@noodleseed/agent-kit 0.55.0 → 0.56.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodleseed/agent-kit",
-  "version": "0.55.0",
+  "version": "0.56.1",
   "private": false,
   "description": "Self-checking, self-updating agent skills for the Noodle Seed CLI. Authored in this repo by @noodle-borg/agent-kit; this is the published, independently-versioned canonical skills artifact the CLI fetches and verifies.",
   "license": "Apache-2.0",

package/skills/claude-code/SKILL.md

@@ -3,7 +3,7 @@ name: noodle-seed
 description: "Use when building, validating, testing, deploying, or operating a local or hosted Noodle Seed MCP server or app authored in TypeScript with the noodle CLI."
 ---
 
-<!-- noodle-skill version:0.55.0 hash:ec5bfcd0d8165205 -->
+<!-- noodle-skill version:0.56.1 hash:ec5bfcd0d8165205 -->
 
 # Noodle Seed
 

package/skills/claude-code/authoring-mcp-servers/SKILL.md

@@ -3,7 +3,7 @@ name: authoring-mcp-servers
 description: "Use when creating or extending a headless Noodle Seed MCP server, tool, resource, prompt, or typed model-facing capability."
 ---
 
-<!-- noodle-skill version:0.55.0 hash:0b2fd8c7e43fc69f -->
+<!-- noodle-skill version:0.56.1 hash:0b2fd8c7e43fc69f -->
 
 # authoring-mcp-servers
 

package/skills/claude-code/building-mcp-apps/SKILL.md

@@ -3,7 +3,7 @@ name: building-mcp-apps
 description: "Use when a Noodle Seed MCP App, widget, interactive card, visual interaction, or host-visible UI is the primary requested outcome."
 ---
 
-<!-- noodle-skill version:0.55.0 hash:f7fa54992c8d7692 -->
+<!-- noodle-skill version:0.56.1 hash:f7fa54992c8d7692 -->
 
 # building-mcp-apps
 

package/skills/claude-code/connecting-apis-to-mcp/SKILL.md

@@ -3,7 +3,7 @@ name: connecting-apis-to-mcp
 description: "Use when credentials, an API URL, an OpenAPI document, or an observed response must become real Noodle Seed MCP behavior."
 ---
 
-<!-- noodle-skill version:0.55.0 hash:1e86b8704f407bd3 -->
+<!-- noodle-skill version:0.56.1 hash:1e86b8704f407bd3 -->
 
 # connecting-apis-to-mcp
 

package/skills/claude-code/debugging-mcp-delivery/SKILL.md

@@ -3,7 +3,7 @@ name: debugging-mcp-delivery
 description: "Use when an existing Noodle Seed MCP project has a concrete validation, runtime, connector, App, host, deployment, or production failure."
 ---
 
-<!-- noodle-skill version:0.55.0 hash:aa715bae12041d7c -->
+<!-- noodle-skill version:0.56.1 hash:aa715bae12041d7c -->
 
 # debugging-mcp-delivery
 

package/skills/claude-code/deploying-mcp-services/SKILL.md

@@ -3,7 +3,7 @@ name: deploying-mcp-services
 description: "Use when the user explicitly requests a Noodle Seed hosted link, configuration write, deployment, access change, rollback, or connection write."
 ---
 
-<!-- noodle-skill version:0.55.0 hash:93e735b7ffb45df1 -->
+<!-- noodle-skill version:0.56.1 hash:93e735b7ffb45df1 -->
 
 # deploying-mcp-services
 

package/skills/claude-code/designing-mcp-products/SKILL.md

@@ -3,7 +3,7 @@ name: designing-mcp-products
 description: "Use when a Noodle Seed MCP product idea needs conversational fit, user benefit, scope, interaction, or evidence design before implementation."
 ---
 
-<!-- noodle-skill version:0.55.0 hash:76cce86729cffbee -->
+<!-- noodle-skill version:0.56.1 hash:76cce86729cffbee -->
 
 # designing-mcp-products
 

package/skills/claude-code/embedding-mcp-assistants/SKILL.md

@@ -3,7 +3,7 @@ name: embedding-mcp-assistants
 description: "Use when embedding a Noodle assistant into an existing SaaS or web application with browser, identity, session, and credential boundaries."
 ---
 
-<!-- noodle-skill version:0.55.0 hash:cc54a67f21c0ecdb -->
+<!-- noodle-skill version:0.56.1 hash:cc54a67f21c0ecdb -->
 
 # embedding-mcp-assistants
 

package/skills/claude-code/examples/customer-auth/README.md

@@ -2,23 +2,26 @@
 
 This curated example owns the customer/end-user authentication capability slot. It proves that a SaaS app
 can protect an MCP endpoint with direct OIDC, retain role/scope-based tool authorization, and route ordinary
-read-only connector calls to the API origin selected by the verified customer's identity provider.
+reads and confirmed actions to the API origin selected by the verified customer's identity provider.
 
