@onesi/genesis 0.2.5 → 0.2.7

package/dist/genesis.openapi.json

@@ -14725,11 +14725,38 @@
         },
         "responses": {
           "200": {
-            "description": "Actual provider upload metadata",
+            "description": "Actual provider upload metadata (unfunded mode), or the original settled receipt without `result` for a same-key replay",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/Hives.CloudResource_GenesisCellsObjectAcknowledgement"
+                  "oneOf": [
+                    {
+                      "$ref": "#/components/schemas/Hives.CloudResource_GenesisCellsObjectAcknowledgement"
+                    },
+                    {
+                      "$ref": "#/components/schemas/Hives.CloudResource_GenesisCellsStorageWriteReceipt"
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "201": {
+            "description": "Funded write settled; the receipt carries the object acknowledgement as `result`",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Hives.CloudResource_GenesisCellsStorageWriteReceipt"
+                }
+              }
+            }
+          },
+          "202": {
+            "description": "Funded write not settled yet; replay the same Idempotency-Key to read its outcome",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Hives.CloudResource_GenesisCellsStorageWriteReceipt"
                 }
               }
             }
@@ -14737,6 +14764,16 @@
           "400": {
             "description": "Invalid encoded key"
           },
+          "402": {
+            "description": "Funded write denied; the receipt's state is final",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Hives.CloudResource_GenesisCellsStorageWriteReceipt"
+                }
+              }
+            }
+          },
           "404": {
             "description": "Owned bucket not found"
           },
@@ -14942,11 +14979,38 @@
         },
         "responses": {
           "200": {
-            "description": "Object uploaded",
+            "description": "Object uploaded (unfunded mode), or the original settled receipt without `result` for a same-key replay",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/Hives.CloudResource_GenesisCellsObjectAcknowledgement"
+                  "oneOf": [
+                    {
+                      "$ref": "#/components/schemas/Hives.CloudResource_GenesisCellsObjectAcknowledgement"
+                    },
+                    {
+                      "$ref": "#/components/schemas/Hives.CloudResource_GenesisCellsStorageWriteReceipt"
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "201": {
+            "description": "Funded write settled; the receipt carries the object acknowledgement as `result`",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Hives.CloudResource_GenesisCellsStorageWriteReceipt"
+                }
+              }
+            }
+          },
+          "202": {
+            "description": "Funded write not settled yet; replay the same Idempotency-Key to read its outcome",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Hives.CloudResource_GenesisCellsStorageWriteReceipt"
                 }
               }
             }
@@ -14954,9 +15018,22 @@
           "401": {
             "description": "Unauthorized"
           },
+          "402": {
+            "description": "Funded write denied; the receipt's state is final",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Hives.CloudResource_GenesisCellsStorageWriteReceipt"
+                }
+              }
+            }
+          },
           "404": {
             "description": "Bucket not found"
           },
+          "409": {
+            "description": "Idempotency-Key reused with a different body, or the write conflicted with admission"
+          },
           "413": {
             "description": "Payload too large"
           },
@@ -15093,11 +15170,38 @@
         },
         "responses": {
           "200": {
-            "description": "Object uploaded",
+            "description": "Object uploaded (unfunded mode), or the original settled receipt without `result` for a same-key replay",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/Hives.CloudResource_GenesisCellsObjectAcknowledgement"
+                  "oneOf": [
+                    {
+                      "$ref": "#/components/schemas/Hives.CloudResource_GenesisCellsObjectAcknowledgement"
+                    },
+                    {
+                      "$ref": "#/components/schemas/Hives.CloudResource_GenesisCellsStorageWriteReceipt"
