[JonasJesus42]

Why

• Grain stopped indexing on 2026-09-30. Grain retired its v1 API (/_/public-api/... → 410 gone: The v1 API has been retired). The grain MCP only spoke v1, so the webhook died and every tool (LIST_RECORDINGS, GET_RECORDING, GET_SUMMARY, GET_TRANSCRIPT) fails. grain_meeting_recordings has nothing after Sep 30.
• The shared Supabase (Deco-Ajuda) is wide open. With the public anon key one can read and write discord_connections / slack_connections (bot tokens, signing secrets, mesh tokens), trigger callback tokens, 241k Discord messages incl. DMs, and every Grain meeting summary. We're turning RLS on with no anon access; the MCPs must use the service-role key server-side.

What

grain

• Client on /_/public-api/v2 + Public-Api-Version: 2026-10-01; recordings via POST; plain dates accepted (normalized to ISO date-times).
• Hooks: v2 has one hook per type → ensures recording_added + recording_updated (with include: participants, ai_summary), drops stale ones.
• Webhook: v2 hooks are unsigned, so the body only says which recording changed — the row is always re-fetched from Grain by id. A forged POST can't write the index (tested: real id indexed with Grain's data, forged title ignored; fake id not indexed).
• GRAIN_API_KEY env fallback: onChange only runs when the connection is saved, so the in-memory client was lost on every restart and webhooks skipped enrichment.
• Tools keep their output contract (owners = recorders' emails, notes = ai_summary).
• scripts/backfill.ts on v2 with --since, full rows (participants, summary).

slack-mcp, discord-read, discord, registry, grain

• Read SUPABASE_SERVICE_ROLE_KEY ?? SUPABASE_ANON_KEY — deploy-compatible: nothing changes until the secret is set.

Rollout

1. Merge → deploy; set SUPABASE_SERVICE_ROLE_KEY (+ GRAIN_API_KEY on grain) via the control plane.
2. Enable RLS / revoke anon on the Deco-Ajuda tables.
3. Rotate the leaked secrets (Discord/Slack bot tokens, signing secret, mesh tokens, callback tokens).
4. Register the v2 hooks and backfill --since 2026-09-30.

Tested

Live against Grain v2: list (date filter, cursor), get (participants, owners, summary), transcript json/txt, template sections, hooks list. Webhook end-to-end on a local server writing to the real index.

🤖 Generated with Claude Code