@noodleseed/agent-kit 0.58.2 → 0.60.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodleseed/agent-kit",
-  "version": "0.58.2",
+  "version": "0.60.0",
   "private": false,
   "description": "Self-checking, self-updating agent skills for the Noodle Seed CLI. Authored in this repo by @noodle-borg/agent-kit; this is the published, independently-versioned canonical skills artifact the CLI fetches and verifies.",
   "license": "Apache-2.0",

package/skills/claude-code/SKILL.md

@@ -3,7 +3,7 @@ name: noodle-seed
 description: "Use when building, validating, testing, deploying, or operating a local or hosted Noodle Seed MCP server or app authored in TypeScript with the noodle CLI."
 ---
 
-<!-- noodle-skill version:0.58.2 hash:ec5bfcd0d8165205 -->
+<!-- noodle-skill version:0.60.0 hash:d83543258e5ca5ff -->
 
 # Noodle Seed
 
@@ -19,15 +19,16 @@ If the request is unrelated to the Noodle MCP surface, stop here: follow the pro
 
 Choose exactly one primary route from the user outcome below, then load the selected sibling skill and hand off the request. Read that primary reference in full; read supporting references only when the sibling or observed evidence requires them. Do not reread the corpus or restart discovery after the handoff.
 
-Apply this precedence when wording overlaps: concrete failure evidence takes the debugging route; an MCP App/UI outcome takes the App route; external API integration from credentials, a URL, or an API specification takes precedence over generic server building; hosted inspection is debugging read-only; hosted mutation requires the explicitly requested deployment route.
+Apply this precedence when wording overlaps: concrete failure evidence takes the debugging route; an MCP App/UI outcome takes the App route; an existing application with no stable, usable API or specification takes `wrapping-existing-applications`; only when all four API-evidence inputs exist—an API base URL, authentication scheme, representative safe read, and observed response—use `connecting-apis-to-mcp`; missing, stale, inaccessible, undocumented-only, or otherwise unusable evidence remains in `wrapping-existing-applications`; both integration routes take precedence over generic server building; hosted inspection is debugging read-only; hosted mutation requires the explicitly requested deployment route.
 
 Negative routing examples: “Inspect hosted logs/status” → `inspect-hosted` (read-only). “Prepare for deployment” → the applicable build or verification route and stop with a handoff; preparation does not authorize `link`, hosted config, deployment, rollback, host writes, or submission. “Keep this local” → a build or verification route, never a hosted route.
 
 | User outcome | Load sibling skill | Canonical playbook | Done when |
 | :--- | :--- | :--- | :--- |
 | Turn a vague MCP product idea into a bounded design before implementation | `designing-mcp-products` | `references/experience-design.md` (`references/authoring-workflow.md`) | The product contract identifies the user benefit, model boundary, evidence, and next implementation skill. |
+| Plan how to wrap an existing application that has no stable usable public API | `wrapping-existing-applications` | `references/wrap-existing-app.md` (`references/authoring-workflow.md`, `references/tool-design.md`) | A sanitized identity-first capability map and repository-scoped implementation plan are presented for approval before mutation. |
 | Create or extend a headless MCP server whose external API contract is already modeled | `authoring-mcp-servers` | `references/build-an-mcp-server.md` (`references/authoring-workflow.md`, `references/sdk-surface.md`) | The requested server behavior is locally validated and tested; connector reads have real-output evidence. |
-| Connect a real API when credentials or an API specification are available | `connecting-apis-to-mcp` | `references/connect-an-api.md` (`references/authoring-workflow.md`) | A representative live read returns populated, intentionally mapped fields without exposing credentials. |
+| Connect a real API only when all four API-evidence inputs exist: API base URL, authentication scheme, representative safe read, and observed response | `connecting-apis-to-mcp` | `references/connect-an-api.md` (`references/authoring-workflow.md`) | A representative live read returns populated, intentionally mapped fields without exposing credentials. |
 | Build or change an MCP App, widget, or host-visible UI | `building-mcp-apps` | `references/build-an-mcp-app.md` (`references/experience-design.md`, `references/widgets-and-apps.md`) | The UI has a stated user benefit, passes the requested checks, and degrades to useful text. |
 | Validate, test, or prove a project at a named delivery evidence level | `verifying-mcp-delivery` | `references/verify-and-recover.md` (`references/test-in-hosts.md`) | The failing evidence layer is repaired and rerun, or the remaining blocker and exact next action are reported. |
 | Diagnose or recover an existing project with concrete local or hosted failure evidence | `debugging-mcp-delivery` | `references/verify-and-recover.md` (`references/troubleshooting.md`, `references/inspect-hosted.md`) | The failing layer is repaired and rerun, or the stable blocker and exact next action are reported. |
@@ -63,6 +64,7 @@ This is a lookup catalog, not a discovery checklist. Return here only when the s
 - `references/tool-design.md` — intent-shaped tools, titles and annotations, bounded outputs, tool-surface budget, and context provisioning.
 - `references/embedded-assistant.md` — HTTPS origins, managed model config, deploy sequencing, session exchange, browser mounting, and credential boundaries.
 - `references/connect-an-api.md` — secure credentials, probe the live API, model the observed shape, and prove real output.
+- `references/wrap-existing-app.md` — read-only identity-first planning for an existing application with no stable usable API.
 - `references/build-an-mcp-app.md` — product-fit, output-boundary, fallback, and evidence workflow for an MCP App.
 - `references/experience-design.md` — design an app experience: funnel boundary, grounding, two users, display modes, and wireframe.
 - `references/widgets-and-apps.md` — MCP Apps, typed views, widget hooks, output shaping, and CSP.

