Realtime

Upcoming, not deployed. Browser admission requires the current session, exactly one configured browser Origin, no Authorization header, and the WebSocket subprotocol assign.realtime.v1. Native mobile admission requires one native access-token Authorization bearer, no Origin or Cookie header, and the same subprotocol. The optional X-Assign-Workspace-ID header selects a current authorized Workspace for native Workspace scopes; omit it for Account-only scopes. No query parameters or URL credentials are accepted. IDE admission also accepts a developer OAuth bearer issued to assign-jetbrains or assign-vscode with assign:read. It forbids Origin, Cookie and URL credentials. The grant fixes the Workspace; an optional X-Assign-Workspace-ID must match it. IDE tokens admit only workspace, projects and task_comments scopes, never Account or Discuss scopes. CLI, MCP and personal API tokens do not admit application sockets. Every active subscription rechecks the exact access token, grant, client, scope and current membership; reconnect after expiry/revocation requires valid authentication and new baseline custody. This operation is a WebSocket upgrade, not a JSON GET. HTTP SDK methods do not implement the upgraded transport; use the application WebSocket owner. JSON control frames negotiate bounded subscriptions and independent applied ACKs. Account/security scopes omit workspace_id and carry no client-supplied User identity. Inbox and personal Project scopes require workspace_id. A visible application owner may send presence_renew with an applied Workspace subscription ID and cursor. It renews only that owner's eligible human Workspace lease; transport pongs do not renew presence. An applied Workspace owner may send presence_observe with that cursor and up to 256 distinct active human member User IDs. An empty list clears observation. Authorized snapshots carry an epoch, revision and complete selected online states; presence_unknown clears confidence on source, observer or authorization loss. Wake recovery requires a fresh snapshot. Ordinary Workspace subscriptions exclude private collection hints. The discuss scope uses a separate session-bound private sequence and content-free message identity hints; its cursor is not a Workspace journal position. Source health is separate from canonical applied state. See the public realtime guide for authentication, scope and recovery rules.

Upcoming, not deployed. Omitted scope captures ordinary Workspace routing custody. The account, account_security, inbox and personal_projects scopes accept only the scope query parameter and return content-free routing custody. The discuss scope returns private conversation sequence custody without message content or an atomic transcript snapshot. They do not establish an atomic domain snapshot. Account scopes work without a Workspace. All private cursors bind the current User and browser session or native access-token identity; Workspace-private cursors also bind current membership. Native mobile callers use a single bearer with no Origin or Cookie, and select a Workspace with X-Assign-Workspace-ID when the scope requires one. Projects and task_comments return a canonical page and its same-snapshot cursor. task_comments requires a canonical UUID resource_id and admits at most two items. Canonical private reads use X-Assign-Realtime-Baseline instead. IDE developer bearers (assign-jetbrains or assign-vscode) admit only omitted scope/workspace custody, projects and task_comments. Their grant fixes the Workspace; an optional Workspace header must match. They omit Origin and Cookie. Private Account and Discuss baselines are denied. Unknown or duplicate query parameters are rejected.