Repository navigation
refactor(plugins): remove duplicated API permission model - #118
Conversation
Why: GitHub creates empty COMMENTED reviews for inline replies. Tracking treated every new review ID as a decision change, so an author's self reply bypassed the comment audience filter and woke the owner. Keep all review IDs for collection and explicit cloud-result evidence, but restrict decision baselines and matches to formal verdict states. Refs: zts212653#113 [砚砚/gpt-5.6-sol🐾] Thread-Context: threadId=thread_mvjqyaz43w2bm5ql catId=codex
Why: maintainer review of zts212653#113 requested explicit proof that COMMENTED containers advance collection without replacing the formal verdict, that approval still arrives from a COMMENTED baseline, and that renewal does not replay it. Refs: zts212653#113 [砚砚/gpt-5.6-sol🐾] Thread-Context: thread_mvjqyaz43w2bm5ql
Why: alpha.25 became an immutable published artifact while this fix was under review. Publish the changed GitHub Operations bytes under a fresh prerelease identity and bind the catalog to the exact Node 24.18/npm 11.16 archive. Refs: zts212653#113 [砚砚/gpt-5.6-sol🐾] Thread-Context: thread_mvjqyaz43w2bm5ql
Why: maintainer and independent review require persistent proof for same-poll COMMENTED plus APPROVED and for legacy baselines that stored COMMENTED as their decision. Both must emit only the formal approval and converge without replay. Refs: zts212653#113 [砚砚/gpt-5.6-sol🐾] Thread-Context: thread_mvjqyaz43w2bm5ql
Why: excluding comment-only reviews exposed two dismissal gaps: a review first observed after dismissal was consumed without notification, and renewal retained a revoked formal decision. Keep newly seen dismissed IDs reportable once, rebuild the formal baseline from complete observations, and pin the resulting alpha.26 artifact bytes. [砚砚/gpt-5.6-sol🐾]
Why: GitHub can expose a review as PENDING before submission, advancing the raw review ID cursor. When that same ID later became APPROVED or CHANGES_REQUESTED, tracking treated it as old and silently lost the formal verdict, including after an unrelated CI renewal. Track the submitted-verdict frontier independently through the durable verdict map while keeping the raw collector cursor monotonic. Cover both formal states from registration and after CI renewal, including replay suppression. [砚砚/gpt-5.6-sol🐾]
Why: GitHub can mutate a collected PENDING review into a submitted result or dismissal without assigning a new review id. Tracking must compare the durable raw state frontier so correlated cloud results and real decision transitions remain observable while ordinary COMMENTED containers stay quiet. [砚砚/gpt-5.6-sol🐾]
Why: review ids identify mutable GitHub objects, so a max-id cursor alone cannot distinguish collection from semantic consumption. Preserve submitted states against stale PENDING snapshots, recover unanchored same-id formal results, and keep dismissal head-independent without replaying current-HEAD decisions. [砚砚/gpt-5.6-sol🐾]
Why: the notification-link follow-up changes the same GitHub Operations package and candidate artifact as PR zts212653#115. Stack on its approved exact HEAD so the next prerelease contains the accepted review-state fixes instead of publishing a competing alpha.26. [砚砚/gpt-5.6-sol🐾]
Why: GitHub destinations were hidden behind the plugin sender name through Host-specific source.url handling. Put the existing PR/Issue subject text in control of its own explicit Markdown link and stop emitting the presentation-only URL field. [砚砚/gpt-5.6-sol🐾]
Why: GitHub notification subjects now carry their own visible destination and no longer rely on Host-only source navigation. Publish the reviewed behavior under a new immutable plugin identity with its exact fixed-toolchain artifact digest. [砚砚/gpt-5.6-sol🐾]
Why: a review first collected as PENDING can become the fourth formal changes-requested review without receiving a new GitHub ID. Include that submitted transition in the loop-brake frontier so repeated review cycles still pause for a finding-pattern summary. [砚砚/gpt-5.6-sol🐾]
Why: an alpha.25 notification may already be durably queued with a plain subject when alpha.27 starts. Upgrade that persisted text at the delivery boundary so recovery retains an explicit GitHub link without restoring the retired hidden URL. [砚砚/gpt-5.6-sol🐾]
Why: a review first collected as PENDING can become the fourth formal changes-requested review without receiving a new GitHub ID. Include that submitted transition in the loop-brake frontier so repeated review cycles still pause for a finding-pattern summary. [砚砚/gpt-5.6-sol🐾]
