[purpshell]

Summary

Adds native Number catalog list/get/products/sync and Marketing Messages status, Official multipart and Linked Devices group-picture commands, and Platform webhook batching flags/details. Existing Graph and contact block/unblock commands remain available; beta/scoping errors and Hybrid linked-only routing are preserved.

Draft, blocked on an actually published accepted containing SDK and clean new-head qualification. The committed SDK pin remains 0.1.0-dev.20261004024706. The manifest's f9937116b17f9962de8a3eb632c44d0399b05002 candidate is historical local evidence, not a registry or environment acceptance receipt. SDK360 was integrated through SDK357; the existing sdks#362 publication gate remains separate.

Current head: 85630800ea40022046c7d5fc635e6ac238092ef5, tree ee61ea63ee34e0f82ad1a1a8b1ccb71f8eb68083. Explicit --rebase-merges --onto refresh moved the two owning commits from base 301bd6afd019aa8422cc91912424981387effb25 to accepted current main a9a19cd68eecf7f33eae495665c1f389b6906a5e, which contains CLI Zod #91. No conflicts. Authored patches, author identities and author dates are preserved; git range-diff marks both =. Package.json, package-lock.json and workflows are byte-identical to accepted main.

Old authored commit	Rebased commit
726b63bf7db987ac270fd92fd825f95cc71cef9f	4ab3e6f4bb3db1a143a72b37f45a6dfedbee13dd
c71cdcd42ecc66fcb26a5ccb3c876d09665ac03d	85630800ea40022046c7d5fc635e6ac238092ef5

Old remote head c71cdcd42ecc66fcb26a5ccb3c876d09665ac03d is retained by backup/oa-cli89-pre-rebase-20261028-c71cdcd and a pre-rebase bundle. Delivery used the explicit expected-old-head lease after checking the live head and target. Main was not rewritten.

Impact

Impact table

Area	Status and required next gate	Evidence
CLI commands, rendering, help and docs	Existing prepared changes retained exactly during rebase. Native catalogs/marketing, multipart, Linked Devices group pictures and webhook batching remain behind server scopes, enrollment, target and effect checks.	src/commands/cloud/, src/commands/group/picture.ts, src/developer/batching.ts, docs/official-api-round2.md
TypeScript SDK and clean build	Blocked on an accepted published containing version, exact package/lock refresh and clean type/build/HTTP fixture qualification. No Git/file dependency or fabricated version committed.	package.json, contracts/official-api-round2.json, existing sdks#362 publication gate
Security/dependency qualification	Accepted #91 Zod 4.6.6 and MCP 2.3.1 declarations/lock retained. Installed Zod 4.2.0/MCP 2.0.0 remain old; they do not qualify the repaired lock or new-head audit. No install allowed in this refresh.	Accepted-main parity and current rebase evidence
Feature and package release	Prepared counterparts only; published:false remains enforced. Native/provider and deployed environment acceptance, actual accepted SDK publication and CLI exact-head CI/review remain required.	Six pinned producer records and scripts/prepare-release.mjs
Session publication	Current manual checkpoint and source/rebase evidence are now published with monorepo #810; native zero-event capture and partial coverage are explicit.	Commit-pinned links below

