@muxoai/platform 1.4.3 → 1.4.5

package/dist/store.d.ts

@@ -178,7 +178,10 @@ export declare class MuxoStore {
         category: "llm" | "supplier";
         envVarName: string;
     };
-    setByokKey(workspaceId: string, providerInput: string, secretKey: string): ByokKeyRecord;
+    setByokKey(workspaceId: string, providerInput: string, secretKey: string, options?: {
+        mcpGatewayUrl?: string | null;
+    }): ByokKeyRecord;
+    getByokMcpGatewayUrl(workspaceId: string): string | null;
     getByokKey(workspaceId: string, providerInput: string): string | null;
     deleteByokKey(workspaceId: string, providerInput: string): boolean;
     listByokKeys(workspaceId: string): ByokKeyRecord[];

package/dist/store.js

@@ -1,5 +1,6 @@
 import { DatabaseSync } from "node:sqlite";
 import crypto from "node:crypto";
+import { normalizeComposioByokGatewayUrl } from "./composio-catalog.js";
 export const BYOK_PROVIDER_CATALOG = {
     openai: { category: "llm", envVarName: "OPENAI_API_KEY", label: "OpenAI (GPT-4o / o3-mini)" },
     anthropic: { category: "llm", envVarName: "ANTHROPIC_API_KEY", label: "Anthropic (Claude 3.7 Sonnet)" },
@@ -1204,7 +1205,7 @@ export class MuxoStore {
             envVarName,
         };
     }
-    setByokKey(workspaceId, providerInput, secretKey) {
+    setByokKey(workspaceId, providerInput, secretKey, options) {
         const trimmed = secretKey.trim();
         if (!trimmed) {
             throw new Error("BYOK secretKey must not be empty");
@@ -1214,7 +1215,17 @@ export class MuxoStore {
         const keyPreview = trimmed.length <= 8
             ? `${trimmed.slice(0, 2)}***`
             : `${trimmed.slice(0, 6)}...${trimmed.slice(-4)}`;
-        const encryptedHex = this.encryptSecrets(workspaceId, { [envVarName]: trimmed });
+        if (options?.mcpGatewayUrl && provider !== "composio") {
+            throw new Error("MCP gateway URLs are only supported for Composio BYOK.");
+        }
+        const cleanGatewayUrl = options?.mcpGatewayUrl
+            ? normalizeComposioByokGatewayUrl(options.mcpGatewayUrl)
+            : provider === "composio" ? this.getByokMcpGatewayUrl(workspaceId) || "" : "";
+        const secretPayload = {
+            [envVarName]: trimmed,
+            ...(cleanGatewayUrl ? { COMPOSIO_MCP_GATEWAY_URL: cleanGatewayUrl } : {}),
+        };
+        const encryptedHex = this.encryptSecrets(workspaceId, secretPayload);
         this.db
             .prepare(`INSERT INTO byok_keys (
           workspace_id, provider, category, env_var_name, key_preview, encrypted_secret_hex, updated_at
@@ -1233,9 +1244,19 @@ export class MuxoStore {
             envVarName,
             keyPreview,
             configured: true,
+            ...(cleanGatewayUrl ? { mcpGatewayUrl: cleanGatewayUrl } : {}),
             updatedAt: now,
         };
     }
+    getByokMcpGatewayUrl(workspaceId) {
+        const row = this.db
+            .prepare("SELECT encrypted_secret_hex FROM byok_keys WHERE workspace_id = ? AND provider = 'composio'")
+            .get(workspaceId);
+        if (!row)
+            return null;
+        const dec = this.decryptSecrets(workspaceId, row.encrypted_secret_hex);
+        return dec.COMPOSIO_MCP_GATEWAY_URL || null;
+    }
     getByokKey(workspaceId, providerInput) {
         const { provider, envVarName } = this.normalizeByokProvider(providerInput);
         const row = this.db
@@ -1255,11 +1276,23 @@ export class MuxoStore {
     }
     listByokKeys(workspaceId) {
         const rows = this.db
-            .prepare("SELECT provider, category, env_var_name, key_preview, updated_at FROM byok_keys WHERE workspace_id = ? ORDER BY updated_at DESC")
+            .prepare("SELECT provider, category, env_var_name, key_preview, encrypted_secret_hex, updated_at FROM byok_keys WHERE workspace_id = ? ORDER BY updated_at DESC")
             .all(workspaceId);
         const configuredMap = new Map();
         for (const r of rows) {
             const p = String(r.provider);
+            let mcpGatewayUrl;
+            if (p === "composio" && r.encrypted_secret_hex) {
+                try {
+                    const dec = this.decryptSecrets(workspaceId, String(r.encrypted_secret_hex));
+                    if (dec.COMPOSIO_MCP_GATEWAY_URL) {
+                        mcpGatewayUrl = dec.COMPOSIO_MCP_GATEWAY_URL;
+                    }
+                }
+                catch {
+                    // ignore
+                }
+            }
             configuredMap.set(p, {
                 provider: p,
                 providerSlug: p,
@@ -1267,6 +1300,7 @@ export class MuxoStore {
                 envVarName: String(r.env_var_name),
                 keyPreview: String(r.key_preview),
                 configured: true,
+                ...(mcpGatewayUrl ? { mcpGatewayUrl } : {}),
                 updatedAt: String(r.updated_at),
             });
         }