 It also owns the customer-branded embedded-assistant presentation showcase. Embedded sessions lack
 direct/federated MCP OIDC endpoint claims, so these routed tools fail with `connector_route_unavailable`;
 static connectors still support embedded delegated exchange. Exercise routed tools through the MCP endpoint.
 
 The public developer entrypoint is [`src/server.ts`](src/server.ts). It exposes a deliberately small MCP
-surface for organization discovery:
+surface for organization discovery and app lifecycle operations:
 
 - `list_my_organizations` lists the NoodleSeed.com organizations the signed-in customer belongs to (no
   arguments — the org set comes from the verified customer session).
 - `list_org_apps` lists apps for one of those organizations through that tenant's API. It is visible and
   callable only when the verified customer has the `org_apps:read` scope and either the `org_admin` or
   `org_member` role.
+- `archive_org_app` archives one app only after exact runtime confirmation. It requires the
+  `org_apps:write` scope and `org_admin` role.
 
-The two tools chain: `list_my_organizations` surfaces the `org_id`s the customer can act on, and
-`list_org_apps` takes one of those `org_id`s. Tool code remains independent of the selected origin.
+The tools chain: `list_my_organizations` surfaces the `org_id`s the customer can act on,
+`list_org_apps` takes one of those ids, and `archive_org_app` accepts the selected app id. Tool code remains
+independent of the selected origin.
 