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "201": {
+            "description": "Funded write settled; the receipt carries the object acknowledgement as `result`",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Hives.CloudResource_GenesisCellsStorageWriteReceipt"
+                }
+              }
+            }
+          },
+          "202": {
+            "description": "Funded write not settled yet; replay the same Idempotency-Key to read its outcome",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Hives.CloudResource_GenesisCellsStorageWriteReceipt"
                 }
               }
             }
@@ -15105,9 +15209,22 @@
           "401": {
             "description": "Unauthorized"
           },
+          "402": {
+            "description": "Funded write denied; the receipt's state is final",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Hives.CloudResource_GenesisCellsStorageWriteReceipt"
+                }
+              }
+            }
+          },
           "404": {
             "description": "Bucket not found"
           },
+          "409": {
+            "description": "Idempotency-Key reused with a different body, or the write conflicted with admission"
+          },
           "413": {
             "description": "Payload too large"
           },
@@ -44567,6 +44684,9 @@
           },
           "403": {
             "$ref": "#/components/responses/Minds.MindsHumanSelectionRequired"
+          },
+          "410": {
+            "$ref": "#/components/responses/Minds.MindsGone"
           }
         },
         "x-required-scope": "minds:read",
@@ -44678,6 +44798,9 @@
           },
           "403": {
             "$ref": "#/components/responses/Minds.MindsHumanSelectionRequired"
+          },
+          "410": {
+            "$ref": "#/components/responses/Minds.MindsGone"
           }
         },
         "requestBody": {
@@ -44784,6 +44907,9 @@
           },
           "403": {
             "$ref": "#/components/responses/Minds.MindsHumanSelectionRequired"
+          },
+          "410": {
+            "$ref": "#/components/responses/Minds.MindsGone"
           }
         },
         "x-required-scope": "minds:write",
@@ -44838,6 +44964,9 @@
           },
           "403": {
             "$ref": "#/components/responses/Minds.MindsHumanSelectionRequired"
+          },
+          "410": {
+            "$ref": "#/components/responses/Minds.MindsGone"
           }
         },
         "x-required-scope": "minds:read",
@@ -44887,6 +45016,9 @@
           },
           "403": {
             "$ref": "#/components/responses/Minds.MindsHumanSelectionRequired"
+          },
+          "410": {
+            "$ref": "#/components/responses/Minds.MindsGone"
           }
         },
         "requestBody": {
@@ -44963,6 +45095,9 @@
           },
           "403": {
             "$ref": "#/components/responses/Minds.MindsHumanSelectionRequired"
+          },
+          "410": {
+            "$ref": "#/components/responses/Minds.MindsGone"
           }
         },
         "x-required-scope": "minds:write",
@@ -45800,6 +45935,9 @@
           },
           "403": {
             "$ref": "#/components/responses/Minds.MindsHumanSelectionRequired"
+          },
+          "410": {
+            "$ref": "#/components/responses/Minds.MindsGone"
           }
         },
         "x-required-scope": "minds:write",
@@ -46907,7 +47045,7 @@
       "post": {
         "operationId": "minds_engineAssociativeMemoryPostAssocMhnClear",
         "summary": "associative-memory: POST /v1/assoc/mhn/clear",
-        "description": "Calls `POST /v1/assoc/mhn/clear` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `mhn:admin` on `memory:mhn`, `assoc_mem` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/assoc/mhn/clear` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `mhn:admin`, `query`, `delete` on `memory:mhn`, `assoc_mem` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -46947,7 +47085,9 @@
           "daemon_method": "POST",
           "daemon_path": "/v1/assoc/mhn/clear",
           "actions": [
-            "mhn:admin"
+            "mhn:admin",
+            "query",
+            "delete"
           ],
           "keyspaces": [
             "memory:mhn",
@@ -46987,7 +47127,7 @@
       "post": {
         "operationId": "minds_engineAssociativeMemoryPostAssocMhnConfig",
         "summary": "associative-memory: POST /v1/assoc/mhn/config",
