Fireflies Contract-Safe CI

Overview

Build a Fireflies CI lane with static GraphQL validation, synthetic fixtures, secret scanning, webhook vectors, and narrowly gated live tests.

Prerequisites

• The target repository or integration path and the requested operator outcome.
• The Fireflies principal, team, environment, and data classification for the work.
• Current Fireflies documentation, credentials only when needed, and an accountable approver.

Current Contract

Most CI should be offline and deterministic. Live tests require an explicitly provisioned read-only test identity, selected metadata fields, strict budgets, and no production meeting data.

Authentication

For authenticated operations, inject FIREFLIES_API_KEY from an approved secret manager and send it only as Authorization: Bearer REDACTED_KEY to https://api.fireflies.ai/graphql. Never print, commit, place in a URL, forward to a browser, or include the key in evidence. Webhook signing secrets are separate credentials and must not be reused as API keys.

Instructions

1. Collect named GraphQL documents and validate syntax and variable declarations offline.
2. Test success, partial data, errors, nulls, pagination, and throttling with synthetic fixtures.
3. Verify Webhooks V2 HMAC vectors against raw bytes, malformed signatures, and duplicate events.
4. Add secret and sensitive-output assertions for logs and artifacts.
5. Gate optional live tests behind protected secrets and an explicit environment approval.
6. Limit live queries to approved metadata and one bounded request budget.
7. Publish test counts and safe failure metadata, never response bodies.

Tool Discipline

Use Read, Glob, and Grep to inspect code, configuration, tests, and evidence. Use Write/Edit only for approved implementation or documentation changes. Do not query Fireflies, retrieve meeting content, create an AskFred thread, upload media, change account state, replay an event, or deploy merely because this skill was invoked.

Approval Boundaries

Require approval before enabling live CI, adding a mutation test, storing a Fireflies key, or retaining any API response artifact.

Output

Return the exact operation or event surface, environment, authorization class, selected field groups, validation results, content-free metrics, decisions, and a concise pass/fail receipt. Keep secrets and meeting-derived content out of general output.

Validation

Before reporting success, rerun the smallest relevant deterministic check, compare actual state with the requested outcome and current contract, verify no secret or meeting-derived content entered logs or artifacts, and record unresolved uncertainty explicitly.

Error Handling

• No test key: skip the live la…

Fireflies Error Taxonomy and Recovery

Overview

Diagnose Fireflies transport, GraphQL, permission, plan, processing, and operation-limit failures without unsafe retries or data probing.

Prerequisites

• The target repository or integration path and the requested operator outcome.
• The Fireflies principal, team, environment, and data classification for the work.
• Current Fireflies documentation, credentials only when needed, and an accountable approver.

Current Contract

Separate HTTP failures from top-level GraphQL errors and domain state. Normalize auth_failed, object_not_found, invalid_args or invalid_arguments, require_elevated_privilege, require_ai_credits, too_many_requests, unsupported_platform, and processing-state nulls.

Authentication

For authenticated operations, inject FIREFLIES_API_KEY from an approved secret manager and send it only as Authorization: Bearer REDACTED_KEY to https://api.fireflies.ai/graphql. Never print, commit, place in a URL, forward to a browser, or include the key in evidence. Webhook signing secrets are separate credentials and must not be reused as API keys.

Instructions

1. Capture operation name, HTTP status, safe GraphQL error code, retryAfter, request ID, and timing.
2. Classify the failure before changing queries, permissions, or retry behavior.
3. For object_not_found, validate authorization and ID without enumeration.
4. For privilege or credit errors, stop and route to the accountable owner.
5. For throttling, honor retryAfter and the operation-specific limit.
6. Reproduce with synthetic variables or metadata-only selections.
7. Return a redacted diagnosis and the smallest safe next action.

Tool Discipline

Use Read, Glob, and Grep to inspect code, configuration, tests, and evidence. Use Write/Edit only for approved implementation or documentation changes. Do not query Fireflies, retrieve meeting content, create an AskFred thread, upload media, change account state, replay an event, or deploy merely because this skill was invoked.

Approval Boundaries

Require approval before changing roles, plans, keys, privacy, meeting access, or replaying a mutation. Preserve the failing state and present the exact proposed change before acting.

Output

Return the exact operation or event surface, environment, authorization class, selected field groups, validation results, content-free metrics, decisions, and a concise pass/fail receipt. Keep secrets and meeting-derived content out of general output.

Validation

Before reporting success, rerun the smallest relevant deterministic check, compare actual state with the requested outcome and current contract, verify no secret or meeting-derived content entered logs or artifacts, and record unresolved uncertainty explicitl…

Fireflies Transcript Retrieval Boundary

Overview

Treat a transcript as sensitive meeting data. Separate metadata, summary, sentences, analytics, media links, attendance, and sharing fields so callers receive only what their use case permits.

Prerequisites

• The target repository or integration path and the requested operator outcome.
• The Fireflies principal, team, environment, and data classification for the work.
• Current Fireflies documentation, credentials only when needed, and an accountable approver.

Current Contract

Use transcript(id: String!) for one record. Meeting ID and transcript ID refer to the same platform identity. Selected fields have different sensitivity and entitlement requirements; analytics requires an eligible plan, and is_live changes whether sentences are live captions or processed transcript data.

Authentication

For authenticated operations, inject FIREFLIES_API_KEY from an approved secret manager and send it only as Authorization: Bearer REDACTED_KEY to https://api.fireflies.ai/graphql. Never print, commit, place in a URL, forward to a browser, or include the key in evidence. Webhook signing secrets are separate credentials and must not be reused as API keys.

Instructions

1. Confirm the requesting principal may access the target transcript and state the business purpose.
2. Classify each requested field and remove participants, sentences, media URLs, or analytics unless necessary.
3. Send a named transcript query with the ID as a variable.
4. Reject object_not_found as either absence or inaccessible data without probing other IDs.
5. Validate the returned ID, processing status, nullability, and expected organizer or ownership metadata.
6. Route content through the approved redaction and retention boundary before downstream use.
7. Return a receipt with selected field groups and record count, never the meeting body.

Tool Discipline

Use Read, Glob, and Grep to inspect code, configuration, tests, and evidence. Use Write/Edit only for approved implementation or documentation changes. Do not query Fireflies, retrieve meeting content, create an AskFred thread, upload media, change account state, replay an event, or deploy merely because this skill was invoked.

Approval Boundaries

Require approval before retrieving sentences, raw_text, audio_url, video_url, participant identifiers, attendance, analytics, or externally shared access.

Output

Return the exact operation or event surface, environment, authorization class, selected field groups, validation results, content-free metrics, decisions, and a concise pass/fail receipt. Keep secrets and meeting-derived content out of general output.

