@mmerterden/multi-agent-pipeline 20.30.0 → 20.34.0

package/pipeline/commands/multi-agent/test-gen/SKILL.md

@@ -47,9 +47,32 @@ Scripts: `test-gen-gate.mjs` (artefact, handle and write gates),
 ## Step 1 - Prepare
 
 1. Repo: `--repo`, else the current directory; confirm it in one line.
-   Platform: `--platform`, else detect as `/multi-agent:test` does. Run id
-   `tg-<timestamp>`; `RUN="$HOME/.claude/logs/test-gen/<repo>/<timestamp>"`,
-   created with `mkdir -p "$RUN"`.
+   Platform: `--platform`, else detect as `/multi-agent:test` does. One
+   timestamp names the run everywhere: `TS="$(date +%Y%m%d%H%M%S)"`, run id
+   `tg-$TS`, `RUN="$HOME/.claude/logs/test-gen/<repo>/$TS"`, created with
+   `mkdir -p "$RUN"`.
+   Register the run so its progress shows wherever runs are read (the office
+   panel, `/multi-agent:status`), with one step per stage below:
+
+   ```bash
+   TG_ID="tg-$TS"
+   S="${LOGS_ROOT:-$HOME/.claude/logs/multi-agent}/$TG_ID"; mkdir -p "$S"
+   printf '{"taskId":"%s","mode":"test-gen","status":"in_progress","currentPhase":0}' "$TG_ID" \
+     | node "$HOME/.claude/scripts/write-state.mjs" "$S/agent-state.json" >/dev/null
+   export MULTI_AGENT_TASK_ID="$TG_ID"
+   bash "$HOME/.claude/scripts/phase-tracker.sh" init "$TG_ID"
+   for p in "0:Prepare" "1:Inventory" "2:Discovery" "3:Handles" "4:Tests" "5:Report"; do
+     bash "$HOME/.claude/scripts/phase-tracker.sh" add "${p%%:*}" "${p#*:}"
+   done
+   bash "$HOME/.claude/scripts/phase-tracker.sh" update 0 in_progress
+   ```
+
+   Each step below starts with `update <N> in_progress` and ends with
+   `update <N> completed` (Step 5 and Step 6 share step 4), every call prefixed
+   `MULTI_AGENT_TASK_ID=<the tg- id, written out> MULTI_AGENT_STRICT_TASK_ID=1`
+   since it runs in a new shell where `$TG_ID` is gone, and on
+   Claude Code each gets a task-widget tile named as its tracker line
+   (`tracker-contract.md`, "Call pattern").
 2. Toolkit: `test_results_classify`, `coverage_gap` and `ui_locator_codegen`
    need `@mmerterden/multi-agent-toolkit-mcp` >= v3.25.0. Check the tool list
    once. Each missing tool has a fallback in `stages.md` (classify from the
@@ -122,3 +145,6 @@ inventory, the gaps, the triage). Then record the change base
 Offer, one question: open the product bugs through `/multi-agent` with each
 failing test as the acceptance check, or stop. **No commit, no push, no issue
 from this command.**
+
+Last, close the run record: `phase-tracker.sh update 5 completed`, then the
+same `write-state.mjs` call with `"status":"complete","currentPhase":5`.

package/pipeline/contract/CHANGELOG.md

@@ -3,6 +3,52 @@
 Versions of the client contract (`manifest.json` `contractVersion`), separate
 from the package version. See `README.md` for what counts as minor and major.
 
