. The request has no agent principal.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: Provider ingress has no agent invocation path. Provider signature validation remains required.
post-companies-email-send
API: present — POST /api/companies/{companyId}/email/send; JSON REST.
Agent access: available — existing REST/native runtime tool or scoped gateway client, as documented by the linked route.
Policy: Existing run-bound tool, scoped credential lease, execution policy, or assigned-email-agent checks; connection-management grants do not bypass these controls.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
get-companies-email-tasks
API: present — GET /api/companies/{companyId}/email/tasks/{issueId}; JSON REST.
Agent access: available — existing REST/native runtime tool or scoped gateway client, as documented by the linked route.
Policy: Existing run-bound tool, scoped credential lease, execution policy, or assigned-email-agent checks; connection-management grants do not bypass these controls.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
post-api-chat-webhooks-agentmail
API: present — POST /api/chat-webhooks/agentmail/{publicId}; provider webhook ingress.
Agent access: not-applicable — provider-signed inbound events; agent keys and gateway tokens cannot authenticate this route.
Policy: The provider verifies the payload signature and binds the endpoint/company. The request has no agent principal.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: Provider ingress has no agent invocation path. Provider signature validation remains required.
Monitor publication lineage uses the admitted wake and its source run's matching
set_task_monitor receipt, including company, task, immutable agent, requester,
and scheduled time. A source ID in context cannot grant publication. The normal
delivery worker rechecks current endpoint and sender authority. Database fixtures
exercise lineage and finalization recovery; live Slack qualification remains
separate.
Publication, provider-reply, and form-open 403/permission errors fail the rejected operation without removing unrelated assigned channel tools. Confirmed authentication failures still put the endpoint in attention, which blocks tool admission and provider sends; connection enabled intent is retained. Known resource denials and explicit revocation keep their narrower or installation-wide stops. PostgreSQL provider fixtures verify discovery after 403 and rejection after 401, including signed installation removal after a 401; they do not establish live GitHub credential recovery.
GitHub publication recovery (2026-10-14): assigned-agent submit_review, comment,
and update_comment calls reuse their run-, task-, endpoint-, and argument-bound
publication on an exact retry. Identity uses the complete durable request rather
than the shortened audit preview. A changed suffix, changed nested entry, or
missing completed publication cannot authorize another write. Exact retries read an
existing receipt; the worker owns pending provider retries. A request interrupted
during metadata or file reads before staging can repeat that preflight with the
same full request identity. The immutable assessment, unique publication and
provider lease still serialize its external write. begin_review exact retries
resolve the run's current review and return a typed result instead of an audit
preview. Fresh gateway policy and provider authority remain
required. The durable worker resumes transient failures after restart and stops
at its retry cap, revoked authority, or a superseded head. A pending receipt is
not task completion. Source:
publication service and
gateway. Verification uses
PostgreSQL-backed provider fixtures; this entry does not claim live provider
qualification for the new retry path.
GitHub main-response identity (2026-10-19): PR requests share a company-, App-, repository- and PR-bound comment. Agents still supply no comment destination. Current sender, assignee, repository and publication authority are checked before edits, including maintenance failure notices. Leading mentions for another recipient are filtered before task work; explicit mentions of this bot still follow normal access checks. Provider-fixture coverage is not live GitHub proof. Native terminal reconciliation resolves the accepted run identity through the existing chat provenance resolver; an older run's reply cannot complete a newer request merely because both requests share the same PR comment. A terminal native success does not authorize missing-response publication while its native phase or durable presentation decision remains pending. Maintenance rechecks the same request after authoritative settlement; failures keep their separate fallback path. Maintenance projects the bounded server-committed native passive-wait decision only after current request ownership. It settles a no-comment acknowledgement without authorizing a new send or counting an old shared receipt as a current-run reply. Existing final App/marker-owned PR content survives progress acknowledgements; new canonical review publication remains the writer for replacement assessments.