 ## Declare the customer endpoint
 
@@ -48,11 +51,11 @@ const api = connector('noodleseed_app_api')
       tokenUrl: 'https://id.noodleseed.dev/oauth/token',
       clientId: variable('CUSTOMER_API_CLIENT_ID'),
       clientSecret: secret('CUSTOMER_API_CLIENT_SECRET'),
-      scopes: ['organizations:read', 'org_apps:read'],
+      scopes: ['organizations:read', 'org_apps:read', 'org_apps:write'],
       audience: 'noodleseed-customer-api',
     },
     operations: {
-      // read operations...
+      // read and action operations...
     },
   });
 ```
@@ -65,7 +68,7 @@ public `${user}` expression scope:
 ```ts
 auth: customerAuth.oidc({
   issuer: 'https://id.noodleseed.dev',
-  audience: 'https://org.cloud.noodleseed.dev/app/mcp',
+  audience: 'noodleseed-customer-auth-prod',
   claims: {
     id: 'sub',
     email: 'email',
@@ -90,7 +93,7 @@ auth: customerAuth.federatedOidc({
   issuers: [
     {
       issuer: 'https://id.customer-a.com',
-      audience: 'https://org.cloud.noodleseed.dev/app/mcp',
+      audience: 'noodleseed-customer-auth-prod',
       routing: {
         endpoints: {
           customer_api: { claim: 'tenant.api_base_url' },
@@ -99,7 +102,7 @@ auth: customerAuth.federatedOidc({
     },
     {
       issuer: 'https://login.customer-b.com',
-      audience: 'https://org.cloud.noodleseed.dev/app/mcp',
+      audience: 'noodleseed-customer-auth-prod',
       routing: {
         endpoints: {
           customer_api: { claim: 'organization.routes.customer_api' },
@@ -110,21 +113,56 @@ auth: customerAuth.federatedOidc({
 }),
 ```
 
-At runtime, Noodle Seed validates both the configured audience and exact MCP resource, projects the route
-into private request state, applies its policy, and freezes it for the call. Missing, malformed, or
+At runtime, Noodle Seed validates the configured stable audience, associates the caller with the exact
+transport-derived MCP resource, projects the route into private request state, applies its policy, and
+freezes it for the call. Missing, malformed, or
 disallowed claims return `connector_route_unavailable` before credential lookup or connector egress.
-Resolved URLs never enter artifacts, `${user}`, logs, model output, widgets, confirmation review, broker cache
-keys, or delegated exchange assertions.
+Resolved URLs never enter artifacts, `${user}`, logs, model output, widgets, public confirmation review,
+broker cache keys, or delegated exchange assertions.
 
-This release permits routed reads in tools, including declared nested calls. Routed actions fail with
-`customer_endpoint_action_unsupported`; routed resources, prompts, and ambient context fail with
-`customer_endpoint_surface_unsupported`.
+Routed reads work in tools, including declared nested calls. Routed actions require exact
+`annotations.confirm: true`; otherwise they fail with `customer_endpoint_action_unsupported`. Routed
+resources, prompts, and ambient context fail with `customer_endpoint_surface_unsupported`.
+
+The flagship's routed action uses the normal TypeScript action helper:
+
+```ts
+tool('archive_org_app', {
+  authorization: {
+    requiredScopes: ['org_apps:write'],
+    allowedRoles: ['org_admin'],
+  },
+  annotations: annotations.openAction({ destructive: false, confirm: true }),
+  // input, output, and the normal connectors.app_api.archiveOrgApp(...) call...
+});
+```
+
+The flagship also opts into the current stateless hosted MCP path:
+
+```ts
+interactions: {
+  confirmationFallback: 'host',
+},
+```
+
+A bidirectional client that negotiated form elicitation can complete the standard confirmation exchange
+instead. The explicit host fallback trusts the MCP host to have collected native write approval before the
+tool call reaches Noodle Seed; it is never inferred from client identity and does not replace auth, policy,
+or accurate action/destructive annotations. Omit the fallback when connected hosts are not trusted to
+provide that approval. If neither standard confirmation nor the fallback is available, the action fails
+closed with `interaction_unavailable`.
+
+Preparation stores only sorted route `{ key, fingerprint }` bindings in its private server-held
+continuation; the public review exposes none of them. Acceptance re-resolves the current request route and
+returns `invalid_continuation` if it is missing or changed, before policy, credentials, or egress. A match
+reuses the current frozen snapshot for the action and all nested or later reads.
 
 The application developer owns the direct/federated authorization server. It must publish its path-inserted
 RFC 8414 document as direct HTTP 200 JSON with exact issuer and HTTPS authorization/token/registration/JWKS
 endpoints, authorization-code and refresh grants, PKCE S256, public-client auth method `none`, RFC 8707
-resource handling, and public signing keys. Access tokens must include the exact MCP resource audience; there
-is no audience fallback.
+resource handling, and public signing keys. It validates each exact MCP resource on authorize, code exchange,
+and refresh, then maps approved versions of this app/environment to `noodleseed-customer-auth-prod`. Other
+apps and environments use distinct audiences.
 
 Run `noodle auth doctor src/server.ts` before sharing. Its bounded, read-only probes never register a client.
 Adding the embedded assistant does not choose or rewrite MCP customer auth.
