coilyco-flight-deck/bluesky-mcp

Watch

Build the authenticated read-only Bluesky MCP and publish its image #1

New issue

Closed

opened 2026-07-23 10:32:16 +00:00 by coilyco-ops · 3 comments

coilyco-ops commented

2026-07-23 10:32:16 +00:00

Member

Intent

Build and publish the source for Kai's authenticated, strictly read-only Bluesky MCP in this dedicated product repo, then finish its deployment wiring in coilyco-bridge/deploy.

Context and ownership

Kai created this repo after correcting the first implementation's ownership boundary. The green donor implementation exists in closed deploy PR:

coilyco-bridge/deploy#190
donor commit: 1205acf7b92cdbf0cba0a77a78ac5aad57c120a9
umbrella deployment issue: coilyco-bridge/deploy#172

Authenticated Bluesky reads require internal session creation and refresh, so this cannot be a static ward-mcp spec. All executable source belongs here. coilyco-bridge/deploy must retain deployment wiring only.

Bootstrap this empty repo

Initialize main and add the normal public fleet repo baseline:

MIT license
README.md
AGENTS.md
docs/FEATURES.md
.ward/ward.yaml
validation/pre-commit configuration
source CI and image-publish workflow

Follow reddit-mcp, node-stats-mcp, and ward-mcp for current public MCP source-repo conventions.

Port the proven source

Port the adapter source and product tests from closed deploy PR #190 while preserving its green behavior:

official AT Protocol SDK session creation and refresh
official MCP SDK streamable HTTP transport
exact 11-tool authenticated read-only inventory
bounded page sizes and thread depth
no generic URL, arbitrary XRPC, raw HTTP, login, or mutation tool
app-password and session-token redaction
health endpoint and graceful shutdown
tests locking initialize and the complete tools/list inventory
secure dependency pins, including the fixed MCP SDK version selected after the donor audit finding

The read tools cover profile lookup/search, post search, author feed, posts by AT URI, post thread, followers, follows, Kai's home timeline, notifications, and liked posts.

No posting, replying, following, liking, reposting, deleting, muting, blocking, reporting, moderation, chat, account mutation, generic URL, arbitrary XRPC, or raw HTTP tool may exist.

Source deliverables

TypeScript source and tests
pinned package manifest and lockfile
non-root Dockerfile
lint, typecheck, unit/inventory tests, and dependency audit
CI publishing bluesky-mcp:<main-sha> to the in-cluster registry after merge, following sibling MCP repos
README with local configuration, transport endpoints, exact tool list, and threat model
docs/FEATURES.md matching the shipped surface

Do not put the SSM path, Kubernetes manifests, Authelia settings, NodePorts, or *.coilysiren.me deployment hostnames in this source repo.

Deployment integration

The engineer is granted these additional repos:

coilyco-bridge/deploy for deployment-only wiring
coilyco-bridge/agentic-os-kai as read-only SSM inventory context

Verify the existing Bluesky credential in agentic-os-kai/SSM.md without retrieving or printing its value. The donor resolved it as /bsky/password.

After the source image exists, open a fresh deploy PR from current deploy main that contains only:

immutable published image reference
values/manifests and ExternalSecret mapping
service, Authelia-gated ingress, and tailnet NodePort
rollout/CD workflow and image-readiness checks
Makefile/ward validation verbs
deploy README and feature/access inventory updates

Do not reopen donor PR #190. The fresh deploy PR must contain no adapter source, adapter package manifest/lockfile, adapter tests, or adapter Dockerfile.

Acceptance

This repo is initialized with its baseline and ownership docs.
Source tests prove the exact 11-tool read-only inventory and absence of escape hatches.
Secrets and session tokens never appear in logs, results, or tracked files.
Source CI passes and publishes an immutable image tagged with the merged source SHA.
Source changes land through this issue and close it.
A fresh deployment-only PR references this repo and image SHA.
Deploy validation passes and the umbrella deploy issue is linked.
Available live checks verify initialize, home timeline, notifications, public 401 behavior, and tailnet-direct access.