Speko browser sessions use POST /api/companies/{companyId}/voice-sessions,
with GET inspection/notification and POST /{sessionId}/end operations below
that collection. These routes require board identity; ordinary agent credentials
cannot start a private voice session. Start and notification also require the
experimental chat-connectors gate. Signed provider callbacks use the separate
voice-webhook routes and their session capability. Evidence: source-only —
voice routes. No live browser answer
retrieval or telephone playback is established by the UI fixtures.
Slack's Require at-mention policy applies to channel messages and channel thread replies, including queued work. DMs are exempt from mention checks; endpoint availability, Allow direct messages, and sender authorization still apply. Top-level DM replies retain their linear conversation destination. Source: admission and queued run policy. Live Slack verification of this exemption remains separate from provider-fixture coverage.
Slack eyes acknowledge the authorized task/comment commit before attachment preparation or scheduler acceptance. This server-owned receipt grants no agent authority. Generation/credential fencing, durable retries and exact-source final cleanup still apply. PostgreSQL fixtures block attachments, subscription and wakeup independently to verify that none gates the reaction; live Slack latency remains a separate check. See receipt worker.
Controller-owned receipt reactions accept the SDK's empty thread timestamp for linear DMs. Channel IDs and source message timestamps remain validated. This does not add an agent tool or change sender, task, or credential authorization. The pinned SDK transport regression is covered in receipt tests; live acknowledgement speed needs a separate provider test.
Slack assignment and tool discovery bound concurrent endpoint preparation to two. Every endpoint keeps the live task, company, agent and linked-user checks; 403 denials omit only that endpoint. Preparation waits for both active checks before it returns an ordered result or propagates an error. Tool authority reads the current bot token without resolving unrelated webhook credentials. See the real-database preparation controls and batch failure controls. These local controls do not establish live Slack latency or provider access.
Native tool gateways use the durable run task binding for discovery and policy checks, with legacy JSON task fields as a fallback. GitHub and Slack follow accepted request provenance across task continuations. GitHub can retain the originating conversation after a board follow-up from the same accepted user. An inherited origin cannot cross a task, agent, company, or requester boundary. Cycle checks reject invalid history without a fixed limit on valid continuations. Endpoint settings, linked identity, tool profiles, and invocation policy still apply on each call. The native tool contract rotates older provider sessions so an empty retained catalog is not reused. PostgreSQL fixtures cover discovery, review publication, Slack reads, and revocation in channel integration and provenance controls. The voice gateway fixture also verifies durable task binding for a later personal callback invocation. Failure replies cannot replace final answers inherited from an earlier run. These fixtures do not prove live provider delivery.
Catalog authorization projection (2026-10-17): tool discovery uses the same live service-owned task, company, agent, requester, endpoint and credential checks as full authority resolution. It omits the revision digest and search-action token, which catalog descriptors do not consume. Connector assignments and governed operations retain full revision resolution; invocation policy is still checked by the gateway. Registry replacement and missing-service controls are in authority registration tests. This is a source and local-database contract; hosted latency needs live evidence.
New conversations resolve typed project/workspace defaults from their endpoint and destination under the task-creation transaction. Defaults do not authorize private sources: admission checks the linked user's authority and assigned agent. An existing conversation keeps its task binding. See creation service and defaults contract.
post-voice-sessions
API: present — POST /api/companies/{companyId}/voice-sessions; JSON REST.
Agent access: operator-only — the private voice caller must be an authenticated board user (or local operator); agent bearer credentials are rejected.
Policy: Company access and the service's current caller/session/endpoint authority apply. Browser start, notification, and callback preferences also require experimental chat connectors. Private microphone access, callback preferences, and incoming-call approval remain human identity/consent steps; connection-management grants do not impersonate that caller.
Evidence: source-only — voice routes, reviewed in this working tree.
Verification: not-run — verify the board caller's own state and reject agent, wrong-user, and foreign-company calls. No live telephone or browser audio qualification is claimed.
Gaps: This is an explicit human boundary. Authorized agents configure the underlying connection through its endpoint API; the human controls private calling and incoming-call consent.
get-voice-session
API: present — GET /api/companies/{companyId}/voice-sessions/{sessionId}; JSON REST.
