MSX ship log: auth, Teams, Marketing, and agent-safe APIs

May 20 was a product-hardening day for MSX. The work moved through the full agent path: auth became less brittle, Scout results became cleaner for public consumers, MSX Marketing moved closer to an honest managed Reddit Ads flow, Teams became usable, and the website got static and social polish.

This is a public summary of what GitHub, local Codex logs, production health checks, Cloudflare Pages, and PostHog showed after the deploys landed.

Agent auth and API trust

The agent entrypoint depends on a simple promise: give an agent the skill URL, let it follow the API, and keep the user in control of auth and billing. Today we fixed several parts of that contract.

Device auth now handles the browser side more reliably. Google success can create the dashboard session, success redirects are explicit, and the agent-facing contract is clearer about when to wait, when to poll, and when to stop.

We also cleaned up public investigation results. Runtime and model internals are no longer presented as product-facing result fields, and candidate provenance now uses research_steps. Agent_next_steps stays reserved for actual next actions.

#419, #420, #423, #424, #426: device auth and Google success flow fixes.

#422 and #429: recovery wording audit so agents get useful instructions instead of vague failure copy.

#425 and #445: hide internal runtime/model details from public investigation API responses.

#427 and #451: rename candidate agent_actions to research_steps and keep agent_next_steps for actions.

Marketing became more concrete

MSX Marketing is the newest product surface, so most of the risk is fake capability: showing a flow that looks complete before the backend can honestly support it. The May 20 work pushed the Reddit Ads path toward a real managed campaign loop.

The frontend now shows managed ad status and cleaner campaign copy. Campaign detail pages hydrate the important fields. The backend can return marketing reports and optimization recommendations, and managed Reddit campaigns can auto-submit after funding and final approval.

#405, #439, #441: managed ad order and execution status UI.

#447, #448, #450: Marketing setup, recovery, and overview copy cleanup.

#449 and #454: campaign detail field hydration.

#300 and #456: marketing reports and recommendation-only optimization.

#453 and #455: auto-submit MSX-managed Reddit campaigns after the approval path.

Teams, invites, and the app shell

Teams moved from a partial dashboard idea to something that can support shared work. The API contract now has the membership model, the UI has a team settings and switcher surface, the invite path is discoverable, and invite emails can be sent through Cloudflare.

The public website and authenticated app also split more cleanly. The landing page now renders static-first, authenticated routes use the app shell, the dashboard error state points to support, social previews are richer, and dark theme tokens were unified.

#415 and #418: Team sharing API contract and membership model.

#416 and #417: Team settings and switcher.

#459, #460, #461, #462, #463, #464: teammate invite flow, UI, and email delivery.

#428 and #432: static-first landing page.

#433 and #434: separate app shell from landing shell.

#444, #446, #457, #458, #465, #466: dashboard support state, social previews, and theme polish.

Telemetry and remaining work

PostHog showed 1,351 total events, 21 unique visitors, 49 sessions, and 8 prompt-copy events for the local May 20 workday window. The production API health check was OK, the database was OK, runtime was configured, and Stripe mode was live.

Codex local logs showed 276 user prompts across the active workday and 74 active thread IDs. Those numbers are local agent-work statistics, not product analytics, but they are useful for understanding how much execution happened behind the shipped PRs.

The backlog is still honest. Open backend work remains around sandbox end-to-end testing, spend caps, PostHog attribution, MCP parity, provider cost control, and the broader credit model. None of that changes what shipped today; it marks what still has to be proven before we make stronger customer promises.