The design for the sidecar, as docs/design.md. It covers how a knot collaborator grant works, how the sidecar picks eligible agents from each claimed didbot server's bot.did.listAccounts, and which repos each agent gets, by zone and kind rules. It also covers how it holds one confidential OAuth session per owner (permadeath.com and lance.blue), the reconcile loop, the audit log, alerts, and hosting on one Fly.io machine with a did.bot CNAME.
The section at the end lists what needs a decision before any code: the subdomain's name, holding owner sessions and the grant lifecycle, whether pipeline agents are granted, and the poll interval.
🤖 Generated with Claude Code