package/dist/types.d.ts

@@ -184,6 +184,7 @@ export interface MuxoTool {
     llmContextUrl?: string;
     providerUrl?: string;
     metadata?: Record<string, unknown>;
+    domainSkill?: Record<string, unknown>;
 }
 export type ToolDescriptor = MuxoTool;
 export interface ConnectionRecord {
@@ -441,6 +442,7 @@ export interface ByokKeyRecord {
     category: "llm" | "supplier";
     envVarName: string;
     keyPreview: string;
+    mcpGatewayUrl?: string | null;
     configured: boolean;
     updatedAt: string;
 }
@@ -499,6 +501,29 @@ export interface HumanHandoffDescriptor {
     oauthRedirectUrl: string | null;
     consoleUrl: string;
 }
+export interface ApprovalImpactPreview {
+    whatChanges: string;
+    whoIsAffected: string;
+    targetEntity: string;
+    estimatedCostUsd: number;
+    creditCost: number;
+    fundingMode: "muxo_funded" | "byok";
+    costDisplay: string;
+    triggeredRule: string;
+    reversibility: "reversible" | "compensatable_saga" | "irreversible";
+    recoveryBehavior: string;
+}
+export interface BusinessReceiptSummary {
+    whatChanged: string;
+    whoAuthorized: string;
+    whatSucceeded: string;
+    whatRemainsUnresolved: string[];
+    costUsd: number;
+    creditsCharged: number;
+    fundingMode: "muxo_funded" | "byok";
+    costDisplay: string;
+    reconciliationStatus: "verified_complete" | "failed_zero_charge" | "cancelled" | "needs_reconciliation";
+}
 export interface ActionPlan {
     id: string;
     workspaceId: string;
@@ -510,6 +535,9 @@ export interface ActionPlan {
     input: Record<string, unknown>;
     reason: string;
     creditCost: number;
+    estimatedCostUsd?: number;
+    changePreview?: ApprovalImpactPreview;
+    idempotencyKey?: string;
     approvalStatus: "auto_approved" | "pending_approval" | "approved" | "rejected" | "executed";
     approvedBy: string | null;
     approvedAt: string | null;
@@ -548,6 +576,9 @@ export interface ExecutionRun {
     errorMessage?: string | null;
     actionsMetered: number;
     creditsMetered: number;
+    estimatedCostUsd?: number;
+    idempotentReplay?: boolean;
+    reconciliationStatus?: "verified_complete" | "failed_zero_charge" | "cancelled" | "needs_reconciliation";
     durationMs: number | null;
     receiptId: string | null;
     startedAt: string;
@@ -586,6 +617,8 @@ export interface ExecutionReceipt {
     status: "succeeded" | "failed" | "cancelled";
     actionsMetered: number;
     creditsMetered: number;
+    estimatedCostUsd?: number;
+    businessSummary?: BusinessReceiptSummary;
     inputHash: string;
     outputHash: string;
     prevReceiptHash: string;

