@onesi/genesis 0.2.11 → 0.2.13

package/dist/genesis.openapi.json

@@ -136,6 +136,10 @@
     {
       "name": "brews",
       "description": "Brews (agent recipes and decisions)"
+    },
+    {
+      "name": "connections",
+      "description": "Connections (verified remote MCP servers)"
     }
   ],
   "paths": {
@@ -2130,53 +2134,6 @@
         "x-mcp": true
       }
     },
-    "/v1/foundry/files/{file_id}/content": {
-      "get": {
-        "operationId": "foundry_downloadFile",
-        "summary": "Download tenant file content",
-        "tags": [
-          "foundry"
-        ],
-        "x-foundry-executable": true,
-        "x-foundry-rust-source": "foundry-edge/src/openrouter_files.rs",
-        "x-foundry-rust-route": "/v1/files/{file_id}/content",
-        "responses": {
-          "200": {
-            "description": "File bytes.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "type": "string",
-                  "format": "binary"
-                }
-              }
-            }
-          },
-          "default": {
-            "$ref": "#/components/responses/Foundry.Error"
-          }
-        },
-        "parameters": [
-          {
-            "name": "file_id",
-            "in": "path",
-            "required": true,
-            "schema": {
-              "type": "string",
-              "minLength": 1
-            }
-          }
-        ],
-        "x-genesis-service": "foundry",
-        "x-upstream": {
-          "base": "https://api.fdy.sh",
-          "method": "GET",
-          "path": "/v1/files/{file_id}/content",
-          "status": "live"
-        },
-        "x-mcp": true
-      }
-    },
     "/v1/foundry/fine_tuning/providers": {
       "get": {
         "operationId": "foundry_listFineTuningProviders",
@@ -6674,170 +6631,6 @@
         "x-mcp": false
       }
     },
-    "/v1/hives/organizations/{org_id}/sso": {
-      "get": {
-        "tags": [
-          "hives"
-        ],
-        "summary": "Get SSO configuration for an organization",
-        "operationId": "hives_get_sso_config",
-        "parameters": [
-          {
-            "name": "org_id",
-            "in": "path",
-            "description": "Organization ID",
-            "required": true,
-            "schema": {
-              "type": "string"
-            }
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "SSO configuration",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "type": "object"
-                }
-              }
-            }
-          },
-          "401": {
-            "description": "Unauthorized"
-          },
-          "404": {
-            "description": "Organization not found"
-          },
-          "503": {
-            "description": "SSO service unavailable"
-          }
-        },
-        "x-genesis-service": "hives",
-        "x-upstream": {
-          "base": "https://api.hives.sh",
-          "method": "GET",
-          "path": "/v1/organizations/{org_id}/sso",
-          "status": "down"
-        },
-        "x-mcp": false
-      },
-      "post": {
-        "tags": [
-          "hives"
-        ],
-        "summary": "Create a new SSO connection",
-        "operationId": "hives_create_sso_connection",
-        "parameters": [
-          {
-            "name": "org_id",
-            "in": "path",
-            "description": "Organization ID",
-            "required": true,
-            "schema": {
-              "type": "string"
-            }
-          }
-        ],
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/Hives.CreateSsoConnectionRequest"
-              }
-            }
-          },
-          "required": true
-        },
-        "responses": {
-          "200": {
-            "description": "SSO connection created",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "type": "object"
-                }
-              }
-            }
-          },
-          "401": {
-            "description": "Unauthorized"
-          },
-          "404": {
-            "description": "Organization not found"
-          },
-          "503": {
-            "description": "SSO service unavailable"
-          }
-        },
-        "x-genesis-service": "hives",
-        "x-upstream": {
-          "base": "https://api.hives.sh",
-          "method": "POST",
-          "path": "/v1/organizations/{org_id}/sso",
-          "status": "down"
-        },
-        "x-mcp": false
-      }
-    },
-    "/v1/hives/organizations/{org_id}/sso/{connection_id}": {
-      "delete": {
-        "tags": [
-          "hives"
-        ],
-        "summary": "Delete an SSO connection",
-        "operationId": "hives_delete_sso_connection",
-        "parameters": [
-          {
-            "name": "org_id",
-            "in": "path",
-            "description": "Organization ID",
-            "required": true,
-            "schema": {
-              "type": "string"
-            }
-          },
-          {
-            "name": "connection_id",
-            "in": "path",
-            "description": "SSO connection ID",
-            "required": true,
-            "schema": {
-              "type": "string"
-            }
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "SSO connection deleted",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "type": "object"
-                }
-              }
-            }
-          },
-          "401": {
-            "description": "Unauthorized"
-          },
-          "404": {
-            "description": "Organization or connection not found"
-          },
-          "503": {
-            "description": "SSO service unavailable"
-          }
-        },
-        "x-genesis-service": "hives",
-        "x-upstream": {
-          "base": "https://api.hives.sh",
-          "method": "DELETE",
-          "path": "/v1/organizations/{org_id}/sso/{connection_id}",
-          "status": "down"
-        },
-        "x-mcp": false
-      }
-    },
     "/v1/hives/organizations/{org_id}/usage": {
       "get": {
         "tags": [
@@ -17907,6 +17700,63 @@
           "status": "down"
         },
         "x-mcp": true
+      },
+      "delete": {
+        "tags": [
+          "hives"
+        ],
+        "summary": "Delete a Flight",
+        "description": "Tombstones the Flight (status deleted). Its hostname stops routing, it leaves get and list, and it no longer blocks deleting the project. The deployment behind it keeps running until it is stopped; DNS records are not touched. A Flight of another organization, project or environment, or one already deleted, is 404.",
+        "operationId": "hives_delete_flight",
+        "parameters": [
+          {
+            "name": "project_id",
+            "in": "path",
+            "description": "Hives project id (prj_…)",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "flight_id",
+            "in": "path",
+            "description": "Flight ID",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "The deleted Flight (status deleted)",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Hives.FlightResponse"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Unauthorized"
+          },
+          "403": {
+            "description": "Permission denied"
+          },
+          "404": {
+            "description": "Project or Flight not found, or already deleted"
+          }
+        },
+        "x-genesis-service": "hives",
+        "x-upstream": {
+          "base": "https://api.hives.sh",
+          "method": "DELETE",
+          "path": "/v1/projects/{project_id}/flights/{flight_id}",
+          "status": "down"
+        },
+        "x-mcp": true
       }
     },
     "/v1/hives/flights/{flight_id}/files": {
@@ -26895,7 +26745,7 @@
         },
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "GET",
           "path": "/v4/iam/orgs/{org_id}/projects",
           "status": "not_deployed"
@@ -26964,7 +26814,7 @@
         },
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "POST",
           "path": "/v4/iam/orgs/{org_id}/projects",
           "status": "not_deployed"
@@ -27017,7 +26867,7 @@
         },
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "GET",
           "path": "/v4/iam/orgs/{org_id}/projects/{project_id}",
           "status": "not_deployed"
@@ -27078,7 +26928,7 @@
         },
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "PATCH",
           "path": "/v4/iam/orgs/{org_id}/projects/{project_id}",
           "status": "not_deployed"
@@ -27125,7 +26975,7 @@
         },
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "DELETE",
           "path": "/v4/iam/orgs/{org_id}/projects/{project_id}",
           "status": "not_deployed"
@@ -27172,7 +27022,7 @@
         },
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "GET",
           "path": "/v4/iam/orgs/{org_id}/workspaces",
           "status": "not_deployed"
@@ -27241,7 +27091,7 @@
         },
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "POST",
           "path": "/v4/iam/orgs/{org_id}/workspaces",
           "status": "not_deployed"
@@ -27294,7 +27144,7 @@
         },
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "GET",
           "path": "/v4/iam/orgs/{org_id}/workspaces/{workspace_id}",
           "status": "not_deployed"
@@ -27355,7 +27205,7 @@
         },
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "PATCH",
           "path": "/v4/iam/orgs/{org_id}/workspaces/{workspace_id}",
           "status": "not_deployed"
@@ -27402,7 +27252,7 @@
         },
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "DELETE",
           "path": "/v4/iam/orgs/{org_id}/workspaces/{workspace_id}",
           "status": "not_deployed"
@@ -27465,7 +27315,7 @@
         },
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "GET",
           "path": "/v4/iam/orgs",
           "status": "not_deployed"
@@ -27515,7 +27365,7 @@
         },
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "GET",
           "path": "/v4/iam/orgs/{org_id}",
           "status": "not_deployed"
@@ -27573,7 +27423,7 @@
         },
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "PATCH",
           "path": "/v4/iam/orgs/{org_id}",
           "status": "not_deployed"
@@ -27620,7 +27470,7 @@
         },
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "GET",
           "path": "/v4/iam/orgs/{org_id}/fleets",
           "status": "not_deployed"
@@ -27689,7 +27539,7 @@
         },
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "POST",
           "path": "/v4/iam/orgs/{org_id}/fleets",
           "status": "not_deployed"
@@ -27748,7 +27598,7 @@
         },
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "GET",
           "path": "/v4/iam/orgs/{org_id}/fleets/{fleet_id}",
           "status": "not_deployed"
@@ -27815,7 +27665,7 @@
         },
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "PATCH",
           "path": "/v4/iam/orgs/{org_id}/fleets/{fleet_id}",
           "status": "not_deployed"
@@ -27868,7 +27718,7 @@
         },
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "DELETE",
           "path": "/v4/iam/orgs/{org_id}/fleets/{fleet_id}",
           "status": "not_deployed"
@@ -27915,7 +27765,7 @@
         },
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "GET",
           "path": "/v4/iam/orgs/{org_id}/agents",
           "status": "not_deployed"
@@ -27970,7 +27820,7 @@
         },
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "POST",
           "path": "/v4/iam/orgs/{org_id}/agents",
           "status": "not_deployed"
@@ -28030,7 +27880,7 @@
         },
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "GET",
           "path": "/v4/iam/orgs/{org_id}/agents/{agent_did}",
           "status": "not_deployed"
@@ -28088,7 +27938,7 @@
         },
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "DELETE",
           "path": "/v4/iam/orgs/{org_id}/agents/{agent_did}",
           "status": "not_deployed"
@@ -28148,7 +27998,7 @@
         },
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "POST",
           "path": "/v4/iam/orgs/{org_id}/agents/{agent_did}/suspend",
           "status": "not_deployed"
@@ -28208,7 +28058,7 @@
         },
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "POST",
           "path": "/v4/iam/orgs/{org_id}/agents/{agent_did}/resume",
           "status": "not_deployed"
@@ -28278,7 +28128,7 @@
         },
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "POST",
           "path": "/v4/iam/orgs/{org_id}/agents/{agent_did}/rotate",
           "status": "not_deployed"
@@ -28338,7 +28188,7 @@
         },
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "GET",
           "path": "/v4/iam/orgs/{org_id}/agents/{agent_did}/acts",
           "status": "not_deployed"
@@ -28406,7 +28256,7 @@
         },
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "POST",
           "path": "/v4/iam/orgs/{org_id}/agents/{agent_did}/acts",
           "status": "not_deployed"
@@ -28453,7 +28303,7 @@
         },
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "GET",
           "path": "/v4/iam/orgs/{org_id}/roles",
           "status": "not_deployed"
@@ -28511,7 +28361,7 @@
         },
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "POST",
           "path": "/v4/iam/orgs/{org_id}/roles",
           "status": "not_deployed"
@@ -28570,7 +28420,7 @@
         },
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "GET",
           "path": "/v4/iam/orgs/{org_id}/roles/{role_id}",
           "status": "not_deployed"
@@ -28637,7 +28487,7 @@
         },
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "PATCH",
           "path": "/v4/iam/orgs/{org_id}/roles/{role_id}",
           "status": "not_deployed"
@@ -28690,7 +28540,7 @@