package/skills/claude-code/authoring-mcp-servers/SKILL.md

@@ -3,7 +3,7 @@ name: authoring-mcp-servers
 description: "Use when creating or extending a headless Noodle Seed MCP server, tool, resource, prompt, or typed model-facing capability."
 ---
 
-<!-- noodle-skill version:0.58.2 hash:0b2fd8c7e43fc69f -->
+<!-- noodle-skill version:0.60.0 hash:0b2fd8c7e43fc69f -->
 
 # authoring-mcp-servers
 

package/skills/claude-code/building-mcp-apps/SKILL.md

@@ -3,7 +3,7 @@ name: building-mcp-apps
 description: "Use when a Noodle Seed MCP App, widget, interactive card, visual interaction, or host-visible UI is the primary requested outcome."
 ---
 
-<!-- noodle-skill version:0.58.2 hash:f7fa54992c8d7692 -->
+<!-- noodle-skill version:0.60.0 hash:f7fa54992c8d7692 -->
 
 # building-mcp-apps
 

package/skills/claude-code/connecting-apis-to-mcp/SKILL.md

@@ -1,9 +1,9 @@
 ---
 name: connecting-apis-to-mcp
-description: "Use when credentials, an API URL, an OpenAPI document, or an observed response must become real Noodle Seed MCP behavior."
+description: "Use when all four API-evidence inputs exist—and only then: API base URL, authentication scheme, representative safe read, and observed response."
 ---
 
-<!-- noodle-skill version:0.58.2 hash:1e86b8704f407bd3 -->
+<!-- noodle-skill version:0.60.0 hash:21bbd3ec441ffd30 -->
 
 # connecting-apis-to-mcp
 
@@ -11,13 +11,12 @@ Connect a real API using managed credentials and mappings proven against observe
 
 ## Use when
 
-- Connect this OpenAPI URL to MCP.
-- Use these API credentials for a real connector.
+- Connect this API after confirming its base URL, authentication scheme, safe read, and observed response.
 
 ## Do not use when
 
 - Do not use for static local behavior.
-- Do not use when credentials or a representative safe read are unavailable.
+- Do not use when all available API evidence is stale, inaccessible, undocumented-only, or otherwise unusable.
 
 ## Required inputs
 

package/skills/claude-code/debugging-mcp-delivery/SKILL.md

@@ -3,7 +3,7 @@ name: debugging-mcp-delivery
 description: "Use when an existing Noodle Seed MCP project has a concrete validation, runtime, connector, App, host, deployment, or production failure."
 ---
 
-<!-- noodle-skill version:0.58.2 hash:aa715bae12041d7c -->
+<!-- noodle-skill version:0.60.0 hash:aa715bae12041d7c -->
 
 # debugging-mcp-delivery
 

package/skills/claude-code/deploying-mcp-services/SKILL.md

@@ -3,7 +3,7 @@ name: deploying-mcp-services
 description: "Use when the user explicitly requests a Noodle Seed hosted link, configuration write, deployment, access change, rollback, or connection write."
 ---
 
-<!-- noodle-skill version:0.58.2 hash:93e735b7ffb45df1 -->
+<!-- noodle-skill version:0.60.0 hash:93e735b7ffb45df1 -->
 
 # deploying-mcp-services
 

package/skills/claude-code/designing-mcp-products/SKILL.md

@@ -3,7 +3,7 @@ name: designing-mcp-products
 description: "Use when a Noodle Seed MCP product idea needs conversational fit, user benefit, scope, interaction, or evidence design before implementation."
 ---
 
-<!-- noodle-skill version:0.58.2 hash:76cce86729cffbee -->
+<!-- noodle-skill version:0.60.0 hash:76cce86729cffbee -->
 
 # designing-mcp-products
 

package/skills/claude-code/embedding-mcp-assistants/SKILL.md

@@ -3,7 +3,7 @@ name: embedding-mcp-assistants
 description: "Use when embedding a Noodle assistant into an existing SaaS or web application with browser, identity, session, and credential boundaries."
 ---
 
-<!-- noodle-skill version:0.58.2 hash:cc54a67f21c0ecdb -->
+<!-- noodle-skill version:0.60.0 hash:cc54a67f21c0ecdb -->
 
 # embedding-mcp-assistants
 

package/skills/claude-code/examples/customer-auth/README.md

@@ -4,9 +4,9 @@ This curated example owns the customer/end-user authentication capability slot.
 can protect an MCP endpoint with direct OIDC, retain role/scope-based tool authorization, and route ordinary
 reads and confirmed actions to the API origin selected by the verified customer's identity provider.
 
-It also owns the customer-branded embedded-assistant presentation showcase. Embedded sessions lack
-direct/federated MCP OIDC endpoint claims, so these routed tools fail with `connector_route_unavailable`;
-static connectors still support embedded delegated exchange. Exercise routed tools through the MCP endpoint.
+It also owns the customer-branded embedded-assistant presentation showcase. Direct MCP calls obtain the
+route from the verified OIDC claim; embedded sessions obtain it from the authenticated customer backend's
+session exchange. Both paths keep the URL outside tool/model/browser-visible state.
 
