Skip to content

feat(reborn): scoped-lifecycle admin install store (#3288) — availability foundation for #5261 #4544

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
serrrfirat wants to merge 14 commits into
base: main
Choose a base branch
from
Open

feat(reborn): scoped-lifecycle admin install store (#3288) — availability foundation for #5261 #4544

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
6eefc7d
feat(reborn): add scoped lifecycle admin foundation
serrrfirat Jun 8, 2026
0e1ff3b
refactor(reborn): simplify scoped lifecycle lookups
serrrfirat Jun 8, 2026
44fd9e7
fix(reborn): reject duplicate scoped lifecycle packages
serrrfirat Jun 8, 2026
1e2be9b
fix(reborn): make scoped lifecycle package uniqueness atomic
serrrfirat Jun 8, 2026
17863f0
fix(reborn): guard scoped lifecycle deletes by version
serrrfirat Jun 8, 2026
a3ffe9d
fix(reborn): keep scoped lifecycle delete tombstones durable
serrrfirat Jun 8, 2026
b670561
fix(reborn): reserve scoped lifecycle installation ids
serrrfirat Jun 8, 2026
7334847
fix(reborn): tombstone scoped lifecycle id reservations
serrrfirat Jun 8, 2026
b408246
fix(reborn): make scoped lifecycle id deletes retryable
serrrfirat Jun 8, 2026
68dc061
fix(reborn): classify scoped lifecycle package races
serrrfirat Jun 8, 2026
c506170
fix: address scoped lifecycle review comments
serrrfirat Jun 17, 2026
be2ab7c
Merge remote-tracking branch 'origin/main' into codex/reborn-scoped-l…
serrrfirat Jun 17, 2026
de1cd61
Merge origin/main into scoped-lifecycle-admin (take over #4544)
zetyquickly Jun 25, 2026
fc014da
feat(reborn): availability resolver at the dispatch seam (#5267)
zetyquickly Jun 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion FEATURE_PARITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -337,7 +337,7 @@ Trace Commons issuer/TenantCtx note: the server-side `zmanian/tracedao-server` s
| Z.AI tool_stream | ✅ | ❌ | Real-time tool call streaming |
| Plugin tools | ✅ | ✅ | WASM tools |
| GSuite WASM tools | ✅ | 🚧 | Reborn bundles operation-level Google Drive/Docs/Sheets/Slides WASM packages with host-mediated HTTP egress, product-auth scoped bearer injection, and manifest-declared Google OAuth setup metadata; full live-recorded parity remains follow-up |
| Hosted MCP extensions | ✅ | 🚧 | Reborn composes host-mediated MCP runtime, bundles the current Notion MCP supported tool set, wires Notion ProductAuth OAuth exchange/refresh, can use Reborn ProductAuth DCR OAuth setup through the host callback origin, and can activate hosted MCP packages with live `tools/list` schema discovery through host-staged product-auth credentials |
| Hosted MCP extensions | ✅ | 🚧 | Reborn composes host-mediated MCP runtime, bundles the current Notion MCP supported tool set, wires Notion ProductAuth OAuth exchange/refresh, can use Reborn ProductAuth DCR OAuth setup through the host callback origin, can activate hosted MCP packages with live `tools/list` schema discovery through host-staged product-auth credentials, and now has a product-workflow scoped lifecycle model/store foundation for admin-shared plus user-private package resolution; WebUI/API wiring and adapter activation against that scoped store remain pending |

@coderabbitai coderabbitai Bot Jun 25, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Clarify the hosted MCP status wording.

“Can activate” reads as shipped behavior, but the same sentence says WebUI/API wiring and adapter activation are still pending. Split the store/resolution foundation from the actual activation path so the parity row doesn’t overclaim.

♻️ Suggested wording tweak 
- ...can activate hosted MCP packages with live `tools/list` schema discovery through host-staged product-auth credentials, and now has a product-workflow scoped lifecycle model/store foundation for admin-shared plus user-private package resolution; WebUI/API wiring and adapter activation against that scoped store remain pending
+ ...has a product-workflow scoped lifecycle model/store foundation for admin-shared plus user-private package resolution; WebUI/API wiring and adapter activation against that scoped store remain pending

Based on the storage-boundary note in crates/ironclaw_product_workflow_storage/AGENTS.md, the docs should separate the foundation from activation wiring.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
| Hosted MCP extensions | ✅ | 🚧 | Reborn composes host-mediated MCP runtime, bundles the current Notion MCP supported tool set, wires Notion ProductAuth OAuth exchange/refresh, can use Reborn ProductAuth DCR OAuth setup through the host callback origin, can activate hosted MCP packages with live `tools/list` schema discovery through host-staged product-auth credentials, and now has a product-workflow scoped lifecycle model/store foundation for admin-shared plus user-private package resolution; WebUI/API wiring and adapter activation against that scoped store remain pending |
| Hosted MCP extensions | ✅ | 🚧 | Reborn composes host-mediated MCP runtime, bundles the current Notion MCP supported tool set, wires Notion ProductAuth OAuth exchange/refresh, can use Reborn ProductAuth DCR OAuth setup through the host callback origin, and now has a product-workflow scoped lifecycle model/store foundation for admin-shared plus user-private package resolution; WebUI/API wiring and adapter activation against that scoped store remain pending |
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@FEATURE_PARITY.md` at line 340, Clarify the Hosted MCP extensions parity row
so it does not imply shipped activation behavior when only the storage and
resolution foundation exists. Update the wording in FEATURE_PARITY.md to
separate the product-workflow lifecycle model/store foundation and package
resolution support from the still-pending WebUI/API wiring and adapter
activation path, using the Hosted MCP extensions entry as the anchor. Keep the
sentence aligned with the storage-boundary guidance from the product workflow
storage docs so “can activate” is replaced with language that only describes
what is actually implemented today.

| NEAR AI MCP extension | ✅ | 🚧 | Host-bundled Reborn MCP extension exposes `nearai.web_search` via host-mediated HTTP and `llm_nearai_api_key`; local-dev startup now auto-seeds product-auth and activates the bundled MCP extension when `NEARAI_BASE_URL` plus `NEARAI_API_KEY` are configured, and WebChat v2 no longer projects that host-managed credential as extension setup work while NEAR remains a static supported-tool adapter |
| Tool policies (allow/deny) | ✅ | ✅ | Reborn now stores scoped persistent `AlwaysAllow` approval policies for manifest-allow capabilities and replays them at the current sandbox scope; WebChat v2 exposes authenticated caller-scoped tool approval settings at `/api/webchat/v2/settings/tools` so regular multi-user sessions do not need operator config access; product-facing revoke paths remain follow-up while the policy-store revoke interface is available |
| Exec approvals (`/approve`) | ✅ | ✅ | TUI approval overlay |
Expand Down
Loading
Loading