+## 1.6.0
+
+Added. Nothing existing changes shape.
+
+- `GET /v1/system` (`system-status.mjs --json`): CPU, memory, disk and the
+  pipeline's own processes, numbers only.
+- `GET /v1/credentials` (`office-credentials.mjs --json [--probe]`, local-only):
+  logical names, state and probe verdict per credential, never a value.
+- `GET /v1/memory` (`office-memory.mjs --json`, local-only): per-repository code
+  graph age and learning, finding and session-note counts, redacted.
+- `POST /v1/prune-logs` (two steps, local-only): the task log folders older than
+  7, 30 or 90 days, then a prune of exactly that list; 409 `changed` when the
+  folders moved since the preview.
+- `GET /v1/settings` and `POST /v1/settings` (two steps, local-only, one change
+  at a time): output language, the fable rung and model routing; a route-on
+  preview names a saved free provider chain in `change.freeChain`.
+- runs and run (1.3.0): `source`, `prNumber`, `mode`, `channels`, and the
+  local-only `channelUrls`, dropped from a redacted answer.
+- activity, activity stream, agent chat, routines, routine delete, repo add and
+  remove (1.1.0): tables carry `source`, `pr`, `channels`, `waitingFor`,
+  `currentTask`, `progress` and each phase's `tasks`; seats carry their own
+  `tasks` and recent `mcp` calls.
+- prs, issue maturity, review verdict (1.1.0): a pull request names the
+  `account` it was listed for, numbered in a redacted answer.
+
+## 1.5.0
+
+Added. Nothing existing changes shape.
+
+- `GET /v1/repos?all=1` (`launch-request.mjs repos --all`): `suggested`
+  (checkouts earlier runs worked in that launch does not accept yet) and
+  `missing` (registered entries whose folder is gone), each with an `id`; a
+  page sees ids and names, never paths.
+- `POST /v1/repos` (two steps, `repo-request.schema.json`,
+  `repo-change.schema.json`, `local-only`/`high`): register a suggestion by id
+  or an absolute path to a git checkout. `DELETE /v1/repos/{id}` (two steps)
+  removes a registered entry; configured autopilot repositories are not
+  touched.
+- `version` on `GET /v1/tools`: the exact toolkit version the panel starts.
+- `GET /v1/jobs` (`office-jobs.schema.json`): the jobs the office can start,
+  from `schemas/office-jobs.json`. `POST /v1/jobs` (two steps,
+  `job-request.schema.json`, `job-change.schema.json`, `local-only`/`high`)
+  starts one with `claude --bg` under the unattended profile; it is the one
+  route that starts a session itself.
+- `--idle-minutes 0` and `--max-hours 0` mean no idle stop and no lifetime.
+
 ## 1.4.0
 
 Added. Nothing existing changes shape; one narrowing for browser pages.

package/pipeline/contract/README.md

@@ -42,7 +42,11 @@ same bytes (`test/contract-parity.test.mjs`):
 | Assigned issues | `issues.mjs --json [--source S] [--project K] [--max N]` | `GET /v1/issues` |
 | Worktrees | `worktrees.mjs --json [--measure] [--redact]` | `GET /v1/worktrees` |
 | Launch shape | `launch-request.mjs spec` | `GET /v1/launch-spec` |
-| Launch repositories | `launch-request.mjs repos [--redact]` | `GET /v1/repos` |
+| Launch repositories | `launch-request.mjs repos [--redact] [--all]` | `GET /v1/repos[?all=1]` |
+| Add a launch repository (two steps; the route also requires a git checkout) | `launch-request.mjs register-repo <path>` | `POST /v1/repos` |
+| Remove a registered repository (two steps) | - | `DELETE /v1/repos/{id}` |
+| Office jobs | `job-launch.mjs list` | `GET /v1/jobs` |
+| Start an office job (two steps) | - | `POST /v1/jobs` |
 | Start a run | write the request file, then `launch-request.mjs plan FILE --repo P --session-id U [--channel phone]` | `POST /v1/launch?repo=P` |
 | Answer a question | `answer-question.mjs STATE --question Q --answer IDS` | `POST /v1/runs/{id}/answer` |
 | A run's log | `run-log.mjs ID [--tail N]` (1-2000, default 200) | `GET /v1/runs/{id}/log?tail=N` |
@@ -56,6 +60,12 @@ same bytes (`test/contract-parity.test.mjs`):
 | Agent activity | `activity-snapshot.mjs --json` | `GET /v1/activity`, `GET /v1/activity/stream` (SSE) |
 | An agent's chat | `activity-snapshot.mjs chat SESSION [AGENT] [--before N] [--limit N]` | `GET /v1/agents/{sessionId}/{agentId}/chat` |
 | Cost ledger | `office-ledger.mjs --json` | `GET /v1/ledger` |
+| Machine resources | `system-status.mjs --json` | `GET /v1/system` |
+| Key cabinet (names and verdicts, never values) | `office-credentials.mjs --json [--probe]` | `GET /v1/credentials` |
+| Institutional memory | `office-memory.mjs --json` | `GET /v1/memory` |
+| Prune old run logs (two steps) | `office-prune.mjs preview\|apply N --json` | `POST /v1/prune-logs` |
+| Office settings | `office-settings.mjs --json` | `GET /v1/settings` |
+| Change one setting (two steps) | `office-settings.mjs set SETTING VALUE --json` | `POST /v1/settings` |
 | What a run produced | `run-results.mjs ID --json` | `GET /v1/runs/{id}/results` |
 | One screenshot | `run-results.mjs ID --evidence NAME` | `GET /v1/runs/{id}/evidence/{name}` |
 | Post a review verdict (two steps) | `work-items.mjs verdict ID [--post]` | `POST /v1/runs/{id}/review-verdict` |
@@ -72,16 +82,19 @@ same bytes (`test/contract-parity.test.mjs`):
 