Agent access: operator-only — the private voice caller must be an authenticated board user (or local operator); agent bearer credentials are rejected.
Policy: Company access and the service's current caller/session/endpoint authority apply. Browser start, notification, and callback preferences also require experimental chat connectors. Private microphone access, callback preferences, and incoming-call approval remain human identity/consent steps; connection-management grants do not impersonate that caller.
Evidence: source-only — voice routes, reviewed in this working tree.
Verification: not-run — verify the board caller's own state and reject agent, wrong-user, and foreign-company calls. No live telephone or browser audio qualification is claimed.
Gaps: This is an explicit human boundary. Authorized agents configure the underlying connection through its endpoint API; the human controls private calling and incoming-call consent.
get-voice-notification
API: present — GET /api/companies/{companyId}/voice-sessions/{sessionId}/notification; JSON REST.
Agent access: operator-only — the private voice caller must be an authenticated board user (or local operator); agent bearer credentials are rejected.
Policy: Company access and the service's current caller/session/endpoint authority apply. Browser start, notification, and callback preferences also require experimental chat connectors. Private microphone access, callback preferences, and incoming-call approval remain human identity/consent steps; connection-management grants do not impersonate that caller.
Evidence: source-only — voice routes, reviewed in this working tree.
Verification: not-run — verify the board caller's own state and reject agent, wrong-user, and foreign-company calls. No live telephone or browser audio qualification is claimed.
Gaps: This is an explicit human boundary. Authorized agents configure the underlying connection through its endpoint API; the human controls private calling and incoming-call consent.
get-voice-report
API: present — GET /api/companies/{companyId}/voice-sessions/{sessionId}/report; JSON REST.
Agent access: operator-only — the private voice caller must be an authenticated board user (or local operator); agent bearer credentials are rejected.
Policy: Company access and the service's current caller/session/endpoint authority apply. Browser start, notification, and callback preferences also require experimental chat connectors. Private microphone access, callback preferences, and incoming-call approval remain human identity/consent steps; connection-management grants do not impersonate that caller.
Evidence: source-only — voice routes, reviewed in this working tree.
Verification: not-run — verify the board caller's own state and reject agent, wrong-user, and foreign-company calls. No live telephone or browser audio qualification is claimed.
Gaps: This is an explicit human boundary. Authorized agents configure the underlying connection through its endpoint API; the human controls private calling and incoming-call consent.
attachments
Capability ID: chat-channels/attachments.
Review: operation-reviewed.
get-issues-attachments
API: present — GET /api/issues/{id}/attachments; JSON REST.
Agent access: available — agent REST and native search_api / call_api for the attachment list.
Policy: Current company membership and task read/privacy authority. Connection management grants do not replace task access.
Evidence: source-only — asset routes.
Verification: not-run — list attachments with actual agent authentication and deny a foreign or private task.
Gaps: This operation has source review, not current-head HTTP verification.
post-companies-issues-attachments
API: present — POST /api/companies/{companyId}/issues/{issueId}/attachments; multipart upload.
Agent access: partial — agent REST upload; native attachment tools and register_deliverable use their admitted resource paths and server-owned chat delivery. JSON-only call_api does not upload multipart content.
Policy: Task mutation/privacy authority, company/resource bounds, storage limits, and admitted native tool scope. Server-owned delivery does not grant endpoint administration.
Evidence: source-only — asset routes and native authority.
Verification: not-run — upload through an admitted agent path, inspect the stored task attachment and outbound delivery, and deny a foreign task.
Gaps: Multipart upload is not a JSON native API call. Live chat file delivery remains unqualified by this connection setup audit.
post-chat-endpoints-publications-replay
API: present — POST /api/chat-endpoints/{endpointId}/publications/{publicationId}/replay; JSON REST.
Agent access: restricted — existing human setup or approval surface; agent can identify the saved setup and inspect the result.
Policy: Human consent, identity confirmation, action approval, or trusted-host administration. This endpoint does not delegate human identity or self-approval to an agent.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: Agent invocation is denied by the stated policy. The authorized human or operator must perform this step; this entry does not claim delegated execution.
post-chat-endpoints-publications-resolve
API: present — POST /api/chat-endpoints/{endpointId}/publications/{publicationId}/resolve; JSON REST.