@@ -180,7 +218,8 @@ noodle validate examples/customer-auth/src/server.ts
 
 Against a deployed customer-protected environment, set a short-lived real customer token only in
 `NOODLE_CUSTOMER_TOKEN` and add `--live --org <org> --app <app> --env <env>`. The live doctor performs
-credential exchanges without invoking either business tool.
+credential exchanges without invoking any business tool. Add `--version 1` when testing a pinned version;
+the reported customer resource must match that versioned MCP endpoint.
 
 ## Run locally
 
@@ -487,13 +526,16 @@ https://cloud.noodleseed.dev/o/noodleseed/customer-auth/mcp
 - Tool `list_my_organizations`: calls `GET /api/organizations` and returns the organizations the signed-in
   customer is a member of. Takes no arguments; the org set is scoped by the verified customer session.
 - Tool `list_org_apps`: calls `GET /api/organizations/{org_id}/apps` for one organization `org_id`.
+- Tool `archive_org_app`: after confirmation, calls
+  `POST /api/organizations/{org_id}/apps/{app_id}/archive`.
 
 ## Auth boundary
 
-Noodle Seed verifies the configured OIDC issuer, audience, and exact MCP resource before reading identity or
-routing claims. Public caller identity contains the user/role/scope projection; the customer route remains
-private request state.
+Noodle Seed verifies the configured OIDC issuer and stable audience, then binds the exact transport-derived
+MCP resource before reading identity or routing claims. Public caller identity contains the user/role/scope
+projection; the customer route remains private request state.
 
 Connector-backed tools ask the broker for a route-bound delegated credential; only the endpoint key and
 fingerprint enter broker cache/single-flight state or the assertion. The route claim and inbound MCP bearer
-token never reach tools, connectors, widgets, model output, or downstream systems.
+token never reach tools, connectors, widgets, model output, or downstream systems. Confirmed actions keep
+the same URL-blind binding only in private continuation state and reject acceptance-time drift.

package/skills/claude-code/examples/customer-auth/src/server.ts

@@ -25,7 +25,7 @@ const noodleseedApi = connector('noodleseed_app_api')
       tokenUrl: 'https://id.noodleseed.dev/oauth/token',
       clientId: variable('CUSTOMER_API_CLIENT_ID'),
       clientSecret: secret('CUSTOMER_API_CLIENT_SECRET'),
-      scopes: ['organizations:read', 'org_apps:read'],
+      scopes: ['organizations:read', 'org_apps:read', 'org_apps:write'],
       audience: 'noodleseed-customer-api',
     },
     operations: {
@@ -53,6 +53,19 @@ const noodleseedApi = connector('noodleseed_app_api')
           organizations: '${response.organizations}',
         },
       },
+      archive_org_app: {
+        type: 'action',
+        method: 'POST',
+        path: '/api/organizations/${args.org_id}/apps/${args.app_id}/archive',
+        input: z.object({
+          org_id: z.string(),
+          app_id: z.string(),
+        }),
+        output: z.object({ archived: z.boolean() }),
+        response: {
+          archived: '${response.archived}',
+        },
+      },
     },
   });
 
@@ -73,9 +86,10 @@ export default server(
       },
     },
     use: { app_api: noodleseedApi },
+    interactions: { confirmationFallback: 'host' },
     auth: customerAuth.oidc({
       issuer: 'https://id.noodleseed.dev',
-      audience: 'https://org.cloud.noodleseed.dev/app/mcp',
+      audience: 'noodleseed-customer-auth-prod',
       claims: {
         id: 'sub',
         email: 'email',
@@ -91,7 +105,7 @@ export default server(
       },
     }),
     instructions:
-      'Direct/federated MCP OIDC demo. The customer IdP proves identity and privately selects the tenant API base URL for read-only MCP calls, while the broker supplies delegated credentials.',
+      'Direct/federated MCP OIDC demo. The customer IdP proves identity and privately selects the tenant API base URL, while the broker supplies delegated credentials and confirmed actions stay bound to the reviewed route.',
     assistant: embeddedAssistant({
       model: openAICompatible({
         baseUrl: variable('ASSISTANT_MODEL_BASE_URL'),
@@ -169,5 +183,30 @@ export default server(
         };
       },
     }),
+    tool('archive_org_app', {
+      title: 'Archive organization app',
+      description: 'Archive one NoodleSeed.com app through its customer API after confirmation.',
+      authorization: {
+        requiredScopes: ['org_apps:write'],
+        allowedRoles: ['org_admin'],
+      },
+      input: z.object({
+        org_id: z.string().meta({ title: 'Organization' }),
+        app_id: z.string().meta({ title: 'App' }),
+      }),
+      output: z.object({
+        archived: z.boolean(),
+      }),
+      annotations: annotations.openAction({ destructive: false, confirm: true }),
+      fulfil({ input, connectors }) {
+        const result = connectors.app_api.archiveOrgApp({
+          org_id: input.org_id,
+          app_id: input.app_id,
+        });
+        return {
+          archived: result.archived,
+        };
+      },
+    }),
   ],
 );

package/skills/claude-code/examples/customer-auth/test/server.test.ts

@@ -26,7 +26,7 @@ describe('customer-auth example', () => {
     expect(manifest.server.auth).toEqual({
       kind: 'oidc',
       issuer: 'https://id.noodleseed.dev',