 Every surface in `manifest.json` carries `remote` (the scope a remote carrier
 would require: `read`, `answer`, `launch`, or `local-only` for anything that
-widens what runs on this machine: autopilot on, stack, routine removal, kill,
-gc) and `risk` (the confirmation tier: `read`, `low`, `high`). Locally the
+widens what runs on this machine (autopilot on, stack, routine removal, kill,
+gc, prune, settings) and for a read that stays on this machine for privacy
+(credentials, memory, settings)) and `risk` (the confirmation tier: `read`, `low`, `high`). Locally the
 bearer token is the only credential; nothing enforces the tags yet. They are
 there so a later carrier reuses these routes without redefining them.
 
-Starting a run is always the client's act. `POST /v1/launch` validates the
+Starting a run is the client's act. `POST /v1/launch` validates the
 request, writes it (0600) and returns the argv, environment and working
-directory from `launch.json`; it never starts a session (the only `claude` the
-server runs is `claude stop`, for a kill). Spawn the argv without
-a shell. `launch.json` is marked `verified: false` until a live launch trial, so
+directory from `launch.json`; spawn the argv without a shell. The office panel
+is a client that starts its own: `POST /v1/jobs` (two steps, `local-only`)
+starts a job from `schemas/office-jobs.json` in the background after the
+unattended profile, workspace trust and sandbox checks. Besides that the only
+`claude` the server runs is `claude stop`, for a kill. `launch.json` is marked `verified: false` until a live launch trial, so
 treat the shape as provisional.
 
 The run starts with no permission prompts, so its input is held to a shape: a
@@ -155,15 +168,19 @@ answer to the old one.
   (own Origin only, no bearer); a used, expired or unknown code is 401.
   `GET /office/assets/<name>.png` serves the page's sprites, also without a
   token: a plain file name, a PNG of at most 256 KiB directly in the assets
-  directory beside the page, and 404 for anything else.
+  directory beside the page, and 404 for anything else. `GET /favicon.ico`
+  answers an empty 204 without a token, since browsers request it on their own.
 - Every write route appends one line (who, route, step, status; never a body
   or token) to `~/.claude/logs/multi-agent/office-actions.jsonl`.
 - Bodies are JSON, at most 64 KiB, and must satisfy the route's schema.
 - Errors follow `contract-error.schema.json`; switch on `error`, never on
   `message`.
 - Service reads, the work list, the review verdict and autopilot control run
-  in child processes and never block other routes; a second request for the
-  same one while the first runs is 429 `busy`.
+  in child processes and never block other routes. A second write, or a
+  second service read, while the same one runs is 429 `busy`; a read whose
+  answer is the same for every caller (`GET /v1/prs`, `GET /v1/autopilot`,
+  `GET /v1/issues/{key}/maturity`) is answered from the run already in
+  flight instead.
 - The server exits after 15 idle minutes (`--idle-minutes`), after 8 hours in
   any case (`--max-hours`, an open event stream does not extend it) or on
   SIGTERM. It is never a service; start it when you need it.