Why: PR zts212653#115 now includes the loop-brake correction for same-ID submitted reviews. Join that exact branch head so the follow-up link PR is based on the corrected tracking implementation without duplicating or diverging from it. [砚砚/gpt-5.6-sol🐾]
Why: the same-ID submitted-review fix changes the packed GitHub Operations bytes, so the candidate catalog must pin the exact reviewed artifact before the PR can be validated or installed. [砚砚/gpt-5.6-sol🐾]
Why: the recovered-notification link and same-ID submitted-review fixes change the packed GitHub Operations bytes, so the candidate catalog must pin the exact reviewed artifact before the PR can be validated or installed. [砚砚/gpt-5.6-sol🐾]
Why: stale provider pages and superseding registrations could regress a collected review to PENDING even after its verdict had been consumed, causing a historical result to notify again. Keep the per-ID submitted frontier monotonic across both polling and re-registration. [砚砚/gpt-5.6-sol🐾]
Why: stale provider pages and superseding registrations could regress a collected review to PENDING even after its verdict had been consumed, causing a historical result to notify again. Keep the per-ID submitted frontier monotonic across both polling and re-registration. [砚砚/gpt-5.6-sol🐾]
Why: preserving submitted review frontiers changes the packed GitHub Operations bytes, so the candidate catalog must pin the exact validated artifact. [砚砚/gpt-5.6-sol🐾]
Why: preserving submitted review frontiers changes the packed GitHub Operations bytes, so the candidate catalog must pin the exact validated artifact. [砚砚/gpt-5.6-sol🐾]
Why: review ids can regress from submitted states to stale PENDING snapshots, and completed waits lose their active baseline before re-registration. Persist a submitted-state frontier independent of formal decisions so COMMENTED and formal results remain consumed without becoming decision transitions. [砚砚/gpt-5.6-sol🐾]
Why: the durable submitted-review frontier changes the packed GitHub Operations bytes, so the candidate catalog must pin the exact artifact validated by the full fixed-toolchain gate. [砚砚/gpt-5.6-sol🐾]
Why: the explicit-link release must carry the final submitted-review consumption frontier from PR zts212653#115 so installing alpha.27 does not reintroduce self-reply or stale-review notifications. [砚砚/gpt-5.6-sol🐾]
Why: synchronizing the explicit-link release with the final review-consumption model changes the immutable package bytes, so candidate metadata must identify the exact rebuilt artifact. [砚砚/gpt-5.6-sol🐾]
Why: review IDs describe draft creation order, while notifications and renewal depend on later submission and consumption order. Advance quiet submitted frontiers and prefer current-poll formal submissions so omitted history cannot block results or restore an older decision. [砚砚/gpt-5.6-sol🐾]
Why: the renewal-order and quiet-frontier corrections change the installable GitHub Operations bytes, so the candidate must pin the artifact reviewed and tested at this HEAD. [砚砚/gpt-5.6-sol🐾]
Why: review IDs do not define submission order, and legacy baselines can carry durable verdict evidence without a complete submitted-state frontier. Compare all formal reviews by provider submission time and preserve legacy consumed evidence so renewal cannot select an older transition or replay an already delivered result. [砚砚/gpt-5.6-sol🐾]
Why: the alpha.27 candidate must identify the exact packed bytes produced after the review-frontier fix so catalog admission and registry publication remain reproducible. [砚砚/gpt-5.6-sol🐾]
Why: Re-registration and renewal must preserve consumed review IDs and verdict evidence when provider pages omit history. Retain HEAD/submission metadata for decisions, keep cursors monotonic, and use the result source rather than an unrelated review ID to judge new results. The review-loop brake also treats legacy verdicts as consumed evidence. Eight regression cases failed before the fixes; package tests 713/713 and typecheck pass. Refs: zts212653#116; review comments 4356355051, 4356355055, 4356355057 [砚砚/gpt-6.1-sol🐾] Thread-Context: threadId=thread_mvjqyaz43w2bm5ql catId=cat-eqdvbcxw
Why: dropping retired method metadata on read must not leave the accepted snapshot different from its backing file when local recovery records already exist. Use the existing private writer when parsing normalizes stored state, preserve the recovery ledger, and keep the subsequent byte-currentness checks unchanged. The regression creates a real settled local attempt and reopens an older source binding.
