Integrate retained evidence links with current Context API
Callers need to link an exact retained supporting copy to an existing artist, professional or Context record they can access, then inspect that link later. This candidate adds authenticated HTTP and standard MCP actions. Delegated OAuth gains neither the evidence tools nor extra supporting-text references. It adds no web upload, verified file origin, reviewed fact or automatic artist link.
Current review head: 56a46e10cc5ae9fce62c29dc1cd60a794c711131, unmerged and unreleased. It merges accepted evidence candidate c70af814d5671f26a07b3af4d9a83a39a296c161 with current main d50794499c82448d41e88f7ff18dc8400c820e91 (API #1050). Independent exact-head delta review confirms that only four discovery/instructions/test/config files were imported, each byte-identical to main. Context runtime, MCP restrictions, database client, contracts and dependencies are unchanged from accepted c70af814. Main's earlier posting/payer repair and both Social/Context fixture references remain preserved.
The existing repair separates transaction dispatch from strict result validation, uses safe fixed diagnostic categories, gives evidence reads private/no-store responses and provides action-specific retry guidance. Standard-only tools stay excluded from delegated registration. Pagination coverage includes continuing after empty nonterminal pages. Read throttling remains an explicit operational-policy deferral; no standard HTTP/MCP quota is introduced.
Canonical companion Marketing #184 at ab94b651d70d7751bb19b5232e84aeea110d6f98 imports the already merged posting reference and pins the earlier unmerged c70af814 review source. Refresh that pin only after the actual API merge. Its Context contract and producer code remain unchanged from 873d3ce1; its two shared fixture copies exactly match this candidate.
Focused current-main verification: 51 API contract cases, response-contract typecheck, required lint and fixture formatting pass. Marketing has 14 producer/11 docs passes plus generation, inventory/fixture checks and the required production build. Accepted broad suites were not repeated. Earlier functional evidence (6,695 API passes/12 opt-in skips, Node22 OAuth 203/one skip, extension 19) remains scoped to 1364336e, not a new combined-main run. The prior c70af814 CI and preview checks passed; those observations do not substitute for required checks on 56a46e10. Independent source/compatibility review now passes at 56a46e10. Its required CI and preview results must pass before the coordinator's guarded merge; automated merge-commit success statuses are not independent review.
Database prerequisite satisfied: the five approved changes are installed and independently verified in production. Read-only checks confirm the five original source hashes, exact tool-envelope record, eight final function hashes, RLS/access rules, required constraints/triggers and unchanged existing Context definitions. The exact production receipt is retained privately, and the generated envelope source is preserved in the owning Database checkout. Database source/Preview publication and parent-reference updates remain separate unperformed work; no such side effect is authorized here.
Remaining pre-merge gates: required checks on exact head 56a46e10 and the coordinator's normal guarded merge. The bounded source delta and database prerequisite pass. The existing recovery plan retains additive schema/receipts and the pre-existing lock privilege, with application fallback to the pinned prior d5079449 deployment after its binding is revalidated; this does not authorize a manual rollback. Existing local synthetic qualification covers real shared Context code, isolation, exact-key lost-ack recovery and changed-input/withdrawal rejection; it is not hosted customer acceptance, and no redundant broad rerun is claimed.
After release: verify the actual API merge/deployment and database binding, then refresh Marketing from the actual API merge. Any hosted synthetic or customer attachment/read/replay needs a separately named authenticated actor/company, exact retained source version, independently allowed targets, idempotency key and retention/recovery scope. No hosted write test or Gatsby business write is authorized by this source release recommendation. Evidence tools remain excluded from delegated OAuth.
The original #983 remains untouched/open; reconcile replacement ownership under Mono #361, not both candidates. After approved API release, regenerate Marketing's pin from the actual merge; retained Docs follows the actual Marketing merge. This source integration performs no migration, hosted write, provider/model call, customer import, merge to main or production publication.