package/pipeline/contract/fixtures/error-invalid-request.json

@@ -1,5 +1,5 @@
 {
-  "contractVersion": "1.4.0",
+  "contractVersion": "1.6.0",
   "error": "invalid-request",
   "message": "the launch request was refused",
   "errors": [

package/pipeline/contract/fixtures/error-unauthorized.json

@@ -1,5 +1,5 @@
 {
-  "contractVersion": "1.4.0",
+  "contractVersion": "1.6.0",
   "error": "unauthorized",
   "message": "a bearer token is required"
 }

package/pipeline/contract/fixtures/error-unsigned.json

@@ -1,5 +1,5 @@
 {
-  "contractVersion": "1.4.0",
+  "contractVersion": "1.6.0",
   "error": "unsigned",
   "message": "a device signature is required"
 }

package/pipeline/contract/fixtures/launch-plan.json

@@ -22,7 +22,7 @@
     "MULTI_AGENT_UNATTENDED": "1",
     "MULTI_AGENT_SESSION_ID": "00000000-0000-4000-8000-000000000201",
     "MCP_TOOLKIT_URL_POLICY": "strict",
-    "MCP_TOOLKIT_INDEX_DENY": "~/.ssh,~/.aws,~/.gnupg,~/Library/Keychains",
+    "MCP_TOOLKIT_INDEX_DENY": "~/.ssh,~/.aws,~/.gnupg,~/Library/Keychains,~/.claude/logs/multi-agent/contract-server,~/.claude/logs/multi-agent/office",
     "LOGS_ROOT": "/Users/example/.multi-agent-unattended/logs",
     "MA_LAUNCH_REQUEST": "/Users/example/.claude/autopilot/requests/00000000-0000-4000-8000-000000000201.json"
   },

package/pipeline/contract/fixtures/runs-awaiting-question.json

@@ -1,5 +1,5 @@
 {
-  "contractVersion": "1.2.0",
+  "contractVersion": "1.3.0",
   "logsRoot": "/Users/example/.claude/logs/multi-agent",
   "count": 1,
   "runs": [
@@ -68,7 +68,12 @@
       "estUsd": 0,
       "unlockedWrites": 0,
       "runType": "autopilot",
+      "mode": null,
       "title": null,
+      "source": null,
+      "prNumber": null,
+      "channels": [],
+      "channelUrls": {},
       "progress": 0,
       "currentTask": null,
       "processAlive": false

package/pipeline/contract/fixtures/runs-empty.json

@@ -1,5 +1,5 @@
 {
-  "contractVersion": "1.2.0",
+  "contractVersion": "1.3.0",
   "logsRoot": "/Users/example/.claude/logs/multi-agent",
   "count": 0,
   "runs": []

package/pipeline/contract/fixtures/runs-failed.json

@@ -1,5 +1,5 @@
 {
-  "contractVersion": "1.2.0",
+  "contractVersion": "1.3.0",
   "logsRoot": "/Users/example/.claude/logs/multi-agent",
   "count": 1,
   "runs": [
@@ -88,7 +88,12 @@
       "estUsd": 0.0353,
       "unlockedWrites": 0,
       "runType": "development",
+      "mode": null,
       "title": null,
+      "source": null,
+      "prNumber": null,
+      "channels": [],
+      "channelUrls": {},
       "progress": 0.75,
       "currentTask": null,
       "processAlive": null

package/pipeline/contract/fixtures/runs-old-schema.json

@@ -64,7 +64,12 @@
         "cached": 1800
       },
       "estUsd": 0.0236,
-      "unlockedWrites": 0
+      "unlockedWrites": 0,
+      "mode": null,
+      "source": null,
+      "prNumber": null,
+      "channels": [],
+      "channelUrls": {}
     }
   ]
 }

package/pipeline/contract/fixtures/runs-pr-opened-redacted.json

@@ -1,5 +1,5 @@
 {
-  "contractVersion": "1.2.0",
+  "contractVersion": "1.3.0",
   "count": 1,
   "runs": [
     {
@@ -109,7 +109,11 @@
       "estUsd": 0.0707,
       "unlockedWrites": 0,
       "runType": "development",
+      "mode": null,
       "title": null,
+      "source": null,
+      "prNumber": 104,
+      "channels": [],
       "progress": 1,
       "currentTask": null,
       "processAlive": null

