release-k-01-02: chat trim, canvas beta gate, docs deploy, support-request forwarder#876
Merged
Conversation
Canvas becomes opt-in per project via project.is_canvas_enabled (default off), on top of the global ENABLE_CANVAS kill switch: - Directus migration script for the new boolean (snapshot pull to follow) - BFF canvas routes and the 8 agentic canvas routes 404 unless the project opted in; the gate fires before policy checks so existence stays hidden - canvas ticks no-op for non-opted-in projects; reconciler exits early when the global flag is off - the agentic worker resolves the verdict per turn and forwards it as X-Dembrane-Canvas-Enabled; the agent registers its 9 canvas tools and the Canvases prompt section only when enabled, so a canvas-off chat never learns canvas exists (prompt is byte-identical when enabled) - is_canvas_enabled whitelisted on the project PATCH so the settings toggle can actually write it Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
New Experimental card in project settings (visible only where the ENABLE_CANVAS env flag allows) with a per-project Living canvas switch writing is_canvas_enabled. The Library nav entry now also requires the project's toggle, so canvas surfaces disappear for non-opted-in projects. Locale catalogs recompiled. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The smart-loop and building pages now describe the living canvas as an opt-in beta on dembrane next (off by default, per-project experimental toggle, not in production). The chat-and-ask pages are rewritten around the new Ask experience: one question bar, Specific Details as the classic fallback, Overview retired. Referring anchors and FACTS.md updated. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Extends the gitops rhythm to documentation: push to main keeps deploying docs.echo-next.dembrane.com; a v*.*.* tag now builds the same docs/ corpus with the production base URL and deploys the static output to the Vercel project owning docs.dembrane.com (Build Output API, --prebuilt). Needs the VERCEL_PROJECT_ID_DOCS secret before the first release. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The agent's editProjectTags direct write is replaced by proposeTagsUpdate: the agent proposes add/remove changes with a one-line reason, a card renders in the chat (same wiring and persistence as project-update proposals), and the host applies it through the existing dashboard tag endpoints. The agent never mutates the tag vocabulary itself. Part of the production chat trim (founder call 2026-07-24): the last direct-write tool is gone; remaining writes are memory (host-visible and deletable) and the support/insight outboxes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
reachOutToDembraneSupport writes support_request rows and tells the host "logged for the team" — until now nothing forwarded them. This is the outbox forwarder that makes the claim true: - task_forward_support_requests: reconciler catch-up (*/2 cron), rows with status=new and forwarded_at NULL are POSTed to sam's webhook and stamped forwarded_at only on 2xx — at-least-once, sam dedupes by id. 4xx (payload bug) logs loudly and leaves the row unstamped; 5xx or a network error stops the batch for the next run. - Auth: shared static token in the X-Echo-Support-Token header (NOT Authorization — sam's ingress uses that for its GCP IAM layer). - SupportSettings (SUPPORT_WEBHOOK_URL + ECHO_SUPPORT_WEBHOOK_TOKEN); both unset (the local default) disables the forwarder entirely. - environment / origin_link derived from admin_base_url host, no new env var (analytics-token pattern). - Idempotent migration adds support_request.forwarded_at; run per env before enabling the config, then pull the snapshot. Receiving side is live (Dembrane/sam PR #168): deterministic #gen-engineering post + in-thread triage. Payload contract lives in sam's product-support recipe; keep both ends in sync. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Migration ran against echo-next (idempotent, verified on re-run); this is the snapshot pull of the new column, plus a --token auth option on the migration script so deployed envs (which expose DIRECTUS_ADMIN_TOKEN, not a login) can run it. Production still needs the same migration before its forwarder config goes live. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- first-aid (en + nl): what happens when the assistant logs a support request — goes straight to the engineering team, what's shared (message, page context, project reference; never recordings or transcripts), and that 'Report an issue' stays the always-available direct route. No response-time promises, per the assistant's honesty rules. - docs/support_request_pipeline.md: the end-to-end internals (outbox → forwarder → sam → #gen-engineering), delivery semantics, payload contract, code map, and the per-environment enablement order (echo-next done; prod = migration, then SUPPORT_WEBHOOK_URL). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
spashii
enabled auto-merge
July 24, 2026 14:25
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Comment on lines
+29
to
+58
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| # folder2website reads git history for page metadata | ||
| fetch-depth: 0 | ||
|
|
||
| - name: Setup Bun | ||
| uses: oven-sh/setup-bun@v2 | ||
|
|
||
| - name: Build docs site | ||
| run: bunx github:spashii/folder2website#main docs --out _docs-site --base-url https://docs.dembrane.com | ||
|
|
||
| - name: Install Node.js | ||
| uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: 22 | ||
|
|
||
| - name: Install Vercel CLI | ||
| run: npm install --global vercel@latest | ||
|
|
||
| - name: Stage prebuilt static output | ||
| run: | | ||
| mkdir -p .vercel/output/static | ||
| cp -R _docs-site/. .vercel/output/static/ | ||
| echo '{"version": 3}' > .vercel/output/config.json | ||
|
|
||
| - name: Deploy to Vercel (docs.dembrane.com) | ||
| run: vercel deploy --prebuilt --prod --token=${{ secrets.VERCEL_TOKEN }} |
dembrane-sam-bot
approved these changes
Jul 24, 2026
dembrane-sam-bot
left a comment
dembrane-sam-bot
left a comment
Contributor
There was a problem hiding this comment.
Approving on Sameer's explicit go ('pls merge it', 2026-07-24) — release-k-01-02 → main deploys echo-next only; prod follows via a release tag. Verification in the PR body: zero new test failures vs baseline, helm renders checked, echo-next migration already applied.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release branch for k-01-02, merging to main to deploy echo-next (dev image build triggers on main push). Production ships later via a release tag, per usual.
What's in it (8 commits, squashed here — see branch
release-k-01-02for the individual history)Agentic chat trim (release scope):
Support loop (ISSUE-034 — closes the honesty gap):
task_forward_support_requests: outbox forwarder (*/2 reconciler) POSTing newsupport_requestrows to sam's webhook with the shared token (X-Echo-Support-Token);forwarded_atstamped only on 2xx, at-least-once, sam dedupes by id. No-ops unlessSUPPORT_WEBHOOK_URL+ECHO_SUPPORT_WEBHOOK_TOKENare set — so this is inert everywhere until the env config exists (echo-next's is already live in echo-gitops; prod's deliberately isn't).forwarded_atmigration (idempotent; already run on echo-next Directus, snapshot committed). Prod runs it before its config goes live.docs/support_request_pipeline.mdrunbook.CI:
Verification
After merge
reachOutToDembraneSupporton echo-next — the request should appear in #gen-engineering within ~2 minutes with sam picking up the thread.forwarded_atmigration on prod Directus, then setSUPPORT_WEBHOOK_URLinvalues-prod.yaml.🤖 Generated with Claude Code