         },
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "DELETE",
           "path": "/v4/iam/orgs/{org_id}/roles/{role_id}",
           "status": "not_deployed"
@@ -28756,7 +28606,7 @@
         },
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "GET",
           "path": "/v4/iam/orgs/{org_id}/members",
           "status": "not_deployed"
@@ -28816,7 +28666,7 @@
         },
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "GET",
           "path": "/v4/iam/orgs/{org_id}/entitlements",
           "status": "not_deployed"
@@ -28863,7 +28713,7 @@
         },
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "GET",
           "path": "/v4/iam/orgs/{org_id}/agent-enrollment-grants",
           "status": "not_deployed"
@@ -28919,7 +28769,7 @@
         },
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "GET",
           "path": "/v4/iam/orgs/{org_id}/minds/{mind_id}/agents",
           "status": "not_deployed"
@@ -28979,7 +28829,7 @@
         },
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "GET",
           "path": "/v4/iam/orgs/{org_id}/agents/by-id/{agent_id}/product-grants/orbit-msgs",
           "status": "not_deployed"
@@ -29039,7 +28889,7 @@
         },
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "GET",
           "path": "/v4/iam/orgs/{org_id}/agents/by-id/{agent_id}/publication",
           "status": "not_deployed"
@@ -29081,7 +28931,7 @@
         },
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "GET",
           "path": "/v4/iam/platforms",
           "status": "not_deployed"
@@ -29123,7 +28973,7 @@
         },
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "GET",
           "path": "/v4/iam/tenant-context",
           "status": "not_deployed"
@@ -29175,7 +29025,7 @@
         },
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "POST",
           "path": "/v4/iam/check-permission",
           "status": "not_deployed"
@@ -29227,7 +29077,7 @@
         },
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "POST",
           "path": "/v4/iam/require-permission",
           "status": "not_deployed"
@@ -29279,7 +29129,7 @@
         },
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "POST",
           "path": "/v4/iam/check-entitlement",
           "status": "not_deployed"
@@ -29368,7 +29218,7 @@
         },
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "GET",
           "path": "/v4/iam/grants",
           "status": "not_deployed"
@@ -29431,7 +29281,7 @@
         },
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "POST",
           "path": "/v4/iam/grants",
           "status": "not_deployed"
@@ -29487,7 +29337,7 @@
         },
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "GET",
           "path": "/v4/iam/grants/{grant_id}",
           "status": "not_deployed"
@@ -29551,7 +29401,7 @@
         },
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "PATCH",
           "path": "/v4/iam/grants/{grant_id}",
           "status": "not_deployed"
@@ -29598,7 +29448,7 @@
         },
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "DELETE",
           "path": "/v4/iam/grants/{grant_id}",
           "status": "not_deployed"
@@ -29663,7 +29513,7 @@
         },
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "POST",
           "path": "/v4/iam/capabilities",
           "status": "not_deployed"
@@ -29715,7 +29565,7 @@
         },
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "POST",
           "path": "/v4/iam/capabilities/verify",
           "status": "not_deployed"
@@ -29771,7 +29621,7 @@
         },
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "GET",
           "path": "/v4/iam/capabilities/{capability_id}",
           "status": "not_deployed"
@@ -29835,7 +29685,7 @@
         },
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "PATCH",
           "path": "/v4/iam/capabilities/{capability_id}",
           "status": "not_deployed"
@@ -29892,7 +29742,7 @@
         },
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "DELETE",
           "path": "/v4/iam/capabilities/{capability_id}",
           "status": "not_deployed"
@@ -29944,7 +29794,7 @@
         "security": [],
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "GET",
           "path": "/v4/public/agents/{agent_id}",
           "status": "not_deployed"
@@ -29997,7 +29847,7 @@
         "security": [],
         "x-genesis-service": "iam",
         "x-upstream": {
-          "base": "https://iam.l1fe.ai",
+          "base": "https://iam.one.ml",
           "method": "POST",
           "path": "/v4/iam/agents/enroll",
           "status": "not_deployed"
@@ -46298,8 +46148,8 @@
     "/v1/minds/memory/episodic/{storage_id}": {
       "put": {
         "operationId": "minds_updateEpisodicMemory",
-        "summary": "Update content of the same stored episodic event",
-        "description": "Original human Console authorization only (Sandbox, or Live). Requires the existing logical event_id and preserves all other stored metadata. No delete/recreate, automatic retry or atomic compare-and-swap guarantee. Reconcile an unknown result with get. Org API keys with a Sandbox or Live binding are admitted with `minds:write`. Live selections reach Live Minds only when the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); the verified environment is forwarded and never falls back to Sandbox. Until then a Live selection answers 409 ENVIRONMENT_NOT_AVAILABLE before any delegation.",
+        "summary": "Update content of a stored episodic event; event_id must equal storage_id",
+        "description": "Original human Console authorization only (Sandbox, or Live). Requires `event_id` equal to the path `storage_id` (the persisted storage UUID that insert returns as `id`, not the caller event UUID); any other value answers 409 EVENT_ID_MISMATCH. Preserves all other stored metadata. No delete/recreate, automatic retry or atomic compare-and-swap guarantee. Reconcile an unknown result with get. Org API keys with a Sandbox or Live binding are admitted with `minds:write`. Live selections reach Live Minds only when the gateway lists Minds as Live (GENESIS_LIVE_SERVICES); the verified environment is forwarded and never falls back to Sandbox. Until then a Live selection answers 409 ENVIRONMENT_NOT_AVAILABLE before any delegation.",
         "parameters": [
           {
             "name": "storage_id",
@@ -73168,6 +73018,84 @@
         "x-mcp": false
       }
     },
+    "/v1/flares/choreography/workflows/{workflow_id}": {
+      "delete": {
+        "operationId": "flares_deleteChoreographyWorkflow",
+        "summary": "Delete a tenant-scoped choreography workflow definition",
+        "description": "Needs `flares:write` at the gateway (service scope `choreography.write`). Deletes one of the caller's workflow definitions in the caller's own organization, project and environment and returns it as `{id, deleted, workflow}`. Another organization's or environment's workflow is 404. A workflow with a pending, running or compensating execution is 409; cancel or finish those first. Finished, failed and cancelled executions stay readable.",
+        "parameters": [
+          {
+            "name": "workflow_id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          },
+          {
+            "$ref": "#/components/parameters/Flares.IdempotencyKey"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Deleted",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "id",
+                    "deleted",
+                    "workflow"
+                  ],
+                  "properties": {
+                    "id": {
+                      "type": "string",
+                      "format": "uuid"
+                    },
+                    "deleted": {
+                      "type": "boolean"
+                    },
+                    "workflow": {
+                      "type": "object",
+                      "additionalProperties": true
+                    }
+                  },
+                  "additionalProperties": true
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Noncanonical request, invalid JSON or missing Idempotency-Key"
+          },
+          "401": {
+            "description": "Interactive One account login with a current Sandbox selection required"
+          },
+          "403": {
+            "description": "Flares grant missing or a scope hint names another organization or project"
+          },
+          "404": {
+            "description": "No workflow with this id in the caller's organization, project and environment"
+          },
+          "409": {
+            "description": "The workflow has a pending, running or compensating execution"
+          }
+        },
+        "tags": [
+          "flares"
+        ],
+        "x-genesis-service": "flares",
+        "x-upstream": {
+          "base": "https://flares-api-qualification-wueoxao7jq-uc.a.run.app",
+          "method": "DELETE",
+          "path": "/v1/choreography/workflows/{workflow_id}",
+          "status": "unverified"
+        },
+        "x-mcp": false
+      }
+    },
     "/v1/flares/choreography/executions": {
       "get": {
         "operationId": "flares_listChoreographyExecutions",
@@ -80627,6 +80555,54 @@
         "x-mcp": true
       }
     },
+    "/v1/credits/catalog": {
+      "get": {
+        "operationId": "gateway_getCreditCatalog",
+        "summary": "The One credits catalog",
+        "description": "Every price of the catalog (version `one-plans-20261021`) with its credits, computer hours, amount in US cents and interval, the pack rate (60 credits per dollar), the payment methods Checkout offers per mode (Apple Pay and Google Pay ride on `card`; `crypto` is USDC hosted by Stripe and offered for packs only), the `return_to` a checkout may use and the wallet-payment terms. Needs genesis.billing.read and no credits account: an organization that is not a One tenant can read it. Takes no query.",
+        "responses": {
+          "200": {
+            "description": "The catalog",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Gateway.CreditCatalog"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "invalid_request"
+          },
+          "401": {
+            "description": "unauthorized"
+          },
+          "403": {
+            "description": "forbidden (an M2M token, or a key without genesis.billing.read)"
+          },
+          "409": {
+            "description": "ENVIRONMENT_NOT_AVAILABLE (a Live selection)"
+          },
+          "502": {
+            "description": "invalid_response"
+          },
+          "503": {
+            "description": "credits_unavailable"
+          }
+        },
+        "tags": [
+          "gateway"
+        ],
+        "x-genesis-service": "gateway",
+        "x-upstream": {
+          "base": "https://os.one.ml/api",
+          "method": "GET",
+          "path": "/v1/credits/catalog",
+          "status": "live"
+        },
+        "x-mcp": true
+      }
+    },
     "/v1/credits/entries": {
       "get": {
         "operationId": "gateway_listCreditEntries",
@@ -80839,7 +80815,7 @@
       "post": {
         "operationId": "gateway_createCreditCheckout",
         "summary": "Start a Stripe Checkout for a plan, seats or a credit pack",
-        "description": "Returns the hosted Stripe Checkout URL (test mode) for the items: a plan or seat price (`one_one_monthly`, `one_pro_monthly`, `one_operator_monthly`, ...) or a credit pack (`one_pack_10`, `one_pack_25`, `one_pack_50`). The URL is always on https://checkout.stripe.com and never a live-mode session. Nothing is charged until you pay on that page. Needs genesis.billing.manage and an Idempotency-Key.",
+        "description": "Returns the hosted Stripe Checkout URL (test mode) for the items: a plan or seat price (`one_one_monthly`, `one_pro_monthly`, `one_operator_monthly`, ...) or a credit pack (`one_pack_10`, `one_pack_25`, `one_pack_50`). The URL is always on https://checkout.stripe.com and never a live-mode session. Nothing is charged until you pay on that page. Plans and seats take card, Link and ACH; packs also take crypto (USDC hosted by Stripe), and Apple Pay and Google Pay come with card. Pack credits are minted once the payment is paid: at once for card and Link, later for ACH and crypto. `return_to` (optional) sends the person back to https://chat.one.ml/pay or a path below it, with `?checkout=success&session_id=...` or `?checkout=cancel`. Needs genesis.billing.manage and an Idempotency-Key.",
         "parameters": [
           {
             "$ref": "#/components/parameters/Gateway.IdempotencyKey"
@@ -80850,7 +80826,7 @@
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/Gateway.CreditItems"
+                "$ref": "#/components/schemas/Gateway.CreditCheckoutRequest"
               }
             }
           }
@@ -80905,6 +80881,75 @@
         "x-mcp": true
       }
     },
+    "/v1/credits/wallet-payment": {
+      "post": {
+        "operationId": "gateway_createCreditWalletPayment",
+        "summary": "Pay for a credit pack in USDC from a wallet",
