@cohortapp/agent-sdk 2.3.0

package/lib/org/tool-surface.mjs

@@ -0,0 +1,2535 @@
+/**
+ * lib/org/tool-surface.mjs — the curated Cohort org tool table (single SoT).
+ *
+ * ONE table consumed by BOTH exposure planes so they cannot drift:
+ *   - the MCP server (`lib/mcp/server.mjs`, bin `cohort-mcp`) — tools/list +
+ *     tools/call for interactive Claude sessions;
+ *   - the native function-call path (`lib/tool-definitions.js` category 7 +
+ *     `lib/action-executor.js` executor routing).
+ *
+ * 28 curated tools + 5 email tools + 5 artifact tools + 69 agent-desk tools
+ * (mail app / files / calendar / crm / books / meetings.recapFile / directory /
+ * design / call working sessions — the additive families register only when
+ * the vendored protocol carries them — see emailFamilyAvailable /
+ * artifactFamilyAvailable / deskFamilyAvailable) — NOT a 406-method
+ * one-to-one mirror. The long tail
+ * stays reachable through
+ * the `org_rpc` / `org_read` escape hatches, which validate against the frozen
+ * protocol table before any network I/O and are deliberately `access:"admin"`.
+ *
+ * Governance parity (spec §1.5):
+ *   - Tools that emit human-visible outbound content carry `outbound: true`
+ *     (exactly messaging_send + email_send + email_draft_send +
+ *     org_call_share_step — the verbs whose params CARRY free text a human
+ *     will read: the share-step highlight notes / typed text render on every
+ *     call participant's stage tile). `executeOrgTool`
+ *     screens them through lib/comms/send-gate.screenOutbound BEFORE dispatch
+ *     in BOTH planes. Desk verbs that trigger server-TEMPLATED sends
+ *     (books.invoiceSend / statementRun, calendar invite emails) are NOT
+ *     outbound-flagged: their params carry no free text to screen, and hq's
+ *     server-side governance (holds, chase ladders, honest emailQueued/
+ *     emailSkipped payloads) owns those sends.
+ *   - `OUTBOUND_METHODS` is DERIVED from the table (never hand-listed), and an
+ *     `org_rpc` invocation whose method is in that set is screened the same way
+ *     — the escape hatch is not an unscreened outbound lane.
+ *   - Audit rows are written by the CALLERS (native: executeAction's
+ *     appendActionAudit; MCP: the tools/call dispatcher) — one row shape, both
+ *     planes, no double-logging here.
+ *
+ * Fail-open like the whole org client: executeOrgTool NEVER throws — transport
+ * faults, unknown tools, and missing credentials all come back as the standard
+ * `{ok:false, error:{code,message}}` frame.
+ *
+ * Node builtins only. ESM.
+ *
+ * @module lib/org/tool-surface
+ */
+
+"use strict";
+
+import { randomUUID } from "node:crypto";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import {
+  PROTOCOL_VERSION,
+  FAMILIES,
+  METHODS,
+  READS,
+  methodDef,
+  okFrame,
+  errFrame,
+} from "./protocol.mjs";
+import {
+  loadOrgConfig,
+  configFromAgent,
+  call,
+  read,
+  approvalWait,
+  fetchSelfProfile,
+} from "./client.mjs";
+
+/** Default org server origin when neither env nor config names one. */
+export const DEFAULT_COHORT_BASE = "https://os.cohortapp.com";
+
+/** Long-poll budget for approval_wait (server clamps to ≤55s; hq precedent). */
+const APPROVAL_WAIT_BUDGET_MS = 55_000;
+
+// ---------------------------------------------------------------------------
+// Config resolution (spec §1.4 — env-first, config-fallback)
+// ---------------------------------------------------------------------------
+
+/**
+ * Resolve the org client config for a tool invocation. Reuses the EXISTING
+ * `configFromAgent` chain (token: config → COHORT_API_TOKEN → COHORT_TOKEN →
+ * COHORT_API_KEY; org: config → COHORT_ORG_ID) and adds the base resolution
+ * the MCP boot documents: COHORT_BASE → COHORT_API_URL → config base →
+ * https://os.cohortapp.com. Fail-open: never throws; missing fields are "".
+ *
+ * @param {object} [o] - { agentRoot?, orgConfig?, env? }
+ * @returns {{base:string, orgId:string, token:string, agentRoot:string}}
+ */
+export function resolveOrgToolConfig(o = {}) {
+  const env = o.env || process.env;
+  const agentRoot =
+    o.agentRoot || env.COHORT_AGENT_ROOT || env.AGENT_ROOT || process.cwd();
+  const cfg = o.orgConfig || loadOrgConfig(agentRoot);
+  const fromCfg = configFromAgent(cfg);
+  const base =
+    (env.COHORT_BASE && String(env.COHORT_BASE).replace(/\/+$/, "")) ||
+    (env.COHORT_API_URL && String(env.COHORT_API_URL).replace(/\/+$/, "")) ||
+    fromCfg.base ||
+    DEFAULT_COHORT_BASE;
+  return { base, orgId: fromCfg.orgId, token: fromCfg.token, agentRoot };
+}
+
+// ---------------------------------------------------------------------------
+// Email family gate
+// ---------------------------------------------------------------------------
+
+/**
+ * Is the additive `email` protocol family present in the VENDORED protocol?
+ * The five `email_*` tools register only when true — the moment the family
+ * lands via sync-protocol the tools appear with no further SDK edit.
+ * @returns {boolean}
+ */
+export function emailFamilyAvailable() {
+  return methodDef("email.send") != null;
+}
+
+// ---------------------------------------------------------------------------
+// Artifact family gate
+// ---------------------------------------------------------------------------
+
+/**
+ * Is the additive `artifact` protocol family (generative-UI artifact cards;
+ * GU program 2026-07) present in the VENDORED protocol? The five `artifact_*`
+ * tools register only when true — same additive-family pattern as email: the
+ * moment the family lands via sync-protocol the tools appear with no further
+ * SDK edit, and older vendored protocols degrade cleanly.
+ * @returns {boolean}
+ */
+export function artifactFamilyAvailable() {
+  return methodDef("artifact.act") != null;
+}
+
+/**
+ * Per-desk probe methods: a desk's tools register only when the VENDORED
+ * protocol carries that desk's family (2026-07 agent desks). "mail" probes
+ * email.draftSend — the Inbox-app surface is additive on the older email
+ * family, so a 2.0-vendored protocol (email.send only) keeps the five legacy
+ * email_* tools but not the mail-desk ones.
+ * @type {Readonly<Record<string,string>>}
+ */
+const DESK_PROBES = Object.freeze({
+  mail: "email.draftSend",
+  files: "files.list",
+  calendar: "calendar.list",
+  crm: "crm.listDeals",
+  books: "books.accounts",
+  meetings: "meetings.recapFile",
+  // 2026-07 Directory & Design. "design" probes branding.getFoundation rather
+  // than a branding.* method that already existed at 2.2.0 — the Brand Studio
+  // write surface has shipped since then, so probing an OLD branding method
+  // would light the design desk up on a protocol that lacks the read half.
+  directory: "directory.search",
+  design: "branding.getFoundation",
+  // 2026-08 call working sessions. "calls" probes calling.appShareStart, not a
+  // calling.* method that already existed at 2.2.0 — the base calling family
+  // (lifecycle/react/transcript) has been vendored since SP3, so probing an
+  // OLD calling method would light these tools up on a protocol that lacks
+  // the app-share surface.
+  calls: "calling.appShareStart",
+});
+
+/**
+ * Is a desk family present in the vendored protocol? Unknown desk → false
+ * (default-deny, same posture as the method table).
+ * @param {string} desk
+ * @returns {boolean}
+ */
+export function deskFamilyAvailable(desk) {
+  const probe = DESK_PROBES[String(desk || "")];
+  return probe ? methodDef(probe) != null : false;
+}
+
+// ---------------------------------------------------------------------------
+// The table
+// ---------------------------------------------------------------------------
+
+const S = (properties, required = []) => ({ type: "object", properties, required });
+const str = (description) => ({ type: "string", description });
+const num = (description) => ({ type: "number", description });
+const bool = (description) => ({ type: "boolean", description });
+const arr = (items, description) => ({ type: "array", items, description });
+
+/**
+ * The curated org tool table. Each entry:
+ *   { name, title, description, input_schema, access: "read"|"write"|"admin",
+ *     binding: {kind:"rpc",method} | {kind:"read",path} | {kind:"local"},
+ *     outbound?: true, email?: true }
+ *
+ * `input_schema` is Claude `tool_use`-shaped (type/properties/required), which
+ * the MCP server republishes verbatim as `inputSchema` — one schema, two planes.
+ * @type {Array<object>}
+ */
+export const ORG_TOOLS = Object.freeze([
+  // ── org spine ────────────────────────────────────────────────────────────
+  {
+    name: "org_whoami",
+    title: "Who am I",
+    description:
+      "This agent's own identity on the Cohort org: member profile (slug, displayName, role) " +
+      "resolved server-side via the org-data whoami lane, plus the client config summary " +
+      "{base, orgId, protocolVersion, tokenPresent}. Never returns the token. In a multi-agent " +
+      "org set COHORT_AGENT_ID (member id/slug) or COHORT_AGENT_EMAIL so resolution is exact; " +
+      "unresolvable identity degrades to the config summary with member: null (never an error).",
+    input_schema: S({}),
+    access: "read",
+    binding: { kind: "local" },
+  },
+  {
+    name: "org_directory",
+    title: "Org directory",
+    description: "The org roster: members + teams from the /v1 directory read.",
+    input_schema: S({}),
+    access: "read",
+    binding: { kind: "read", path: "directory" },
+  },
+  {
+    name: "org_snapshot",
+    title: "Org snapshot",
+    description: "The signed org state head (GET /v1/snapshot).",
+    input_schema: S({}),
+    access: "read",
+    binding: { kind: "read", path: "snapshot" },
+  },
+  {
+    name: "org_events_tail",
+    title: "Org event chain tail",
+    description:
+      "Read the org event chain (GET /v1/events). Messaging/email payloads are REDACTED " +
+      "on-chain — fetch bodies via messaging_history / email_message, never from here.",
+    input_schema: S({
+      cursor: num("Sequence to read from (exclusive). Default 0."),
+      limit: num("Max events to return (server caps at 500)."),
+    }),
+    access: "read",
+    binding: { kind: "read", path: "events" },
+  },
+  // ── messaging ────────────────────────────────────────────────────────────
+  {
+    name: "messaging_channels",
+    title: "List org channels",
+    description: "Org messaging channels visible to this agent, with membership.",
+    input_schema: S({}),
+    access: "read",
+    binding: { kind: "rpc", method: "messaging.channels" },
+  },
+  {
+    name: "messaging_history",
+    title: "Channel history",
+    description: "Message bodies for one org channel (messaging.history).",
+    input_schema: S(
+      {
+        channelId: str("Channel id."),
+        limit: num("Max messages (server default applies)."),
+        before: str("Paginate: only messages before this cursor/id."),
+      },
+      ["channelId"],
+    ),
+    access: "read",
+    binding: { kind: "rpc", method: "messaging.history" },
+  },
+  {
+    name: "messaging_send",
+    title: "Send org message",
+    description:
+      "Post a message into an org channel (messaging.send). Send-gate screened locally; " +
+      "the server enforces channel ACLs + pairing. A clientMsgId is auto-minted for dedup.",
+    input_schema: S(
+      {
+        channelId: str("Channel id (use messaging_open_dm for a member DM)."),
+        body: str("Message body."),
+        threadRootId: str("Reply under this thread root (optional)."),
+      },
+      ["channelId", "body"],
+    ),
+    access: "write",
+    outbound: true,
+    binding: { kind: "rpc", method: "messaging.send" },
+  },
+  {
+    name: "messaging_open_dm",
+    title: "Open a DM",
+    description:
+      "Resolve or create the DM channel with a member (channel.resolveOrCreateDm). " +
+      "Returns the channelId to feed messaging_send.",
+    input_schema: S({ memberId: str("The member to DM.") }, ["memberId"]),
+    access: "write",
+    binding: { kind: "rpc", method: "channel.resolveOrCreateDm" },
+  },
+  // ── board / tasks ────────────────────────────────────────────────────────
+  {
+    name: "board_ready",
+    title: "Claimable work",
+    description: "The board ready feed — work this agent can claim (GET /v1/board.ready).",
+    input_schema: S({}),
+    access: "read",
+    binding: { kind: "read", path: "board.ready" },
+  },
+  {
+    name: "board_claim",
+    title: "Claim work item",
+    description: "Claim a ready board item (board.claim). The server resolves races atomically.",
+    input_schema: S({ itemId: str("Board item id.") }, ["itemId"]),
+    access: "write",
+    binding: { kind: "rpc", method: "board.claim" },
+  },
+  {
+    name: "board_complete",
+    title: "Complete work item",
+    description: "Mark a claimed board item complete (board.complete).",
+    input_schema: S({ itemId: str("Board item id."), note: str("Completion note (optional).") }, ["itemId"]),
+    access: "write",
+    binding: { kind: "rpc", method: "board.complete" },
+  },
+  {
+    name: "task_create",
+    title: "Create task",
+    description: "Create a task on the org board (board.createTask).",