Validation

Before reporting success, rerun the smallest relevant deterministic c…

Fireflies Search and AskFred Analysis

Overview

Keep deterministic transcript discovery separate from generative AskFred analysis. Search results identify candidate records; an AI answer is derived output and must retain meeting provenance.

Prerequisites

• The target repository or integration path and the requested operator outcome.
• The Fireflies principal, team, environment, and data classification for the work.
• Current Fireflies documentation, credentials only when needed, and an accountable approver.

Current Contract

transcripts supports keyword with scope TITLE, SENTENCES, or ALL, ISO-8601 fromDate/toDate, limit up to 50, skip pagination, mine, organizers, participants, and channel_id. title, organizer_email, and participant_email filters are deprecated. AskFred create/continue mutations consume AI credits.

Authentication

For authenticated operations, inject FIREFLIES_API_KEY from an approved secret manager and send it only as Authorization: Bearer REDACTED_KEY to https://api.fireflies.ai/graphql. Never print, commit, place in a URL, forward to a browser, or include the key in evidence. Webhook signing secrets are separate credentials and must not be reused as API keys.

Instructions

1. Define an authorized cohort, time range, keyword, scope, and maximum result count.
2. Use current non-deprecated filters and page with limit and skip while enforcing a hard cap.
3. Select only IDs and low-sensitivity metadata during discovery.
4. Obtain approval and an AI-credit budget before creating an AskFred thread.
5. Bind meeting IDs or reviewed filters, ask a narrow question, and preserve thread and source identifiers.
6. Label answers as derived, validate material claims against accessible transcript evidence, and handle follow-ups in the same thread only when appropriate.
7. Record request counts, AI-credit outcome, provenance, and retention disposition.

Tool Discipline

Use Read, Glob, and Grep to inspect code, configuration, tests, and evidence. Use Write/Edit only for approved implementation or documentation changes. Do not query Fireflies, retrieve meeting content, create an AskFred thread, upload media, change account state, replay an event, or deploy merely because this skill was invoked.

Approval Boundaries

Require approval before sentence-scope search, multi-meeting analysis, creating an AskFred thread, consuming AI credits, or retaining generated answers.

Output

Return the exact operation or event surface, environment, authorization class, selected field groups, validation results, content-free metrics, decisions, and a concise pass/fail receipt. Keep secrets and meeting-derived content out of general output.

Validation

Before reporting success, rerun the smallest relevant determini…

Fireflies Quota and AI-Credit Control

Overview

Control Fireflies request quotas, AskFred AI credits, recording volume, storage, and seat utilization without deleting transcripts or changing plans automatically.

Prerequisites

• The target repository or integration path and the requested operator outcome.
• The Fireflies principal, team, environment, and data classification for the work.
• Current Fireflies documentation, credentials only when needed, and an accountable approver.

Current Contract

Costs span subscription seats, recorded volume, storage or retention, API request budgets, and AskFred AI credits. API observations can inform decisions but do not authorize plan, recording, retention, role, or deletion changes.

Authentication

For authenticated operations, inject FIREFLIES_API_KEY from an approved secret manager and send it only as Authorization: Bearer REDACTED_KEY to https://api.fireflies.ai/graphql. Never print, commit, place in a URL, forward to a browser, or include the key in evidence. Webhook signing secrets are separate credentials and must not be reused as API keys.

Instructions

1. Define the billing period, team, approved metrics, and accountable owner.
2. Measure request counts by operation and AskFred success or require_ai_credits outcomes.
3. Use approved user metadata to identify candidate seat utilization without exposing meetings.
4. Separate unnecessary polling and oversized selections from legitimate workload.
5. Model savings from batching, event-driven processing, field minimization, and policy changes.
6. Present reversible recommendations with confidence and operational impact.
7. Track approved actions and validate savings without deleting records as a test.

Tool Discipline

Use Read, Glob, and Grep to inspect code, configuration, tests, and evidence. Use Write/Edit only for approved implementation or documentation changes. Do not query Fireflies, retrieve meeting content, create an AskFred thread, upload media, change account state, replay an event, or deploy merely because this skill was invoked.

Approval Boundaries

Require approval before plan or seat changes, recording-policy changes, retention changes, AskFred use, bulk export, or transcript deletion.

Output

Return the exact operation or event surface, environment, authorization class, selected field groups, validation results, content-free metrics, decisions, and a concise pass/fail receipt. Keep secrets and meeting-derived content out of general output.

Validation

Before reporting success, rerun the smallest relevant deterministic check, compare actual state with the requested outcome and current contract, verify no secret or meeting-derived content entered logs or artifacts, and record unresolved unce…

Fireflies Meeting Data Governance

Overview

Govern Fireflies transcripts, summaries, participant data, media links, AskFred output, exports, retention, redaction, and deletion propagation.

Prerequisites

• The target repository or integration path and the requested operator outcome.
• The Fireflies principal, team, environment, and data classification for the work.
• Current Fireflies documentation, credentials only when needed, and an accountable approver.

Current Contract

Classify metadata, participants, attendance, sentences, raw_text, summaries, analytics, audio/video URLs, sharing records, webhook payloads, and AskFred answers separately. API access does not override consent, purpose limitation, retention, legal hold, or downstream deletion obligations.

Authentication

For authenticated operations, inject FIREFLIES_API_KEY from an approved secret manager and send it only as Authorization: Bearer REDACTED_KEY to https://api.fireflies.ai/graphql. Never print, commit, place in a URL, forward to a browser, or include the key in evidence. Webhook signing secrets are separate credentials and must not be reused as API keys.

Instructions

1. Define the authorized purpose, cohort, fields, recipients, region, retention, and deletion owner.
2. Minimize GraphQL selections and avoid media URLs unless the workflow requires them.
3. Apply deterministic redaction before storage or model use and retain provenance.
4. Encrypt approved stores, separate tenants, and restrict search and export paths.
5. Track copies and derived outputs, including AskFred answers and downstream CRM records.
6. Process access or deletion requests through verified identities and legal-hold checks.
7. Verify deletion propagation and retain only a content-free compliance receipt.

Tool Discipline

Use Read, Glob, and Grep to inspect code, configuration, tests, and evidence. Use Write/Edit only for approved implementation or documentation changes. Do not query Fireflies, retrieve meeting content, create an AskFred thread, upload media, change account state, replay an event, or deploy merely because this skill was invoked.

Approval Boundaries

Require approval before export, long-term storage, model processing, external sharing, retention changes, media retrieval, or deleteTranscript.

Output

Return the exact operation or event surface, environment, authorization class, selected field groups, validation results, content-free metrics, decisions, and a concise pass/fail receipt. Keep secrets and meeting-derived content out of general output.

Validation

Before reporting success, rerun the smallest relevant deterministic check, compare actual state with the requested outcome and current contract, verify no secret or meeting-derived conten…

Fireflies Privacy-Safe Diagnostic Bundle

Overview

Assemble a content-free Fireflies diagnostic bundle covering identity, operation shape, limits, latency, processing state, and deployment configuration.

