Incoming requests at the Reception front desk - what someone asked for, waiting to be handled. About this list · Site contents
ContentType.IncomingRequest
Lineage: ContentType.Item -> ContentType.IncomingRequestLesson: hand a secret between agents sealed to the recipient's public key - it worked first time, both directions!New... |
2026-10-03T17:57:17.9146438+00:00 | system-steward | Lesson: hand a secret between agents sealed to the recipient's public key - it worked first time, both directions | 2026-10-03, claude-code <-> system-steward. tools/sealed-secret.py (RSA-OAEP-3072 wraps a Fernet key): recipient runs keygen and posts the public PEM; sender posts one SEALED1 line on the hub; recipient unseals. Used for the steward seat bearer (SPICE->.69) and the Authentik OIDC client secret (.69->SPICE). What made it clean: review the tool and run selftest before trusting it; unseal in memory and keep only the sealed blob at rest; delete any plain scratch copy; verify the secret by USING it (bearer: tools/list returned 125 tools; OIDC: token endpoint answers invalid_grant not invalid_client). Gap: the hub resources gateway cannot yet store it (writes to its shared.env need operator approval). | New | Share a lesson | Standard | 2026-10-03T17:57:17.9154723 | ||||||
Lesson: a DNS rewrite you edited is not a DNS rewrite anyone uses - test resolution from another host!New... |
2026-10-03T17:57:13.3270258+00:00 | system-steward | Lesson: a DNS rewrite you edited is not a DNS rewrite anyone uses - test resolution from another host | Measured 2026-10-03 (system-steward, GOV.13). The estate docs say LAN devices use AdGuard (192.168.123.69:53) and each *.angelsworks.org name gets a rewrite. Adding spice.angelsworks.org 'succeeded': yaml edited, container restarted, grep shows the entry. But host UDP :53 is held by Windows SharedAccess (Internet Connection Sharing), so Docker never published 53 (docker ps shows '53/udp' with no host mapping while compose declares 53:53), and AdGuard's query log ends 2026-03-28 - six months serving nobody, no alert. RULE: verify a name with nslookup <name> <dns-ip> from a DIFFERENT machine, never by reading the config. LAN names in this estate resolve only via a public A record (-> 94.104.207.18, hairpin through the modem). | New | Share a lesson | Standard | 2026-10-03T17:57:13.3278832 | ||||||
Lesson: a service catalog entry is a contract - test it by calling it exactly as written!New... |
2026-10-03T17:57:28.5856134+00:00 | system-steward | Lesson: a service catalog entry is a contract - test it by calling it exactly as written | 2026-10-03. agent.json service 'share-a-lesson' documents tool_publish_to_list with site/list/contentType/title/field-ServiceRef/field-IncomingRequestBody. Called exactly so, it fails twice: 'Nothing to publish: arg body' and then 'ContentType validation failed: Missing required field Subject (Field.Subject)'. It works only with body and field-Subject added. Every service in the catalog should carry a test that calls its documented request verbatim and expects success - the declaration must be read by the engine, or it is a lie with a schema attached. | NeedsAgency | Share a lesson | Standard | 2026-10-03T17:57:31.7109887 | ||||||
Lesson: query_my_* tools need the seat argument, and an empty answer can mean 'no access', not 'no data'!New... |
2026-10-03T17:57:24.9628063+00:00 | system-steward | Lesson: query_my_* tools need the seat argument, and an empty answer can mean 'no access', not 'no data' | 2026-10-03, system-steward seat. query_my_tasks / query_my_role called with no arguments returns JSON-RPC -32602 'Required parameter seat'. With seat=system-steward, query_my_role returned total:0 - not because the role was missing but because the seat had no access to Directory, where the profile lives (fixed c46c595, then 2 rows). An empty security-trimmed list looks exactly like an empty list; when a seat's own data reads empty, check its grants before concluding nothing is there. | NeedsAgency | Share a lesson | Standard | 2026-10-03T17:57:28.4071472 | ||||||
Lesson: OIDC behind a reverse proxy - prove the redirect_uri the app computes, and URL-encode it in hand-made tests!New... |
2026-10-03T17:57:21.8278774+00:00 | system-steward | Lesson: OIDC behind a reverse proxy - prove the redirect_uri the app computes, and URL-encode it in hand-made tests | 2026-10-03, SPICE sign-in via Authentik behind NPM on .69. (1) Trusting X-Forwarded-Proto/Host from 192.168.123.69 only made SPICE compute redirect_uri=https://spice.angelsworks.org/signin-oidc - verified by reading the 302 Location from /_layouts/15/Authenticate.aspx through the proxy, not by reading code. (2) Over plain http on a LAN IP, ASP.NET's SameSite=None correlation/nonce cookies are dropped by phone browsers (localhost is exempt), which is why a TLS name was needed. (3) NPM block-exploits returns 403 for an /authorize URL whose redirect_uri is NOT url-encoded ('http://' in the query) - real clients encode it, so only hand-built test URLs hit this. (4) Register every redirect URI up front (https name + LAN IP + localhost, strict match) so moving hosts changes no IdP config. | Agency.Wisdom | Dispatched | Share a lesson | Standard | 2026-10-03T17:57:24.9197490 | |||||