package/pipeline/contract/fixtures/runs-pr-opened.json

@@ -1,5 +1,5 @@
 {
-  "contractVersion": "1.2.0",
+  "contractVersion": "1.3.0",
   "logsRoot": "/Users/example/.claude/logs/multi-agent",
   "count": 1,
   "runs": [
@@ -114,7 +114,12 @@
       "estUsd": 0.0707,
       "unlockedWrites": 0,
       "runType": "development",
+      "mode": null,
       "title": null,
+      "source": null,
+      "prNumber": 104,
+      "channels": [],
+      "channelUrls": {},
       "progress": 1,
       "currentTask": null,
       "processAlive": null

package/pipeline/contract/fixtures/runs-running.json

@@ -1,5 +1,5 @@
 {
-  "contractVersion": "1.2.0",
+  "contractVersion": "1.3.0",
   "logsRoot": "/Users/example/.claude/logs/multi-agent",
   "count": 1,
   "runs": [
@@ -99,7 +99,12 @@
       "estUsd": 0.0236,
       "unlockedWrites": 0,
       "runType": "autopilot",
+      "mode": null,
       "title": "Fix the crash on the login screen",
+      "source": null,
+      "prNumber": null,
+      "channels": [],
+      "channelUrls": {},
       "progress": 0.8333333333333334,
       "currentTask": {
         "subject": "Make the test pass",

