@onesi/genesis 0.2.12 → 0.2.14

package/dist/genesis.openapi.json

@@ -136,6 +136,14 @@
     {
       "name": "brews",
       "description": "Brews (agent recipes and decisions)"
+    },
+    {
+      "name": "connections",
+      "description": "Connections (verified remote MCP servers)"
+    },
+    {
+      "name": "agents",
+      "description": "Agents (public agent search)"
     }
   ],
   "paths": {
@@ -2130,53 +2138,6 @@
         "x-mcp": true
       }
     },
-    "/v1/foundry/files/{file_id}/content": {
-      "get": {
-        "operationId": "foundry_downloadFile",
-        "summary": "Download tenant file content",
-        "tags": [
-          "foundry"
-        ],
-        "x-foundry-executable": true,
-        "x-foundry-rust-source": "foundry-edge/src/openrouter_files.rs",
-        "x-foundry-rust-route": "/v1/files/{file_id}/content",
-        "responses": {
-          "200": {
-            "description": "File bytes.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "type": "string",
-                  "format": "binary"
-                }
-              }
-            }
-          },
-          "default": {
-            "$ref": "#/components/responses/Foundry.Error"
-          }
-        },
-        "parameters": [
-          {
-            "name": "file_id",
-            "in": "path",
-            "required": true,
-            "schema": {
-              "type": "string",
-              "minLength": 1
-            }
-          }
-        ],
-        "x-genesis-service": "foundry",
-        "x-upstream": {
-          "base": "https://api.fdy.sh",
-          "method": "GET",
-          "path": "/v1/files/{file_id}/content",
-          "status": "live"
-        },
-        "x-mcp": true
-      }
-    },
     "/v1/foundry/fine_tuning/providers": {
       "get": {
         "operationId": "foundry_listFineTuningProviders",
@@ -6674,170 +6635,6 @@
         "x-mcp": false
       }
     },
-    "/v1/hives/organizations/{org_id}/sso": {
-      "get": {
-        "tags": [
-          "hives"
-        ],
-        "summary": "Get SSO configuration for an organization",
-        "operationId": "hives_get_sso_config",
-        "parameters": [
-          {
-            "name": "org_id",
-            "in": "path",
-            "description": "Organization ID",
-            "required": true,
-            "schema": {
-              "type": "string"
-            }
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "SSO configuration",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "type": "object"
-                }
-              }
-            }
-          },
-          "401": {
-            "description": "Unauthorized"
-          },
-          "404": {
-            "description": "Organization not found"
-          },
-          "503": {
-            "description": "SSO service unavailable"
-          }
-        },
-        "x-genesis-service": "hives",
-        "x-upstream": {
-          "base": "https://api.hives.sh",
-          "method": "GET",
-          "path": "/v1/organizations/{org_id}/sso",
-          "status": "down"
-        },
-        "x-mcp": false
-      },
-      "post": {
-        "tags": [
-          "hives"
-        ],
-        "summary": "Create a new SSO connection",
-        "operationId": "hives_create_sso_connection",
-        "parameters": [
-          {
-            "name": "org_id",
-            "in": "path",
-            "description": "Organization ID",
-            "required": true,
-            "schema": {
-              "type": "string"
-            }
-          }
-        ],
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/Hives.CreateSsoConnectionRequest"
-              }
-            }
-          },
-          "required": true
-        },
-        "responses": {
-          "200": {
-            "description": "SSO connection created",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "type": "object"
-                }
-              }
-            }
-          },
-          "401": {
-            "description": "Unauthorized"
-          },
-          "404": {
-            "description": "Organization not found"
-          },
-          "503": {
-            "description": "SSO service unavailable"
-          }
-        },
-        "x-genesis-service": "hives",
-        "x-upstream": {
-          "base": "https://api.hives.sh",
-          "method": "POST",
-          "path": "/v1/organizations/{org_id}/sso",
-          "status": "down"
-        },
-        "x-mcp": false
-      }
-    },
-    "/v1/hives/organizations/{org_id}/sso/{connection_id}": {
-      "delete": {
-        "tags": [
-          "hives"
-        ],
-        "summary": "Delete an SSO connection",
-        "operationId": "hives_delete_sso_connection",
-        "parameters": [
-          {
-            "name": "org_id",
-            "in": "path",
-            "description": "Organization ID",
-            "required": true,
-            "schema": {
-              "type": "string"
-            }
-          },
-          {
-            "name": "connection_id",
-            "in": "path",
-            "description": "SSO connection ID",
-            "required": true,
-            "schema": {
-              "type": "string"
-            }
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "SSO connection deleted",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "type": "object"
-                }
-              }
-            }
-          },
-          "401": {
-            "description": "Unauthorized"
-          },
-          "404": {
-            "description": "Organization or connection not found"
-          },
-          "503": {
-            "description": "SSO service unavailable"
-          }
-        },
-        "x-genesis-service": "hives",
-        "x-upstream": {
-          "base": "https://api.hives.sh",
-          "method": "DELETE",
-          "path": "/v1/organizations/{org_id}/sso/{connection_id}",
-          "status": "down"
-        },
-        "x-mcp": false
-      }
-    },
     "/v1/hives/organizations/{org_id}/usage": {
       "get": {
         "tags": [
@@ -41449,6 +41246,128 @@
         "x-mcp": true
       }
     },
+    "/v1/dials/workflows/{workflow_id}": {
+      "delete": {
+        "operationId": "dials_deleteWorkflow",
+        "summary": "Delete an owned workflow and its routing descriptor",
+        "description": "Needs `dials:write`. Deletes the workflow with this id (the `id` you deployed it with) and every routing-rule descriptor row it was deployed as, in the verified org/workspace/project/environment only, and records a `workflows.delete` audit event whose actor is the verified gateway identity. Another organization's, workspace's, project's or environment's workflow, and a repeat delete, are 404 `workflow_not_found`. If a held (not released) number is assigned to the workflow (kind `workflow` or `routing_rule`), the delete is refused with 409 `workflow_number_attached` and nothing changes: unassign the number first with `assignNumber` and no resource. Managed inbound policies (`/v1/routing/rules`) are never deleted here. Scope is required in the JSON body, not query parameters.",
+        "parameters": [
+          {
+            "name": "workflow_id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 256
+            }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/Dials.DeleteWorkflow"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Deleted. The descriptor rows are gone; audit records are kept.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Dials.DeleteWorkflowReceipt"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Invalid scope or request shape.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Dials.CustomerError"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Missing or invalid verified identity.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Dials.CustomerError"
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "Selected scope is not authorized by signed identity or lacks the required Dials grant.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Dials.CustomerError"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "No workflow with this id in the authorized scope (workflow_not_found).",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Dials.CustomerError"
+                }
+              }
+            }
+          },
+          "409": {
+            "description": "A held number is assigned to this workflow (workflow_number_attached); unassign it first.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Dials.CustomerError"
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "Durable store failed.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Dials.CustomerError"
+                }
+              }
+            }
+          },
+          "503": {