package/dist/ui/console-html.js

@@ -2003,9 +2003,12 @@ async function loadByokKeys() {
 async function saveByokKeyFromUi() {
   var provider = byId('byok-provider-select').value;
   var secretKey = byId('byok-key-input').value.trim();
+  var gwInput = byId('byok-gateway-input');
+  var mcpGatewayUrl = provider === 'composio' && gwInput && gwInput.value ? gwInput.value.trim() : undefined;
   if (!secretKey) { showToast('Paste a key first'); byId('byok-key-input').focus(); return; }
-  await post('/api/v1/byok', { provider: provider, secretKey: secretKey, apiKey: secretKey });
+  await post('/api/v1/byok', { provider: provider, secretKey: secretKey, apiKey: secretKey, mcpGatewayUrl: mcpGatewayUrl });
   byId('byok-key-input').value = '';
+  if (gwInput) gwInput.value = '';
   showToast('Saved your ' + provider + ' key. It is encrypted in your vault.');
   await loadByokKeys();
 }
@@ -2365,6 +2368,13 @@ function init() {
   onSubmit('policy-form', savePolicy);
   onSubmit('scan-form', scanContextFromUi);
   onSubmit('byok-form', saveByokKeyFromUi);
+  var byokSelect = byId('byok-provider-select');
+  if (byokSelect) {
+    byokSelect.addEventListener('change', function () {
+      var gwField = byId('byok-gateway-field');
+      if (gwField) gwField.hidden = byokSelect.value !== 'composio';
+    });
+  }
   onSubmit('join-workspace-form', joinWorkspaceFromForm);
   onSubmit('create-workspace-form', createWorkspaceFromForm);
   onSubmit('team-onboard-form', onboardTeamFromForm);
@@ -2753,7 +2763,7 @@ export function renderConsoleHtml() {
                   <option value="anthropic">Anthropic (plain-English routing)</option>
                   <option value="openrouter">OpenRouter (plain-English routing)</option>
                   <option value="gemini">Google Gemini (plain-English routing)</option>
-                  <option value="composio">Apps and instant tools (0 credits)</option>
+                  <option value="composio">Apps, MCP Gateway &amp; instant tools (0 credits)</option>
                   <option value="stripe">Cloud infrastructure (0 credits)</option>
                   <option value="supermemory">Workspace memory</option>
                   <option value="firecrawl">Firecrawl (scrape and crawl)</option>
@@ -2761,6 +2771,7 @@ export function renderConsoleHtml() {
                 </select>
               </label>
               <label class="field"><span>Key</span><input id="byok-key-input" type="password" placeholder="Paste the key" autocomplete="off" /></label>
+              <label class="field" id="byok-gateway-field" hidden><span>MCP Gateway URL (optional)</span><input id="byok-gateway-input" type="url" placeholder="https://connect.composio.dev/mcp" autocomplete="off" /></label>
               <button class="btn btn-primary" type="submit" style="min-height:40px">Save key</button>
             </form>
             <div class="table-wrap">
@@ -3312,17 +3323,17 @@ export function renderOAuthConsentHtml(opts) {
 </html>`;
 }
 const approvalCss = `
-.approval-facts{display:grid;gap:8px;margin:18px 0 0;padding:0;list-style:none;text-align:left;font-size:14px}
-.approval-facts li{display:flex;justify-content:space-between;gap:14px;padding:9px 12px;border:1px solid var(--color-border);border-radius:10px;background:var(--color-bg)}
+.approval-facts{display:grid;gap:6px;margin:12px 0 0;padding:0;list-style:none;text-align:left;font-size:13px}
+.approval-facts li{display:flex;justify-content:space-between;gap:12px;padding:6px 10px;border:1px solid var(--color-border);border-radius:8px;background:var(--color-bg)}
 .approval-facts .k{color:var(--color-muted);flex:none}
 .approval-facts .v{color:var(--color-text);font-weight:500;text-align:right;overflow-wrap:anywhere}
-.approval-input{margin:14px 0 0;padding:12px;border:1px solid var(--color-border);border-radius:10px;background:var(--color-bg);font-family:var(--font-mono);font-size:12px;text-align:left;white-space:pre-wrap;overflow-wrap:anywhere;max-height:180px;overflow:auto}
+.approval-input{margin:10px 0 0;padding:10px;border:1px solid var(--color-border);border-radius:8px;background:var(--color-bg);font-family:var(--font-mono);font-size:12px;text-align:left;white-space:pre-wrap;overflow-wrap:anywhere;max-height:110px;overflow:auto}
 .approval-risk{display:inline-block;border-radius:999px;padding:3px 10px;font-size:12px;font-weight:600;text-transform:capitalize}
