@mhome/app-facade-protocol 1.126.0 → 1.127.1

package/contract/agent-llm-v1.md

@@ -0,0 +1,56 @@
+# Agent LLM settings
+
+`agent_llm` and `schema/agent-llm.v1.schema.json` own the public business DTOs.
+The standard Facade response envelope carries these values in `data` for Full;
+Essential uses the shared Agent projection and YAML presentation.
+
+## Read ownership
+
+| Target | Input | Result |
+| --- | --- | --- |
+| `/app/agent/llm/summary` | Empty | `Summary` for the active `llmMode` |
+| `/app/agent/llm/provider/list` | Optional `llmMode`; defaults to active mode | `ProviderList` for the requested mode |
+| `/app/agent/llm/provider/get` | `provider`, `llmMode` | `ProviderDetail`, used by UI Operations and native Agent verification |
+| `/app/agent/llm/mapping/list` | Empty | `MappingList` for the active `llmMode` |
+
+Reading a mode does not activate it. Provider reads do not initialize mappings.
+The summary has no embedded inactive Local settings. A local Space's UI can read
+Local providers explicitly while its active LLM mode is Cloud. A cloud Space
+cannot hold Local provider configuration.
+
+Provider catalog facts and saved configuration are distinct. `configuration` is
+present for Local providers and null for platform-managed Cloud providers.
+`hasCredential` means a stored credential exists; it is not a remote authentication
+check. `ready` and `readinessByUseCase` describe discovery and runtime availability.
+Public credential settings contain only region, credential profile and workspace
+ID. Keys, tokens, transport settings and provider model aliases remain private.
+
+Models appear once in `providerModels`, or in `models` for a single provider.
+`contextWindowTokens` preserves catalog information; unknown values remain null.
+`generationControls` describes controls supported by both model and execution
+backend. Metadata source is independent of LLM mode: Local provider catalog
+metadata can be supplied by the cloud.
+
+## Writes and mode selection
+
+Mode selection changes the active configuration. It does not delete or overwrite
+Cloud mappings, Local mappings or Local provider credentials. Mapping writes use
+the active mode. Credential changes always target Local configuration, require a
+local Space and a human UI/CLI caller, and do not switch modes. Native Agent
+UserActions hand off to the Provider Operation; MCP and external Skills cannot
+mutate provider credentials.
+
+The frontend settings controller owns the authoritative loaded snapshot. A failed
+mode write retains it. A successful write clears the previous mode's snapshot
+before reloading; reload failure reports that the write succeeded and offers retry.
+Provider Operations own a separate single-provider controller and never fetch the
+whole summary or session policy.
+
+## Presentation
+
+Full preserves the public business DTO, including nullable fields. Essential
+omits absent values and internal catalog/configuration metadata while retaining
+mode, provider identity, configuration/readiness, model choices and actionable
+model controls. Both surfaces preserve result status, warnings and errors.
+
+Each use case has one `requirements` object and one effective provider/model selection. Mapping writes accept `useCase`, `provider`, `model` and generation preferences. Requests and execution snapshots carry no model tier. Local/Cloud execution selection remains independent.

package/contract/agent-profile-media-v1.md

@@ -0,0 +1,39 @@
+# Agent Profile media
+
+Memory and Identity stay Space-shared Markdown strings. Public get responses use
+`{ content }`; save keeps its completion-only success envelope. The same Facades
+serve UI, CLI, MCP and native Agent workflows; only the native update tool merges
+new facts before calling save. There is no separate image-profile DTO.
+
+An actual CommonMark image node `![description](meow-artifact://...)` is a retained
+reference. Reference-style images are supported and canonicalized inline. Prose,
+plain links and fenced/inline code are not image ownership declarations. Image
+labels are descriptive; adjacent prose records the approved identity or fact.
+No XML tag, signed delivery URL, local path or embedded binary is persisted.
+
+The authoritative Space owner validates each reference's tenant, Space and Image
+kind, reads its source bytes and creates an independent manual/standard Artifact
+with a random Profile creation identity. Each document keeps its own reference
+set. Existing references owned by that same document are reused. New references
+from another document are copied, so deleting one document's reference cannot
+invalidate another's. Source expiration/deletion does not affect committed copies.
+
+Text, owned URIs, pending retired URIs and a new internal revision publish in one
+conditional write. A stale save fails and requires a new read/reconciliation. A
+known rejection cleans newly created copies only; an uncertain publication error
+never deletes potentially committed content. This revision is not a public merge
+protocol and does not prevent a caller from submitting already-stale text.
+
+After publication, context is invalidated and removed owned images are deleted.
+Failed retired deletions remain recorded and are retried on the next save. The
+save worker completes publication/cleanup after caller cancellation. Process
+termination before publication or failed cleanup of unpublished copies can leave
+unreferenced Artifacts; there is no global reference collector or cross-store
+transaction. Storage failures never justify deleting possibly committed content.
+
+Callers re-read after saving to obtain canonical rewritten URIs. Full reads return
+structured `{content}` and essential reads serialize the same complete text,
+including multiline Markdown. Neither mode embeds image bytes. Native `media`
+Skill `artifact_resolve` attaches actual Image content to the next model request;
+CLI hosts must resolve and view an output file or supported expiring image URL;
+MCP returns its existing image content block. Resolving is scoped, not public access.