+            "description": "Backend is not ready.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Dials.CustomerError"
+                }
+              }
+            }
+          }
+        },
+        "tags": [
+          "dials"
+        ],
+        "x-genesis-service": "dials",
+        "x-upstream": {
+          "base": "https://dials-808958844152.us-central1.run.app",
+          "method": "DELETE",
+          "path": "/v1/workflows/{workflow_id}",
+          "status": "unverified"
+        },
+        "x-mcp": true
+      }
+    },
     "/v1/dials/numbers/{number_id}": {
       "delete": {
         "operationId": "dials_deleteNumber",
@@ -101545,6 +101464,838 @@
         },
         "x-mcp": true
       }
+    },
+    "/v1/connections/catalog": {
+      "get": {
+        "operationId": "connections_listCatalog",
+        "summary": "List verified MCP servers in the catalog",
+        "description": "Scope `connections:read`. Filter by OneOS plugin category (`plugin`, e.g. `scopes`). Suspended servers are listed with their `reason`.",
+        "parameters": [
+          {
+            "name": "plugin",
+            "in": "query",
+            "required": false,
+            "description": "OneOS plugin category the server competes in, e.g. scopes, silos, traces",
+            "schema": {
+              "type": "string",
+              "pattern": "^[a-z][a-z0-9-]{0,31}$"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Catalog servers",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "data"
+                  ],
+                  "properties": {
+                    "data": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/components/schemas/Connections.CatalogServer"
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "403": {
+            "$ref": "#/components/responses/Connections.Forbidden"
+          }
+        },
+        "tags": [
+          "connections"
+        ],
+        "x-genesis-service": "connections",
+        "x-upstream": {
+          "base": "https://connections-api-808958844152.us-central1.run.app",
+          "method": "GET",
+          "path": "/v1/catalog",
+          "status": "not_deployed"
+        },
+        "x-mcp": true
+      }
+    },
+    "/v1/connections/catalog/{server}": {
+      "parameters": [
+        {
+          "$ref": "#/components/parameters/Connections.Server"
+        }
+      ],
+      "get": {
+        "operationId": "connections_getCatalogServer",
+        "summary": "Get a catalog server with its pinned tool manifest",
+        "description": "Scope `connections:read`.",
+        "responses": {
+          "200": {
+            "description": "The server and its pinned manifest",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Connections.CatalogServerDetail"
+                }
+              }
+            }
+          },
+          "404": {
+            "$ref": "#/components/responses/Connections.NotFound"
+          }
+        },
+        "tags": [
+          "connections"
+        ],
+        "x-genesis-service": "connections",
+        "x-upstream": {
+          "base": "https://connections-api-808958844152.us-central1.run.app",
+          "method": "GET",
+          "path": "/v1/catalog/{server}",
+          "status": "not_deployed"
+        },
+        "x-mcp": true
+      }
+    },
+    "/v1/connections": {
+      "get": {
+        "operationId": "connections_list",
+        "summary": "List your organization's connections",
+        "description": "Scope `connections:read`. Connections of the selected environment, newest first (at most 200), optionally of one `status`.",
+        "parameters": [
+          {
+            "name": "status",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string",
+              "enum": [
+                "pending_auth",
+                "active",
+                "needs_reauth",
+                "revoked"
+              ]
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Connections",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "data"
+                  ],
+                  "properties": {
+                    "data": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/components/schemas/Connections.Connection"
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "403": {
+            "$ref": "#/components/responses/Connections.Forbidden"
+          }
+        },
+        "tags": [
+          "connections"
+        ],
+        "x-genesis-service": "connections",
+        "x-upstream": {
+          "base": "https://connections-api-808958844152.us-central1.run.app",
+          "method": "GET",
+          "path": "/v1",
+          "status": "not_deployed"
+        },
+        "x-mcp": true
+      },
+      "post": {
+        "operationId": "connections_connect",
+        "summary": "Connect a catalog server",
+        "description": "Scope `connections:write`. Creates a `pending_auth` connection and returns the `authorize_url` a person opens to consent at the vendor. `tools` picks the tools to enable (default: the manifest's defaults); only their scopes are requested. Unknown fields are refused (422). Enabling any `send`, `spend` or `destructive` tool needs an owner's approval (428). `auto_org` names the Auto org that governs the connection (its authority checks and approvals); a connect carrying `auto_org` always answers `428 APPROVAL_REQUIRED` first, so a person approves binding the connection to that Auto org.",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/Connections.Approval"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/Connections.ConnectRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "201": {
+            "description": "Connection created, waiting for a person to authorize it",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Connections.ConnectResponse"
+                }
+              }
+            }
+          },
+          "403": {
+            "$ref": "#/components/responses/Connections.Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/Connections.NotFound"
+          },
+          "409": {
+            "$ref": "#/components/responses/Connections.Conflict"
+          },
+          "410": {
+            "$ref": "#/components/responses/Connections.ToolChanged"
+          },
+          "422": {
+            "$ref": "#/components/responses/Connections.Invalid"
+          },
+          "428": {
+            "$ref": "#/components/responses/Connections.ApprovalRequired"
+          }
+        },
+        "tags": [
+          "connections"
+        ],
+        "x-genesis-service": "connections",
+        "x-upstream": {
+          "base": "https://connections-api-808958844152.us-central1.run.app",
+          "method": "POST",
+          "path": "/v1",
+          "status": "not_deployed"
+        },
+        "x-mcp": true
+      }
+    },
+    "/v1/connections/{id}": {
+      "parameters": [
+        {
+          "$ref": "#/components/parameters/Connections.Id"
+        }
+      ],
+      "get": {
+        "operationId": "connections_get",
+        "summary": "Get a connection",
+        "description": "Scope `connections:read`. Status, granted scopes and the pinned manifest hash.",
+        "responses": {
+          "200": {
+            "description": "The connection",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Connections.Connection"
+                }
+              }
+            }
+          },
+          "404": {
+            "$ref": "#/components/responses/Connections.NotFound"
+          }
+        },
+        "tags": [
+          "connections"
+        ],
+        "x-genesis-service": "connections",
+        "x-upstream": {
+          "base": "https://connections-api-808958844152.us-central1.run.app",
+          "method": "GET",
+          "path": "/v1/{id}",
+          "status": "not_deployed"
+        },
+        "x-mcp": true
+      },
+      "delete": {
+        "operationId": "connections_revoke",
+        "summary": "Revoke a connection",
+        "description": "Scope `connections:write`. Never needs an approval. Blinds deletes the stored tokens and asks the vendor to revoke them (best effort, reported as `vendor_revoked`; `tokens_deleted` is false when Blinds did not confirm, and repeating the DELETE retries). The connection stays listed as `revoked`.",
+        "responses": {
+          "200": {
+            "description": "Revoked",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Connections.RevokeResponse"
+                }
+              }
+            }
+          },
+          "403": {
+            "$ref": "#/components/responses/Connections.Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/Connections.NotFound"
+          }
+        },
+        "tags": [
+          "connections"
+        ],
+        "x-genesis-service": "connections",
+        "x-upstream": {
+          "base": "https://connections-api-808958844152.us-central1.run.app",