+    input_schema: S(
+      {
+        title: str("Task title."),
+        description: str("Task body/description (optional)."),
+        assignee: str("Member to assign (optional)."),
+        status: str("Initial status (optional)."),
+        priority: str("Priority (optional)."),
+        dueAt: str("Due date ISO 8601 (optional)."),
+      },
+      ["title"],
+    ),
+    access: "write",
+    binding: { kind: "rpc", method: "board.createTask" },
+  },
+  {
+    name: "task_update",
+    title: "Update task",
+    description:
+      "Update a task's status/fields, or move it into a workstream lane (board.updateTask). Pass workstreamName to assign a task that's sitting in no lane — reuses an existing lane by name or creates it.",
+    input_schema: S(
+      {
+        taskId: str("Task id."),
+        status: str("New status (optional)."),
+        title: str("New title (optional)."),
+        description: str("New description (optional)."),
+        assignee: str("New assignee (optional)."),
+        priority: str("New priority (optional)."),
+        dueAt: str("New due date ISO 8601 (optional)."),
+        workstreamName: str(
+          "Move the task into this workstream lane — reuses an existing lane by name or creates it (optional).",
+        ),
+      },
+      ["taskId"],
+    ),
+    access: "write",
+    binding: { kind: "rpc", method: "board.updateTask" },
+  },
+  {
+    name: "task_comment",
+    title: "Comment on task",
+    description: "Add a comment to a task (board.addTaskComment).",
+    input_schema: S({ taskId: str("Task id."), body: str("Comment body.") }, ["taskId", "body"]),
+    access: "write",
+    binding: { kind: "rpc", method: "board.addTaskComment" },
+  },
+  // ── decisions / approvals ────────────────────────────────────────────────
+  {
+    name: "decision_list",
+    title: "List decisions",
+    description: "The org decision registry (GET /v1/decision.list).",
+    input_schema: S({ status: str("Filter by status (optional).") }),
+    access: "read",
+    binding: { kind: "read", path: "decision.list" },
+  },
+  {
+    name: "decision_propose",
+    title: "Propose decision",
+    description: "Propose a decision into the org registry (decision.propose).",
+    input_schema: S(
+      {
+        title: str("Decision title."),
+        rationale: str("Why (optional)."),
+        scope: str("Scope (optional)."),
+      },
+      ["title"],
+    ),
+    access: "write",
+    binding: { kind: "rpc", method: "decision.propose" },
+  },
+  {
+    name: "decision_sign",
+    title: "Sign decision",
+    description: "Sign a proposed decision (decision.sign).",
+    input_schema: S({ decisionId: str("Decision id.") }, ["decisionId"]),
+    access: "write",
+    binding: { kind: "rpc", method: "decision.sign" },
+  },
+  {
+    name: "decision_comment",
+    title: "Comment on decision",
+    description: "Comment on a decision (decision.comment).",
+    input_schema: S({ decisionId: str("Decision id."), body: str("Comment body.") }, ["decisionId", "body"]),
+    access: "write",
+    binding: { kind: "rpc", method: "decision.comment" },
+  },
+  {
+    name: "approval_request",
+    title: "Request approval",
+    description:
+      "File an approval request (approval.request) for a gated action — e.g. the " +
+      "external_comms first-contact flow email_send returns. Requester ≠ approver is enforced server-side.",
+    input_schema: S(
+      {
+        actionClass: str("Action class, e.g. \"external_comms\"."),
+        payload: { type: "object", description: "The intent payload the approval binds (hash-bound server-side)." },
+        subject: str("Human-readable subject (optional)."),
+        payload_hash: str("Precomputed sha256 payload hash (optional — pass through from a structured approval_required result)."),
+      },
+      ["actionClass"],
+    ),
+    access: "write",
+    binding: { kind: "rpc", method: "approval.request" },
+  },
+  {
+    name: "approval_wait",
+    title: "Wait for approval",
+    description:
+      "Bounded long-poll (≤55s) for an approval outcome (GET /v1/approval.wait). " +
+      "Returns the current state either way; poll again while status is pending.",
+    input_schema: S({ approvalId: str("Approval id."), timeoutMs: num("Wait budget ms (clamped ≤55000).") }, ["approvalId"]),
+    access: "read",
+    binding: { kind: "local" }, // dispatched via approvalWait (long-poll budget)
+  },
+  // ── knowledge / memory ───────────────────────────────────────────────────
+  {
+    name: "knowledge_search",
+    title: "Search org knowledge",
+    description:
+      "Search the ACL'd shared org knowledge plane (knowledge.search). Every retrieval is " +
+      "audit-logged server-side; the server decides what this agent may see.",
+    input_schema: S({ query: str("Free-text query."), limit: num("Max hits (optional).") }, ["query"]),
+    access: "read",
+    binding: { kind: "rpc", method: "knowledge.search" },
+  },
+  {
+    name: "knowledge_append",
+    title: "Append org knowledge",
+    description: "Append a knowledge episode to the shared plane (knowledge.append).",
+    input_schema: S(
+      {
+        text: str("The fact/episode text."),
+        kind: str("Kind (optional)."),
+        group: str("Group hint (server enforces ACL; optional)."),
+      },
+      ["text"],
+    ),
+    access: "write",
+    binding: { kind: "rpc", method: "knowledge.append" },
+  },
+  {
+    name: "memory_author",
+    title: "Author org memory",
+    description: "Write to the org memory plane (memory.author).",
+    input_schema: S(
+      {
+        content: str("Memory content."),
+        kind: str("Memory kind (optional)."),
+        tags: arr({ type: "string" }, "Tags (optional)."),
+      },
+      ["content"],
+    ),
+    access: "write",
+    binding: { kind: "rpc", method: "memory.author" },
+  },
+  // ── members / escalation ─────────────────────────────────────────────────
+  {
+    name: "member_profile",
+    title: "Member profile",
+    description: "One member's full profile (member.get).",
+    input_schema: S({ memberId: str("Member id or slug.") }, ["memberId"]),
+    access: "read",
+    binding: { kind: "rpc", method: "member.get" },
+  },
+  {
+    name: "escalation_raise",
+    title: "Raise escalation",
+    description: "Raise an escalation to the org (escalation.create).",
+    input_schema: S(
+      {
+        severity: str("Severity, e.g. low|medium|high|critical."),
+        subject: str("Escalation subject."),
+        body: str("Details."),
+      },
+      ["severity", "subject", "body"],
+    ),
+    access: "write",
+    binding: { kind: "rpc", method: "escalation.create" },
+  },
+  // ── discoverability + escape hatches ─────────────────────────────────────
+  {
+    name: "org_describe",
+    title: "Describe the org protocol",
+    description:
+      "Discoverability (works offline): list the protocol FAMILIES, methods " +
+      "({name, family, scope, sideEffecting, idempotent}) and GET reads from the vendored " +
+      "protocol table. Optional {family} filter. Use this to find the long tail before " +
+      "reaching for org_rpc.",
+    input_schema: S({ family: str("Filter to one family (optional).") }),
+    access: "read",
+    binding: { kind: "local" },
+  },
+  {
+    name: "org_rpc",
+    title: "Raw org RPC (escape hatch)",
+    description:
+      "Invoke ANY protocol method by name (the ~170 methods without a curated tool). The " +
+      "method is validated against the frozen protocol table before any network I/O; hq's " +
+      "server-side scope gate still applies (this tool adds no privilege). Outbound-content " +
+      "methods (messaging.send, email.send) are send-gate screened before dispatch. Prefer " +
+      "the curated tools when one exists.",
+    input_schema: S(
+      {
+        method: str("Full dotted method name, e.g. \"contacts.upsert\"."),
+        params: { type: "object", description: "The params object (request body)." },
+        idempotencyKey: str("Stable idempotency key for side-effecting retries (optional)."),
+      },
+      ["method"],
+    ),
+    access: "admin",
+    binding: { kind: "local" }, // dispatched through call() after validation
+  },
+  {
+    name: "org_read",
+    title: "Raw org GET read (escape hatch)",
+    description:
+      "Invoke one of the protocol GET reads by path (snapshot, directory, events, hierarchy, " +
+      "board.ready, board.context, ops, approval.wait, cost.rollup, decision.list, policy, " +
+      "contacts.list, meetings.list), with optional query params. Validated against READS " +
+      "before any network I/O.",
+    input_schema: S(
+      {
+        path: str("Read path, e.g. \"events\"."),
+        query: { type: "object", description: "Query params, e.g. {cursor: 0, limit: 100}." },
+      },
+      ["path"],
+    ),
+    access: "admin",
+    binding: { kind: "local" },
+  },
+  // ── email (workspace mailbox; registered only when the family is vendored) ─
+  {
+    name: "email_send",
+    title: "Send workspace email",
+    description:
+      "Send email from this agent's workspace mailbox (email.send; outbox-queued server-side). " +
+      "Thread replies may omit to/subject — the server derives them from the thread. May return " +
+      "a NORMAL result {status:\"approval_required\", approval:{actionClass:\"external_comms\", " +
+      "payloadHash, intent}} for first-contact recipients: call approval_request with that exact " +
+      "payload, approval_wait, then re-send with approvalId and the SAME idempotencyId. An " +
+      "idempotencyId is auto-minted when absent.",
+    input_schema: S(
+      {
+        to: arr({ type: "string" }, "Recipient addresses (≤25). Optional for thread replies."),
+        cc: arr({ type: "string" }, "Cc addresses (optional)."),
+        bcc: arr({ type: "string" }, "Bcc addresses (optional)."),
+        subject: str("Subject (optional for thread replies)."),
+        text: str("Plain-text body."),
+        html: str("HTML body (optional)."),
+        threadId: str("Reply into this thread (optional)."),
+        replyToMessageId: str("Reply to this specific message (optional)."),
+        approvalId: str("Consumed external_comms approval for first-contact sends (optional)."),
+        idempotencyId: str("Business dedup id 8..64 chars (auto-minted when absent)."),
+      },
+      ["text"],
+    ),
+    access: "write",
+    outbound: true,
+    email: true,
+    binding: { kind: "rpc", method: "email.send" },
+  },
+  {
+    name: "email_inbox",
+    title: "Workspace inbox",
+    description:
+      "Keyset-paged own-mailbox listing (email.inbox) — summaries + snippet; " +
+      "bodies via email_message.",
+    input_schema: S({
+      unreadOnly: bool("Only unread messages."),
+      cursor: str("Keyset cursor from a prior page."),
+      limit: num("Page size 1..100 (default 50)."),
+    }),
+    access: "read",
+    email: true,
+    binding: { kind: "rpc", method: "email.inbox" },
+  },
+  {
+    name: "email_message",
+    title: "Read email",
+    description: "Full body/headers/attachment-metadata for one own-mailbox message (email.message).",
+    input_schema: S({ id: str("EmailMessage id.") }, ["id"]),
+    access: "read",
+    email: true,
+    binding: { kind: "rpc", method: "email.message" },
+  },
+  {
+    name: "email_thread",
+    title: "Read email thread",
+    description: "A whole email thread with bodies, ascending (email.thread).",
+    input_schema: S({ threadId: str("Thread id."), limit: num("Max messages (default 50).") }, ["threadId"]),
+    access: "read",
+    email: true,
+    binding: { kind: "rpc", method: "email.thread" },
+  },
+  {
+    name: "email_mark_read",
+    title: "Mark email read",
+    description:
+      "Advance the server-side read cursor (email.markRead) for one message or a whole thread " +
+      "(exactly one of messageId | threadId).",
+    input_schema: S({ messageId: str("Message id."), threadId: str("Thread id.") }),
+    access: "write",
+    email: true,
+    binding: { kind: "rpc", method: "email.markRead" },
+  },
+  // ── artifact (generative-UI cards; registered only when the family is vendored) ─
+  {
+    name: "artifact_create",
+    title: "Post artifact card",
+    description:
+      "Post a generative-UI artifact into an org channel (artifact.create) — an interactive " +
+      "card message whose every rendered button is equally invocable via artifact_act. Returns " +
+      "{artifactId, messageId}. The envelope is genui/v2: {genui:\"v2\", artifact:{class, version, " +
+      "state: draft|streaming|complete|acted|expired|error, source:{kind:\"native\"|\"plugin\", ...}, " +
+      "provenance?:{sources[], counts?, costCents?, generatedAt}, ttlAt?, deepLink?}, " +
+      "actions:[≤12 descriptors], root:{type:\"card\", tone, title?, blocks:[...]}}; simple static " +
+      "cards may use genui/v1 {genui:\"v1\", root:card}. Discover the native classes, their " +
+      "envelope versions and action descriptors via artifact_catalog FIRST. For slow data post " +
+      "state:\"streaming\" with skeleton blocks, then hydrate via artifact.patch (org_rpc) to " +