package/pipeline/contract/manifest.json

@@ -1,5 +1,5 @@
 {
-  "contractVersion": "1.4.0",
+  "contractVersion": "1.6.0",
   "supportedMajors": [1],
   "description": "The pipeline's client contract: every surface a client reads or writes, the CLI invocation and the HTTP route that carry it, and the schema its JSON follows. Schemas are not copied here; schemasDir points at the one tree the producers validate against. Paths in cli are relative to the pipeline directory (installed: ~/.claude).",
   "schemasDir": "../schemas",
@@ -13,7 +13,7 @@
       "redact": "1 drops every x-sensitivity local field, as --redact does; forced for a request that carries an Origin",
       "v": "the major to serve; see README.md"
     },
-    "confirm": "POST /v1/runs/{id}/kill, POST /v1/gc, POST /v1/autopilot/on, POST /v1/stack, POST /v1/runs/{id}/steer and POST /v1/runs/{id}/review-verdict take two requests: the first returns a preview, confirmToken and expiresAt; the second sends confirmToken back. DELETE /v1/routines/{name} takes the token as ?confirm=. Tokens are 32 random bytes held in the server's memory, single use, valid 120 seconds, bound to the route and its target.",
+    "confirm": "POST /v1/runs/{id}/kill, POST /v1/gc, POST /v1/autopilot/on, POST /v1/stack, POST /v1/runs/{id}/steer, POST /v1/runs/{id}/review-verdict, POST /v1/repos and POST /v1/jobs take two requests: the first returns a preview, confirmToken and expiresAt; the second sends confirmToken back. DELETE /v1/routines/{name} and DELETE /v1/repos/{id} take the token as ?confirm=. Tokens are 32 random bytes held in the server's memory, single use, valid 120 seconds, bound to the route and its target.",
     "tags": "Every surface carries remote (the scope a remote carrier would require: read, answer, launch, or local-only for anything that widens what runs on this machine) and risk (the confirmation tier it would require: read, low, high). Locally the bearer token is the only credential; nothing enforces the tags yet.",
     "origin": "A request may carry no Origin, the server's own (http://127.0.0.1:<port>), or one passed with --allow-origin. Writes (POST, DELETE) and the chat route accept no Origin but the server's own. The bearer token is read from the Authorization header only."
   },
@@ -74,6 +74,11 @@
     "autopilot-off-request.schema.json",
     "autopilot-off.schema.json",
     "repos.schema.json",
+    "repo-request.schema.json",
+    "repo-change.schema.json",
+    "office-jobs.schema.json",
+    "job-request.schema.json",
+    "job-change.schema.json",
     "activity.schema.json",
     "activity-chat.schema.json",
     "routines.schema.json",
@@ -86,6 +91,11 @@
     "steer-request.schema.json",
     "steer.schema.json",
     "ledger.schema.json",
+    "system-status.schema.json",
+    "office-credentials.schema.json",
+    "office-memory.schema.json",
+    "prune-logs.schema.json",
+    "prune-logs-request.schema.json",
     "run-results.schema.json",
     "run-evidence.schema.json",
     "issue-maturity.schema.json",
@@ -97,7 +107,9 @@
     "tool-call.schema.json",
     "service-read.schema.json",
     "permissions.schema.json",
-    "contract-error.schema.json"
+    "contract-error.schema.json",
+    "office-settings.schema.json",
+    "office-settings-request.schema.json"
   ],
   "surfaces": [
     {
@@ -107,7 +119,7 @@
       "query": ["group", "redact"],
       "cli": ["node", "scripts/runs-index.mjs", "--json", "[--group <group>]", "[--redact]"],
       "schema": "runs-index.schema.json",
-      "version": "1.2.0",
+      "version": "1.3.0",
       "remote": "read",
       "risk": "read"
     },
@@ -118,7 +130,7 @@
       "query": ["redact"],
       "cli": ["node", "scripts/runs-index.mjs", "--json", "--task-id", "{id}", "[--redact]"],
       "schema": "runs-index.schema.json",
-      "version": "1.2.0",
+      "version": "1.3.0",
       "remote": "read",
       "risk": "read"
     },
@@ -188,14 +200,38 @@
       "id": "repos",
       "method": "GET",
       "path": "/v1/repos",
-      "query": ["redact"],
-      "cli": ["node", "scripts/launch-request.mjs", "repos", "[--redact]"],
+      "query": ["redact", "all"],
+      "cli": ["node", "scripts/launch-request.mjs", "repos", "[--redact]", "[--all]"],
       "schema": "repos.schema.json",
       "version": "1.1.0",
-      "note": "The repositories POST /v1/launch?repo= accepts: configured autopilot repos and registered ones.",
+      "note": "The repositories POST /v1/launch?repo= accepts: configured autopilot repos and registered ones. ?all=1 adds suggested checkouts from earlier runs and registered entries that are gone.",
       "remote": "read",
       "risk": "read"
     },
+    {
+      "id": "repo-add",
+      "method": "POST",
+      "path": "/v1/repos",
+      "query": [],
+      "body": "repo-request.schema.json",
+      "cli": ["node", "scripts/launch-request.mjs", "register-repo", "<path>"],