+          "method": "DELETE",
+          "path": "/v1/{id}",
+          "status": "not_deployed"
+        },
+        "x-mcp": true
+      }
+    },
+    "/v1/connections/{id}/authorize": {
+      "parameters": [
+        {
+          "$ref": "#/components/parameters/Connections.Id"
+        }
+      ],
+      "post": {
+        "operationId": "connections_authorize",
+        "summary": "Get a new authorize URL for a person to open",
+        "description": "Scope `connections:write`. Returns a fresh `authorize_url` (its `state` is single use and valid for 10 minutes). Human step: a person opens it in a browser. The hosted MCP refuses this operation for agents (human consent); use the CLI (`genesis connections authorize <id>`) or the Console.",
+        "responses": {
+          "200": {
+            "description": "The URL a person opens to consent at the vendor",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Connections.AuthorizeResponse"
+                }
+              }
+            }
+          },
+          "403": {
+            "$ref": "#/components/responses/Connections.Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/Connections.NotFound"
+          },
+          "409": {
+            "$ref": "#/components/responses/Connections.Conflict"
+          }
+        },
+        "tags": [
+          "connections"
+        ],
+        "x-genesis-service": "connections",
+        "x-upstream": {
+          "base": "https://connections-api-808958844152.us-central1.run.app",
+          "method": "POST",
+          "path": "/v1/{id}/authorize",
+          "status": "not_deployed"
+        },
+        "x-mcp": false
+      }
+    },
+    "/v1/connections/{id}/tools": {
+      "parameters": [
+        {
+          "$ref": "#/components/parameters/Connections.Id"
+        }
+      ],
+      "get": {
+        "operationId": "connections_listTools",
+        "summary": "List a connection's tools with their policy",
+        "description": "Scope `connections:read`. The pinned manifest's tools, each with its effect, scopes, policy mode and the vendor's description and input schema (untrusted).",
+        "responses": {
+          "200": {
+            "description": "Tools",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Connections.ToolList"
+                }
+              }
+            }
+          },
+          "404": {
+            "$ref": "#/components/responses/Connections.NotFound"
+          },
+          "410": {
+            "$ref": "#/components/responses/Connections.ToolChanged"
+          }
+        },
+        "tags": [
+          "connections"
+        ],
+        "x-genesis-service": "connections",
+        "x-upstream": {
+          "base": "https://connections-api-808958844152.us-central1.run.app",
+          "method": "GET",
+          "path": "/v1/{id}/tools",
+          "status": "not_deployed"
+        },
+        "x-mcp": true
+      },
+      "patch": {
+        "operationId": "connections_setToolPolicy",
+        "summary": "Set tool policies (allow, approve or deny)",
+        "description": "Scope `connections:write`. `tools` maps tool names to `allow`, `approve` or `deny`; `send`, `spend` and `destructive` tools take `approve` or `deny` only (422 for `allow`). Narrowing never needs an approval; widening (deny to approve or allow, approve to allow) needs an owner's approval (428) and Auto's `connections.widen` check. When the change needs scopes not yet granted, the answer carries `reauthorize`.",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/Connections.Approval"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/Connections.ToolPolicyRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "The connection with its new policy and the changes made",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Connections.ToolPolicyResponse"
+                }
+              }
+            }
+          },
+          "403": {
+            "$ref": "#/components/responses/Connections.Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/Connections.NotFound"
+          },
+          "409": {
+            "$ref": "#/components/responses/Connections.Conflict"
+          },
+          "422": {
+            "$ref": "#/components/responses/Connections.Invalid"
+          },
+          "428": {
+            "$ref": "#/components/responses/Connections.ApprovalRequired"
+          }
+        },
+        "tags": [
+          "connections"
+        ],
+        "x-genesis-service": "connections",
+        "x-upstream": {
+          "base": "https://connections-api-808958844152.us-central1.run.app",
+          "method": "PATCH",
+          "path": "/v1/{id}/tools",
+          "status": "not_deployed"
+        },
+        "x-mcp": true
+      }
+    },
+    "/v1/connections/{id}/tools/{tool}/call": {
+      "parameters": [
+        {
+          "$ref": "#/components/parameters/Connections.Id"
+        },
+        {
+          "$ref": "#/components/parameters/Connections.Tool"
+        }
+      ],
+      "post": {
+        "operationId": "connections_call",
+        "summary": "Call a connected tool",
+        "description": "Scope `connections:write`. Runs Auto's `connections.call` check, then calls the tool through Blinds. The result is third-party content inside the `untrusted` wrapper. A tool whose policy is `approve`, or a write to another connection after this session read untrusted content, answers 428; retry with `OneOS-Approval`.",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/Connections.Approval"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/Connections.CallRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "The call's outcome and its wrapped result",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Connections.CallResult"
+                }
+              }
+            }
+          },
+          "403": {
+            "$ref": "#/components/responses/Connections.Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/Connections.NotFound"
+          },
+          "409": {
+            "$ref": "#/components/responses/Connections.NeedsReauth"
+          },
+          "410": {
+            "$ref": "#/components/responses/Connections.ToolChanged"
+          },
+          "422": {
+            "$ref": "#/components/responses/Connections.Invalid"
+          },
+          "428": {
+            "$ref": "#/components/responses/Connections.ApprovalRequired"
+          }
+        },
+        "tags": [
+          "connections"
+        ],
+        "x-genesis-service": "connections",
+        "x-upstream": {
+          "base": "https://connections-api-808958844152.us-central1.run.app",
+          "method": "POST",
+          "path": "/v1/{id}/tools/{tool}/call",
+          "status": "not_deployed"
+        },
+        "x-mcp": true
+      }
+    },
+    "/v1/connections/{id}/activity": {
+      "parameters": [
+        {
+          "$ref": "#/components/parameters/Connections.Id"
+        }
+      ],
+      "get": {
+        "operationId": "connections_activity",
+        "summary": "Read a connection's activity ledger",
+        "description": "Scope `connections:read`. Append-only, hash-chained rows, oldest first; hashes only, never payloads. Page with `after` = `next_after`.",
+        "parameters": [
+          {
+            "name": "after",
+            "in": "query",
+            "required": false,
+            "description": "Return rows with a larger `seq` (default 0)",
+            "schema": {
+              "type": "integer",
+              "minimum": 0
+            }
+          },
+          {
+            "name": "limit",
+            "in": "query",
+            "required": false,
+            "description": "Page size, 1-500 (default 100)",
+            "schema": {
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 500
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Ledger rows",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "data"
+                  ],
+                  "properties": {
+                    "data": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/components/schemas/Connections.ActivityRow"
+                      }
+                    },
+                    "next_after": {
+                      "type": [
+                        "integer",
+                        "null"
+                      ]
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "404": {
+            "$ref": "#/components/responses/Connections.NotFound"
+          }
+        },
+        "tags": [
+          "connections"
+        ],
+        "x-genesis-service": "connections",
+        "x-upstream": {
+          "base": "https://connections-api-808958844152.us-central1.run.app",
+          "method": "GET",
+          "path": "/v1/{id}/activity",
+          "status": "not_deployed"
+        },
+        "x-mcp": true