+        "description": "A pack ($10, $25 or $50) paid in USDC (1:1 with USD) on Base or Solana through a Stripe deposit-mode PaymentIntent (Stripe test mode: Base Sepolia, Solana devnet). Send exactly `amount_usdc_atomic` (6-decimal USDC units) of the token at `token_contract_address` to `deposit_address` before `expires_at` (30 minutes); after that the intent is canceled. Stripe matches a transfer by its exact amount, so when the pack's amount is already open the lowest free amount up to 99 cents higher is used (`jitter_cents`), and those cents buy credits at 60 per dollar, rounded down (`credits`). Credits are minted when the payment succeeds, as a pack lot that expires after 12 months. A payment from another wallet than `payer_address` is still credited and flagged for review. Refunds go back to the sending wallet. Needs genesis.billing.manage and an Idempotency-Key.",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/Gateway.IdempotencyKey"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/Gateway.CreditWalletPaymentRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "The deposit instructions",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Gateway.CreditWalletPayment"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "invalid_request, idempotency_key_required or a pack, network or address the service refuses"
+          },
+          "401": {
+            "description": "unauthorized"
+          },
+          "403": {
+            "description": "forbidden (needs genesis.billing.manage)"
+          },
+          "404": {
+            "description": "credits_account_not_found"
+          },
+          "409": {
+            "description": "wallet_amount_busy (every amount from the pack's up to 99 cents higher is open), the Idempotency-Key was used for a different request, or ENVIRONMENT_NOT_AVAILABLE (a Live selection)"
+          },
+          "413": {
+            "description": "body_too_large (16 KiB)"
+          },
+          "502": {
+            "description": "invalid_response"
+          },
+          "503": {
+            "description": "credits_unavailable, billing_unavailable or wallet_unavailable"
+          }
+        },
+        "tags": [
+          "gateway"
+        ],
+        "x-genesis-service": "gateway",
+        "x-upstream": {
+          "base": "https://os.one.ml/api",
+          "method": "POST",
+          "path": "/v1/credits/wallet-payment",
+          "status": "live"
+        },
+        "x-mcp": true
+      }
+    },
     "/v1/credits/subscription": {
       "post": {
         "operationId": "gateway_changeCreditSubscription",
@@ -100730,17 +100775,17 @@
         "x-mcp": true
       }
     },
-    "/v1/brews/mcp": {
+    "/v1/brews/exchange/uninstall": {
       "post": {
-        "operationId": "brews_callTool",
-        "summary": "Call a Brews MCP tool",
-        "description": "One Brews tool call: brews.create, brews.run, brews.eval, brews.list, brews.get, brews.card, brews.compile, brews.bench.run, brews.exchange.list, brews.exchange.get, brews.exchange.install, or a typed brews.decision.v1 / brews.selection.v1 tool. Needs `brews:read`; tools that write need `brews:write`, checked by Brews per tool. `arguments.scope` is filled from the selection.",
+        "operationId": "brews_uninstallBrew",
+        "summary": "Uninstall an exchange Brew from the selected project",
+        "description": "Needs `brews:write`. Removes a Brew that installBrew put in the caller's organization, project and environment, and drops the source listing's install count. A Brew in another scope is 404 BREWS_E_NOT_FOUND; a Brew that was not installed from the exchange is 409 BREWS_E_NOT_AN_INSTALL.",
         "requestBody": {
           "required": true,
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/Brews.ToolCall"
+                "$ref": "#/components/schemas/Brews.UninstallBrew"
               }
             }
           }
@@ -100757,7 +100802,8 @@
             }
           },
           "400": {
-            "description": "BREWS_E_BAD_REQUEST or a scope error"
+            "description": "BREWS_E_BAD_REQUEST",
+            "BREWS_E_INVALID_URI or a scope error": null
           },
           "401": {
             "description": "Credential missing or invalid"
@@ -100766,40 +100812,10 @@
             "description": "SCOPE_MISSING, BREWS_E_ACCESS_DENIED or BREWS_E_SCOPE_MISMATCH"
           },
           "404": {
-            "description": "Not found"
+            "description": "BREWS_E_NOT_FOUND: no such Brew in the selected organization, project and environment"
           },
-          "503": {
-            "description": "Brews unavailable"
-          }
-        },
-        "tags": [
-          "brews"
-        ],
-        "x-genesis-service": "brews",
-        "x-upstream": {
-          "base": "https://brews-api-genesis.onrender.com",
-          "method": "POST",
-          "path": "/v1/brews/mcp",
-          "status": "unverified"
-        },
-        "x-mcp": true
-      }
-    },
-    "/v1/brews/decisions/status": {
-      "get": {
-        "operationId": "brews_getDecisionStatus",
-        "summary": "Brews decision readiness and contract",
-        "description": "Needs `brews:read`. Public readiness report with no tenant data.",
-        "responses": {
-          "200": {
-            "description": "Readiness report",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Brews.Json"
-                }
-              }
-            }
+          "409": {
+            "description": "BREWS_E_EXCHANGE_INSTALL or BREWS_E_NOT_AN_INSTALL: the other removal applies"
           },
           "503": {
             "description": "Brews unavailable"
@@ -100811,61 +100827,57 @@
         "x-genesis-service": "brews",
         "x-upstream": {
           "base": "https://brews-api-genesis.onrender.com",
-          "method": "GET",
-          "path": "/v1/brews/decisions/status",
+          "method": "POST",
+          "path": "/v1/brews/exchange/uninstall",
           "status": "unverified"
         },
         "x-mcp": true
       }
     },
-    "/v1/brews/decisions": {
+    "/v1/brews/delete": {
       "post": {
-        "operationId": "brews_createDecision",
-        "summary": "Create a typed brews.decision.v1 decision",
-        "description": "Needs `brews:write` and an Idempotency-Key. Decisions are admitted only when Brews reports acceptingDecisions.",
-        "parameters": [
-          {
-            "$ref": "#/components/parameters/Brews.RequiredIdempotencyKey"
-          }
-        ],
+        "operationId": "brews_deleteBrew",
+        "summary": "Delete a Brew from the selected project",
+        "description": "Needs `brews:write`. Deletes one Brew version from the caller's organization, project and environment and returns its digest; the version can be created again afterwards. A Brew in another scope is 404 BREWS_E_NOT_FOUND; an exchange install is 409 BREWS_E_EXCHANGE_INSTALL (use uninstallBrew).",
         "requestBody": {
           "required": true,
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/Brews.Json"
+                "$ref": "#/components/schemas/Brews.DeleteBrew"
               }
             }
           }
         },
         "responses": {
           "200": {
-            "description": "Typed result",
+            "description": "Brews result envelope",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/Brews.Json"
+                  "$ref": "#/components/schemas/Brews.Result"
                 }
               }
             }
           },
           "400": {
-            "description": "Invalid request"
+            "description": "BREWS_E_BAD_REQUEST",
+            "BREWS_E_INVALID_URI or a scope error": null
           },
           "401": {
             "description": "Credential missing or invalid"
           },
           "403": {
-            "description": "SCOPE_MISSING or PERMISSION_DENIED"
+            "description": "SCOPE_MISSING, BREWS_E_ACCESS_DENIED or BREWS_E_SCOPE_MISMATCH"
           },
           "404": {
-            "description": "Not found in the selected organization and project"
+            "description": "BREWS_E_NOT_FOUND: no such Brew in the selected organization, project and environment"
           },
           "409": {
-            "description": "Idempotency conflict"
+            "description": "BREWS_E_EXCHANGE_INSTALL or BREWS_E_NOT_AN_INSTALL: the other removal applies"
           },
           "503": {
-            "description": "Decisions not accepted yet (see GET /v1/brews/decisions/status)"
+            "description": "Brews unavailable"
           }
         },
         "tags": [
@@ -100875,50 +100887,52 @@
         "x-upstream": {
           "base": "https://brews-api-genesis.onrender.com",
           "method": "POST",
-          "path": "/v1/brews/decisions",
+          "path": "/v1/brews/delete",
           "status": "unverified"
         },
         "x-mcp": true
       }
     },
-    "/v1/brews/decisions/{decisionId}": {
-      "get": {
-        "operationId": "brews_getDecision",
-        "summary": "Get a decision",
-        "description": "Needs `brews:read`. Only decisions of the selected organization and project are visible.",
-        "parameters": [
-          {
-            "$ref": "#/components/parameters/Brews.DecisionId"
+    "/v1/brews/mcp": {
+      "post": {
+        "operationId": "brews_callTool",
+        "summary": "Call a Brews MCP tool",
+        "description": "One Brews tool call: brews.create, brews.run, brews.eval, brews.list, brews.get, brews.card, brews.compile, brews.bench.run, brews.exchange.list, brews.exchange.get, brews.exchange.install, brews.exchange.uninstall, brews.delete, or a typed brews.decision.v1 / brews.selection.v1 tool. Needs `brews:read`; tools that write need `brews:write`, checked by Brews per tool. `arguments.scope` is filled from the selection.",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/Brews.ToolCall"
+              }
+            }
           }
-        ],
+        },
         "responses": {
           "200": {
-            "description": "Typed result",
+            "description": "Brews result envelope",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/Brews.Json"
+                  "$ref": "#/components/schemas/Brews.Result"
                 }
               }
             }
           },
           "400": {
-            "description": "Invalid request"
+            "description": "BREWS_E_BAD_REQUEST or a scope error"
           },
           "401": {
             "description": "Credential missing or invalid"
           },
           "403": {
-            "description": "SCOPE_MISSING or PERMISSION_DENIED"
+            "description": "SCOPE_MISSING, BREWS_E_ACCESS_DENIED or BREWS_E_SCOPE_MISMATCH"
           },
           "404": {
-            "description": "Not found in the selected organization and project"
-          },
-          "409": {
-            "description": "Idempotency conflict"
+            "description": "Not found"
           },
           "503": {
-            "description": "Decisions not accepted yet (see GET /v1/brews/decisions/status)"
+            "description": "Brews unavailable"
           }
         },
         "tags": [
@@ -100927,39 +100941,21 @@
         "x-genesis-service": "brews",
         "x-upstream": {
           "base": "https://brews-api-genesis.onrender.com",
-          "method": "GET",
-          "path": "/v1/brews/decisions/{decisionId}",
+          "method": "POST",
+          "path": "/v1/brews/mcp",
           "status": "unverified"
         },
         "x-mcp": true
       }
     },
-    "/v1/brews/decisions/{decisionId}/reconcile": {
-      "post": {
-        "operationId": "brews_reconcileDecision",
-        "summary": "Reconcile a decision held in custody",
-        "description": "Needs `brews:write` and the Idempotency-Key the decision was created with.",
-        "parameters": [
-          {
-            "$ref": "#/components/parameters/Brews.DecisionId"
-          },
-          {
-            "$ref": "#/components/parameters/Brews.RequiredIdempotencyKey"
-          }
-        ],
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/Brews.Json"
-              }
-            }
-          }
-        },
+    "/v1/brews/decisions/status": {
+      "get": {
+        "operationId": "brews_getDecisionStatus",
+        "summary": "Brews decision readiness and contract",
+        "description": "Needs `brews:read`. Public readiness report with no tenant data.",
         "responses": {
           "200": {
-            "description": "Typed result",
+            "description": "Readiness report",
             "content": {
               "application/json": {
                 "schema": {
@@ -100968,23 +100964,8 @@
               }
             }
           },
-          "400": {
-            "description": "Invalid request"
-          },
-          "401": {
-            "description": "Credential missing or invalid"
-          },
-          "403": {
-            "description": "SCOPE_MISSING or PERMISSION_DENIED"
-          },
-          "404": {
-            "description": "Not found in the selected organization and project"
-          },
-          "409": {
-            "description": "Idempotency conflict"
-          },
           "503": {
-            "description": "Decisions not accepted yet (see GET /v1/brews/decisions/status)"
+            "description": "Brews unavailable"
           }
         },
         "tags": [
@@ -100993,18 +100974,200 @@
         "x-genesis-service": "brews",
         "x-upstream": {
           "base": "https://brews-api-genesis.onrender.com",
-          "method": "POST",
-          "path": "/v1/brews/decisions/{decisionId}/reconcile",
+          "method": "GET",
+          "path": "/v1/brews/decisions/status",
           "status": "unverified"
         },
         "x-mcp": true
       }
     },
-    "/v1/brews/selections": {
+    "/v1/brews/decisions": {
       "post": {
-        "operationId": "brews_createSelection",
-        "summary": "Create a typed brews.selection.v1 selection",
-        "description": "Needs `brews:write`.",
+        "operationId": "brews_createDecision",
