Add approval-gated Discord wiki editing

.env.example

@@ -91,10 +91,11 @@ AUTHENTIK_RECOVERY_EMAIL_STAGE_ID=
 # Optional Authentik Email Stage name used when the UUID override is unset.
 AUTHENTIK_RECOVERY_EMAIL_STAGE_NAME=default-recovery-email
 # Outline integrations
-# Privileged key used only for invitations (also requires Migadu + Authentik
-# for /create-user-accounts). Do not reuse it for member-safe content reads.
+# Privileged API/worker-only key used for invitations (also requires Migadu +
+# Authentik for /create-user-accounts) and explicitly approved wiki publishing.
+# Do not reuse it for member-safe content reads or expose it to the Discord bot.
 # OUTLINE_API_KEY is accepted as a legacy fallback.
-# Required for /create-user-accounts and /invite-outline-user.
+# Required by the backend for /create-user-accounts and /invite-outline-user.
 # For Outline Cloud, keep the default https://app.getoutline.com.
 # For self-hosted Outline, use https://your-outline-host.
 OUTLINE_BASE_URL=https://app.getoutline.com
@@ -105,6 +106,40 @@ OUTLINE_ADMIN_API_KEY=
 # to documents.search, documents.info, and stars.list. That account's starred
 # documents are /wiki quick links.
 OUTLINE_CONTENTS_API_KEY=
+# Review-first Discord wiki authoring (disabled by default).
+# The writer may only run in the configured Discord guild and requires the
+# backend-only OUTLINE_ADMIN_API_KEY above plus a collection ID for new pages.
+WIKI_EDITING_ENABLED=false
+WIKI_OUTLINE_COLLECTION_ID=
+# A separate high-entropy secret shared only by the Discord bot and API. It
+# signs short-lived role/identity assertions for wiki actions and the fixed
+# Outline membership proxy; each assertion binds its exact method, path, and
+# JSON body. Do not reuse API_SHARED_SECRET. Inject it per service in
+# production, not through a broadly inherited env_file.
+WIKI_EDITING_ASSERTION_SECRET=
+WIKI_EDITING_API_TIMEOUT_SECONDS=20.0
+# Discord's authenticated wiki request can synchronously read then write
+# Outline during a confirmed publish. Keep this above two default 20s calls.
+WIKI_EDITING_REQUEST_TIMEOUT_SECONDS=45.0
+WIKI_EDITING_MAX_INSTRUCTION_CHARACTERS=4000
+# Target articles above this limit are rejected rather than partially sent to
+# an external model provider. Split large articles before requesting an edit.
+WIKI_EDITING_MAX_DOCUMENT_CHARACTERS=16000
+# OMP is never launched from the credentialed worker. Configure the separately
+# credentialed sandbox endpoint instead. Host-run deployments require HTTPS;
+# Compose injects http://wiki_omp_sandbox:8080 over its internal control network.
+WIKI_OMP_SANDBOX_URL=
+# Shared only by the worker and sandbox to authenticate the narrow draft RPC.
+# Inject it per service in production, not through a broadly inherited env_file.
+WIKI_OMP_SANDBOX_TOKEN=
+WIKI_OMP_SANDBOX_PROTOCOL_VERSION=v1
+WIKI_OMP_MODEL=openrouter/openai/gpt-5-mini
+WIKI_OMP_THINKING=medium
+WIKI_OMP_STARTUP_TIMEOUT_SECONDS=30.0
+WIKI_OMP_AUTHORING_TIMEOUT_SECONDS=300.0
+# Do not set WIKI_OMP_COMMAND or WIKI_OMP_LAUNCHER_PATH: legacy local OMP
+# launching is deliberately rejected. Supply the sandbox's OpenRouter key via
+# a Docker secret or deployment secret manager, never this worker env file.
 # ERPNext project tracking (required for project dashboard sync and /projects)
 ERPNEXT_BASE_URL=https://erp.example.com/
 ERPNEXT_API_TIMEOUT_SECONDS=20.0
@@ -280,6 +315,8 @@ DISCORD_UNQUALIFIED_LEADS_FORUM_CHANNEL=unqualified-leads
 HEALTHCHECK_PORT=3000
 BACKEND_API_BASE_URL=http://127.0.0.1:8090
 AGENT_API_TIMEOUT_SECONDS=8.0
+# Uses the same HTTPS policy as BACKEND_API_BASE_URL because audit writes send
+# API_SHARED_SECRET. Leave blank to use BACKEND_API_BASE_URL.
 AUDIT_API_BASE_URL=
 AUDIT_API_TIMEOUT_SECONDS=2.0
 # Worker mailbox resume intake (required if email intake is enabled)

README.md

@@ -92,6 +92,7 @@ avoids printing the resolved Postgres password directly.
 - [Discord Gig Dashboard](./docs/discord-gig-dashboard.md): gig tracking and dashboard behavior.
 - [Discord GitHub Todos and Projects](./docs/discord-github-todos.md): GitHub App setup and Discord access model.
 - [Discord Agent Eval Harness](./docs/discord-agent-eval-harness.md): Discord agent eval workflow.
+- [Discord Wiki Editing](./docs/discord-wiki-editing.md): approval-gated shared wiki authoring.
 
 ## Deployment