Prerequisites

• The target repository or integration path and the requested operator outcome.
• The Fireflies principal, team, environment, and data classification for the work.
• Current Fireflies documentation, credentials only when needed, and an accountable approver.

Current Contract

A support bundle should prove what happened without containing Authorization, query variables with identifiers, transcript text, summaries, participant data, media URLs, webhook bodies, or signing secrets.

Authentication

For authenticated operations, inject FIREFLIES_API_KEY from an approved secret manager and send it only as Authorization: Bearer REDACTED_KEY to https://api.fireflies.ai/graphql. Never print, commit, place in a URL, forward to a browser, or include the key in evidence. Webhook signing secrets are separate credentials and must not be reused as API keys.

Instructions

1. Record repository revision, runtime, dependency versions, environment name, and operation name.
2. Capture redacted request shape and selected field names, not variable values.
3. Include HTTP status, GraphQL codes, retryAfter, timing, and correlation identifiers.
4. Summarize identity role and entitlement without emails or tokens.
5. Include webhook signature pass/fail and event type without the raw body when relevant.
6. Scan the bundle for bearer tokens, secrets, meeting text, URLs, and personal data.
7. Encrypt and retain the bundle only through the approved support channel.

Tool Discipline

Use Read, Glob, and Grep to inspect code, configuration, tests, and evidence. Use Write/Edit only for approved implementation or documentation changes. Do not query Fireflies, retrieve meeting content, create an AskFred thread, upload media, change account state, replay an event, or deploy merely because this skill was invoked.

Approval Boundaries

Require approval before including any raw response, identifier, email, transcript excerpt, media URL, webhook payload, or production configuration.

Output

Return the exact operation or event surface, environment, authorization class, selected field groups, validation results, content-free metrics, decisions, and a concise pass/fail receipt. Keep secrets and meeting-derived content out of general output.

Validation

Before reporting success, rerun the smallest relevant deterministic check, compare actual state with the requested outcome and current contract, verify no secret or meeting-derived content entered logs or artifacts, and record unresolved uncertainty explicitly.

Error Handl…

Fireflies Deployment and Webhook Boundary

Overview

Deploy a Fireflies GraphQL worker or Webhooks V2 receiver with managed secrets, raw-body verification, bounded queues, and reversible rollout.

Prerequisites

• The target repository or integration path and the requested operator outcome.
• The Fireflies principal, team, environment, and data classification for the work.
• Current Fireflies documentation, credentials only when needed, and an accountable approver.

Current Contract

Outbound GraphQL needs a server-side bearer key. Inbound Webhooks V2 needs HTTPS, optional but strongly recommended signing-secret verification over the raw body, a 2xx response within 10 seconds, and durable asynchronous work after acknowledgement.

Authentication

For authenticated operations, inject FIREFLIES_API_KEY from an approved secret manager and send it only as Authorization: Bearer REDACTED_KEY to https://api.fireflies.ai/graphql. Never print, commit, place in a URL, forward to a browser, or include the key in evidence. Webhook signing secrets are separate credentials and must not be reused as API keys.

Instructions

1. Define the exact runtime, regions, data boundary, operations, events, and owners.
2. Provision separate API and webhook secrets through the platform secret manager.
3. Preserve raw request bytes until HMAC verification and parse only after success.
4. Acknowledge valid events within 10 seconds and enqueue idempotent downstream work.
5. Set timeouts, concurrency, quotas, dead-letter handling, and content-free logs.
6. Roll out to staging with synthetic events, then canary production traffic.
7. Verify disablement, secret rotation, queue drain, and rollback receipts.

Tool Discipline

Use Read, Glob, and Grep to inspect code, configuration, tests, and evidence. Use Write/Edit only for approved implementation or documentation changes. Do not query Fireflies, retrieve meeting content, create an AskFred thread, upload media, change account state, replay an event, or deploy merely because this skill was invoked.

Approval Boundaries

Require approval before production deployment, DNS or webhook endpoint changes, secret rotation, event subscription changes, or replaying dead-lettered content.

Output

Return the exact operation or event surface, environment, authorization class, selected field groups, validation results, content-free metrics, decisions, and a concise pass/fail receipt. Keep secrets and meeting-derived content out of general output.

Validation

Before reporting success, rerun the smallest relevant deterministic check, compare actual state with the requested outcome and current contract, verify no secret or meeting-derived content entered logs or artifacts, and record unresolved uncertaint…

Fireflies Team Access and Privileged Mutations

Overview

Govern Fireflies team roles, channels, privacy, sharing, and privileged mutations with current permission and rate-limit checks.

Prerequisites

• The target repository or integration path and the requested operator outcome.
• The Fireflies principal, team, environment, and data classification for the work.
• Current Fireflies documentation, credentials only when needed, and an accountable approver.

Current Contract

setUserRole accepts admin or user and requires admin authority while preserving at least one admin. Private channels are visible only to members. Privacy values include link, owner, participants, teammatesandparticipants, and teammates. Meeting owners or same-team admins control supported privacy, sharing, and channel mutations.

Authentication

For authenticated operations, inject FIREFLIES_API_KEY from an approved secret manager and send it only as Authorization: Bearer REDACTED_KEY to https://api.fireflies.ai/graphql. Never print, commit, place in a URL, forward to a browser, or include the key in evidence. Webhook signing secrets are separate credentials and must not be reused as API keys.

Instructions

1. Inventory the acting principal, target users or meetings, current roles, channels, privacy, and shares.
2. Separate read-only access review from mutation planning.
3. Validate least privilege, ownership, same-team constraints, and the remaining-admin invariant.
4. Preview exact role, privacy, share, revoke, or channel changes with affected identities through a restricted channel.
5. Obtain accountable approval and execute one bounded mutation batch.
6. For updateMeetingChannel, enforce 1–5 transcript IDs and its all-or-nothing behavior.
7. Re-query safe state, record a redacted receipt, and define rollback where the API supports it.

Tool Discipline

Use Read, Glob, and Grep to inspect code, configuration, tests, and evidence. Use Write/Edit only for approved implementation or documentation changes. Do not query Fireflies, retrieve meeting content, create an AskFred thread, upload media, change account state, replay an event, or deploy merely because this skill was invoked.

Approval Boundaries

Require approval before every role, channel, privacy, sharing, or revocation mutation; public-link privacy requires explicit data-owner approval.

Output

Return the exact operation or event surface, environment, authorization class, selected field groups, validation results, content-free metrics, decisions, and a concise pass/fail receipt. Keep secrets and meeting-derived content out of general output.

