Review feedback

Every review URL is a trusted Shiplet host. The artifact and any package widget run in sandboxed frames; the host owns reviewer identity, confirmation, and capability checks.

What feedback captures

• Comment, canonical status, replies, and mentions.
• Page URL, pathname, ticket number, and label.
• Screenshot metadata when the reviewer explicitly captures it.
• Viewport, coordinates, selected element, and trusted actor.

Custom workflow statuses and fields enter the canonical event envelope, so global Feedback, Inbox, audit, and MCP stay coherent. Human-attributed writes always require a trusted operation.

Review in the browser

1. Open the returned review URL and use the trusted control to add a contextual or general comment.
2. Reply, update status, mention an already-authorized collaborator, or watch the Shiplet from its detail page.
3. Use global Feedback for the review queue and Inbox for canonical notifications.

Watching subscribes the current account to future activity; stop watching from the Shiplet detail view. Marking an Inbox item read does not change feedback status. Denied mention, watch, notification, or presence requests never widen access.

Read through MCP

async () =>
  await codemode.request({
    method: "GET",
    path: "/api/projects/project_123/review-feedback",
    query: { status: "New" }
  });

Reply through MCP

async () =>
  await codemode.request({
    method: "POST",
    path: "/api/projects/project_123/review-feedback/review_123/replies",
    body: { comment: "Added a loading skeleton in the next build." }
  });

Update status through MCP

async () =>
  await codemode.request({
    method: "POST",
    path: "/api/projects/project_123/review-feedback/review_123/status",
    body: { status: "In Progress" }
  });

Callers still need the correct feedback scope and project access. Presence and live updates may be interrupted; persisted feedback remains canonical. If the live channel stops, reload the trusted review host; do not widen access or recreate an already-persisted event.

Next: open the app, leave one harmless review event, and confirm it appears in the global Feedback view. Then read MCP automation.