-      audience: 'https://org.cloud.noodleseed.dev/app/mcp',
+      audience: 'noodleseed-customer-auth-prod',
       claims: {
         id: 'sub',
         email: 'email',
@@ -41,6 +41,7 @@ describe('customer-auth example', () => {
         },
       },
     });
+    expect(manifest.server.interactions).toEqual({ confirmationFallback: 'host' });
     const catalog = app.toConnectorCatalog();
     expect(catalog?.connectors).toHaveLength(1);
     expect(catalog?.connectors[0]?.http).toMatchObject({
@@ -56,11 +57,11 @@ describe('customer-auth example', () => {
         clientSecret: 'CUSTOMER_API_CLIENT_SECRET',
       },
     });
-    expect(
-      Object.values(catalog?.connectors[0]?.http?.operations ?? {}).every(
-        (operation) => operation.type === 'read',
-      ),
-    ).toBe(true);
+    expect(catalog?.connectors[0]?.operations).toMatchObject({
+      list_org_apps: { type: 'read' },
+      list_organizations: { type: 'read' },
+      archive_org_app: { type: 'action', method: 'POST' },
+    });
     expect(catalog?.connectors[0]?.http).not.toHaveProperty('allowedOrigins');
     expect(JSON.stringify({ manifest, catalog })).not.toContain('tenant-a.api.noodleseed.dev');
     expect(manifest.tools.find((tool) => tool.name === 'list_org_apps')?.authorization).toEqual({
@@ -70,5 +71,17 @@ describe('customer-auth example', () => {
     expect(
       manifest.tools.find((tool) => tool.name === 'list_my_organizations')?.authorization,
     ).toBeUndefined();
+    expect(manifest.tools.find((tool) => tool.name === 'archive_org_app')).toMatchObject({
+      authorization: {
+        requiredScopes: ['org_apps:write'],
+        allowedRoles: ['org_admin'],
+      },
+      annotations: {
+        readOnlyHint: false,
+        destructiveHint: false,
+        openWorldHint: true,
+        confirm: true,
+      },
+    });
   });
 });

package/skills/claude-code/executing-noodle-plans/SKILL.md

@@ -3,7 +3,7 @@ name: executing-noodle-plans
 description: "Use when the user asks to execute an approved, decision-complete implementation plan for a Noodle Seed project task by task with test-first changes, review, recovery, and final verification."
 ---
 
-<!-- noodle-skill version:0.55.0 hash:6a9f132ddb79352e -->
+<!-- noodle-skill version:0.56.1 hash:6a9f132ddb79352e -->
 
 # Execute a Noodle Seed implementation plan
 

package/skills/claude-code/publishing-mcp-integrations/SKILL.md

@@ -3,7 +3,7 @@ name: publishing-mcp-integrations
 description: "Use when preparing, reviewing, or submitting a Noodle Seed MCP integration to a host or app directory."
 ---
 
-<!-- noodle-skill version:0.55.0 hash:efffbf82007f935d -->
+<!-- noodle-skill version:0.56.1 hash:efffbf82007f935d -->
 
 # publishing-mcp-integrations
 

package/skills/claude-code/references/authoring-workflow.md

@@ -108,14 +108,14 @@ More: `auth.kind` is `bearer` | `apiKey` (needs `header`) | `clientCredentials`
 
 For `customerAuth.oidc(...)` and `.federatedOidc(...)`, the application developer owns the standards-compliant authorization server. Noodle verifies its access tokens; it does not proxy discovery, create OAuth clients, or repair the upstream server. For issuer `https://id.example.com/oauth`, publish the path-inserted RFC 8414 document at `https://id.example.com/.well-known/oauth-authorization-server/oauth` as direct unauthenticated HTTP 200 JSON — never a login redirect.
 
-That metadata must expose HTTPS `authorization_endpoint`, `token_endpoint`, `jwks_uri`, and RFC 7591 `registration_endpoint`; advertise authorization-code and refresh-token grants, Dynamic Client Registration, PKCE with `code_challenge_methods_supported: ["S256"]`, and public clients with `token_endpoint_auth_methods_supported: ["none"]`. Implement RFC 8707 `resource`, mint access-token `aud` for the exact MCP resource URL, and publish only public signing keys in JWKS. Run `noodle auth doctor src/server.ts`; its issuer-readiness probes perform bounded read-only GET checks and never register a client. A successful `noodle deploy --access customers` reports the same readiness without turning a diagnostic failure into a failed deployment.
+That metadata must expose HTTPS `authorization_endpoint`, `token_endpoint`, `jwks_uri`, and RFC 7591 `registration_endpoint`; advertise authorization-code and refresh-token grants, Dynamic Client Registration, PKCE with `code_challenge_methods_supported: ["S256"]`, and public clients with `token_endpoint_auth_methods_supported: ["none"]`. Validate the exact RFC 8707 `resource` on authorize, code exchange, and refresh, then map approved versions of one app/environment to the stable audience configured in `customerAuth`; use distinct audiences across apps and environments. Publish only public signing keys in JWKS. Run `noodle auth doctor src/server.ts`; its issuer-readiness probes perform bounded read-only GET checks and never register a client. A successful `noodle deploy --access customers` reports the same readiness without turning a diagnostic failure into a failed deployment.
 
 ## Auth-derived customer API endpoints
 
 Use a customer endpoint when the verified IdP selects a different API base URL for each SaaS customer. The claim contains the complete base URL; tool input and `${user}` do not select it. Declare one named policy, use that reference as the connector `baseUrl`, and map its claim path in direct OIDC or on every federated issuer:
 