+      }
+    },
+    "/v1/connections/tools": {
+      "get": {
+        "operationId": "connections_searchTools",
+        "summary": "Search the connected tools your organization may call",
+        "description": "Scope `connections:read`. Connected tools of the selected environment whose policy is not `deny`, matched against `q` (at most 100). genesis-mcp's `genesis_search_tools` lists them by `name` (`conn.<connection>.<tool>`). `session_tainted` says whether this principal has read untrusted content.",
+        "parameters": [
+          {
+            "name": "q",
+            "in": "query",
+            "required": false,
+            "description": "Keywords",
+            "schema": {
+              "type": "string",
+              "maxLength": 200
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Matching connected tools",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Connections.SearchToolsResponse"
+                }
+              }
+            }
+          },
+          "403": {
+            "$ref": "#/components/responses/Connections.Forbidden"
+          }
+        },
+        "tags": [
+          "connections"
+        ],
+        "x-genesis-service": "connections",
+        "x-upstream": {
+          "base": "https://connections-api-808958844152.us-central1.run.app",
+          "method": "GET",
+          "path": "/v1/tools",
+          "status": "not_deployed"
+        },
+        "x-mcp": true
+      }
+    },
+    "/v1/connections/oauth/callback": {
+      "get": {
+        "operationId": "connections_oauthCallback",
+        "summary": "OAuth redirect target for a person's browser (anonymous)",
+        "description": "Human browser only; anonymous. The vendor redirects the person here after consent. The gateway forwards it with no identity envelope and no credential; Connections authenticates it only by the single-use `state` (10 minutes, bound to the connection and its PKCE verifier) and hands the code to Blinds. Not an API for agents.",
+        "parameters": [
+          {
+            "name": "state",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string",
+              "maxLength": 512
+            }
+          },
+          {
+            "name": "code",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string",
+              "maxLength": 2048
+            }
+          },
+          {
+            "name": "iss",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string",
+              "maxLength": 512
+            }
+          },
+          {
+            "name": "error",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string",
+              "maxLength": 256
+            }
+          },
+          {
+            "name": "error_description",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string",
+              "maxLength": 1024
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "A page telling the person the connection is ready (or what failed)",
+            "content": {
+              "text/html": {
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Unknown, used or expired state",
+            "content": {
+              "text/html": {
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
+          }
+        },
+        "tags": [
+          "connections"
+        ],
+        "security": [],
+        "x-genesis-service": "connections",
+        "x-upstream": {
+          "base": "https://connections-api-808958844152.us-central1.run.app",
+          "method": "GET",
+          "path": "/v1/oauth/callback",
+          "status": "not_deployed"
+        },
+        "x-mcp": false
+      }
+    },
+    "/v1/agents/search": {
+      "get": {
+        "operationId": "agents_search",
+        "summary": "Search public agents",
+        "description": "Public, no credential. Ranked full-text search over public Live agents: matches in the name rank above the organization name, then the description, then the agent id; every word must match, as a prefix. An exact agent id ranks that agent first. GET only, no body, no other query key. Cached at the edge for up to 30 seconds. Rate limited per client address (429 RATE_LIMITED with Retry-After).",
+        "parameters": [
+          {
+            "name": "q",
+            "in": "query",
+            "required": true,
+            "description": "What to search for, 1 to 200 characters.",
+            "schema": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 200
+            }
+          },
+          {
+            "name": "limit",
+            "in": "query",
+            "required": false,
+            "description": "Most results to return, 1 to 20 (default 20).",
+            "schema": {
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 20,
+              "default": 20
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Matching public agents, best first",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Agents.AgentSearchResults"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "INVALID_QUERY (q or limit out of range) or INVALID_REQUEST (another query key",
+            "or a body)": null
+          },
+          "405": {
+            "description": "METHOD_NOT_ALLOWED (after a credential verifies; without one",
+            "401 like every non-public path)": null
+          },
+          "429": {
+            "description": "RATE_LIMITED"
+          },
+          "502": {
+            "description": "BAD_GATEWAY (the index answered outside its contract; nothing is passed through)"
+          },
+          "503": {
+            "description": "AGENT_INDEX_UNAVAILABLE or SERVICE_DISABLED"
+          }
+        },
+        "tags": [
+          "agents"
+        ],
+        "security": [],
+        "x-genesis-service": "agents",
+        "x-upstream": {
+          "base": "https://genesis-agent-index.invalid",
+          "method": "GET",
+          "path": "/v1/agents/search",
+          "status": "not_deployed"
+        },
+        "x-mcp": true
+      }
+    },
+    "/v1/agents/sitemap": {
+      "get": {
+        "operationId": "agents_sitemap",
+        "summary": "List every public agent for crawlers",
+        "description": "Public, no credential. Every public Live agent id (at most 50,000) with when its public content last changed, for sitemaps and spiders. GET only, no query string, no body. Cached at the edge for up to 5 minutes. Rate limited per client address.",
+        "responses": {
+          "200": {
+            "description": "Public agent ids",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Agents.AgentSitemap"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "INVALID_REQUEST (a query string or a body)"
+          },
+          "405": {
+            "description": "METHOD_NOT_ALLOWED (after a credential verifies; without one",
+            "401 like every non-public path)": null
+          },
+          "429": {
+            "description": "RATE_LIMITED"
+          },
+          "502": {
+            "description": "BAD_GATEWAY"
+          },
+          "503": {
+            "description": "AGENT_INDEX_UNAVAILABLE or SERVICE_DISABLED"
+          }
+        },
+        "tags": [
+          "agents"
+        ],
+        "security": [],
+        "x-genesis-service": "agents",
+        "x-upstream": {
+          "base": "https://genesis-agent-index.invalid",
+          "method": "GET",
+          "path": "/v1/agents/sitemap",
+          "status": "not_deployed"
+        },
+        "x-mcp": true
+      }
     }
   },
   "components": {
@@ -105260,39 +106011,6 @@
           }
         }
       },
-      "Hives.CreateSsoConnectionRequest": {
-        "type": "object",
-        "required": [
-          "name"
-        ],
-        "properties": {
-          "idp_type": {
-            "type": [
-              "string",
-              "null"
-            ],
-            "description": "IdP type hint"
-          },
-          "metadata_raw": {
-            "type": [
-              "string",
-              "null"
-            ],
-            "description": "Raw IdP metadata XML (alternative to URL)"
-          },
-          "metadata_url": {
-            "type": [
-              "string",
-              "null"
-            ],
-            "description": "IdP metadata URL (e.g. Okta, Azure AD metadata endpoint)"
-          },
-          "name": {
-            "type": "string",
-            "description": "Connection name/label"
-          }
-        }
-      },
       "Hives.CreateTerminalSessionRequest": {
         "type": "object",
         "description": "Create terminal session request",
@@ -131145,6 +131863,65 @@
         "additionalProperties": false,
         "description": "Upsert by scoped workflow ID. Backend supplies deployed status, stable route ID and enabled routing descriptor. This is persisted configuration, not runtime/telephony execution proof."