-        "description": "Calls `POST /v1/assoc/mhn/config` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `mhn:read` on `memory:mhn`, `assoc_mem` (minds:instances:read). Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/assoc/mhn/config` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `mhn:read`, `query` on `memory:mhn`, `assoc_mem` (minds:instances:read). Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -47027,7 +47167,8 @@
           "daemon_method": "POST",
           "daemon_path": "/v1/assoc/mhn/config",
           "actions": [
-            "mhn:read"
+            "mhn:read",
+            "query"
           ],
           "keyspaces": [
             "memory:mhn",
@@ -47067,7 +47208,7 @@
       "post": {
         "operationId": "minds_engineAssociativeMemoryPostAssocMhnList",
         "summary": "associative-memory: POST /v1/assoc/mhn/list",
-        "description": "Calls `POST /v1/assoc/mhn/list` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `mhn:read` on `memory:mhn`, `assoc_mem` (minds:instances:read). Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/assoc/mhn/list` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `mhn:read`, `query` on `memory:mhn`, `assoc_mem` (minds:instances:read). Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -47107,7 +47248,8 @@
           "daemon_method": "POST",
           "daemon_path": "/v1/assoc/mhn/list",
           "actions": [
-            "mhn:read"
+            "mhn:read",
+            "query"
           ],
           "keyspaces": [
             "memory:mhn",
@@ -47147,7 +47289,7 @@
       "post": {
         "operationId": "minds_engineAssociativeMemoryPostAssocMhnNew",
         "summary": "associative-memory: POST /v1/assoc/mhn/new",
-        "description": "Calls `POST /v1/assoc/mhn/new` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `mhn:admin`, `mhn:write` on `memory:mhn`, `assoc_mem` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/assoc/mhn/new` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `mhn:admin`, `mhn:write`, `query` on `memory:mhn`, `assoc_mem` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -47188,7 +47330,8 @@
           "daemon_path": "/v1/assoc/mhn/new",
           "actions": [
             "mhn:admin",
-            "mhn:write"
+            "mhn:write",
+            "query"
           ],
           "keyspaces": [
             "memory:mhn",
@@ -47228,7 +47371,7 @@
       "post": {
         "operationId": "minds_engineAssociativeMemoryPostAssocMhnRetrieve",
         "summary": "associative-memory: POST /v1/assoc/mhn/retrieve",
-        "description": "Calls `POST /v1/assoc/mhn/retrieve` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `mhn:read` on `memory:mhn`, `assoc_mem` (minds:instances:read). Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/assoc/mhn/retrieve` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `mhn:read`, `query` on `memory:mhn`, `assoc_mem` (minds:instances:read). Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -47268,7 +47411,8 @@
           "daemon_method": "POST",
           "daemon_path": "/v1/assoc/mhn/retrieve",
           "actions": [
-            "mhn:read"
+            "mhn:read",
+            "query"
           ],
           "keyspaces": [
             "memory:mhn",
@@ -47308,7 +47452,7 @@
       "post": {
         "operationId": "minds_engineAssociativeMemoryPostAssocMhnRetrieveByKey",
         "summary": "associative-memory: POST /v1/assoc/mhn/retrieve_by_key",
-        "description": "Calls `POST /v1/assoc/mhn/retrieve_by_key` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `mhn:read` on `memory:mhn`, `assoc_mem` (minds:instances:read). Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/assoc/mhn/retrieve_by_key` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `mhn:read`, `query` on `memory:mhn`, `assoc_mem` (minds:instances:read). Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -47348,7 +47492,8 @@
           "daemon_method": "POST",
           "daemon_path": "/v1/assoc/mhn/retrieve_by_key",
           "actions": [
-            "mhn:read"
+            "mhn:read",
+            "query"
           ],
           "keyspaces": [
             "memory:mhn",
@@ -47388,7 +47533,7 @@
       "post": {
         "operationId": "minds_engineAssociativeMemoryPostAssocMhnRetrieveByVector",
         "summary": "associative-memory: POST /v1/assoc/mhn/retrieve_by_vector",
-        "description": "Calls `POST /v1/assoc/mhn/retrieve_by_vector` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `mhn:read` on `memory:mhn`, `assoc_mem` (minds:instances:read). Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/assoc/mhn/retrieve_by_vector` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `mhn:read`, `query` on `memory:mhn`, `assoc_mem` (minds:instances:read). Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -47428,7 +47573,8 @@