+      "state:\"complete\". A clientMsgId is auto-minted for dedup.",
+    input_schema: S(
+      {
+        channelId: str("Channel id to post the artifact message into."),
+        envelope: {
+          type: "object",
+          description: "The genui/v2 envelope object ({genui, artifact, actions, root}); genui/v1 {genui:\"v1\", root} also accepted.",
+        },
+        threadRootId: str("Post under this thread root (optional)."),
+        clientMsgId: str("Business dedup id (auto-minted when absent)."),
+      },
+      ["channelId", "envelope"],
+    ),
+    access: "write",
+    artifact: true,
+    binding: { kind: "rpc", method: "artifact.create" },
+  },
+  {
+    name: "artifact_act",
+    title: "Act on artifact",
+    description:
+      "Invoke an action on an artifact (artifact.act) — the SAME action a human clicking the " +
+      "rendered button invokes, with the same params schema (see artifact_catalog). Address by " +
+      "artifactId or messageId. The result carries the action outcome; {held:true, approvalId} " +
+      "means the action is approval-gated — approval_wait that id, then re-invoke with the SAME " +
+      "idempotencyKey to consume the grant; {replay:true} marks an idempotent replay (the action " +
+      "already ran under this key). An idempotencyKey is auto-minted when absent — pass your own " +
+      "stable key whenever you may retry.",
+    input_schema: S(
+      {
+        artifactId: str("Artifact id (pass this or messageId)."),
+        messageId: str("The artifact's message id (alternative address)."),
+        action: str("Action name from the artifact's action descriptors / the catalog."),
+        params: { type: "object", description: "Action params, per the catalog's JSON Schema for this action (optional)." },
+        idempotencyKey: str("Stable dedup key (auto-minted when absent; reuse it to retry or to re-invoke after approval)."),
+      },
+      ["action"],
+    ),
+    access: "write",
+    artifact: true,
+    binding: { kind: "rpc", method: "artifact.act" },
+  },
+  {
+    name: "artifact_get",
+    title: "Read artifact",
+    description:
+      "One artifact row (artifact.get): envelope, state, class, messageId, channelId. Use it to " +
+      "re-read current state and any receipt after acting/patching, or before acting on an " +
+      "artifact another agent posted.",
+    input_schema: S({ artifactId: str("Artifact id.") }, ["artifactId"]),
+    access: "read",
+    artifact: true,
+    binding: { kind: "rpc", method: "artifact.get" },
+  },
+  {
+    name: "artifact_list",
+    title: "List artifacts",
+    description:
+      "List artifact rows (artifact.list), filterable by channelId, class, and lifecycle state " +
+      "(draft|streaming|complete|acted|expired|error); newest first, server-capped limit.",
+    input_schema: S({
+      channelId: str("Only artifacts in this channel (optional)."),
+      class: str("Only this artifact class, e.g. \"governance.approval\" (optional)."),
+      state: str("Only this lifecycle state (optional)."),
+      limit: num("Max rows (server caps; optional)."),
+    }),
+    access: "read",
+    artifact: true,
+    binding: { kind: "rpc", method: "artifact.list" },
+  },
+  {
+    name: "artifact_catalog",
+    title: "Artifact class catalog",
+    description:
+      "THE discovery surface for generative UI (artifact.catalog): the org's native artifact " +
+      "classes — {version, classes:[{class, version, title, describe, actions:[{name, label, " +
+      "kind, description?, params? (JSON Schema), confirm?, gate?, audience, roles?}]}]}. Call " +
+      "this BEFORE composing a native-class artifact_create or an artifact_act so the class " +
+      "version, action names, and params match the server's registry; `describe` says when to " +
+      "use each class.",
+    input_schema: S({}),
+    access: "read",
+    artifact: true,
+    binding: { kind: "rpc", method: "artifact.catalog" },
+  },
+  // ── mail desk (the hq Inbox app; registered when the family is vendored) ──
+  {
+    name: "email_mailboxes",
+    title: "List mailboxes",
+    description:
+      "The mailboxes/viewpoints this seat is entitled to (email.mailboxes), with unread and " +
+      "held-approval counts. Start here — every other mail-desk tool takes a mailboxId from this list.",
+    input_schema: S({}),
+    access: "read",
+    desk: "mail",
+    binding: { kind: "rpc", method: "email.mailboxes" },
+  },
+  {
+    name: "email_threads",
+    title: "List mail threads",
+    description:
+      "Thread rows for one mailbox (email.threads). folder is inbox|archive|starred|assigned|" +
+      "tag:<name>|<folderId>. Summaries only — bodies via email_thread_messages.",
+    input_schema: S(
+      {
+        mailboxId: str("Mailbox id from email_mailboxes."),
+        folder: str("inbox | archive | starred | assigned | tag:<name> | a folder id (default inbox)."),
+        unreadOnly: bool("Only unread threads."),
+        limit: num("Max rows 1..200 (default 50)."),
+      },
+      ["mailboxId"],
+    ),
+    access: "read",
+    desk: "mail",
+    binding: { kind: "rpc", method: "email.threads" },
+  },
+  {
+    name: "email_thread_messages",
+    title: "Read mail thread",
+    description:
+      "All messages of one Inbox-app thread with bodies (email.messages; bcc visible on " +
+      "OUTBOUND only). NB distinct from email_thread (the agent's own workspace mailbox).",
+    input_schema: S({ threadId: str("Thread id from email_threads.") }, ["threadId"]),
+    access: "read",
+    desk: "mail",
+    binding: { kind: "rpc", method: "email.messages" },
+  },
+  {
+    name: "email_triage",
+    title: "Triage mail thread",
+    description:
+      "One triage facet per call (email.triage): set priority (P0|P1|P2), category, tags, " +
+      "starred, read, OR assigneeMemberId — the same one-verb-per-call rule the Inbox UI applies.",
+    input_schema: S(
+      {
+        threadId: str("Thread id."),
+        priority: str("P0 | P1 | P2 (or null to clear)."),
+        category: str("Category label (optional)."),
+        tags: arr({ type: "string" }, "Replace the tag set (≤12; optional)."),
+        starred: bool("Star/unstar."),
+        read: bool("Mark read/unread."),
+        assigneeMemberId: str("Assign to this member (null to unassign)."),
+      },
+      ["threadId"],
+    ),
+    access: "write",
+    desk: "mail",
+    binding: { kind: "rpc", method: "email.triage" },
+  },
+  {
+    name: "email_move",
+    title: "Move mail thread",
+    description:
+      "Move a thread (email.move): target inbox|archive|delete|restore|snooze|folder " +
+      "(folderId required for folder; snoozeUntil ISO for snooze).",
+    input_schema: S(
+      {
+        threadId: str("Thread id."),
+        target: str("inbox | archive | delete | restore | snooze | folder."),
+        folderId: str("Destination folder id (target folder)."),
+        snoozeUntil: str("ISO datetime (target snooze)."),
+      },
+      ["threadId", "target"],
+    ),
+    access: "write",
+    desk: "mail",
+    binding: { kind: "rpc", method: "email.move" },
+  },
+  {
+    name: "email_draft_save",
+    title: "Save mail draft",
+    description:
+      "Create or update a draft in any entitled mailbox (email.draftSave). Attachments may " +
+      "carry workspaceFileId for live drive links. Nothing sends — pair with email_draft_send.",
+    input_schema: S(
+      {
+        draftId: str("Existing draft to update (omit to create)."),
+        mailboxId: str("Mailbox id."),
+        threadId: str("Reply thread (optional)."),
+        mode: str("compose | reply | replyAll | forward."),
+        to: arr({ type: "string" }, "To addresses (≤25)."),
+        cc: arr({ type: "string" }, "Cc addresses."),
+        bcc: arr({ type: "string" }, "Bcc addresses."),
+        subject: str("Subject."),
+        bodyText: str("Plain-text body."),
+        bodyHtml: str("HTML body (optional)."),
+        attachments: {
+          type: "array",
+          items: { type: "object", properties: { name: { type: "string" }, workspaceFileId: { type: "string" }, contentType: { type: "string" }, size: { type: "number" } }, required: ["name"] },
+          description: "Attachments (≤8); workspaceFileId links a drive file.",
+        },
+      },
+      ["mailboxId", "mode"],
+    ),
+    access: "write",
+    desk: "mail",
+    binding: { kind: "rpc", method: "email.draftSave" },
+  },
+  {
+    name: "email_draft_send",
+    title: "Send mail (governed)",
+    description:
+      "Compose/reply/forward from ANY entitled mailbox through the governance path " +
+      "(email.draftSend). Unlike email_send (the agent's own mailbox + first-contact approvals), " +
+      "this rides the Inbox domain layer: when mailbox rules or a per-thread hold trip, the " +
+      "result is {status:\"held\", draftId, policyCite} and the draft lands in the guardian's " +
+      "approvals queue — NEVER a silent send. Send-gate screened locally before dispatch.",
+    input_schema: S(
+      {
+        mailboxId: str("Mailbox to send from."),
+        threadId: str("Reply thread (optional for compose)."),
+        mode: str("compose | reply | replyAll | forward (default reply)."),
+        to: arr({ type: "string" }, "Recipient addresses (≤25)."),
+        cc: arr({ type: "string" }, "Cc addresses."),
+        bcc: arr({ type: "string" }, "Bcc addresses."),
+        subject: str("Subject (optional for replies)."),
+        bodyText: str("Plain-text body."),
+        bodyHtml: str("HTML body (optional)."),
+        attachments: {
+          type: "array",
+          items: { type: "object", properties: { name: { type: "string" }, workspaceFileId: { type: "string" } }, required: ["name"] },
+          description: "Attachments (≤8).",
+        },
+        draftId: str("Send this saved draft (optional)."),
+      },
+      ["mailboxId", "to", "bodyText"],
+    ),
+    access: "write",
+    outbound: true,
+    desk: "mail",
+    binding: { kind: "rpc", method: "email.draftSend" },
+  },
+  {
+    name: "email_report_spam",
+    title: "Report spam / not spam",
+    description:
+      "Report a thread as spam — or clear it with spam:false (email.reportSpam). Stamps the " +
+      "disposition AND maintains the mailbox's Blocked-senders rule, so future mail from the " +
+      "sender files as spam on arrival. Returns the blocked address for honest relay.",
+    input_schema: S(
+      {
+        threadId: str("Thread id."),
+        spam: bool("true = report spam (default); false = not spam (unblocks the sender)."),
+      },
+      ["threadId"],
+    ),
+    access: "write",
+    desk: "mail",
+    binding: { kind: "rpc", method: "email.reportSpam" },
+  },
+  {
+    name: "email_react",
+    title: "React to a mail message",
+    description:
+      "Toggle YOUR reaction pill on one message (email.react): one of 👍 ✅ 🎉 ❤️ 😂 👀. A new " +
+      "emoji replaces yours; the same emoji removes it. A reachable colleague sender is " +
+      "notified through the notification lane — the result's `notified` says so honestly.",
+    input_schema: S(
+      {
+        messageId: str("Message id (from email_thread_messages)."),
+        emoji: str("One of: 👍 ✅ 🎉 ❤️ 😂 👀."),
+      },
+      ["messageId", "emoji"],
+    ),
+    access: "write",
+    desk: "mail",
+    binding: { kind: "rpc", method: "email.react" },
+  },
+  {
+    name: "email_move_mailbox",
+    title: "Move thread to another desk",
+    description:
+      "Reassign a thread to ANOTHER mailbox you hold (email.moveMailbox) — the mailbox sheet's " +
+      "'Move to…'. ACL is enforced on BOTH desks in-domain; folder placement and rule filing " +
+      "reset so the destination desk's filing rules take over.",
+    input_schema: S(
+      {
+        threadId: str("Thread id."),
+        mailboxId: str("DESTINATION mailbox id (from email_mailboxes)."),
+      },
+      ["threadId", "mailboxId"],
+    ),
+    access: "write",
+    desk: "mail",
+    binding: { kind: "rpc", method: "email.moveMailbox" },
+  },
+  {
+    name: "email_summarise",
+    title: "Summarise mail thread (stored)",
+    description:
+      "Generate AND STORE the thread's grounded brief (email.summarise) — the same aiSummary " +
+      "card the mobile Inbox shows, written through the governed lane: gateway-metered " +
+      "(costCents + auditId returned; relay them) with one chain event. Re-running refreshes " +
+      "the brief; prior reply suggestions are preserved.",
+    input_schema: S({ threadId: str("Thread id.") }, ["threadId"]),
+    access: "write",
+    desk: "mail",
+    binding: { kind: "rpc", method: "email.summarise" },
+  },
+  {
+    name: "email_ask",
+    title: "Ask the mail desk",
+    description:
+      "Grounded ask over your entitled mailboxes (email.ask): desks, recent thread rows " +
+      "(triage-level — never bodies) and held approvals form the context. Result carries " +
+      "content + grounding + costCents + auditId — cite them. mailboxId narrows to one desk.",
+    input_schema: S(
+      {
+        question: str("The question (≤500 chars)."),
+        mailboxId: str("Ground in this one desk only (optional)."),