 The public developer entrypoint is [`src/server.ts`](src/server.ts). It exposes a deliberately small MCP
 surface for organization discovery and app lifecycle operations:
@@ -171,7 +171,9 @@ and refresh, then maps approved versions of this app/environment to `noodleseed-
 apps and environments use distinct audiences.
 
 Run `noodle auth doctor src/server.ts` before sharing. Its bounded, read-only probes never register a client.
-Adding the embedded assistant does not choose or rewrite MCP customer auth.
+Adding the embedded assistant does not choose or rewrite MCP customer auth. Its authenticated backend may
+bind `routing.endpoints.customer_api` during assistant-session exchange from server-owned membership data;
+direct MCP requests continue to resolve the same endpoint from the configured verified OIDC claim.
 
 ## Per-tool authorization remains independent
 
@@ -210,10 +212,10 @@ fulfil({ input, connectors }) {
 The broker exchanges a short-lived, platform-signed assertion at the fixed token endpoint and caches the
 result by caller, connector, scopes, and a route fingerprint. The assertion carries only the route key and
 fingerprint, never the URL. The MCP access token is never forwarded to the customer API. The exchange wire
-contract lives in [docs/spec/connectors.md](../../docs/spec/connectors.md).
+contract lives in docs/spec/connectors.md.
 
 Firebase and Microsoft remain supported managed adapters; their provider-specific contracts and tests live
-in [docs/spec/auth-and-policy.md](../../docs/spec/auth-and-policy.md) and the SharePoint flagship.
+in docs/spec/auth-and-policy.md and the SharePoint flagship.
 
 ## Supabase direct-OIDC access-token hook
 
@@ -331,9 +333,11 @@ The embedded assistant uses a customer-supplied OpenAI Chat Completions-compatib
 managed values at the Noodle deployment environment; none of these values belongs in the customer web
 application environment, and the API key never reaches the browser:
 
-The assistant session carries a verified user, tenant, deployment, roles, and scopes, but not the IdP's
-`tenant.api_base_url` claim. These routed operations are MCP-only; do not copy the route into page context,
-session claims, tool input, or model instructions.
+The assistant session carries a verified user, tenant, deployment, roles, and scopes. For this flagship's
+routed tools, the embedding backend resolves the signed-in user's cluster from server-owned membership data
+and passes `routing: { endpoints: { customer_api: cluster.apiBaseUrl } }` to
+`createAssistantSession`. Noodle validates and privately stores that route; it is not returned to the
+browser. Do not copy the route into page context, session claims, tool input, or model instructions.
 
 ```bash
 noodle variables set ASSISTANT_MODEL_BASE_URL https://model.example.com/v1 --scope env
@@ -536,8 +540,9 @@ After deployment, use the assistant doctor to verify the embed client, model, an
 noodle assistant doctor --user-id <real-test-user> --origin "$PUBLIC_APP_ORIGIN" --org <org> --app <app> --env <env>
 ```
 
-This does not add an OIDC customer route. Routed operations succeed only through a direct/federated
-customer-authenticated MCP request with an allowed endpoint claim.
+The doctor does not invent or test an application-specific customer route. Prove routed assistant tools by
+having the authenticated embedding backend pass the user's server-verified endpoint during session
+exchange, then invoke one representative safe read.
 
 If the application deliberately sends a first turn on mount, do not combine a persistent "sent" ref with a
 mount effect. React Strict Mode can abort that provisional request and then suppress the stable remount.

package/skills/claude-code/executing-noodle-plans/SKILL.md

@@ -3,7 +3,7 @@ name: executing-noodle-plans
 description: "Use when the user asks to execute an approved, decision-complete implementation plan for a Noodle Seed project task by task with test-first changes, review, recovery, and final verification."
 ---
 
-<!-- noodle-skill version:0.58.2 hash:6a9f132ddb79352e -->
+<!-- noodle-skill version:0.60.0 hash:6a9f132ddb79352e -->
 
 # Execute a Noodle Seed implementation plan
 

package/skills/claude-code/publishing-mcp-integrations/SKILL.md

@@ -3,7 +3,7 @@ name: publishing-mcp-integrations
 description: "Use when preparing, reviewing, or submitting a Noodle Seed MCP integration to a host or app directory."
 ---
 
-<!-- noodle-skill version:0.58.2 hash:efffbf82007f935d -->
+<!-- noodle-skill version:0.60.0 hash:efffbf82007f935d -->
 
 # publishing-mcp-integrations
 

package/skills/claude-code/references/authoring-workflow.md

@@ -230,7 +230,7 @@ Role values are trusted only from the explicitly configured claim path (or the p
 
 Use delegated connector auth when the downstream API must enforce its own per-user authorization — a shared service credential plus a forwarded user id would bypass it. Three shapes exist; pick by who owns the downstream:
 
-- **`delegatedTokenExchange`** — your own API. The platform signs a short-lived, verifiable assertion of the signed-in user and exchanges it at a token endpoint you implement (RFC 8693). It works with verified customer OIDC identities and the built-in Firebase/Microsoft adapters; no per-user OAuth enrollment. Embedded-assistant sessions support this exchange for static connectors. Customer-routed connectors require a direct or federated MCP OIDC request and fail closed in embedded-assistant sessions because those sessions carry no IdP endpoint claim.
+- **`delegatedTokenExchange`** — your own API. The platform signs a short-lived, verifiable assertion of the signed-in user and exchanges it at a token endpoint you implement (RFC 8693). It works with verified customer OIDC identities and the built-in Firebase/Microsoft adapters; no per-user OAuth enrollment. Embedded-assistant sessions can bind customer-routed connectors when the authenticated embedding backend resolves each route from server-owned tenancy data and passes it during session exchange. Browser input, page context, session claims, and tool arguments cannot supply or override that private route authority.
 - **`delegatedOAuth` with `provider: "firebase" | "microsoft"`** — Noodle-managed bridge providers using stored per-user refresh tokens. Requires the matching `customerAuth` bridge; any other provider string is the compile error `unsupported_delegated_provider`.
 - **`delegatedSessionCookie`** — Firebase-managed session-cookie apps only; not a generic mechanism.
 

