World Monitor Updates & Release Notes

Summary

Partners can now mint their own embed key: Settings → Embeds → Create Embed Key, on any paid plan. Until this, createEmbedKey existed with no interface, so the docs had to say "ask us for one" and the paid tier was effectively unreachable.

It also finishes the credential migration. chokepoint-strip and fear-greed now accept wme_ keys, so a partner running a keyed panel finally has something safe to publish instead of the wm_ or enterprise key the docs used to recommend.

Stacked on #7706.

The brief for this was wrong, and the fix is wider

Accepting wme_ in evaluateEmbedEntitlement alone does not make those panels work. They do not read their data through the entitlement endpoint — they call get-chokepoint-status and get-fear-greed-index through server/gateway.ts with the same credential, where wme_ fails every shape test. The handshake would answer 200 and the panel would still 401.

So the gateway accepts wme_ too, and the containment is worth stating precisely:

• Only on RPC paths a paid panel declares in the registry.
• EMBED_KEY_RPC_PATHS is derived from those declarations, so the surface cannot widen without a panel owning the path.
• Not an escalation. Neither declared path is tier-gated or in PREMIUM_RPC_PATHS, so both already answer an anonymous wms_ session.
• This reaches no new data; it gives a frame with no session a credential shape the gateway understands, replacing the over-powered key it is migrating off.

isUserApiKey stays false, so the credential never enters the per-account REST meter, never hits the apiAccess gate, and never becomes the rate-limit principal — an embed is read by many viewers on many IPs, so the per-IP bucket is the correct one.

Same fail-closed IP guard as the wm_ branch against rotating-key lookup amplification, and a transient billing failure returns a retryable 503 rather than collapsing into "invalid key".

This also fixes an inconsistency #7705 introduced: moving the entitlement endpoint onto hasEmbedAccess admitted Pro accounts, but the gateway still required apiAccess for the wm_ key those panels carry, so a Pro partner got 200 from the handshake and 403 from the data read.

Design decisions

A separate Settings tab, not a section of API Keys. That tab is gated on apiAccess, which is false for both Pro tiers, so embed keys placed there would be invisible to the customers this feature exists for. The Connected MCP Clients tab already solves the same split for the same reason. Keeping them apart also matters because they are different kinds of secret: one is meant to be published in page HTML, the other carries your REST allowance.

wm_ and enterprise keys keep working, with no removal date.

Partners are running them right now. The response marks them deprecated and the frame logs a migration warning naming the risk, but nothing breaks. Retiring the path would need telemetry that does not exist — the gateway emits these as anon today, so nobody can count who would break.

The dialog offers the keyed snippet without gating the free one. A keyless snippet is now the free tier, so it stays available to everyone including signed-out visitors. Users with embed access additionally get the loader form; users with the entitlement but no key yet are routed to the new tab rather than dead-ending.

Revocation states both windows. New reads with a revoked key are denied within about 60 seconds. An already rendered one-shot paid panel remains visible until reload, while a live map frame that already holds a grant can keep its paid tier for up to 30 more minutes before falling back to the free tier. The earlier copy promised only the shorter number, which is exactly wrong for the person most likely to read it — someone revoking a key they believe has leaked.

Deviation

The dialog emits a placeholder rather than the user's actual key. It cannot do otherwise: plaintext is shown once at mint and listEmbedKeys returns only a 9-character display prefix, by design.

Validation

npm run test:convex 92 files / 1,778 tests, npm run test:dom 108 files / 861 tests, focused embed and entitlement suites 161 tests, and npm run typecheck:all all pass. The full npm run test:data run passed 30,671 of 30,689 tests, skipped 17, and had one unrelated 40 ms timing failure in five-factor-scorecard-seed; its isolated rerun passed all 26 tests.

The entitlement crosswalk is green with 333 gates, zero unmapped gates, and zero count drift. Architecture boundaries and the 44-policy rate-limit audit also pass. The local /embed.html?panel=map&layers=conflicts,earthquakes,weather runtime mounts the attributed keyless map without a credential error.

Post-Deploy Monitoring & Validation

For 24 hours after deployment, monitor AUTH_REQUIRED, EMBED_ACCESS_REQUIRED, account_verification_unavailable, embed_not_entitled, key_validation_unavailable, /api/embed/session, and /api/embed/map-frame.

Healthy behavior:

• A verified PRO account can mint a persistent wme_ key.
• The key exchange returns a panel-scoped wmg_ grant with a 30-minute maximum lifetime.
• Paid frames use private, no-store responses and rate-limit by verified account ID before source reads.
• The keyless public map continues to show conflicts, earthquakes, and weather with the hourly shared-cache profile.

Treat a rise in PRO 403 or 503 responses, a missing plan claim in the active Clerk convex JWT template, or paid frames that stop renewing as a release failure. Roll back the #7707 head or hide the self-serve key UI while keeping the free keyless map available. The WorldMonitor maintainer owns this validation window.

fix(x): stabilize curated List polling budget

fix(review): close code-review findings on the curated List polling budget

Applies the verified findings from the multi-agent review of #7626.