+      },
+      ["question"],
+    ),
+    access: "read",
+    desk: "mail",
+    binding: { kind: "rpc", method: "email.ask" },
+  },
+  // ── files desk (workspace drive; registered when the family is vendored) ──
+  {
+    name: "files_list",
+    title: "List drive files",
+    description:
+      "The workspace drive listing (files.list) with the human surface's filters: folder " +
+      "scope, kind, starred, agent-owned, free-text q; deleted:true shows the recovery bin.",
+    input_schema: S({
+      parentId: str("Folder scope (null/omit = root)."),
+      kind: str("FOLDER | DOC | SHEET | DECK | PDF | IMAGE | FILE."),
+      starred: bool("Only starred."),
+      byAgents: bool("Only agent-owned files."),
+      q: str("Name contains (case-insensitive)."),
+      deleted: bool("Show soft-deleted (30-day bin)."),
+      limit: num("Max rows 1..200 (default 100)."),
+    }),
+    access: "read",
+    desk: "files",
+    binding: { kind: "rpc", method: "files.list" },
+  },
+  {
+    name: "files_get",
+    title: "Get drive file",
+    description:
+      "One file with the acting seat's effective permission and its shares (files.get). " +
+      "Shares/ACLs (VIEW/COMMENT/EDIT) govern agents exactly as humans.",
+    input_schema: S({ fileId: str("File id.") }, ["fileId"]),
+    access: "read",
+    desk: "files",
+    binding: { kind: "rpc", method: "files.get" },
+  },
+  {
+    name: "files_doc_read",
+    title: "Read doc",
+    description:
+      "A DOC's HEAD revision as HTML (files.docRead). Sheets/decks: org_rpc files.sheetRead / " +
+      "files.deckRead.",
+    input_schema: S({ fileId: str("DOC file id.") }, ["fileId"]),
+    access: "read",
+    desk: "files",
+    binding: { kind: "rpc", method: "files.docRead" },
+  },
+  {
+    name: "files_create",
+    title: "Create file/folder",
+    description: "Create a DOC, SHEET, DECK, or FOLDER in the workspace drive (files.create).",
+    input_schema: S(
+      {
+        kind: str("DOC | SHEET | DECK | FOLDER."),
+        name: str("Name (≤200 chars)."),
+        parentId: str("Parent folder (omit for root)."),
+      },
+      ["kind", "name"],
+    ),
+    access: "write",
+    desk: "files",
+    binding: { kind: "rpc", method: "files.create" },
+  },
+  {
+    name: "files_doc_write",
+    title: "Write doc revision",
+    description:
+      "Write a DOC revision (files.docWriteRevision; EDIT permission required — bumps HEAD + " +
+      "DocRevision). Set aiDrafted + costCents when the content came from a model call.",
+    input_schema: S(
+      {
+        fileId: str("DOC file id."),
+        html: str("The full new HTML body (≤400KB)."),
+        summary: str("Revision summary (optional)."),
+        aiDrafted: bool("Content was AI-drafted."),
+        costCents: num("Model cost in cents (optional)."),
+      },
+      ["fileId", "html"],
+    ),
+    access: "write",
+    desk: "files",
+    binding: { kind: "rpc", method: "files.docWriteRevision" },
+  },
+  {
+    name: "files_share_grant",
+    title: "Share drive file",
+    description:
+      "Grant VIEW/COMMENT/EDIT on a file or folder (files.shareGrant; folder grants " +
+      "materialize inherited rows). Subjects: members, channels, or external emails.",
+    input_schema: S(
+      {
+        fileId: str("File or folder id."),
+        permission: str("VIEW | COMMENT | EDIT."),
+        subjects: {
+          type: "array",
+          items: {
+            type: "object",
+            properties: {
+              type: { type: "string", description: "member | channel | email" },
+              memberId: { type: "string" },
+              channelId: { type: "string" },
+              email: { type: "string" },
+            },
+            required: ["type"],
+          },
+          description: "Who to share with.",
+        },
+        message: str("Share message (optional)."),
+      },
+      ["fileId", "permission", "subjects"],
+    ),
+    access: "write",
+    desk: "files",
+    binding: { kind: "rpc", method: "files.shareGrant" },
+  },
+  {
+    name: "files_ask",
+    title: "Ask the drive",
+    description:
+      "Grounded ask over the workspace drive (files.ask): file names, kinds, owners, share/" +
+      "expiry facts — never file CONTENT (read a file via its own lane). Result carries " +
+      "content + grounding + costCents + auditId — cite them.",
+    input_schema: S(
+      {
+        question: str("The question (≤500 chars)."),
+        limit: num("How many recent files to ground in, 4..30 (default 24)."),
+      },
+      ["question"],
+    ),
+    access: "read",
+    desk: "files",
+    binding: { kind: "rpc", method: "files.ask" },
+  },
+  // ── calendar desk (registered when the family is vendored) ──
+  {
+    name: "calendar_list",
+    title: "List calendar events",
+    description:
+      "Events in a window with attendee rows (calendar.list). Defaults to the acting seat's " +
+      "calendar; calendarMemberId targets a colleague's, subject to visibility.",
+    input_schema: S({
+      fromIso: str("Window start ISO (optional)."),
+      toIso: str("Window end ISO (optional)."),
+      calendarMemberId: str("Whose calendar (optional)."),
+      limit: num("Max rows 1..500 (default 200)."),
+    }),
+    access: "read",
+    desk: "calendar",
+    binding: { kind: "rpc", method: "calendar.list" },
+  },
+  {
+    name: "calendar_get",
+    title: "Get calendar event",
+    description: "One event with attendee/RSVP rows and linked records (calendar.get).",
+    input_schema: S({ eventId: str("Event id.") }, ["eventId"]),
+    access: "read",
+    desk: "calendar",
+    binding: { kind: "rpc", method: "calendar.get" },
+  },
+  {
+    name: "calendar_find_a_time",
+    title: "Find a time",
+    description:
+      "Deterministic free-slot scan across attendees (calendar.findATime): 15-min lattice, " +
+      "Mon–Fri 08–18, ≤20 attendees. Proposes times — changes nothing.",
+    input_schema: S(
+      {
+        attendeeMemberIds: arr({ type: "string" }, "Member ids to intersect (1..20)."),
+        durationMinutes: num("Meeting length 15..480."),
+        fromDay: str("First day to scan (ISO date)."),
+        scanDays: num("Days to scan 1..21 (default 7)."),
+      },
+      ["attendeeMemberIds", "durationMinutes", "fromDay"],
+    ),
+    access: "read",
+    desk: "calendar",
+    binding: { kind: "rpc", method: "calendar.findATime" },
+  },
+  {
+    name: "calendar_create",
+    title: "Create calendar event",
+    description:
+      "Create a typed event (calendar.create): MEETING/REVIEW/FOCUS/AGENT_BLOCK/ALL_HANDS/HOLD. " +
+      "Queues REAL invite emails to attendees (invitesQueued/invitesSkipped honest in the payload). " +
+      "companyCalendar:true targets the shared calendar; AGENT_BLOCK carries estCostCents.",
+    input_schema: S(
+      {
+        title: str("Event title."),
+        kind: str("MEETING | REVIEW | FOCUS | AGENT_BLOCK | ALL_HANDS | HOLD (default MEETING)."),
+        startsAt: str("Start ISO datetime."),
+        endsAt: str("End ISO datetime."),
+        allDay: bool("All-day event."),
+        location: str("Location (optional)."),
+        description: str("Description/agenda (optional)."),
+        companyCalendar: bool("Put on the shared company calendar."),
+        calendarMemberId: str("Whose calendar (optional; ignored with companyCalendar)."),
+        agendaFileId: str("Link a drive file as the agenda (optional)."),
+        estCostCents: num("Estimated cost for AGENT_BLOCK (optional)."),
+        attendees: {
+          type: "array",
+          items: { type: "object", properties: { memberId: { type: "string" }, email: { type: "string" }, name: { type: "string" }, role: { type: "string" } } },
+          description: "Attendees by memberId or external email (≤50).",
+        },
+      },
+      ["title", "startsAt", "endsAt"],
+    ),
+    access: "write",
+    desk: "calendar",
+    binding: { kind: "rpc", method: "calendar.create" },
+  },
+  {
+    name: "calendar_rsvp",
+    title: "RSVP event",
+    description:
+      "RSVP the acting seat's own invite (calendar.rsvp): ACCEPTED | DECLINED | TENTATIVE | " +
+      "COMMITTED. Reschedule/update/cancel ride org_rpc (calendar.reschedule / update / delete).",
+    input_schema: S(
+      { eventId: str("Event id."), rsvp: str("ACCEPTED | DECLINED | TENTATIVE | COMMITTED.") },
+      ["eventId", "rsvp"],
+    ),
+    access: "write",
+    desk: "calendar",
+    binding: { kind: "rpc", method: "calendar.rsvp" },
+  },
+  {
+    name: "calendar_ask",
+    title: "Ask the calendar",
+    description:
+      "Grounded ask over the calendar window this seat may see (calendar.ask) — company + own " +
+      "events; PERSONAL_RESTRICTED events of other seats are ABSENT by law. Defaults to " +
+      "yesterday..+14d; fromIso/toIso override. Result carries content + grounding + " +
+      "costCents + auditId — cite them.",
+    input_schema: S(
+      {
+        question: str("The question (≤500 chars)."),
+        fromIso: str("Window start ISO (optional)."),
+        toIso: str("Window end ISO (optional)."),
+      },
+      ["question"],
+    ),
+    access: "read",
+    desk: "calendar",
+    binding: { kind: "rpc", method: "calendar.ask" },
+  },
+  // ── crm desk (registered when the family is vendored) ──
+  {
+    name: "crm_list_deals",
+    title: "List deals",
+    description: "Pipeline listing (crm.listDeals) filterable by stage/account/owner/openOnly.",
+    input_schema: S({
+      stage: str("Deal stage filter (optional)."),
+      accountId: str("Account filter (optional)."),
+      ownerId: str("Owner filter (optional)."),
+      openOnly: bool("Only open deals."),
+      limit: num("Max rows 1..100 (default 50)."),
+    }),
+    access: "read",
+    desk: "crm",
+    binding: { kind: "rpc", method: "crm.listDeals" },
+  },
+  {
+    name: "crm_get_deal",
+    title: "Get deal",
+    description:
+      "One deal with account, contacts, and hold detail (crm.getDeal) — check heldDetail " +
+      "before acting; a held deal refuses next-best-action.",
+    input_schema: S({ dealId: str("Deal id.") }, ["dealId"]),
+    access: "read",
+    desk: "crm",
+    binding: { kind: "rpc", method: "crm.getDeal" },
+  },
+  {
+    name: "crm_list_escalations",
+    title: "List CRM escalations",
+    description:
+      "Held deals pending human resolution (crm.listEscalations). Signing/returning an " +
+      "escalation is HUMAN-ONLY — agents surface them, humans resolve them.",
+    input_schema: S({ limit: num("Max rows 1..50 (default 20).") }),
+    access: "read",
+    desk: "crm",
+    binding: { kind: "rpc", method: "crm.listEscalations" },
+  },
+  {
+    name: "crm_create_deal",
+    title: "Create deal",
+    description: "Create a deal (crm.createDeal); account resolved/minted by company name.",
+    input_schema: S(
+      {
+        company: str("Company/account name."),
+        name: str("Deal name (optional; defaults from company)."),
+        valueCents: num("Deal value in cents (optional)."),
+        ownerId: str("Owner member id (optional)."),
+        source: str("Source label (optional)."),
+      },
+      ["company"],
+    ),
+    access: "write",
+    desk: "crm",
+    binding: { kind: "rpc", method: "crm.createDeal" },
+  },
+  {
+    name: "crm_move_stage",
+    title: "Move deal stage",
+    description:
+      "Move a deal through the pipeline (crm.moveStage). Moving to CLOSED without an outcome " +
+      "is refused — close via org_rpc crm.closeDeal (WON auto-drafts a Books invoice).",
+    input_schema: S(
+      {
+        dealId: str("Deal id."),
+        stage: str("Target stage enum value."),
+        sortOrder: num("Position inside the column (optional)."),
+      },
+      ["dealId", "stage"],
+    ),
+    access: "write",
+    desk: "crm",
+    binding: { kind: "rpc", method: "crm.moveStage" },
+  },
+  {
+    name: "crm_log_interaction",
+    title: "Log CRM interaction",
+    description: "Log a note/call/email/meeting against a deal or contact (crm.logInteraction).",
+    input_schema: S(
+      {
+        kind: str("note | call | email | meeting."),
+        text: str("What happened (≤4000 chars)."),
+        dealId: str("Deal (optional)."),
+        contactId: str("Contact (optional)."),
+      },
+      ["kind", "text"],
+    ),
+    access: "write",
+    desk: "crm",
+    binding: { kind: "rpc", method: "crm.logInteraction" },
+  },
+  {
+    name: "crm_next_best_action",
+    title: "Run next best action",
+    description:
+      "Run the playbook's next-best-action for a deal (crm.runNextBestAction). Refused while " +
+      "the deal is held — resolve the hold first (crm_list_escalations).",
+    input_schema: S({ dealId: str("Deal id.") }, ["dealId"]),
+    access: "write",
+    desk: "crm",
+    binding: { kind: "rpc", method: "crm.runNextBestAction" },
+  },
+  {
+    name: "crm_ask",
+    title: "Ask the pipeline",
+    description:
+      "Grounded ask over the deals this seat may see (crm.ask): value, stage, owner, held-for-" +
+      "signature state, next steps. Result carries content + grounding + costCents + auditId — " +