package/contract/authorization-v1.md

@@ -0,0 +1,57 @@
+# Business authorization
+
+`manifest/authorization.v1.json` is the sole operation policy catalog consumed
+by MeowCore and Lion. Rust uses `authorization::required`; Lion loads this same
+file from the checksum-pinned protocol package into its runtime resources.
+Both run `fixtures/authorization/decisions.json`. There is no permissive default.
+
+The verified principal is either User or Space. User operations require a User
+and retain their domain ownership checks. Space operations use READ, WRITE and
+MANAGE: current members have WRITE, owners have MANAGE, and a Space principal
+has WRITE only in its exact tenant and Space. A supplied owner role never
+promotes a Space principal. Personal credentials, enrolling users and billing
+accounts cannot substitute for the principal.
+
+The `nodePrefix` is explicit delegation, not a wildcard execution grant. Static
+operations take precedence. The authoritative Core must also enforce the exact
+operation policy from the currently authenticated Node registration before
+forwarding. MCP grants and Agent tool allowlists are additional restrictions.
+
+User and Agent entrypoints use the same policies. Agent execution retains its
+verified originating principal, including through cloud forwarding, prepared
+actions and retries. Each execution rechecks current membership; confirmation
+does not freeze or elevate permissions. Core durable actions store a typed
+principal; cloud personal actions bind the verified User. Core records missing
+their principal are rejected without legacy conversion.
+
+`DelegatedCall` is private to the authenticated Lion-to-Core bridge. Its
+`authority` is either `caller` with the original principal, or `service` for
+the exact `serviceOperations` allowlist. Client input never accepts this
+envelope, and Agent forwarding cannot select service authority. `MwsClientInfo`
+is routing metadata, not the authority for these business calls.
+Internal `/dispatch/app/*` calls accept direct domain execution only. Public
+`/invoke/app/*` forwarding instead carries the complete `ForwardedCall` and enters
+the same Core action orchestration as LAN calls. These are distinct private
+operations, not compatibility formats. The latter preserves Client identity or
+trusted MCP/Agent invocation binding and returns a tagged JSON response containing the complete Facade result.
+User Client cloud ingress and MCP require a User principal. A verified Agent run
+may carry its original Space principal only back to that bound Space; it does
+not issue a cloud credential to a Space Client or invent an acting User.
+
+Prepared state belongs to the operation's business executor. Changing Client
+transport does not create a second action record. MCP's cloud continuation owns
+its interaction/grant lifecycle, not a copy of Core business state. Agent adapters
+carry the executor's prepared reference rather than querying a cloud action table.
+Deploy this contract and its consumers together. Drain or expire pending
+interactions before cutover; do not translate old references, migrate action rows,
+or automatically replay operations after uncertain delivery.
+
+Host administration retains its independent authentication and ownership checks;
+the User policies on Host operations do not grant Host administration. Space Pod
+enrollment requires the current Space owner, as defined by its commissioning
+contract. User Pod approval uses the current personal login.
+
+Old cloud dispatch envelopes and duplicated per-runtime policy tables are not
+supported. Publish the Foundation package and synchronize consumers before a
+runtime deployment. A Gradle source override is available only for explicit
+joint source validation, never as an automatic production fallback.

