Engineering for SCSP’s “first fully AI-native entity by 2027-01-01” program. Read HANDOFF.md first: it holds the current state, the open decisions and the next steps. Confluence (IPO → 3.M) is the shared record with SCSP.
gw-admin-assistant IAM,
harry-devs access, secret names, other entities’ data or names. Write those pages for
SCSP’s engineers and leadership. Proposals stay labeled Draft until reviewed; decisions
count only once recorded in 3.M.4.01 SCSP Intelligence (shared foundation: knowledge, shared tracker, search, permissions, status pipeline, feedback) → 02 Access control and record of use (every request checked, every result recorded) → 03 Team bases (PTB / Communications, Technology Leadership, AI Adoption, Global Partnerships, Events, Operations / HR) → 04 Work agents (CEO and senior directors only, able to exchange with each other) → 05 SCSP MCP connector (sign-in, tool routing, refusals) → 06 Chiefs of staff (everyone; their own Claude or ChatGPT).
scsp.ai, customer 101475582153570045240, helpdesk route scsp-prod
(sibling scsp-ap.ai). Leadership works in Gmail, not Slack. Email is non-negotiable.POST /v1/context) that returns “evidence packets with provenance,
timestamps and scope”. That API is the connector’s first tool. Its contract and auth are
still to come from EH.us and global only.Server takes on_list_tools / on_call_tool in
its constructor (the 1.x decorators are gone), and its types are snake_case with
camelCase aliases. streamable_http_app’s default host settings reject every
non-localhost Host header, which means everything behind Cloud Run (Gwen hit this).
It guards /mcp only when handed token_verifier; without it /mcp is silently open.
Its own /revoke refuses public clients such as Claude, its /authorize refusals carry no
RFC 9207 iss, and it never checks tool arguments against their schema: the prototype
wraps or replaces each (cos_lab/CLAUDE.md, “Facts learned the hard way”).project = ITPROJ AND parentEpic = ITPROJ-1401 ORDER BY Rank ASC.
Tickets and comments posted through Claude are first person, in Adam’s voice, and SCSP
staff can read them.cos_lab/ (GCP project adam-cos-lab, ITPROJ-1421) builds the
SCSP connector for Adam alone first. Lessons from it feed this folder. It has its own
CLAUDE.md and HANDOFF.md; read those before touching it. Its connector (2026-10-15) is the
starting point for SCSP’s: a consent page before Google (the MCP spec requires one here),
only the approving browser finishing, Google’s ID token really verified, sessions with
rotating refresh tokens, and every step recorded without content. The lessons that bind
SCSP are in HANDOFF.md, “Facts learned”.hillspire.atlassian.net)| Page | ID |
|---|---|
| Folder 3.M SCSP Initiative | 2629500957 (a folder, not a page) |
| 3.M.0 Start Here | 2629140548 |
| 3.M.1 Roadmap to January 1 | 2628059242 |
| 3.M.2 Discovery | 2627174519 |
| · Systems Inventory | 2626879595 |
| · Base: PTB / Communications | 2630221840 |
| · Base: Technology Leadership | 2626879616 |
| · Base: AI Adoption | 2628681789 |
| · Base: Global Partnerships | 2628255828 |
| · Base: Events | 2628714598 |
| · Base: Operations / HR | 2629992463 |
| 3.M.3 Architecture (Proposal) | 2630090779 |
| · Permissions Model | 2630025229 |
| · MCP Connector | 2628059264 |
| · Gmail Strategy | 2626748568 |
| 3.M.4 Decisions and Open Questions | 2629369901 |
| 3.M.5 Meeting Notes | 2628616259 |
| · Sync 2026-10-09 | 2629697546 |
New meeting pages go under 3.M.5, titled SCSP Sync YYYY-MM-DD: topic. Confluence page
titles must be unique within IPO, which is why every title carries “SCSP”.
gw-admin-assistant. SCSP gets its own projects, ideally in
its own organization.