Agent access: restricted — existing human setup or approval surface; agent can identify the saved setup and inspect the result.
Policy: Human consent, identity confirmation, action approval, or trusted-host administration. This endpoint does not delegate human identity or self-approval to an agent.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: Agent invocation is denied by the stated policy. The authorized human or operator must perform this step; this entry does not claim delegated execution.
post-chat-endpoints-actions-resolve
API: present — POST /api/chat-endpoints/{endpointId}/actions/{actionId}/resolve; JSON REST.
Agent access: restricted — existing human setup or approval surface; agent can identify the saved setup and inspect the result.
Policy: Human consent, identity confirmation, action approval, or trusted-host administration. This endpoint does not delegate human identity or self-approval to an agent.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: Agent invocation is denied by the stated policy. The authorized human or operator must perform this step; this entry does not claim delegated execution.
post-companies-email-deliveries-resolve
API: present — POST /api/companies/{companyId}/email/deliveries/{publicationId}/resolve; JSON REST.
Agent access: restricted — human connection manager records the outcome of an uncertain external delivery. Agents use normal governed send/status operations.
Policy: Existing run-bound tool, scoped credential lease, execution policy, or assigned-email-agent checks; connection-management grants do not bypass these controls.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: Agent invocation is denied by the stated policy. The authorized human or operator must perform this step; this entry does not claim delegated execution.
lifecycle
Capability ID: chat-channels/lifecycle.
Review: operation-reviewed.
post-chat-endpoints-slack-test-message
API: present — POST /api/chat-endpoints/{endpointId}/slack/test-message; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:use; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user. Test messages and identity-link invitations intersect caller and endpoint-agent Block/Ask first/rate policies before dispatch. Independent rate buckets apply separately, identical shared buckets consume once, and saved request receipts prevent duplicate sends.
Evidence: verified — production-authenticated integration fixture with real database persistence and deterministic provider responses where required.
Verification: passed — actual agent-key/run-JWT requests cover caller Block/Ask first/rate rules, target Block/rate rules and one shared quota for both linked-account test messages and identity invitations. Denied requests make no additional provider send, caller audit retains the actual acting agent, and saved requests replay without another send. Provider responses are fixtures.
Gaps: Fixture evidence does not qualify live provider behavior or an empirical model success rate.
post-chat-endpoints-slack-resume
API: present — POST /api/chat-endpoints/{endpointId}/slack/resume; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
post-chat-endpoints-test
API: present — POST /api/chat-endpoints/{endpointId}/test; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
post-chat-endpoints-finish
API: present — POST /api/chat-endpoints/{endpointId}/finish; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
get-chat-endpoints-test-status
API: present — GET /api/chat-endpoints/{endpointId}/test-status; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Endpoint access remains required. The responsible human's linked external principals bound the result: only the earliest qualifying received timestamp since test start is returned, or null, with no message body. See setup probes.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — check a permitted agent's responsible-human link, another user's received message, and no linked principal. Only the matching human's qualifying timestamp may appear; the other cases return null without content. Revoke endpoint access and assert denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
get-chat-endpoints-activity
API: present — GET /api/chat-endpoints/{endpointId}/activity; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:view_audit; shared management policy. Current task visibility applies to every returned event. Cursors advance over bounded examined candidates, including private-only windows; private event details remain filtered.
Evidence: verified — actual-JWT regression through the assembled server and real database.
Verification: passed — a private-only first page retains a cursor; the next reaches three readable older events after 27 private events, including tied timestamps. The page-bounded per-task authorization regression remains green.
Gaps: Deterministic database/provider fixtures do not qualify live provider setup or availability.
post-chat-endpoints-deliveries-replay
API: present — POST /api/chat-endpoints/{endpointId}/deliveries/{deliveryId}/replay; JSON REST.
Agent access: restricted — existing human setup or approval surface; agent can identify the saved setup and inspect the result.