+      "cite them.",
+    input_schema: S(
+      {
+        question: str("The question (≤500 chars)."),
+        limit: num("How many deals to ground in, 4..40 (default 30)."),
+      },
+      ["question"],
+    ),
+    access: "read",
+    desk: "crm",
+    binding: { kind: "rpc", method: "crm.ask" },
+  },
+  // ── books desk (registered when the family is vendored) ──
+  {
+    name: "books_reports",
+    title: "Books reports",
+    description:
+      "Ledger-current reporting (books.reports): pl | balance | cashflow | agedAr | agedAp. " +
+      "Every figure carries the journal-line ids it was computed from.",
+    input_schema: S(
+      {
+        report: str("pl | balance | cashflow | agedAr | agedAp."),
+        from: str("Window start ISO (optional; defaults to month start)."),
+        to: str("Window end ISO (optional; defaults to now)."),
+      },
+      ["report"],
+    ),
+    access: "read",
+    desk: "books",
+    binding: { kind: "rpc", method: "books.reports" },
+  },
+  {
+    name: "books_invoices",
+    title: "List AR invoices",
+    description: "AR invoices with chase state (books.invoices); filter by status.",
+    input_schema: S({
+      status: str("DRAFT | SENT | PART_PAID | PAID | VOID | WRITTEN_OFF (optional)."),
+      limit: num("Max rows 1..100 (default 50)."),
+    }),
+    access: "read",
+    desk: "books",
+    binding: { kind: "rpc", method: "books.invoices" },
+  },
+  {
+    name: "books_bills",
+    title: "List AP bills",
+    description: "AP bills with hold reasons + payment-run linkage (books.bills).",
+    input_schema: S({
+      status: str("CAPTURED | AWAITING_APPROVAL | APPROVED | SCHEDULED | PAID | VOID (optional)."),
+      limit: num("Max rows 1..100 (default 50)."),
+    }),
+    access: "read",
+    desk: "books",
+    binding: { kind: "rpc", method: "books.bills" },
+  },
+  {
+    name: "books_tax_obligations",
+    title: "List tax obligations",
+    description:
+      "Tax obligations + lodgement state (books.taxObligations). Signing/lodging is the " +
+      "HUMAN-SIGNATURE LAW (PB-B4) — agents prepare, humans sign.",
+    input_schema: S({
+      status: str("UPCOMING | ASSEMBLING | READY | HELD_FOR_SIGNATURE | SIGNED | LODGED | ACCEPTED | REJECTED | AMENDED (optional)."),
+    }),
+    access: "read",
+    desk: "books",
+    binding: { kind: "rpc", method: "books.taxObligations" },
+  },
+  {
+    name: "books_ask",
+    title: "Ask the books",
+    description:
+      "Grounded finance Q&A over the ledger via the shared AI gateway (books.ask). Returns " +
+      "{content, grounding[], costCents, auditId} — always show grounding + the mono cost.",
+    input_schema: S({ question: str("The question (≤500 chars).") }, ["question"]),
+    access: "read",
+    desk: "books",
+    binding: { kind: "rpc", method: "books.ask" },
+  },
+  {
+    name: "books_invoice_draft",
+    title: "Draft AR invoice",
+    description:
+      "Draft an AR invoice (books.invoiceDraft) — payee by id or minted by name; dealId " +
+      "prefills from a closed-won deal. Nothing posts or emails until books_invoice_send.",
+    input_schema: S(
+      {
+        payeeId: str("Existing payee id (or use payeeName)."),
+        payeeName: str("Payee name to resolve-or-mint."),
+        description: str("Line description (≤240 chars)."),
+        totalCents: num("Total in cents (positive)."),
+        dueDays: num("Days until due 0..90 (default 14)."),
+        dealId: str("CRM deal to link (optional)."),
+      },
+      ["description", "totalCents"],
+    ),
+    access: "write",
+    desk: "books",
+    binding: { kind: "rpc", method: "books.invoiceDraft" },
+  },
+  {
+    name: "books_invoice_send",
+    title: "Send AR invoice",
+    description:
+      "Send a drafted invoice (books.invoiceSend): posts the AR journal, mints a SANDBOX " +
+      "payment link, arms the PB-B2 chase ladder, and queues a REAL customer email from the " +
+      "billing/accounts mailbox — the payload's emailQueued/emailSkipped is honest.",
+    input_schema: S({ id: str("Invoice id.") }, ["id"]),
+    access: "write",
+    desk: "books",
+    binding: { kind: "rpc", method: "books.invoiceSend" },
+  },
+  {
+    name: "books_bill_approve",
+    title: "Approve AP bill",
+    description:
+      "Release a held bill onto the payment run (books.billApprove). PB-B1 floor/new-payee " +
+      "holds require a verified human signature — without it the hold frame comes back " +
+      "(SIGNATURE_REQUIRED), never a silent release.",
+    input_schema: S(
+      {
+        id: str("Bill id."),
+        humanSignatureMemberId: str("Human signer member id (required by PB-B1 holds)."),
+      },
+      ["id"],
+    ),
+    access: "write",
+    desk: "books",
+    binding: { kind: "rpc", method: "books.billApprove" },
+  },
+  // ── meetings desk addition ──
+  {
+    name: "meetings_recap_file",
+    title: "File meeting recap",
+    description:
+      "File a held meeting's recap + transcript into the workspace drive (meetings.recapFile): " +
+      "two DOCs + MeetingRecord links back to the meeting. The notetaker's landing verb.",
+    input_schema: S(
+      {
+        meetingId: str("Meeting id."),
+        callId: str("Source call id (optional)."),
+        occurredAt: str("ISO datetime (optional)."),
+        recap: {
+          type: "object",
+          description: "{ bullets: string[] (1..20), decisions?: string[], actions?: string[] }",
+          properties: {
+            bullets: { type: "array", items: { type: "string" } },
+            decisions: { type: "array", items: { type: "string" } },
+            actions: { type: "array", items: { type: "string" } },
+          },
+          required: ["bullets"],
+        },
+        transcript: {
+          type: "array",
+          items: { type: "object", properties: { at: { type: "string" }, name: { type: "string" }, speakerMemberId: { type: "string" }, text: { type: "string" } }, required: ["at", "name", "text"] },
+          description: "Transcript lines (optional).",
+        },
+      },
+      ["meetingId", "recap"],
+    ),
+    access: "write",
+    desk: "meetings",
+    binding: { kind: "rpc", method: "meetings.recapFile" },
+  },
+  // ── directory desk (registered when the family is vendored) ──
+  //
+  // The Directory holds EXTERNAL people and organisations only — colleagues live
+  // in the workforce, and the domain refuses to archive one from here (D-1).
+  // Two governance facts shape this block:
+  //   - Awareness (D-4): a NAMED record is ABSENT, not redacted, from every read
+  //     below for a seat without a grant. An empty result is the correct answer,
+  //     never evidence that a record does not exist — do not infer from absence.
+  //   - The propose-only permission matrix (D-7): agents read, enrich and
+  //     PROPOSE. Merge execution, awareness changes and archives are human-gated
+  //     server-side; an agent call to them files a review item rather than
+  //     acting, so they stay in the `org_rpc` long tail deliberately.
+  {
+    name: "directory_search",
+    title: "Search the directory",
+    description:
+      "One-box search across external people and organisations (directory.search) — name, " +
+      "organisation, email, phone, handle. Awareness-scoped: records you hold no grant for " +
+      "are absent from the results, not marked restricted.",
+    input_schema: S(
+      {
+        q: str("Query text (≤200 chars)."),
+        scope: str("external | internal | all (default external)."),
+        limit: num("Max rows 1..50."),
+      },
+      ["q"],
+    ),
+    access: "read",
+    desk: "directory",
+    binding: { kind: "rpc", method: "directory.search" },
+  },
+  {
+    name: "directory_list_people",
+    title: "List people",
+    description:
+      "The People view (directory.listPeople): filter by relationship, organisation, awareness, " +
+      "list membership or free text; sort by touch or name. Cursor-paginated. " +
+      "Awareness-scoped — restricted records are absent.",
+    input_schema: S({
+      scope: str("external | internal | all (default external)."),
+      relationship: str("all | client | vendor | prospect | partner | personal."),
+      accountId: str("Only people at this organisation."),
+      awareness: str("WORKSPACE | NAMED."),
+      listId: str("Only members of this contact list."),
+      q: str("Free-text filter (≤200 chars)."),
+      sort: str("touch | name."),
+      includeArchived: bool("Include archived records (default false)."),
+      limit: num("Page size 1..200."),
+      cursor: str("Opaque cursor from a previous page."),
+    }),
+    access: "read",
+    desk: "directory",
+    binding: { kind: "rpc", method: "directory.listPeople" },
+  },
+  {
+    name: "directory_list_orgs",
+    title: "List organisations",
+    description:
+      "The Organisations view (directory.listOrgs): external companies with their relationship " +
+      "set, filterable by relationship and free text. Cursor-paginated.",
+    input_schema: S({
+      relationship: str("all | LEAD | PROSPECT | CUSTOMER | PARTNER | VENDOR | OTHER."),
+      q: str("Free-text filter (≤200 chars)."),
+      includeArchived: bool("Include archived organisations (default false)."),
+      limit: num("Page size 1..200."),
+      cursor: str("Opaque cursor from a previous page."),
+    }),
+    access: "read",
+    desk: "directory",
+    binding: { kind: "rpc", method: "directory.listOrgs" },
+  },
+  {
+    name: "directory_get_person",
+    title: "Get person record",
+    description:
+      "One person record (directory.getPerson): channels with their provenance and verification " +
+      "state, links across mail/calendar/books/CRM, steward, awareness and grantees. " +
+      "NOT_FOUND is also what a restricted record looks like — treat it as absence.",
+    input_schema: S({ contactId: str("Contact id.") }, ["contactId"]),
+    access: "read",
+    desk: "directory",
+    binding: { kind: "rpc", method: "directory.getPerson" },
+  },
+  {
+    name: "directory_get_org",
+    title: "Get organisation record",
+    description:
+      "One organisation record (directory.getOrg): address, contact channels, relationships, " +
+      "billing entity, steward, and the people attached to it.",
+    input_schema: S({ accountId: str("Account id.") }, ["accountId"]),
+    access: "read",
+    desk: "directory",
+    binding: { kind: "rpc", method: "directory.getOrg" },
+  },
+  {
+    name: "directory_ask",
+    title: "Ask the directory",
+    description:
+      "Grounded Q&A over the directory via the shared AI gateway (directory.ask). Returns " +
+      "{content, grounding[], costCents, auditId} — always show the grounding rows and the " +
+      "cost. Grounding is awareness-scoped, so restricted records never reach the model.",
+    input_schema: S(
+      {
+        question: str("The question (≤500 chars)."),
+        limit: num("People to ground in, 1..24 (orgs get half as many again)."),
+      },
+      ["question"],
+    ),
+    access: "read",
+    desk: "directory",
+    binding: { kind: "rpc", method: "directory.ask" },
+  },
+  {
+    name: "directory_list_captures",
+    title: "List capture queue",
+    description:
+      "The Review view's capture queue (directory.listCaptures): records proposed from mail " +
+      "signatures, calendar rosters, call transcripts and bank feeds, each with its provenance " +
+      "line. A capture writes nothing until a human approves it.",
+    input_schema: S({
+      status: str("PENDING | APPROVED | EDITED_APPROVED | DISMISSED."),
+      limit: num("Max rows 1..200."),
+    }),
+    access: "read",
+    desk: "directory",
+    binding: { kind: "rpc", method: "directory.listCaptures" },
+  },
+  {
+    name: "directory_list_merges",
+    title: "List duplicate candidates",
+    description:
+      "Proposed duplicate pairs awaiting a human (directory.listMerges), with the evidence that " +
+      "flagged them. Executing or reverting a merge is human-gated — surface these, never " +
+      "resolve them yourself.",
+    input_schema: S({
+      status: str("PENDING | MERGED | DISMISSED | REVERTED."),
+      limit: num("Max rows 1..200."),
+    }),
+    access: "read",
+    desk: "directory",
+    binding: { kind: "rpc", method: "directory.listMerges" },
+  },
+  {
+    name: "directory_create_person",
+    title: "Create person",
+    description:
+      "Create an EXTERNAL person record (directory.createPerson) with an optional first channel " +
+      "and provenance. Colleagues are not directory records — add a workforce member instead. " +
+      "Prefer directory_propose_capture when the person came from parsed traffic.",
+    input_schema: S(
+      {
+        displayName: str("Full name."),
+        firstName: str("Given name (optional)."),
+        lastName: str("Family name (optional)."),
+        title: str("Role title (optional)."),
+        accountId: str("Existing organisation id (optional)."),
+        organisationName: str("Organisation name to resolve-or-mint (optional)."),
+        relationship: str("LEAD | PROSPECT | CUSTOMER | PARTNER | VENDOR | OTHER."),
+        partyKind: str("BUSINESS | PERSONAL | FAMILY."),