package/skills/claude-code/references/embedded-assistant.md

@@ -128,13 +128,13 @@ noodle assistant clients create --name web --org <org> --app <app> --env <env>
 
 The CLI writes `{ clientId, clientSecret }` to a mode-`0600` file and prints only its path. Move the values into the SaaS backend secret manager without printing or committing them. Rotation invalidates the previous secret.
 
-Validate the active deployment, backend credential, exact origin, and delegated credential exchanges without invoking a business tool:
+Validate the active deployment, backend credential, exact origin, and delegated credential exchanges that do not require an application-specific customer route:
 
 ```sh
 noodle assistant doctor --origin "$PUBLIC_APP_ORIGIN" --org <org> --app <app> --env <env>
 ```
 
-The doctor reads `NOODLE_ASSISTANT_CLIENT_ID` / `NOODLE_ASSISTANT_CLIENT_SECRET` or the saved mode-0600 client file and never prints the secret. Pass `--user-id <real-test-user>` only when the downstream exchange requires an existing application user.
+The doctor reads `NOODLE_ASSISTANT_CLIENT_ID` / `NOODLE_ASSISTANT_CLIENT_SECRET` or the saved mode-0600 client file and never prints the secret. Pass `--user-id <real-test-user>` only when the downstream exchange requires an existing application user. The assistant doctor does not supply application-specific routes; after the backend mints a routed session, invoke one representative safe read to verify its route-bound exchange and connector together.
 
 ## Integrate the customer backend
 
@@ -171,6 +171,32 @@ Authenticate before exchange. Pass backend-verified `user.roles` and OAuth-style
 
 `serviceUrl` is the Noodle Seed control-plane base URL: the value `noodle assistant clients create` prints, also stored as `serviceUrl` in `deployment.json`. It is NOT the deployment MCP endpoint (`url`, which ends in `/v1/mcp` and rejects session exchange). Never probe or guess endpoints with real credentials.
 
+### Route customer endpoints from the backend
+
+When a connector uses `customerEndpoint("customer_api", ...)`, resolve the signed-in user's API base URL from authenticated, server-owned tenancy data and bind it during session exchange:
+
+```ts
+const user = await requireCurrentUser(request);
+const account = await requireAccountMembership(user.id);
+
+const session = await createAssistantSession({
+  serviceUrl,
+  clientId,
+  clientSecret,
+  origin,
+  user: { id: user.id, email: user.email },
+  routing: {
+    endpoints: {
+      customer_api: account.clusterApiBaseUrl,
+    },
+  },
+});
+```
+
+The browser does not send `routing`. Authenticate the user and validate account/cluster membership before selecting the URL. Never read it from page context, request headers, session claims, tool arguments, or model output. The endpoint key must match the authored `customerEndpoint` name. Noodle validates the canonical HTTPS URL against the active artifact policy, stores it only in the private short-lived session, and omits it from the session response and caller identity.
+
+Routing is optional: static tools continue to work, while a tool whose endpoint was omitted fails closed with `connector_route_unavailable` before credential or connector egress. A confirmed routed action binds a URL-blind fingerprint at proposal time and rejects a missing or changed route on acceptance.
+
 ## Ground time and ambient facts
 
 Every assistant turn receives a server-authoritative instant and user-local date/time. Locale and IANA time zone resolve in this order: backend-verified `preferences` from session exchange, fresh per-turn browser `clientContext` hints, `server.context.defaults`, then platform defaults (`en-US`/`UTC`). Browser hints affect presentation and relative-date interpretation only; they are untrusted and never authorize a tool.
@@ -515,6 +541,7 @@ Devtools privacy gate: default model and connector exercises to synthetic or moc
 - An expired turn re-exchanges once; interaction decisions never auto-retry. An explicit same-decision repeat returns the stored outcome without executing again.
 - Accept, decline, and cancel are single-use. Only accept executes; the server ignores replacement tool arguments.
 - Wrong-origin and malformed-origin requests fail closed.
+- Browser-controlled fields cannot select or override `routing.endpoints`; a customer-routed connector uses only the backend-verified session route.
 - Run the production-equivalent host build after regenerating environment bindings.
 - In a real browser, submit with the keyboard, inspect console and network failures, complete session exchange and one tool turn, and render one linked App before claiming the host works.
 