       },
+      "Dials.DeleteWorkflow": {
+        "type": "object",
+        "additionalProperties": false,
+        "properties": {
+          "scope": {
+            "$ref": "#/components/schemas/Dials.Scope"
+          },
+          "actorId": {
+            "type": [
+              "string",
+              "null"
+            ],
+            "description": "Optional compatibility field; the actual actor comes from the verified gateway identity."
+          }
+        },
+        "required": [
+          "scope"
+        ]
+      },
+      "Dials.DeleteWorkflowReceipt": {
+        "type": "object",
+        "additionalProperties": false,
+        "properties": {
+          "ok": {
+            "type": "boolean",
+            "const": true
+          },
+          "deleted": {
+            "type": "boolean",
+            "const": true
+          },
+          "workflow": {
+            "$ref": "#/components/schemas/Dials.WorkflowDocument"
+          },
+          "routeIds": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "The routing-rule descriptor ids that were deleted."
+          },
+          "auditId": {
+            "type": "string"
+          },
+          "next": {
+            "type": "string",
+            "const": "workflow_deleted"
+          }
+        },
+        "required": [
+          "ok",
+          "deleted",
+          "workflow",
+          "routeIds",
+          "auditId",
+          "next"
+        ],
+        "description": "The deleted workflow as it was, with status \"deleted\"."
+      },
       "Dials.CallSession": {
         "type": "object",
         "required": [
@@ -157015,6 +157792,951 @@
             }
           }
         }
+      },
+      "Connections.Tier": {
+        "type": "string",
+        "enum": [
+          "verified",
+          "suspended",
+          "pending"
+        ]
+      },
+      "Connections.Effect": {
+        "type": "string",
+        "enum": [
+          "read",
+          "write",
+          "send",
+          "spend",
+          "destructive"
+        ]
+      },
+      "Connections.Mode": {
+        "type": "string",
+        "enum": [
+          "allow",
+          "approve",
+          "deny"
+        ]
+      },
+      "Connections.ConnectionStatus": {
+        "type": "string",
+        "enum": [
+          "pending_auth",
+          "active",
+          "needs_reauth",
+          "revoked"
+        ]
+      },
+      "Connections.Error": {
+        "type": "object",
+        "required": [
+          "error"
+        ],
+        "description": "Codes include TOOL_DENIED, AUTHORITY_DENIED (with `reasons`), APPROVAL_UNAVAILABLE (403), TOOL_CHANGED_PENDING_REVIEW (410), APPROVAL_CONSUMED, APPROVAL_NOT_APPROVED, APPROVAL_MISMATCH, revoked, conflict (409) and invalid (422).",
+        "properties": {
+          "error": {
+            "type": "object",
+            "required": [
+              "code",
+              "message"
+            ],
+            "properties": {
+              "code": {
+                "type": "string"
+              },
+              "message": {
+                "type": "string"
+              },
+              "request_id": {
+                "type": "string"
+              }
+            }
+          },
+          "reasons": {
+            "type": "array",
+            "items": {},
+            "description": "Auto's reasons on 403 AUTHORITY_DENIED"
+          },
+          "auto_check_id": {
+            "type": "string"
+          }
+        }
+      },
+      "Connections.ApprovalRequired": {
+        "type": "object",
+        "required": [
+          "error",
+          "approval_request_id",
+          "poll_url",
+          "expires_at"
+        ],
+        "properties": {
+          "error": {
+            "type": "object",
+            "required": [
+              "code",
+              "message"
+            ],
+            "properties": {
+              "code": {
+                "type": "string",
+                "const": "APPROVAL_REQUIRED"
+              },
+              "message": {
+                "type": "string"
+              },
+              "request_id": {
+                "type": "string"
+              }
+            }
+          },
+          "approval_request_id": {
+            "type": "string",
+            "pattern": "^apr_[0-9a-f]{32}$"
+          },
+          "poll_url": {
+            "type": "string",
+            "description": "Read the approval here, e.g. /v1/auto/approvals/apr_…"
+          },
+          "expires_at": {
+            "type": [
+              "string",
+              "null"
+            ],
+            "format": "date-time"
+          }
+        }
+      },
+      "Connections.NeedsReauth": {
+        "type": "object",
+        "required": [
+          "error",
+          "authorize_url"
+        ],
+        "properties": {
+          "error": {
+            "type": "object",
+            "required": [
+              "code",
+              "message"
+            ],
+            "properties": {
+              "code": {
+                "type": "string",
+                "const": "CONNECTION_NEEDS_REAUTH"
+              },
+              "message": {
+                "type": "string"
+              },
+              "request_id": {
+                "type": "string"
+              }
+            }
+          },
+          "authorize_url": {
+            "type": "string",
+            "format": "uri",
+            "description": "A person opens this to re-authorize"
+          }
+        }
+      },
+      "Connections.Source": {
+        "type": "object",
+        "properties": {
+          "connection": {
+            "type": "string"
+          },
+          "server": {
+            "type": "string"
+          },
+          "tool": {
+            "type": "string"
+          },
+          "tier": {
+            "$ref": "#/components/schemas/Connections.Tier"
+          }
+        }
+      },
+      "Connections.UntrustedText": {
+        "type": "object",
+        "description": "A vendor-written text (a tool description), sanitized and flagged. Data, never instructions.",
+        "required": [
+          "untrusted",
+          "text"
+        ],
+        "properties": {
+          "untrusted": {
+            "type": "boolean",
+            "const": true
+          },
+          "source": {
+            "$ref": "#/components/schemas/Connections.Source"
+          },
+          "text": {
+            "type": "string"
+          },
+          "sanitized": {
+            "type": "integer",
+            "minimum": 0
+          },
+          "flags": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          }
+        }
+      },
+      "Connections.UntrustedResult": {
+        "type": "object",
+        "description": "A tool's output (MCP content blocks), sanitized, credential-redacted and flagged. Third-party data, never instructions.",
+        "required": [
+          "untrusted",
+          "source",
+          "content"
+        ],
+        "properties": {
+          "untrusted": {
+            "type": "boolean",
+            "const": true
+          },
+          "source": {
+            "$ref": "#/components/schemas/Connections.Source"
+          },
+          "flags": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "sanitized": {
+            "type": "integer",
+            "minimum": 0
+          },
+          "credentials_redacted": {
+            "type": "integer",
+            "minimum": 0