No impact table

Area	Specific reason unaffected by this consumer refresh	Supporting paths or evidence
API, Barback/HyperMeow/Bartender, runners, Temporal, Admin API/MCP, producer logs/audits	Rebase consumes existing accepted CLI main and preserves the six producer contract snapshots. No backend state, route, schema or authority implementation changed in this repository.	Unchanged contracts/official-api-round2.json and owning CLI path scope
Go, Python, PHP, Rust and C# SDKs; TypeScript SDK implementation	No SDK source changed here. Their separate owner retains accepted source, verification and publication authority; this PR cannot qualify or publish any language.	CLI-only authored patch and SDK publication gate
Inspector, Console UI, Admin UI, Help Center and marketing	No graphical UI or shipped availability change from this CLI refresh. Command help/docs are assessed above.	Owning source paths; no GUI delivery
Authentication, identity/recipient, regional routing, custody and enrollment/flags	Reuses accepted SDK/server authority without granting access or retrying Hybrid via Official.	Existing CLI client and command contracts; byte-identical authored patch
Billing/PAYG, Number tiers, Usage, Finance, analytics, tracking, experiments and onboarding	No financial rule, credential, flag, event schema or measurement changed.	Consumer-only patch scope
Shared CI, hosts, images, deployment and lock inputs	No owned workflow or lockfile delta from current main. Existing accepted dependency repairs are consumed as written.	Empty git diff a9a19cd6 HEAD -- package.json package-lock.json .github
Public/private API specs and API version	Producer paths/hashes remain historical pinned snapshots; no producer change or new API contract version is generated by a CLI rebase.	contracts/official-api-round2.json, published:false

Verification

On rewritten head 85630800ea40022046c7d5fc635e6ac238092ef5, through the serialized standard run.py lease with Node 24.15.0:

Current check	Actual result
node --test --test-concurrency=1 scripts/release-evidence.test.mjs	3 passed
One-worker Vitest test/release/check-prerelease.test.ts	4 passed
Rebase/range-diff and authors	Both patches identical; author identities/dates preserved; accepted main is an ancestor
Source/package-lock/workflow parity and whitespace	Passed; clean worktree

The selected guards use source manifests and synthetic acceptance receipts. They do not execute the installed SDK, Zod or MCP runtime. The existing installed SDK is an unpublished 0.1.0-dev.0 candidate, and installed security dependencies differ from current lock. No install, stale-dist command test, build, full typecheck/suite, production audit, registry acceptance or live provider test was run or claimed for the rewritten head.

Historical local evidence on the old head used an exact packed SDK candidate and passed 111 files / 1,066 tests plus typecheck, lint, build, formatting, release checks and package dry-run. That does not qualify this rewritten head. Old CI 39565704066 failed npm ci's prepare/build with seven absent SDK methods/types. The old MCP audit also failed. Accepted #91 repairs the dependency source; those old failures remain historical and fresh clean new-head SDK/build/audit/CI checks are still required. No old red is waived or relabeled green.

New-head hosted CI/review is not yet qualified by this lane. Release owns the existing watches and merge slot. No automated review request or CI dispatch/rerun/poll was made.

Session provenance and UI evidence

Agent registration #511, Codex / gpt-6.1-sol xhigh, current owner thread 4af7f220-6221-461f-a59a-6bce7c722622. Original authored commits retain their author attribution.

Current reviewed manual checkpoint, commit a92e5a950f8f6c67e3e44ff2e91d2add8f4fcbac. Rebase, patch/author mapping and new-head checks and six-part report bind this CLI head and the separate dark Groups candidate to their own actual evidence. Native SQLite capture returned zero events; selected visible messages were manually imported with omissions stated. No complete transcript, hidden reasoning, customer data, graphical UI or real credentials are claimed. CLI text/source guards only; no GUI screenshots apply.

Rollout and rollback

Keep draft. Required order: accepted SDK source and environment acceptance, actual containing registry publication, exact CLI package/lock pin update, clean qualification and exact-head CI/independent review, then Release's merge decision. Nightly packages need matching staging acceptance and stable packages need production acceptance. Staging deployment stays deferred; no package/tag/registry/flag/provider action occurred.

Release is the sole merge executor. Existing deployment-pause, image-admission and human legal/activation gates remain; a mechanical rebase approves none of them. No main rewrite or other owner contract/lifecycle change occurred.

Rollback reverts the CLI commands/settings support while retaining pre-rebase backups. A client revert cannot reverse an applied catalog sync, block or group picture. Uncertain provider effects require reconciliation before a new attempt; Hybrid never retries group operations through Official.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}