 ```ts
-import { connector, customerAuth, customerEndpoint, secret, server, tool, variable, z } from '@noodleseed/one';
+import { annotations, connector, customerAuth, customerEndpoint, secret, server, tool, variable, z } from '@noodleseed/one';
 
 const customerApi = customerEndpoint('customer_api', {
   allowedHttpsHostSuffixes: ['api.noodleseed.dev'],
@@ -137,6 +137,13 @@ const api = connector('customer_api_connector').version('1.0.0').http({
       input: z.object({}),
       output: z.object({ records: z.array(z.unknown()).max(100) }),
     },
+    archive_record: {
+      type: 'action',
+      method: 'POST',
+      path: '/records/${args.record_id}/archive',
+      input: z.object({ record_id: z.string() }),
+      output: z.object({ archived: z.boolean() }),
+    },
   },
 });
 
@@ -146,9 +153,10 @@ export default server(
     title: 'Customer records',
     version: '1.0.0',
     use: { api },
+    interactions: { confirmationFallback: 'host' },
     auth: customerAuth.oidc({
       issuer: 'https://id.noodleseed.dev',
-      audience: 'https://org.cloud.noodleseed.dev/app/mcp',
+      audience: 'noodleseed-customer-records-prod',
       routing: {
         endpoints: {
           customer_api: { claim: 'tenant.api_base_url' },
@@ -166,17 +174,29 @@ export default server(
         return { records: result.records };
       },
     }),
+    tool('archive_record', {
+      description: 'Archive one record for the signed-in customer.',
+      input: z.object({ record_id: z.string() }),
+      output: z.object({ archived: z.boolean() }),
+      annotations: annotations.openAction({ destructive: false, confirm: true }),
+      fulfil({ input, connectors }) {
+        const result = connectors.api.archiveRecord({ record_id: input.record_id });
+        return { archived: result.archived };
+      },
+    }),
   ],
 );
 ```
 
 `customerEndpoint` accepts exactly one non-empty policy arm: exact HTTPS origins, or HTTPS hostname suffixes. Exact policies may authorize an explicit non-default port; suffix policies allow port 443 and match only the exact host or dot-boundary subdomains. Do not add connector `allowedOrigins` to a customer-routed connector. Its fixed credential/token endpoints are validated independently and cannot come from caller claims.
 
+On a bidirectional MCP transport whose client negotiated form elicitation, Noodle sends the standard confirmation form. The current stateless hosted MCP transport cannot initiate that exchange, so the example explicitly declares `server.interactions.confirmationFallback: 'host'`. That fallback trusts the MCP host to have collected native write approval before the tool call reaches Noodle; it is never inferred from client identity and does not replace authentication, authorization, policy, or accurate action/destructive annotations. Omit it when connected hosts are not trusted to provide that approval; confirmation then fails closed with `interaction_unavailable` when the standard exchange is unavailable.
+
 Every federated issuer must repeat every endpoint key used by the app, although each issuer may choose a different claim path. Endpoint names use lowercase letters, numbers, and underscores. Resolved claims must be exact absolute HTTPS URLs of at most 2,048 UTF-8 bytes with no userinfo, query, fragment, IP literal, special-use host, or unsafe whitespace/control characters. The runtime preserves a canonical optional base path.
 
-Resolved customer URLs are private routing authority: they never enter the manifest/artifact, `${user}`, logs, model output, widgets, confirmation review, cache keys, or delegated-token-exchange assertions. Routed read operations may be used by tools, including their declared nested connector calls. Customer-routed action operations fail compilation with `customer_endpoint_action_unsupported`; routed resources, prompts, and ambient context fail with `customer_endpoint_surface_unsupported` in this release.
+Resolved customer URLs are private routing authority: they never enter the manifest/artifact, `${user}`, logs, model output, widgets, public confirmation review, cache keys, or delegated-token-exchange assertions. Routed reads may be used by tools, including declared nested calls. A routed action—including one reached through a connector wrapper—requires exact `annotations.confirm: true`; omitted or `false` fails with `customer_endpoint_action_unsupported`. Routed resources, prompts, and ambient context fail with `customer_endpoint_surface_unsupported`.
 
-At runtime, a missing, malformed, or disallowed claim returns the same safe `connector_route_unavailable` tool error before credential lookup or connector egress. `tools/list` remains based only on roles and scopes, so route availability neither reveals tenant topology nor changes the existing authorization filter.
+At runtime, an initially missing, malformed, or disallowed claim returns the same safe `connector_route_unavailable` tool error before credential lookup or connector egress. Preparation stores only sorted route `{ key, fingerprint }` bindings in the private server-held continuation. Acceptance re-resolves the current request routes; a missing or changed binding returns `invalid_continuation` before policy, credentials, or egress, then the matching frozen snapshot is reused for the action and nested/later calls. `tools/list` remains based only on roles and scopes, so route availability neither reveals tenant topology nor changes the existing authorization filter.
 
 ## Per-tool authorization
 
@@ -267,7 +287,7 @@ export async function tokenEndpoint(req: Request): Promise<Response> {
 }
 ```
 