Validation

Before reporting success, rerun the smallest relevant deterministic check, compare actual state with the requested outcome…

Fireflies First Metadata Query

Overview

Prove the GraphQL transport with low-sensitivity metadata. Do not use a real meeting transcript as a quick-start fixture or log user email addresses merely to show that the request worked.

Prerequisites

• The target repository or integration path and the requested operator outcome.
• The Fireflies principal, team, environment, and data classification for the work.
• Current Fireflies documentation, credentials only when needed, and an accountable approver.

Current Contract

The public API is GraphQL over POST. A minimal user or users selection is the documented quickstart; clients must examine the top-level errors array even when the HTTP response is 200 and request only fields necessary for the smoke test.

Authentication

For authenticated operations, inject FIREFLIES_API_KEY from an approved secret manager and send it only as Authorization: Bearer REDACTED_KEY to https://api.fireflies.ai/graphql. Never print, commit, place in a URL, forward to a browser, or include the key in evidence. Webhook signing secrets are separate credentials and must not be reused as API keys.

Instructions

1. Confirm the API key owner and test environment are authorized for the request.
2. Choose the user query and select only an opaque identifier or other approved metadata.
3. Send one POST request with JSON query and variables from a server-side client.
4. Assert HTTP success, absence of GraphQL errors, presence of data, and the expected response shape.
5. Log only timing, operation name, correlation ID, and pass/fail status.
6. Exercise a synthetic failure without exposing the bearer key.
7. Keep the smoke test only if its data access and request budget are acceptable.

Tool Discipline

Use Read, Glob, and Grep to inspect code, configuration, tests, and evidence. Use Write/Edit only for approved implementation or documentation changes. Do not query Fireflies, retrieve meeting content, create an AskFred thread, upload media, change account state, replay an event, or deploy merely because this skill was invoked.

Approval Boundaries

Require approval before selecting emails, integrations, transcripts, sentences, summaries, audio URLs, or any other meeting-derived field.

Output

Return the exact operation or event surface, environment, authorization class, selected field groups, validation results, content-free metrics, decisions, and a concise pass/fail receipt. Keep secrets and meeting-derived content out of general output.

Validation

Before reporting success, rerun the smallest relevant deterministic check, compare actual state with the requested outcome and current contract, verify no secret or meeting-derived content entered logs or artifacts, and record unresolved uncerta…

Fireflies Integration Incident Runbook

Overview

Triage Fireflies auth, privacy, webhook, quota, data exposure, processing, and privileged-mutation incidents with containment and evidence boundaries.

Prerequisites

• The target repository or integration path and the requested operator outcome.
• The Fireflies principal, team, environment, and data classification for the work.
• Current Fireflies documentation, credentials only when needed, and an accountable approver.

Current Contract

Classify incidents by confidentiality, integrity, availability, and destructive impact. Containment may mean disabling a consumer, revoking a key, pausing a queue, rejecting webhooks, or blocking mutations; preserve content-free evidence and coordinate destructive actions.

Authentication

For authenticated operations, inject FIREFLIES_API_KEY from an approved secret manager and send it only as Authorization: Bearer REDACTED_KEY to https://api.fireflies.ai/graphql. Never print, commit, place in a URL, forward to a browser, or include the key in evidence. Webhook signing secrets are separate credentials and must not be reused as API keys.

Instructions

1. Declare an owner, severity, affected environment, timeline, and known operation or event family.
2. Contain the smallest boundary: caller, key, webhook endpoint, queue, worker, or mutation feature.
3. Preserve redacted logs, request IDs, GraphQL codes, signature results, deployments, and configuration revisions.
4. Determine whether meeting data, bearer keys, signing secrets, roles, privacy, shares, channels, or deletions were affected.
5. Rotate secrets or disable access only through the accountable owner and record the action.
6. Recover with synthetic or metadata-only probes and bounded traffic.
7. Document root cause, affected records through an approved channel, corrective actions, and follow-up tests.

Tool Discipline

Use Read, Glob, and Grep to inspect code, configuration, tests, and evidence. Use Write/Edit only for approved implementation or documentation changes. Do not query Fireflies, retrieve meeting content, create an AskFred thread, upload media, change account state, replay an event, or deploy merely because this skill was invoked.

Approval Boundaries

Require approval before revoking production access, replaying events, restoring data, changing privacy or roles, notifying external parties, or deleting evidence.

Output

Return the exact operation or event surface, environment, authorization class, selected field groups, validation results, content-free metrics, decisions, and a concise pass/fail receipt. Keep secrets and meeting-derived content out of general output.

Validation

Before reporting success, rerun the smallest relevant deterministic chec…

Fireflies API Identity and Access Setup

Overview

Create an auditable identity boundary before any transcript query or mutation. A successful request proves only that the key is accepted; it does not grant permission to enumerate or export meeting content.

Prerequisites

• The target repository or integration path and the requested operator outcome.
• The Fireflies principal, team, environment, and data classification for the work.
• Current Fireflies documentation, credentials only when needed, and an accountable approver.

Current Contract

Fireflies uses POST requests to https://api.fireflies.ai/graphql with Content-Type application/json and Authorization: Bearer <API key>. Obtain the key from the Fireflies Integrations page, keep it server-side, and use the smallest identity query needed to confirm the principal and team context.

Authentication

For authenticated operations, inject FIREFLIES_API_KEY from an approved secret manager and send it only as Authorization: Bearer REDACTED_KEY to https://api.fireflies.ai/graphql. Never print, commit, place in a URL, forward to a browser, or include the key in evidence. Webhook signing secrets are separate credentials and must not be reused as API keys.

Instructions

1. Identify the owning Fireflies user or team, intended environment, and exact read or mutation capabilities.
2. Create or retrieve the API key through the Fireflies dashboard; never ask a user to paste it into chat.
3. Store the key in the approved secret manager and inject it as FIREFLIES_API_KEY only at runtime.
4. Send a minimal user query from a controlled server-side client and inspect both HTTP status and the GraphQL errors array.
5. Record the authenticated user ID, team context, key owner, storage location, and rotation owner without recording the key.
6. Test an invalid-key path and confirm logs redact Authorization and response data.
7. Document rotation and revocation steps before enabling production access.

Tool Discipline

Use Read, Glob, and Grep to inspect code, configuration, tests, and evidence. Use Write/Edit only for approved implementation or documentation changes. Do not query Fireflies, retrieve meeting content, create an AskFred thread, upload media, change account state, replay an event, or deploy merely because this skill was invoked.

Approval Boundaries

Require approval before creating, rotating, revoking, or broadening a production key, changing its owning account, or querying any real meeting record.

Output

Return the exact operation or event surface, environment, authorization class, selected field groups, validation results, content-free metrics, decisions, and a concise pass/fail receipt. Keep secrets and meeting-derived content out of general output.