Policy: Human consent, identity confirmation, action approval, or trusted-host administration. This endpoint does not delegate human identity or self-approval to an agent.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: Agent invocation is denied by the stated policy. The authorized human or operator must perform this step; this entry does not claim delegated execution.
post-email-inboxes-control
API: present — POST /api/email/inboxes/{endpointId}/control; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
post-email-inboxes-reconnect
API: present — POST /api/email/inboxes/{endpointId}/reconnect; JSON REST.
Agent access: available — agent REST and default native search_api / call_api.
Policy: tools:manage_connections; shared management policy. Resolved resources and every affected target are checked; personal ownership remains the responsible user.
Evidence: source-only — route; reviewed in the working tree based on the source commit above.
Verification: not-run — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
GitHub review summary headings use the bot display name. Checks remain independently scoped by GitHub App and endpoint/PR/commit identity.
After publishing a review, native agents can report yielded with
response_wake and no attention requests. Current conversation authorization
is checked again at commit. The task remains in review without a human card;
real human dependencies retain the ordinary attention-request path. A timed
wait requires a confirmed set_task_monitor schedule. Database coverage lives
in external-chat-wait.integration.test.ts; this is not live model evidence.
Inherited GitHub review waits (2026-10-26): an explicit native response_wake
after tree resume or same-agent continuation may retain the provider-event path
through accepted requester identity lineage and the latest processed review
publication for that task/conversation. This does not grant monitor management
or publication authority. Current task/agent/company binding, repository,
principal and endpoint checks remain effective. PostgreSQL regressions cover
quiet repeated finalization, historical publication reuse, newer unreviewed
heads and revoked access; live GitHub delivery remains separate acceptance.
Omitted/null yielded reports may use the current run's server-projected published
review wait. The same proof is rechecked at feedback, finalization and commit;
older/different-run review, pending publication and revoked connection cannot
supply it. This grants no new publication/monitor authority and leaves Done policy
unchanged; explicit malformed input is not coerced.
post-voice-end
API: present — POST /api/companies/{companyId}/voice-sessions/{sessionId}/end; JSON REST.
Agent access: operator-only — the private voice caller must be an authenticated board user (or local operator); agent bearer credentials are rejected.
Policy: Company access and the service's current caller/session/endpoint authority apply. Browser start, notification, and callback preferences also require experimental chat connectors. Private microphone access, callback preferences, and incoming-call approval remain human identity/consent steps; connection-management grants do not impersonate that caller.
Evidence: source-only — voice routes, reviewed in this working tree.
Verification: not-run — verify the board caller's own state and reject agent, wrong-user, and foreign-company calls. No live telephone or browser audio qualification is claimed.
Gaps: This is an explicit human boundary. Authorized agents configure the underlying connection through its endpoint API; the human controls private calling and incoming-call consent.
get-voice-callbacks
API: present — GET /api/companies/{companyId}/voice-callbacks/{endpointId}; JSON REST.
Agent access: operator-only — the private voice caller must be an authenticated board user (or local operator); agent bearer credentials are rejected.
Policy: Company access and the service's current caller/session/endpoint authority apply. Browser start, notification, and callback preferences also require experimental chat connectors. Private microphone access, callback preferences, and incoming-call approval remain human identity/consent steps; connection-management grants do not impersonate that caller.
Evidence: source-only — voice routes, reviewed in this working tree.
Verification: not-run — verify the board caller's own state and reject agent, wrong-user, and foreign-company calls. No live telephone or browser audio qualification is claimed.
Gaps: This is an explicit human boundary. Authorized agents configure the underlying connection through its endpoint API; the human controls private calling and incoming-call consent.
put-voice-callbacks
API: present — PUT /api/companies/{companyId}/voice-callbacks/{endpointId}; JSON REST.
Agent access: operator-only — the private voice caller must be an authenticated board user (or local operator); agent bearer credentials are rejected.
Policy: Company access and the service's current caller/session/endpoint authority apply. Browser start, notification, and callback preferences also require experimental chat connectors. Private microphone access, callback preferences, and incoming-call approval remain human identity/consent steps; connection-management grants do not impersonate that caller.
