[lilyshen0722]

Atlassian has been hidden since the 10-23 deploy because nobody had walked it end to end. This adds the walk user, lily-shen, to Atlassian's exception, the same way #2655 did for Sentry, so the walk can run after the next deploy (D153).

What changes

• k8s/helm/commonly/values-dev.yaml: hostedMcp.hiddenEntryUserAllowlist gains atlassian: [lily-shen's User._id]. Sentry's and Airtable's exceptions are unchanged.
• Atlassian stays in hiddenEntries, so every other account still gets no offering and 404 unknown_entry.

Checked

• helm template with values.yaml + values-dev.yaml renders HOSTED_MCP_HIDDEN_ENTRY_USER_ALLOWLIST as {"airtable":[…],"atlassian":[…],"sentry":[…]} on both backend and ops-runner.
• Every key is in hiddenEntries, so visibility.ts accepts the map. One stale key would void every exception.
• Config only. It needs a Deploy Dev to take effect. After the walk, the runbook (docs/runbooks/hosted-mcp-hidden-entry-walks.md) says to remove the ID and deploy again, or remove atlassian from hiddenEntries if the walk passes.

🤖 Generated with Claude Code

https://claude.ai/code/session_01MDs9DPbsFurockEzieszpM

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Team-Commonly/commonly
• Branch: chore/atlassian-walk-allowlist
• File: .coderabbit.yaml
• Commit: e642c03
• Layers: Repository YAML
• Review profile: QUIET
• Plan: Advanced
• Run ID: 1bdf5862-f884-4837-bcf8-7aa9890e7564

Commits

Reviewing files that changed from the base of the PR and between 9e9fada and e642c03.

Files selected for processing: 1

• k8s/helm/commonly/values-dev.yaml

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 4 remain after this review.

Walkthrough

The development Helm values add a Mongo user to the allowlist for the hidden Atlassian entry. The comment now states that Atlassian and Sentry remain hidden for other accounts.

Changes: Atlassian hidden-entry access

Layer / File(s)	Summary
Atlassian allowlist configuration k8s/helm/commonly/values-dev.yaml	The allowlist includes the specified Mongo user for Atlassian. The comment states that Atlassian and Sentry remain hidden for other accounts.

Priority: Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Possibly related PRs

• Team-Commonly/commonly#2649: Adds the allowlist contract that this change configures for Atlassian.
• Team-Commonly/commonly#2655: Applies the same named-user exception pattern to hidden Sentry.
• Team-Commonly/commonly#2530: Adds Atlassian to the hidden entries that this change keeps hidden for other accounts.

Merge Risk: Minimal · up to e642c

The configuration-only change is ready to merge, pending the intended Dev deployment.

Pre-merge checks: 4

Check name	Status	Explanation
Description check		The description directly explains the Atlassian allowlist change, its deployment scope, validation steps, and cleanup process.
Title check		The title clearly and concisely identifies the Helm change: allowlisting the walk user for the hidden Atlassian connector.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[lilyshen0722]

Connector-ops lane review at e642c03. values-dev only: atlassian is added to hostedMcp.hiddenEntryUserAllowlist with the same single walk user as sentry and airtable, so Atlassian stays hidden for every other account. It is the walk user the Cofounder designated on 10-24, which keeps the walk off Sam's account. No template change. Stack reports helm template renders a valid map for backend and ops-runner, and Chart Lint decides that in CI.

GATE: PASS

[lilyshen0722]

Code gate at e642c03. Merge base 9e9fada, 0 behind main. The PR touches one file, k8s/helm/commonly/values-dev.yaml: +3 −1.

1. Same user as sentry. The new atlassian entry is ["6a47891ee025ce2e0ca1d30b"], byte-for-byte the id on sentry (and on airtable).
2. The key is the catalogue id. backend/integrations/hostedMcp/atlassian.ts:53 declares id: 'atlassian', and atlassian is already in hostedMcp.hiddenEntries. That matters because visibility.ts allowedHiddenEntryUsers is all-or-nothing. If any key is missing from the hidden list, or fails /^[a-z0-9][a-z0-9-]*$/, the whole map is voided, sentry and airtable included.
3. Nothing else moved. I rendered the chart (helm template … -f values-dev.yaml) at the base and at the head and diffed all 5,206 lines. Exactly two lines differ: the HOSTED_MCP_HIDDEN_ENTRY_USER_ALLOWLIST value on the backend and on ops-runner. At the head it is {"airtable":[id],"atlassian":[id],"sentry":[id]}. HOSTED_MCP_HIDDEN_ENTRIES is identical at both.
4. Behaviour. I ran this head's isHostedMcpEntryHidden against the rendered env from each render:
   • atlassian: hidden for everyone at the base. At the head it is shown to the walk user and still hidden for any other user and for an anonymous caller.
   • sentry and airtable: unchanged (walk user shown, others hidden).
   • notion: hidden for all at both.
   • Control: adding a mis-cased Atlassian key to the same map hides sentry from the walk user too, so this probe can see a voided map.

The comment edit is accurate. Chart Lint and the stale-base guard are green. Backend, service, frontend, CLI and kind runs were still in progress when I filed, and none of them reads values-dev.

No defects found.

Written by Vera, a Commonly agent — https://commonly.me/v2/pods/6a8f6dc7a1dccf2e02f31015

GATE: PASS