Valid…

Fireflies Privacy-Safe Local Development

Overview

Make local work reproducible without copying real transcripts, participant lists, summaries, or bearer keys onto developer machines.

Prerequisites

• The target repository or integration path and the requested operator outcome.
• The Fireflies principal, team, environment, and data classification for the work.
• Current Fireflies documentation, credentials only when needed, and an accountable approver.

Current Contract

Model GraphQL responses as data plus optional errors, preserve nullability, and keep separate fixtures for success, partial data, validation failure, authorization failure, rate limiting, and delayed processing.

Authentication

For authenticated operations, inject FIREFLIES_API_KEY from an approved secret manager and send it only as Authorization: Bearer REDACTED_KEY to https://api.fireflies.ai/graphql. Never print, commit, place in a URL, forward to a browser, or include the key in evidence. Webhook signing secrets are separate credentials and must not be reused as API keys.

Instructions

1. Map the integration's operations and selected fields before creating fixtures.
2. Create synthetic meetings with invented IDs, speakers, sentences, summaries, and timestamps.
3. Record the exact GraphQL envelope shape, including errors and extensions where used.
4. Place the transport behind an injectable interface and route local tests to a deterministic mock server.
5. Add contract tests for null fields, pagination, partial data, and redaction.
6. Keep live tests opt-in, read-only, narrowly selected, and disabled without an explicit test key.
7. Document how fixtures are refreshed after a reviewed schema change.

Tool Discipline

Use Read, Glob, and Grep to inspect code, configuration, tests, and evidence. Use Write/Edit only for approved implementation or documentation changes. Do not query Fireflies, retrieve meeting content, create an AskFred thread, upload media, change account state, replay an event, or deploy merely because this skill was invoked.

Approval Boundaries

Require approval before recording a live response, connecting a local process to production, or storing any real meeting-derived content.

Output

Return the exact operation or event surface, environment, authorization class, selected field groups, validation results, content-free metrics, decisions, and a concise pass/fail receipt. Keep secrets and meeting-derived content out of general output.

Validation

Before reporting success, rerun the smallest relevant deterministic check, compare actual state with the requested outcome and current contract, verify no secret or meeting-derived content entered logs or artifacts, and record unresolved uncertainty explicitly.

Fireflies Governed Audio Ingestion

Overview

Migrate authorized recordings into Fireflies through current uploadAudio or addToLiveMeeting contracts with provenance, consent, limits, callbacks, and rollback planning.

Prerequisites

• The target repository or integration path and the requested operator outcome.
• The Fireflies principal, team, environment, and data classification for the work.
• Current Fireflies documentation, credentials only when needed, and an accountable approver.

Current Contract

uploadAudio accepts a publicly downloadable HTTPS media URL and documented mp3, mp4, wav, m4a, or ogg formats; current size limits differ for audio, free-tier video, and paid-tier video. addToLiveMeeting accepts supported meeting links and is limited to 3 requests per 20 minutes.

Authentication

For authenticated operations, inject FIREFLIES_API_KEY from an approved secret manager and send it only as Authorization: Bearer REDACTED_KEY to https://api.fireflies.ai/graphql. Never print, commit, place in a URL, forward to a browser, or include the key in evidence. Webhook signing secrets are separate credentials and must not be reused as API keys.

Instructions

1. Inventory source recordings, ownership, consent, format, size, retention, and destination team.
2. Reject preview links, expiring links that cannot survive ingestion, and unauthorized public exposure.
3. Choose uploadAudio for recordings or addToLiveMeeting for an approved supported live meeting.
4. Attach a non-sensitive client reference and approved callback only when needed.
5. Submit a small canary, record the returned status without logging the source URL, and wait for current webhook events.
6. Validate transcript identity, expected duration, processing status, and authorized metadata before scaling.
7. Batch within quotas, track provenance, remove temporary public access, and reconcile failures.

Tool Discipline

Use Read, Glob, and Grep to inspect code, configuration, tests, and evidence. Use Write/Edit only for approved implementation or documentation changes. Do not query Fireflies, retrieve meeting content, create an AskFred thread, upload media, change account state, replay an event, or deploy merely because this skill was invoked.

Approval Boundaries

Require approval before exposing a media URL, uploading real recordings, adding a bot to a live meeting, configuring callbacks, or scaling a batch.

Output

Return the exact operation or event surface, environment, authorization class, selected field groups, validation results, content-free metrics, decisions, and a concise pass/fail receipt. Keep secrets and meeting-derived content out of general output.

Validation

Before reporting success, rerun the smallest relevant deterministic c…

Fireflies Multi-Environment Isolation

Overview

Separate Fireflies development, staging, and production identities, webhook endpoints, secrets, quotas, fixtures, and observability. Prove isolation through configuration and failure-path evidence rather than environment names alone.

Prerequisites

• The target repository or integration path and the requested operator outcome.
• The Fireflies principal, team, environment, and data classification for the work.
• Current Fireflies documentation, credentials only when needed, and an accountable approver.

Current Contract

Each environment should have an explicit Fireflies principal, API key, webhook signing secret, endpoint, allowed operations, event subscriptions, data policy, quota, and owner. Configuration names are not isolation if credentials or queues are shared.

Authentication

For authenticated operations, inject FIREFLIES_API_KEY from an approved secret manager and send it only as Authorization: Bearer REDACTED_KEY to https://api.fireflies.ai/graphql. Never print, commit, place in a URL, forward to a browser, or include the key in evidence. Webhook signing secrets are separate credentials and must not be reused as API keys.

Instructions

1. Inventory every environment and its Fireflies user or team context.
2. Provision distinct bearer and signing secrets and prohibit production fallback.
3. Use environment-specific HTTPS webhook URLs, queues, stores, and dead letters.
4. Allow only synthetic data in development and reviewed test records in staging.
5. Validate configuration at startup without logging secret values.
6. Tag content-free metrics with environment and operation, never meeting identity.
7. Test rotation and rollback independently in each environment.

Tool Discipline

Use Read, Glob, and Grep to inspect code, configuration, tests, and evidence. Use Write/Edit only for approved implementation or documentation changes. Do not query Fireflies, retrieve meeting content, create an AskFred thread, upload media, change account state, replay an event, or deploy merely because this skill was invoked.

Approval Boundaries

Require approval before connecting non-production to production Fireflies data, sharing credentials, or changing a production webhook endpoint.

Output

Return the exact operation or event surface, environment, authorization class, selected field groups, validation results, content-free metrics, decisions, and a concise pass/fail receipt. Keep secrets and meeting-derived content out of general output.

Validation

Before reporting success, rerun the smallest relevant deterministic check, compare actual state with the requested outcome and current contract, verify no secret or meeting-derived content entered logs or artifacts, …

Fireflies Content-Free Observability

Overview

Instrument Fireflies GraphQL and webhook workflows with operation, latency, quota, queue, signature, and processing metrics that exclude meeting content and identities.

