diff --git a/quest/m0/kix/README.md b/quest/m0/kix/README.md index dc424340..0a107077 100644 --- a/quest/m0/kix/README.md +++ b/quest/m0/kix/README.md @@ -95,6 +95,9 @@ operator-paid-hosting decisions: - [Job sandbox](/quest/m0/kix/sandbox.md) - OS-sandboxed commands, with untrusted PR devShells built in a VM on Linux runners - [opencode adapter](/quest/m0/kix/opencode.md) - OpenCode Go, ChatGPT plans, and API-key providers through opencode - [Decision inbox](/quest/m0/kix/prompts.md) - a simple prompt UI with new-issue and new-PR notifications +- [Webhook reconcile](/quest/m0/kix/reconcile.md) - new issues and PRs arrive in the inbox ready to act on, without a manual refresh +- [Inbox merge](/quest/m0/kix/merge.md) - PR items merge the reviewed head through GitHub's rules +- [Co-maintainer inbox](/quest/m0/kix/members.md) - every current maintainer sees enrolled projects in their inbox - [Output retention](/quest/m0/kix/output.md) - raw agent output in R2, kept 30 days and capped at 64 MiB per attempt - [Agent activity](/quest/m0/kix/activity.md) - agent cards and map highlights built from checkpoint summaries - [Mobile web app](/quest/m0/kix/mobile.md) - an installable PWA with Web Push for decisions diff --git a/quest/m0/kix/members.md b/quest/m0/kix/members.md new file mode 100644 index 00000000..d38683d3 --- /dev/null +++ b/quest/m0/kix/members.md @@ -0,0 +1,29 @@ +# [S] Show co-maintainers' projects in their inbox + +## Goal + +Every current maintainer of an enrolled project sees it in their decision +inbox, not only the user who enrolled it. A maintainer whose access is revoked +stops seeing it. + +## Plan + +Decided 2026-10-18 as a follow-up of the decision inbox (#144), which lists +only projects the viewer enrolled (`enrolledBy`): + +- A maintainer joins a project's inbox membership when they pass the + per-request maintainer check on its project page. No extra GitHub calls to + list maintainers. +- Membership only decides which projects the inbox lists. It is not + authority: every action still rechecks the maintainer per request. +- A maintainer check that GitHub answers with a denial drops that user's + membership along with their read and skip state for the project. A check + that cannot complete (an outage or rate limit) fails the request and leaves + membership as it is. The enrolling user is a member like any other. +- Disconnecting a project removes its memberships with it. +- Test a co-maintainer joining, a revoked maintainer dropping out, a + rate-limited check keeping membership, and a non-maintainer never joining. + +## Required + +- [Decision inbox](/quest/m0/kix/prompts.md) - the inbox and its read state diff --git a/quest/m0/kix/merge.md b/quest/m0/kix/merge.md new file mode 100644 index 00000000..adbc8da5 --- /dev/null +++ b/quest/m0/kix/merge.md @@ -0,0 +1,32 @@ +# [S] Merge PRs from the decision inbox + +## Goal + +A PR item in the decision inbox offers a merge button when the maintainer may +merge it. Clicking it merges exactly the head they reviewed through GitHub, +using a method the repository allows, or shows GitHub's refusal plainly. + +## Plan + +Decided 2026-10-18 as a follow-up of the decision inbox (#144), whose PR items +offer only "Review on GitHub": + +- Build on the bot publication's merge: bound to the current head, with the + method picked from the repository's allowed methods (squash, then merge + commit, then rebase). Keep that logic in publication and only add the + inbox action here. +- Show the button only when it can work: the PR is open, the viewer passes + the per-request maintainer check, and GitHub reports it mergeable. Otherwise + keep "Review on GitHub". +- Bind the form to the head SHA the maintainer saw. A moved head, failing + checks, missing reviews, or branch rules refuse the merge and say why; never + retry or bypass them. +- An agent recommendation is never approval: the merge happens only on the + maintainer's click. +- Test a moved head, a refused merge, a squash-only repository, and a + non-maintainer. + +## Required + +- [Bot publication](/quest/m0/kix/publication.md) - the head-bound merge and method selection +- [Decision inbox](/quest/m0/kix/prompts.md) - the PR items that show the button diff --git a/quest/m0/kix/mobile.md b/quest/m0/kix/mobile.md index ab4a12c0..68b51b64 100644 --- a/quest/m0/kix/mobile.md +++ b/quest/m0/kix/mobile.md @@ -33,6 +33,9 @@ Decided 2026-10-15 in the decisions-not-implementations interview: encryption and VAPID signing work in the Workers runtime with WebCrypto before choosing a library. Keep payloads minimal (project and decision title), since the full context loads in the app. +- Show an unread decision count in the nav and, where the Badging API is + supported, on the installed app icon. Decided 2026-10-18 as a follow-up of + the decision inbox (#144), folded here rather than its own quest. - Make the installed app phone-first: the inbox, prompts, and activity cards fit a narrow viewport and work with touch and keyboard. - Sources: diff --git a/quest/m0/kix/reconcile.md b/quest/m0/kix/reconcile.md new file mode 100644 index 00000000..6ba89ae0 --- /dev/null +++ b/quest/m0/kix/reconcile.md @@ -0,0 +1,33 @@ +# [S] Reconcile projects after each webhook + +## Goal + +A new GitHub issue, PR, or quest change arrives in the decision inbox with its +title and context, ready to act on, without anyone clicking "Refresh from +GitHub". The manual refresh stays as a fallback. Webhooks still never approve +or launch work. + +## Plan + +Decided 2026-10-18 as a follow-up of the decision inbox (#144), which shows a +webhook's item as a bare pointer ("Issue #N") and offers only a refresh until +someone reads the project from GitHub: + +- After a webhook records an observation, reconcile that project in the + background with the App's installation token. Coalesce bursts so repeated + or duplicate deliveries for one project trigger one read, not one each. +- Background reads publish observations only. Authority stays per request: + every action still rechecks the acting maintainer, as decided for the + inbox, so a background read never grants or caches authority. +- A failed or rate-limited reconcile leaves the item as it is today, with + the refresh fallback and its reason shown, and a later webhook or refresh + retries. No retry loops. +- The per-load GitHub call count (about five per project) stays as is until + it becomes a measured problem; caching authority checks would weaken the + per-request recheck. +- Test with duplicate deliveries, a burst of deliveries, a failed read, and a + webhook for a paused or disconnected project. + +## Required + +- [Decision inbox](/quest/m0/kix/prompts.md) - the webhook items this fills in diff --git a/quest/m0/kix/runner.md b/quest/m0/kix/runner.md index 02118e54..81bc7169 100644 --- a/quest/m0/kix/runner.md +++ b/quest/m0/kix/runner.md @@ -71,6 +71,10 @@ replacing the hosted Agent SDK runtime: away. Each account's opaque ID must stay stable across restarts so its preference rank and paused sessions follow it. A CLI sign-in flow and a control to reorder account preference remain here. +- Add a runner and account settings page as a secondary view off the + decision inbox: each runner's online state, its accounts, and the + preference-order control. Decided 2026-10-18 as a follow-up of the + decision inbox (#144), folded here rather than its own quest. ## Required