[purpshell]

Summary

Adds Number catalog list/get/products/sync and Marketing Messages status, Official multipart and Linked Devices group-picture commands, and Platform webhook batching flags/details. Existing Graph and contact block/unblock commands remain available. Server scopes, beta/enrollment checks and Hybrid linked-only routing remain authoritative.

Current head: 6ac56fea4fd9e0e7afe92bcc9d2fd0a339a4e34e, tree 1612c6fe041dee17be5a42ffff0f92c44af668be. Current main 044f8b75ae8b0689664fe489c22d4a3c64486717 is an ancestor. Normal integration commit 0ed399bfdf77793fb18e18bfff1ec539cc1b5ab1 has ordered parents 85630800ea40022046c7d5fc635e6ac238092ef5 and 044f8b75ae8b0689664fe489c22d4a3c64486717, with no conflicts. Authored history and prior rebase mappings are preserved. No main rewrite or new force rewrite occurred.

The integration includes current main's browser shell, command-reference producer and accepted Zod/MCP repairs. The actual browser-registry producer added four missing loaders: cloud catalog get/sync, cloud group picture and group picture. HTTP fixtures now use canonical synthetic opaque credentials, without relaxing authentication. The campaign recipient-reason flag now uses Oclif's typed option parser for the accepted SDK's eleven existing values; unknown values fail during parsing, before command dispatch.

Remain draft: matching-dependency native/browser/HTTP/compiled-reference qualification is unavailable under the no-install restriction. The installed SDK and security dependencies differ from the accepted lock. The smallest missing action is admission or provision of one source-bound installed qualification environment using accepted SDK source b3bd05843342275f25f304bfe1fc67ca872740ba and current-main locked security dependencies. This permits the real builds, fixture tests and CLI-reference producer; it does not authorize registry publication or deployed acceptance.

Accepted SDK source through sdks#362 contains all seven required methods/types. The committed registry SDK pin remains 0.1.0-dev.20261004024706, which lacks those exports. No invented version, Git/file dependency, donor lockfile or type bypass was committed. The round-2 manifest's f9937116b17f9962de8a3eb632c44d0399b05002 remains historical candidate evidence. Actual accepted package pinning/publication is a separate merge/release gate; publication alone is not the reason to withhold source Ready.

Impact

Impact table

Area	Change or remaining gate	Supporting paths or evidence
CLI commands, options, help and rendering	Prepared Official commands retained; browser loaders cover all four new commands. Recipient failure-reason admission matches the accepted eleven-value SDK enum and rejects unknown input before dispatch.	src/commands/cloud/, src/commands/group/picture.ts, src/commands/campaign/recipients/list.ts, src/developer/batching.ts, parser regression
CLI native/browser qualification and command reference	Blocked by the mismatched installed environment. Native/browser builds, genuine compiled-command reference generation/check and HTTP command fixtures remain unrun for this head. contracts/cli-reference.json is inherited current-main output and does not yet cover this PR. No hand-edit or stale-dist generation was used.	scripts/gen-browser-registry.mjs, scripts/cli-reference.mjs, contracts/cli-reference.json, CLI-CURRENT-CHECKS.json
TypeScript SDK consumer	Accepted b3bd0584 source has catalog operations, Official group picture, Marketing status and WebhookBatchingInput. The current registry pin lacks them; a genuine candidate environment is required for source qualification, and actual accepted published-version pinning remains a merge/release gate.	package.json, package-lock.json, contracts/official-api-round2.json, sdks#362
Security and dependency qualification	Current-main declarations/lock preserved: Zod 4.6.7, MCP 2.3.1. Installed Zod 4.2.0/MCP 2.0.0 do not qualify the repaired lock. No install, audit suppression or favorable lock copy.	Empty owned package/lock/workflow delta against 044f8b75; installed/locked table below
Documentation	Existing command guide retained. The current-main compiled CLI-reference producer must be rerun on genuine built commands before source Ready. No API contract date or availability announcement changes.	docs/official-api-round2.md, contracts/cli-reference.json, scripts/cli-reference.mjs
Feature and package release	Prepared consumers only; published:false, source-bound SDK/environment acceptance, actual SDK/CLI package publication and independent exact-head CI/review remain required. Beta/server authority and uncertainty reconciliation remain enforced.	Six pinned producer records, scripts/prepare-release.mjs, release evidence guards
Session publication	Current selected manual checkpoint and prior patch/author mappings are linked below; capture gaps remain explicit.	Committed session paths below

No impact table

Area	Specific reason unaffected by this consumer change	Supporting paths or evidence
API, Barback/HyperMeow, runners/Bartender, Temporal, Admin API/MCP and producer logs/audits	No backend state, route, schema, audit payload or staff authority implementation changes in this repository. Existing producer snapshots remain unchanged.	contracts/official-api-round2.json and CLI-only paths
Go, Python, PHP, Rust, C# and TypeScript SDK implementations	No SDK source or acceptance record is authored here. Consumer component checks cannot qualify another repository or package.	CLI-owned scope and accepted SDK source boundary
Inspector, Console UI and Admin Console UI	No graphical UI implementation or staff content access changes. Browser CLI loader generation is assessed above and has no UI screenshot claim.	CLI source paths; no graphical delivery
Identity, scopes, recipient/routing/custody, enrollment and feature authority	Reuses SDK/server authorization. The changed credentials are synthetic test fixtures only; CRC validity is not authentication. No fallback transport, granted principal or provider replay was added.	test/helpers/opaque-credential.ts, two HTTP fixture files, scripts/verify-browser.mjs, existing command clients
Billing/PAYG, Number tiers, Usage, Finance, analytics, tracking, experiments and onboarding	No financial rule, server credential, feature flag or event schema changes.	Consumer/test-only delta
CI, hosts, images, deploy and dependency inputs	Accepted current-main workflow and package/lock bytes are unchanged by this PR. No infra repair, timeout change or policy weakening.	Empty git diff 044f8b75 HEAD -- package.json package-lock.json .github
Public/private API specs, API version, Help Center and marketing	No producer contract or shipped availability changes to announce. CLI docs/reference effects are assessed above.	Historical pinned producer manifest and published:false