+          },
+          "truncated": {
+            "type": "boolean"
+          },
+          "content": {
+            "type": "array",
+            "items": {}
+          },
+          "structuredContent": {},
+          "isError": {
+            "type": "boolean"
+          }
+        }
+      },
+      "Connections.CatalogServer": {
+        "type": "object",
+        "required": [
+          "id",
+          "display",
+          "tier"
+        ],
+        "properties": {
+          "id": {
+            "type": "string"
+          },
+          "vendor": {
+            "type": "string"
+          },
+          "display": {
+            "type": "string"
+          },
+          "plugins": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "url": {
+            "type": "string"
+          },
+          "docs": {
+            "type": "string"
+          },
+          "auth": {
+            "type": "string"
+          },
+          "tier": {
+            "$ref": "#/components/schemas/Connections.Tier"
+          },
+          "reason": {
+            "type": [
+              "string",
+              "null"
+            ],
+            "description": "Why a suspended server is paused"
+          },
+          "tools": {
+            "type": "integer",
+            "description": "Number of tools in the pinned manifest"
+          }
+        }
+      },
+      "Connections.CatalogTool": {
+        "type": "object",
+        "required": [
+          "name",
+          "effect"
+        ],
+        "properties": {
+          "name": {
+            "type": "string"
+          },
+          "effect": {
+            "$ref": "#/components/schemas/Connections.Effect"
+          },
+          "scopes": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "description": {
+            "$ref": "#/components/schemas/Connections.UntrustedText"
+          }
+        }
+      },
+      "Connections.CatalogServerDetail": {
+        "type": "object",
+        "required": [
+          "id",
+          "display",
+          "tier",
+          "tools"
+        ],
+        "properties": {
+          "id": {
+            "type": "string"
+          },
+          "vendor": {
+            "type": "string"
+          },
+          "display": {
+            "type": "string"
+          },
+          "plugins": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "url": {
+            "type": "string"
+          },
+          "docs": {
+            "type": "string"
+          },
+          "auth": {
+            "type": "string"
+          },
+          "tier": {
+            "$ref": "#/components/schemas/Connections.Tier"
+          },
+          "reason": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "manifest_sha256": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "tools": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/Connections.CatalogTool"
+            }
+          }
+        }
+      },
+      "Connections.Connection": {
+        "type": "object",
+        "required": [
+          "id",
+          "server",
+          "status"
+        ],
+        "properties": {
+          "id": {
+            "type": "string",
+            "pattern": "^conn_[0-9a-f]{32}$"
+          },
+          "server": {
+            "type": "string"
+          },
+          "url": {
+            "type": "string"
+          },
+          "status": {
+            "$ref": "#/components/schemas/Connections.ConnectionStatus"
+          },
+          "auto_org": {
+            "type": [
+              "string",
+              "null"
+            ],
+            "description": "The Auto org that governs the connection, if one was named at connect"
+          },
+          "tier": {
+            "$ref": "#/components/schemas/Connections.Tier"
+          },
+          "server_status": {
+            "$ref": "#/components/schemas/Connections.Tier"
+          },
+          "policy": {
+            "type": "object",
+            "additionalProperties": {
+              "$ref": "#/components/schemas/Connections.Mode"
+            }
+          },
+          "scopes_requested": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "scopes_granted": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "token_expires_at": {
+            "type": [
+              "string",
+              "null"
+            ],
+            "format": "date-time"
+          },
+          "created_by": {
+            "type": "string"
+          },
+          "created_at": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "updated_at": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "revoked_at": {
+            "type": [
+              "string",
+              "null"
+            ],
+            "format": "date-time"
+          }
+        }
+      },
+      "Connections.ConnectRequest": {
+        "type": "object",
+        "required": [
+          "server"
+        ],
+        "additionalProperties": false,
+        "properties": {
+          "server": {
+            "type": "string",
+            "pattern": "^[a-z0-9-]{1,64}$"
+          },
+          "tools": {
+            "type": "array",
+            "maxItems": 500,
+            "items": {
+              "type": "string",
+              "pattern": "^[A-Za-z0-9_.-]{1,128}$"
+            },
+            "description": "Tools to enable (default: the manifest defaults)"
+          },
+          "auto_org": {
+            "type": "string",
+            "pattern": "^aorg_[a-f0-9]{32}$",
+            "description": "The Auto org that governs the connection. A connect carrying it always answers 428 APPROVAL_REQUIRED first."
+          }
+        }
+      },
+      "Connections.ConnectResponse": {
+        "type": "object",
+        "required": [
+          "connection",
+          "authorize_url"
+        ],
+        "properties": {
+          "connection": {
+            "$ref": "#/components/schemas/Connections.Connection"
+          },
+          "authorize_url": {
+            "type": "string",
+            "format": "uri",
+            "description": "A person opens this to consent at the vendor"
+          },
+          "next": {
+            "type": "string"
+          }
+        }
+      },
+      "Connections.AuthorizeResponse": {
+        "type": "object",
+        "required": [
+          "authorize_url"
+        ],
+        "properties": {
+          "authorize_url": {
+            "type": "string",
+            "format": "uri"
+          },
+          "next": {
+            "type": "string"
+          }
+        }
+      },
+      "Connections.ConnectionTool": {
+        "type": "object",
+        "required": [
+          "name",
+          "effect",
+          "mode"
+        ],
+        "properties": {
+          "name": {
+            "type": "string"
+          },
+          "effect": {
+            "$ref": "#/components/schemas/Connections.Effect"
+          },
+          "mode": {
+            "$ref": "#/components/schemas/Connections.Mode"
+          },
+          "stored_mode": {
+            "$ref": "#/components/schemas/Connections.Mode"
+          },
+          "scopes": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "description": {
+            "$ref": "#/components/schemas/Connections.UntrustedText"
+          },
+          "inputSchema": {},
+          "schema_flags": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          }
+        }
+      },
+      "Connections.ToolList": {
+        "type": "object",
+        "required": [