## Intent Build and publish the source for Kai's authenticated, strictly read-only Bluesky MCP in this dedicated product repo, then finish its deployment wiring in `coilyco-bridge/deploy`. ## Context and ownership Kai created this repo after correcting the first implementation's ownership boundary. The green donor implementation exists in closed deploy PR: - https://forgejo.coilysiren.me/coilyco-bridge/deploy/pulls/190 - donor commit: `1205acf7b92cdbf0cba0a77a78ac5aad57c120a9` - umbrella deployment issue: https://forgejo.coilysiren.me/coilyco-bridge/deploy/issues/172 Authenticated Bluesky reads require internal session creation and refresh, so this cannot be a static ward-mcp spec. All executable source belongs here. `coilyco-bridge/deploy` must retain deployment wiring only. ## Bootstrap this empty repo Initialize `main` and add the normal public fleet repo baseline: - MIT license - `README.md` - `AGENTS.md` - `docs/FEATURES.md` - `.ward/ward.yaml` - validation/pre-commit configuration - source CI and image-publish workflow Follow `reddit-mcp`, `node-stats-mcp`, and `ward-mcp` for current public MCP source-repo conventions. ## Port the proven source Port the adapter source and product tests from closed deploy PR #190 while preserving its green behavior: - official AT Protocol SDK session creation and refresh - official MCP SDK streamable HTTP transport - exact 11-tool authenticated read-only inventory - bounded page sizes and thread depth - no generic URL, arbitrary XRPC, raw HTTP, login, or mutation tool - app-password and session-token redaction - health endpoint and graceful shutdown - tests locking initialize and the complete `tools/list` inventory - secure dependency pins, including the fixed MCP SDK version selected after the donor audit finding The read tools cover profile lookup/search, post search, author feed, posts by AT URI, post thread, followers, follows, Kai's home timeline, notifications, and liked posts. No posting, replying, following, liking, reposting, deleting, muting, blocking, reporting, moderation, chat, account mutation, generic URL, arbitrary XRPC, or raw HTTP tool may exist. ## Source deliverables - TypeScript source and tests - pinned package manifest and lockfile - non-root Dockerfile - lint, typecheck, unit/inventory tests, and dependency audit - CI publishing `bluesky-mcp:<main-sha>` to the in-cluster registry after merge, following sibling MCP repos - README with local configuration, transport endpoints, exact tool list, and threat model - `docs/FEATURES.md` matching the shipped surface Do not put the SSM path, Kubernetes manifests, Authelia settings, NodePorts, or `*.coilysiren.me` deployment hostnames in this source repo. ## Deployment integration The engineer is granted these additional repos: - `coilyco-bridge/deploy` for deployment-only wiring - `coilyco-bridge/agentic-os-kai` as read-only SSM inventory context Verify the existing Bluesky credential in `agentic-os-kai/SSM.md` without retrieving or printing its value. The donor resolved it as `/bsky/password`. After the source image exists, open a fresh deploy PR from current deploy `main` that contains only: - immutable published image reference - values/manifests and ExternalSecret mapping - service, Authelia-gated ingress, and tailnet NodePort - rollout/CD workflow and image-readiness checks - Makefile/ward validation verbs - deploy README and feature/access inventory updates Do not reopen donor PR #190. The fresh deploy PR must contain no adapter source, adapter package manifest/lockfile, adapter tests, or adapter Dockerfile. ## Acceptance - [ ] This repo is initialized with its baseline and ownership docs. - [ ] Source tests prove the exact 11-tool read-only inventory and absence of escape hatches. - [ ] Secrets and session tokens never appear in logs, results, or tracked files. - [ ] Source CI passes and publishes an immutable image tagged with the merged source SHA. - [ ] Source changes land through this issue and close it. - [ ] A fresh deployment-only PR references this repo and image SHA. - [ ] Deploy validation passes and the umbrella deploy issue is linked. - [ ] Available live checks verify initialize, home timeline, notifications, public 401 behavior, and tailnet-direct access.

coilyco-ops referenced this issue from a commit

2026-07-23 10:39:57 +00:00

feat: build authenticated read-only Bluesky MCP

coilyco-ops closed this issue

2026-07-23 10:39:57 +00:00

coilyco-ops commented

2026-07-23 10:48:14 +00:00

Author

Member

WARDED_WORKFLOW: done ✅

details

review: skipped intentionally; the in-container review gate is pending brokered QA.
workflow: merge-remote-main; review summary: skipped intentionally (in-container review gate pending brokered QA).
landed: source 863cbfb and deploy dfc2d89; deploy PR #191 merged and deploy#192 tracks operator-only live checks.
felt: a clean ownership split once the donor was reduced to its adapter and deployment contracts.
confidence: high for source and offline deployment validation.
surprises: the bootstrap ward gate needs a first commit, and the deployment renderer needed silent recipe output for YAML validation.
follow-up: an interactive operator verifies initialize, home timeline, notifications, public 401, and tailnet-direct access under deploy#192.

WARDED_WORKFLOW: done ✅ <details><summary>details</summary> review: skipped intentionally; the in-container review gate is pending brokered QA. workflow: merge-remote-main; review summary: skipped intentionally (in-container review gate pending brokered QA). landed: source `863cbfb` and deploy `dfc2d89`; deploy PR #191 merged and deploy#192 tracks operator-only live checks. felt: a clean ownership split once the donor was reduced to its adapter and deployment contracts. confidence: high for source and offline deployment validation. surprises: the bootstrap ward gate needs a first commit, and the deployment renderer needed silent recipe output for YAML validation. follow-up: an interactive operator verifies initialize, home timeline, notifications, public 401, and tailnet-direct access under deploy#192. </details>

coilyco-ops referenced this issue from a pull request that will close it,

2026-07-23 10:48:24 +00:00

ward salvage: ward-salvage/bluesky-mcp-9556a70d #2

coilyco-ops reopened this issue

2026-07-23 10:48:25 +00:00

coilyco-ops commented

2026-07-23 10:48:26 +00:00

Author

Member

WARDED_WORKFLOW: blocked 🛑

salvage details

An ephemeral ward container (codex mode) dispatched for this issue finished but its work was not merged to main, so cleanup preserved it on a branch before teardown and reopened the issue (a closing reference for #1 never reached main). Recover from the salvage branch below.