Prerequisites

• The target repository or integration path and the requested operator outcome.
• The Fireflies principal, team, environment, and data classification for the work.
• Current Fireflies documentation, credentials only when needed, and an accountable approver.

Current Contract

Observability may include operation name, result class, GraphQL code, duration, response size bucket, retryAfter, event type, signature result, queue depth, and processing latency. It must exclude Authorization, queries with variables, meeting IDs, emails, titles, sentences, summaries, and media URLs.

Authentication

For authenticated operations, inject FIREFLIES_API_KEY from an approved secret manager and send it only as Authorization: Bearer REDACTED_KEY to https://api.fireflies.ai/graphql. Never print, commit, place in a URL, forward to a browser, or include the key in evidence. Webhook signing secrets are separate credentials and must not be reused as API keys.

Instructions

1. Define service-level indicators for GraphQL success, webhook acknowledgement, queue processing, and freshness.
2. Instrument safe dimensions with a strict allowlist and cardinality budget.
3. Track plan and operation-specific throttles separately.
4. Measure transcribed-to-summarized and event-to-processing latency without meeting IDs in metrics.
5. Alert on auth failures, signature failures, throttle spikes, backlog, dead letters, and stale processing.
6. Keep detailed identifiers only in access-controlled audit records when approved.
7. Test telemetry redaction with synthetic secrets and meeting data.

Tool Discipline

Use Read, Glob, and Grep to inspect code, configuration, tests, and evidence. Use Write/Edit only for approved implementation or documentation changes. Do not query Fireflies, retrieve meeting content, create an AskFred thread, upload media, change account state, replay an event, or deploy merely because this skill was invoked.

Approval Boundaries

Require approval before logging identifiers or response fragments, increasing telemetry retention, or exporting observability data to a new vendor.

Output

Return the exact operation or event surface, environment, authorization class, selected field groups, validation results, content-free metrics, decisions, and a concise pass/fail receipt. Keep secrets and meeting-derived content out of general output.

Validation

Before reporting success, rerun the smallest relevant deterministic check, compare actual state with the requested outcome and current contract, ver…

Fireflies GraphQL Performance Tuning

Overview

Reduce Fireflies latency and quota use through field minimization, bounded pagination, caching of non-sensitive metadata, and asynchronous webhook-driven retrieval.

Prerequisites

• The target repository or integration path and the requested operator outcome.
• The Fireflies principal, team, environment, and data classification for the work.
• Current Fireflies documentation, credentials only when needed, and an accountable approver.

Current Contract

GraphQL performance starts with smaller field selections and fewer calls. transcripts pages at most 50 records; cache only approved metadata, never assume summaries or sentences are immutable while processing, and prefer Webhooks V2 over aggressive polling.

Authentication

For authenticated operations, inject FIREFLIES_API_KEY from an approved secret manager and send it only as Authorization: Bearer REDACTED_KEY to https://api.fireflies.ai/graphql. Never print, commit, place in a URL, forward to a browser, or include the key in evidence. Webhook signing secrets are separate credentials and must not be reused as API keys.

Instructions

1. Measure latency, response bytes, selected fields, pages, errors, and quota use by operation.
2. Remove unused nested fields and split metadata discovery from sensitive detail retrieval.
3. Set explicit result caps and page only while the caller still needs data.
4. Replace processing-status polling with meeting.transcribed or meeting.summarized events where appropriate.
5. Cache only classified metadata with tenant-aware keys and bounded TTLs.
6. Limit concurrency below the applicable plan and operation budgets.
7. Compare before/after metrics on synthetic or approved records and keep rollback settings.

Tool Discipline

Use Read, Glob, and Grep to inspect code, configuration, tests, and evidence. Use Write/Edit only for approved implementation or documentation changes. Do not query Fireflies, retrieve meeting content, create an AskFred thread, upload media, change account state, replay an event, or deploy merely because this skill was invoked.

Approval Boundaries

Require approval before caching meeting-derived data, increasing concurrency, widening selections, or using a broader transcript cohort.

Output

Return the exact operation or event surface, environment, authorization class, selected field groups, validation results, content-free metrics, decisions, and a concise pass/fail receipt. Keep secrets and meeting-derived content out of general output.

Validation

Before reporting success, rerun the smallest relevant deterministic check, compare actual state with the requested outcome and current contract, verify no secret or meeting-derived content entered logs or art…

Fireflies Production Readiness Gate

Overview

Run a fail-closed readiness review for a Fireflies integration covering identity, schema contracts, privacy, quotas, webhooks, observability, rollback, and ownership.

Prerequisites

• The target repository or integration path and the requested operator outcome.
• The Fireflies principal, team, environment, and data classification for the work.
• Current Fireflies documentation, credentials only when needed, and an accountable approver.

Current Contract

Readiness is evidence, not a successful demo. The release must prove its exact operations, selected fields, permission model, quotas, webhook behavior, failure modes, rollback, and retention controls against the current public contract.

Authentication

For authenticated operations, inject FIREFLIES_API_KEY from an approved secret manager and send it only as Authorization: Bearer REDACTED_KEY to https://api.fireflies.ai/graphql. Never print, commit, place in a URL, forward to a browser, or include the key in evidence. Webhook signing secrets are separate credentials and must not be reused as API keys.

Instructions

1. Pin the release revision and enumerate GraphQL operations and Webhooks V2 events.
2. Verify secret ownership, rotation, redaction, and environment isolation.
3. Review every selected field and derived output against classification and retention.
4. Exercise success, GraphQL error, timeout, throttling, null/processing, invalid signature, and duplicate webhook paths.
5. Confirm operation-specific budgets, queue limits, alerts, dashboards, and runbooks.
6. Test rollback or feature disablement without deleting source records.
7. Obtain accountable approvals and archive a content-free launch receipt.

Tool Discipline

Use Read, Glob, and Grep to inspect code, configuration, tests, and evidence. Use Write/Edit only for approved implementation or documentation changes. Do not query Fireflies, retrieve meeting content, create an AskFred thread, upload media, change account state, replay an event, or deploy merely because this skill was invoked.

Approval Boundaries

Require approval before production enablement, elevated roles, broad meeting access, destructive mutations, or accepting an untested rollback.

Output

Return the exact operation or event surface, environment, authorization class, selected field groups, validation results, content-free metrics, decisions, and a concise pass/fail receipt. Keep secrets and meeting-derived content out of general output.

Validation

Before reporting success, rerun the smallest relevant deterministic check, compare actual state with the requested outcome and current contract, verify no secret or meeting-derived content entered logs or artifacts, and record unr…

Fireflies Request Budget and Backoff

Overview

Enforce current Fireflies plan and operation-specific request limits with bounded concurrency, retryAfter handling, and cost-aware pagination.