           "daemon_method": "POST",
           "daemon_path": "/v1/assoc/mhn/retrieve_by_vector",
           "actions": [
-            "mhn:read"
+            "mhn:read",
+            "query"
           ],
           "keyspaces": [
             "memory:mhn",
@@ -47468,7 +47614,7 @@
       "post": {
         "operationId": "minds_engineAssociativeMemoryPostAssocMhnStats",
         "summary": "associative-memory: POST /v1/assoc/mhn/stats",
-        "description": "Calls `POST /v1/assoc/mhn/stats` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `mhn:read` on `memory:mhn`, `assoc_mem` (minds:instances:read). Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/assoc/mhn/stats` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `mhn:read`, `query` on `memory:mhn`, `assoc_mem` (minds:instances:read). Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -47508,7 +47654,8 @@
           "daemon_method": "POST",
           "daemon_path": "/v1/assoc/mhn/stats",
           "actions": [
-            "mhn:read"
+            "mhn:read",
+            "query"
           ],
           "keyspaces": [
             "memory:mhn",
@@ -47548,7 +47695,7 @@
       "post": {
         "operationId": "minds_engineAssociativeMemoryPostAssocMhnStore",
         "summary": "associative-memory: POST /v1/assoc/mhn/store",
-        "description": "Calls `POST /v1/assoc/mhn/store` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `mhn:write` on `memory:mhn`, `assoc_mem` (minds:instances:update). Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/assoc/mhn/store` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `mhn:write`, `query`, `read`, `update` on `memory:mhn`, `assoc_mem` (minds:instances:update). Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -47588,7 +47735,10 @@
           "daemon_method": "POST",
           "daemon_path": "/v1/assoc/mhn/store",
           "actions": [
-            "mhn:write"
+            "mhn:write",
+            "query",
+            "read",
+            "update"
           ],
           "keyspaces": [
             "memory:mhn",
@@ -47628,7 +47778,7 @@
       "post": {
         "operationId": "minds_engineAssociativeMemoryPostAssocMhnSystemInfo",
         "summary": "associative-memory: POST /v1/assoc/mhn/system_info",
-        "description": "Calls `POST /v1/assoc/mhn/system_info` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `mhn:read` on `memory:mhn`, `assoc_mem` (minds:instances:read). Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/assoc/mhn/system_info` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `mhn:read`, `query` on `memory:mhn`, `assoc_mem` (minds:instances:read). Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -47668,7 +47818,8 @@
           "daemon_method": "POST",
           "daemon_path": "/v1/assoc/mhn/system_info",
           "actions": [
-            "mhn:read"
+            "mhn:read",
+            "query"
           ],
           "keyspaces": [
             "memory:mhn",
@@ -47708,7 +47859,7 @@
       "get": {
         "operationId": "minds_engineCognitiveCycleGetCognitiveCycles",
         "summary": "cognitive-cycle: GET /v1/cognitive/cycles",
-        "description": "Calls `GET /v1/cognitive/cycles` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `cognitive_cycle_history` (minds:instances:read). Exists only on Minds created with `enable_cognitive_cycle` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/cognitive/cycles` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `query` on `cognitive_cycle_history` (minds:instances:read). Exists only on Minds created with `enable_cognitive_cycle` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -47748,7 +47899,8 @@
           "daemon_method": "GET",
           "daemon_path": "/v1/cognitive/cycles",
           "actions": [
-            "read"
+            "read",
+            "query"
           ],
           "keyspaces": [
             "cognitive_cycle_history"
@@ -47773,7 +47925,7 @@
       "post": {
         "operationId": "minds_engineCognitiveCyclePostCognitiveCycles",
         "summary": "cognitive-cycle: POST /v1/cognitive/cycles",
-        "description": "Calls `POST /v1/cognitive/cycles` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write` on `cognitive_cycle_history` (minds:instances:update). Exists only on Minds created with `enable_cognitive_cycle` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/cognitive/cycles` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `query`, `delete` on `cognitive_cycle_history` (minds:instances:update). Exists only on Minds created with `enable_cognitive_cycle` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -47813,7 +47965,9 @@