@@ -530,6 +557,8 @@ Devtools privacy gate: default model and connector exercises to synthetic or moc
 | Validate rejects an origin | Non-loopback HTTP origin in `allowedOrigins` | Use the exact HTTPS production origin; HTTP is only for `localhost`/`127.0.0.1` |
 | Session exchange returns 404 | `serviceUrl` points at the deployment MCP endpoint | Use the control-plane service URL printed by `noodle assistant clients create` |
 | Session exchange returns 403 `origin is not allowed` | Request origin differs from `allowedOrigins` character-for-character | Align the exact scheme/host/port on both sides and redeploy |
+| Session exchange returns `400` with `invalid assistant routing` | The authenticated backend supplied an unknown endpoint name or a malformed/policy-disallowed URL | Resolve the route from server-owned membership, use the exact authored endpoint name, and ensure the canonical HTTPS URL satisfies its active `customerEndpoint` policy; the error never reflects the URL |
+| A routed assistant tool returns `connector_route_unavailable` | The authenticated backend omitted that endpoint during session exchange | Pass the server-verified route as `routing.endpoints.<name>` when minting a new session; keep it out of browser input |
 | Host session 503 | A required backend environment name is absent or mapped into the wrong deployment environment | Run `noodle assistant embed --check --json`, repair the host CI mapping, then probe the session route again |
 | `HEAD` on a widget or session path looks broken | The route contract is `GET` for the hosted sandbox/widget document or `POST` for session exchange; `HEAD` is not the product flow | Exercise the documented method and inspect its response instead of inferring readiness from `HEAD` |
 | Local server reports `listen EPERM` | The coding sandbox blocked loopback binding before application behavior ran | Rerun the same local/browser test with approved loopback permissions; do not change product code |

package/skills/claude-code/references/examples.md

@@ -27,7 +27,6 @@ Paths are relative to this skill directory. Assets (images/fonts) are omitted fr
 | `bitcoin` | API-key HTTP connector, custom auth header, and compute normalization. |
 | `sharepoint` | Microsoft SharePoint delegated Microsoft Entra auth and Graph tools. |
 | `internal-ops-demo` | Governed internal connectivity — tools/resources/prompts, role-shaped output. |
-| `docs-assistant` | Docs/knowledge assistant grounding coding agents in the live docs export. |
 
 ## Canonical server.ts
 

package/skills/claude-code/references/wrap-existing-app.md

@@ -0,0 +1,65 @@
+# Outcome
+
+Produce a sanitized, repository-grounded plan for wrapping an existing application with a focused Noodle Seed MCP server. Discovery is read-only: present the capability map and implementation phases in the conversation, then stop before writing a plan or source file until the user explicitly authorizes that local mutation and repository.
+
+## Contents
+
+- Use when
+- Do not use when
+- Required inputs
+- Workflow
+- Verification evidence
+- Recovery paths
+- Stop conditions
+
+## Use when
+
+- An existing web application has internal HTTP handlers, framework-owned server calls, or inline database-backed logic but no stable, usable public API or specification.
+- The user wants a decision-complete integration plan before changing the application or Noodle project.
+
+## Do not use when
+
+- Only when all four API-evidence inputs exist—an API base URL, authentication scheme, representative safe read, and observed response—use the API-connection route. If any input is missing, stale, inaccessible, undocumented-only, or otherwise unusable, remain on the existing-application planning route.
+- The request is already-approved implementation, failure diagnosis, deployment, publication, or a host-visible App outcome; use that owning route.
+- Source access is unavailable and the user expects a repository-grounded plan. Return the bounded evidence checklist instead of inventing routes or schemas.
+
+## Required inputs
+
+Confirm the repository or repositories in scope, the user jobs to expose, the requested stopping point, which identity provider authenticates end users, whether callers are the owner's staff or the application's customers, and whether the relevant deployment has one static preconfigured downstream origin.
+
+Never read or print `.env` / `.env.noodle` values, credential stores, browser cookies, production records, secret-bearing logs, or customer payloads. Inspect source, route declarations, authentication middleware, tests, and non-secret configuration declarations only. Record sanitized capability descriptions and source locations, never copied customer code or data.
+
+## Workflow
+
+1. **Establish authority.** Name every repository in scope and whether the user requested discovery, a draft plan, local implementation, or a higher evidence level. Discovery alone authorizes no file or hosted mutation.
+2. **Ask identity first.** Before connector design, ask which identity provider authenticates end users and whether MCP callers are staff or customers. Separate **inbound MCP identity** from **downstream application authorization**. A supported provider can simplify inbound configuration; it does not automatically authorize downstream calls. An application session is not itself an inbound customer identity. Without a standards-based issuer, current production choices are the staff/service-credential path or a customer-built standards-based authorization server; the generic identity bridge is demand-gated and not shipped.