Verification

Fresh checks on exact head 6ac56fea4fd9e0e7afe92bcc9d2fd0a339a4e34e, under one serialized standard local-validation/run.py claim, Node 24.15.0 and one Vitest worker:

Check	Actual result and limit
Standalone release-evidence and CLI-reference-emitter tests	4 passed; synthetic/source guards, not a regenerated compiled reference
Vitest prerelease/render/recipient-reason tests	3 files, 12 passed; accepted frequency_cap and rejected unknown reason use the real Oclif parser
Diagnostic TypeScript check	tsc -p tsconfig.json --noEmit --incremental false passed against the existing installed candidate; matching lock/runtime qualification remains open
Changed-file formatting	Seven files passed using installed Prettier 3.9.10, distinct from locked 3.9.6
Actual browser-registry producer	386 commands, 2 local/unsupported loaders excluded; repeated generation leaves a clean tree
Git/source integrity	Clean worktree, whitespace clean, current main contained; expected-old-head fast-forward push and remote backup readback succeeded

Earlier in this continuation, five fixture assertions ran against the unmodified credential-shape implementation fetched from accepted SDK b3bd0584: valid opaque key accepted, old invalid fixture rejected, corrupted checksum rejected, canonical client credential accepted and old client fixture rejected. This is component validation, not an installed SDK/build/HTTP acceptance claim. Actual producer-file SHA-256: efd2195c0fad2d4bb80fb97794d44acd6718a9d70c7765eb5971e0b315dd9838. The reason options were compared with the accepted SDK campaign-contract enum; all eleven values match.

Dependency	Installed	Accepted CLI lock
@polymorfa/sdk	0.1.0-dev.0, historical local candidate	0.1.0-dev.20261004024706, lacks the seven required exports
MCP server	2.0.0	2.3.1
Zod	4.2.0	4.6.7
Prettier	3.9.10	3.9.6
TypeScript / Vitest / esbuild	6.0.3 / 3.2.7 / 0.28.2	Same versions

No install/download, stale-dist command execution, native/browser build, HTTP fixture run, compiled-reference regeneration, production audit, package dry-run or live provider test is claimed. No source assertion or backend/API semantics was weakened to silence a check.

Historical CI 40631452866, Verify Node 22 job 122628536690 failed prepare/build on old head 85630800 because the registry SDK lacks four catalog operations, Official group picture, Marketing status and WebhookBatchingInput. Audit was not reached. Accepted SDK b3bd0584 source contains those exports; old CI remains a failure and does not qualify this head. Current-head hosted CI and independent review are unqualified here. There were no inline review threads in the owner read; no review request, CI rerun/dispatch or source watch was added.

Session provenance and UI evidence

Registration #511, purpshell-t3-codex, Codex gpt-6.1-sol, xhigh reasoning, STANDARD/default service tier, thread 4af7f220-6221-461f-a59a-6bce7c722622. No child or review delegate. Existing authors retain their attribution.

Current reviewed manual checkpoint, commit ba153fa8ee25077d0d4be8f9f0f3085195f585ee, records four selected assistant checkpoints, with no claim of full user/tool/native capture or subsequent test results. Prior rebase and patch/author receipt retains the earlier exact mapping. Current commands/log hashes/push receipts remain in oa-readiness-20261030/. No hidden reasoning, customer content, real credentials, GUI screenshots or runtime acceptance is claimed.

Rollout and rollback

Keep draft until the genuine matching environment permits native/browser builds, scoped HTTP fixtures and actual compiled CLI-reference generation/check. One owner/environment action is missing: admit or provide that installed source-bound environment for accepted SDK b3bd0584 plus CLI main 044f8b7 security dependencies. No installation permission is inferred from this PR. This is source qualification; registry publication and deployment need their own authority.

For merge/release, bind the actual accepted published containing SDK version in package/lock and source-bound acceptance, complete exact-head CI/independent review, and obtain Release's merge decision. Nightlies require matching staging acceptance; stable packages require production acceptance. Release alone merges; staging stays deferred. PG/MR/mount/POL-23/default-off and provider acceptance remain with the separate dark Groups surface and are not qualified by these CLI checks.

No package/tag, registry, provider, flag, secret, host, deployment or DB action occurred. Old remote 85630800ea40022046c7d5fc635e6ac238092ef5 is preserved at backup/oa-cli89-ready-20261030-head and in a pre-integration bundle. Rollback can revert this consumer support but cannot reverse an applied catalog sync, block or group-picture effect. Uncertain provider effects require reconciliation; Hybrid never retries group operations through Official.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}