package/contract/client-appearance-v1.md

@@ -0,0 +1,32 @@
+# Client appearance
+
+`/app/client/appearance/report` uses the canonical FacadeCall envelope and the
+normal Space-mode execution rule. User Client reports may enter directly or
+through authenticated Cloud forwarding, preserving the original live Client identity. Its input is the six-field snapshot in
+`schema/client-appearance.v1.schema.json`; success returns `{}`.
+
+Only the authenticated, live UI Client may report its own snapshot in the Space
+it is displaying. The installation and transport identity come from ingress,
+never from input. Both User and Space Clients use the existing Space admission.
+The report forwards to `basic.app.state.appearance` subscribers; it does not
+create backend preference storage. Clients report after local settings or
+capability changes, system appearance changes, and connection/focus restoration.
+
+The public capabilities are `basic.app.state.appearance` and
+`basic.app.command.setAppearance`. Discovery is part of those schemas. Backend
+native functions invoke `/app/invoke/discovery.appearance`,
+`/app/invoke/state.appearance`, or `/app/invoke/command.setAppearance` with a
+Space-scoped server request. The Client replies once over the original connection
+with the original target, signature, Space, and source peer. An error payload is
+an invocation failure, including for commands without response data.
+
+Changes validate the entire patch before applying it to the Client's persisted
+Space preferences. Omitted settings are unchanged; no reset or separate options
+operation is provided. `background` is the public name; opacity is retained for
+Classic backgrounds while `cardOpacityApplied` is false. Presets come from the
+target Client's discovery rather than a second backend catalog.
+
+A persistent appearance subscription resolves `a:current` before calculating its
+endpoint and storing its request. The first resolution is retained in condition
+memory, so both re-evaluation and recovery reuse the concrete Client identity
+without requiring the creator's transient connection context.

package/contract/client-page-v1.md

@@ -0,0 +1,42 @@
+# Client page navigation
+
+`/app/client/page/report` forwards the authenticated Client's observed navigation
+snapshot to `basic.app.state.page` subscriptions in its focused Space. It uses
+the FacadeCall envelope and spaceRead authorization, accepts no caller-selected
+Client identity, and stores no second navigation state. The canonical payload
+is `schema/client-page.v1.schema.json`; success returns `{}`.
+
+`current` describes the topmost registered navigation view. A drawer requires
+`base`, the underlying full page. Page-specific navigation identifiers belong
+in Dynamic `payload`; drafts, page contents, transient menus and dialogs are
+excluded. Unregistered views use `page: unknown`.
+
+`basic.app.state.page` and `basic.app.command.openPage` use client-dependent
+page discovery. Native functions request `/app/invoke/discovery.page`,
+`/app/invoke/state.page` and `/app/invoke/command.openPage`. Commands reply only
+when the target is observed active; timeout does not prove navigation was
+cancelled. State reporting converges to the latest snapshot after reconnect;
+it is not a durable log of every intermediate transition.
+
+Persistent subscriptions bind `a:current` to a concrete Client before endpoint
+hashing. Deploy the manifest, both runtimes and Client page host together.
+
+## Current-client operations
+
+| Target | Input definition | Output definition | Admission |
+| --- | --- | --- | --- |
+| `/app/client/page/list` | `emptyRequest` | `catalogResponse` | spaceRead |
+| `/app/client/page/current` | `emptyRequest` | `navigationResponse` | spaceRead |
+| `/app/client/page/open` | `openRequest` | `navigationResponse` | spaceWrite |
+
+These direct-only operations use the trusted invocation's current Client and Space.
+Input never selects a Client or Space, a transport target, a URL, or a raw app route.
+Missing/offline Client context fails without selecting another Client. The executor
+follows Space mode and reuses AppInvoke's scoped request/reply transport. Page
+availability and payload validation belong to the Client's single page registry.
+A successful open returns the observed navigation state, not just delivery acceptance.
+Navigation blockers, redirects and errors propagate. No HITL, persisted operation,
+extra navigation state or automatic retry is introduced.
+
+The native Agent exposes these operations through its bundled `app` Skill. There
+are no dedicated MCP tools or CLI commands for them.

package/contract/host-directory-v1.md

@@ -0,0 +1,18 @@
+# Host registration directory
+
+`/app/host/directory/list` takes empty input and reads the caller's Admin Host registrations
+and the current Space's Host registrations (Space member required). The result is
+`{hosts, observedAtMs}`. Each row contains `hostId`, `hostName`, `env`, `mode`,
+`registered: true`, `reachability: "unknown"`, `authorizationState: "unknown"`.
+
+These are historical successful registrations, including offline Hosts. They do
+not grant current access or attest that an administrator remains in the Host ACL.
+Names are registration snapshots. No keys, tokens, signed challenges or ACLs leave
+this directory. Native list composition adds current observations using existing
+Host authentication; only authenticated live results establish current access.
+
+A signed-in personal Client may omit the Space envelope to read only its Admin
+registrations, including before its first Space exists. With a Space envelope,
+Space membership is required before that Space's directory is read.
+Commissioning, claims, permission prompts and runtime installation are unchanged
+by this directory contract.