Evidence: source-only — voice routes, reviewed in this working tree.
Verification: not-run — verify the board caller's own state and reject agent, wrong-user, and foreign-company calls. No live telephone or browser audio qualification is claimed.
Gaps: This is an explicit human boundary. Authorized agents configure the underlying connection through its endpoint API; the human controls private calling and incoming-call consent.
get-voice-phone
API: present — GET /api/companies/{companyId}/voice-phone/{endpointId}; JSON REST.
Agent access: operator-only — the private voice caller must be an authenticated board user (or local operator); agent bearer credentials are rejected.
Policy: Company access and the service's current caller/session/endpoint authority apply. Browser start, notification, and callback preferences also require experimental chat connectors. Private microphone access, callback preferences, and incoming-call approval remain human identity/consent steps; connection-management grants do not impersonate that caller.
Evidence: source-only — voice routes, reviewed in this working tree.
Verification: not-run — verify the board caller's own state and reject agent, wrong-user, and foreign-company calls. No live telephone or browser audio qualification is claimed.
Gaps: This is an explicit human boundary. Authorized agents configure the underlying connection through its endpoint API; the human controls private calling and incoming-call consent.
put-voice-phone
API: present — PUT /api/companies/{companyId}/voice-phone/{endpointId}; JSON REST.
Agent access: operator-only — the private voice caller must be an authenticated board user (or local operator); agent bearer credentials are rejected.
Policy: Company access and the service's current caller/session/endpoint authority apply. Browser start, notification, and callback preferences also require experimental chat connectors. Private microphone access, callback preferences, and incoming-call approval remain human identity/consent steps; connection-management grants do not impersonate that caller.
Evidence: source-only — voice routes, reviewed in this working tree.
Verification: not-run — verify the board caller's own state and reject agent, wrong-user, and foreign-company calls. No live telephone or browser audio qualification is claimed.
Gaps: This is an explicit human boundary. Authorized agents configure the underlying connection through its endpoint API; the human controls private calling and incoming-call consent.
get-voice-incoming
API: present — GET /api/companies/{companyId}/voice-phone/{endpointId}/incoming; JSON REST.
Agent access: operator-only — the private voice caller must be an authenticated board user (or local operator); agent bearer credentials are rejected.
Policy: Company access and the service's current caller/session/endpoint authority apply. Browser start, notification, and callback preferences also require experimental chat connectors. Private microphone access, callback preferences, and incoming-call approval remain human identity/consent steps; connection-management grants do not impersonate that caller.
Evidence: source-only — voice routes, reviewed in this working tree.
Verification: not-run — verify the board caller's own state and reject agent, wrong-user, and foreign-company calls. No live telephone or browser audio qualification is claimed.
Gaps: This is an explicit human boundary. Authorized agents configure the underlying connection through its endpoint API; the human controls private calling and incoming-call consent.
post-voice-incoming-decision
API: present — POST /api/companies/{companyId}/voice-phone/{endpointId}/incoming/{callId}; JSON REST.
Agent access: operator-only — the private voice caller must be an authenticated board user (or local operator); agent bearer credentials are rejected.
Policy: Company access and the service's current caller/session/endpoint authority apply. Browser start, notification, and callback preferences also require experimental chat connectors. Private microphone access, callback preferences, and incoming-call approval remain human identity/consent steps; connection-management grants do not impersonate that caller.
Evidence: source-only — voice routes, reviewed in this working tree.
Verification: not-run — verify the board caller's own state and reject agent, wrong-user, and foreign-company calls. No live telephone or browser audio qualification is claimed.
Gaps: This is an explicit human boundary. Authorized agents configure the underlying connection through its endpoint API; the human controls private calling and incoming-call consent.
get-voice-phone-history
API: present — GET /api/companies/{companyId}/voice-phone/{endpointId}/history; JSON REST.
Agent access: operator-only — the private voice caller must be an authenticated board user (or local operator); agent bearer credentials are rejected.