           "daemon_method": "POST",
           "daemon_path": "/v1/cognitive/cycles",
           "actions": [
-            "write"
+            "write",
+            "query",
+            "delete"
           ],
           "keyspaces": [
             "cognitive_cycle_history"
@@ -47934,7 +48088,7 @@
       "get": {
         "operationId": "minds_engineCognitiveCycleGetCognitiveStats",
         "summary": "cognitive-cycle: GET /v1/cognitive/stats",
-        "description": "Calls `GET /v1/cognitive/stats` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `cognitive_cycle_history` (minds:instances:read). Exists only on Minds created with `enable_cognitive_cycle` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/cognitive/stats` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `query` on `cognitive_cycle_history` (minds:instances:read). Exists only on Minds created with `enable_cognitive_cycle` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -47974,7 +48128,8 @@
           "daemon_method": "GET",
           "daemon_path": "/v1/cognitive/stats",
           "actions": [
-            "read"
+            "read",
+            "query"
           ],
           "keyspaces": [
             "cognitive_cycle_history"
@@ -49233,7 +49388,7 @@
       "post": {
         "operationId": "minds_engineForgettingPostForgettingRequests",
         "summary": "forgetting: POST /v1/forgetting/requests",
-        "description": "Calls `POST /v1/forgetting/requests` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query`, `read` on `_system_forgetting_requests` (minds:instances:read). Registered on every Mind with a storage service (kv, graph, analytics, ml, inference, vector or memory) enabled. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/forgetting/requests` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query`, `read`, `write` on `_system_forgetting_requests` (minds:instances:update). Registered on every Mind with a storage service (kv, graph, analytics, ml, inference, vector or memory) enabled. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -49268,18 +49423,19 @@
             }
           }
         },
-        "x-required-scope": "minds:read",
+        "x-required-scope": "minds:write",
         "x-minds-engine": {
           "daemon_method": "POST",
           "daemon_path": "/v1/forgetting/requests",
           "actions": [
             "query",
-            "read"
+            "read",
+            "write"
           ],
           "keyspaces": [
             "_system_forgetting_requests"
           ],
-          "scope": "minds:instances:read",
+          "scope": "minds:instances:update",
           "mintable": true,
           "flag": "database(enable_kv|graph|analytics|ml|inference|vector|memory)",
           "grant": "table"
@@ -49732,7 +49888,7 @@
       "post": {
         "operationId": "minds_engineKnowledgeGraphPostGraphCypher",
         "summary": "knowledge-graph: POST /v1/graph/cypher",
-        "description": "Calls `POST /v1/graph/cypher` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/graph/cypher` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query`, `read` on `*` (minds:instances:manage). A write (`allow_updates: true`, or a CREATE, MERGE, DELETE, DETACH, SET or REMOVE clause anywhere in the query) is also minted `write` and `update`, plus `delete` for a DELETE or DETACH clause. SET, MERGE and REMOVE are not supported by the engine yet and answer 501 `MINDS_CYPHER_CLAUSE_UNSUPPORTED` (clause names it). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -49819,7 +49975,7 @@
       "post": {
         "operationId": "minds_engineKnowledgeGraphPostGraphCypherLite",
         "summary": "knowledge-graph: POST /v1/graph/cypher-lite",
-        "description": "Calls `POST /v1/graph/cypher-lite` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/graph/cypher-lite` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query`, `read` on `*` (minds:instances:manage). A write (`allow_updates: true`, which cypher-lite needs before it runs a write clause, or a CREATE, MERGE, DELETE, DETACH, SET or REMOVE clause anywhere in the query) is also minted `write` and `update`, plus `delete` for a DELETE or DETACH clause. SET, MERGE and REMOVE are not supported by the engine yet and answer 501 `MINDS_CYPHER_CLAUSE_UNSUPPORTED` (clause names it). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -49997,7 +50153,7 @@
