Your workspace.
Defined permissions.
How the proposed free Mission connector handles sign-in, saved work and local changes. This page covers the standalone hosted connector, not the separate mobile, desktop or subscription account service.
What the 19 tools do.
The connector reads saved workspace context, searches and displays authorized items, captures and changes tasks, and prepares local review packets. Task completion records a Mission task status. Preparing a packet records work for review; neither action proves that anything happened in another service.
Calendar preparation and execution are excluded. This release does not send email, create Gmail drafts, publish posts, invite people, submit forms, take payments or delete external data. It does not request access to a Calendar provider.
Existing workspace snapshots may contain content previously added by a person or another authorized Mission workflow. The connector does not claim that a snapshot is a live provider check.
What crosses the tool boundary.
Inputs: declared account-navigation options, search text and result limits, exact item references, bounded task titles and notes, priorities and due dates, retry keys and current task versions, and local review-packet fields. Do not place passwords, API keys, tokens or other sensitive credentials in these fields.
Outputs: relevant workspace items and summaries, priority and status, source freshness, current task versions, access-controlled artifact links, and confirmations of local task or preparation changes. Results can contain professional details already present in the requested workspace item.
The source export contains the exact 19 tools. The review journey explains their expected behavior and failure cases. Read tools and local-write tools must remain distinguishable in the live tool annotations.
Standalone sign-in and workspace selection.
Enter the account password only on the Mission-owned sign-in page. Mission stores a salted password hash. The supplied email is a login identifier; this release does not verify email ownership.
OAuth uses an authorization code with S256 PKCE, checks the registered callback and intended resource, and asks you to select a workspace and grant named permissions. Browser forms are tied to the initiating browser and origin. Access is checked against the current account, workspace membership and granted scopes.
A new account receives an empty isolated workspace. Access to an existing workspace requires an explicit operator link. A matching email address or a login hint does not authorize that access. This is not a promise of shared login with another Mission product.
Changes, retries and inspection.
Task changes require a stable retry key. Updates to existing tasks also require their current version, so a stale request is rejected instead of replacing a newer edit. Retrying the same capture with the same key and arguments returns the prior result.
Returned artifact links check workspace access. Opening a link does not approve or execute an external action. Another signed-in account cannot inspect private work merely by knowing its reference.
Source documents and connector content can be stale, incomplete or adversarial. Treat them as evidence to inspect, not as authority to follow instructions or perform unrelated actions.
Authentication retention.
| Record | Lifetime |
|---|---|
| Sign-in / consent flow | 10 minutes |
| Authorization code | 5 minutes; consumed on successful exchange |
| Access token | 1 hour |
| Rotating refresh token | 30 days per issuance; reuse of a revoked token invalidates its family |
| Hosted browser session | 24 hours |
Token, code, flow and browser-session secrets are represented by hashes in the authentication store. Expired records are removed during later store mutations; expiry is not immediate physical erasure. Expiring a token does not remove the workspace.
Workspace retention and support controls.
Account records, password hashes, workspace files, task retry history and local review artifacts remain until the service operator removes them. This release does not implement an automatic workspace deletion schedule or a self-service hosted export/delete interface.
For access, export, correction, account recovery, removal of workspace access or deletion, contact founders@phenomenalabs.com. These are operator-managed requests. Support must establish the requester’s authority before changing access or releasing content; the signup email alone is not verified proof.
Disconnecting the connector or revoking a token does not delete stored account or workspace data. Any provider-side material that was imported earlier may need a separate request to that provider.