+3. **Choose downstream authorization honestly.** A shared service credential provides attribution, not per-user authorization, and should be least-privilege. Once Noodle has a verified caller identity, a delegated path requires one compatible token endpoint, whether existing or newly added, plus bearer acceptance in the relevant middleware. That endpoint does not solve the inbound session-only identity gap. Logic without a stable HTTP entry point may also need a thin HTTP handler over the existing business function.
+4. **Choose routing.** Use one static `http` connector with one static preconfigured downstream origin so the same server can serve embedded and external MCP clients. The canonical no-API path is a small application-owned integration layer with stable HTTPS handlers over existing business functions. Any downstream origin receiving a service or delegated credential must use HTTPS. Reject redirects for requests carrying service or delegated credentials; require the final HTTPS origin to be configured directly. If the application requires multi-origin routing or has no stable HTTP origin, stop, report a blocker, and hand off to the existing owning routing workflow. Browser input, model text, page context, tool arguments, and caller input cannot select an origin.
+5. **Map jobs, not routes.** For each user job record a sanitized source location, current HTTP/auth boundary, read or action effect, route-adapter need, proposed intent-shaped tool, minimal typed result, confirmation need, and verification evidence. Treat five to twelve tools as a normal budget, not a minimum; a smaller product should ship fewer. Design intent tools, not one tool per internal route.
+6. **Reject unstable seams.** Do not call an unstable server-call protocol whose identifier or serialization changes across builds. Never use direct database access, including ORM or SQL; it bypasses application authorization and business rules. Do not log in and copy a browser session into the runtime; copying a browser session or its credentials into the runtime is prohibited. Do not treat a service credential as per-user authorization. Propose a narrow application-owned HTTP handler instead.
+7. **Separate implementation ownership.** Produce an existing-application phase for handlers/auth/tests, a Noodle-project phase for TypeScript connector/tools/fakes/tests, and a cross-surface verification phase. If repositories differ, create separate repository-scoped plans and approval boundaries.
+8. **Present and stop.** Show the capability map, identity/routing decision, minimum honest application changes, rejected alternatives, test matrix, risks, and phases in the conversation. A design approval is review only. Local implementation requires an explicit “proceed” for the named repository. Local implementation approval does not authorize hosted configuration, live writes, deployment, publication, or issue-state changes; those require their own authority.
+9. **Hand off approved work.** Once a decision-complete local plan is explicitly authorized, persist it when repository workflow requires and hand it to `executing-noodle-plans`. Use the existing server-authoring and API-connection playbooks for implementation and real-output evidence; do not add another task loop here.
+
+## Verification evidence
+
+- **Discovery:** repository instructions, stable HTTP boundaries, auth middleware, and tests were inspected read-only without secret values or copied customer data.
+- **Decision:** inbound identity, downstream authorization, one static preconfigured downstream origin, and required application changes are explicit rather than inferred.
+- **Product:** each proposed tool maps to a user job, typed result, effect, and backing operation within the stated surface budget.
+- **Plan:** application, Noodle, and cross-surface phases name files or subsystems, tests, blockers, approval boundaries, and the first unproven layer.
+- **Conformance boundary:** a later representative safe `noodle tools call` can prove one observed mapping; it does not prove general schema conformance. A dedicated conformance feature is separate.
+
+## Recovery paths
+
+- Unknown identity provider or caller population: stop before choosing customer auth or delegated credentials and ask that one question.
+- No source access: provide the exact route/auth/test evidence checklist and report that no repository-grounded plan was produced.
+- Stable origin but no safe stable HTTP boundary: plan the smallest application-owned stable HTTPS adapter over existing business functions instead of calling a private server protocol.
+- A multi-origin requirement or no stable HTTP origin: stop, report the routing blocker, and hand off to the existing owning routing workflow; browser, model, tool, and caller input cannot select an origin.
+- Missing safe live verification input or working credential: leave that evidence explicitly unproven and name the exact prerequisite. A missing reachable service or action sandbox is handled the same way.
+
+## Stop conditions
+
+- Stop after presenting the draft capability map and plan until the user explicitly approves the next local mutation and repository.
+- Stop before live writes, hosted configuration, deployment, publication, or issue-state mutation without separate explicit authorization.
+- Stop blocked and hand off to the existing owning routing workflow only when the application requires multi-origin routing or has no stable HTTP origin.
+- This workflow does not add an importer, generate manifests or IR, or implement live schema probing, inference, or diffing.