 .approval-risk[data-tone="ok"]{background:var(--color-ok-bg);color:var(--color-ok)}
 .approval-risk[data-tone="warn"]{background:var(--color-warn-bg);color:var(--color-warn)}
 .approval-risk[data-tone="strict"]{background:var(--color-danger-bg);color:var(--color-danger)}
-.approval-note{margin-top:14px;color:var(--color-muted);font-size:13px}
-.approval-done{margin-top:18px;text-align:left;font-size:14px}
+.approval-note{margin-top:10px;color:var(--color-muted);font-size:13px}
+.approval-done{margin-top:14px;text-align:left;font-size:14px}
 `;
 const approvalScript = String.raw `
 (function () {
@@ -3356,10 +3367,17 @@ const approvalScript = String.raw `
   function renderPlan() {
     show('approval-loading', false);
     show('approval-review', true);
+    var preview = plan.changePreview || {};
+    var credits = plan.creditCost != null ? plan.creditCost : 0;
+    var usd = plan.estimatedCostUsd != null ? Number(plan.estimatedCostUsd).toFixed(2) : (credits * 0.01).toFixed(2);
     byId('approval-tool').textContent = plan.toolSlug || '';
     byId('approval-risk').textContent = plan.riskLevel + ' risk';
     byId('approval-risk').setAttribute('data-tone', riskTone(plan.riskLevel));
-    byId('approval-cost').textContent = String(plan.creditCost != null ? plan.creditCost : 0) + ' credits';
+    byId('approval-what-changes').textContent = preview.whatChanges || plan.reason || ('Execute ' + (plan.toolSlug || 'action'));
+    byId('approval-affected').textContent = preview.whoIsAffected || preview.targetEntity || 'Workspace integration';
+    byId('approval-cost').textContent = preview.costDisplay || ('$' + usd + ' USD (' + credits + ' credits)');
+    byId('approval-rule').textContent = preview.triggeredRule || (plan.decisionRecord && plan.decisionRecord.matchedRule) || 'Workspace approval policy';
+    byId('approval-recovery').textContent = preview.recoveryBehavior || 'Execute-once idempotency; 0 credits charged on failure.';
     byId('approval-reason').textContent = plan.reason || '—';
     byId('approval-input').textContent = JSON.stringify(plan.input || {}, null, 2);
     var already = plan.approvalStatus === 'approved' || plan.approvalStatus === 'auto_approved';
@@ -3377,7 +3395,11 @@ const approvalScript = String.raw `
     show('approval-done', true);
     var html = '<p>' + esc(message) + '</p>';
     if (result && result.run) {
+      var bs = (result.receipt && result.receipt.businessSummary) || {};
       html += '<ul class="approval-facts">'
+        + (bs.whatChanged ? '<li><span class="k">What changed</span><span class="v">' + esc(bs.whatChanged) + '</span></li>' : '')
+        + (bs.whoAuthorized ? '<li><span class="k">Authorized by</span><span class="v">' + esc(bs.whoAuthorized) + '</span></li>' : '')
+        + (bs.costDisplay ? '<li><span class="k">Cost</span><span class="v">' + esc(bs.costDisplay) + '</span></li>' : '')
         + '<li><span class="k">Run</span><span class="v">' + esc(result.run.id) + ' · ' + esc(result.run.status) + '</span></li>'
         + (result.receipt ? '<li><span class="k">Receipt</span><span class="v">' + esc(result.receipt.id) + '</span></li>' : '')
         + '</ul>';
@@ -3542,8 +3564,12 @@ export function renderApprovalPageHtml(opts) {
           <div id="approval-review" hidden>
             <ul class="approval-facts">
               <li><span class="k">Action</span><span class="v" id="approval-tool"></span></li>
+              <li><span class="k">What changes</span><span class="v" id="approval-what-changes"></span></li>
+              <li><span class="k">Who is affected</span><span class="v" id="approval-affected"></span></li>
               <li><span class="k">Risk</span><span class="v"><span id="approval-risk" class="approval-risk" data-tone="warn"></span></span></li>
-              <li><span class="k">Cost</span><span class="v" id="approval-cost"></span></li>
+              <li><span class="k">Estimated cost</span><span class="v" id="approval-cost"></span></li>
+              <li><span class="k">Triggered rule</span><span class="v" id="approval-rule"></span></li>
+              <li><span class="k">Recovery &amp; safety</span><span class="v" id="approval-recovery"></span></li>
               <li><span class="k">Reason</span><span class="v" id="approval-reason"></span></li>
             </ul>
             <pre id="approval-input" class="approval-input" aria-label="Tool input"></pre>