+        "summary": "Create a typed brews.decision.v1 decision",
+        "description": "Needs `brews:write` and an Idempotency-Key. Decisions are admitted only when Brews reports acceptingDecisions.",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/Brews.RequiredIdempotencyKey"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/Brews.Json"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Typed result",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Brews.Json"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Invalid request"
+          },
+          "401": {
+            "description": "Credential missing or invalid"
+          },
+          "403": {
+            "description": "SCOPE_MISSING or PERMISSION_DENIED"
+          },
+          "404": {
+            "description": "Not found in the selected organization and project"
+          },
+          "409": {
+            "description": "Idempotency conflict"
+          },
+          "503": {
+            "description": "Decisions not accepted yet (see GET /v1/brews/decisions/status)"
+          }
+        },
+        "tags": [
+          "brews"
+        ],
+        "x-genesis-service": "brews",
+        "x-upstream": {
+          "base": "https://brews-api-genesis.onrender.com",
+          "method": "POST",
+          "path": "/v1/brews/decisions",
+          "status": "unverified"
+        },
+        "x-mcp": true
+      }
+    },
+    "/v1/brews/decisions/{decisionId}": {
+      "get": {
+        "operationId": "brews_getDecision",
+        "summary": "Get a decision",
+        "description": "Needs `brews:read`. Only decisions of the selected organization and project are visible.",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/Brews.DecisionId"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Typed result",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Brews.Json"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Invalid request"
+          },
+          "401": {
+            "description": "Credential missing or invalid"
+          },
+          "403": {
+            "description": "SCOPE_MISSING or PERMISSION_DENIED"
+          },
+          "404": {
+            "description": "Not found in the selected organization and project"
+          },
+          "409": {
+            "description": "Idempotency conflict"
+          },
+          "503": {
+            "description": "Decisions not accepted yet (see GET /v1/brews/decisions/status)"
+          }
+        },
+        "tags": [
+          "brews"
+        ],
+        "x-genesis-service": "brews",
+        "x-upstream": {
+          "base": "https://brews-api-genesis.onrender.com",
+          "method": "GET",
+          "path": "/v1/brews/decisions/{decisionId}",
+          "status": "unverified"
+        },
+        "x-mcp": true
+      }
+    },
+    "/v1/brews/decisions/{decisionId}/reconcile": {
+      "post": {
+        "operationId": "brews_reconcileDecision",
+        "summary": "Reconcile a decision held in custody",
+        "description": "Needs `brews:write` and the Idempotency-Key the decision was created with.",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/Brews.DecisionId"
+          },
+          {
+            "$ref": "#/components/parameters/Brews.RequiredIdempotencyKey"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/Brews.Json"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Typed result",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Brews.Json"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Invalid request"
+          },
+          "401": {
+            "description": "Credential missing or invalid"
+          },
+          "403": {
+            "description": "SCOPE_MISSING or PERMISSION_DENIED"
+          },
+          "404": {
+            "description": "Not found in the selected organization and project"
+          },
+          "409": {
+            "description": "Idempotency conflict"
+          },
+          "503": {
+            "description": "Decisions not accepted yet (see GET /v1/brews/decisions/status)"
+          }
+        },
+        "tags": [
+          "brews"
+        ],
+        "x-genesis-service": "brews",
+        "x-upstream": {
+          "base": "https://brews-api-genesis.onrender.com",
+          "method": "POST",
+          "path": "/v1/brews/decisions/{decisionId}/reconcile",
+          "status": "unverified"
+        },
+        "x-mcp": true
+      }
+    },
+    "/v1/brews/selections": {
+      "post": {
+        "operationId": "brews_createSelection",
+        "summary": "Create a typed brews.selection.v1 selection",
+        "description": "Needs `brews:write`.",
         "requestBody": {
           "required": true,
           "content": {
@@ -101175,6 +101338,718 @@
         },
         "x-mcp": true
       }
+    },
+    "/v1/connections/catalog": {
+      "get": {
+        "operationId": "connections_listCatalog",
+        "summary": "List verified MCP servers in the catalog",
+        "description": "Scope `connections:read`. Filter by OneOS plugin category (`plugin`, e.g. `scopes`). Suspended servers are listed with their `reason`.",
+        "parameters": [
+          {
+            "name": "plugin",
+            "in": "query",
+            "required": false,
+            "description": "OneOS plugin category the server competes in, e.g. scopes, silos, traces",
+            "schema": {
+              "type": "string",
+              "pattern": "^[a-z][a-z0-9-]{0,31}$"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Catalog servers",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "data"
+                  ],
+                  "properties": {
+                    "data": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/components/schemas/Connections.CatalogServer"
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "403": {
+            "$ref": "#/components/responses/Connections.Forbidden"
+          }
+        },
+        "tags": [
+          "connections"
+        ],
+        "x-genesis-service": "connections",
+        "x-upstream": {
+          "base": "https://connections-api-808958844152.us-central1.run.app",
+          "method": "GET",
+          "path": "/v1/catalog",
+          "status": "not_deployed"
+        },
+        "x-mcp": true
+      }
+    },
+    "/v1/connections/catalog/{server}": {
+      "parameters": [
+        {
+          "$ref": "#/components/parameters/Connections.Server"
+        }
+      ],
+      "get": {
+        "operationId": "connections_getCatalogServer",
+        "summary": "Get a catalog server with its pinned tool manifest",
+        "description": "Scope `connections:read`.",
+        "responses": {
+          "200": {
+            "description": "The server and its pinned manifest",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Connections.CatalogServerDetail"
+                }
+              }
+            }
+          },
+          "404": {
+            "$ref": "#/components/responses/Connections.NotFound"
+          }
+        },
+        "tags": [
+          "connections"
+        ],
+        "x-genesis-service": "connections",
+        "x-upstream": {
+          "base": "https://connections-api-808958844152.us-central1.run.app",
+          "method": "GET",
+          "path": "/v1/catalog/{server}",
+          "status": "not_deployed"
+        },
+        "x-mcp": true
+      }
+    },
+    "/v1/connections": {
+      "get": {
+        "operationId": "connections_list",
+        "summary": "List your organization's connections",
+        "description": "Scope `connections:read`. Connections of the selected environment, newest first (at most 200), optionally of one `status`.",
+        "parameters": [
+          {
+            "name": "status",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string",
+              "enum": [
+                "pending_auth",
+                "active",
+                "needs_reauth",
+                "revoked"
+              ]
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Connections",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "data"
+                  ],
+                  "properties": {
+                    "data": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/components/schemas/Connections.Connection"
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "403": {
+            "$ref": "#/components/responses/Connections.Forbidden"
+          }
+        },
+        "tags": [
+          "connections"
+        ],
+        "x-genesis-service": "connections",
+        "x-upstream": {
+          "base": "https://connections-api-808958844152.us-central1.run.app",
+          "method": "GET",
+          "path": "/v1",
+          "status": "not_deployed"
+        },
+        "x-mcp": true
+      },
+      "post": {
+        "operationId": "connections_connect",
+        "summary": "Connect a catalog server",
+        "description": "Scope `connections:write`. Creates a `pending_auth` connection and returns the `authorize_url` a person opens to consent at the vendor. `tools` picks the tools to enable (default: the manifest's defaults); only their scopes are requested. Unknown fields are refused (422). Enabling any `send`, `spend` or `destructive` tool needs an owner's approval (428). `auto_org` names the Auto org that governs the connection (its authority checks and approvals); a connect carrying `auto_org` always answers `428 APPROVAL_REQUIRED` first, so a person approves binding the connection to that Auto org.",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/Connections.Approval"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/Connections.ConnectRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "201": {
+            "description": "Connection created, waiting for a person to authorize it",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Connections.ConnectResponse"
+                }
+              }
+            }
+          },
+          "403": {
+            "$ref": "#/components/responses/Connections.Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/Connections.NotFound"
+          },
+          "409": {
+            "$ref": "#/components/responses/Connections.Conflict"
+          },
+          "410": {
+            "$ref": "#/components/responses/Connections.ToolChanged"
+          },
+          "422": {
+            "$ref": "#/components/responses/Connections.Invalid"
+          },
+          "428": {
+            "$ref": "#/components/responses/Connections.ApprovalRequired"
+          }
+        },
+        "tags": [
+          "connections"
+        ],
+        "x-genesis-service": "connections",
+        "x-upstream": {
+          "base": "https://connections-api-808958844152.us-central1.run.app",
+          "method": "POST",
+          "path": "/v1",
+          "status": "not_deployed"
+        },
+        "x-mcp": true
+      }
+    },
+    "/v1/connections/{id}": {
+      "parameters": [
+        {
+          "$ref": "#/components/parameters/Connections.Id"
+        }
+      ],
+      "get": {
+        "operationId": "connections_get",
+        "summary": "Get a connection",
+        "description": "Scope `connections:read`. Status, granted scopes and the pinned manifest hash.",
+        "responses": {
+          "200": {
+            "description": "The connection",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Connections.Connection"
+                }
+              }
+            }
+          },
+          "404": {
+            "$ref": "#/components/responses/Connections.NotFound"
+          }
+        },
+        "tags": [
+          "connections"
+        ],
+        "x-genesis-service": "connections",
+        "x-upstream": {
+          "base": "https://connections-api-808958844152.us-central1.run.app",
+          "method": "GET",
+          "path": "/v1/{id}",
+          "status": "not_deployed"
+        },
+        "x-mcp": true
+      },
+      "delete": {
+        "operationId": "connections_revoke",
+        "summary": "Revoke a connection",
+        "description": "Scope `connections:write`. Never needs an approval. Blinds deletes the stored tokens and asks the vendor to revoke them (best effort, reported as `vendor_revoked`; `tokens_deleted` is false when Blinds did not confirm, and repeating the DELETE retries). The connection stays listed as `revoked`.",
+        "responses": {
+          "200": {
+            "description": "Revoked",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Connections.RevokeResponse"
+                }
+              }
+            }
+          },
+          "403": {
+            "$ref": "#/components/responses/Connections.Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/Connections.NotFound"
+          }
+        },
+        "tags": [
+          "connections"
+        ],
+        "x-genesis-service": "connections",
+        "x-upstream": {
+          "base": "https://connections-api-808958844152.us-central1.run.app",
+          "method": "DELETE",
+          "path": "/v1/{id}",
+          "status": "not_deployed"
+        },
+        "x-mcp": true
+      }
+    },
+    "/v1/connections/{id}/authorize": {
+      "parameters": [
+        {
+          "$ref": "#/components/parameters/Connections.Id"
+        }
+      ],
+      "post": {
+        "operationId": "connections_authorize",
+        "summary": "Get a new authorize URL for a person to open",
+        "description": "Scope `connections:write`. Returns a fresh `authorize_url` (its `state` is single use and valid for 10 minutes). Human step: a person opens it in a browser. The hosted MCP refuses this operation for agents (human consent); use the CLI (`genesis connections authorize <id>`) or the Console.",