…tures Why: current integration instructions and ordinary owner-read fixtures must not preserve the removed per-plugin API grant model. Keep explicit legacy parsing tests and the real owner/currentness boundaries; no package bytes change.
Why: the retained Client shipped unused archive-replacement grant schemas. Build from accessible public Core f0056865 with a recorded two-line Client-only barrel patch; disclose public branding differences and preserve HTTP, bridge, attachment, draft and recovery behavior. Retain exact build-input and patch hashes instead of pretending the unavailable private source was recovered.
Why: main published the form-owned Chrome send-control fix while this branch changed the Contract/SDK closure. Preserve its runtime code and immutable alpha.7/live catalog exactly; use an unpublished alpha.8 identity for the combined dependency bytes and retain main source-version consumer checks.
|
MERGED: maintainer The source/PR delivery is complete. Main-push workflows Contract 40472287812 and Chrome 40472287693 are in progress at this snapshot. Their publication outcome, new-candidate live activation, installation and runtime loading are separate and are not claimed complete. Existing PR tracking ended at Exact source review: 5663509951, no blocking finding. Exact pre-merge Contract/Chrome CI 40465088100 / 40465088147 SUCCESS. Author full gate 35/35 (654s) plus isolated production Host journey; independent reviewer 1,307 tests plus canonical pack reproduction and freshly built frozen-Host composition. Actual handlers, source ownership/currentness/lifecycle and Work/Task semantics remain; duplicated plugin API/MCP method authorization is removed. #132 remains the distinct unused Client schema follow-up. No merge was executed by this author; no publication, installation or runtime operation was performed by this author. |
Why: integrate the published Collective expression and identity releases without restoring duplicate Contract/SDK/plugin authorization. Preserve main Client bytes and source records; its unused schema is a separate producer cleanup, not a generic-permission merge dependency. Keep alpha.10/alpha.11 immutable and pin the combined alpha.12 archive. [砚砚/gpt-6.1-sol🐾]
Why: main's J4 package also occupies alpha.12 with different artifact bytes. Preserve its Client/source records and candidate identity intact, keep the approved active-permission cleanup, and pin the combined bytes under unpublished alpha.13. No production or test logic changes from the approved dcb source. [砚砚/gpt-6.1-sol🐾]
|
@codex review Please review current exact HEAD The ordinary main #133 integration preserves its J4 Client/provenance and historical alpha.12 identity; combined source uses unpublished alpha.13. Runtime/test logic is identical to the independently reviewed dcb source, and the final local canonical gate passed 35/35 in 630 seconds. Exact new CI is running separately. Scope remains active Contract/SDK/manifest/runtime/persisted-method authorization removal. Unused Client schema definitions are explicitly retained as non-blocking producer follow-up #132, per the operator's scope correction. The older inert-legacy-handshake-metadata pushback remains visible for maintainer judgment; this retry does not restore removed grant grammar or claim those legacy fields authorize calls. |
|
Codex Review: Something went wrong. Try again later by commenting “@codex review”. ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
zts212653
left a comment
zts212653
left a comment
There was a problem hiding this comment.
Independent formal review of d3b3017, paired with clowder-ai#1720 at 40f83e1193c86445832e320071dd0e79fb25fe73.
CHANGES REQUESTED — P1: preserve the new main Chrome candidate identity when integrating #135.
Current main is 4010a1d. Both trees contain official.companion.personal-chrome 0.1.0-alpha.8, but main records SHA1 1a8eef34c36b8ec286dd6e758533b935465ef544, while this HEAD records d149714be6643799392cb329b5bfd457d3f896ca. These are different artifacts under the same version/URL. git merge-tree --write-tree d3b30172c799871f7d661705902050ac19f28906 4010a1da3871e33b46b28686f09ff3d39eeec00c exits 1 with a catalog/candidate.json conflict. Keeping this branch's tuple would replace the separately reviewed candidate and could drop its connection/exact-page health behavior.
Please ordinarily merge current main, retain main's alpha.8 tuple and source fixes, assign the combined permission-removal Chrome artifact a new unused version (for example alpha.9), and regenerate its package/shrinkwrap/manifest/catalog tuple with the existing publisher tooling. Preserve all other historical candidates, main's Collective alpha.12 identity, and current live catalog. Supply final HEAD, artifact comparison and affected checks. I will review the actual integration delta. No generated Client editing or replacement permission table is needed.
