Retries & approvals

Every mutation includes a new UUID idempotency_key for each intentional action. Reuse the same UUID and exactly the same arguments for retries. The unique key is scoped to connection + tool. Changing arguments for the same key returns idempotency_conflict. A new connection is a new idempotency namespace: reconcile previous content before repeating an action after reconnection.

Publishing, scheduling, deleting, approving a carousel, and running/changing/enabling/disabling automations require a separate browser review. The page displays the immutable request, owned resource labels and destinations. Requests expire after 30 minutes. An approved action executes once under its saved effective scopes, rechecking current grant and membership. A second approval cannot run it twice.

Creating a generation automation saves a draft; it does not start publishing. An active automation can affect future posts, so updates also require review. Creating draft posts, product analysis or credit-consuming carousel generation uses the user's approved OAuth scopes directly; those scopes should be granted only to agents the user trusts.

The scheduled caroush:mcp-maintain command runs every five minutes. It expires approvals, redispatches operations stranded before execution for more than ten minutes, and marks overdue running operations as unknown. Execution claims are atomic; duplicate queue delivery cannot start the same handler twice. Recovery never blindly replays a handler already marked running or finished.