@mhome/app-facade-protocol 1.57.0 → 1.60.1

package/README.md

@@ -53,8 +53,30 @@ and MCP public results use essential; internal workflow reads use full. The CLI
 uses `--response-detail full|essential`, and the bundled external Skill requests
 essential. Dashboard essential projection keeps card identity, title, type,
 layouts and view choices, excluding renderer configuration and resource payloads.
-Other targets currently retain their business fields in YAML; essential does not
-promise a smaller field set for every domain. Targets own that selection.
+Device brief-list essential retains identity, room, capability IDs, Integration and
+availability, omitting `connectId`, `manufacturerId` and `manufacturerName`.
+Selected Device detail, history, recent activity and mutation outcomes keep their
+public business fields. Device bulk list remains a CLI-only surface.
+Space preference updates retain only the submitted preference keys in essential,
+with `updatedFields` unchanged. Location updates omit the previous name/address;
+the current Location remains complete. Hub, Pod, Messaging identity/account reads
+and compact mutation DTOs retain their business fields, including unknown states,
+source errors, failed invitations, one-use commands and expiry.
+
+Host list essential retains every row, observation error, component state, permission
+and operation outcome. It omits the runtime root and duplicate per-file component
+checks. Completed service installation results omit Catalog receipts and downloadable
+assets/manifests from the plan, retaining selected components, versions, compatibility,
+actions and warnings. Queued/running/failed remain resource states, never inferred success.
+
+Card skin selection and release-list essential omit delivery URLs, entry files,
+asset manifests and renderer configuration schemas. Selected release detail keeps
+`configSchema` (including defaults) so callers can construct valid overrides.
+Revisions, installation IDs, existing override config and supported patterns remain.
+Empty mutation acknowledgements remain empty; they do not invent a new revision.
+
+Targets without a dedicated projection retain their business fields in YAML;
+essential does not promise a smaller field set for every domain. Targets own that selection.
 
 The [response schema](schema/facade-response.v1.schema.json) and shared
 [presentation fixtures](fixtures/presentation/cases.json) define the wire

package/contract/pod-directory-v1.md

@@ -0,0 +1,51 @@
+# Pod directory
+
+`/app/pod/list` is a Space-mode-routed, direct, read-only Facade call with empty
+input. It requires a personal User and read access to the current Space. It combines
+all completed personal Pod registrations owned by that User with registered
+Space-owned Pods in that Space. Another User's personal Pods and other Spaces'
+Pods are excluded. Offline registrations remain; incomplete commissioning attempts
+and nearby discovery candidates are not registrations.
+
+A local Space composes this result in Core, reading its own Space inventory and
+obtaining personal registrations through the authenticated private cloud control
+bridge. A cloud Space composes it in cloud. LLM placement does not change this
+owner. Cloud entrypoints forward local-Space business to Core; only an unavailable
+Hub transport permits the explicit read-only registration fallback below.
+
+The result contains `pods`, `scopeId`, `observedAtMs`, and `sourceErrors`.
+Every row contains `registrationId`, `clientMode` (`user` or `space`), `registered`
+(true), and `connection` with `scopeId`, `state` (`connected`, `disconnected`, or
+`unknown`), and `source` (`hub`, `cloud`, or `unavailable`). Space rows also contain
+`scopeId` and `appClientId`. Personal rows contain the saved `name`, `deviceId`,
+`model`, `platform`, `firmwareVersion`, `issuedAt`, and `activatedAt`.
+No tokens, enrollment grants, credential IDs or private keys are returned.
+
+Connection is an observation in the indicated Space, not global power state.
+Personal registration IDs are keyed by User and device public-key fingerprint;
+personal connection IDs do not carry that fingerprint. The directory does not
+join them by name or hardware ID. Personal connection state is therefore unknown.
+Space registration IDs are their authenticated appClientId and can be correlated.
+When a local Hub cannot be queried, the cloud's persisted Space registrations
+remain visible with unknown connection state and `sourceErrors.space`. The cache
+may omit registrations not yet synchronized; it must not imply a complete live
+snapshot. Cloud presence lookup failures likewise retain saved Space records
+as unknown, with an explicit source error. A successful empty presence lookup
+can establish disconnection. Registration read failures fail the call instead
+of fabricating an empty inventory; authorization and request failures remain errors.
+
+`/app/pod/space/list` is an internal composition target, not a separate Agent,
+MCP or CLI operation. Scope-mode routing reads the Hub for a local Space or cloud
+inventory for a cloud Space. It returns only Space-owned Pod registrations.
+UI, Agent, MCP and CLI all use `/app/pod/list`; UI groups by clientMode.
+
+`/app/pod/rename` is a direct, idempotent write with exactly `registrationId` and
+`name` (trimmed, 1–64 characters). The authenticated User is the owner; request
+input cannot select a User. It updates only that personal registration's display
+name and returns `{registrationId,name}`. It works while the Pod is offline and
+does not change credentials, ownership, networking or the Pod's local settings.
+It has no prepare/commit or HITL requirement. Space Pod rename is not provided.
+The CLI is `meow pod rename <registrationId> <name>`; Agent/MCP use `pod_rename`.
+
+Personal login approve/redeem and Space commissioning retain their existing
+protocols. Factory reset is available only on the Pod itself, not remotely.