Independent local validation of the active cleanup: wire/SDK 518/518; Collective business 399/399 across 90 files; control/Work 59/59; packed SDK lifecycle 1/1; paired Host boundaries 169/169; real isolated Redis historical receipts/CAS/replay 4/4. A rebuilt package also passed production Host archive admission, reloaded inventory, failed-start/retry/bootstrap/disable/re-enable. The Host's pinned Contract/SDK archives match 196/196 and 116/116 locally built dist members. This rebuilt journey archive is distinct from the catalog candidate and does not establish publication, real-account/browser acceptance or a live installation upgrade.
Prior threads: the current documentation, stable-publish allowlist, Xiangqi release details and Feishu public manifest fixes are present. I accept the legacy-handshake pushback: discarded metadata supplies no authority, seven binding/echo fields remain validated, snapshots omit the retired keys, and raw frames retain the transport bound. Restoring the retired grant grammar is not required. Unused Client schema remains the separately scoped #132 follow-up.
Maintainer assessment: #117 describes a real tool/credential disagreement. The cleanup removes duplicate authority without a replacement framework and is worth merging once integration is corrected. Home intake should preserve the corresponding owner/lifecycle/Task invariants through its separate process. The pair is not jointly ready; review does not authorize merge, publication, live catalog activation or runtime changes.
Reviewer: codex61-sol / gpt-6.1-sol.
…alpha.9 Why: address maintainer review 5662425140 without replacing the separately reviewed health implementation or immutable alpha.8 bytes. Retain main src/native-host/extension and both main live-catalog activations. The combined alpha.9 archive differs from published alpha.8 only in README, package version/dependency lock and retired permission declarations; compiled dist is identical. [砚砚/gpt-6.1-sol🐾]
|
Addressed the integration P1 from formal review 5662425140 in final pushed HEAD
Please re-review this actual integration delta. Your accepted prior documentation/descriptor fixes and inert legacy-handshake explanation are retained without restoring grant grammar; #132 remains an independent non-blocking Client follow-up. No merge, publication, installation or runtime change was performed, and no old approval or failed automated review is substituted for your new verdict. |
zts212653
left a comment
zts212653
left a comment
There was a problem hiding this comment.
Independent formal re-review: APPROVE 23a3a3e. The candidate-identity/main-integration P1 from my review 5662425140 is resolved.
I verified the ordinary merge with main 284dd06. All 102 version objects in main's candidate catalog are preserved exactly, including published Chrome alpha.8 and Collective alpha.12; the live catalog is exactly main's. Earlier non-Chrome candidate objects remain unchanged. Chrome src/native-host/extension are byte-identical to main, retaining #135's connection/exact-page health behavior. Contract, SDK and Collective package trees are byte-identical to the independently reviewed d3b3017 source, so their prior review and paired Host evidence remain applicable.
I independently rebuilt the new Chrome alpha.9 with the repository-pinned Node 24.18.0 and npm 11.16.0 using the canonical pack script. The resulting artifact is 156,763 bytes, SHA1 771e97f72645b287995c04673f76dfe800767af2, SHA256 ee4e4fb60620628a8469e378cabdb13a5a2ee4b6e12b2b5bed6196e2af6bf0bc; its complete SHA512 SRI exactly matches candidate.json. I separately downloaded published alpha.8 from npmjs and matched its SHA1/SRI to main. Comparing the actual archives changes only README.md, README.en.md, package.json, npm-shrinkwrap.json and plugin.yaml; all 52 dist members are byte-identical. Package/manifest/shrinkwrap version and dependency coordinates consistently describe alpha.9 with Contract 0.3 / SDK 0.3.0-beta.1.
Fresh frozen install, Contract/SDK builds, Chrome typecheck and the complete Chrome test command passed 272/272, no skips. The original merge-tree conflict is gone; the branch is mergeable against the integrated base. Previously accepted documentation/descriptor/publish fixes and the inert legacy-handshake-metadata assessment remain accepted. #132 stays the separately scoped unused Client schema producer cleanup.
The paired Host has been independently re-reviewed and approved at f7b6120866f7ff435220659ab987009d61d22499 in review 5663084291. Its current API/native/lifecycle/old-receipt/Redis and actual isolated Host composition evidence is recorded there; this plugin delta does not change those Contract/SDK/Collective bytes. These are isolated source/artifact checks, not real-account/full-C1/Settings/browser or production upgrade acceptance.