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const MUXO_VERSION = "1.4.3";
+export declare const MUXO_VERSION = "1.4.5";

package/dist/version.js

@@ -1 +1 @@
-export const MUXO_VERSION = "1.4.3";
+export const MUXO_VERSION = "1.4.5";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@muxoai/platform",
-  "version": "1.4.3",
+  "version": "1.4.5",
   "description": "Muxo — Unified Execution, Provisioning & Governance Platform over Composio, Stripe Projects, Microsoft Agent Governance & Supermemory",
   "private": false,
   "license": "MIT",

package/plugins/muxo/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "muxo",
-  "version": "1.4.3",
+  "version": "1.4.5",
   "description": "Governed agent execution across 1,000+ Connected Apps (managed OAuth handoff), Instant Tools (search, scrape, crawl, SEO audit), live Cloud Infrastructure provisioning, Workspace Memory recall, and verifiable audit records.",
   "author": {
     "name": "Muxo AI LLC",
@@ -8,7 +8,7 @@
     "url": "https://muxo.ai"
   },
   "homepage": "https://muxo.ai",
-  "repository": "https://github.com/muxo-ai/muxo",
+  "repository": "https://github.com/Muxoai/muxo3",
   "license": "MIT",
   "skills": "./skills/",
   "hooks": "./hooks/hooks.json",

