[Reconciliation][P2] Reconcile API, App and Docs contributor instructions with current architecture #356

Parent workstream: #324
Epic: #318

Priority: P2 · Audit findings: API-DOC-10, W2

Outcome and problem

API AGENTS prohibits caller account_id and raw auth extraction while its examples contradict those rules. App guidance points to removed lib/browser and lib/chat/toolChains paths. Docs guidance names a nonexistent single OpenAPI file and obsolete design rules. These are instruction defects, not evidence of an authorization bypass.

Scope and ownership

• Implementation repositories: api, app, docs; coordinate with the marketing and skills instruction tickets.
• Explain authenticated identity separately from explicitly authorized target-account overrides and use the actual shared helper pattern.
• Replace removed architecture/authoring paths with current source locations and declare the canonical design reference.

Planning is tracked in Mono. Implementation and release PRs belong in the owning repositories under their current branch rules.

Acceptance criteria

• Every auth example follows current validateAuthContext authorization rules and no example contradicts its surrounding instruction.
• App architecture paths resolve in the reviewed commit and describe the current transport/tool implementation.
• Docs instructions point to split OpenAPI files and the intended current design source.
• A bounded maintained-path check detects removed literal repository paths without scanning historical documents as active policy.

Evidence and existing work

Baseline: October 10, 2026 audit of July 10–October 10 merges. Recheck current source and existing tracker comments before implementation. Source findings do not establish authenticated production behavior.

• Source evidence 1
• Source evidence 2
• Source evidence 3
• Source evidence 4

Source corrections released — October 12, 2026

API resolver examples now include the correct import and explicit accountIdOverride argument and remove the contradictory body identity example. Docs points to maintained split specs and a real wrapper example. App #2242 removes three stale paths and describes API-owned workflow transport. Its dependency-free CI guard verifies 15 maintained Architecture/MCP/Constants paths without scanning historical docs as active policy.

All five approved source PRs are merged: API #1032, Marketing #152, Docs #373, CLI #26, and App #2242. Mono #373 records the five source references at e650245fe3267a08b94abbb75dc30a8a4108c020. The immutable provenance chain is API 0a590490c0e005045e4cbf399fe552dc41e6b9a3 → Marketing 62cc352c4c90d4578bea4352001fc459b7566e1b → Docs fa6dc9e761056066299dde4525552b0d14442f1f. App source is d13bdcb7b112ff0ed8d9d243ae7c6fd56f9a80d4; CLI source is a11bff0a36e339e94ad6921e55d82ec9472d0e35.

Verified publication: API, App and Marketing main checks pass and their canonical Vercel aliases are READY at those actual merge commits. All 231 merged Docs files/navigation match Marketing. Five representative Markdown pages pass on both public hosts; all 12 downloadable split specs on both hosts exactly match source. Canonical Marketing human pages and both LLM catalogs pass. Both human catalog pages show the 1–366 range; the separate playcount maximum remains 31.

Remaining release gates: CLI build/typecheck/77 tests passed, but npm publication failed with HTTP 404; the registry still serves 0.1.15. The release bot bumped source to 0.1.16 without publishing it. A valid NPM_TOKEN replacement and installed-registry-package verification are required; no token value belongs in an issue. Retained-host normal /llms-full.txt still returns cached v0.1.13/--room-id guidance (cf-cache-status: HIT, max-age=86400); a cache-busted read shows the corrected CLI/Context/Sites content. Its human /mcp still returns 405. Docs main's Mintlify deployment succeeds, but these URL/cache problems are not thereby resolved. Mintlify connection/routing repair and host cutover remain explicitly deferred. No hosted Context, media, OAuth/client, or unresolved-feature acceptance is inferred from this source release.

Ticket acceptance update: Closure evidence: API resolver/auth examples were reviewed against the current helper signatures; App architecture paths resolve at the merged commit; Docs instructions name the maintained split specs and actual wrapper. The merged dependency-free App guard passes all 15 maintained paths and fails when lib/browser/ is temporarily restored; the original file was restored and the checkout is clean. All three owning instruction changes are merged.