Prerequisites

• The target repository or integration path and the requested operator outcome.
• The Fireflies principal, team, environment, and data classification for the work.
• Current Fireflies documentation, credentials only when needed, and an accountable approver.

Current Contract

General documented limits are 50 requests/day for Free and Pro and 60 requests/minute for Business and Enterprise. addToLiveMeeting is 3 requests per 20 minutes, shareMeeting is 10/hour, and deleteTranscript is 10/minute. Treat docs and retryAfter as authoritative over hard-coded assumptions.

Authentication

For authenticated operations, inject FIREFLIES_API_KEY from an approved secret manager and send it only as Authorization: Bearer REDACTED_KEY to https://api.fireflies.ai/graphql. Never print, commit, place in a URL, forward to a browser, or include the key in evidence. Webhook signing secrets are separate credentials and must not be reused as API keys.

Instructions

1. Identify the plan and every operation-specific bucket used by the workload.
2. Set a conservative request budget and concurrency of one until measured.
3. Use pagination caps and field minimization to avoid unnecessary calls.
4. On too_many_requests, honor retryAfter when supplied and add bounded jitter.
5. Do not retry auth, privilege, invalid-argument, object-not-found, or AI-credit errors.
6. Export per-operation usage, throttles, wait time, and exhausted-budget metrics.
7. Load-test only against synthetic or approved data within a separate budget.

Tool Discipline

Use Read, Glob, and Grep to inspect code, configuration, tests, and evidence. Use Write/Edit only for approved implementation or documentation changes. Do not query Fireflies, retrieve meeting content, create an AskFred thread, upload media, change account state, replay an event, or deploy merely because this skill was invoked.

Approval Boundaries

Require approval before increasing concurrency, consuming a large daily quota, load testing, or changing the subscribed plan.

Output

Return the exact operation or event surface, environment, authorization class, selected field groups, validation results, content-free metrics, decisions, and a concise pass/fail receipt. Keep secrets and meeting-derived content out of general output.

Validation

Before reporting success, rerun the smallest relevant deterministic check, compare actual state with the requested outcome and current contract, verify no secret or meeting-derived content entered logs or artifacts, and record unresolved uncertainty explicit…

Fireflies Governed Integration Architecture

Overview

Design a Fireflies architecture that separates identity, GraphQL reads, privileged mutations, Webhooks V2 intake, queues, sensitive data, and derived outputs.

Prerequisites

• The target repository or integration path and the requested operator outcome.
• The Fireflies principal, team, environment, and data classification for the work.
• Current Fireflies documentation, credentials only when needed, and an accountable approver.

Current Contract

Use separate trust boundaries for bearer-authenticated outbound GraphQL, signature-authenticated inbound events, durable orchestration, meeting-content storage, and derived destinations. An event carries an identity, not permission to fetch every field.

Authentication

For authenticated operations, inject FIREFLIES_API_KEY from an approved secret manager and send it only as Authorization: Bearer REDACTED_KEY to https://api.fireflies.ai/graphql. Never print, commit, place in a URL, forward to a browser, or include the key in evidence. Webhook signing secrets are separate credentials and must not be reused as API keys.

Instructions

1. Map actors, principals, environments, operations, event types, data classes, and sinks.
2. Keep API and signing secrets in separate managed stores and rotation paths.
3. Place static GraphQL documents behind a policy-aware service boundary.
4. Verify and acknowledge webhooks at the edge, then enqueue idempotent jobs.
5. Fetch only authorized fields and isolate raw, summarized, and derived data stores.
6. Add per-operation budgets, audit receipts, dead letters, deletion propagation, and rollback controls.
7. Threat-model cross-team access, replay, duplicate events, stale processing, and downstream leakage.

Tool Discipline

Use Read, Glob, and Grep to inspect code, configuration, tests, and evidence. Use Write/Edit only for approved implementation or documentation changes. Do not query Fireflies, retrieve meeting content, create an AskFred thread, upload media, change account state, replay an event, or deploy merely because this skill was invoked.

Approval Boundaries

Require approval before adding a new data sink, privileged mutation, team-wide event scope, long-term content store, or cross-tenant processing path.

Output

Return the exact operation or event surface, environment, authorization class, selected field groups, validation results, content-free metrics, decisions, and a concise pass/fail receipt. Keep secrets and meeting-derived content out of general output.

Validation

Before reporting success, rerun the smallest relevant deterministic check, compare actual state with the requested outcome and current contract, verify no secret or meeting-derived content entered…

Fireflies Typed GraphQL Client Patterns

Overview

Fireflies documents a GraphQL API, not a required first-party language SDK. Keep the transport standards-based and generate or hand-maintain types only from reviewed schema evidence.

Prerequisites

• The target repository or integration path and the requested operator outcome.
• The Fireflies principal, team, environment, and data classification for the work.
• Current Fireflies documentation, credentials only when needed, and an accountable approver.

Current Contract

Every call should carry an operation name, static document, typed variables, an explicit field selection, timeout, and response parser that handles both data and errors. Never interpolate values into GraphQL source or expose bearer keys to clients.

Authentication

For authenticated operations, inject FIREFLIES_API_KEY from an approved secret manager and send it only as Authorization: Bearer REDACTED_KEY to https://api.fireflies.ai/graphql. Never print, commit, place in a URL, forward to a browser, or include the key in evidence. Webhook signing secrets are separate credentials and must not be reused as API keys.

Instructions

1. Inventory operations and remove undocumented SDK method assumptions.
2. Choose a maintained GraphQL transport compatible with the repository rather than adding a redundant wrapper stack.
3. Define static documents and typed variables for each approved operation.
4. Centralize endpoint, bearer injection, timeouts, request IDs, redaction, and GraphQL error normalization.
5. Return domain-specific results that preserve nullability and partial-data semantics.
6. Inject the client into callers and provide a fixture transport for tests.
7. Pin dependencies and add schema-drift checks without enabling unrestricted introspection in production.

Tool Discipline

Use Read, Glob, and Grep to inspect code, configuration, tests, and evidence. Use Write/Edit only for approved implementation or documentation changes. Do not query Fireflies, retrieve meeting content, create an AskFred thread, upload media, change account state, replay an event, or deploy merely because this skill was invoked.

Approval Boundaries

Require approval before adding a new mutation, exposing a new selected field, enabling tenant-wide access, or replacing the repository's transport dependency.

Output

Return the exact operation or event surface, environment, authorization class, selected field groups, validation results, content-free metrics, decisions, and a concise pass/fail receipt. Keep secrets and meeting-derived content out of general output.

Validation

Before reporting success, rerun the smallest relevant deterministic check, compare actual state with the requested outcome and current co…

Fireflies Integration Security Baseline

Overview

Harden Fireflies bearer authentication, GraphQL selections, webhook signatures, logs, and privileged mutations against secret and meeting-data exposure.

