[AGENT] Add contributor collections, local uploads and media review

[BASIC-BIT]

[AGENT] Contributors can organize collections, upload local images through a temporary multipart endpoint, and inspect and review stored media through MCP or the website. Shared versioned commands and durable receipts recover lost responses. Separate reviewer, publisher and capacity grants preserve independent review and restrict trusted publication to eligible empty slots.

This combines the three approved phases in one PR: assigned review, native current/candidate previews, withdrawal, paginated contributor history, bounded intake and retention, cleanup, and migration controls. Admission and retries retain current authorization. Private current images use reviewer-authorized access, OAuth challenges identify the required grant, and archived or empty batches remain subject to retained-capacity limits.

Local evidence includes the mixed 30-item/20-image collection and 1,100-item capacity proofs using injected storage and synthetic accounts, desktop/mobile comparison and publication-recovery cases, and concurrency, revocation, migration and cleanup regressions. A large-history regression verifies byte-bounded envelope counting, honest partial counts and same-key recovery. Signing recovery tests cover no-op settlement and lost acknowledgements through the real adapter, registered MCP callback and local backend. Each correction passed independent scoped review.

Feature-specific hosted S3 transfer/cleanup, authenticated multi-user journeys, installed Codex/Claude image rendering and exact product-copy approval remain release gates. Local upload intake defaults to disabled, and elevated capacity policy is restricted to the local proof identity. The operator checkpoint covers migration/accounting reconciliation, approved-target prerequisites and rollback.

• Implemented review journey and commands
• Collection checkpoint and rollout gates

[github-actions]

PR verification report

All configured preview and verification checks passed.

Check	Result	Evidence
Mutation data flow	PASSED	Open artifact
Hosted data flow	PASSED	Open artifact
Public route screenshots	PASSED	Open artifact
Public route image diff	PASSED	Open artifact
Storybook screenshots	PASSED	Open artifact
Storybook image diff	PASSED	Open artifact

Changed visual baselines (2)

storybook-desktop / storybook-media-review-comparison

storybook-mobile / storybook-media-review-comparison

Updated from Baseline Checks run 35907709649, attempt 1 for 8658531. This comment is updated in place.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-23T19:31:27.885403Z	8658531	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

[AGENT]

Claude Review

Claude review for commit 8658531ba3deb54cce5fd39b9cbe3fa157aadfa9 is unavailable because the pull request was merged.

This is not a current review or approval.

[greptile-apps]

Confidence Score: 4/5

The signing-recovery correction appears sound, but the PR is not ready to merge until the repository’s exact public-copy approval requirement is satisfied.

Findings

1.  Public copy lacks approval ▶

Fix with agent prompt

### Issue 1
apps/web/src/app/account/media-review/media-review-view.ts:21-43
This ships new authored browser status text even though the repository requires BASIC's review of exact new public-facing copy before shipping. The checked-in task report explicitly identifies these strings as proposed and not yet approved. The same issue appears in the new publication messages and MCP tool descriptions. This repository requirement must be satisfied before merging by obtaining approval or withholding the unapproved copy.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

This PR adds contributor collections, bounded local media uploads, assigned media review, trusted publication, durable command receipts, and the associated contracts, documentation, and tests. The correction since the previous review now distinguishes confirmed signing failure from lost or uncertain settlement acknowledgements.

• A confirmed matching settlement produces the durable terminal upload-target refusal.
• A stale, no-op, or unacknowledged settlement returns same-key retry guidance so a live reservation is not falsely reported as terminal.
• Recovery coverage includes lost success and failure acknowledgements, concurrent attempts, durable receipt replay, and the registered MCP callback path.
• The merged event-lineup changes come from the updated base branch rather than this correction.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[Begin upload with idempotency key] --> B[Admit reservation and acquire signing token]
  B --> C[Generate storage target]
  C -->|Target created| D[Settle signing success]
  D --> E[Return upload target]
  C -->|Target creation fails| F[Attempt matching failure settlement]
  F -->|Settlement confirmed| G[Return durable terminal refusal]
  F -->|No-op or acknowledgement uncertain| H[Return same-key retry guidance]
  H --> I[Replay admission]
  I -->|Stored receipt exists| G
  I -->|Reservation remains live| C

Loading

_{Reviews (3) · Last reviewed commit: "Trim contribution test EOF whitespace"}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f79c68748c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[BASIC-BIT]

[AGENT] The GitHub Claude review stopped before inference because this PR exceeds its 500,000-byte textual-diff limit. That job remains unavailable; its safety limit and skip controls are unchanged.

A local read-only Claude fallback reviewed public base 74cf6b8 through f79c687 in three file-boundary partitions. The returned model was claude-opus-5. The recorded reads cover all 21,956 text-diff lines. It did not run tests or inspect screenshot binaries.

Source validation confirmed one OAuth consent-recovery issue for the new contribution tools, included in the current correction round. Its concern about daily cleanup re-arming was not confirmed as a blocker: that schedule intentionally reconciles late writes, and processed rows move to the following day in the ordered queue. The review does not establish hosted storage behavior or cleanup throughput.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[BASIC-BIT]

[AGENT] @codex review

Please review the correction delta from f79c687 to 3ac183b and verify the resolved technical findings. Each correction round passed independent scoped review. The final candidate passed 892 backend tests, 487 web tests, typechecks, API/MCP package checks, documentation build and local Convex runtime validation.

The two exact-copy approval threads intentionally remain open pending BASIC's decision. Hosted feature enablement still has separate S3, authenticated journey and installed-client proof gates.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[BASIC-BIT]

[AGENT] @greptileai Please review the correction delta from f79c687 to 3ac183b and verify the resolved technical findings. Both correction rounds passed independent scoped review. The exact-copy approval threads intentionally remain open pending BASIC's decision.

[BASIC-BIT]

[AGENT] @greptileai Please review the correction from 3ac183b to bf2f21d.

The local read-only Claude delta review completed through 3ac183b and found a replay signing failure being reported as terminal while its reservation remained live. db2f6ff fixes that classification: only confirmed settlement produces terminal refusal; no-op or uncertain settlement returns same-key retry guidance. Its independent scoped review passed, including real adapter/backend and registered MCP callback cases for lost acknowledgements.

This head also integrates main's merged event-lineup PR342. Independent integration review confirmed both parent MCP test sets and generated contracts are retained. The remaining follow-up only removes EOF whitespace. CI is now running on bf2f21d.

The two exact-copy approval threads remain open pending BASIC's decision. GitHub Claude's full-PR review remains unavailable because of its diff-size cap, and the Codex re-review request hit the account's code-review quota. Local review evidence does not turn those unavailable reviews into approvals.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8658531ba3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[BASIC-BIT]

[AGENT] The twelve technical review threads have individual dispositions and are resolved. The corrections are in follow-up PR #345, which is undergoing its own CI and review. This link tracks the postmerge fixes; it does not change the already deployed PR343 release.