# Community sessions — updated October 2, 2026

Home brings together planned game nights, live product testing and market discussions.
An organizer with `manage_channels` chooses a voice room, agenda, local start time,
15–240 minute duration and an optional mission ID. Members can RSVP, copy a member
link, download a local calendar event and open the existing voice room. Opening
the room does not start the microphone or bypass the regular call access checks.

## Scope and permissions

- GET and POST require a valid Orb profile session. Writes reject foreign origins,
  use the existing community-tools rate limits and a 6 KB body limit.
- Reads join current community membership, bans, room visibility and channel-level
  connect permissions. A forwarded link is not an invitation or a grant of access.
- Creation requires current community membership, visible/connectable voice room,
  `manage_channels`, and no active timeout. Cancellation requires the current host
  or a current channel manager; a removed host cannot retain access.
- RSVP requires a current, visible/connectable voice room, no ban/timeout and a live,
  uncancelled event. The write changes only the authenticated person's RSVP.
- At most 20 upcoming events per community and 100 RSVPs per event. Counts exclude
  removed/banned members; RSVP is not proof of attendance or a reserved voice seat.
- A client-generated ID makes retries of the same create attempt idempotent.
  Reusing it does not edit an existing event. To change an agenda, cancel and create
  a replacement. There is no automatic posting to chat, signing or payment.

The board reads up to 40 upcoming accessible sessions and 100 accessible room
choices. Initially it shows six sessions, with a show-all control. A shared session
ID promotes the matching accessible card; unavailable IDs disclose nothing.
Visible Home refreshes one list every 30 seconds, pauses while hidden and refreshes
after writes. No per-card polls or new global presence endpoint were added.
Live room counts come from the already authorized application snapshot.

## Mission connection and privacy

Session schedules, agendas and RSVP rows are backend records, not blockchain
records or E2EE content. Details are available only to people with room access;
the server operator can read them. Calendar export is an explicit local download.
Forwarding the `.ics` file can disclose the agenda outside the community.

A related mission is an organizer-selected link, not a claim that the community
owns or sponsored the mission. The mission board resolves its ID against the
configured Monad testnet escrow. It shows sponsor, funding, criteria and terms
before any submission. Invalid IDs do not produce a funding/reward claim.
RSVP or joining voice does not submit work, approve it or mint reputation.

The separate mission contract records sponsor approval and reserves test ORB
credits. The participant explicitly withdraws those credits. Only approved work
incurs the existing 5% testnet mission fee; scheduling and RSVP have no fee.

The local mission panel now opens `/?view=home&planMission=<id>` for organizers.
This prefills an editable session draft but does not create it automatically.
Normal room permissions still control the available choices. A session's mission
link carries its session ID so participants can return from the mission panel.
Approved participants review and withdraw current credits within that panel,
then open a contract-bound independent receipt link. Withdrawal covers all current
credits, possibly including other missions or refunds, not only this event.

## Validation

`node scripts/test-orb-social.mjs` checks real route authentication, local SQLite
migrations, role and private-room access, blocked connect permission, RSVP
idempotency and cancellation. `node scripts/test-orb-social-ui.mjs` checks desktop
and 390 px mobile creation, RSVP, calendar, room navigation and cancellation.
The extended browser test covers mission-prefilled drafts and bidirectional
navigation. `test-missions-orb-ui.mjs` executes funding, submission, approval and
inline withdrawal on a local EVM, then verifies the payout in the static client
with Orb API blocked. Transport/Privy adapters are fixtures; these are not two
live Privy accounts or an independent security audit.