[codex] publish GHL Agent Contract v2 manifest#1
Draft
MADPANDA3D wants to merge 31 commits into
Draft
Conversation
Add the UI-observed Brand Voice clone contract as a source-only tool, add the newly published location conversation-channel endpoint, and refresh GHL audit counts to 651 runtime tools and 637 official endpoint matches. Validation: npm run lint; npm run build; npm test -- --runInBand; npm run audit:openai; npm run audit:parity; npm run audit:security; portal clone/read/delete smoke.
Refs: TKT-000033
Refs: TKT-000028
Refs: TKT-000029
Refs: TKT-000027
Refs: TKT-000036
Refs: TKT-000027 Refs: TKT-000028 Refs: TKT-000029 Refs: TKT-000036
Refs: TKT-000036
Refs: TKT-000036
Refs: TKT-000036
Add a sourceUrl and hosted=false fileUrl path for remote-safe direct media uploads without base64 JSON inflation. Guard source fetches with public-host checks, redirect validation, and a 25 MB direct upload limit. Also make task timezone normalization deterministic across host timezones and refresh audited transitive dependency versions. Refs: TKT-000092
Refs: TKT-000116
Refs: MAD-619
Add a strict Portal-compatible provider catalog, standard navigation tools, conservative contract tiers, normalized health metadata, and build provenance while preserving the existing GHL upload aliases and legacy surface. Refs: MAD-637
Permit only the five standard local support tools to run after Portal grant validation without provider credentials, while preserving PIT enforcement for initialize, discovery surfaces, category wrappers, and provider calls. Refs: MAD-637
Permit protocol initialization before BYOK while keeping tools/list and all nonstandard provider tools credential-gated.\n\nRefs: MAD-639
Refs: MAD-639
Refs: MAD-655
Refs: MAD-625 Refs: MAD-639
Owner
Author
|
Upstream reconciliation is complete through a normal merge (no rebase or force-push).
The shared-conformance caller may remain pending/failing until MADPANDA-MAIN-SITE PR #3 is reviewed and merged, because provider callers intentionally reference the central reusable workflow on Refs: MAD-625, MAD-639 |
Refs: MAD-625
Owner
Author
|
MAD-625 audit reproducibility follow-up:
Refs: MAD-625 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Agent-first provider hardening
This draft reconciles the provider's deployed Agent Contract v2 work through
the normal repository review path.
User/agent problem
Provider discovery previously depended on inconsistent or incomplete metadata,
and fleet authorization, health, build provenance, and navigation behavior did
not share one enforceable contract. That made tool selection and production
truth harder for agents to trust.
Root cause
The provider did not own a complete versioned ToolManifest and the shared fleet
conformance gate did not exist in its repository. Runtime health and local
navigation behavior had also evolved independently across services.
Change
aliases, annotations, risk, contract tier, and build/catalog provenance.
check_configuration,list_capabilities,get_endpoint_coverage,get_tool_usage, andfind_tools.Verification
tracked-secret scan passed before publication.
returned no result.
Merge ordering
This PR is intentionally a draft. The central reusable workflow in
MADPANDA3D/MADPANDA-MAIN-SITEmust merge before this caller can resolve@main. Hosted workflow evidence should be reviewed after that dependency isavailable.
No force-push was used and unrelated worktree files were not staged.
Refs: MAD-636, MAD-625, MAD-639