+          "connection",
+          "server",
+          "tools"
+        ],
+        "properties": {
+          "connection": {
+            "type": "string"
+          },
+          "server": {
+            "type": "string"
+          },
+          "tier": {
+            "$ref": "#/components/schemas/Connections.Tier"
+          },
+          "server_status": {
+            "$ref": "#/components/schemas/Connections.Tier"
+          },
+          "manifest_sha256": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "tools": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/Connections.ConnectionTool"
+            }
+          }
+        }
+      },
+      "Connections.ToolPolicyRequest": {
+        "type": "object",
+        "required": [
+          "tools"
+        ],
+        "additionalProperties": false,
+        "properties": {
+          "tools": {
+            "type": "object",
+            "maxProperties": 500,
+            "additionalProperties": {
+              "$ref": "#/components/schemas/Connections.Mode"
+            },
+            "description": "Tool name to mode, e.g. {\"create_issue\": \"approve\"}"
+          }
+        }
+      },
+      "Connections.ToolPolicyResponse": {
+        "type": "object",
+        "required": [
+          "connection",
+          "changed"
+        ],
+        "properties": {
+          "connection": {
+            "$ref": "#/components/schemas/Connections.Connection"
+          },
+          "changed": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string"
+                },
+                "effect": {
+                  "$ref": "#/components/schemas/Connections.Effect"
+                },
+                "from": {
+                  "$ref": "#/components/schemas/Connections.Mode"
+                },
+                "to": {
+                  "$ref": "#/components/schemas/Connections.Mode"
+                }
+              }
+            }
+          },
+          "reauthorize": {
+            "type": "object",
+            "properties": {
+              "missing_scopes": {
+                "type": "array",
+                "items": {
+                  "type": "string"
+                }
+              },
+              "authorize_url": {
+                "type": "string",
+                "format": "uri"
+              }
+            }
+          }
+        }
+      },
+      "Connections.CallRequest": {
+        "type": "object",
+        "required": [
+          "arguments"
+        ],
+        "additionalProperties": false,
+        "properties": {
+          "arguments": {
+            "type": "object",
+            "additionalProperties": true,
+            "description": "The tool's arguments, as its inputSchema describes"
+          }
+        }
+      },
+      "Connections.CallResult": {
+        "type": "object",
+        "required": [
+          "call_id",
+          "outcome",
+          "result"
+        ],
+        "properties": {
+          "call_id": {
+            "type": "string"
+          },
+          "outcome": {
+            "type": "string",
+            "enum": [
+              "ok",
+              "tool_error"
+            ]
+          },
+          "result": {
+            "$ref": "#/components/schemas/Connections.UntrustedResult"
+          },
+          "auto_check_id": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "auto_receipt": {
+            "type": [
+              "string",
+              "null"
+            ],
+            "description": "Auto's signed receipt (JWS)"
+          },
+          "approval_id": {
+            "type": [
+              "string",
+              "null"
+            ]
+          }
+        }
+      },
+      "Connections.RevokeResponse": {
+        "type": "object",
+        "required": [
+          "connection"
+        ],
+        "properties": {
+          "connection": {
+            "$ref": "#/components/schemas/Connections.Connection"
+          },
+          "vendor_revoked": {
+            "type": "boolean"
+          },
+          "tokens_deleted": {
+            "type": "boolean"
+          }
+        }
+      },
+      "Connections.ActivityRow": {
+        "type": "object",
+        "required": [
+          "seq",
+          "kind",
+          "outcome",
+          "hash"
+        ],
+        "additionalProperties": true,
+        "properties": {
+          "seq": {
+            "type": "integer"
+          },
+          "at": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "kind": {
+            "type": "string"
+          },
+          "connection_id": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "principal": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "tool": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "args_sha256": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "result_sha256": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "outcome": {
+            "type": "string"
+          },
+          "prev_hash": {
+            "type": "string"
+          },
+          "hash": {
+            "type": "string"
+          }
+        }
+      },
+      "Connections.ConnectedTool": {
+        "type": "object",
+        "required": [
+          "name",
+          "connection",
+          "server",
+          "tool",
+          "effect"
+        ],
+        "properties": {
+          "name": {
+            "type": "string",
+            "description": "conn.<connection>.<tool>"
+          },
+          "connection": {
+            "type": "string",
+            "pattern": "^conn_[0-9a-f]{32}$"
+          },
+          "server": {
+            "type": "string"
+          },
+          "tool": {
+            "type": "string"
+          },
+          "effect": {
+            "$ref": "#/components/schemas/Connections.Effect"
+          },
+          "mode": {
+            "$ref": "#/components/schemas/Connections.Mode"
+          },
+          "description": {
+            "$ref": "#/components/schemas/Connections.UntrustedText"
+          },
+          "inputSchema": {},
+          "schema_flags": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          }
+        }
+      },
+      "Connections.SearchToolsResponse": {
+        "type": "object",
+        "required": [
+          "data"
+        ],
+        "properties": {
+          "data": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/Connections.ConnectedTool"
+            }
+          },
+          "session_tainted": {
+            "type": "boolean"
+          }
+        }
+      },
+      "Agents.AgentSearchResults": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "results"
+        ],
+        "properties": {
+          "results": {
+            "type": "array",
+            "maxItems": 20,
+            "items": {
+              "$ref": "#/components/schemas/Agents.AgentSearchHit"
+            }
+          }
+        }
+      },
+      "Agents.AgentSearchHit": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "agentId",
+          "did",
+          "verified",
+          "environment"
+        ],
+        "description": "One public agent. Optional keys are omitted when the owner did not disclose them.",
+        "properties": {
+          "agentId": {
+            "type": "string",
+            "pattern": "^a_[A-Za-z0-9]{1,64}$",
+            "description": "The agent's IAM id (a_...)"
+          },
+          "did": {
+            "type": "string",
+            "description": "The agent's canonical DID (did:oas:agent:...)"
