SyncDeck presentation <-> host communication capabilities

[mrbdahlem]

Summary by CodeRabbit

• Documentation
  • Added a comprehensive plan for trusted presentation-host capabilities in SyncDeck.
  • Documented secure instructor-only roster access, session announcements, and structured report contributions.
  • Defined phased delivery milestones, validation requirements, privacy safeguards, and acceptance criteria.
  • Outlined proposed protocols for participant selection, session events, and report updates.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 65260e6b-7c47-4d31-866c-be7fa6b54884

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch syncdeck-presentation-host-capabilities

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

Adds a detailed implementation plan for introducing a trusted SyncDeck presentation-iframe ↔ host capability API, covering roster access, session events, and report contributions with phased delivery, validation, privacy/security boundaries, and testing/documentation requirements.

Changes:

• Introduces a phased roadmap (contract foundation → roster → session events → private delivery → report contributions → hardening).
• Specifies proposed request/response envelopes and capability shapes for roster, events, and report mutations.
• Documents server-authoritative ownership, persistence/limits, validation/testing expectations, and skill-doc maintenance requirements.

Comments suppressed due to low confidence (2)

.agent/plans/syncdeck-presentation-host-capabilities.md:470

• reportKey is constrained to “safe chars”, but the allowed character set isn’t defined. Please specify the exact allowed charset/regex so deck-side and server-side validation stays consistent.

  reportKey: string                 // 1–100 safe chars, unique within this parent session

.agent/plans/syncdeck-presentation-host-capabilities.md:475

• This input type includes studentScopeBlocks, but Phase 4 explicitly says per-student presentation blocks should be deferred pending privacy review. To keep the plan internally consistent, mark this field as reserved / rejected in v1 (or remove it from the v1 contract snippet).

  studentScopeBlocks?: GenericStudentReportBlock[]

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coderabbitai]

Actionable comments posted: 5

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.agent/plans/syncdeck-presentation-host-capabilities.md:
- Around line 294-313: Update the SyncDeckHostCapabilityRequest contract to
define an explicit idempotency key for participants.pickRandom, including its
scope and retention semantics, while preserving requestId as correlation-only;
alternatively, explicitly designate requestId as the mutation deduplication key
and document that contract wherever the request envelope is defined.
- Around line 469-476: Remove studentScopeBlocks from the v1
PresentationReportContributionInput contract and all corresponding deck input,
persistence, and report-rendering model definitions; keep the initial reporting
contract class-level using only GenericReportBlock data unless an explicit
approved capability/version gate already exists.
- Around line 404-420: Update PresentationEventInput so Phase 2 accepts only the
{ type: 'all' } audience for both announcement and emote events. Remove
participant audience support from the Phase 2 schema, or gate it behind the
Phase 3 capability so targeted delivery cannot occur before server-side audience
resolution and filtering are implemented.
- Around line 351-358: Clarify the random-selection ownership in the
presentation plan: non-shared UI may select locally from the snapshot, but any
shared or persisted winner must be chosen through server-authoritative,
idempotent participants.pickRandom. Update the surrounding guidance to remove
ambiguity and preserve retry consistency and the Phase 1 acceptance criteria.
- Around line 464-490: Define a dedicated ReportRemoveInput contract alongside
PresentationReportContributionInput, including the reportKey format and any
parent-session identification required by the protocol. Specify that repeated
removals of the same reportKey are idempotent, define validation failure
behavior without altering existing contributions, and document the success
response semantics for removing an existing or already-absent contribution
before implementation.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 6dab7b93-956a-49dc-80d8-61fce4c92655

📥 Commits

Reviewing files that changed from the base of the PR and between 528631a and 1ef1daf.

📒 Files selected for processing (1)

• .agent/plans/syncdeck-presentation-host-capabilities.md