Implements the full solstone support experience per the approved CPO spec (cpo/specs/in-flight/solstone-support-agent.md): Portal client (portal.py): - Welcome-mat client with RSA-4096 keypair gen/persistence - DPoP proof creation per RFC 9449 - Self-signed access token (wm+jwt) with tos_hash, aud, cnf.jkt - TOS fetching, signing, and local caching - Auto re-consent on TOS changes (401 tos_changed) - Full API: signup, tickets, messages, articles, announcements CLI (call.py — sol call support): - register, search, article, create, list, show, reply, feedback, announcements, diagnose - KB-first flow on create: search KB → present matches → confirm - Auto-populated user_context via diagnostic collector - Consent gate: draft → review → approve → submit Support app (convey): - workspace.html with three sections: tickets, feedback, help - background.html polling for ticket updates + badge - routes.py API endpoints - events.py proactive error detection via callosum Support agent (muse/support.md): - Cogitate agent with consent-gated outbound - Journal content never included by default Diagnostic collector (diagnostics.py): - Version, OS, services, recent errors, config (secrets stripped) Triage + onboarding integration: - Triage hands off support scenarios with handoff to support agent - Onboarding introduces support agent after setup completes SKILL.md for coding agents (sol-support): - Documents all sol call support subcommands - Instructs agents to read local TOS and search KB first Privacy constraints (non-negotiable): - Nothing leaves without explicit user approval - User reviews everything before submission - Journal content never included by default - Anonymous mode strips installation identifiers - Fully toggleable (disabled = local help only) - portal_url configurable for self-hosters Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>