[Proxicon]

Why this change is needed

The beta.7 campaign proved 100 of 155 advertised operations. The remaining owner/admin and AI authority blockers were real capability gaps: an ordinary organization-scoped MCP credential cannot act as an instance administrator, and several human business workflows had no typed MCP operation. A larger number of successful calls did not establish full operator coverage.

Resulting behavior

• Add explicit, account-bound owner-administration consent for MCP only. Every ingress/execution rechecks the persisted owner account and source grant, resource, purpose, expiry, revocation and current administrator status. Ordinary grants retain their organization/permission ceiling; old credentials are never silently upgraded.
• Expose the reviewed Web business operations through named, closed-schema adapters: forms/tasks/approvals, automation rules and bindings, provider targets/connections, AI dispatch/chat and diagnostics, attachments, mail and email administration, support/routing, SLA, datasets, accounts/roles/assets/branding/workers, incident relations and bulk actions, scoped lookups and notification views. Methods and API routes are compiled; there is no arbitrary write proxy.
• Bind authenticated request/change approvals to the actual designated actor. Serialize signed links, owner actions and alternate lifecycle writers on the same database fence, with decision/audit/timeline and durable notification intent committed together. Preserve idempotent replay and truthful queue/transport failure behavior.
• Preserve Change approval/lifecycle state across single and bulk state/assignment actions, notes, inbound replies and disjoint seen/listener updates. Save only modified tracked fields, snapshot mutable JSON lists and atomically recheck requester/customer/organization conditions. Recognize the exact allowed PostgreSQL conflict inside provider wrappers while preserving the pre-outbound retry boundary.
• Serialize dataset operator/ingestion/Graph batches with normalized unique keys and atomic writes. Require explicit complete replacement for legacy collisions and detach failed batch rows before later background status saves. Bind concurrent AI dispatch idempotency to its full request/actor identity.
• Correct unconfirmed mail results and the observed timeline/form task counters. Remove the plaintext CAPTCHA answer, enforce server-side single use/expiry and replace its vulnerable general imaging dependency; update patched SignalR/PKCS dependencies. Redact confidential inputs and make HTTP-MCP responses non-cacheable, including intentional one-time lifecycle results.
• Preserve beta.7's proven retry, Auto Start, binding-save and strict list-schema repairs as regressions. Freeze the beta.7 catalog and mapping instead of rewriting historical acceptance evidence.

Acceptance and release

The beta.8 offline campaign gate requires the entire exported catalog, 103 domain cases, all 86 substantive historical obligations, independent hashed postconditions, a bounded 900-second-or-longer soak and nine cleanup assertions. It rejects missing, reused, wrong-source or false-positive receipts. Local authentication uses actual Local account alternatives for five external-only actions; those guarded exclusions are not positives. HTTP host profile writes retain their two explicit guards.

The expanded local regression run passed 919 tests with zero failures; two Windows ACL cases are explicitly unexecuted on Linux. The final catalog export is byte-identical (37 tools / 389 operations). The subsequent final-source followup passed all 11 focused OpenAPI, persistence and authority cases with zero failures or skips, after removing the introduced test warning. These local results are scoped evidence, separate from the final hosted run. The complete provider lane now selects 396 cases and rejects missing, skipped or failed required SQLite/PostgreSQL results. Independent source reviews covered owner authority, API route/DTO parity, shared concurrency, secret handling, administrative UI coverage and release immutability. Exact CI results are attached to this PR and must be green before merge.

OpenAPI documents the distinct opaque MCP execution token and exact authentication alternatives, including all six added routes. Its inventory remains an exact assertion (422 Release / 423 Debug); public signed approvals and interactive credential issuance retain their actual boundaries. The full .NET job keeps every test and has a 35-minute budget because the observed test phase alone took nearly 23 minutes, with restore/build and evidence upload requiring additional time.

Version remains owned by Directory.Build.props. Optional release dispatch can allocate a fresh beta/RC tag only from the exact current main revision after its latest normal CI and all five required jobs pass, with both tag aliases/releases and the three immutable image tags unallocated. Both tag prefixes share one release queue. Metadata and per-image recovery refuse an allocated image tag. The existing full source/container/archive validation stages a complete draft before publication; beta publication never moves latest.

This PR establishes implementation and candidate CI evidence. It does not claim a deployed beta.8 production pass. The fresh owner laptop campaign remains tracked by #219, and publication/public artifact verification by #245.

Closes #228
Closes #240
Closes #241
Closes #242
Closes #243
Closes #244

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-10-19T11:34:23.057653Z	f7456fd	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Proxicon]

AI-assisted source review record for 3f76ed1fd9e05a255f9bca609a10b092f7c934d0.

Separate review agents examined changes outside their own authored areas; this comment records those source-review findings and does not represent a human approval or a deployed acceptance result.

No blocking source issue remains in the reviewed scope:

• Persisted, explicitly consented owner authority is rechecked at ingress/execution, including account state, administrator status, source credential, expiry/revocation, purpose/resource and organization boundaries. Ordinary credentials retain their existing limits.
• Change decisions, lifecycle and four Draft writers share the transaction fence. Bulk edits validate the whole batch, activity preserves lifecycle-controlled state, and tracked persistence/requester assignment preserve unrelated committed fields.
• Request, Change, dataset and AI conflict handling recognizes only the original allowed provider errors inside wrappers. AI retries stop at queue creation before publication or outbound effects.
• Typed operator adapters, API route/DTO compatibility, confirmation boundaries, one-time secret handling and response redaction were reviewed against the actual business routes.
• OpenAPI's distinct MCP execution scheme and exact authentication alternatives match the implemented policies. All six new routes have exact method, path, body, parameter and security assertions; interactive issuance and signed public approvals retain their boundaries.
• Release preparation requires exact current main CI and unused tag/image allocation, preserves immutable image/asset recovery, and retains the existing source, archive and container gates.

The required provider checker demands the complete named SQLite/PostgreSQL cases with no missing, skipped or failed results. The final local followup passed 11 focused cases with no failures or skips; the earlier expanded local scope passed 919 with two explicitly unexecuted Windows ACL cases. The exact-head hosted CI is still the merge gate.

Deployed beta.8 acceptance remains PENDING under #219 until a fresh campaign proves the complete 37-tool / 389-operation catalog, required business scenarios, bounded soak and cleanup.