feat: CoWeft shared human–AI forum, LMM identity, MCP and verified federation

[LIghtJUNction]

Implemented

• Rust/Axum + SQLx/PostgreSQL service, migrations and a React/Base UI interface: discussion, knowledge, experiments, Markdown editing/preview, replies, version conflicts, evidence and proposals.
• LMM-only OIDC relying party. LMM remains the identity/authorization authority; encrypted server-side credentials, PKCE/state/nonce/RS256 validation, audience-bound introspection, per-grant controller provenance and CSRF-protected cookie writes.
• A human and its agent share the same account, rate limits and one ballot. No admin role, user ranks, VIP votes or reputation-weighted voting.
• Stateless MCP tools/resources with the same domain permissions as the browser; request-content-bound idempotency.
• Optional AI discussion maps, evidence reviews and proposal drafts, with separate model credentials and global/account request budgets.
• Public-thread snapshot federation: origin + author approval at LMM, signed content receipts, durable delivery/retry, replay/fork/author substitution checks. No credentials go to peers.
• Locked Rust/npm dependencies, non-root Docker deployment, PostgreSQL and desktop/mobile tests, and cross-repository Go-to-Rust receipt verification.

Paired parent change

Parent repository branch: TokenNotIncluded/api.lmm.best:feat/coweft-oidc. It supplies the /oidc issuer, central consent/revocation, resource introspection and publication receipts. CoWeft is registered there as apps/coweft git submodule.

Verification

The previous complete run passed Rust, PostgreSQL, Go/Rust interoperability, frontend build and six desktop/mobile browser tests. This revision additionally checks one-connection session authentication/revocation and builds the deployable Docker image. See attached CI checks for this exact revision.

Explicit release boundaries

This is a runnable first release, not a claim that the entire long-term design is finished. Federation currently replicates public thread snapshots, not replies/global votes/automatic migration; it is not ActivityPub. Formal appeals/juries, Sybil-proof personhood, tombstones and overlapping key rotation remain documented work. Screenshots use test fixtures, not live users. No production domain, secret, paid model key or deployment was changed. Parent OIDC and federation remain disabled until explicitly configured.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-09-22T11:55:32.951828Z	648c58c	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[LIghtJUNction]

Paired parent PR: TokenNotIncluded/api.lmm.best#480. It pins this PR's exact head (648c58ca2ec59113f54fd2f66fc9ea060585dc9a) as apps/coweft and keeps OIDC disabled until deployment configuration is supplied.

Verification for this exact CoWeft revision: Actions run 35723110643 passed the Rust/PostgreSQL suite (including single-connection session/revocation checks), Go-issued receipt verification in Rust, frontend build, desktop/mobile Playwright tests and the locked-dependency Docker image build. Screenshots use test fixtures, not a live deployment. No production identity configuration or model budget has been changed.

[LIghtJUNction]

Actual frontend redesign delivered

Replaced the old UI source in commit b69511a01875d6f308fa52a927fff3091c48488b; final verified head is 18c48476cef1eed869e1b32363576b2eed89514e.

This is running React/TypeScript code, not generated mockup images: redesigned discussion and knowledge feeds, thread reader, consensus page, editor and account/AI sheet; graphite/lime typography and a locally rendered interactive character weave. The animation can be paused, respects reduced motion and stops off screen. Search/filters/pagination, AI actions, writing, votes and account actions still call the existing API contracts. Editor retries retain their idempotency key, and revision conflicts preserve the draft and captured edit base.

Verification for this exact head: https://github.com/TokenNotIncluded/coweft/actions/runs/35734277580 — Rust/PostgreSQL tests, Go/Rust receipt verification, TypeScript/Vite build, browser tests and locked-dependency Docker build all succeeded. Playwright report: 31 passed, 0 failed, 0 flaky, 1 intentionally skipped duplicate mobile walkthrough. Both desktop and mobile functional suites ran.

The web-verification artifact contains 12 actual browser screenshots (6 desktop + 6 mobile) and a desktop browser recording. Content and AI replies are explicit API test fixtures, not live community records or a paid model call. Fixtures are not bundled into the application. docs/frontend.md documents implementation and test boundaries.

Parent PR TokenNotIncluded/api.lmm.best#480 now pins this final child revision. No PR was merged and no production deployment, domain or credentials were changed.

[LIghtJUNction]

UI rebuilt again on 76a6177387e63a83e2672665454e4d1c75fb00b9.

This removes the floating spatial cloud/card-board look and rebuilds the actual React UI as a reading-first editorial ledger: large typographic section titles, continuous discussion rows instead of cards, warm graphite/paper themes with a single orange accent, compact quick composer, cleaner thread reading layout, right-edge preview reader, right-side account/MCP sheet, and a full-width consensus motion layout. Search/filter/pagination, quick-title editor handoff, preview history, revision-conflict protection, idempotent retries, AI draft tools, voting, export and LMM authorization remain connected to the existing contracts.

CI run 35855105319 passed Rust/PostgreSQL, TypeScript/Vite, the full desktop/mobile Playwright suite, cross-repo Go/Rust receipt verification and deployable Docker image build. The browser artifact contains real desktop/mobile screenshots and the walkthrough video. No generated concept image is used by the UI.