-Diagnose statically with `noodle auth doctor`; set a short-lived real customer token only in `NOODLE_CUSTOMER_TOKEN` and add `--live --org <org> --app <app> --env <env>` to perform one exchange per delegated binding without invoking a business tool. Common failures include structured `credential_unavailable` reasons such as `caller_identity_not_customer`. Direct/federated OIDC verification assigns the customer identity at the trusted verifier boundary; never ask an IdP to mint a Noodle-specific classification claim.
+Diagnose statically with `noodle auth doctor`; set a short-lived real customer token only in `NOODLE_CUSTOMER_TOKEN` and add `--live --org <org> --app <app> --env <env>` to perform one exchange per delegated binding without invoking a business tool. Add `--version <version>` to test that exact pinned MCP resource. Common failures include structured `credential_unavailable` reasons such as `caller_identity_not_customer`. Direct/federated OIDC verification assigns the customer identity at the trusted verifier boundary; never ask an IdP to mint a Noodle-specific classification claim.
 
 ## Design tools for the model
 

package/skills/claude-code/references/compile-errors.md

@@ -67,9 +67,10 @@ Run `noodle validate` (add `--json` for the machine-readable envelope, `--fix-pr
 | `customer_endpoint_mapping_required` | Add the endpoint key at the cited auth routing path; every direct/federated issuer must map every customer endpoint used by the app. |
 | `customer_endpoint_unknown_mapping` | Remove the unknown or unused auth routing key, or use that exact declared `customerEndpoint` key from a reachable connector operation. |
 | `customer_endpoint_bridge_unsupported` | Replace the Firebase/Microsoft bridge with direct or federated OIDC before using auth-derived customer connector endpoints. |
-| `customer_endpoint_action_unsupported` | Use a read operation for this customer-routed call until route-bound action confirmation support is available. |
+| `customer_endpoint_action_unsupported` | Set exact `annotations.confirm: true` on the enclosing tool, or keep the customer-routed operation read-only; action hints alone do not enable confirmation. |
 | `customer_endpoint_surface_unsupported` | Move the customer-routed call into a tool fulfilment; routed resources, prompts, and ambient providers are unsupported. |
 | `customer_endpoint_credential_source_unsupported` | Remove the manifest connection binding; a customer-routed connector uses its declared delegated token exchange auth or no auth. |
 | `customer_endpoint_policy_conflict` | Give every reachable declaration of this endpoint key one identical policy, or rename keys whose allowed origins differ. |
+| `customer_endpoint_routing_inconsistent` | Regenerate the connector catalog so every action route includes all of its ordinary customer endpoint dependencies. |
 | `unused_connector_alias` | A declared connector alias is never called; remove the unused `use` entry or wire it into a tool. |
 | `arg_mismatch` | A connector call is missing or adds arguments; match the operation signature under `expected`/`got`. |

package/skills/claude-code/references/examples.md

@@ -14,7 +14,7 @@ Paths are relative to this skill directory. Assets (images/fonts) are omitted fr
 | `acme-discovery` | Top-of-funnel discovery→handoff: a discovery carousel, a `create_handoff` deep link, and a design-first UX spec + wireframe. | `examples/acme-discovery/src/server.ts` + `design/` |
 | `acme-tasks` | A two-way productivity app designed around its top-3 prioritized flows (capture/prioritize/complete), with a design-first flow spec + wireframe. | `examples/acme-tasks/src/server.ts` + `design/` |
 | `acme-bistro` | End-to-end ordering with a payment-only handoff; ships a gold-standard `design/` set (UX doc, wireframe with compliance audit, API contract). | `examples/acme-bistro/src/server.ts` + `design/` |
-| `customer-auth` | End-user (customer) auth via OIDC/Firebase bridge with delegated credentials. | `examples/customer-auth/src/server.ts` |
+| `customer-auth` | End-user OIDC, private customer API routing, route-bound confirmed actions, roles/scopes, and delegated credentials. | `examples/customer-auth/src/server.ts` |
 | `gmail-multi-account` | One curated Gmail connector reused by two account bindings, canonical account arrays, exact mutation confirmation, and an accompanying personal-automation skill. | `examples/gmail-multi-account/src/server.ts` |
 | `google-bigquery` | Keyless Google Workload Identity Federation with optional service-account impersonation, a BigQuery REST connector, and complete developer/operator setup. | `examples/google-bigquery/src/server.ts` |
 

package/skills/claude-code/reporting-noodle-feedback/SKILL.md

@@ -3,7 +3,7 @@ name: reporting-noodle-feedback
 description: "Use when a Noodle Seed bug, misleading instruction, missing capability, or concrete product improvement should be proposed to the user."
 ---
 
-<!-- noodle-skill version:0.55.0 hash:0f404109f4845683 -->
+<!-- noodle-skill version:0.56.1 hash:0f404109f4845683 -->
 