+        "responses": {
+          "200": {
+            "description": "The URL a person opens to consent at the vendor",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Connections.AuthorizeResponse"
+                }
+              }
+            }
+          },
+          "403": {
+            "$ref": "#/components/responses/Connections.Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/Connections.NotFound"
+          },
+          "409": {
+            "$ref": "#/components/responses/Connections.Conflict"
+          }
+        },
+        "tags": [
+          "connections"
+        ],
+        "x-genesis-service": "connections",
+        "x-upstream": {
+          "base": "https://connections-api-808958844152.us-central1.run.app",
+          "method": "POST",
+          "path": "/v1/{id}/authorize",
+          "status": "not_deployed"
+        },
+        "x-mcp": false
+      }
+    },
+    "/v1/connections/{id}/tools": {
+      "parameters": [
+        {
+          "$ref": "#/components/parameters/Connections.Id"
+        }
+      ],
+      "get": {
+        "operationId": "connections_listTools",
+        "summary": "List a connection's tools with their policy",
+        "description": "Scope `connections:read`. The pinned manifest's tools, each with its effect, scopes, policy mode and the vendor's description and input schema (untrusted).",
+        "responses": {
+          "200": {
+            "description": "Tools",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Connections.ToolList"
+                }
+              }
+            }
+          },
+          "404": {
+            "$ref": "#/components/responses/Connections.NotFound"
+          },
+          "410": {
+            "$ref": "#/components/responses/Connections.ToolChanged"
+          }
+        },
+        "tags": [
+          "connections"
+        ],
+        "x-genesis-service": "connections",
+        "x-upstream": {
+          "base": "https://connections-api-808958844152.us-central1.run.app",
+          "method": "GET",
+          "path": "/v1/{id}/tools",
+          "status": "not_deployed"
+        },
+        "x-mcp": true
+      },
+      "patch": {
+        "operationId": "connections_setToolPolicy",
+        "summary": "Set tool policies (allow, approve or deny)",
+        "description": "Scope `connections:write`. `tools` maps tool names to `allow`, `approve` or `deny`; `send`, `spend` and `destructive` tools take `approve` or `deny` only (422 for `allow`). Narrowing never needs an approval; widening (deny to approve or allow, approve to allow) needs an owner's approval (428) and Auto's `connections.widen` check. When the change needs scopes not yet granted, the answer carries `reauthorize`.",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/Connections.Approval"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/Connections.ToolPolicyRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "The connection with its new policy and the changes made",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Connections.ToolPolicyResponse"
+                }
+              }
+            }
+          },
+          "403": {
+            "$ref": "#/components/responses/Connections.Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/Connections.NotFound"
+          },
+          "409": {
+            "$ref": "#/components/responses/Connections.Conflict"
+          },
+          "422": {
+            "$ref": "#/components/responses/Connections.Invalid"
+          },
+          "428": {
+            "$ref": "#/components/responses/Connections.ApprovalRequired"
+          }
+        },
+        "tags": [
+          "connections"
+        ],
+        "x-genesis-service": "connections",
+        "x-upstream": {
+          "base": "https://connections-api-808958844152.us-central1.run.app",
+          "method": "PATCH",
+          "path": "/v1/{id}/tools",
+          "status": "not_deployed"
+        },
+        "x-mcp": true
+      }
+    },
+    "/v1/connections/{id}/tools/{tool}/call": {
+      "parameters": [
+        {
+          "$ref": "#/components/parameters/Connections.Id"
+        },
+        {
+          "$ref": "#/components/parameters/Connections.Tool"
+        }
+      ],
+      "post": {
+        "operationId": "connections_call",
+        "summary": "Call a connected tool",
+        "description": "Scope `connections:write`. Runs Auto's `connections.call` check, then calls the tool through Blinds. The result is third-party content inside the `untrusted` wrapper. A tool whose policy is `approve`, or a write to another connection after this session read untrusted content, answers 428; retry with `OneOS-Approval`.",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/Connections.Approval"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/Connections.CallRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "The call's outcome and its wrapped result",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Connections.CallResult"
+                }
+              }
+            }
+          },
+          "403": {
+            "$ref": "#/components/responses/Connections.Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/Connections.NotFound"
+          },
+          "409": {
+            "$ref": "#/components/responses/Connections.NeedsReauth"
+          },
+          "410": {
+            "$ref": "#/components/responses/Connections.ToolChanged"
+          },
+          "422": {
+            "$ref": "#/components/responses/Connections.Invalid"
+          },
+          "428": {
+            "$ref": "#/components/responses/Connections.ApprovalRequired"
+          }
+        },
+        "tags": [
+          "connections"
+        ],
+        "x-genesis-service": "connections",
+        "x-upstream": {
+          "base": "https://connections-api-808958844152.us-central1.run.app",
+          "method": "POST",
+          "path": "/v1/{id}/tools/{tool}/call",
+          "status": "not_deployed"
+        },
+        "x-mcp": true
+      }
+    },
+    "/v1/connections/{id}/activity": {
+      "parameters": [
+        {
+          "$ref": "#/components/parameters/Connections.Id"
+        }
+      ],
+      "get": {
+        "operationId": "connections_activity",
+        "summary": "Read a connection's activity ledger",
+        "description": "Scope `connections:read`. Append-only, hash-chained rows, oldest first; hashes only, never payloads. Page with `after` = `next_after`.",
+        "parameters": [
+          {
+            "name": "after",
+            "in": "query",
+            "required": false,
+            "description": "Return rows with a larger `seq` (default 0)",
+            "schema": {
+              "type": "integer",
+              "minimum": 0
+            }
+          },
+          {
+            "name": "limit",
+            "in": "query",
+            "required": false,
+            "description": "Page size, 1-500 (default 100)",
+            "schema": {
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 500
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Ledger rows",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "data"
+                  ],
+                  "properties": {
+                    "data": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/components/schemas/Connections.ActivityRow"
+                      }
+                    },
+                    "next_after": {
+                      "type": [
+                        "integer",
+                        "null"
+                      ]
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "404": {
+            "$ref": "#/components/responses/Connections.NotFound"
+          }
+        },
+        "tags": [
+          "connections"
+        ],
+        "x-genesis-service": "connections",
+        "x-upstream": {
+          "base": "https://connections-api-808958844152.us-central1.run.app",
+          "method": "GET",
+          "path": "/v1/{id}/activity",
+          "status": "not_deployed"
+        },
+        "x-mcp": true
+      }
+    },
+    "/v1/connections/tools": {
+      "get": {
+        "operationId": "connections_searchTools",
+        "summary": "Search the connected tools your organization may call",
+        "description": "Scope `connections:read`. Connected tools of the selected environment whose policy is not `deny`, matched against `q` (at most 100). genesis-mcp's `genesis_search_tools` lists them by `name` (`conn.<connection>.<tool>`). `session_tainted` says whether this principal has read untrusted content.",
+        "parameters": [
+          {
+            "name": "q",
+            "in": "query",
+            "required": false,
+            "description": "Keywords",
+            "schema": {
+              "type": "string",
+              "maxLength": 200
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Matching connected tools",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Connections.SearchToolsResponse"
+                }
+              }
+            }
+          },
+          "403": {
+            "$ref": "#/components/responses/Connections.Forbidden"
+          }
+        },
+        "tags": [
+          "connections"
+        ],
+        "x-genesis-service": "connections",
+        "x-upstream": {
+          "base": "https://connections-api-808958844152.us-central1.run.app",
+          "method": "GET",
+          "path": "/v1/tools",
+          "status": "not_deployed"
+        },
+        "x-mcp": true
+      }
+    },
+    "/v1/connections/oauth/callback": {
+      "get": {
+        "operationId": "connections_oauthCallback",
+        "summary": "OAuth redirect target for a person's browser (anonymous)",
+        "description": "Human browser only; anonymous. The vendor redirects the person here after consent. The gateway forwards it with no identity envelope and no credential; Connections authenticates it only by the single-use `state` (10 minutes, bound to the connection and its PKCE verifier) and hands the code to Blinds. Not an API for agents.",
+        "parameters": [
+          {
+            "name": "state",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string",
+              "maxLength": 512
+            }
+          },
+          {
+            "name": "code",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string",
+              "maxLength": 2048
+            }
+          },
+          {
+            "name": "iss",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string",
+              "maxLength": 512
+            }
+          },
+          {
+            "name": "error",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string",
+              "maxLength": 256
+            }
+          },
+          {
+            "name": "error_description",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string",
+              "maxLength": 1024
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "A page telling the person the connection is ready (or what failed)",
+            "content": {
+              "text/html": {
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Unknown, used or expired state",
+            "content": {
+              "text/html": {
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
+          }
+        },
+        "tags": [
+          "connections"
+        ],
+        "security": [],
+        "x-genesis-service": "connections",
+        "x-upstream": {
+          "base": "https://connections-api-808958844152.us-central1.run.app",
+          "method": "GET",
+          "path": "/v1/oauth/callback",
+          "status": "not_deployed"
+        },
+        "x-mcp": false
+      }
     }
   },
   "components": {
@@ -104890,39 +105765,6 @@
           }
         }
       },
-      "Hives.CreateSsoConnectionRequest": {
-        "type": "object",
-        "required": [
-          "name"
-        ],
-        "properties": {
-          "idp_type": {
-            "type": [
-              "string",
-              "null"
-            ],
-            "description": "IdP type hint"
-          },
-          "metadata_raw": {
-            "type": [
-              "string",
-              "null"
-            ],
-            "description": "Raw IdP metadata XML (alternative to URL)"
-          },
-          "metadata_url": {
-            "type": [
-              "string",
-              "null"
-            ],
-            "description": "IdP metadata URL (e.g. Okta, Azure AD metadata endpoint)"
-          },
-          "name": {
-            "type": "string",
-            "description": "Connection name/label"
-          }
-        }
-      },
       "Hives.CreateTerminalSessionRequest": {
         "type": "object",
         "description": "Create terminal session request",
@@ -113913,8 +114755,7 @@
       "Relays.OncallScheduleCreate": {
         "type": "object",
         "required": [
-          "name",
-          "members"
+          "name"
         ],
         "properties": {
           "name": {
@@ -113974,11 +114815,12 @@
           },
           "members": {
             "type": "array",
-            "minItems": 1,
+            "maxItems": 100,
             "items": {
               "type": "string",
               "format": "uuid"
-            }
+            },
+            "description": "Tenant user ids, at least one for a signed-in caller. An org API key has no users row: it must send [] (or omit members) and gets 400 for any user id; a signed-in member adds people later."