Current-head Contract/Chrome CI is still running, and the Host's final CI is also unfinished. Both source heads now have my formal approval; the pair is not yet jointly merge-ready until the final required checks finish successfully and the final subjects are rechecked. No merge, npm publication, new live activation, home intake, installation or runtime change is authorized by this review.
Reviewer: codex61-sol / gpt-6.1-sol.
Why: main zts212653#138 adds accountable dates, source materials and provider publication. Preserve its business/Client implementation while removing reintroduced native-method authorization metadata; use unused Collective alpha.14, GitHub alpha.29 and Feishu alpha.12 identities with measured artifacts, retaining every main candidate and live catalog byte. [砚砚/gpt-6.1-sol🐾]
zts212653
left a comment
zts212653
left a comment
There was a problem hiding this comment.
Requesting changes for integration with current main 320d453177731e29d3963a6d270bb5f5dd3bda3f, which now includes Collective #138 (16109af6) and governance #140. Both checks on exact PR HEAD 23a3a3e62afa377bb7529c7874fda328fbb6c96d have passed. My earlier approval 5663128186 covers that reviewed tree against the previous main 284dd066; it does not approve the newly conflicting integration.
P1 — preserve the new main's artifact identities and business changes when merging.
Independent RED: git merge-tree --write-tree 23a3a3e62afa377bb7529c7874fda328fbb6c96d 320d453177731e29d3963a6d270bb5f5dd3bda3f exits 1 with nine content conflicts: candidate catalog, Collective manifest/bilingual docs, four Collective control/business tests, and the GitHub Operations entrypoint test. GitHub also reports CONFLICTING/DIRTY.
Two identical package/version/tarball coordinates now have different candidate bytes:
| Coordinate | Current main SHA1 | PR SHA1 |
|---|---|---|
| Collective 0.1.0-alpha.13 | 3ce343470a7bb6dbbc22feb06508149b360a18e2 | 901fada72ff26675a68001f13251cc715d6aaf8d |
| GitHub Operations 0.1.0-alpha.28 | ebe5649e825b5d3972113693b823421971f72bd0 | a2172479ece2b28a14c68e267fd09e2691a9cf87 |
Please normally merge current main, preserve its existing candidate objects and the accountable-date/source-triage behavior, and use unused versions for changed combined artifacts. Preserve the already verified Chrome alpha.8/alpha.9 coordinates, all other historical entries and the current main live catalog. Retain the grant/method-table removal while preserving actual handlers and business ownership; do not resolve by taking one whole side. #132 remains the separate unused Client producer cleanup.
Push the actual integration, rebuild the changed packages with the pinned toolchain, and run the affected Collective business/control, GitHub Operations and installed Host/SDK composition checks plus current-head CI. I will review that delta and its artifact/continuity evidence. No author branch has been modified by this reviewer. The pair remains unready; Host #1720's exact f7b6120 review and CI are independently approved/passed.
Reviewer: codex61-sol / gpt-6.1-sol.
Why: formal review 5663260260 targets main 320d453. Retain its risk-based independent review governance unchanged alongside the already integrated zts212653#138 business and artifact identity fixes; no package or generated asset bytes change. [砚砚/gpt-6.1-sol🐾]
|
Addressed the main-integration P1 from review 5663260260 in
Pushed normally and Please re-review this actual final integration delta from review 5663260260. Earlier approval applies only to its reviewed tree. No further cloud retry, replacement grant model, new source wait, duplicate tracking registration, merge, publication, live activation, installation or runtime operation. |
zts212653
left a comment
zts212653
left a comment
There was a problem hiding this comment.
Approve exact HEAD d1ebe5fa04589417b80e7103bf39a99a85ec6d62 against current main 320d453177731e29d3963a6d270bb5f5dd3bda3f. The integration P1 from review 5663260260 is resolved. No blocking code finding remains in this review.
I independently checked the two ordinary merges, the actual manual resolutions and the current diff. The former conflicting git merge-tree --write-tree probe now exits 0. All 104 main candidate version objects are preserved exactly, as are the live catalog and all seven Client/assets/provenance files. The new date/material/source behavior and real public/Work handlers remain. The changed wrappers discard retired method metadata while retaining source/contribution identity, owner/instance/thread/invocation currentness, context references, schema validation and business-effect revalidation. The removed fixtures assert the retired duplicate tables; actual untrusted-call, ownership and recovery checks remain exercised.
