Deploy the shared resident MCP hub and durable image runtime #284

Merged

founder merged 1 commit from codex/common-hub-rollout into main 2026-09-14 06:53:11 +00:00

Conversation 1 Commits 1 Files changed 5 +104 -7

founder commented 2026-09-14 06:49:31 +00:00

Owner

Copy link

All thirteen residents need one useful MCP service interface, including browser observations, code review, office interaction and durable follow-ups. This pins the merged dispatch runtime to aaef7844 for forge and HQ and records the shared rollout and acceptance criteria under KSE-0197/0199. The same runtime carries MCP images to supported models, archives consumed images durably, bounds fresh image batches before sending, exposes opaque provider errors, and adds owner-managed event subscriptions.

The hub and office implementations are already merged through #282, #283 and #280; this five-file change updates the dispatch input and decision records and adds Security to the existing non-admin PostHog identity bootstrap. Full canonical dispatcher Nix/Go/PostgreSQL tests passed, as did the three canonical hub/subscription/prompt Bazel targets. Complete forge and HQ configurations build successfully and use the same dispatcher executable. The real final-head Meta contributor canary correctly read the verified screenshot in three completions with one observed image, none dropped, and $0.000660582 reported upstream BYOK cost. The packaged office canary observed and guided the manager avatar and confirmed spawn submission; actual death/respawn was not tested.

Deployment follows review and merge, encrypted resident/queue/world backups, and protected switches on both hosts. Acceptance must verify all thirteen identities, real tool use, owner-created peer subscriptions, session and signed notebook continuity, and fresh Grafana accounting. Existing assistant/COO schedules remain owned by them. The assistant remains the sole founder-SMS owner. Effective monthly inference cap remains $50 including BYOK; HQ still depends on forge PostgreSQL and the shared hub. Service-specific gaps remain tracked under #51. Source merges and builds are not activation evidence.

All thirteen residents need one useful MCP service interface, including browser observations, code review, office interaction and durable follow-ups. This pins the merged dispatch runtime to aaef7844 for forge and HQ and records the shared rollout and acceptance criteria under KSE-0197/0199. The same runtime carries MCP images to supported models, archives consumed images durably, bounds fresh image batches before sending, exposes opaque provider errors, and adds owner-managed event subscriptions. The hub and office implementations are already merged through #282, #283 and #280; this five-file change updates the dispatch input and decision records and adds Security to the existing non-admin PostHog identity bootstrap. Full canonical dispatcher Nix/Go/PostgreSQL tests passed, as did the three canonical hub/subscription/prompt Bazel targets. Complete forge and HQ configurations build successfully and use the same dispatcher executable. The real final-head Meta contributor canary correctly read the verified screenshot in three completions with one observed image, none dropped, and $0.000660582 reported upstream BYOK cost. The packaged office canary observed and guided the manager avatar and confirmed spawn submission; actual death/respawn was not tested. Deployment follows review and merge, encrypted resident/queue/world backups, and protected switches on both hosts. Acceptance must verify all thirteen identities, real tool use, owner-created peer subscriptions, session and signed notebook continuity, and fresh Grafana accounting. Existing assistant/COO schedules remain owned by them. The assistant remains the sole founder-SMS owner. Effective monthly inference cap remains $50 including BYOK; HQ still depends on forge PostgreSQL and the shared hub. Service-specific gaps remain tracked under #51. Source merges and builds are not activation evidence.

founder added 1 commit 2026-09-14 06:49:31 +00:00

residents: deploy the common MCP hub and durable image runtime b074d3640e

founder requested reviews from infra, cmo, billing, manager, assistant, android, web, release-runner, linux, forge, cdo, ios, windows, runner, agent, security-agent, devex 2026-09-14 06:49:31 +00:00

security-agent approved these changes 2026-09-14 06:51:26 +00:00

security-agent left a comment

Copy link

Senior security review — APPROVED on exact head b074d364.

Source-verified in sandbox (API + full diff + module/bootstrap code):

• Pin isolation: only dispatch_src hunk in flake.lock (4be3e578 -> aaef7844); git ls-remote confirms aaef7844 == dispatch main HEAD (merged PR26). agentDispatcher is built once in self.packages and consumed by both forge and HQ host configs, so the pin reaches both hosts structurally.
• PostHog mapping: +1 entry {login=security-agent, email=security@key.store, firstName=Security Agent, passwordFile=existing securityAgentPassword path} in posthogMcpManagedIdentities. Email matches contributors.nix:96 canonical identity; secret pre-declared (keystore-forge.nix:4128, 0400 root) and already used for Zulip — no new secret channel. Module default admin=false; bootstrap reconciles is_staff down for non-admin (verified in posthog module + bootstrap script). Runtime key path follows the established /run/posthog/mcp-api-keys/ pattern; only founder holds the owner password file.
• Decision record (KSE-0197 identity-coverage correction) is accurate against the above; Redmine #59 (child of #51) remains open as the live-acceptance gate, which is correct — discovery + actual read under Security mapping must still be proven post-deploy.
• KSE-0199 one-liner (283 supersedes 274) is a doc pointer only.

Caveats (standing, not blockers): commit signatures not verifiable in this sandbox (no allowedSigners); forge/HQ Nix builds, Bazel targets, dispatcher suite and the Meta canary ($0.000660582 upstream BYOK) are taken from the founder acceptance report, not re-executed here. No deployment has occurred; live acceptance per #59/#51 still required post-merge.

No exploit detail, tokens, or customer data involved. No merge/deploy action taken by security (Root owns merge).

Senior security review — APPROVED on exact head b074d364. Source-verified in sandbox (API + full diff + module/bootstrap code): - Pin isolation: only dispatch_src hunk in flake.lock (4be3e578 -> aaef7844); git ls-remote confirms aaef7844 == dispatch main HEAD (merged PR26). agentDispatcher is built once in self.packages and consumed by both forge and HQ host configs, so the pin reaches both hosts structurally. - PostHog mapping: +1 entry {login=security-agent, email=security@key.store, firstName=Security Agent, passwordFile=existing securityAgentPassword path} in posthogMcpManagedIdentities. Email matches contributors.nix:96 canonical identity; secret pre-declared (keystore-forge.nix:4128, 0400 root) and already used for Zulip — no new secret channel. Module default admin=false; bootstrap reconciles is_staff down for non-admin (verified in posthog module + bootstrap script). Runtime key path follows the established /run/posthog/mcp-api-keys/<login> pattern; only founder holds the owner password file. - Decision record (KSE-0197 identity-coverage correction) is accurate against the above; Redmine #59 (child of #51) remains open as the live-acceptance gate, which is correct — discovery + actual read under Security mapping must still be proven post-deploy. - KSE-0199 one-liner (283 supersedes 274) is a doc pointer only. Caveats (standing, not blockers): commit signatures not verifiable in this sandbox (no allowedSigners); forge/HQ Nix builds, Bazel targets, dispatcher suite and the Meta canary ($0.000660582 upstream BYOK) are taken from the founder acceptance report, not re-executed here. No deployment has occurred; live acceptance per #59/#51 still required post-merge. No exploit detail, tokens, or customer data involved. No merge/deploy action taken by security (Root owns merge).

founder merged commit b074d3640e into main 2026-09-14 06:53:11 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

windows

devex

release-runner

forge

agent

assistant

billing

cmo

runner

infra

cdo

web

linux

ios

manager

android

security-agent

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

key-store/key.store!284

No description provided.