Publish

Publish

Stage 4 of 4 in the Rubicon coach programming pipeline:

sheet-read → programming-inference → preview → publish

Input: the exact same operation batch that was sent to programming_write_dry_run in preview, plus the confirmationToken that call returned. Output: the operations are actually written to Rubicon.

Before you call this

Do not run this skill unless:

1. The coach has seen the preview output and explicitly said to proceed (e.g. "publish it", "looks good, go ahead" — not just silence).
2. You still have the exact operation batch and confirmationToken from that specific preview run. If any time has passed, the coach asked for changes, or you're unsure the batch is identical, go back to programming-inference → preview and get a fresh token rather than reusing an old one.

What to do

1. Call the Coach MCP Surface tool programming_write_publish with:
   • the same operations array used in the matching programming_write_dry_run call, unmodified
   • the confirmationToken from that dry run
2. programming_write_publish requires the programming:admin OAuth scope. In practice this is satisfied because the coach's Rubicon account already holds the coach role — canPublishProgramming checks the authenticated user's role, not how the OAuth client itself was provisioned. Ordinary Codex OAuth dynamic client registration + the coach's own login + consent is sufficient. No special client provisioning or pre-approval step is needed beyond the coach authenticating as themselves.
3. Server-side safety gate: the server recomputes the expected token from the exact operation set + requester + track slug and rejects the publish if it doesn't match the supplied confirmationToken. This plugin does not implement or duplicate that check — it's an existing hard gate on the Rubicon side. If publish is rejected for a token mismatch, do not retry with a stale token; restart from programming-inference with the corrected operations and get a fresh preview.
4. Report the result back to the coach in plain terms: what was created vs. patched, and a link/reference to view it in Rubicon if the tool response includes one. If the call fails, surface the raw error — don't paraphrase it into something reassuring.

After publish

This is the end of the pipeline for this batch. If the coach has more rows to bring in (e.g. the next week, or the batch was split because of the 25-operation cap), start a fresh cycle at sheet-read or programming-inference as appropriate — don't chain another publish off this same token.