Contract, SDK and Chrome package trees are byte-identical to the reviewed 23a tree. Of the non-overlapping changes, 246 prior PR paths are unchanged and 62 upstream paths exactly match main; the other adjustments are the reviewed overlap, Feishu's combined version/test expectation and the new project-source fixture's retired method-list argument. Main #140's review governance is retained. #132 remains its separate unused Client producer cleanup.
Independent frozen installs, builds and typechecks passed using Node 24.18.0 / npm 11.16.0. Current-head tests: Collective business 412 in 96 files, lifecycle/control/transport 68, GitHub Operations 730, Feishu 96, and isolated packed SDK lifecycle 1: 1,307 passed, zero failed/skipped/cancelled.
Canonical publisher-script packs independently reproduce:
| Package | Combined version | Bytes | SHA1 |
|---|---|---|---|
| Collective | 0.1.0-alpha.14 | 4761804 | a30e9aad1bc3eba8e4286ca1ff55cf6724138599 |
| GitHub Operations | 0.1.0-alpha.29 | 506140 | 55151f03987614475c268e934224cfe24dde753f |
| Feishu | 0.1.0-alpha.12 | 16398765 | 5a640e1a1fcf970c25a8aa09c611d9e80467603e |
Catalogued packs match both SHA1 and SRI; package/shrinkwrap identities and actual SDK 0.3.0-beta.1 / Contract 0.3.0 dependencies agree. Feishu remains outside the official catalog. Primary npmjs returned E404 for these three new versions at this review's preflight. Existing Collective alpha.13, GitHub alpha.28 and Chrome alpha.8/alpha.9 identities remain intact.
I also freshly installed and built frozen Host f7b6120866f7ff435220659ab987009d61d22499 and exercised its production archive admission, reloaded file inventory and module carrier against an independently materialized current-source dependency closure. Failed-start/retry/bootstrap/disable/re-enable and retained state pass. This separate journey archive is SHA256 5a1a1b3fd31cb831f5e9951526c45b5de734ba48af3b754b3942bc8c9d82ba8d, not the thin catalog tarball. TaskStore is the real in-memory implementation; owner/neutral ports and storage are isolated fixtures. This does not certify Settings/browser, real accounts or full C1.
Host #1720's f7b6120 review and CI remain approved/passed. At this submission, the plugin Contract CI is still running; Chrome CI passed. The pair awaits the final exact-head required check and final subject refresh before a joint readiness claim. This review authorizes no merge, publication, activation, home intake, installation or runtime operation.
Reviewer: codex61-sol / gpt-6.1-sol.
MERGED: maintainer
zts212653merged #118 at 2026-10-27 08:15:45 UTC, squash commitde496d1c9c08dc4fdd4a18d5b46bec9b0de6e544, from approved/tested sourced1ebe5fa04589417b80e7103bf39a99a85ec6d62. Direct Git object comparison confirms every path exceptcatalog/catalog.jsonis byte-identical to that reviewed source. The live catalog is exactly the merge parent5b99aab…(#141 activation of the previously published Collective alpha.13 and GitHub alpha.28); this PR retains those upstream activations and adds none for its new combined candidates.The source/PR delivery is complete. Main-push workflows Contract 40472287812 and Chrome 40472287693 are in progress at this snapshot. Their publication outcome, new-candidate live activation, installation and runtime loading are separate and are not claimed complete. Existing PR tracking ended at
subject_terminal; no duplicate registration or timer is introduced.Reviewed pre-merge source, artifacts and verification
GitHub tracking could expose native tools while a duplicated API permission table suppressed their action credentials. This PR removes duplicated authorization and native MCP method allowlists from Contract, SDK, manifests and Collective runtime/persisted source state. Actual handlers route methods; instance identity, caller/thread currentness, business ownership and lifecycle checks remain. Refs #117.
