Update: what changed since submission
Spokes has kept moving since the initial submission. The live site at https://spokes.alainschlesser.com now runs the current build. Highlights:
A room can be a sequence. A goal like "dinner, then the new film" now decomposes into up to three steps. The room runs one step at a time. Committing an agreement settles that step and opens the next one, re-centred on the place just agreed.
Onboarding that an agent can walk through. Opening a room asks name → goal → plan, and only then which prepared region to run in (Berlin Mitte or San Francisco SoMa). Two new WebMCP tools, describe_regions and open_room, let an agent start a room from a stated goal. The surface is now 24 tools.
Invite links. A + beside the avatars mints a single-person link (also shown as a code). The first claim binds it to that device. Unused links expire after an hour, and a refusal never reveals who is already in the room.
WebMCP reliability. Candidate reads now page with real total / returned / remaining counts and a cursor, instead of silently clipping results. Passive reads, receipts and reconnect behaviour were fixed, with regression tests for concurrent retries and private-read isolation.
Security review and fixes. A second review found and fixed a cross-room confirmation leak, added an approval boundary so the built-in agent can only propose mutations (owner approves a single-use, five-minute code), added explicit proxy trust and bounded rate limits, hardened CSP and headers, tightened outbound DNS validation, and moved the app containers to non-root with resource limits. Findings and residual limits are documented in the repo.
More evidence, resumable pipeline. Overture Places and accessibility.cloud joined the evidence sources. Prepopulation for the demo regions is now checkpointed and resumable with request and cost caps. Compound requirements are preserved instead of flattened, and tentative results can be confirmed or ruled out in place.
Diagnostics. The { } drawer now shows a causal view of what happened: page, agent, tool, HTTP and socket events linked by request, revision or retry, with timings and tool outcomes.
Smaller things. 3D map pins with stable label anchors, a WebMCP readiness check on the landing page, refreshed screenshots, and a tighter mobile layout.
Test suite: 812 unit, 279 three-user API, and 62 Playwright browser tests (up from 364 total).
Log in or sign up for Devpost to join the conversation.