package/contract/host-management-v1.md

@@ -0,0 +1,54 @@
+# Host management
+
+All operations require a personal User principal. They accept business input only;
+Host authentication, identity pinning and transport selection remain internal.
+The request schemas are in `schema/host-management.v1.schema.json` and the public
+targets in the `hostManagement` manifest section.
+
+`/app/host/list` returns registrations together with current observations and an
+individual `detail` observation. Offline records remain. Each observation has
+`status`, `data`, `stale` and an error on failure. Host metadata never grants
+management access. Native list implementations use `/app/host/directory/list` as
+the historical input, avoiding a request back into the public list composition.
+
+Business execution follows Space mode, independently of LLM placement:
+
+- Local Space: Core composes the list and sends Host commands through its existing
+  authenticated LAN transport. Remote App/MCP requests reach that same Core via
+  cloud forwarding. Core obtains cloud-owned directory metadata and user grants
+  through the private `/bridge/management/control` endpoint; this endpoint neither
+  dispatches Host commands nor impersonates a Client.
+- Cloud Space: cloud executes business through the initiating personal desktop
+  Client. No other online App is selected. MCP, web and mobile have no such
+  transport and management calls fail if no suitable route exists. List still
+  returns registrations with unavailable observations.
+
+Host mode, ACL and Space ownership remain authoritative. The private bridge is
+bound to its authenticated tenant/Space and rechecks personal User read access;
+existing grant issuers check Host authorization. The fixed operations are Host
+and personal Pod directory reads, Host access issuance, administrator application
+preparation and signed receipt confirmation. It accepts no arbitrary target.
+Public signing endpoints remain Client-only and are not Agent/MCP tools.
+
+The private `/app/host/execute` Client request is a fixed management transport,
+not a capability or public Facade. It accepts no service switch or admin removal.
+A missing route fails; a mutation is never replayed through another transport.
+If a cloud entrypoint cannot reach a local Space's Core, list alone may return
+cloud registrations with unavailable observations and `sourceErrors.hub`.
+Authorization errors and registration read failures remain errors.
+
+Administrator request/approval credentials and signed receipts remain internal.
+A successful approval receipt must be confirmed before `complete: true`; pending
+requests do not grant access. Results exclude credentials, including nested ones.
+
+Service install prepares exactly the selected service and submits its existing
+Host operation. Restart uses a stable invocation-derived operation identity.
+The returned Host operation state is `queued`, `running`, `succeeded` or `failed`;
+acceptance is not completion. List details include current operations. There is
+no public plan, start or operation-polling tool. The local CLI waits internally.
+
+Permission reads never prompt. Permission requests belong to the target's local
+UI/CLI. Native Agent UserAction opens the existing desktop permission UI, then
+reads actual Host state on continuation. MCP cannot invoke that local interaction.
+Service enable/disable is reserved for human UI/CLI. These management entrypoints
+do not alter commissioning, claim proofs, Admin, SpaceSelf or SpaceDep semantics.

