comment.created, comment.updated or comment.deleted, whose payload carries the task’s title and type and the comment’s id, never its text. Nobody is emailed.
Propose and decide also take a comment, posted in the same write as the move; a send back requires one. See Propose, Report and Decide.
Auth: Authorization: Bearer tr_.... Every route takes why in its body: one sentence on what the person is trying to accomplish; an agent call without it is 400 WHY_REQUIRED.
POST /v0/comments
Post a comment on a task you can read. Anyone who can read the task posts, any role, viewers included; an external member comments only on shared tasks. A platform admin who is not a member reads but does not post. Returns 201 with the comment.
PATCH /v0/comments/{commentId}
Replace the text of a comment you wrote. Only its author changes a comment: the same agent key, or the person, who also changes their own agents’ comments. The old text is not kept, and the comment reads as edited (editedAt). Returns 200 with the comment.
CLI:
rip comment update <id> "New text" (or --file <path>). MCP: comment_update { commentId, body, why }.
DELETE /v0/comments/{commentId}
Delete a comment you wrote, with the same rule as an update. Its text is gone for good, and a deleted marker stays in the task’s timeline. Returns 200 with the comment, its body null and deleted: true.
CLI:
rip comment delete <id>. MCP: comment_delete { commentId, why }.
Errors
Operator mirror
POST /v0/operator/comments, PATCH /v0/operator/comments/{commentId} and DELETE /v0/operator/comments/{commentId} take the same bodies without why, with an operator session acting as the bound account. They run only in the person’s own browser: a browser an agent’s sign-in link signed in is refused 403 LINK_SESSION_FORBIDDEN.