+      "schema": "repo-change.schema.json",
+      "version": "1.1.0",
+      "note": "Two steps: the preview names the repository, the confirmation stores it in launch-repos.json. Only a git checkout that is neither the home directory nor the root is accepted.",
+      "remote": "local-only",
+      "risk": "high"
+    },
+    {
+      "id": "repo-remove",
+      "method": "DELETE",
+      "path": "/v1/repos/{id}",
+      "query": ["confirm"],
+      "schema": "repo-change.schema.json",
+      "version": "1.1.0",
+      "note": "Two steps: without confirm the preview and a token; with ?confirm=<token> the registered entry is removed. Configured autopilot repositories are not touched.",
+      "remote": "local-only",
+      "risk": "high"
+    },
     {
       "id": "launch",
       "method": "POST",
@@ -341,7 +377,7 @@
       "scope": "read",
       "cli": ["node", "scripts/runs-index.mjs", "--json", "[--group <group>]", "--redact"],
       "schema": "runs-index.schema.json",
-      "version": "1.2.0",
+      "version": "1.3.0",
       "note": "Always redacted; redact=0 is refused.",
       "risk": "read"
     },
@@ -354,7 +390,7 @@
       "scope": "read",
       "cli": ["node", "scripts/runs-index.mjs", "--json", "--task-id", "{id}", "--redact"],
       "schema": "runs-index.schema.json",
-      "version": "1.2.0",
+      "version": "1.3.0",
       "note": "Always redacted; redact=0 is refused.",
       "risk": "read"
     },
@@ -447,7 +483,7 @@
       "query": [],
       "cli": ["node", "scripts/activity-snapshot.mjs", "--json"],
       "schema": "activity.schema.json",
-      "version": "1.0.0",
+      "version": "1.1.0",
       "note": "Derived from disk on every call; no field is machine-local, so redact changes nothing.",
       "remote": "read",
       "risk": "read"
@@ -459,7 +495,7 @@
       "query": [],
       "cli": ["node", "scripts/activity-snapshot.mjs", "--json"],
       "schema": "activity.schema.json",
-      "version": "1.0.0",
+      "version": "1.1.0",
       "note": "text/event-stream: an `activity` event carrying the document whenever it changes (checked every 2 seconds), a comment line as heartbeat. At most 4 streams at once (429 too-many-streams).",
       "remote": "read",
       "risk": "read"
@@ -479,7 +515,7 @@
         "[--limit <n>]"
       ],
       "schema": "activity-chat.schema.json",
-      "version": "1.0.0",
+      "version": "1.1.0",
       "note": "agentId main is the session itself. Refused (403) to any Origin but the server's own page, even an allowed one. limit is 1 to 500, 200 by default; before is the offset the previous page returned.",
       "remote": "read",
       "risk": "read"
@@ -491,7 +527,7 @@
       "query": [],
       "cli": ["node", "scripts/routine-registry.mjs", "list", "--json"],
       "schema": "routines.schema.json",
-      "version": "1.0.0",
+      "version": "1.1.0",
       "remote": "read",
       "risk": "read"
     },
@@ -502,11 +538,35 @@
       "query": ["confirm"],
       "cli": ["node", "scripts/routine-registry.mjs", "remove", "--name", "{name}"],
       "schema": "routine-delete.schema.json",
-      "version": "1.0.0",
+      "version": "1.1.0",
       "note": "Two steps: without confirm the preview and a token; with ?confirm=<token> the removal. A shipped command is refused (409 not-removable).",
       "remote": "local-only",
       "risk": "high"
     },
+    {
+      "id": "jobs",
+      "method": "GET",
+      "path": "/v1/jobs",
+      "query": [],
+      "cli": ["node", "scripts/job-launch.mjs", "list"],
+      "schema": "office-jobs.schema.json",
+      "version": "1.0.0",
+      "note": "The jobs the office can hand to someone: the command, the role that does it, team or solo, typed parameters and what it writes outside the machine; available is false when the command is not installed here.",
+      "remote": "read",
+      "risk": "read"
+    },
+    {
+      "id": "job-start",
+      "method": "POST",
+      "path": "/v1/jobs",
+      "query": [],
+      "body": "job-request.schema.json",
+      "schema": "job-change.schema.json",
+      "version": "1.0.0",
+      "note": "Two steps: the preview names the role, repository, exact prompt and what the job writes; the confirmation re-checks that the repository is allowed and starts it with claude --bg under the unattended profile after the workspace trust, agent-guard registration and sandbox checks; claude's own output stays in the server's log. A team job is refused while a run is live in that repository. Never reachable from a phone.",
+      "remote": "local-only",
+      "risk": "high"
+    },
     {
       "id": "stack",
       "method": "GET",
@@ -552,6 +612,80 @@
       "risk": "read",
       "note": "Estimates at list price from cost-table.json. Each amount names its source (tracker-state, transcript, mixed); a run nobody could measure is not-measured with null numbers, never 0. prices.warning names a price table older than 60 days."