package/contract/nfc-v1.md

@@ -0,0 +1,48 @@
+# NFC management v1
+
+The six shared App Facades use the canonical `control`/`input` request and
+`status`/`data`/`error`/`warnings` result. Identity and Space authorization come
+from transport context, never input. Source directory is cloud-owned; all other
+operations use the Space's authoritative Core or cloud executor. The schema is
+`schema/nfc.v1.schema.json`; Rust DTOs and the Lion Java binding are checked against
+`fixtures/nfc.conformance.json`. Schema validates structural shape; normalization
+also checks whitespace, source identity uniqueness and merged policy constraints.
+
+| Target | Input | Full success data | Mode |
+| --- | --- | --- | --- |
+| `/app/nfc/list` | optional `createState`: active (default), pending, all | `{nfcTags:[{tagId,spaceId,name,description,policy,trustedSources,createState,createdAt,lastUsedAt}]}` | direct, Space read |
+| `/app/nfc/sources/list` | `{}` | `{sources:[{sourceType,sourceId,sourceName}]}` | direct, Space read, cloud |
+| `/app/nfc/create` | required name, policy; optional description, trustedSources | `{tagId,createState:"pending",writePayload}` | direct, Space write |
+| `/app/nfc/activate` | `{tagId}` | no data; `{status:"success"}` | direct, Space write |
+| `/app/nfc/update` | tagId and at least one of name, description, policy, trustedSources | no data | direct, Space write |
+| `/app/nfc/delete` | `{tagIds:[...]}`, 1–100 unique IDs | no data | direct or prepared, Space write |
+
+Name is trimmed, nonempty and unique case-insensitively within the tenant/Space,
+including pending records. Duplicate create never removes or replaces pending.
+Description defaults to empty; update omission preserves, empty clears, null fails.
+Unknown fields and client-supplied lifecycle/timestamps fail.
+Policy is ALL_PHONE or CUSTOM_PHONE. Sources have type phone and a nonempty unique
+sourceId, plus optional sourceName (default empty). ALL_PHONE clears sources;
+CUSTOM_PHONE requires at least one after patching. Source directory only includes
+enabled registered phones advertising event.nfc. It is a discovery snapshot,
+not an online status or runtime permission guarantee.
+
+Create only creates a record. `writePayload` is `mhomeai://nfc/{spaceId}:{tagId}`.
+A phone writes that exact content; activate is called only on physical success.
+Only activation changes pending to active and sets createdAt. Repeating activation
+preserves createdAt and lastUsedAt. Cancelled/failed physical writes explicitly
+delete pending; read/list/sync do not clean it up. No TTL or background cleanup.
+Update patches configuration without activating or resetting metadata.
+Delete missing IDs is idempotent, has no deleted-count guarantee, does not erase
+physical tags, and does not promise cross-record atomicity on cloud storage.
+Prepared preview includes requested IDs, found state, name and creation state;
+last-use observations do not invalidate a preview.
+
+Full list timestamps are Unix milliseconds. Essential retains all business fields
+in YAML, localizes positive timestamps, and preserves zero as unknown. Mutations
+with no business result return only canonical status in either detail mode.
+
+Physical tap (`/nfc/tap` on Core, `/api/v1/nfc/tap` on cloud/mobile) remains an
+authenticated native ingress, not a management Facade or CLI/MCP tool. It checks
+Space, active state and source policy. Successful acceptance observes lastUsedAt
+best effort; persistence failure does not reject the tap. List and sync are read-only.

package/contract/wave-v1.md

@@ -0,0 +1,33 @@
+# Native Wave LAN admission
+
+These Hub-routed App Facades require current-Space Manage access and an active
+local Hub. They do not make Wave devices Hosts, Nodes or Plugins. No device URL,
+Space/Hub selector, grant, certificate or private key is an input/output.
+
+- `/app/wave/discover`: `{}` -> `{candidates:[{candidateId,deviceId,proof,purpose}]}`.
+  Core browses `_meow-wave._tcp.local.` and identifies bounded LAN candidates.
+  Results are untrusted location hints, scoped to this caller, Space and Hub
+  generation, expiring after two minutes. They never grant operation authority.
+- `/app/wave/pair`: `{candidateId,pin?}` -> AdmissionResult below. This is a direct
+  authenticated App interaction; Agent/MCP/cloud delegation cannot submit PINs.
+  PIN6 is required when the selected device requires it. Omitting it is allowed
+  only for an explicitly opened initial local-claim window. No fallback occurs.
+  Retry reconciles an existing candidate; an uncertain result never rotates a key.
+- `/app/wave/list`: `{}` -> `{bindings:[{deviceId,grantState}]}`. States are
+  `candidate` or `committed`; this is authorization bookkeeping, not Device/Twin
+  inventory, online state or evidence that a candidate committed on the device.
+- `/app/wave/refresh`: `{deviceId}` -> AdmissionResult. Reconcile the same saved
+  credential, validate full Entity self-description against installed contracts,
+  then use ordinary Twin source synchronization. It cannot open a pairing window.
+
+AdmissionResult is `{deviceId,grantState,inventoryState,entityIds,reason?}`.
+`inventoryState:ready` means existing inventory synchronization completed;
+`unavailable` with a committed grant is a partial result. Authorization may have
+committed even when metadata/contract acquisition or inventory synchronization
+fails. A later refresh uses the existing grant, without consuming another slot.
+Missing/uninstalled or incompatible contracts never install code automatically.
+Normal Device/capability APIs own subsequent observations, control and subscriptions.
+
+Credentials remain Core-local, outside ordinary Connection/privateData/Twin/sync.
+Explicit Hub migration is outside this increment. Removal/invitation UI, BLE and
+physical target acceptance remain separate increments. Commands are never replayed.

