Memory
INT_CONTROL SESSION WORK — MCP portals + ambient sphere gatekeeper (Mike + docucleardev, Sep 3 late evening; reported by Mike Sep 4, 2026, ~01:04 BST first-party; reconciles gap 6c219794 part 2 of 2). Estate grows 6 → 8 workers. 1) TWO MCP PORTAL GATEKEEPERS (upstream @gadgets/mcp-portal-gatekeeper, starter layer only, submodule untouched): - docuclear-mcp-portal-internal — vetted tier (MCP_PORTAL_TRUST_ANNOTATIONS=true), https://control-internal-portal.docuclear.ai/mcp - docuclear-mcp-portal-external — byo tier (trust off), https://control-external-mcp-portal.docuclear.ai/mcp - Both OAuth, no secrets. Starter deploy.ts had no portal slot — extended: per-worker generated configs (shared package dir), GATEKEEPER_MCP_PORTAL_* bindings on Workshop + Router, deploy order portals → workshop → router-last. 28/28 deploy tests. - Fix found in testing: OAuth redirects escaped to localhost:8787 — upstream mints connect URLs from env.BASE_URL which the starter never set; now derived per portal from the public origin. - Status: connected, working. Versions: internal 97c0ceb2 → e62a5c63 (BASE_URL fix); external be4ea49c → b2150ef7; workshop/router rebound accordingly (IDs in run record). - ARCHITECTURE NOTE: the two-tier split lands the trust-domain model — vetted internal tier vs BYO external tier — consistent with the internal/external trust framing in 5d0286c4; the gatekeeper-factory MCP portal planned in handoff efe7781f now has its portal shape. 2) AMBIENT SPHERE GATEKEEPER (custom, replaces the starter example in packages/custom-gatekeeper/): - Whole-sphere SphereSession: 12 read methods (observations) + 11 queued actions + getActionResult plumbing. Vendor autoProvisionsAccount, singleton account, strategy-A observers (private-only; collaborators refused). - Policy: only sphere.capture is auto-approvable (and needs a workspace rule to activate); forget flagged permanent/manual-only; export/import/config/migration/revoke-all/tag-batch/multipart-upload NEVER agent-reachable. - SPHERE_TOKEN in Secrets Store (operator-installed, value never exposed). Admin mode: enabled. - Fix found in testing: 'Illegal invocation' on every call — client invoked captured global fetch as a method (this = client); arrow-wrapper fix + receiver-checking regression test. - Status: working end-to-end from chat (186 entries recalled, briefs, stats). docuclear-gatekeeper now v7908a22d. - This is the 'sphere' gatekeeper from the naming list (1950f2b5) becoming real; it fronts the vendor sphere (second-brain-cloudflare). PARKED KNOWN ISSUE (vendor's, not ours — hand back to second-brain-cloudflare): GET /tags returns all 455 tags with every count=0 (genuine numbers, correct shapes) while getBrief/getStats show correct counts for the same tags. Client hypotheses eliminated (shape, string-coercion, transport). Server-side aggregation bug; full evidence table in the run record. EVIDENCE: int_control main, every step committed small and pushed; run record runs/bootstrap/2026-09-03-docucleardev.md (tagged [VERIFIED]/[INFERRED]/[UNKNOWN], version IDs, verbatim outputs, rejected improvisations). Acceptance: scripts/verify-mcp-portal.sh 5/5, scripts/verify-blueprint-seed.sh 7/7, gatekeeper unit tests 14/14, deploy tests 28/28. OPEN (Phase 2, later session): caching/simulation for sphere writes; getAgentCatalog; auto-approval workspace rule for sphere.capture; tagBatch revisited if needed; legacy KV/R2 quarantine decommission (separate work item). NAMING CATCH-UP: docuclear-mcp-portal-internal / -external + the two portal hostnames are new allocated names — registry seed catch-up at NAMING_CONTRACT ratification (same pattern as int_control in 3ccf5c84).
[Update Sep 4, 2026]: [BUG REPORT ARTIFACT, Sep 4, 2026, ~01:10 BST — produced by Muse Spark 1.3 from WITHIN docuclear_control; shared by Mike as example, not actionable now; captured for the eventual second-brain-cloudflare hand-back]: GET /tags server-side aggregation bug — Symptom: full tag vocabulary (455 tags), correct shape [{tag:string, count:number}], tag fields accurate (match getBrief().topics / getStats().top_tags), but count=0 for all 455 (0 nonzero); counts arrive as genuine JS numbers (not string coercion). Cross-endpoint check (same tags, other endpoints correct): project:docuclear getBrief=44 / getStats=11 / getTags=0; docuclear 39/11/0; architecture 13/—/0; glassagent 10/—/0; decision 8/—/0; cloudflare-os 8/—/0. Eliminated client hypotheses: shape mismatch (previous 'unexpected shape' bug already fixed; array parses fine), string-serialized numbers (real number type), binding/transport (all other sphere reads work from the same executeCode environment; well-formed response). Conclusion: /tags count aggregation returns 0 server-side; tag-list query and count aggregation appear to be separate queries, latter broken. Vendor confirmation step: one raw GET /tags with valid token — tag array correct, counts all 0. Re-verifiable from our side in one call when a fix lands. Full evidence table also in runs/bootstrap/2026-09-03-docucleardev.md.
[Digest: 441278e2-67ad-4bd6-8187-df580abcca19]
Tags: docuclear, docuclear-control, mcp-portal, sphere-gatekeeper, gatekeepers, deployment, session-report, reconciliation, volatility:state, project:docuclear, kind:episodic, rolled-up — Source: mcp — 2026-09-04 00:05:16 UTC