Conversation
Move the house style onto the current PyMC Labs website identity: Inter for body and headings at normal stretch, JetBrains Mono for code, the dark/light website wordmarks, and a plain cover by default. Archivo, Fira Mono and the cover artwork stay bundled for existing documents. This content was applied to staging out of band and then silently reverted: the adapters reconcile every ready tenant against the image's bundled defaults/ on boot, so any apply that is not committed here is undone by the next deploy. Shipping it in the repo is what makes it stick. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…cker banner The readme was doing the work of six documents: two landing-page headings, a three-step setup that had grown to 125 lines, and a 20-line paragraph on artifact storage inside step one. It now leads with a one-line description, a badge row, a feature list, a three-step quickstart and a repository table, and links out for everything else. The banner is the cheering daimon sticker with its white background keyed out; the layout table now lists mux, report-host and plugin, and one line explains the daimon/Daimon naming.
Everything the readme dropped lives in docs/self-hosting.md with the same facts under shorter headings: the environment, the Discord app, the stack, running by hand, Slack, the Claude Code login mounts, chart storage and connecting MCP servers.
…o tour The repo tour predated three workspace members and drifted from the readme layout table.
…ebsite-identity Align the artifact-style skill with the website identity
…and the consulting line The hosted version is the zero-setup path and the original readme sold it as one click; that framing is back in the hero and at the end of the quickstart. The daimon/Daimon naming note is gone: nothing defines that rule and readers do not need it. The consulting line was not in the original and is removed.
Forking copies the source agent's MCP servers and none of its OAuth grants: a grant sits in the vault of (person, source agent) and is never readable back. On the fork, Managed Agents opened the copied server on every turn, failed it, and every reply carried the degraded-turn notice — for the person who signed in on the source as much as for anyone else. The classifier only knew a server needed a sign-in from grants made on the very same agent, so a fork looked like a server nobody had to sign in to and nothing was hidden. Grants are now read tenant-wide and matched to the agent's servers by URL, which is what MA authenticates against: a URL anybody signed in to anywhere is a sign-in server on every agent carrying it, and only a grant made on this agent by this caller keeps it on their session. A URL nobody has signed in to is left alone as before.
Every fork path copies the source's MCP servers raw, but the token stored for a token-backed one stayed with the source, so the fork mounted a server with nothing to authenticate it and failed it on every turn. The fork copy helper now copies those rows too — ciphertext as is, both agents sit under the same key set — and does so before the repo-binding early return, so a source with no bound repository still passes its tokens on.
The MCP token copy committed in its own transaction ahead of the GitHub re-key, whose unresolvable-credential check raises and tells the caller nothing was created. A fork that failed there was left holding copies of the source's tokens under an agent id no path cleans up. The check now runs before the first write, so the fail-loud path is write-free again.
The tenant-wide grant read ran on every session create and every turn's snapshot and returned one row per completed flow in the tenant, reconnects included, for the classifier to rescan once per server. It now filters to the URLs the agent carries and de-duplicates, which also restores the empty result for an agent none of whose servers anybody has signed in to. The classifier builds its two URL sets in one pass. The grant row loses `server_name`: matching is by URL, and a field nothing reads invites the name matching this branch removed.
The grant read is keyed by tenant, normalised server URL and completion, and the table had indexes only on `state`, `request_token` and (tenant, agent), so every turn walked the tenant's whole sign-in history to find the handful of rows for the caller's URLs. A partial expression index is that predicate exactly. The classifier states its rule as one set expression, and the read drops a DISTINCT that deduplicated raw URLs only, which the set-building consumer never needed.
The GitHub re-key and the binding copy can still fail after the check that gates them, so a token copy committed ahead of them could survive a fork reported as failed. The GitHub half moves into its own helper and the token copy runs after it; the raising check stays first.
…lity fix(core): a forked agent no longer carries MCP servers nobody can authenticate
…equirement (pymc-labs#162) The staging walk-through hit this live: the first upload used the original PDF filename, was rejected because the host only extracts a member named exactly `report.pdf` from the archive root, and that rejection burned the single-use upload URL — forcing a second call to the publish tool to mint a new one. Front-load the requirement in bold, add a pre-flight check to the procedure, and add it to the "what not to do" list. Claude-Session: https://claude.ai/code/session_01XJPPkRT2D8mdGA95jKXoNW Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
…s#208) Co-authored-by: Derick Wells <derick.wells@pymc-labs.com>
docs: rework the readme, add a self-hosting guide, new banner
Owner
Author
|
CI-only draft; the real PR is pymc-labs#220. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Draft opened inside the fork only to run GitHub Actions on Linux for contrib/teams-adapter at aae5a0f before the real PR is opened against pymc-labs/daimon. Not for merge here; close after the run.