June 2, 2026

[cassidyjames]

We're having our Coop working group meeting at 1445 UTC!

Proposed agenda items

• Welcome, @calebmcquaid!
• v1 milestone burn down/priorities

[cassidyjames]

Thanks everyone for a productive call!

Notes

Attendees: @julietshen, @cassidyjames, @calebmcquaid, @ThatKoffe, @serendipty01, @juanmrad

FYI

• Welcome @calebmcquaid!!
• New Community team! Should we add Community team to the CODEOWNERS file?
• V1 Coop release date on June 9th, livestream on June 11th. Sign up here!

Adopters

• Kyodo:
  • NCMEC overhaul happening more often (having to go through every image in a NCMEC report takes a lot of time and slows down NCMEC work)
    • Improve NCMEC view/flow to handle image gallery #517
  • Difficult to find recent decisions on the Job view (all the way at the bottom of the page).
    • [OpenAI] Moderation api is missing image/media inputs #518
• Another adopter: interested in using Coop but needs video support in the Content Safety API
  • Add support for Content Safety API for video #635

Open issues/PRs

• Design (expanded/desired) integration tests #288: need code review!
  • Nice-to-haves for 1.0, not blockers
  • Prioritize open PRs
• Blockers:
  • [Kysely] Switch lint enforcement from Sequelize to Kysely and added transaction wrapper enforcement #436
  • [404]Add "Invalidate reports from a reporter" action for MRT #644
    • Need to merge [Permissions] Capability-based authz refactor. gate org secrets, deleteUser, and ReadMe JWT on MANAGE_ORG #528, then there’s a new permission for invalidation
      • Right now it’s tied to “edit manual review queue,” which is a broadly-scoped permission
      • Do we need a sense of inherited permissions?
      • As we get more granular/add new capabilities as permissions, there’s risk of breaking things; need to ensure we have migrations to inherent from more broad permissions
      • Permissions/capabilities for v1, custom roles later
      • Will there be an org-owner type role that can’t be removed? There’s an admin role which is assumed to be an owner; there’s a role to manage roles… but maybe not guarded
        • “Disgruntled admin” scenario; deletion of admin itself is not possible. Deleting users is a permission; once we ship custom roles (v1.1), you could make an “admin” like role that can’t delete other users.
• feat: add pnpm as package manager #224
  • Split out refactor: migrate CoreSignal to GQLSignal, remove redundant client type casts #666 for type changes
  • Don’t have to upgrade all packages in one go, either; focus on moving npm→pnpm as single step
  • For things that are lint warnings now that become errors when switching to upgrade of types, we can fix those first instead of all in one PR
• [280] Publish Docker Images #665 🎉
  • Runs 8 containers at the same time, seeds a new user with unique password each time
  • Where do we want to host the docker images? It’s set up for GitHub Container Registry (ghcr.io) right now. Another option is docker hub.
    • 👍🏻 to ghcr
  • Osprey’s published image is on ghcr as well
• Working on adding images to HMA bank when submitting a NCMEC report Add reported images to HMA bank #196
• Expose db-only org settings in UI #615
• feat: Add OIDC SSO #84
  • Push recent changes, should be mergeable after @ThisIsMissEm reviewed
• Playbook agent framework #659
  • @cassidyjames commented on PR, invited to discuss on the issue and in Discord; will follow up

Actions

• @cassidyjames to double check settings for Community team and CODEOWNERS permissions
• @cassidyjames add a GitHub UI protips section to community docs