package/skills/claude-code/reporting-noodle-feedback/SKILL.md

@@ -3,7 +3,7 @@ name: reporting-noodle-feedback
 description: "Use when a Noodle Seed bug, misleading instruction, missing capability, or concrete product improvement should be proposed to the user."
 ---
 
-<!-- noodle-skill version:0.58.2 hash:0f404109f4845683 -->
+<!-- noodle-skill version:0.60.0 hash:0f404109f4845683 -->
 
 # reporting-noodle-feedback
 

package/skills/claude-code/verifying-mcp-delivery/SKILL.md

@@ -3,7 +3,7 @@ name: verifying-mcp-delivery
 description: "Use when proving a Noodle Seed MCP project works at a named compile, local, connector, App, host, deployment, or production evidence level."
 ---
 
-<!-- noodle-skill version:0.58.2 hash:6ef6ef551e26b78e -->
+<!-- noodle-skill version:0.60.0 hash:6ef6ef551e26b78e -->
 
 # verifying-mcp-delivery
 

package/skills/claude-code/wrapping-existing-applications/SKILL.md

@@ -0,0 +1,49 @@
+---
+name: wrapping-existing-applications
+description: "Use when an existing application has no stable usable API and needs a read-only, identity-first Noodle Seed integration plan before implementation."
+---
+
+<!-- noodle-skill version:0.60.0 hash:eccc3c158dcafba8 -->
+
+# wrapping-existing-applications
+
+Produce the smallest safe, repository-grounded existing-application integration plan before any mutation.
+
+## Use when
+
+- Plan how to wrap an existing application that has no usable public API.
+- Map internal application capabilities into an approved Noodle Seed implementation plan.
+
+## Do not use when
+
+- Do not use when all four API-evidence inputs exist—an API base URL, authentication scheme, representative safe read, and observed response; use `connecting-apis-to-mcp`. Missing, stale, inaccessible, undocumented-only, or otherwise unusable API evidence remains in `wrapping-existing-applications`.
+- Do not use to execute an approved plan, diagnose a concrete failure, or mutate hosted state.
+
+## Required inputs
+
+- Repository scope and requested stopping point.
+- Target user jobs.
+- End-user identity provider and caller population.
+- One static preconfigured downstream origin, or a routing blocker and owning-workflow handoff.
+
+## Workflow
+
+Read and follow the canonical playbook `references/wrap-existing-app.md` at `../noodle-seed/references/wrap-existing-app.md`. It owns the workflow; do not recreate it here or load the command catalog speculatively.
+Load `references/authoring-workflow.md` at `../noodle-seed/references/authoring-workflow.md` only when the playbook or observed evidence names that concern.
+Load `references/tool-design.md` at `../noodle-seed/references/tool-design.md` only when the playbook or observed evidence names that concern.
+
+## Verification evidence
+
+A sanitized capability map and repository-scoped plan state identity, authorization, routing, application changes, tool budget, tests, blockers, and the first unproven layer.
+
+## Recovery paths
+
+With a stable origin but no safe stable HTTP boundary, plan the smallest application-owned stable HTTPS adapter over existing business functions. If a safe live verification input or working credential is missing, leave that evidence explicitly unproven and name the exact prerequisite. Only multi-origin routing or no stable HTTP origin blocks and hands off to the existing owning routing workflow.
+
+## Stop conditions
+
+Stop after presenting the draft plan and before any file or hosted mutation until the user explicitly authorizes the exact next action and target.
+
+## Handoff contract
+
+Pass the selected outcome, explicit target, changed files, commands run, passing evidence, first unproven evidence layer, sanitized failure, remaining authority, and exact next action. The receiving skill continues from that layer; do not restart discovery or discard prior proof.

package/skills/codex/SKILL.md

@@ -3,7 +3,7 @@ name: noodle-seed
 description: "Use when building, validating, testing, deploying, or operating a local or hosted Noodle Seed MCP server or app authored in TypeScript with the noodle CLI."
 ---
 
-<!-- noodle-skill version:0.58.2 hash:ec5bfcd0d8165205 -->
+<!-- noodle-skill version:0.60.0 hash:d83543258e5ca5ff -->
 
 # Noodle Seed
 
@@ -19,15 +19,16 @@ If the request is unrelated to the Noodle MCP surface, stop here: follow the pro
 
 Choose exactly one primary route from the user outcome below, then load the selected sibling skill and hand off the request. Read that primary reference in full; read supporting references only when the sibling or observed evidence requires them. Do not reread the corpus or restart discovery after the handoff.
 
-Apply this precedence when wording overlaps: concrete failure evidence takes the debugging route; an MCP App/UI outcome takes the App route; external API integration from credentials, a URL, or an API specification takes precedence over generic server building; hosted inspection is debugging read-only; hosted mutation requires the explicitly requested deployment route.
+Apply this precedence when wording overlaps: concrete failure evidence takes the debugging route; an MCP App/UI outcome takes the App route; an existing application with no stable, usable API or specification takes `wrapping-existing-applications`; only when all four API-evidence inputs exist—an API base URL, authentication scheme, representative safe read, and observed response—use `connecting-apis-to-mcp`; missing, stale, inaccessible, undocumented-only, or otherwise unusable evidence remains in `wrapping-existing-applications`; both integration routes take precedence over generic server building; hosted inspection is debugging read-only; hosted mutation requires the explicitly requested deployment route.
 
 Negative routing examples: “Inspect hosted logs/status” → `inspect-hosted` (read-only). “Prepare for deployment” → the applicable build or verification route and stop with a handoff; preparation does not authorize `link`, hosted config, deployment, rollback, host writes, or submission. “Keep this local” → a build or verification route, never a hosted route.
 
 | User outcome | Load sibling skill | Canonical playbook | Done when |
 | :--- | :--- | :--- | :--- |
 | Turn a vague MCP product idea into a bounded design before implementation | `designing-mcp-products` | `references/experience-design.md` (`references/authoring-workflow.md`) | The product contract identifies the user benefit, model boundary, evidence, and next implementation skill. |
+| Plan how to wrap an existing application that has no stable usable public API | `wrapping-existing-applications` | `references/wrap-existing-app.md` (`references/authoring-workflow.md`, `references/tool-design.md`) | A sanitized identity-first capability map and repository-scoped implementation plan are presented for approval before mutation. |
 | Create or extend a headless MCP server whose external API contract is already modeled | `authoring-mcp-servers` | `references/build-an-mcp-server.md` (`references/authoring-workflow.md`, `references/sdk-surface.md`) | The requested server behavior is locally validated and tested; connector reads have real-output evidence. |
-| Connect a real API when credentials or an API specification are available | `connecting-apis-to-mcp` | `references/connect-an-api.md` (`references/authoring-workflow.md`) | A representative live read returns populated, intentionally mapped fields without exposing credentials. |
+| Connect a real API only when all four API-evidence inputs exist: API base URL, authentication scheme, representative safe read, and observed response | `connecting-apis-to-mcp` | `references/connect-an-api.md` (`references/authoring-workflow.md`) | A representative live read returns populated, intentionally mapped fields without exposing credentials. |
 | Build or change an MCP App, widget, or host-visible UI | `building-mcp-apps` | `references/build-an-mcp-app.md` (`references/experience-design.md`, `references/widgets-and-apps.md`) | The UI has a stated user benefit, passes the requested checks, and degrades to useful text. |
 | Validate, test, or prove a project at a named delivery evidence level | `verifying-mcp-delivery` | `references/verify-and-recover.md` (`references/test-in-hosts.md`) | The failing evidence layer is repaired and rerun, or the remaining blocker and exact next action are reported. |
 | Diagnose or recover an existing project with concrete local or hosted failure evidence | `debugging-mcp-delivery` | `references/verify-and-recover.md` (`references/troubleshooting.md`, `references/inspect-hosted.md`) | The failing layer is repaired and rerun, or the stable blocker and exact next action are reported. |
@@ -63,6 +64,7 @@ This is a lookup catalog, not a discovery checklist. Return here only when the s
 - `references/tool-design.md` — intent-shaped tools, titles and annotations, bounded outputs, tool-surface budget, and context provisioning.
 - `references/embedded-assistant.md` — HTTPS origins, managed model config, deploy sequencing, session exchange, browser mounting, and credential boundaries.
 - `references/connect-an-api.md` — secure credentials, probe the live API, model the observed shape, and prove real output.
+- `references/wrap-existing-app.md` — read-only identity-first planning for an existing application with no stable usable API.
 - `references/build-an-mcp-app.md` — product-fit, output-boundary, fallback, and evidence workflow for an MCP App.
 - `references/experience-design.md` — design an app experience: funnel boundary, grounding, two users, display modes, and wireframe.
 - `references/widgets-and-apps.md` — MCP Apps, typed views, widget hooks, output shaping, and CSP.