     },
+    {
+      "id": "system",
+      "method": "GET",
+      "path": "/v1/system",
+      "query": [],
+      "cli": ["node", "scripts/system-status.mjs", "--json"],
+      "schema": "system-status.schema.json",
+      "version": "1.0.0",
+      "remote": "read",
+      "risk": "read",
+      "note": "Numbers only: CPU load, memory, free disk, the pipeline's own sessions and toolkit processes and its log folder size. No path, process argument, user or host name. A value that could not be measured is null."
+    },
+    {
+      "id": "prune-logs",
+      "method": "POST",
+      "path": "/v1/prune-logs",
+      "query": [],
+      "body": "prune-logs-request.schema.json",
+      "cli": ["node", "scripts/office-prune.mjs", "preview|apply", "{days}", "--json"],
+      "schema": "prune-logs.schema.json",
+      "version": "1.0.0",
+      "remote": "local-only",
+      "risk": "high",
+      "note": "Two steps: the preview lists the task log folders older than 7, 30 or 90 days; the confirmation lists them again, refuses with 409 changed when they differ, and prunes only that list (prune-logs.sh --only-from). The audit trail, metrics and counters are never removed; a folder written in the last minutes and a run that can still be resumed are spared."
+    },
+    {
+      "id": "settings",
+      "method": "GET",
+      "path": "/v1/settings",
+      "query": [],
+      "cli": ["node", "scripts/office-settings.mjs", "--json"],
+      "schema": "office-settings.schema.json",
+      "version": "1.0.0",
+      "remote": "local-only",
+      "risk": "read",
+      "note": "The output language, the fable rung and model routing, read from the preferences file."
+    },
+    {
+      "id": "settings-set",
+      "method": "POST",
+      "path": "/v1/settings",
+      "query": [],
+      "body": "office-settings-request.schema.json",
+      "cli": ["node", "scripts/office-settings.mjs", "set", "{setting}", "{value}", "--json"],
+      "schema": "office-settings.schema.json",
+      "version": "1.0.0",
+      "remote": "local-only",
+      "risk": "high",
+      "note": "Two steps: the preview names the change, the confirmation runs what /multi-agent:language, /multi-agent:model or /multi-agent:route-on|off runs; one change at a time (429 busy). Route on passes the saved strategy back; widening it stays in the terminal."
+    },
+    {
+      "id": "credentials",
+      "method": "GET",
+      "path": "/v1/credentials",
+      "query": ["probe"],
+      "cli": ["node", "scripts/office-credentials.mjs", "--json", "[--probe]"],
+      "schema": "office-credentials.schema.json",
+      "version": "1.0.0",
+      "remote": "local-only",
+      "risk": "read",
+      "note": "Logical names and verdicts only, never a value. probe=1 makes one cheap authenticated request per configured credential. Renewal is /multi-agent:setup in the terminal. Local only: not even the verdicts go to a phone."
+    },
+    {
+      "id": "memory",
+      "method": "GET",
+      "path": "/v1/memory",
+      "query": [],
+      "cli": ["node", "scripts/office-memory.mjs", "--json"],
+      "schema": "office-memory.schema.json",
+      "version": "1.0.0",
+      "remote": "local-only",
+      "risk": "read",
+      "note": "Counts per repository from the learning loop's stores and the newest learnings, redacted and cut to 120 characters. Local only."
+    },
     {
       "id": "run-results",
       "method": "GET",
@@ -582,7 +716,7 @@
       "body": "review-verdict-request.schema.json",
       "cli": ["node", "scripts/work-items.mjs", "verdict", "{id}", "[--post]"],
       "schema": "review-verdict.schema.json",
-      "version": "1.0.0",
+      "version": "1.1.0",
       "note": "Two steps. Only a finished review whose every finding is triaged is previewed (409 review-incomplete); the token is bound to the decision and findingsDigest, and a confirmation after either changed is 409 confirm-mismatch.",
       "remote": "launch",
       "risk": "high"
@@ -594,7 +728,7 @@
       "query": [],
       "cli": ["node", "scripts/work-items.mjs", "maturity", "{key}"],
       "schema": "issue-maturity.schema.json",
-      "version": "1.0.0",
+      "version": "1.1.0",
       "note": "key is URL-encoded (owner%2Frepo%23N for a GitHub issue).",
       "remote": "read",
       "risk": "read"
@@ -606,8 +740,8 @@
       "query": ["redact"],
       "cli": ["node", "scripts/work-items.mjs", "prs"],
       "schema": "prs.schema.json",
-      "version": "1.0.0",
-      "note": "Bitbucket listing is not implemented; its source entry says so.",
+      "version": "1.1.0",
+      "note": "One list across every GitHub account gh is logged in to (each asked with its own token in GH_TOKEN) and the configured Bitbucket Server (https, token in the header). A source that cannot be read says why. Redacted, URLs and logins are dropped.",
       "remote": "read",
       "risk": "read"
     },