           },
           "allow_self_coverage": {
             "type": "boolean",
@@ -114000,11 +114842,12 @@
           },
           "alert_channel_ids": {
             "type": "array",
+            "maxItems": 0,
             "items": {
               "type": "string",
               "format": "uuid"
             },
-            "description": "Accepted but not stored"
+            "description": "Not supported on on-call schedules: send [] or omit it; a non-empty list is 400 (relays#53)"
           }
         }
       },
@@ -114084,12 +114927,12 @@
           },
           "members": {
             "type": "array",
-            "minItems": 1,
+            "maxItems": 100,
             "items": {
               "type": "string",
               "format": "uuid"
             },
-            "description": "Replaces the whole rotation"
+            "description": "Replaces the whole rotation (at least one member). Signed-in callers only: an org API key gets 400 for members (even []) and for create_override."
           },
           "create_override": {
             "$ref": "#/components/schemas/Relays.OncallOverrideInput"
@@ -143851,6 +144694,13 @@
           },
           "used_this_month_credits": {
             "type": "number"
+          },
+          "paused_reason": {
+            "enum": [
+              "dispute_open",
+              null
+            ],
+            "description": "Auto-refill is paused while a dispute on one of your charges is open"
           }
         }
       },
@@ -144246,6 +145096,338 @@
           }
         }
       },
+      "Gateway.CreditCheckoutRequest": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "items"
+        ],
+        "properties": {
+          "items": {
+            "type": "array",
+            "minItems": 1,
+            "maxItems": 10,
+            "items": {
+              "$ref": "#/components/schemas/Gateway.CreditItem"
+            }
+          },
+          "return_to": {
+            "type": "string",
+            "maxLength": 512,
+            "pattern": "^https://chat\\.one\\.ml/pay(/[A-Za-z0-9._~-]{1,128}){0,4}/?$",
+            "description": "Where Checkout sends the person back: https://chat.one.ml/pay or a path below it"
+          }
+        }
+      },
+      "Gateway.CreditCatalogPrice": {
+        "type": "object",
+        "required": [
+          "lookup_key",
+          "kind",
+          "plan",
+          "credits",
+          "computer_hours",
+          "unit_amount",
+          "interval",
+          "team",
+          "purchasable"
+        ],
+        "properties": {
+          "lookup_key": {
+            "type": "string"
+          },
+          "kind": {
+            "type": "string",
+            "enum": [
+              "plan",
+              "seat",
+              "bundle",
+              "pack",
+              "refill"
+            ]
+          },
+          "plan": {
+            "type": "string"
+          },
+          "credits": {
+            "type": "integer",
+            "description": "Credits per unit per period (plans",
+            "seats": null,
+            "bundles) or per purchase (packs": null,
+            "refills)": null
+          },
+          "computer_hours": {
+            "type": "integer"
+          },
+          "unit_amount": {
+            "type": "integer",
+            "description": "US cents"
+          },
+          "interval": {
+            "type": [
+              "string",
+              "null"
+            ],
+            "enum": [
+              "month",
+              "year",
+              null
+            ]
+          },
+          "team": {
+            "type": [
+              "object",
+              "null"
+            ],
+            "additionalProperties": {
+              "type": "integer"
+            }
+          },
+          "purchasable": {
+            "type": "boolean",
+            "description": "false for the free price and the refill prices (auto-refill buys those)"
+          }
+        }
+      },
+      "Gateway.CreditCatalog": {
+        "type": "object",
+        "required": [
+          "object",
+          "version",
+          "billing_environment",
+          "test_mode",
+          "currency",
+          "pack_credits_per_usd",
+          "prices",
+          "payment_methods",
+          "return_to"
+        ],
+        "properties": {
+          "object": {
+            "const": "credits_catalog"
+          },
+          "version": {
+            "type": "string",
+            "description": "one-plans-20261021"
+          },
+          "billing_environment": {
+            "type": "string",
+            "enum": [
+              "sandbox",
+              "live"
+            ]
+          },
+          "test_mode": {
+            "type": "boolean"
+          },
+          "currency": {
+            "const": "usd"
+          },
+          "pack_credits_per_usd": {
+            "type": "integer",
+            "description": "Credits per dollar for packs",
+            "refills and wallet payments (60)": null
+          },
+          "prices": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/Gateway.CreditCatalogPrice"
+            }
+          },
+          "payment_methods": {
+            "type": "object",
+            "required": [
+              "payment",
+              "subscription"
+            ],
+            "properties": {
+              "payment": {
+                "type": "array",
+                "items": {
+                  "type": "string"
+                },
+                "description": "card, link, us_bank_account, crypto"
+              },
+              "subscription": {
+                "type": "array",
+                "items": {
+                  "type": "string"
+                },
+                "description": "card, link, us_bank_account"
+              }
+            }
+          },
+          "return_to": {
+            "type": "object",
+            "properties": {
+              "origin": {
+                "type": "string"
+              },
+              "path_prefix": {
+                "type": "string"
+              }
+            }
+          },
+          "wallet": {
+            "type": "object",
+            "description": "The terms of POST /v1/credits/wallet-payment",
+            "properties": {
+              "token": {
+                "const": "usdc"
+              },
+              "networks": {
+                "type": "array",
+                "items": {
+                  "type": "string",
+                  "enum": [
+                    "base",
+                    "solana"
+                  ]
+                }
+              },
+              "packs": {
+                "type": "array",
+                "items": {
+                  "type": "integer",
+                  "enum": [
+                    10,
+                    25,
+                    50
+                  ]
+                }
+              },
+              "usdc_per_usd": {
+                "type": "integer"
+              },
+              "intent_minutes": {
+                "type": "integer"
+              },
+              "jitter_max_cents": {
+                "type": "integer"
+              },
+              "test_networks": {
+                "type": "object",
+                "additionalProperties": {
+                  "type": "string"
+                }
+              }
+            }
+          }
+        }
+      },
+      "Gateway.CreditWalletPaymentRequest": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "pack",
+          "network",
+          "payer_address"
+        ],
+        "properties": {
+          "pack": {
+            "type": "integer",
+            "enum": [
+              10,
+              25,
+              50
+            ],
+            "description": "The pack in US dollars"
+          },
+          "network": {
+            "type": "string",
+            "enum": [
+              "base",
+              "solana"
+            ]
+          },
+          "payer_address": {
+            "type": "string",
+            "maxLength": 64,
+            "description": "The wallet you pay from. Base: 0x and 40 hex characters. Solana: base58, 32 to 44 characters."
