Overseer Handover — Knowtation
Cross-repo note: Scooling is the orchestration layer. Primary handover lives in
scooling/docs/OVERSEER-HANDOVER.md — copy the NEXT SESSION block from there for
Scooling-tracked phases.
Knowtation-specific history → this file's change log below.
NEXT SESSION — Durable agent auth Phase B (Thinking → Auto)
Date: 2026-07-12
Branch to start from: main (after Phase A merge) → feat/connect-cloud-agent-device-code
Read first:
docs/DURABLE-AGENT-AUTH-SPEC.md§5–6 (Rank swap)docs/DURABLE-AGENT-AUTH-ROADMAP.mdPhase B- Spike:
docs/evidence/durable-agent-auth/hermes-oauth-spike-2026-07-12.md
Why B is primary: Hermes Hostinger spike was partial → Rank 1↔2 swap. Device authorization (RFC 8628) is the critical path for headless Hostinger; durable MCP OAuth (Phase A) remains for Cursor / OAuth-capable clients.
Model tier (RULE #8): Phase B Thinking (UX: device-code vs guided OAuth wireframes) on a thinking model → freeze → Auto Build.
Shared context (prepend to phase prompt)
You are building Knowtation Hub “Connect cloud agent” for remote always-on agents.
Read: Spec §5–7, Roadmap Phase B, Phase A durable refresh (already on persistent MCP host), web/hub Integrations UI.
Guardrails: no long-lived god JWTs; no secrets in logs; do not teach Netlify /mcp; update Spec/Roadmap/this handover + open PR when done; no commit/push without explicit consent.
Tests: unit + integration + e2e + security minimum for Phase B DoD.
Phase B prompt (draft)
Build Phase B — Hub Connect cloud agent (device authorization primary).
Goal: Non-SSH user connects a cloud agent to their vault in one Hub flow (RFC 8628
user_code + verification URL), issuing a refreshable credential; revoke from same panel.
Frozen: Roadmap Phase B after Rank 1↔2 swap. Prefer device code when loopback/paste-back
is unreliable (Hostinger). May deep-link Hermes MCP OAuth when spike follow-up confirms
Managed Hermes OAuth.
DoD + tests: Roadmap Phase B. Update ROADMAP, this OVERSEER-HANDOVER, Hub copy +
AGENT-INTEGRATION in the same PR as code. No docs-only PR to main.
Interim ops (Born Free)
See Spec §12 — Cursor MCP OAuth / Hub propose until Phase B ships; Phase A durable refresh is live on MCP host after merge.
Knowtation status
| Phase 1D | LIVE (gate on) — KN-INF-3a 2026-07-07 |
| Hosted calendar blobs | INF-KN-3b (#266) + INF-KN-3c (#267) strong read-after-write |
| INF-3 connect | PASS 2026-07-08 (connect=ok + source calendars) |
| API | api.knowtation.store live |
| MCP public | mcp.knowtation.store/mcp (web/hub/config.js) |
| Durable remote-agent auth | Phase A DONE 2026-07-12 — durable MCP refresh + scope REST guard + offline-lock assert; Hermes spike partial → Phase B device code primary |
Change log (recent)
| Date | Event |
|---|---|
| 2026-07-12 | Phase A Build DONE — KnowtationOAuthProvider → createGatewayRefreshStore({ consistency: 'strong' }); agent meta; mcp_access scope REST guard; offline-lock; Hermes spike partial + Rank swap; tests durable-mcp-oauth-*.test.mjs; docs AGENT-INTEGRATION always-on |
| 2026-07-12 | Durable agent auth freeze revised after adversarial security/identity review: Spec §1/§5/§8/§14 + Roadmap Phase A |
| 2026-07-12 | Durable agent auth Thinking freeze — Spec + ROADMAP; branch feat/durable-agent-mcp-auth-thinking |
| 2026-07-08 | INF-3 operator connect smoke PASS after #267 deploy |
| 2026-07-08 | INF-KN-3c — calendar store blob hydrate consistency: 'strong' + merge pending OAuth — KN #267 |
| 2026-07-07 | INF-KN-3b — calendar store + OAuth token blobs; gateway redirect: 'manual' — KN #266 |
| 2026-07-07 | KN-INF-3a — CALENDAR_OAUTH_GOOGLE_AUTHORIZED=true — KN #265 |
| 2026-07-05 | Calendar step 11b MERGED — Google OAuth connector (1D) |
Legacy detail (2026-07-03 snapshot — reference only)
Media write surfaces (2F-b-d-kn): gates on dev/staging via data/hub_media_write_policy.json;
node --test test/media-write-*.test.mjs — 22/22; live smoke 7/7. Scooling consumer:
MEDIA_*_AUTHORIZED all live on main. Superseded prompts archived in git history @ bd73698.