Policy: Company access and the service's current caller/session/endpoint authority apply. Browser start, notification, and callback preferences also require experimental chat connectors. Private microphone access, callback preferences, and incoming-call approval remain human identity/consent steps; connection-management grants do not impersonate that caller.
Evidence: source-only — voice routes, reviewed in this working tree.
Verification: not-run — verify the board caller's own state and reject agent, wrong-user, and foreign-company calls. No live telephone or browser audio qualification is claimed.
Gaps: This is an explicit human boundary. Authorized agents configure the underlying connection through its endpoint API; the human controls private calling and incoming-call consent.
get-voice-history
API: present — GET /api/companies/{companyId}/voice-history/{endpointId}; JSON REST.
Agent access: operator-only — the private voice caller must be an authenticated board user (or local operator); agent bearer credentials are rejected.
Policy: Company access and the service's current caller/session/endpoint authority apply. Browser start, notification, and callback preferences also require experimental chat connectors. Private microphone access, callback preferences, and incoming-call approval remain human identity/consent steps; connection-management grants do not impersonate that caller.
Evidence: source-only — voice routes, reviewed in this working tree.
Verification: not-run — verify the board caller's own state and reject agent, wrong-user, and foreign-company calls. No live telephone or browser audio qualification is claimed.
Gaps: This is an explicit human boundary. Authorized agents configure the underlying connection through its endpoint API; the human controls private calling and incoming-call consent.
outbound-email
Capability ID: chat-channels/outbound-email.
Review: baseline.
API: present — GET /api/companies/{companyId}/email/inboxes; POST /api/companies/{companyId}/email/send for both send/reply; GET /api/companies/{companyId}/email/tasks/{issueId}; GET /api/companies/{companyId}/email/deliveries/{publicationId}. Administrative uncertain-outcome resolution uses POST /api/companies/{companyId}/email/deliveries/{publicationId}/resolve.
Agent access: partial — the assigned agent can use the email REST/CLI path with its actual active run and admitted email.send/email.reply policy. Board writers use their own credential authority. Availability of a CLI or scenario email tool does not establish that a native run has that tool binding or generic fallback admitted.
Policy: Agent sends require ownership of the inbox and source task, task read access, an available agent within budget, a running task run that owns execution/checkout, standard work mode, and no restricted external execution. Active endpoint, connection, credential access, and email.send/email.reply policy are rechecked. Authenticated board sends require active company membership and credential access; viewer sends additionally require instance-admin status. Local implicit authority skips the membership check. Agent reads retain task/inbox/company checks; board thread/delivery reads use the route’s company-access boundary. Delivery resolution requires board tools:manage_connections or existing elevated operator authority, not ordinary agent access.
Evidence: source-only — reviewed at 9ef434fe79c57d976b8b03b14c5242db270b8320. Email CLI, request schema, email routes, and email authority/publication.
Verification: not-run — Use the actual permitted writer and run to create one child/publication, confirm recipient delivery and an exact-message reply, and repeat idempotent requests without duplicate sends. Assert run/owner/mode/budget/company/credential/attachment denials and separate read access. Inspect the provider before resolving an unknown write outcome; a 202 or queued publication alone is not proof of delivery.
Gaps: Real AgentMail transport, recipient delivery, and each native tool binding still need live proof. Controlled provider receipts and inbound-reply recipes do not establish a newly initiated external email journey.
Ordinary task Retry can select newer linked-human GitHub input whose original admission was skipped by a budget or agent-availability gate. The chat owner revalidates its exact processed delivery, company/task/agent/principal, unchanged comment, session generation, and admitted instruction snapshot. A separate retry receipt preserves the original skipped receipt and older failed native result. Current access and normal native stop/cleanup guards still govern execution; board wake metadata alone cannot manufacture chat authority or replay old work.
Deferred chat Retry excludes independent board queues from its pinned batch. An explicit board Retry can restore a historical mixed batch only with exact never-started evidence, current source authority, unchanged board comments and no prior delivery or allocation. The server records the restoration in activity; failed runs and original skipped receipts remain history. This grants no new agent retry capability and does not weaken execution-time source validation.