package/fixtures/authorization/decisions.json

@@ -1,6 +1,6 @@
 [
   {
-    "name": "owner:/app/device/list",
+    "name": "owner:/app/device/brief/list",
     "principal": {
       "kind": "user",
       "userId": "owner"
@@ -8,7 +8,7 @@
     "memberRole": "OWNER",
     "tenantId": "tenant",
     "scopeId": "space",
-    "target": "/app/device/list",
+    "target": "/app/device/brief/list",
     "allowed": true
   },
   {
@@ -84,7 +84,7 @@
     "allowed": false
   },
   {
-    "name": "member:/app/device/list",
+    "name": "member:/app/device/brief/list",
     "principal": {
       "kind": "user",
       "userId": "member"
@@ -92,7 +92,7 @@
     "memberRole": "MEMBER",
     "tenantId": "tenant",
     "scopeId": "space",
-    "target": "/app/device/list",
+    "target": "/app/device/brief/list",
     "allowed": true
   },
   {
@@ -168,7 +168,7 @@
     "allowed": false
   },
   {
-    "name": "removed:/app/device/list",
+    "name": "removed:/app/device/brief/list",
     "principal": {
       "kind": "user",
       "userId": "former"
@@ -176,7 +176,7 @@
     "memberRole": null,
     "tenantId": "tenant",
     "scopeId": "space",
-    "target": "/app/device/list",
+    "target": "/app/device/brief/list",
     "allowed": false
   },
   {
@@ -252,7 +252,7 @@
     "allowed": false
   },
   {
-    "name": "space:/app/device/list",
+    "name": "space:/app/device/brief/list",
     "principal": {
       "kind": "space",
       "tenantId": "tenant",
@@ -261,7 +261,7 @@
     "memberRole": null,
     "tenantId": "tenant",
     "scopeId": "space",
-    "target": "/app/device/list",
+    "target": "/app/device/brief/list",
     "allowed": true
   },
   {
@@ -343,7 +343,7 @@
     "allowed": false
   },
   {
-    "name": "space-cannot-borrow-owner:/app/device/list",
+    "name": "space-cannot-borrow-owner:/app/device/brief/list",
     "principal": {
       "kind": "space",
       "tenantId": "tenant",
@@ -352,7 +352,7 @@
     "memberRole": "OWNER",
     "tenantId": "tenant",
     "scopeId": "space",
-    "target": "/app/device/list",
+    "target": "/app/device/brief/list",
     "allowed": true
   },
   {
@@ -434,7 +434,7 @@
     "allowed": false
   },
   {
-    "name": "foreign-space:/app/device/list",
+    "name": "foreign-space:/app/device/brief/list",
     "principal": {
       "kind": "space",
       "tenantId": "tenant",
@@ -443,7 +443,7 @@
     "memberRole": null,
     "tenantId": "tenant",
     "scopeId": "space",
-    "target": "/app/device/list",
+    "target": "/app/device/brief/list",
     "allowed": false
   },
   {
@@ -525,7 +525,7 @@
     "allowed": false
   },
   {
-    "name": "foreign-tenant:/app/device/list",
+    "name": "foreign-tenant:/app/device/brief/list",
     "principal": {
       "kind": "space",
       "tenantId": "other",
@@ -534,7 +534,7 @@
     "memberRole": null,
     "tenantId": "tenant",
     "scopeId": "space",
-    "target": "/app/device/list",
+    "target": "/app/device/brief/list",
     "allowed": false
   },
   {