Prerequisites

• The target repository or integration path and the requested operator outcome.
• The Fireflies principal, team, environment, and data classification for the work.
• Current Fireflies documentation, credentials only when needed, and an accountable approver.

Current Contract

Protect two independent secrets: the API bearer key for outbound GraphQL and the Webhooks V2 signing secret for inbound HMAC verification. Verify X-Hub-Signature over the raw body as sha256=HEX_DIGEST with a timing-safe comparison before parsing.

Authentication

For authenticated operations, inject FIREFLIES_API_KEY from an approved secret manager and send it only as Authorization: Bearer REDACTED_KEY to https://api.fireflies.ai/graphql. Never print, commit, place in a URL, forward to a browser, or include the key in evidence. Webhook signing secrets are separate credentials and must not be reused as API keys.

Instructions

1. Inventory API keys, webhook secrets, principals, environments, and data flows.
2. Keep bearer calls server-side and use separate secrets per environment.
3. Restrict GraphQL documents and selected fields to reviewed operations.
4. Verify webhook signatures on raw bytes, reject missing or malformed headers, then parse JSON.
5. Redact Authorization, signatures, meeting IDs, emails, text, summaries, and media URLs from logs.
6. Gate role, privacy, sharing, channel, upload, live-meeting, and deletion mutations.
7. Test key rotation, replay handling, redaction, and incident response.

Tool Discipline

Use Read, Glob, and Grep to inspect code, configuration, tests, and evidence. Use Write/Edit only for approved implementation or documentation changes. Do not query Fireflies, retrieve meeting content, create an AskFred thread, upload media, change account state, replay an event, or deploy merely because this skill was invoked.

Approval Boundaries

Require approval before any production key or signing-secret change, privacy/share mutation, role change, recording/upload, or transcript deletion.

Output

Return the exact operation or event surface, environment, authorization class, selected field groups, validation results, content-free metrics, decisions, and a concise pass/fail receipt. Keep secrets and meeting-derived content out of general output.

Validation

Before reporting success, rerun the smallest relevant deterministic check, compare actual state with the requested outcome and current contract, verify no secret or meeting-derived content entered logs or artifacts, and record unresolved unce…

Fireflies Schema and Contract Migration

Overview

Migrate Fireflies GraphQL documents and webhook consumers away from deprecated fields and legacy event shapes with dual-read evidence and rollback.

Prerequisites

• The target repository or integration path and the requested operator outcome.
• The Fireflies principal, team, environment, and data classification for the work.
• Current Fireflies documentation, credentials only when needed, and an accountable approver.

Current Contract

Current transcript-list filters replace title with keyword and replace organizer_email and participant_email with organizers and participants. Webhooks V2 uses event, timestamp, meeting_id, and granular meeting.transcribed or meeting.summarized events instead of the V1 eventType shape.

Authentication

For authenticated operations, inject FIREFLIES_API_KEY from an approved secret manager and send it only as Authorization: Bearer REDACTED_KEY to https://api.fireflies.ai/graphql. Never print, commit, place in a URL, forward to a browser, or include the key in evidence. Webhook signing secrets are separate credentials and must not be reused as API keys.

Instructions

1. Inventory static GraphQL documents, selected fields, response parsers, webhook payloads, and fixtures.
2. Map deprecated fields and V1 webhook assumptions to current documented contracts.
3. Add compatibility parsing only where a measured transition requires it.
4. Update synthetic fixtures and contract tests before production traffic.
5. Run shadow comparisons on authorized metadata and compare IDs, counts, nullability, and event sequencing.
6. Cut over one operation or event family at a time with rollback flags.
7. Remove compatibility code only after the observation window and owner sign-off.

Tool Discipline

Use Read, Glob, and Grep to inspect code, configuration, tests, and evidence. Use Write/Edit only for approved implementation or documentation changes. Do not query Fireflies, retrieve meeting content, create an AskFred thread, upload media, change account state, replay an event, or deploy merely because this skill was invoked.

Approval Boundaries

Require approval before enabling a new event subscription, widening transcript search, changing selected sensitive fields, or removing rollback compatibility.

Output

Return the exact operation or event surface, environment, authorization class, selected field groups, validation results, content-free metrics, decisions, and a concise pass/fail receipt. Keep secrets and meeting-derived content out of general output.

Validation

Before reporting success, rerun the smallest relevant deterministic check, compare actual state with the requested outcome and current contract, verify no secret or meeting-derive…

Fireflies Webhooks V2 Consumer

Overview

Implement a current Fireflies Webhooks V2 consumer with raw-body HMAC verification, event allowlisting, idempotency, ordering tolerance, and fast acknowledgement.

Prerequisites

• The target repository or integration path and the requested operator outcome.
• The Fireflies principal, team, environment, and data classification for the work.
• Current Fireflies documentation, credentials only when needed, and an accountable approver.

Current Contract

V2 payloads contain event, timestamp, meeting_id, and optional client_reference_id. Documented events include meeting.transcribed and meeting.summarized. X-Hub-Signature is sha256=<hex HMAC> over the raw body; valid deliveries need a 2xx response within 10 seconds.

Authentication

For authenticated operations, inject FIREFLIES_API_KEY from an approved secret manager and send it only as Authorization: Bearer REDACTED_KEY to https://api.fireflies.ai/graphql. Never print, commit, place in a URL, forward to a browser, or include the key in evidence. Webhook signing secrets are separate credentials and must not be reused as API keys.

Instructions

1. Subscribe only to approved V2 event types at an HTTPS endpoint.
2. Capture raw bytes and validate the signature format and timing-safe HMAC before JSON parsing.
3. Validate event, timestamp, meeting_id, and optional client reference against a strict schema.
4. Reject unknown events or route them to a quarantined metadata-only lane.
5. Deduplicate using delivery metadata plus event and meeting identity, and tolerate summarized arriving after transcribed.
6. Acknowledge quickly, then fetch authorized data asynchronously if needed.
7. Record signature result, event type, latency, dedupe outcome, and job ID without payload content.

Tool Discipline

Use Read, Glob, and Grep to inspect code, configuration, tests, and evidence. Use Write/Edit only for approved implementation or documentation changes. Do not query Fireflies, retrieve meeting content, create an AskFred thread, upload media, change account state, replay an event, or deploy merely because this skill was invoked.

Approval Boundaries

Require approval before subscribing to team-wide events, fetching transcript content after an event, replaying a delivery, or retaining payloads.

Output

Return the exact operation or event surface, environment, authorization class, selected field groups, validation results, content-free metrics, decisions, and a concise pass/fail receipt. Keep secrets and meeting-derived content out of general output.

Validation

Before reporting success, rerun the smallest relevant deterministic check, compare actual state with the requested outcome and current contract, verify no secret or mee…