+        email: str("Primary email (optional)."),
+        phone: str("Primary phone (optional)."),
+        location: str("Location (optional)."),
+        timezone: str("IANA timezone (optional)."),
+        notes: str("Notes (≤4000 chars)."),
+        stewardMemberId: str("Owning member id (optional)."),
+        awareness: str("WORKSPACE | NAMED (default WORKSPACE)."),
+        granteeMemberIds: arr(str("Member id."), "Grantees when awareness is NAMED."),
+        source: str("MAIL | CALENDAR | CALL | BOOKS | CRM | MANUAL | IMPORT."),
+        sourceRef: str("Where it came from (≤400 chars)."),
+      },
+      ["displayName"],
+    ),
+    access: "write",
+    desk: "directory",
+    binding: { kind: "rpc", method: "directory.createPerson" },
+  },
+  {
+    name: "directory_update_person",
+    title: "Update person",
+    description:
+      "Edit a person record (directory.updatePerson). Every field is optional — send only what " +
+      "changed. `verifiedFrom` records HOW a channel written by this edit was learned, which is " +
+      "what re-verification writes.",
+    input_schema: S(
+      {
+        contactId: str("Contact id."),
+        displayName: str("Full name."),
+        title: str("Role title."),
+        accountId: str("Organisation id."),
+        organisationName: str("Organisation name to resolve-or-mint."),
+        relationship: str("LEAD | PROSPECT | CUSTOMER | PARTNER | VENDOR | OTHER."),
+        email: str("Primary email."),
+        phone: str("Primary phone."),
+        location: str("Location."),
+        timezone: str("IANA timezone."),
+        notes: str("Notes (≤4000 chars)."),
+        stewardMemberId: str("Owning member id."),
+        verifiedFrom: str("SIGNATURE | CALL | MANUAL | IMPORT | BANK_FEED."),
+        source: str("MAIL | CALENDAR | CALL | BOOKS | CRM | MANUAL | IMPORT."),
+        sourceRef: str("Where it came from (≤400 chars)."),
+      },
+      ["contactId"],
+    ),
+    access: "write",
+    desk: "directory",
+    binding: { kind: "rpc", method: "directory.updatePerson" },
+  },
+  {
+    name: "directory_add_channel",
+    title: "Add a channel",
+    description:
+      "Attach an email/phone/handle/URL to a person or organisation (directory.addChannel) with " +
+      "the provenance that proves it. THE enrichment verb: re-adding a channel already on the " +
+      "record with a fresh `verifiedFrom` is how a stale channel is re-verified.",
+    input_schema: S(
+      {
+        subjectType: str("PERSON | ORGANISATION."),
+        subjectId: str("Contact id (PERSON) or account id (ORGANISATION)."),
+        type: str("EMAIL | PHONE | HANDLE | URL."),
+        value: str("The address/number/handle/URL."),
+        isPrimary: bool("Make this the primary channel of its type."),
+        verifiedFrom: str("SIGNATURE | CALL | MANUAL | IMPORT | BANK_FEED."),
+        label: str("Display label, e.g. 'work' (≤80 chars)."),
+        source: str("MAIL | CALENDAR | CALL | BOOKS | CRM | MANUAL | IMPORT."),
+        sourceRef: str("Where it came from (≤400 chars)."),
+        confidence: num("0..1 confidence in the observation."),
+      },
+      ["subjectType", "subjectId", "type", "value"],
+    ),
+    access: "write",
+    desk: "directory",
+    binding: { kind: "rpc", method: "directory.addChannel" },
+  },
+  {
+    name: "directory_propose_capture",
+    title: "Propose a capture",
+    description:
+      "Propose a person/organisation for the Review queue (directory.proposeCapture) from a " +
+      "signature block, meeting roster, transcript or bank feed. Writes NO record — a human " +
+      "approves it. `sourceFingerprint` dedupes, so re-proposing the same observation is safe.",
+    input_schema: S(
+      {
+        kind: str("PERSON | ORG | PERSON_AND_ORG."),
+        payload: {
+          type: "object",
+          description:
+            "{ person?: {displayName?, email?, phone?, title?, …}, org?: {name?, domain?, …} } — what was observed.",
+          properties: {
+            person: { type: "object", description: "Observed person fields." },
+            org: { type: "object", description: "Observed organisation fields." },
+          },
+        },
+        source: str("MAIL | CALENDAR | CALL | BOOKS | CRM | MANUAL | IMPORT."),
+        sourceRef: str("The message/event/feed-line id (≤200 chars)."),
+        sourceFingerprint: str("Stable hash of the observation — the dedup key."),
+        confidence: num("0..1 confidence in the observation."),
+      },
+      ["kind", "payload", "source", "sourceFingerprint"],
+    ),
+    access: "write",
+    desk: "directory",
+    binding: { kind: "rpc", method: "directory.proposeCapture" },
+  },
+  {
+    name: "directory_propose_merge",
+    title: "Propose a merge",
+    description:
+      "Flag two records as the same party (directory.proposeMerge) with the evidence that says " +
+      "so. Files a duplicate candidate for a human — it does NOT merge. Refs are " +
+      "`contact:<id>` / `account:<id>`.",
+    input_schema: S(
+      {
+        aRef: str("Party ref, e.g. contact:abc123."),
+        bRef: str("The other party ref."),
+        evidence: {
+          type: "object",
+          description: "Why they look alike — printed verbatim in the queue, e.g. {reason:'Same signature block'}.",
+        },
+      },
+      ["aRef", "bRef"],
+    ),
+    access: "write",
+    desk: "directory",
+    binding: { kind: "rpc", method: "directory.proposeMerge" },
+  },
+  {
+    name: "directory_request_awareness",
+    title: "Request awareness",
+    description:
+      "Ask for awareness of a restricted record (directory.requestAwareness). The reason is " +
+      "printed verbatim to the person who decides. Granting is human-only — you file the " +
+      "request, a human answers it.",
+    input_schema: S(
+      {
+        contactId: str("Contact id."),
+        reason: str("Why you need it (≤500 chars) — shown verbatim to the decider."),
+      },
+      ["contactId"],
+    ),
+    access: "write",
+    desk: "directory",
+    binding: { kind: "rpc", method: "directory.requestAwareness" },
+  },
+  // ── design desk (Brand Studio; registered when the family is vendored) ──
+  //
+  // The wire family stays `branding.*`; the product section is called Design
+  // (D-5). Foundation mutations are ALWAYS human-gated (D-7): `design.write` —
+  // the scope an ordinary agent seat holds — reaches design_propose_change,
+  // which stages a reviewable diff and writes nothing. branding.saveFoundation /
+  // restoreFoundation are `admin` scope and stay in the org_rpc long tail.
+  {
+    name: "design_foundation",
+    title: "Get brand foundation",
+    description:
+      "The workspace's brand foundation (branding.getFoundation): typography, colour, scale, " +
+      "archetype and principles, plus the version history head. Pass `versionId` to read a " +
+      "historical snapshot before proposing a restore.",
+    input_schema: S({
+      versionId: str("Read this saved snapshot instead of the head (optional)."),
+      historyLimit: num("History rows 0..50; 0 suppresses the history block."),
+    }),
+    access: "read",
+    desk: "design",
+    binding: { kind: "rpc", method: "branding.getFoundation" },
+  },
+  {
+    name: "design_voice",
+    title: "Get brand voice",
+    description:
+      "The voice statement, trait pills, SAY/AVOID lexicon and in-practice examples " +
+      "(branding.getVoice). Read this BEFORE drafting anything the workspace publishes.",
+    input_schema: S({}),
+    access: "read",
+    desk: "design",
+    binding: { kind: "rpc", method: "branding.getVoice" },
+  },
+  {
+    name: "design_list_templates",
+    title: "List brand templates",
+    description:
+      "The template gallery (branding.listTemplates) with each template's status chip — " +
+      "READY / GENERATING / STALE / DRAFT. STALE means the foundation moved under it.",
+    input_schema: S({
+      visibleOnly: bool("Default true; false is the founder-facing inventory."),
+      category: str("digital | print | email | social | og."),
+    }),
+    access: "read",
+    desk: "design",
+    binding: { kind: "rpc", method: "branding.listTemplates" },
+  },
+  {
+    name: "design_render_template",
+    title: "Render a template",
+    description:
+      "Render a template to HTML, or PNG for GENERATED templates (branding.renderTemplate). " +
+      "`budgetCents` caps this run's spend and is clamped to the hard per-run ceiling — always " +
+      "report the returned cost.",
+    input_schema: S(
+      {
+        templateId: str("Registry spec id or BrandTemplate.slug."),
+        theme: str("light | dark."),
+        size: str("mobile | tablet | desktop."),
+        format: str("html (any template) | png (GENERATED only)."),
+        content: { type: "object", description: "Per-template copy merged over the stored content." },
+        budgetCents: num("Spend cap for this run, US cents 0..1000."),
+      },
+      ["templateId"],
+    ),
+    access: "read",
+    desk: "design",
+    binding: { kind: "rpc", method: "branding.renderTemplate" },
+  },
+  {
+    name: "design_rewrite_in_voice",
+    title: "Rewrite in brand voice",
+    description:
+      "Rewrite a sentence in the workspace's brand voice (branding.rewriteInVoice). Returns the " +
+      "rewrite plus its cost. This produces copy — it never sends anything; the send-gate still " +
+      "screens whatever you do with the result.",
+    input_schema: S(
+      {
+        text: str("The sentence to rewrite (≤4000 chars)."),
+        subject: str("Framing for the audit event's subject column (≤160 chars)."),
+      },
+      ["text"],
+    ),
+    access: "read",
+    desk: "design",
+    binding: { kind: "rpc", method: "branding.rewriteInVoice" },
+  },
+  {
+    name: "design_export_kit",
+    title: "Export the brand kit",
+    description:
+      "Export the brand kit (branding.exportKit): tokens in px/rem/em, voice, and the mark bytes " +
+      "unless `includeMarks:false`. `versionId` exports a historical version instead of the head.",
+    input_schema: S({
+      unit: str("px | rem | em."),
+      includeMarks: bool("Default true; false drops the mark bytes."),
+      versionId: str("Export this version instead of the head."),
+      budgetCents: num("Spend cap for this run, US cents 0..1000."),
+    }),
+    access: "read",
+    desk: "design",
+    binding: { kind: "rpc", method: "branding.exportKit" },
+  },
+  {
+    name: "design_generate_image",
+    title: "Generate brand imagery",
+    description:
+      "Regenerate canonical brand image slots (branding.generateImage). Omitting `slots` " +
+      "regenerates every STALE slot — never a silent full re-run. `budgetCents: 0` is the QUOTE " +
+      "call: it generates nothing, spends nothing, and returns every slot's price and staleness. " +
+      "Quote before you spend.",
+    input_schema: S({
+      slots: arr(str("Slot name, e.g. hero.primary."), "1..8 canonical slots; omit for every STALE slot."),
+      force: bool("Regenerate a slot that is already current."),
+      budgetCents: num("Spend cap, US cents 0..1000. 0 = quote only."),
+    }),
+    access: "write",
+    desk: "design",
+    binding: { kind: "rpc", method: "branding.generateImage" },
+  },
+  {
+    name: "design_propose_change",
+    title: "Propose a foundation change",
+    description:
+      "Stage a reviewable foundation diff (branding.proposeChange). Writes NOTHING to the " +
+      "foundation — a human applies it. Blocks are REPLACED WHOLESALE, so send the COMPLETE " +
+      "block (the whole `fonts` object, the whole `colors` array); a partial block is a silent " +
+      "half-write. Pass `expectedVersionId` from design_foundation so a proposal computed " +
+      "against a stale head is refused.",
+    input_schema: S(
+      {
+        patch: {
+          type: "object",
+          description: "Top-level DesignSystem blocks to change, each COMPLETE.",
+        },
+        note: str("One-line note — becomes the version label when applied."),
+        rationale: str("Why, for the reviewer (≤2000 chars)."),
+        expectedVersionId: str("Head version id you computed against; omit to skip the check."),
+      },
+      ["patch"],
+    ),
+    access: "write",
+    desk: "design",
+    binding: { kind: "rpc", method: "branding.proposeChange" },
+  },
+  // ── calls desk (call working sessions; registered when the family is vendored) ──
+  //
+  // An AI participant "presents" a Cohort surface (doc/sheet/channel/board/
+  // charter) on the call stage — an app share every client renders locally,
+  // driven by step frames over the room data lane. Three laws shape this block:
+  //   - Chain redaction: share.* events carry ids/counts only. Step text IS
+  //     shown to the humans on the call, which is why org_call_share_step is
+  //     the block's one `outbound: true` verb — the send-gate screens its
+  //     notes/typed text before dispatch, per the header's definition.
+  //   - Frames are never persisted server-side: org_call_visual_context reads
+  //     narration TEXT distilled from screen/camera stills, nothing more.