Money and coverage integrity:

Membership drift no longer re-bills every slot. An off-registry author voids the whole page in buildXListReceiptResult, settle() rejects the null receipt before reaching the refund script, and the per-slot coverageId let the identical paid attempt repeat -- 480 of the 600 daily Posts spent on pages the relay discards, indefinitely. Drift now opens the bounded auth-sized backoff, so an operator repairing the List still recovers automatically.

Coverage is verified instead of asserted. accountsPolled was set to the whole registry on any accepted page, and verifyXListMembership was reachable only from the operator-run verifier, so a List that silently lost members -- or was emptied outright -- kept publishing "N/N complete" and stayed healthy, now that an empty page is a valid result. A daily poll-time check (List + members, both non-Post-returning, so no budget cost) degrades cycleComplete and the real counts on drift. Being unable to READ the List is inconclusive, not drift: missingIds is computed against an empty member map, so failing closed there would red a healthy feed on a transient blip.

A rejected slot stops claiming completeness. lastCoverage froze whole, so polled/expected/failed froze with complete and normalizeCoverage could not self-correct; the panel's degraded banner never rendered through an outage.

Dead code and contracts:

SETTLE_LUA's once-per-day and coverage release branches were unreachable once RESERVE started writing the literal "done" into the once key -- the guard compared it against the reservation key. Removed from both the source and the pinned proxy copy, with the inert completeOnce/completeCoverage plumbing and their ARGV/KEYS slots, and RESERVE now records that admission is the sole commit point.

lastPollAt silently became an accepted-publication clock while keeping its name, on the public /health as well as /status. lastAttemptAt (the old semantics) is now served on /health too, and the change is documented.

x-intel.mdx still described GET /2/users/:id/tweets with since_id on a 5-15 minute cadence.

pollXListFeed takes the caller's structured slot instead of re-parsing a list-slot: prefix and re-deriving endsAt from a second interval constant.

The Convex RESULT_CAP.x parity test derived its 95 from a literal, so it could not catch drift against MAX_COMPANY_MONITORING_X_RETURNED_POSTS.

Test coverage on the paid path:

Restored the multi-replica backoff-merge suite deleted with the per-account cursors. mergeRefreshedPollState still ships at two call sites and had zero coverage; a regression could let one replica clear a peer's 429 backoff on the shared bearer.

withReturnedPosts' settle-conflict and over-return inflight releases.

The returned-Post refund's cross-call effect, which computed zero in every existing case.

Deferred, deliberately not applied: the tracked-reconciliation cap (company-monitoring-x-provider.mjs). Reserving a discovery floor there is not safe unilaterally -- the slice always starts at index 0 with no rotating offset, so truncating it means the tail of allTrackedPosts never receives its deletion check on any lease, trading discovery starvation for a compliance gap. The regression-free resolutions both change scan throughput and are the owner's call; the trade-off is now documented at the call site.

Verification: 297 focused tests pass (x-news-accounts, x-poll-cycle, x-post-budget, x-post-budget-lua, x-relay-state-contract, x-post-endpoint-inventory, redis-rest-proxy-command-parity, company-monitoring-x-provider, company-monitoring-worker, health-classify), including 21 new tests.

typecheck, typecheck:api, lint:boundaries and git diff --check all clean.

Claude-Session: https://claude.ai/code/session_01U2c9eT2TWMvNWnetJkjNTX

feat(company-monitoring): add identity_unresolved coverage state

A company with no independent identity binding cannot be scanned — no provider query can be safely attributed to it — so it must never read as a quiet result. Reporting such a company as quiet is the false quiet the #6002 stop conditions prohibit (#7044).

Both sources of truth carry the new state: the CompanyCoverageState proto enum (new number 7, no renumbering) with the generated client/server unions and the generated request validation pattern, and the convex coverageState union (awaiting_first_scan | identity_unresolved; absent still means resolved-and-scanned, with observationState carrying the result).

Transitions, with the non-overlap semantics from the issue:
set when identity resolution fails: an X identity observation that lands demoted (conflict, account change, or expiry) marks the company identity_unresolved;
cleared when a binding is verified: an authoritative identity resolves the company (coverageState back to undefined);
reinstated on demotion: the official_link_lost / authority_lost path that fires when a held binding expires or loses its domain claim re-marks the company identity_unresolved, so a company that held a binding and lost it does not silently read as quiet;
every coverage flip advances the company row's own snapshotGeneration — that is the freshness signal company-scoped reads compare against, so a flip without the bump would stay invisible to snapshot-gated consumers (encoded in a test).

The shared coverage contract accepts the state in both spellings, the OpenAPI injector publishes it with a description stating it is not a quiet result, and assertCoverageObservation keeps refusing it as a carrier of no_events_observed — the never-quiet guarantee is pinned by tests on the contract and on the demotion transition.

fix(review): complete identity-unresolved transitions

chore(review): regenerate company monitoring contracts

fix(review): cover handle-less X identities

fix(review): preserve OpenAPI capacity

fix(review): keep coverage examples schema-valid

Co-authored-by: yzxcj797 [email protected]

Co-authored-by: Elie Habib [email protected]