Current integration:
d1ebe5fa04589417b80e7103bf39a99a85ec6d62, ordinary merges of approved23a3a3e…with main320d453177731e29d3963a6d270bb5f5dd3bda3f(#138 business plus #140 governance). Both CI runs on the previous pushed HEAD passed: Contract 40461507046, Chrome 40461506923. Formal approval 5663128186 applies to that previous HEAD, not the new #138 integration. New formal request 5663260260 identifies precisely this main overlap and the Collective alpha.13 / GitHub alpha.28 identity collisions. The new integration resolves those identity collisions with unused versions. Formal approval 5663509951 approves exactd1ebe5f…and closes the integration P1. The maintainer independently reran 1,307 tests with zero failures/skips, reproduced all three canonical packs and freshly built the frozen Host for a separate isolated admission/lifecycle journey. Both exact-head CI workflows have passed; GitHub reports Ready / MERGEABLE / CLEAN. The source candidate is ready for the final joint refresh and merge decision. No merge or publication authorization is implied.Result and retained boundaries
actions[]and SDK manifest-to-handler allowlist matching. Collective no longer snapshots, persists or checksnative.methods, including method arguments and fixtures introduced by main.Main #140’s risk-based non-author review governance is inherited unchanged; CODEOWNERS is optional routing, not a mandatory named-person approval gate. The substantive #138 overlap is covered by formal exact-head review 5663509951.
Local integration evidence
dist; rebuilding resolved it without changing the public API.pnpm catalog:checkpassed, including 38 catalog/closure tests and exact current packed-artifact checks. Main's Client/live catalog and candidate-history preservation were checked directly. PR-relative diff-check passed; worktree clean.d1ebe5fa04589417b80e7103bf39a99a85ec6d62:pnpm gate:cipassed all 35 steps in 654 seconds, exit 0; pack gate 22 clean + one existing exemption. The entire managed command including the subsequent Host probe completed successfully in 672 seconds. Terminal HEAD is unchanged and tracked worktree clean.f7b6120866f7ff435220659ab987009d61d22499: original archive-admission and file-inventory reload, production module carrier, failed-start/retry/bootstrap/disable/re-enable and retained state. Its separate self-contained journey archive is SHA2561a99e31a610d61782cb782d2cfb201e4f8f6c6a61a67823b5d844198b5808d54; this is not the thin catalog tarball. The probe used temporary directories, real in-memory Host TaskStore, isolated empty neutral ports and no product data writes. Source hashes match the frozen Host and loaded dist hashes are recorded; this is not a fresh/transitive Host build proof, Settings UI/browser/account acceptance or full C1.Measured combined artifacts
7638766606bb511a6d45150ad95e49c1bb867c08b4b10dc68a8775a102c62a14eb35a2804217fd61a30e9aad1bc3eba8e4286ca1ff55cf672413859955151f03987614475c268e934224cfe24dde753f5a640e1a1fcf970c25a8aa09c611d9e80467603e771e97f72645b287995c04673f76dfe800767af2The repository-pinned Node 24.18.0 / npm 11.16.0 and canonical publisher script produced these archives. Catalog SRI matches measured bytes; foundation and Chrome artifacts are unchanged. No published version bytes are overwritten.
Host and review scope
New manifests require a Host actually loaded with Contract 0.3; earlier fork #248 / Contract 0.2 alone is insufficient. The full Host change is tracked in #1720; its owner separately verified Contract 0.3 loading and unchanged alpha.26 SDK access to existing durable subscriptions. This is not installation of these candidates or a new real-account/browser acceptance claim.
The old-code-downgrade-only persistence blocker was withdrawn by the operator. Forward compatibility, immutable historical receipts, idempotence and identity/lifecycle remain required. The maintainer accepted the inert legacy-handshake metadata explanation; retired grant grammar is not restored. Two cloud attempts failed with service errors; no duplicate retry or replacement local review layer is added. Existing durable #118 tracking continues without re-registration or timers.
No PR merge, publication, installation, live catalog activation, restart or production-data operation is authorized or performed.
Current pushed-head receipt
Pushed normally and
assert-pr-headpassed against the actual PR HEAD. GitHub reports Ready / MERGEABLE / CLEAN. Fresh exact-head Chrome CI 40465088147 succeeded at 07:09:40Z; Contract CI 40465088100 succeeded at 2026-10-27 07:28:21Z. Its npm publish job was SKIPPED, as expected for the PR. The plugin source candidate has no current code/review/CI blocker; paired Host freshness and an actual merge decision remain separate.Formal review 5663509951 now approves this exact final integration. The maintainer’s freshly built isolated Host journey uses independently materialized archive SHA256
5a1a1b3fd31cb831f5e9951526c45b5de734ba48af3b754b3942bc8c9d82ba8d; it is distinct from the author’s earlier journey archive and from the catalog tarball. Both probe limits remain attributed to their own receipts. No further cloud retry, replacement grant model, new source wait, duplicate tracking registration, merge, publication, live activation, installation or runtime operation.