+  //   - Real doc edits ride the files desk (files_doc_write) — a share step
+  //     only choreographs what participants see; pair the write with a
+  //     refresh step so the room's tiles refetch.
+  {
+    name: "org_call_share_start",
+    title: "Present a surface on a call",
+    description:
+      "Start presenting a Cohort surface (doc/sheet/channel/board/charter) on a live call's " +
+      "stage (calling.appShareStart) — every participant's client renders it like a screen " +
+      "share. One active session per call: your own previous session is superseded; CONFLICT " +
+      "while another member presents. Returns {sessionId} — keep it for share_step/share_end. " +
+      "You must be a participant in the call; narrate verbally what you're showing.",
+    input_schema: S(
+      {
+        callId: str("Live call id."),
+        surface: {
+          type: "object",
+          description: "What to present: {kind, ref, title?}.",
+          properties: {
+            kind: { type: "string", description: "doc | sheet | channel | board | charter." },
+            ref: { type: "string", description: "fileId (doc/sheet) | channelId | 'org' (board) | charter slug." },
+            title: { type: "string", description: "Display title for the stage tile (optional)." },
+          },
+          required: ["kind", "ref"],
+        },
+      },
+      ["callId", "surface"],
+    ),
+    access: "write",
+    desk: "calls",
+    binding: { kind: "rpc", method: "calling.appShareStart" },
+  },
+  {
+    name: "org_call_share_step",
+    title: "Step through the share",
+    description:
+      "Drive your active share with a step batch (calling.appShareAct), ≤20 steps: " +
+      "{k:'cursor',x,y} (normalized 0..1) · {k:'scroll',anchor} · {k:'highlight',anchor,note?} " +
+      "· {k:'type',anchor,text} (visual typing preview — NOT a real edit; write real content " +
+      "via files_doc_write, then send a refresh step) · {k:'refresh'} (tiles refetch the " +
+      "surface). Anchors: 'block:3' | 'msg:<id>' | 'cell:B4' | 'task:<id>' | 'section:<idx>' " +
+      "| 'top' | 'bottom'. Send-gate screened locally — the note/typed text is read by every " +
+      "human on the call.",
+    input_schema: S(
+      {
+        callId: str("Live call id."),
+        sessionId: str("Active session id from org_call_share_start."),
+        steps: {
+          type: "array",
+          items: {
+            type: "object",
+            properties: {
+              k: { type: "string", description: "cursor | scroll | highlight | type | refresh." },
+              x: { type: "number", description: "Cursor x 0..1 (k:cursor)." },
+              y: { type: "number", description: "Cursor y 0..1 (k:cursor)." },
+              anchor: { type: "string", description: "Target anchor (k:scroll/highlight/type)." },
+              note: { type: "string", description: "Highlight note ≤200 chars (k:highlight; optional)." },
+              text: { type: "string", description: "Typing-preview text ≤2000 chars (k:type)." },
+            },
+            required: ["k"],
+          },
+          description: "The step batch (1..20), applied in order.",
+        },
+      },
+      ["callId", "sessionId", "steps"],
+    ),
+    access: "write",
+    outbound: true,
+    desk: "calls",
+    binding: { kind: "rpc", method: "calling.appShareAct" },
+  },
+  {
+    name: "org_call_share_end",
+    title: "End the share",
+    description:
+      "End the active share session (calling.appShareEnd) and clear the stage tile. The " +
+      "sharer or the call host may end it.",
+    input_schema: S(
+      {
+        callId: str("Live call id."),
+        sessionId: str("Session id to end."),
+        reason: str("ended | superseded (optional; default ended)."),
+      },
+      ["callId", "sessionId"],
+    ),
+    access: "write",
+    desk: "calls",
+    binding: { kind: "rpc", method: "calling.appShareEnd" },
+  },
+  {
+    name: "org_call_visual_context",
+    title: "Read what's on screen",
+    description:
+      "The call's narrated visual stream (calling.getVisualContext): the last N visual events " +
+      "{kind: screen|camera|appshare, sourceMemberId, summary, at}, chronological. Narration " +
+      "text distilled from sampled frames — frames themselves are never persisted. Use it to " +
+      "ground \"this chart\"/\"that number\" talk in what participants actually see.",
+    input_schema: S(
+      {
+        callId: str("Call id."),
+        limit: num("Max events 1..50 (default 20)."),
+      },
+      ["callId"],
+    ),
+    access: "read",
+    desk: "calls",
+    binding: { kind: "rpc", method: "calling.getVisualContext" },
+  },
+  {
+    name: "org_call_events",
+    title: "Read call events",
+    description:
+      "Recent non-speech call events (calling.getCallEvents): reactions, raised/lowered hands, " +
+      "joins, and share.* lifecycle, mapped {kind, actorId, at, payload} (payloads already " +
+      "redacted). Read hands/reactions here to bring quiet participants in.",
+    input_schema: S(
+      {
+        callId: str("Call id."),
+        limit: num("Max events 1..100 (default 30)."),
+      },
+      ["callId"],
+    ),
+    access: "read",
+    desk: "calls",
+    binding: { kind: "rpc", method: "calling.getCallEvents" },
+  },
+]);
+
+// ---------------------------------------------------------------------------
+// Integration tools (SP5) — the workspace's GRANTED plugin tools, merged onto
+// BOTH planes from the cross-process disk cache the daemon refreshes.
+// ---------------------------------------------------------------------------
+
+/** Resolve agentRoot env-first — mirrors integration-tools.resolveAgentRoot. */
+function integrationAgentRoot(agentRoot) {
+  return (
+    agentRoot ||
+    process.env.COHORT_AGENT_ROOT ||
+    process.env.AGENT_ROOT ||
+    process.env.AGENT_DIR ||
+    process.cwd()
+  );
+}
+
+/**
+ * Read the versioned integration tools the daemon persisted to
+ * `state/org/toolset.json` (written by lib/org/integration-tools; SP5). Returns
+ * the surface-shaped tool array, or [] on any error — the SAME defensive pattern
+ * as state/org/repair-needed.json. This is the cross-process seam: a per-session
+ * cohort-mcp subprocess + the native snapshot both read the current set here, so
+ * a newly-granted tool is usable without a daemon restart. Only well-formed
+ * integration descriptors survive (defence against a partial write).
+ * @param {string} [agentRoot]
+ * @returns {object[]}
+ */
+export function loadIntegrationToolsFromDisk(agentRoot) {
+  try {
+    const p = join(integrationAgentRoot(agentRoot), "state", "org", "toolset.json");
+    if (!existsSync(p)) return [];
+    const doc = JSON.parse(readFileSync(p, "utf8"));
+    const tools = doc && Array.isArray(doc.tools) ? doc.tools : [];
+    return tools.filter(
+      (t) =>
+        t &&
+        typeof t.name === "string" &&
+        t.integration &&
+        t.binding &&
+        t.binding.kind === "rpc",
+    );
+  } catch {
+    return [];
+  }
+}
+
+/** Look up a disk integration tool descriptor by name (undefined when unknown). */
+export function integrationToolDef(name, agentRoot) {
+  const n = String(name || "");
+  return loadIntegrationToolsFromDisk(agentRoot).find((t) => t.name === n);
+}
+
+/**
+ * The ACTIVE tool table: every always-on tool, plus the email/artifact/desk
+ * tools when the vendored protocol carries those families, plus the workspace's
+ * GRANTED integration tools from the shared disk cache (SP5; additive — never
+ * reorders/drops a curated tool). `o.agentRoot` locates the disk cache
+ * (env-first default).
+ * @param {object} [o] - { emailAvailable?: boolean, artifactAvailable?: boolean,
+ *                         desksAvailable?: boolean, agentRoot?: string }
+ * @returns {Array<object>}
+ */
+export function getOrgTools(o = {}) {
+  const emailOk = o.emailAvailable ?? emailFamilyAvailable();
+  const artifactOk = o.artifactAvailable ?? artifactFamilyAvailable();
+  const deskOk = (desk) => o.desksAvailable ?? deskFamilyAvailable(desk);
+  const base = ORG_TOOLS.filter(
+    (t) => (!t.email || emailOk) && (!t.artifact || artifactOk) && (!t.desk || deskOk(t.desk)),
+  );
+  return [...base, ...loadIntegrationToolsFromDisk(o.agentRoot)];
+}
+
+/** Tool-name → definition lookup over the FULL table (email included). */
+const TOOLS_BY_NAME = new Map(ORG_TOOLS.map((t) => [t.name, t]));
+
+/**
+ * Is this name one of the org tools — a curated tool (email included) OR a
+ * currently-granted integration tool from the disk cache? Both planes gate
+ * routing on this (native action-executor + MCP tools/call), so recognising a
+ * disk integration tool here is what makes it executable without touching either
+ * plane. Disk lookup uses the env-first agent root.
+ */
+export function isOrgTool(name) {
+  return TOOLS_BY_NAME.has(String(name || "")) || integrationToolDef(name) != null;
+}
+
+/** Look up a CURATED tool definition by name (undefined when unknown). */
+export function orgToolDef(name) {
+  return TOOLS_BY_NAME.get(String(name || ""));
+}
+
+/**
+ * The protocol methods bound by `outbound: true` tools — DERIVED from the
+ * table, never hand-listed, so it cannot drift (spec §1.5(a)). Today:
+ * messaging.send + email.send + email.draftSend (the mail-desk governed send)
+ * + calling.appShareAct (share-step notes/typed text render on every call
+ * participant's stage tile).
+ * `org_rpc` invocations of these methods are send-gate screened exactly like
+ * the first-class tools.
+ * @type {Set<string>}
+ */
+export const OUTBOUND_METHODS = Object.freeze(
+  new Set(
+    ORG_TOOLS.filter((t) => t.outbound && t.binding && t.binding.kind === "rpc").map(
+      (t) => t.binding.method,
+    ),
+  ),
+);
+
+// ---------------------------------------------------------------------------
+// Send-gate screen (spec §1.5(a)) — same perimeter BaseAdapter.send applies
+// ---------------------------------------------------------------------------
+
+/**
+ * Screen outbound content through lib/comms/send-gate.screenOutbound. Failure
+ * mode mirrors the adapter's: a THROWING gate fails open with a counted
+ * `channel.send_gate.fail_open` diagnostic (screenOutbound itself owns the
+ * fail-closed-for-external policy). Returns {allow, reason, text?}.
+ */
+async function screenOrgOutbound({ channel, recipient, text, agentRoot, screenImpl, bumpImpl }) {
+  let screen = screenImpl;
+  if (typeof screen !== "function") {
+    try {
+      ({ screenOutbound: screen } = await import("../comms/send-gate.mjs"));
+    } catch {
+      screen = null;
+    }
+  }
+  if (typeof screen !== "function") return { allow: true, reason: "" };
+  try {
+    const verdict = await screen({
+      channel,
+      recipient: String(recipient ?? ""),
+      text: typeof text === "string" ? text : "",
+      agentRoot,
+    });
+    if (verdict && verdict.allow === false) {
+      return { allow: false, reason: verdict.reason || "blocked" };
+    }
+    return { allow: true, reason: "", text: verdict?.redactedText };
+  } catch (err) {
+    try {
+      let bump = bumpImpl;
+      if (typeof bump !== "function") ({ bump } = await import("../diagnostics/counters.mjs"));
+      bump(
+        "channel.send_gate.fail_open",
+        { channel, stage: "org-tool", error: err && err.message },
+        { agentRoot },
+      );
+    } catch {
+      /* a counter must never crash the path it observes */
+    }
+    return { allow: true, reason: "" };
+  }
+}
+
+/** Outbound screen inputs (recipient + text) for a screened tool/method. */
+function outboundScreenShape(toolName, method, input) {
+  if (method === "messaging.send") {
+    return { recipient: input?.channelId ?? "", text: input?.body ?? "" };
+  }
+  if (method === "email.send") {
+    const to = Array.isArray(input?.to) ? input.to.join(", ") : String(input?.to ?? "");
+    const subject = input?.subject ? `Subject: ${input.subject}\n\n` : "";
+    return { recipient: to || String(input?.threadId ?? ""), text: `${subject}${input?.text ?? ""}` };
+  }
+  if (method === "email.draftSend") {
+    // The mail-desk governed send: the CONTENT rides bodyText (not text), and
+    // the recipient set is to+cc+bcc; a bare reply screens under the thread id.
+    const rcpt = ["to", "cc", "bcc"]
+      .flatMap((k) => (Array.isArray(input?.[k]) ? input[k] : []))
+      .join(", ");
+    const subject = input?.subject ? `Subject: ${input.subject}\n\n` : "";
+    return {
+      recipient: rcpt || String(input?.threadId ?? ""),
+      text: `${subject}${input?.bodyText ?? ""}`,
+    };
+  }
+  if (method === "calling.appShareAct") {
+    // The share-step batch: the human-read free text rides highlight `note`s
+    // and `type` texts; screen them concatenated under the call id.