       "post": {
         "operationId": "minds_engineKnowledgeGraphPostGraphIndexEnsureComposite",
         "summary": "knowledge-graph: POST /v1/graph/index/ensure/composite",
-        "description": "Calls `POST /v1/graph/index/ensure/composite` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/graph/index/ensure/composite` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -50039,7 +50195,8 @@
           "actions": [
             "write",
             "update",
-            "read"
+            "read",
+            "query"
           ],
           "keyspaces": [
             "*"
@@ -50088,7 +50245,7 @@
       "post": {
         "operationId": "minds_engineKnowledgeGraphPostGraphIndexEnsureProperty",
         "summary": "knowledge-graph: POST /v1/graph/index/ensure/property",
-        "description": "Calls `POST /v1/graph/index/ensure/property` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/graph/index/ensure/property` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -50130,7 +50287,8 @@
           "actions": [
             "write",
             "update",
-            "read"
+            "read",
+            "query"
           ],
           "keyspaces": [
             "*"
@@ -50176,7 +50334,7 @@
       "get": {
         "operationId": "minds_engineKnowledgeGraphGetGraphIndexStats",
         "summary": "knowledge-graph: GET /v1/graph/index/stats",
-        "description": "Calls `GET /v1/graph/index/stats` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/graph/index/stats` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -50216,7 +50374,8 @@
           "daemon_method": "GET",
           "daemon_path": "/v1/graph/index/stats",
           "actions": [
-            "read"
+            "read",
+            "query"
           ],
           "keyspaces": [
             "*"
@@ -50243,7 +50402,7 @@
       "post": {
         "operationId": "minds_engineKnowledgeGraphPostGraphMicrotheoryKeyspace",
         "summary": "knowledge-graph: POST /v1/graph/microtheory/keyspace",
-        "description": "Calls `POST /v1/graph/microtheory/keyspace` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/graph/microtheory/keyspace` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -50285,7 +50444,8 @@
           "actions": [
             "write",
             "update",
-            "read"
+            "read",
+            "query"
           ],
           "keyspaces": [
             "*"
@@ -50331,7 +50491,7 @@
       "post": {
         "operationId": "minds_engineKnowledgeGraphPostGraphMicrotheorySwitch",
         "summary": "knowledge-graph: POST /v1/graph/microtheory/switch",
-        "description": "Calls `POST /v1/graph/microtheory/switch` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/graph/microtheory/switch` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -50373,7 +50533,8 @@
           "actions": [
             "write",
             "update",
-            "read"
+            "read",
+            "query"
           ],
           "keyspaces": [
             "*"
@@ -50419,7 +50580,7 @@
       "get": {
         "operationId": "minds_engineKnowledgeGraphGetGraphSchema",
         "summary": "knowledge-graph: GET /v1/graph/schema",
-        "description": "Calls `GET /v1/graph/schema` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/graph/schema` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -50459,7 +50620,8 @@
           "daemon_method": "GET",
           "daemon_path": "/v1/graph/schema",
           "actions": [
-            "read"
+            "read",
+            "query"
           ],
           "keyspaces": [
             "*"
@@ -50582,7 +50744,7 @@
       "post": {
         "operationId": "minds_engineKnowledgeGraphPostGraphTxBegin",
         "summary": "knowledge-graph: POST /v1/graph/tx/begin",
-        "description": "Calls `POST /v1/graph/tx/begin` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/graph/tx/begin` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -50624,7 +50786,8 @@
           "actions": [
             "write",
             "update",
-            "read"
+            "read",
+            "query"
           ],
           "keyspaces": [
             "*"
@@ -50651,7 +50814,7 @@
       "post": {
         "operationId": "minds_engineKnowledgeGraphPostGraphTxCommit",
         "summary": "knowledge-graph: POST /v1/graph/tx/commit",
-        "description": "Calls `POST /v1/graph/tx/commit` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/graph/tx/commit` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -50693,7 +50856,8 @@