+          },
+          "verified": {
+            "type": "boolean",
+            "const": true,
+            "description": "IAM vouches for this public identity"
+          },
+          "environment": {
+            "type": "string",
+            "const": "live",
+            "description": "Always live; Sandbox agents are never indexed"
+          },
+          "name": {
+            "type": "string",
+            "maxLength": 120,
+            "description": "The agent's name (when disclosed)"
+          },
+          "owner": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "name"
+            ],
+            "description": "The owning organization (when its name is disclosed). Never a person.",
+            "properties": {
+              "name": {
+                "type": "string",
+                "maxLength": 120
+              }
+            }
+          },
+          "description": {
+            "type": "string",
+            "maxLength": 300,
+            "description": "The owner's public description (when disclosed)"
+          },
+          "createdAt": {
+            "type": "integer",
+            "description": "When the agent was created",
+            "in milliseconds since the epoch (when disclosed)": null
+          }
+        }
+      },
+      "Agents.AgentSitemap": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "agents"
+        ],
+        "properties": {
+          "agents": {
+            "type": "array",
+            "maxItems": 50000,
+            "items": {
+              "type": "object",
+              "additionalProperties": false,
+              "required": [
+                "agentId",
+                "updatedAt"
+              ],
+              "properties": {
+                "agentId": {
+                  "type": "string",
+                  "pattern": "^a_[A-Za-z0-9]{1,64}$"
+                },
+                "updatedAt": {
+                  "type": "integer",
+                  "description": "When the agent's public content last changed",
+                  "in milliseconds since the epoch": null
+                }
+              }
+            }
+          }
+        }
       }
     },
     "responses": {
@@ -157593,6 +159315,76 @@
             }
           }
         }
+      },
+      "Connections.Forbidden": {
+        "description": "Missing scope; `TOOL_DENIED` (policy deny or not in the manifest); `AUTHORITY_DENIED` with `reasons` (Auto denied); `APPROVAL_UNAVAILABLE` (an approval is needed but the org has no Auto org)",
+        "content": {
+          "application/json": {
+            "schema": {
+              "$ref": "#/components/schemas/Connections.Error"
+            }
+          }
+        }
+      },
+      "Connections.NotFound": {
+        "description": "Not found in your organization and environment",
+        "content": {
+          "application/json": {
+            "schema": {
+              "$ref": "#/components/schemas/Connections.Error"
+            }
+          }
+        }
+      },
+      "Connections.Conflict": {
+        "description": "`revoked`, `conflict` (the policy changed meanwhile), or an approval refusal: `APPROVAL_CONSUMED`, `APPROVAL_NOT_APPROVED`, `APPROVAL_MISMATCH`",
+        "content": {
+          "application/json": {
+            "schema": {
+              "$ref": "#/components/schemas/Connections.Error"
+            }
+          }
+        }
+      },
+      "Connections.NeedsReauth": {
+        "description": "`CONNECTION_NEEDS_REAUTH`: a person opens the fresh `authorize_url` (an approval refusal or `revoked` is also a 409, without it)",
+        "content": {
+          "application/json": {
+            "schema": {
+              "$ref": "#/components/schemas/Connections.NeedsReauth"
+            }
+          }
+        }
+      },
+      "Connections.ToolChanged": {
+        "description": "`TOOL_CHANGED_PENDING_REVIEW`: the server's live tools differ from its pinned manifest; it is suspended for every organization until re-verified",
+        "content": {
+          "application/json": {
+            "schema": {
+              "$ref": "#/components/schemas/Connections.Error"
+            }
+          }
+        }
+      },
+      "Connections.Invalid": {
+        "description": "Invalid request body or parameters",
+        "content": {
+          "application/json": {
+            "schema": {
+              "$ref": "#/components/schemas/Connections.Error"
+            }
+          }
+        }
+      },
+      "Connections.ApprovalRequired": {
+        "description": "`APPROVAL_REQUIRED`: a human approves `approval_request_id` in Auto; then retry the same request with `OneOS-Approval`",
+        "content": {
+          "application/json": {
+            "schema": {
+              "$ref": "#/components/schemas/Connections.ApprovalRequired"
+            }
+          }
+        }
       }
     },
     "parameters": {
@@ -158718,6 +160510,46 @@
           "maxLength": 256
         },
         "description": "Stable key; a retry with it returns the original decision instead of creating another"
+      },
+      "Connections.Id": {
+        "name": "id",
+        "in": "path",
+        "required": true,
+        "description": "Connection id (conn_ followed by 32 hex)",
+        "schema": {
+          "type": "string",
+          "pattern": "^conn_[0-9a-f]{32}$"
+        }
+      },
+      "Connections.Server": {
+        "name": "server",
+        "in": "path",
+        "required": true,
+        "description": "Catalog server id, e.g. linear, neon, sentry",
+        "schema": {
+          "type": "string",
+          "pattern": "^[a-z0-9-]{1,64}$"
+        }
+      },
+      "Connections.Tool": {
+        "name": "tool",
+        "in": "path",
+        "required": true,
+        "description": "The tool's name in the pinned manifest",
+        "schema": {
+          "type": "string",
+          "pattern": "^[A-Za-z0-9_.-]{1,128}$"
+        }
+      },
+      "Connections.Approval": {
+        "name": "OneOS-Approval",
+        "in": "header",
+        "required": false,
+        "description": "An approved approval id (`apr_…`) from an earlier 428, to retry the same request",
+        "schema": {
+          "type": "string",
+          "pattern": "^apr_[0-9a-f]{32}$"
+        }
       }
     },
     "headers": {
@@ -158754,7 +160586,7 @@
       "upstream": "https://api.fdy.sh",
       "status": "live",
       "statusNote": "api.fdy.sh answered in the Oct 9 inventory probe",
-      "operations": 116
+      "operations": 115
     },
     {
       "name": "hives",
@@ -158762,7 +160594,7 @@
       "upstream": "https://api.hives.sh",
       "status": "down",
       "statusNote": "api.hives.sh returned 503 (audit G-LIVE-1); spec misses 35 console-called paths (G-SPEC-1)",
-      "operations": 198
+      "operations": 195
     },
     {
       "name": "relays",
@@ -158826,7 +160658,7 @@
       "upstream": "https://dials-808958844152.us-central1.run.app",
       "status": "unverified",
       "statusNote": "Backend healthy; Genesis signed-identity integration pending deployment and acceptance.",
-      "operations": 37
+      "operations": 38
     },
     {
       "name": "silos",
@@ -158994,6 +160826,24 @@
       "statusNote": "Org API keys and One account logins with a selected project (gateway/src/brews-transport.ts). Sandbox. Omit scope: Brews fills it from the selection. Run, eval and bench answer 503 BREWS_E_METERING_UNAVAILABLE.",
       "gatewayRoute": "dedicated",
       "operations": 22
+    },
+    {
+      "name": "connections",
+      "title": "Connections (verified remote MCP servers)",
+      "upstream": "https://connections-api-808958844152.us-central1.run.app",
+      "status": "not_deployed",
+      "statusNote": "Closed gateway admission behind CONNECTIONS_GATEWAY_ENABLED (default off): /v1/connections/* with a v2 signed identity and selected context (API key, M2M token or login session); connections:read for GET, connections:write otherwise, connections:* both. Sandbox in P0; Live only through UPSTREAM_CONNECTIONS_LIVE once connections is in GENESIS_LIVE_SERVICES. GET /v1/connections/oauth/callback is anonymous (a person's browser after vendor consent): no credential is read or forwarded and no identity envelope is sent. connections_authorize is a human-consent operation the hosted MCP refuses. Tool results and vendor descriptions are wrapped as untrusted. Vendor tokens live in Blinds only.",
+      "gatewayRoute": "dedicated",
+      "operations": 13
+    },
+    {
+      "name": "agents",
+      "title": "Agents (public agent search)",
+      "upstream": "https://genesis-agent-index.invalid",
+      "status": "not_deployed",
+      "statusNote": "genesis-agent-index (l1felabs/genesis-agent-index) is not deployed. The gateway admits it behind AGENT_INDEX_ENABLED with AGENT_INDEX_ORIGIN (gateway/src/agent-index.ts): public and anonymous (no credential is read or forwarded), rate limited per client address, never metered. Live public agents only.",
+      "gatewayRoute": "dedicated",
+      "operations": 2
     }
   ]
 }