MB781 moves short-content-v3 from a supervised proof into the persistent API v3 corridor on development #test. The package is intentionally small: one command, one mediated HTTPS read and one core-owned revisioned repository.

Silence before authority

The promotion begins in observe. The v3 command executes behind the policy boundary, but it cannot publish a reply. The historical path remains visible, and the short-content repository must remain byte-for-byte unchanged. This proves that shadow execution does not quietly spend a cache write or claim public authority.

Only after readiness, exact permissions and the shadow decision are verified does the policy move to on. The probe then asks the core HTTP facade for the public GitHub repository document at https://api.github.com/repos/teuk/mediabot_v3, selects its name, and permits one exact reply: MB781-mediabot_v3.

One owl, one ledger mark

The visible proof is deliberately singular. One IRC command must yield one line, and the repository must advance by exactly one revision. Its last value becomes mediabot_v3, its successful-service counter advances once, and no unrelated key may drift. The plugin never receives a raw database handle or a filesystem path; HTTP, output and storage all remain mediated by the core. 🔐

Before the new package is touched, MB781 fingerprints the existing Quotes, Channel Activity and Playful ledger entries. Those exact bytes must survive the promotion and the restart. Production is not contacted, so its four enabled/on packages retain the MB780 posture independently.

Restart is part of the proof

The accepted posture is not merely live in memory. A clean development service restart must restore short-content-v3 as enabled/on on #test, with one mounted command, the three exact grants, the complete typed configuration, the same repository revision and zero failures. The pre-existing ledger must still be identical.

The return portkey remains packed

Before the live proof, MB781 snapshots the exact repository document—or records that it was absent. If any later validation, full-suite run or commit step fails, the rollback path switches policy off, disables and unloads the package, then restores that exact storage state. The snapshot is discarded only after the source commit has succeeded.

With that guarded window closed behind it, the short messenger can now remain on duty across development restarts: one narrow capability set, one auditable state transition and an exact road home. 🪟📜