Skip to main content
Changeport is an independent NetSuite change-management product. Erstan connects to its MCP server; NetSuite certificates and private keys stay in Changeport.
Changeport is a limited pilot for Erstan Test Company on beta. It is unavailable in production and for other companies.

​
Pilot configuration

The changeport feature flag defaults to off. On the beta API (annexa-edge) and worker (annexa-edge-worker), set CHANGEPORT_PILOT_ACCOUNT_ID to the verified Erstan Test Company account ID and enable only that account’s changeport override. Both the deployment identity and exact account ID are checked by the server; global, plan, role or workspace overrides cannot enable another account or production. Leave the environment setting empty elsewhere. Disable the account override to stop new Changeport access. The same gate controls connector discovery, OAuth registration/callback/refresh, Agent tool access, Library discovery and installation, signed webhook admission and human review. The frontend uses the server-resolved flag and makes no review request when it is off. Existing access controls and review authority checks still apply.

​
Connect

  1. Open Connectors > Changeport > Connect in the intended Erstan workspace.
  2. Sign into Changeport, choose the Changeport account, and select the exact environments to share.
  3. Authorize read, capture and propose. The Erstan proposal connector does not request review or deployment privileges.
  4. Install Propose a NetSuite change through Changeport from the Library.
Erstan registers its public PKCE client automatically, persists the workspace client so other people’s refresh tokens keep working, stores each person’s grant separately, and discovers tools from the connected server. There is no pasted client ID or NetSuite key.

​
Propose and review

The skill finds the target, reads snapshot coverage, imports native artifacts, waits for a preview and requests review of its exact plan. It then gives you the Changeport evidence link. Approve and deploy in Changeport according to the environment’s protection rules. A proposal never deploys just because it was imported.

​
Signed events

A published Erstan Agent with a webhook trigger can receive Changeport events. Provision or rotate its webhook secret after the signed-ingress migration is deployed; old hooks have only a one-way secret hash and cannot verify HMAC until this step. Configure that same secret on the Changeport outbound endpoint and use the Agent’s exact generated hook URL. Changeport signs the timestamp and raw request body with HMAC-SHA256. Erstan rejects stale signatures, binds deduplication to the signed event ID, and records the accepted event in Activity before starting the configured Agent. Installing the connector does not send messages automatically.

​
Native review Tasks

The Changeport Review Coordinator and Changeport SAFE and OWASP Review are currently source-only draft templates pending the hosted pilot; they are not listed or installable from the Library. An operator can import their checked-in catalog/netsuite/agents/changeport-*/workflow.json graphs into a draft through the Agent Builder, inspect and validate them, and publish only the configured pilot revision through the normal Agent workflow. The named connector and proposal skill are listed independently. For the coordinator, configure its changeportReviewerUserId and changeportTeamId workflow variable defaults with exact Erstan IDs. Configure a consented fixed Run As person whose Changeport connector can read the intended environment. Do not reuse Changeport reviewer IDs as Erstan IDs. The static reviewer instead needs a fixed model and a dedicated identity with no account tools, skills or knowledge; Changeport requires explicit per-environment consent to the configured external review endpoint, provider and model before transmitting source. Copy the generated webhook URL and secret into a Changeport outbound endpoint subscribed to review.requested. The coordinator reads the exact current change, rejects stale revision/hash events, and creates a native human Task with no assigned Agent and no external-worker pickup. It marks the Task needs_review only after confirming its human reviewer. The Task description contains the change evidence and a Review in Changeport link bound to the requested revision and plan hash. Duplicate deliveries use the existing signed webhook execution identity and the Task tool’s stable per-run dedupe key. Native Task notifications use the recipient’s Erstan preferences and existing Slack/Teams connections. The coordinator does not send a duplicate chat message. Channel delivery still depends on those connections and preferences; a created Task alone is not evidence that Slack or Teams delivered a card. The native Task details card displays the exact revision and plan hash. Its Approve change and Reject change buttons require an explicit browser confirmation. The assigned human must connect their own Changeport account, be one of the requested Changeport reviewers, retain review authority and be someone other than the author. Completing the Erstan Task does not approve or deploy anything. A stale revision blocks the decision. Environments requiring review in the Changeport browser retain that rule and receive the exact browser link instead. Slack/Teams notifications open the native Task; they do not mint a decision from a chat reaction. Enable inline decisions by provisioning the same secret of at least 32 characters as CHANGEPORT_REVIEW_RECEIPT_SECRET in both Erstan and Changeport backends through their secret stores. This is a separate operator credential from the outbound webhook signing secret. Without it, reviewers use the browser handoff. Deploy the 20261014100000_changeport_review_receipts Erstan migration and Changeport’s signed receipt migration before enabling the feature. The backend creates an immutable Task binding from authenticated webhook execution evidence, not editable Task text. The browser route requires the Erstan user’s authenticated session and allowed origin, then rereads Task visibility, assignment, membership and the person’s live OAuth grant. It stores an exact human receipt before sending the signed callback with that person’s current OAuth token. Changeport rechecks the account, user, environment, current review permission, independent reviewer, revision and hash before atomically recording the decision. The proposal connector still has no review/deploy scope or decision tool. An unknown result offers Check existing decision, which reuses the persisted receipt; it cannot silently create a new decision. Receipts survive Task deletion. The template, authority checks, browser card and concurrent/replayed receipt handling have automated validation, including isolated Postgres transactions. A hosted two-person pilot and live Task notifications still need to be exercised after the backend/UI branches, migrations and secrets are deployed; no real messages were sent while authoring this package.