Reviewed announcement subscriptions

Announcement following has a dedicated lifecycle rather than an immediate webhook shortcut. Set capabilities.announcementSubscriptionAudit: true and list every eligible direct GUILD_TEXT destination by exact ID in scopes.announcementSubscriptionTargetChannelIds. Audit verifies the application and bot identities, target guild ownership, complete roles and overwrites, and effective target VIEW_CHANNEL plus MANAGE_WEBHOOKS. It reads the target's complete bounded webhook collection without reading messages.

list_announcement_subscriptions and discord://channels/{channelId}/announcement-subscriptions return a strict minimized projection after privately validating the complete target webhook collection. The result reports aggregate capacity and only exact Channel Follower IDs, normalized type, locally derived creation timestamp, and source guild and channel IDs when Discord still supplies both and local read scope permits both. Out-of-scope source IDs are explicitly redacted rather than widening the configured boundary. Complete target permission evidence and omitted fields remain explicit. Unrelated webhook identifiers, webhook names, credentials, execution URLs, avatars, creator and application metadata, webhook-embedded source names and icons, unknown raw fields, and message data are excluded.

Changes require capabilities.announcementSubscriptionChanges: true in addition to audit. New subscriptions also require every eligible direct GUILD_ANNOUNCEMENT source in scopes.announcementSubscriptionSourceChannelIds. Both dedicated allowlists must remain subsets of any configured read-channel scope. Source and target can belong to different allowlisted guilds; the plan makes that boundary explicit. Subscribe planning requires source VIEW_CHANNEL, target VIEW_CHANNEL plus MANAGE_WEBHOOKS, a complete non-full target inventory, and reliable in-scope source identity for every existing Channel Follower webhook. It rejects duplicates and returns an exact existing subscription as a record-free no-op.

For subscribe:

1. Call plan_announcement_subscription with action subscribe, exact source and target channel IDs, a bounded Discord audit-log reason, and a unique one-shot operation key.
2. Review the verified identities, exact source and target guilds and channels, complete permission evidence, aggregate capacity, exact Channel Follower subscriptions, privacy omissions, cross-guild warning when applicable, risks, operation-key hash, write requirement, and keyed digest that privately binds the complete inventory.
3. If the plan is already-current, call execute_announcement_subscription with identical inputs and the digest to obtain a verified no-op without confirmation, coordination, reservation, activity, or a Discord write.
4. Otherwise call the execute tool and approve the signed confirmation only if every exact field, risk, warning, operation-key hash, and digest remains intended.
5. Review the returned exact Channel Follower webhook ID, strict response match, fresh complete-inventory transition, activity ID, and outcome before any follow-up.

For unsubscribe:

1. Obtain the exact Channel Follower webhook ID from the dedicated target inventory, then call plan_announcement_subscription with action unsubscribe, that webhook ID, the exact target channel ID, a bounded audit-log reason, and a unique one-shot operation key.
2. Review the exact target and Channel Follower webhook, available source IDs, aggregate capacity, exact follower and complete permission evidence, restoration consequences, privacy omissions, operation-key hash, and keyed digest that privately binds the complete inventory.
3. Call the execute tool with identical inputs plus the digest and approve the signed confirmation.
4. Review exact absence and the complete non-target inventory verdict. Messages already delivered through the subscription remain untouched.

Unsubscription deliberately uses the exact target inventory and webhook ID, so it remains available when Discord withholds source identity after the connector loses access to the source or when local read policy redacts that identity. Either unknown identity blocks new subscription planning because duplicate absence can no longer be proven safely. Application and Incoming webhooks cannot be deleted through this workflow.

The process-keyed digest binds the normalized action, one-shot key hash, verified application and bot identities, exact source and target evidence when applicable, complete minimized target webhook inventory, permissions, privacy projection, risks, and warnings. The MCP adapter rebuilds the plan before approval, and the service rebuilds it immediately before mutation. Every actual write durably coordinates the target channel and its guild webhook collection, plus the source channel for subscribe or exact webhook for unsubscribe, before atomically reserving the key and appending pending content-free activity.

Subscribe sends one non-retried POST /channels/{sourceChannelId}/followers with only the exact target channel ID and reviewed audit reason, validates Discord's returned source channel and new webhook ID, and then proves that exact follower plus every prior webhook through a complete target readback. Unsubscribe sends one non-retried bot-authenticated exact-webhook DELETE and proves the target absent with every survivor unchanged. A valid transition with unrelated inventory drift reports completed-with-drift; malformed response evidence, missing or conflicting readback, transport ambiguity, rate limiting, server failure, or any otherwise indeterminate post-reservation state is uncertain and retains its claims for operator review. The connector never retries, guesses a duplicate, deletes by source, or compensates automatically. See Discord's follow announcement channel endpoint, webhook resource, and permission flags.

Canonical source: docs/reference.md