package/skills/codex/authoring-mcp-servers/SKILL.md

@@ -3,7 +3,7 @@ name: authoring-mcp-servers
 description: "Use when creating or extending a headless Noodle Seed MCP server, tool, resource, prompt, or typed model-facing capability."
 ---
 
-<!-- noodle-skill version:0.58.2 hash:0b2fd8c7e43fc69f -->
+<!-- noodle-skill version:0.60.0 hash:0b2fd8c7e43fc69f -->
 
 # authoring-mcp-servers
 

package/skills/codex/building-mcp-apps/SKILL.md

@@ -3,7 +3,7 @@ name: building-mcp-apps
 description: "Use when a Noodle Seed MCP App, widget, interactive card, visual interaction, or host-visible UI is the primary requested outcome."
 ---
 
-<!-- noodle-skill version:0.58.2 hash:f7fa54992c8d7692 -->
+<!-- noodle-skill version:0.60.0 hash:f7fa54992c8d7692 -->
 
 # building-mcp-apps
 

package/skills/codex/connecting-apis-to-mcp/SKILL.md

@@ -1,9 +1,9 @@
 ---
 name: connecting-apis-to-mcp
-description: "Use when credentials, an API URL, an OpenAPI document, or an observed response must become real Noodle Seed MCP behavior."
+description: "Use when all four API-evidence inputs exist—and only then: API base URL, authentication scheme, representative safe read, and observed response."
 ---
 
-<!-- noodle-skill version:0.58.2 hash:1e86b8704f407bd3 -->
+<!-- noodle-skill version:0.60.0 hash:21bbd3ec441ffd30 -->
 
 # connecting-apis-to-mcp
 
@@ -11,13 +11,12 @@ Connect a real API using managed credentials and mappings proven against observe
 
 ## Use when
 
-- Connect this OpenAPI URL to MCP.
-- Use these API credentials for a real connector.
+- Connect this API after confirming its base URL, authentication scheme, safe read, and observed response.
 
 ## Do not use when
 
 - Do not use for static local behavior.
-- Do not use when credentials or a representative safe read are unavailable.
+- Do not use when all available API evidence is stale, inaccessible, undocumented-only, or otherwise unusable.
 
 ## Required inputs
 

package/skills/codex/debugging-mcp-delivery/SKILL.md

@@ -3,7 +3,7 @@ name: debugging-mcp-delivery
 description: "Use when an existing Noodle Seed MCP project has a concrete validation, runtime, connector, App, host, deployment, or production failure."
 ---
 
-<!-- noodle-skill version:0.58.2 hash:aa715bae12041d7c -->
+<!-- noodle-skill version:0.60.0 hash:aa715bae12041d7c -->
 
 # debugging-mcp-delivery
 

package/skills/codex/deploying-mcp-services/SKILL.md

@@ -3,7 +3,7 @@ name: deploying-mcp-services
 description: "Use when the user explicitly requests a Noodle Seed hosted link, configuration write, deployment, access change, rollback, or connection write."
 ---
 
-<!-- noodle-skill version:0.58.2 hash:93e735b7ffb45df1 -->
+<!-- noodle-skill version:0.60.0 hash:93e735b7ffb45df1 -->
 
 # deploying-mcp-services
 

package/skills/codex/designing-mcp-products/SKILL.md

@@ -3,7 +3,7 @@ name: designing-mcp-products
 description: "Use when a Noodle Seed MCP product idea needs conversational fit, user benefit, scope, interaction, or evidence design before implementation."
 ---
 
-<!-- noodle-skill version:0.58.2 hash:76cce86729cffbee -->
+<!-- noodle-skill version:0.60.0 hash:76cce86729cffbee -->
 
 # designing-mcp-products
 

package/skills/codex/embedding-mcp-assistants/SKILL.md

@@ -3,7 +3,7 @@ name: embedding-mcp-assistants
 description: "Use when embedding a Noodle assistant into an existing SaaS or web application with browser, identity, session, and credential boundaries."
 ---
 
-<!-- noodle-skill version:0.58.2 hash:cc54a67f21c0ecdb -->
+<!-- noodle-skill version:0.60.0 hash:cc54a67f21c0ecdb -->
 
 # embedding-mcp-assistants