+          }
+        }
+      },
+      "Gateway.CreditWalletPayment": {
+        "type": "object",
+        "required": [
+          "payment_intent",
+          "status",
+          "pack",
+          "network",
+          "token",
+          "deposit_address",
+          "token_contract_address",
+          "amount_cents",
+          "amount_usd",
+          "amount_usdc_atomic",
+          "jitter_cents",
+          "credits",
+          "payer_address",
+          "expires_at"
+        ],
+        "properties": {
+          "payment_intent": {
+            "type": "string"
+          },
+          "status": {
+            "const": "requires_action"
+          },
+          "pack": {
+            "type": "integer",
+            "enum": [
+              10,
+              25,
+              50
+            ]
+          },
+          "network": {
+            "type": "string",
+            "enum": [
+              "base",
+              "solana"
+            ]
+          },
+          "token": {
+            "const": "usdc"
+          },
+          "deposit_address": {
+            "type": "string"
+          },
+          "token_contract_address": {
+            "type": "string"
+          },
+          "amount_cents": {
+            "type": "integer",
+            "description": "The exact amount to send",
+            "in US cents": null
+          },
+          "amount_usd": {
+            "type": "string",
+            "description": "amount_cents as dollars, for example 10.03"
+          },
+          "amount_usdc_atomic": {
+            "type": "string",
+            "description": "amount_cents x 10^4: the exact 6-decimal USDC units to send, for example 10030000"
+          },
+          "jitter_cents": {
+            "type": "integer",
+            "minimum": 0,
+            "maximum": 99,
+            "description": "Cents added to the pack's amount so Stripe can match the transfer"
+          },
+          "credits": {
+            "type": "integer",
+            "description": "The pack's credits plus jitter_cents x 0.6, rounded down"
+          },
+          "payer_address": {
+            "type": "string"
+          },
+          "expires_at": {
+            "type": "string",
+            "format": "date-time"
+          }
+        }
+      },
       "Gateway.CreditSubscriptionResult": {
         "type": "object",
         "required": [
@@ -156230,6 +157412,39 @@
           }
         }
       },
+      "Brews.DeleteBrew": {
+        "type": "object",
+        "required": [
+          "brewUri"
+        ],
+        "additionalProperties": true,
+        "properties": {
+          "scope": {
+            "$ref": "#/components/schemas/Brews.Scope"
+          },
+          "brewUri": {
+            "type": "string"
+          },
+          "reason": {
+            "type": "string"
+          }
+        }
+      },
+      "Brews.UninstallBrew": {
+        "type": "object",
+        "required": [
+          "installedUri"
+        ],
+        "additionalProperties": true,
+        "properties": {
+          "scope": {
+            "$ref": "#/components/schemas/Brews.Scope"
+          },
+          "installedUri": {
+            "type": "string"
+          }
+        }
+      },
       "Brews.ToolCall": {
         "type": "object",
         "required": [
@@ -156272,6 +157487,842 @@
             }
           }
         }
+      },
+      "Connections.Tier": {
+        "type": "string",
+        "enum": [
+          "verified",
+          "suspended",
+          "pending"
+        ]
+      },
+      "Connections.Effect": {
+        "type": "string",
+        "enum": [
+          "read",
+          "write",
+          "send",
+          "spend",
+          "destructive"
+        ]
+      },
+      "Connections.Mode": {
+        "type": "string",
+        "enum": [
+          "allow",
+          "approve",
+          "deny"
+        ]
+      },
+      "Connections.ConnectionStatus": {
+        "type": "string",
+        "enum": [
+          "pending_auth",
+          "active",
+          "needs_reauth",
+          "revoked"
+        ]
+      },
+      "Connections.Error": {
+        "type": "object",
+        "required": [
+          "error"
+        ],
+        "description": "Codes include TOOL_DENIED, AUTHORITY_DENIED (with `reasons`), APPROVAL_UNAVAILABLE (403), TOOL_CHANGED_PENDING_REVIEW (410), APPROVAL_CONSUMED, APPROVAL_NOT_APPROVED, APPROVAL_MISMATCH, revoked, conflict (409) and invalid (422).",
+        "properties": {
+          "error": {
+            "type": "object",
+            "required": [
+              "code",
+              "message"
+            ],
+            "properties": {
+              "code": {
+                "type": "string"
+              },
+              "message": {
+                "type": "string"
+              },
+              "request_id": {
+                "type": "string"
+              }
+            }
+          },
+          "reasons": {
+            "type": "array",
+            "items": {},
+            "description": "Auto's reasons on 403 AUTHORITY_DENIED"
+          },
+          "auto_check_id": {
+            "type": "string"
+          }
+        }
+      },
+      "Connections.ApprovalRequired": {
+        "type": "object",
+        "required": [
+          "error",
+          "approval_request_id",
+          "poll_url",
+          "expires_at"
+        ],
+        "properties": {
+          "error": {
+            "type": "object",
+            "required": [
+              "code",
+              "message"
+            ],
+            "properties": {
+              "code": {
+                "type": "string",
+                "const": "APPROVAL_REQUIRED"
+              },
+              "message": {
+                "type": "string"
+              },
+              "request_id": {
+                "type": "string"
+              }
+            }
+          },
+          "approval_request_id": {
+            "type": "string",
+            "pattern": "^apr_[0-9a-f]{32}$"
+          },
+          "poll_url": {
+            "type": "string",
+            "description": "Read the approval here, e.g. /v1/auto/approvals/apr_…"
+          },
+          "expires_at": {
+            "type": [
+              "string",
+              "null"
+            ],
+            "format": "date-time"
+          }
+        }
+      },
+      "Connections.NeedsReauth": {
+        "type": "object",
+        "required": [
+          "error",
+          "authorize_url"
+        ],
+        "properties": {
+          "error": {
+            "type": "object",
+            "required": [
+              "code",
+              "message"
+            ],
+            "properties": {
+              "code": {
+                "type": "string",
+                "const": "CONNECTION_NEEDS_REAUTH"
+              },
+              "message": {
+                "type": "string"
+              },
+              "request_id": {
+                "type": "string"
+              }
+            }
+          },
+          "authorize_url": {
+            "type": "string",
+            "format": "uri",
+            "description": "A person opens this to re-authorize"
+          }
+        }
+      },
+      "Connections.Source": {
+        "type": "object",
+        "properties": {
+          "connection": {
+            "type": "string"
+          },
+          "server": {
+            "type": "string"
+          },
+          "tool": {
+            "type": "string"
+          },
+          "tier": {
+            "$ref": "#/components/schemas/Connections.Tier"
+          }
+        }
+      },
+      "Connections.UntrustedText": {
+        "type": "object",
+        "description": "A vendor-written text (a tool description), sanitized and flagged. Data, never instructions.",
+        "required": [
+          "untrusted",
+          "text"
+        ],
+        "properties": {
+          "untrusted": {
+            "type": "boolean",
+            "const": true
+          },
+          "source": {
+            "$ref": "#/components/schemas/Connections.Source"
+          },
+          "text": {
+            "type": "string"
+          },
+          "sanitized": {
+            "type": "integer",
+            "minimum": 0
+          },
+          "flags": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          }
+        }
+      },
+      "Connections.UntrustedResult": {
+        "type": "object",
+        "description": "A tool's output (MCP content blocks), sanitized, credential-redacted and flagged. Third-party data, never instructions.",
+        "required": [
+          "untrusted",
+          "source",
+          "content"
+        ],
+        "properties": {
+          "untrusted": {
+            "type": "boolean",
+            "const": true
+          },
+          "source": {
+            "$ref": "#/components/schemas/Connections.Source"
+          },
+          "flags": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "sanitized": {
+            "type": "integer",
+            "minimum": 0
+          },
+          "credentials_redacted": {
+            "type": "integer",
+            "minimum": 0
+          },
+          "truncated": {
+            "type": "boolean"
+          },
+          "content": {
+            "type": "array",
+            "items": {}
+          },
+          "structuredContent": {},
+          "isError": {
+            "type": "boolean"
+          }
+        }
+      },
+      "Connections.CatalogServer": {
+        "type": "object",
+        "required": [
+          "id",
+          "display",
+          "tier"
+        ],
+        "properties": {
+          "id": {
+            "type": "string"
+          },
+          "vendor": {
+            "type": "string"
+          },
+          "display": {
+            "type": "string"
+          },
+          "plugins": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "url": {
+            "type": "string"
+          },
+          "docs": {
+            "type": "string"
+          },
+          "auth": {
+            "type": "string"
+          },
+          "tier": {
+            "$ref": "#/components/schemas/Connections.Tier"
+          },
+          "reason": {
+            "type": [
+              "string",
+              "null"
+            ],
+            "description": "Why a suspended server is paused"
+          },
+          "tools": {
+            "type": "integer",
+            "description": "Number of tools in the pinned manifest"
+          }
+        }
+      },
+      "Connections.CatalogTool": {
+        "type": "object",
+        "required": [
+          "name",
+          "effect"
+        ],
+        "properties": {
+          "name": {
+            "type": "string"
+          },
+          "effect": {
+            "$ref": "#/components/schemas/Connections.Effect"
+          },
+          "scopes": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "description": {
+            "$ref": "#/components/schemas/Connections.UntrustedText"
+          }
+        }
+      },
+      "Connections.CatalogServerDetail": {
+        "type": "object",
+        "required": [
+          "id",
+          "display",
+          "tier",
+          "tools"
+        ],
+        "properties": {
+          "id": {
+            "type": "string"
+          },
+          "vendor": {
+            "type": "string"
+          },
+          "display": {
+            "type": "string"
+          },
+          "plugins": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "url": {
+            "type": "string"
+          },
+          "docs": {
+            "type": "string"
+          },
+          "auth": {
+            "type": "string"
+          },
+          "tier": {
+            "$ref": "#/components/schemas/Connections.Tier"
+          },
+          "reason": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "manifest_sha256": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "tools": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/Connections.CatalogTool"
+            }
+          }
+        }
+      },
+      "Connections.Connection": {
+        "type": "object",
+        "required": [
+          "id",
+          "server",
+          "status"
+        ],
+        "properties": {
+          "id": {
+            "type": "string",
+            "pattern": "^conn_[0-9a-f]{32}$"
+          },
+          "server": {
+            "type": "string"
+          },
+          "url": {
+            "type": "string"
+          },
+          "status": {
+            "$ref": "#/components/schemas/Connections.ConnectionStatus"
+          },
+          "auto_org": {
+            "type": [
+              "string",
+              "null"
+            ],
+            "description": "The Auto org that governs the connection, if one was named at connect"
+          },
+          "tier": {
+            "$ref": "#/components/schemas/Connections.Tier"
+          },
+          "server_status": {
+            "$ref": "#/components/schemas/Connections.Tier"
+          },
+          "policy": {
+            "type": "object",
+            "additionalProperties": {
+              "$ref": "#/components/schemas/Connections.Mode"
+            }
+          },
+          "scopes_requested": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "scopes_granted": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "token_expires_at": {
+            "type": [
+              "string",
+              "null"
+            ],
+            "format": "date-time"
+          },
+          "created_by": {
+            "type": "string"
+          },
+          "created_at": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "updated_at": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "revoked_at": {
+            "type": [
+              "string",
+              "null"
+            ],
+            "format": "date-time"
+          }
+        }
+      },
+      "Connections.ConnectRequest": {
+        "type": "object",
+        "required": [
+          "server"
+        ],
+        "additionalProperties": false,
+        "properties": {
+          "server": {
+            "type": "string",
+            "pattern": "^[a-z0-9-]{1,64}$"
+          },
+          "tools": {
+            "type": "array",
+            "maxItems": 500,
+            "items": {
+              "type": "string",
+              "pattern": "^[A-Za-z0-9_.-]{1,128}$"
+            },
+            "description": "Tools to enable (default: the manifest defaults)"
+          },
+          "auto_org": {
+            "type": "string",
+            "pattern": "^aorg_[a-f0-9]{32}$",
+            "description": "The Auto org that governs the connection. A connect carrying it always answers 428 APPROVAL_REQUIRED first."