+    const steps = Array.isArray(input?.steps) ? input.steps : [];
+    const text = steps
+      .map((s) => (s && typeof s === "object" ? [s.note, s.text].filter((v) => typeof v === "string" && v).join("\n") : ""))
+      .filter(Boolean)
+      .join("\n");
+    return { recipient: String(input?.callId ?? ""), text };
+  }
+  // org_rpc passthrough of an outbound method: screen the whole params blob.
+  return { recipient: String(input?.channelId ?? input?.to ?? ""), text: JSON.stringify(input ?? {}) };
+}
+
+// ---------------------------------------------------------------------------
+// Local bindings
+// ---------------------------------------------------------------------------
+
+/** Read config/agent.json fail-open (identity hints for org_whoami). */
+function loadAgentJson(agentRoot) {
+  try {
+    const p = join(agentRoot, "config", "agent.json");
+    if (!existsSync(p)) return {};
+    const doc = JSON.parse(readFileSync(p, "utf8"));
+    return doc && typeof doc === "object" ? doc : {};
+  } catch {
+    return {};
+  }
+}
+
+/** org_describe — offline protocol discoverability. */
+function describeProtocol(input = {}) {
+  const family = input && input.family ? String(input.family) : "";
+  const methods = Object.entries(METHODS)
+    .filter(([, d]) => !family || d.family === family)
+    .map(([name, d]) => ({
+      name,
+      family: d.family,
+      scope: d.scope,
+      sideEffecting: !!d.sideEffecting,
+      idempotent: !!d.idempotent,
+    }));
+  const reads = Object.entries(READS)
+    .filter(([p]) => !family || p === family || p.startsWith(`${family}.`))
+    .map(([path, scope]) => ({ path, scope }));
+  return okFrame({
+    protocolVersion: PROTOCOL_VERSION,
+    families: family ? FAMILIES.filter((f) => f === family) : [...FAMILIES],
+    methodCount: methods.length,
+    methods,
+    reads,
+  });
+}
+
+/** org_whoami — config summary + best-effort server-side member resolution. */
+async function whoami(cfg, { fetchImpl, env = process.env } = {}) {
+  const summary = {
+    base: cfg.base,
+    orgId: cfg.orgId,
+    protocolVersion: PROTOCOL_VERSION,
+    tokenPresent: !!cfg.token,
+  };
+  if (!cfg.token || !cfg.orgId) {
+    return okFrame({
+      member: null,
+      ...summary,
+      note: "not fully enrolled — set COHORT_API_TOKEN / COHORT_ORG_ID or run `cohort setup --only org`",
+    });
+  }
+  // Identity hints, client-side: COHORT_AGENT_ID (member id/slug → direct
+  // member GET) → COHORT_AGENT_EMAIL → config/agent.json email. Hint-less
+  // whoami still resolves in a single-agent org (server-side sole-AI_AGENT
+  // fallback).
+  const agentId = env.COHORT_AGENT_ID ? String(env.COHORT_AGENT_ID) : "";
+  const emailHint =
+    (env.COHORT_AGENT_EMAIL && String(env.COHORT_AGENT_EMAIL)) ||
+    (loadAgentJson(cfg.agentRoot).email ? String(loadAgentJson(cfg.agentRoot).email) : "");
+  const res = await fetchSelfProfile({
+    base: cfg.base,
+    apiKey: cfg.token,
+    orgId: cfg.orgId,
+    agentId: agentId || undefined,
+    emailHint: emailHint || undefined,
+    fetchImpl,
+  });
+  if (res && res.ok) return okFrame({ member: res.result, ...summary });
+  // Unresolvable (multi-agent org, no hints) → degrade, never an error frame.
+  return okFrame({
+    member: null,
+    ...summary,
+    note: "member identity unresolved — set COHORT_AGENT_ID to this agent's member id/slug",
+  });
+}
+
+// ---------------------------------------------------------------------------
+// The shared executor (both planes)
+// ---------------------------------------------------------------------------
+
+/** Build a query-string suffix for a read path from a plain object. */
+function withQuery(path, query) {
+  if (!query || typeof query !== "object") return path;
+  const entries = Object.entries(query).filter(([, v]) => v != null && v !== "");
+  if (!entries.length) return path;
+  const qs = entries
+    .map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(String(v))}`)
+    .join("&");
+  return `${path}?${qs}`;
+}
+
+/** Normalise a client.read() outcome into a res frame. */
+function readToFrame(r) {
+  if (r && r.ok) return okFrame(r.payload);
+  return { ok: false, error: (r && r.error) || errFrame("INTERNAL", "read failed").error };
+}
+
+/**
+ * Execute one curated org tool. The ONE executor both planes share: resolves
+ * config (§1.4), screens outbound content (§1.5a), dispatches via the org
+ * client, and returns the standard `{ok,result}|{ok:false,error}` frame.
+ * NEVER throws (matches the client's fail-open style).
+ *
+ * @param {string} name  tool name from ORG_TOOLS
+ * @param {object} input tool input (already schema-shaped by the caller's plane)
+ * @param {object} [o]   { agentRoot?, orgConfig?, fetchImpl?, env?,
+ *                         screenImpl?, bumpImpl? } (injectables for tests)
+ * @returns {Promise<object>} res frame
+ */
+export async function executeOrgTool(name, input = {}, o = {}) {
+  try {
+    const cfg = resolveOrgToolConfig(o);
+    // A curated tool first; else a granted integration tool from the disk cache
+    // (SP5), located under the resolved agent root.
+    const def = orgToolDef(name) || integrationToolDef(name, cfg.agentRoot);
+    if (!def) return errFrame("NOT_FOUND", `unknown org tool ${name}`);
+    if (def.email && !(o.emailAvailable ?? emailFamilyAvailable())) {
+      return errFrame(
+        "NOT_FOUND",
+        `${name}: the email protocol family is not in this SDK's vendored protocol — upgrade @cohortapp/agent-sdk`,
+      );
+    }
+    if (def.artifact && !(o.artifactAvailable ?? artifactFamilyAvailable())) {
+      return errFrame(
+        "NOT_FOUND",
+        `${name}: the artifact protocol family is not in this SDK's vendored protocol — upgrade @cohortapp/agent-sdk`,
+      );
+    }
+    if (def.desk && !(o.desksAvailable ?? deskFamilyAvailable(def.desk))) {
+      return errFrame(
+        "NOT_FOUND",
+        `${name}: the ${def.desk} desk family is not in this SDK's vendored protocol — upgrade @cohortapp/agent-sdk`,
+      );
+    }
+
+    // Offline-capable local tools first.
+    if (name === "org_describe") return describeProtocol(input);
+
+    // Every network tool needs a token; per §1.4 the server stays up and each
+    // call returns a clear error frame instead.
+    if (!cfg.token && name !== "org_whoami") {
+      return errFrame(
+        "UNAUTHORIZED",
+        "no org credential — set COHORT_API_TOKEN or run `cohort setup --only org`",
+      );
+    }
+
+    const callOpts = { base: cfg.base, token: cfg.token, orgId: cfg.orgId, fetchImpl: o.fetchImpl };
+
+    // Send-gate screen for outbound-content tools (BOTH planes, before dispatch).
+    if (def.outbound) {
+      const method = def.binding && def.binding.method;
+      const shape = outboundScreenShape(name, method, input);
+      const gate = await screenOrgOutbound({
+        channel: "cohort-org",
+        recipient: shape.recipient,
+        text: shape.text,
+        agentRoot: cfg.agentRoot,
+        screenImpl: o.screenImpl,
+        bumpImpl: o.bumpImpl,
+      });
+      if (!gate.allow) return errFrame("FORBIDDEN_SCOPE", `send blocked by outbound gate: ${gate.reason}`);
+    }
+
+    switch (name) {
+      case "org_whoami":
+        return whoami(cfg, { fetchImpl: o.fetchImpl, env: o.env || process.env });
+
+      case "org_events_tail": {
+        const q = {};
+        if (input && input.cursor != null) q.cursor = input.cursor;
+        q.limit = Math.min(Number(input?.limit) > 0 ? Number(input.limit) : 500, 500);
+        return readToFrame(await read(withQuery("events", q), callOpts));
+      }
+
+      case "decision_list": {
+        const q = input && input.status ? { status: input.status } : null;
+        return readToFrame(await read(withQuery("decision.list", q), callOpts));
+      }
+
+      case "approval_wait": {
+        const id = input && (input.approvalId || input.id);
+        if (!id) return errFrame("BAD_REQUEST", "approval_wait: approvalId required");
+        const timeoutMs = Number(input?.timeoutMs) > 0 ? Number(input.timeoutMs) : APPROVAL_WAIT_BUDGET_MS;
+        return readToFrame(await approvalWait({ id, timeoutMs }, callOpts));
+      }
+
+      case "org_rpc": {
+        const method = input && input.method ? String(input.method) : "";
+        if (!method || !methodDef(method)) {
+          return errFrame("NOT_FOUND", `org_rpc: unknown method ${method || "(none)"} — see org_describe`);
+        }
+        const params = input && typeof input.params === "object" && input.params ? input.params : {};
+        // Escape-hatch parity: outbound-content methods are screened here too.
+        if (OUTBOUND_METHODS.has(method)) {
+          const shape = outboundScreenShape(name, method, params);
+          const gate = await screenOrgOutbound({
+            channel: "cohort-org",
+            recipient: shape.recipient,
+            text: shape.text,
+            agentRoot: cfg.agentRoot,
+            screenImpl: o.screenImpl,
+            bumpImpl: o.bumpImpl,
+          });
+          if (!gate.allow) return errFrame("FORBIDDEN_SCOPE", `send blocked by outbound gate: ${gate.reason}`);
+        }
+        const opts = { ...callOpts };
+        if (input.idempotencyKey) opts.idempotencyKey = String(input.idempotencyKey);
+        return call(method, params, opts);
+      }
+
+      case "org_read": {
+        const rawPath = input && input.path ? String(input.path) : "";
+        const basePath = rawPath.split("?")[0];
+        if (!basePath || !Object.prototype.hasOwnProperty.call(READS, basePath)) {
+          return errFrame("NOT_FOUND", `org_read: unknown read path ${basePath || "(none)"} — see org_describe`);
+        }
+        return readToFrame(await read(withQuery(basePath, input.query), callOpts));
+      }
+
+      default: {
+        const binding = def.binding || {};
+        if (binding.kind === "read") {
+          return readToFrame(await read(binding.path, callOpts));
+        }
+        if (binding.kind === "rpc") {
+          // SP5: a granted integration tool proxies to integration.invokeTool
+          // with the descriptor's {slug, tool} + the caller's input as `args`,
+          // then unwraps the handler's {ok, output} into the standard frame — a
+          // tool-level failure (incl. a background self-heal) surfaces as an
+          // error frame so both planes flag it as an error, not a bare result.
+          if (def.integration) {
+            const res = await call(
+              "integration.invokeTool",
+              { slug: def.integration.slug, tool: def.integration.tool, args: input || {} },
+              { ...callOpts },
+            );
+            if (!res.ok) return res;
+            const r = res.result;
+            if (r && r.ok === false) {
+              const suffix = r.healing ? " (auto-repair in progress — retry shortly)" : "";
+              return errFrame("INTERNAL", `${r.error || "integration tool failed"}${suffix}`);
+            }
+            return okFrame(r && r.output !== undefined ? r.output : (r ?? null));
+          }
+          const params = { ...(input || {}) };
+          // Business-dedup ids auto-minted where hq expects them. (artifact.*
+          // is sideEffecting:false at the dispatcher — the hq artifact service
+          // self-manages its writes — so these params ARE the dedup lane.)
+          if (name === "messaging_send" && !params.clientMsgId) params.clientMsgId = randomUUID();
+          if (name === "email_send" && !params.idempotencyId) params.idempotencyId = randomUUID();
+          if (name === "artifact_create" && !params.clientMsgId) params.clientMsgId = randomUUID();
+          if (name === "artifact_act" && !params.idempotencyKey) params.idempotencyKey = randomUUID();
+          const opts = { ...callOpts };
+          const mdef = methodDef(binding.method);
+          if (mdef && mdef.sideEffecting && !opts.idempotencyKey) {
+            // A fresh dispatcher key per invocation: idempotent replays are
+            // governed by the BUSINESS id (clientMsgId/idempotencyId), and a
+            // fresh header key avoids the cached-refusal replay trap on
+            // approval re-sends (companion §8.2).
+            opts.idempotencyKey = randomUUID();
+          }
+          return call(binding.method, params, opts);
+        }
+        return errFrame("INTERNAL", `org tool ${name} has no dispatchable binding`);
+      }
+    }
+  } catch (err) {
+    return errFrame("INTERNAL", `org tool ${name} failed: ${err && err.message ? err.message : String(err)}`);
+  }
+}
+
+export default {
+  ORG_TOOLS,
+  getOrgTools,
+  isOrgTool,
+  orgToolDef,
+  loadIntegrationToolsFromDisk,
+  integrationToolDef,
+  OUTBOUND_METHODS,
+  emailFamilyAvailable,
+  artifactFamilyAvailable,
+  deskFamilyAvailable,
+  resolveOrgToolConfig,
+  executeOrgTool,
+  DEFAULT_COHORT_BASE,
+};