package/plugins/muxo/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "muxo",
-  "version": "1.4.3",
+  "version": "1.4.5",
   "description": "Your agent decides what to do — Muxo governs, provisions, remembers, and executes it. Unified access to 1,000+ Connected Apps (managed OAuth handoff), Instant Tools (search, scrape, crawl, SEO audit), live Cloud Infrastructure provisioning (Postgres, Redis, SQLite, Storage), Workspace Memory recall, and verifiable audit records.",
   "author": {
     "name": "Muxo AI LLC",
@@ -8,7 +8,7 @@
     "url": "https://muxo.ai"
   },
   "homepage": "https://muxo.ai",
-  "repository": "https://github.com/muxo-ai/muxo",
+  "repository": "https://github.com/Muxoai/muxo3",
   "license": "MIT",
   "keywords": [
     "muxo",
@@ -33,7 +33,7 @@
     "com.openai": {
       "onboardingSkill": "./skills/setup/SKILL.md",
       "publication": {
-        "release_notes": "Muxo v1.4.3: Unified governed execution across 1,000+ Connected Apps, Instant web/SEO tools, 94 Stripe Projects Cloud Infrastructure services, MCP 2026-07-28 compliance, and Workspace Memory."
+        "release_notes": "Muxo v1.4.5: Unified governed execution across 1,000+ Connected Apps, Instant web/SEO tools, 94 Stripe Projects Cloud Infrastructure services, MCP 2026-07-28 compliance, and Workspace Memory."
       }
     }
   },

package/plugins/muxo/.cursor-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "muxo",
   "description": "Your agent decides what to do — Muxo governs, provisions, remembers, and executes it. Connect and operate 1,000+ external apps via managed OAuth, zero-auth Instant Tools (web search, scrape, crawl, SEO audit, remote workbench), live Cloud Infrastructure provisioning (Stripe Projects), and Workspace Memory from Cursor.",
-  "version": "1.4.3",
+  "version": "1.4.5",
   "mcpServers": "../mcp.json",
   "skills": "../skills/",
   "author": {
@@ -10,7 +10,7 @@
     "url": "https://muxo.ai"
   },
   "homepage": "https://muxo.ai",
-  "repository": "https://github.com/muxo-ai/muxo",
+  "repository": "https://github.com/Muxoai/muxo3",
   "license": "MIT",
   "keywords": [
     "muxo",

package/plugins/muxo/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "muxo",
-  "version": "1.4.3",
+  "version": "1.4.5",
   "description": "Your agent decides what to do — Muxo governs, provisions, remembers, and executes it. Unified access to 1,000+ Connected Apps (managed OAuth handoff), Instant Tools (search, scrape, crawl, SEO audit), live Cloud Infrastructure provisioning (Postgres, Redis, SQLite, Storage), Workspace Memory recall, and verifiable audit records.",
   "author": {
     "name": "Muxo AI LLC",
@@ -9,7 +9,7 @@
     "url": "https://muxo.ai"
   },
   "homepage": "https://muxo.ai",
-  "repository": "https://github.com/muxo-ai/muxo",
+  "repository": "https://github.com/Muxoai/muxo3",
   "license": "MIT",
   "keywords": [
     "muxo",
@@ -109,7 +109,7 @@
         "commerce_description": "This plugin does not sell retail products or process consumer checkout inside ChatGPT."
       },
       "publication": {
-        "release_notes": "Muxo v1.4.3: Unified governed execution across 1,000+ Connected Apps, Instant web/SEO tools, 94 Stripe Projects Cloud Infrastructure services, MCP 2026-07-28 compliance, and Workspace Memory."
+        "release_notes": "Muxo v1.4.5: Unified governed execution across 1,000+ Connected Apps, Instant web/SEO tools, 94 Stripe Projects Cloud Infrastructure services, MCP 2026-07-28 compliance, and Workspace Memory."
       }
     }
   }

package/plugins/muxo/skills/muxo/SKILL.md

@@ -138,9 +138,19 @@ Users can operate every Muxo pillar in plain English through `POST /api/v1/do` (
 