+          }
+        }
+      },
+      "Connections.ConnectResponse": {
+        "type": "object",
+        "required": [
+          "connection",
+          "authorize_url"
+        ],
+        "properties": {
+          "connection": {
+            "$ref": "#/components/schemas/Connections.Connection"
+          },
+          "authorize_url": {
+            "type": "string",
+            "format": "uri",
+            "description": "A person opens this to consent at the vendor"
+          },
+          "next": {
+            "type": "string"
+          }
+        }
+      },
+      "Connections.AuthorizeResponse": {
+        "type": "object",
+        "required": [
+          "authorize_url"
+        ],
+        "properties": {
+          "authorize_url": {
+            "type": "string",
+            "format": "uri"
+          },
+          "next": {
+            "type": "string"
+          }
+        }
+      },
+      "Connections.ConnectionTool": {
+        "type": "object",
+        "required": [
+          "name",
+          "effect",
+          "mode"
+        ],
+        "properties": {
+          "name": {
+            "type": "string"
+          },
+          "effect": {
+            "$ref": "#/components/schemas/Connections.Effect"
+          },
+          "mode": {
+            "$ref": "#/components/schemas/Connections.Mode"
+          },
+          "stored_mode": {
+            "$ref": "#/components/schemas/Connections.Mode"
+          },
+          "scopes": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "description": {
+            "$ref": "#/components/schemas/Connections.UntrustedText"
+          },
+          "inputSchema": {},
+          "schema_flags": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          }
+        }
+      },
+      "Connections.ToolList": {
+        "type": "object",
+        "required": [
+          "connection",
+          "server",
+          "tools"
+        ],
+        "properties": {
+          "connection": {
+            "type": "string"
+          },
+          "server": {
+            "type": "string"
+          },
+          "tier": {
+            "$ref": "#/components/schemas/Connections.Tier"
+          },
+          "server_status": {
+            "$ref": "#/components/schemas/Connections.Tier"
+          },
+          "manifest_sha256": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "tools": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/Connections.ConnectionTool"
+            }
+          }
+        }
+      },
+      "Connections.ToolPolicyRequest": {
+        "type": "object",
+        "required": [
+          "tools"
+        ],
+        "additionalProperties": false,
+        "properties": {
+          "tools": {
+            "type": "object",
+            "maxProperties": 500,
+            "additionalProperties": {
+              "$ref": "#/components/schemas/Connections.Mode"
+            },
+            "description": "Tool name to mode, e.g. {\"create_issue\": \"approve\"}"
+          }
+        }
+      },
+      "Connections.ToolPolicyResponse": {
+        "type": "object",
+        "required": [
+          "connection",
+          "changed"
+        ],
+        "properties": {
+          "connection": {
+            "$ref": "#/components/schemas/Connections.Connection"
+          },
+          "changed": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string"
+                },
+                "effect": {
+                  "$ref": "#/components/schemas/Connections.Effect"
+                },
+                "from": {
+                  "$ref": "#/components/schemas/Connections.Mode"
+                },
+                "to": {
+                  "$ref": "#/components/schemas/Connections.Mode"
+                }
+              }
+            }
+          },
+          "reauthorize": {
+            "type": "object",
+            "properties": {
+              "missing_scopes": {
+                "type": "array",
+                "items": {
+                  "type": "string"
+                }
+              },
+              "authorize_url": {
+                "type": "string",
+                "format": "uri"
+              }
+            }
+          }
+        }
+      },
+      "Connections.CallRequest": {
+        "type": "object",
+        "required": [
+          "arguments"
+        ],
+        "additionalProperties": false,
+        "properties": {
+          "arguments": {
+            "type": "object",
+            "additionalProperties": true,
+            "description": "The tool's arguments, as its inputSchema describes"
+          }
+        }
+      },
+      "Connections.CallResult": {
+        "type": "object",
+        "required": [
+          "call_id",
+          "outcome",
+          "result"
+        ],
+        "properties": {
+          "call_id": {
+            "type": "string"
+          },
+          "outcome": {
+            "type": "string",
+            "enum": [
+              "ok",
+              "tool_error"
+            ]
+          },
+          "result": {
+            "$ref": "#/components/schemas/Connections.UntrustedResult"
+          },
+          "auto_check_id": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "auto_receipt": {
+            "type": [
+              "string",
+              "null"
+            ],
+            "description": "Auto's signed receipt (JWS)"
+          },
+          "approval_id": {
+            "type": [
+              "string",
+              "null"
+            ]
+          }
+        }
+      },
+      "Connections.RevokeResponse": {
+        "type": "object",
+        "required": [
+          "connection"
+        ],
+        "properties": {
+          "connection": {
+            "$ref": "#/components/schemas/Connections.Connection"
+          },
+          "vendor_revoked": {
+            "type": "boolean"
+          },
+          "tokens_deleted": {
+            "type": "boolean"
+          }
+        }
+      },
+      "Connections.ActivityRow": {
+        "type": "object",
+        "required": [
+          "seq",
+          "kind",
+          "outcome",
+          "hash"
+        ],
+        "additionalProperties": true,
+        "properties": {
+          "seq": {
+            "type": "integer"
+          },
+          "at": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "kind": {
+            "type": "string"
+          },
+          "connection_id": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "principal": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "tool": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "args_sha256": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "result_sha256": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "outcome": {
+            "type": "string"
+          },
+          "prev_hash": {
+            "type": "string"
+          },
+          "hash": {
+            "type": "string"
+          }
+        }
+      },
+      "Connections.ConnectedTool": {
+        "type": "object",
+        "required": [
+          "name",
+          "connection",
+          "server",
+          "tool",
+          "effect"
+        ],
+        "properties": {
+          "name": {
+            "type": "string",
+            "description": "conn.<connection>.<tool>"
+          },
+          "connection": {
+            "type": "string",
+            "pattern": "^conn_[0-9a-f]{32}$"
+          },
+          "server": {
+            "type": "string"
+          },
+          "tool": {
+            "type": "string"
+          },
+          "effect": {
+            "$ref": "#/components/schemas/Connections.Effect"
+          },
+          "mode": {
+            "$ref": "#/components/schemas/Connections.Mode"
+          },
+          "description": {
+            "$ref": "#/components/schemas/Connections.UntrustedText"
+          },
+          "inputSchema": {},
+          "schema_flags": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          }
+        }
+      },
+      "Connections.SearchToolsResponse": {
+        "type": "object",
+        "required": [
+          "data"
+        ],
+        "properties": {
+          "data": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/Connections.ConnectedTool"
+            }
+          },
+          "session_tainted": {
+            "type": "boolean"
+          }
+        }
       }
     },
     "responses": {
@@ -156850,6 +158901,76 @@
             }
           }
         }
+      },
+      "Connections.Forbidden": {
+        "description": "Missing scope; `TOOL_DENIED` (policy deny or not in the manifest); `AUTHORITY_DENIED` with `reasons` (Auto denied); `APPROVAL_UNAVAILABLE` (an approval is needed but the org has no Auto org)",
+        "content": {
+          "application/json": {
+            "schema": {
+              "$ref": "#/components/schemas/Connections.Error"
+            }
+          }
+        }
+      },
+      "Connections.NotFound": {
+        "description": "Not found in your organization and environment",
+        "content": {
+          "application/json": {
+            "schema": {
+              "$ref": "#/components/schemas/Connections.Error"
+            }
+          }
+        }
+      },
+      "Connections.Conflict": {
+        "description": "`revoked`, `conflict` (the policy changed meanwhile), or an approval refusal: `APPROVAL_CONSUMED`, `APPROVAL_NOT_APPROVED`, `APPROVAL_MISMATCH`",
+        "content": {
+          "application/json": {
+            "schema": {
+              "$ref": "#/components/schemas/Connections.Error"
+            }
+          }
+        }
+      },
+      "Connections.NeedsReauth": {
+        "description": "`CONNECTION_NEEDS_REAUTH`: a person opens the fresh `authorize_url` (an approval refusal or `revoked` is also a 409, without it)",
+        "content": {
+          "application/json": {
+            "schema": {
+              "$ref": "#/components/schemas/Connections.NeedsReauth"
+            }
+          }
+        }
+      },
+      "Connections.ToolChanged": {
+        "description": "`TOOL_CHANGED_PENDING_REVIEW`: the server's live tools differ from its pinned manifest; it is suspended for every organization until re-verified",
+        "content": {
+          "application/json": {
+            "schema": {
+              "$ref": "#/components/schemas/Connections.Error"
+            }
+          }
+        }
+      },
+      "Connections.Invalid": {
+        "description": "Invalid request body or parameters",
+        "content": {
+          "application/json": {
+            "schema": {
+              "$ref": "#/components/schemas/Connections.Error"
+            }
+          }
+        }
+      },
+      "Connections.ApprovalRequired": {
+        "description": "`APPROVAL_REQUIRED`: a human approves `approval_request_id` in Auto; then retry the same request with `OneOS-Approval`",
+        "content": {
+          "application/json": {
+            "schema": {
+              "$ref": "#/components/schemas/Connections.ApprovalRequired"
+            }
+          }
+        }
       }
     },
     "parameters": {
@@ -157975,6 +160096,46 @@
           "maxLength": 256
         },
         "description": "Stable key; a retry with it returns the original decision instead of creating another"
+      },
+      "Connections.Id": {
+        "name": "id",
+        "in": "path",
+        "required": true,
+        "description": "Connection id (conn_ followed by 32 hex)",
+        "schema": {
+          "type": "string",
+          "pattern": "^conn_[0-9a-f]{32}$"
+        }
+      },
+      "Connections.Server": {
+        "name": "server",
+        "in": "path",
+        "required": true,
+        "description": "Catalog server id, e.g. linear, neon, sentry",
+        "schema": {
+          "type": "string",
+          "pattern": "^[a-z0-9-]{1,64}$"
+        }
+      },
+      "Connections.Tool": {
+        "name": "tool",
+        "in": "path",
+        "required": true,
+        "description": "The tool's name in the pinned manifest",
+        "schema": {
+          "type": "string",
+          "pattern": "^[A-Za-z0-9_.-]{1,128}$"
+        }
+      },
+      "Connections.Approval": {
+        "name": "OneOS-Approval",
+        "in": "header",
+        "required": false,
+        "description": "An approved approval id (`apr_…`) from an earlier 428, to retry the same request",
+        "schema": {
+          "type": "string",
+          "pattern": "^apr_[0-9a-f]{32}$"
+        }
       }
     },
     "headers": {
@@ -158011,7 +160172,7 @@
       "upstream": "https://api.fdy.sh",
       "status": "live",
       "statusNote": "api.fdy.sh answered in the Oct 9 inventory probe",
-      "operations": 116
+      "operations": 115
     },
     {
       "name": "hives",
@@ -158019,7 +160180,7 @@
       "upstream": "https://api.hives.sh",
       "status": "down",
       "statusNote": "api.hives.sh returned 503 (audit G-LIVE-1); spec misses 35 console-called paths (G-SPEC-1)",
-      "operations": 197
+      "operations": 195
     },
     {
       "name": "relays",
@@ -158169,7 +160330,7 @@
       "status": "unverified",
       "statusNote": "v2 Sandbox qualification receiver only; every mutation needs an Idempotency-Key. Needs an interactive One account login (`genesis login`) with a selected organization and project; API keys and M2M tokens are refused.",
       "gatewayRoute": "dedicated",
-      "operations": 37
+      "operations": 38
     },
     {
       "name": "auto",
@@ -158196,7 +160357,7 @@
       "status": "live",
       "statusNote": "Served by the gateway itself, never forwarded. Usage, billing and One credits (/v1/credits, behind GENESIS_CREDITS_ENABLED) take a login session or an org API key holding genesis.usage.read / genesis.billing.read / genesis.billing.manage.",
       "gatewayRoute": "dedicated",
-      "operations": 36
+      "operations": 38
     },
     {
       "name": "taps",
@@ -158250,7 +160411,16 @@
       "status": "unverified",
       "statusNote": "Org API keys and One account logins with a selected project (gateway/src/brews-transport.ts). Sandbox. Omit scope: Brews fills it from the selection. Run, eval and bench answer 503 BREWS_E_METERING_UNAVAILABLE.",
       "gatewayRoute": "dedicated",
-      "operations": 20
+      "operations": 22
+    },
+    {
+      "name": "connections",
+      "title": "Connections (verified remote MCP servers)",
+      "upstream": "https://connections-api-808958844152.us-central1.run.app",
+      "status": "not_deployed",
+      "statusNote": "Closed gateway admission behind CONNECTIONS_GATEWAY_ENABLED (default off): /v1/connections/* with a v2 signed identity and selected context (API key, M2M token or login session); connections:read for GET, connections:write otherwise, connections:* both. Sandbox in P0; Live only through UPSTREAM_CONNECTIONS_LIVE once connections is in GENESIS_LIVE_SERVICES. GET /v1/connections/oauth/callback is anonymous (a person's browser after vendor consent): no credential is read or forwarded and no identity envelope is sent. connections_authorize is a human-consent operation the hosted MCP refuses. Tool results and vendor descriptions are wrapped as untrusted. Vendor tokens live in Blinds only.",
+      "gatewayRoute": "dedicated",
+      "operations": 13
     }
   ]
 }