Repo: coilyco-flight-deck/bluesky-mcp
Salvage branch: ward-salvage/bluesky-mcp-9556a70d
Pull request: not opened - PR creation failed: forgejo: parse created pull request: unexpected end of JSON input
Reason: missing same-repo closing reference
Container uptime at reap: 14m (age of the baked Forgejo PAT snapshot; a long-lived container is likelier to carry a rotated token)

Cleanup diagnostics

--- reap diagnostics ---
ward version:      v0.793.0
version source:    pinned via WARD_VERSION/--ward-version (v0.793.0)
HEAD:              863cbfb7dbd9
origin/main:       863cbfb7dbd9
ancestry:          HEAD is ALREADY on origin/main - a salvage here is a FALSE salvage (ward#504 signature)
decision gate:     missing same-repo closing reference on already-landed merge-remote-main run
reason:            missing same-repo closing reference
provenance:        present
run-owned landed:  no
working tree:      clean
container uptime:  14m (baked Forgejo PAT age proxy)
--- end reap diagnostics ---

Recover

git fetch https://forgejo.coilysiren.me/coilyco-flight-deck/bluesky-mcp.git ward-salvage/bluesky-mcp-9556a70d
git checkout -b ward-salvage/bluesky-mcp-9556a70d FETCH_HEAD

This salvage was blocked by a missing closing reference. To recover, amend or cherry-pick the salvaged work so the landing commit message includes closes #1, or add a small empty trailer commit with closes #1, then land the branch.

— Codex, via ward agent

WARDED_WORKFLOW: blocked 🛑 <details><summary>salvage details</summary> An ephemeral `ward container` (codex mode) dispatched for this issue finished but its work was **not merged to `main`**, so cleanup preserved it on a branch before teardown and reopened the issue (a closing reference for #1 never reached `main`). Recover from the salvage branch below. - **Repo:** `coilyco-flight-deck/bluesky-mcp` - **Salvage branch:** `ward-salvage/bluesky-mcp-9556a70d` - **Pull request:** not opened - PR creation failed: forgejo: parse created pull request: unexpected end of JSON input - **Reason:** missing same-repo closing reference - **Container uptime at reap:** 14m (age of the baked Forgejo PAT snapshot; a long-lived container is likelier to carry a rotated token) ## Cleanup diagnostics ``` --- reap diagnostics --- ward version: v0.793.0 version source: pinned via WARD_VERSION/--ward-version (v0.793.0) HEAD: 863cbfb7dbd9 origin/main: 863cbfb7dbd9 ancestry: HEAD is ALREADY on origin/main - a salvage here is a FALSE salvage (ward#504 signature) decision gate: missing same-repo closing reference on already-landed merge-remote-main run reason: missing same-repo closing reference provenance: present run-owned landed: no working tree: clean container uptime: 14m (baked Forgejo PAT age proxy) --- end reap diagnostics --- ``` ## Recover ```bash git fetch https://forgejo.coilysiren.me/coilyco-flight-deck/bluesky-mcp.git ward-salvage/bluesky-mcp-9556a70d git checkout -b ward-salvage/bluesky-mcp-9556a70d FETCH_HEAD ``` This salvage was blocked by a missing closing reference. To recover, amend or cherry-pick the salvaged work so the landing commit message includes `closes #1`, or add a small empty trailer commit with `closes #1`, then land the branch. </details>  — Codex, via `ward agent`

coilyco-ops commented

2026-07-23 10:48:29 +00:00

Author

Member

WARDED_WORKFLOW: reservation-released

release details

Run finished with WARDED_WORKFLOW: blocked 🛑.

ward container reap released container engineer-codex-bluesky-mcp-1 (--harness codex): the terminal outcome supersedes the reservation, so a later redispatch no longer needs --override-reservation.

— Codex, via ward agent

WARDED_WORKFLOW: reservation-released <details><summary>release details</summary> Run finished with `WARDED_WORKFLOW: blocked 🛑`. `ward container reap` released container `engineer-codex-bluesky-mcp-1` (`--harness codex`): the terminal outcome supersedes the reservation, so a later redispatch no longer needs `--override-reservation`. </details>  — Codex, via `ward agent`

coilysiren closed this issue

2026-07-23 10:59:09 +00:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

coilyco-flight-deck/bluesky-mcp#1

No description provided.

Rows
Columns