package/manifest/app-facade.v1.json

@@ -1,6 +1,6 @@
 {
   "manifest": "mhome.app-facade.v1",
-  "contractVersion": "1.126.0",
+  "contractVersion": "1.127.1",
   "callSchema": "schema/facade-call.v1.schema.json",
   "routing": "manifest/routing.v1.json",
   "routingSchema": "schema/routing.v1.schema.json",
@@ -443,7 +443,9 @@
     },
     "deviceSources": {
       "contract": "contract/entity-v1.md",
-      "uiRequestTargets": ["/app/device/source/resolve"]
+      "uiRequestTargets": [
+        "/app/device/source/resolve"
+      ]
     },
     "entity": {
       "contract": "contract/entity-v1.md",
@@ -473,6 +475,15 @@
       "eventTargets": [
         "/user/navigation/changed"
       ]
+    },
+    "wave": {
+      "contract": "contract/wave-v1.md",
+      "requestTargets": [
+        "/app/wave/discover",
+        "/app/wave/pair",
+        "/app/wave/list",
+        "/app/wave/refresh"
+      ]
     }
   },
   "authorization": "manifest/authorization.v1.json",

package/manifest/authorization.v1.json

@@ -1,5 +1,5 @@
 {
-  "contractVersion": "1.126.0",
+  "contractVersion": "1.127.1",
   "operations": {
     "/app/agent/context/get": "spaceRead",
     "/app/agent/credit/usage": "spaceRead",
@@ -368,7 +368,11 @@
     "/pod/talk/speech/prepare": "spaceWrite",
     "/pod/talk/turn/submit": "spaceWrite",
     "/pod/talk/view/get": "spaceRead",
-    "/app/entity/state/get": "spaceRead"
+    "/app/entity/state/get": "spaceRead",
+    "/app/wave/discover": "spaceManage",
+    "/app/wave/pair": "spaceManage",
+    "/app/wave/list": "spaceManage",
+    "/app/wave/refresh": "spaceManage"
   },
   "nodePrefix": "/app/plugin/",
   "serviceOperations": [

package/manifest/host-provision-targets.v1.json

@@ -1,6 +1,6 @@
 {
   "manifest": "mhome.host-provision.targets.v1",
-  "contractVersion": "1.126.0",
+  "contractVersion": "1.127.1",
   "contract": "contract/host-provisioning-v1.md",
   "localTargets": [
     "/local/host/provision/start",

package/manifest/hub-targets.v1.json

@@ -1,6 +1,6 @@
 {
   "manifest": "mhome.hub.targets.v1",
-  "contractVersion": "1.126.0",
+  "contractVersion": "1.127.1",
   "appTargets": [
     "/app/hub/get",
     "/app/hub/remove",

package/manifest/pod-targets.v1.json

@@ -1,6 +1,6 @@
 {
   "manifest": "mhome.pod.targets.v1",
-  "contractVersion": "1.126.0",
+  "contractVersion": "1.127.1",
   "contract": "contract/pod-commissioning-v1.md",
   "localTargets": [
     "/local/pod/discovery/start",

package/manifest/routing.v1.json

@@ -1,6 +1,6 @@
 {
   "manifest": "mhome.app-facade.routing.v1",
-  "contractVersion": "1.126.0",
+  "contractVersion": "1.127.1",
   "targetPrefix": "/app/",
   "default": {
     "execution": "spaceMode"
@@ -82,7 +82,8 @@
       "/app/object-storage/",
       "/app/runtime/",
       "/app/system/hosts/",
-      "/app/person/"
+      "/app/person/",
+      "/app/wave/"
     ],
     "requestPlacementPrefixes": [
       "/app/messaging/"

package/manifest/targets.v1.json

@@ -1,6 +1,6 @@
 {
   "manifest": "mhome.messaging.targets.v1",
-  "contractVersion": "1.126.0",
+  "contractVersion": "1.127.1",
   "requestTargets": [
     "/app/messaging/provider/list",
     "/app/messaging/provider-account/list",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mhome/app-facade-protocol",
-  "version": "1.126.0",
+  "version": "1.127.1",
   "description": "Build-time protocol artifacts for mhome.app-facade",
   "license": "Apache-2.0",
   "repository": {

package/protocol.json

@@ -1,6 +1,6 @@
 {
   "protocol": "mhome.app-facade",
-  "contractVersion": "1.126.0",
+  "contractVersion": "1.127.1",
   "manifest": "manifest/app-facade.v1.json",
   "schemas": {
     "storage": "schema/storage.v1.schema.json",