 ### Context, MCP Resources & Prompts
 - **Inspect**: "Show my workspace context", "Explain current run context", or call `get_run_context({ query: "..." })` — returns credits, learned defaults, active guardrails, `llmPolicyBrief`, provisioned resources, and a ready-to-use `llmSystemPrompt` block.
-- **MCP Resources (`resources/read`)**: `muxo://policy/brief`, `muxo://governance/policy`, `muxo://context`, `muxo://memory/graph`.
-- **MCP Prompts (`prompts/get`)**: `context`, `policy_guardrails` (accepts optional `tool_slug`), `governed_execution`, `security_audit`.
-- REST equivalent: `GET/POST /api/v1/context`.
+- **Plain-English OSS & Commercial Intent Router on `get_run_context` & `POST /api/v1/do`**: Pass any plain-English prompt to `get_run_context({ prompt: "..." })` or `POST /api/v1/do` (`{"prompt": "..."}`) without memorizing sub-action enums, workflow IDs, or playbook slugs:
+  - **Turnkey & Custom Saga Playbooks**: `"Run the fullstack cloud bootstrap playbook"`, `"List playbooks"`, or `"Create playbook daily-seo-slack that runs instant.seo.audit and app.slack.send_message"` (`POST /api/v1/playbooks`, `POST /api/v1/playbooks/:slug/run`).
+  - **Temporal Workflow Saga Rollback, Signals & History (`"latest"` supported)**: `"Rollback the latest workflow because staging healthcheck failed"`, `"Signal workflow latest human.approval.granted"`, `"Show Temporal history for latest workflow"` (`POST /api/v1/workflows/latest/rollback`, `/signal`, `/history`).
+  - **Graphiti Time-Travel & Multi-Hop BFS Memory Graph**: `"Show my knowledge graph as of 2026-10-20T00:00:00Z within 2 hops of workspace"` (`GET /api/v1/memory/graph?as_of=...&focal_entity=...&max_hops=2`).
+  - **AWS Cedar 4.0 & OPA Rego v1 Policy-as-Code**: `"Compile our guardrails to AWS Cedar"` or `"Evaluate Cedar policy for resource.turso.database with DROP TABLE users"` (`GET /api/v1/governance/cedar`, `POST /api/v1/governance/cedar/evaluate`).
+  - **OpenTelemetry GenAI 1.29.0 & Langfuse Traces**: `"Export OpenTelemetry traces and Langfuse batch"` (`GET /api/v1/telemetry/otlp`).
+  - **FinOps & Commercial Engineering ROI**: `"What is our ROI and how many engineering hours have we saved?"` (`GET /api/v1/analytics/roi`).
+  - **One-Shot Agent Harness Configurator & Presets**: `"Configure harness preset strict-production and only allow emails to @muxo.ai"` (`GET/POST /api/v1/harness/configure`, `get_run_context({ action: "configure_harness", preset: "strict-production", harness: "claude_code" })`).
+- **MCP Resources (`resources/read`)**: `muxo://policy/brief`, `muxo://governance/policy`, `muxo://context`, `muxo://memory/graph`, `muxo://harness/config`, `muxo://playbooks`, `muxo://skills`, `muxo://skills/{skillSlug}`.
+- **MCP Prompts (`prompts/get`)**: `context`, `policy_guardrails` (accepts optional `tool_slug`), `governed_execution`, `security_audit`, `harness_setup`, `commercial_playbook`.
+- **Governed Domain & Workflow Skills Catalog (`muxo://skills/{skillSlug}`)**:
+  - Read domain playbooks & parameter pitfalls via MCP (`resources/read` on `muxo://skills/github-automation`, `muxo://skills/supabase-provisioning`, `muxo://skills/changelog-generator`, or `skills/get` on `skill://muxo/<slug>/SKILL.md`), REST (`GET /api/v1/skills`, `GET /api/v1/skills/:slug`, `GET /skills/:slug/SKILL.md`), or CLI (`muxo skills list`, `muxo skills show <slug>`, `muxo skills install <slug> --all-curated`).
+- REST equivalent: `GET/POST /api/v1/context`, `GET/POST /api/v1/harness/configure`, `GET/POST /api/v1/playbooks`, `GET /api/v1/skills`.
 
 ### Receipts
 - **Explain / verify**: "Explain my latest receipt", "Verify receipt rcpt_...", "Show recent receipts" — returns the tamper-proof receipt with signature status and a plain-English explanation of action, cost, and funding mode.