 # reporting-noodle-feedback
 

package/skills/claude-code/verifying-mcp-delivery/SKILL.md

@@ -3,7 +3,7 @@ name: verifying-mcp-delivery
 description: "Use when proving a Noodle Seed MCP project works at a named compile, local, connector, App, host, deployment, or production evidence level."
 ---
 
-<!-- noodle-skill version:0.55.0 hash:6ef6ef551e26b78e -->
+<!-- noodle-skill version:0.56.1 hash:6ef6ef551e26b78e -->
 
 # verifying-mcp-delivery
 

package/skills/codex/SKILL.md

@@ -3,7 +3,7 @@ name: noodle-seed
 description: "Use when building, validating, testing, deploying, or operating a local or hosted Noodle Seed MCP server or app authored in TypeScript with the noodle CLI."
 ---
 
-<!-- noodle-skill version:0.55.0 hash:ec5bfcd0d8165205 -->
+<!-- noodle-skill version:0.56.1 hash:ec5bfcd0d8165205 -->
 
 # Noodle Seed
 

package/skills/codex/authoring-mcp-servers/SKILL.md

@@ -3,7 +3,7 @@ name: authoring-mcp-servers
 description: "Use when creating or extending a headless Noodle Seed MCP server, tool, resource, prompt, or typed model-facing capability."
 ---
 
-<!-- noodle-skill version:0.55.0 hash:0b2fd8c7e43fc69f -->
+<!-- noodle-skill version:0.56.1 hash:0b2fd8c7e43fc69f -->
 
 # authoring-mcp-servers
 

package/skills/codex/building-mcp-apps/SKILL.md

@@ -3,7 +3,7 @@ name: building-mcp-apps
 description: "Use when a Noodle Seed MCP App, widget, interactive card, visual interaction, or host-visible UI is the primary requested outcome."
 ---
 
-<!-- noodle-skill version:0.55.0 hash:f7fa54992c8d7692 -->
+<!-- noodle-skill version:0.56.1 hash:f7fa54992c8d7692 -->
 
 # building-mcp-apps
 

package/skills/codex/connecting-apis-to-mcp/SKILL.md

@@ -3,7 +3,7 @@ name: connecting-apis-to-mcp
 description: "Use when credentials, an API URL, an OpenAPI document, or an observed response must become real Noodle Seed MCP behavior."
 ---
 
-<!-- noodle-skill version:0.55.0 hash:1e86b8704f407bd3 -->
+<!-- noodle-skill version:0.56.1 hash:1e86b8704f407bd3 -->
 
 # connecting-apis-to-mcp
 

package/skills/codex/debugging-mcp-delivery/SKILL.md

@@ -3,7 +3,7 @@ name: debugging-mcp-delivery
 description: "Use when an existing Noodle Seed MCP project has a concrete validation, runtime, connector, App, host, deployment, or production failure."
 ---
 
-<!-- noodle-skill version:0.55.0 hash:aa715bae12041d7c -->
+<!-- noodle-skill version:0.56.1 hash:aa715bae12041d7c -->
 
 # debugging-mcp-delivery
 

package/skills/codex/deploying-mcp-services/SKILL.md

@@ -3,7 +3,7 @@ name: deploying-mcp-services
 description: "Use when the user explicitly requests a Noodle Seed hosted link, configuration write, deployment, access change, rollback, or connection write."
 ---
 
-<!-- noodle-skill version:0.55.0 hash:93e735b7ffb45df1 -->
+<!-- noodle-skill version:0.56.1 hash:93e735b7ffb45df1 -->
 
 # deploying-mcp-services
 

package/skills/codex/designing-mcp-products/SKILL.md

@@ -3,7 +3,7 @@ name: designing-mcp-products
 description: "Use when a Noodle Seed MCP product idea needs conversational fit, user benefit, scope, interaction, or evidence design before implementation."
 ---
 
-<!-- noodle-skill version:0.55.0 hash:76cce86729cffbee -->
+<!-- noodle-skill version:0.56.1 hash:76cce86729cffbee -->
 
 # designing-mcp-products
 

package/skills/codex/embedding-mcp-assistants/SKILL.md

@@ -3,7 +3,7 @@ name: embedding-mcp-assistants
 description: "Use when embedding a Noodle assistant into an existing SaaS or web application with browser, identity, session, and credential boundaries."
 ---
 
-<!-- noodle-skill version:0.55.0 hash:cc54a67f21c0ecdb -->
+<!-- noodle-skill version:0.56.1 hash:cc54a67f21c0ecdb -->
 
 # embedding-mcp-assistants