FLT-75 — good morning. Here's exactly where it stands.¶
Bottom line: the founder-intake host is done, tested, and landed. Going live needs two things only you can do (a token and an OAuth click — I can't mint or authorize either while you sleep). I did everything up to that line so it's a ~2-minute finish.
Finished overnight (landed on main)¶
85405ee— the host now reads secrets from your~/.fleet-secrets/drop-in files (same convention as your jira/atlassian/vikunja tokens). Drop a file, it runs — no env-var dance.b00adf0/7ff9bca/457193d— full live transport host (Slack Socket Mode + AgentMail listeners, durable outbox, ingest pipeline), council-gated, 74 tests green, passive by default.agentmailMCP added to my Claude config.
Everything is safe/passive until you flip the flags. I did not touch your other PCs' configs while you slept (unattended config edits could break your other CLIs — inventory only, below).
To go live — 2 minutes, only-you steps¶
1. Slack (the one real blocker)¶
The host talks to Slack over Socket Mode, which needs a bot token + app-level token — not the claude.ai Slack connector (that's for me/Claude, a different thing; it does not feed this standalone service).
- Create the app: api.slack.com → Create App → From manifest → paste
deployment/slack-app-manifest.yaml→ Install to workspace. - Copy the two tokens into one file (this is all I need):
// ~/.fleet-secrets/slack.json { "app_token": "xapp-…", "bot_token": "xoxb-…" }
2. AgentMail¶
- You said the key's around — if so, drop it in:
// ~/.fleet-secrets/agentmail.json { "api_key": "…" } - Also authorize the agentmail MCP for me once: interactive Claude →
/mcp→ authenticate agentmail (or it rides your claude.ai account).
3. Fill the allowlist + flip on¶
In FounderIntake.Host/appsettings.json (or an appsettings.Production.json): put the intake channel's stable ID in AllowedSlackChannelIds, and each requester's Slack user ID + email in Requesters. Then set Slack.Enabled: true, keep DryRun: true, run:
dotnet run --project FounderIntake.Host
Slack Socket Mode connected + [DRY-SEND slack] on a test message. When it looks right, flip DryRun: false for real replies. Full detail: go-live-checklist.md.
Ping me when you're up and I'll do steps 3 with you and run the synthetic checks.
Fleet MCP inventory (read-only)¶
greatroom Claude (this machine — authoritative, via claude mcp list):
| Connector | Status |
|---|---|
| claude.ai figma / Gmail / Google Drive / Google Calendar | ✔ connected |
| agentmail | ⚠ needs your 1-click authorize |
| Slack | not present in claude mcp list — if you enabled it on claude.ai it isn't showing on this CLI; worth re-checking claude.ai → Connectors |
| github, context7, atlassian-rovo, both councils, claude-mem, audio-loop, jdata/jdoc | ✔ connected |
| stitch, semgrep | ⚠ degraded (tools-fetch/health flaps — pre-existing, unrelated) |
Codex (greatroom): has agentmail (hosted URL). No Slack MCP in its config.
Peers (gaming / streaming / bedroom): SSH is up to all three, but claude mcp list didn't run over non-interactive SSH (claude not on that PATH). Run this on each to get its matrix — or ping me and I'll wire a PATH-correct dispatch:
claude mcp list
Key truth about "all keys on all CLIs": the connectors that matter (agentmail, Gmail, Drive, figma, Slack-as-connector) are OAuth grants, not files — they authorize once per CLI, per account and cannot be copied between Claude/Codex/Gemini/Grok or between PCs. The claude.ai connectors already follow your Claude login to every PC. So there's no "paste keys everywhere" step; it's a one-click authorize in each CLI that needs it. Static tokens (like the Slack bot token) can be dropped as files — and now the host reads them from ~/.fleet-secrets/.