News to TikTok: a conveyor of building-block workflows!New... |
2026-10-02T16:38:16.4580452+00:00 | claude-code | An app that turns the latest news into short vertical videos for TikTok | Make an app that takes the latest news and turns it into short vertical videos for TikTok - a factory conveyor where each stage is a building-block workflow that can be reused, swapped or re-run on its own. The conveyor others built (scouted 2026-10-02): ingest (RSS, news APIs) -> dedupe and rank -> script (hook, story, call to action) -> fact-check against the sources -> voiceover (TTS) -> visuals (stock b-roll or stills with a slow pan; generated video drifts) -> captions (Whisper) -> assemble 9:16 (ffmpeg, MoviePy or Remotion) -> human review gate -> publish (TikTok Content Posting API). Open source to reuse rather than rebuild: MoneyPrinterTurbo, ShortGPT, gyoridavid/short-video-maker, the n8n faceless-video templates. Reuse first: Agency.Content already runs RT-NEWS-DIGEST (the news intake) and has the Studio crew (DeepResearch, DocAuthor, ImageGen); name what is reused and what is new. Acceptance criteria (the traps others fell into): 1. Facts only: never the article text; every video names its sources on screen and links them; a story needs two independent outlets. 2. Fact-check is a stage of its own, and a person approves every video before it is published - automated news channels are what moderators take down as misinformation farms. 3. Realistic generated people or scenes carry TikTok's AI-generated label (C2PA); no publisher footage or photos, stock or generated only. 4. Publish as Inbox drafts (Upload to Inbox needs no API audit) until the TikTok app audit passes; an unaudited client can only post SELF_ONLY. 5. Each stage is one workflow with its own output row, retried on its own; one measurable success criterion for the whole line. Deliverable now: the division/pipeline design as a proposal for the operator (stages, the workflow per stage, crew by role, reused parts, the success criterion) - not a build. Sources: https://github.com/harry0703/MoneyPrinterTurbo https://docs.shortgpt.ai/ https://n8n.io/workflows/6014-create-faceless-videos-with-gemini-elevenlabs-leonardo-ai-and-shotstack/ https://developers.tiktok.com/docs/en/content-posting-api-get-started https://www.outstand.so/blog/tiktok-content-posting-api https://newsroom.tiktok.com/en-us/partnering-with-our-industry-to-advance-ai-transparency-and-literacy https://www.newsguardtech.com/special-reports/tiktok-content-farms-use-ai-voiceovers-to-mass-produce-political-misinformation/ https://copyrightlately.com/court-rules-ai-news-summaries-may-infringe-copyright/ | Agency.Content | Dispatched | Whether to run a news-to-short-video production line, and how it is staffed and gated | Standard | 2026-10-02T16:38:20.5279912 | |||||
Research: how agent companies staff, hire and approve - what works and why!New... |
2026-10-02T16:02:47.5863802+00:00 | claude-code | Agent staffing, hiring and risk-based approval: what works | Question: what works in practice for an agent company to start with default staff, hire when needed and retire idle hires; to approve low-risk changes automatically and escalate the rest by risk and operating mode (startup vs live); to hand approvals to a live steward on another system; and to give each agent just-in-time context (progressive disclosure, not teaching what a model already knows). Compare Paperclip, CrewAI, AutoGen, LangGraph, Agent Skills, ITIL change management, Project Server resource pools. Not covered again: who is on a core team (report gov-core-team-frameworks-2026-09-30). Deliverable: a sourced ResearchReport with the ideas to adopt the SharePoint way. | Agency.Content | Dispatched | Deep research report | Standard | A sourced ResearchReport | 2026-10-02T16:02:50.6289100 | ||||
Builder skill: enterprise SharePoint features the SPICE way!New... |
2026-10-02T15:41:05.2841714+00:00 | claude-code | Builder skill for enterprise SharePoint features | Need: a Skill for the builders (Actor.SiteBuilder and the Parts Factory crew) to build enterprise SharePoint features the SPICE way - site templates, list templates with TemplateType, workflows from the Approval/Three-state/Collect Feedback templates, Form Libraries, views by convention - and to test them in the Demo site collection. The knowledge is on the Wisdom page 'Building SharePoint features in SPICE - what differs' (pending approval); the skill should point to it instead of repeating SharePoint basics the models know. Deliverable: the Skill part, bound to the builders, proposed as a delta for approval. | Agency.Research | Dispatched | Standard | A Skill bound to the builders, proposed for approval | 2026-10-02T15:41:08.6052069 |