           "actions": [
             "write",
             "update",
-            "read"
+            "read",
+            "query"
           ],
           "keyspaces": [
             "*"
@@ -50739,7 +50903,7 @@
       "post": {
         "operationId": "minds_engineKnowledgeGraphPostGraphTxRollback",
         "summary": "knowledge-graph: POST /v1/graph/tx/rollback",
-        "description": "Calls `POST /v1/graph/tx/rollback` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/graph/tx/rollback` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -50781,7 +50945,8 @@
           "actions": [
             "write",
             "update",
-            "read"
+            "read",
+            "query"
           ],
           "keyspaces": [
             "*"
@@ -51817,7 +51982,7 @@
       "get": {
         "operationId": "minds_engineLineageGetLineageNodesId",
         "summary": "lineage: GET /v1/lineage/nodes/:id",
-        "description": "Calls `GET /v1/lineage/nodes/:id` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/lineage/nodes/:id` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -51866,7 +52031,8 @@
           "daemon_method": "GET",
           "daemon_path": "/v1/lineage/nodes/:id",
           "actions": [
-            "read"
+            "read",
+            "query"
           ],
           "keyspaces": [
             "*"
@@ -51893,7 +52059,7 @@
       "get": {
         "operationId": "minds_engineLineageGetLineageStats",
         "summary": "lineage: GET /v1/lineage/stats",
-        "description": "Calls `GET /v1/lineage/stats` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/lineage/stats` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -51933,7 +52099,8 @@
           "daemon_method": "GET",
           "daemon_path": "/v1/lineage/stats",
           "actions": [
-            "read"
+            "read",
+            "query"
           ],
           "keyspaces": [
             "*"
@@ -53458,7 +53625,7 @@
       "post": {
         "operationId": "minds_engineProceduralMemoryPostMemoryProceduresDelete",
         "summary": "procedural-memory: POST /v1/memory/procedures/delete",
-        "description": "Calls `POST /v1/memory/procedures/delete` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `delete` on `memory:procedural` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/memory/procedures/delete` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `delete`, `read`, `query` on `memory:procedural` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -53498,7 +53665,9 @@
           "daemon_method": "POST",
           "daemon_path": "/v1/memory/procedures/delete",
           "actions": [
-            "delete"
+            "delete",
+            "read",
+            "query"
           ],
           "keyspaces": [
             "memory:procedural"
@@ -53544,7 +53713,7 @@
       "post": {
         "operationId": "minds_engineProceduralMemoryPostMemoryProceduresGet",
         "summary": "procedural-memory: POST /v1/memory/procedures/get",
-        "description": "Calls `POST /v1/memory/procedures/get` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `memory:procedural` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/memory/procedures/get` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `query` on `memory:procedural` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -53584,7 +53753,8 @@
           "daemon_method": "POST",
           "daemon_path": "/v1/memory/procedures/get",
           "actions": [
-            "read"
+            "read",
+            "query"
           ],
           "keyspaces": [
             "memory:procedural"
@@ -53698,7 +53868,7 @@
       "post": {
         "operationId": "minds_engineProceduralMemoryPostMemoryProceduresSearch",
         "summary": "procedural-memory: POST /v1/memory/procedures/search",
-        "description": "Calls `POST /v1/memory/procedures/search` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query` on `memory:procedural` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/memory/procedures/search` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query`, `read` on `memory:procedural` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -53738,7 +53908,8 @@
           "daemon_method": "POST",
           "daemon_path": "/v1/memory/procedures/search",
           "actions": [
-            "query"
+            "query",
+            "read"
           ],
           "keyspaces": [
             "memory:procedural"
@@ -53784,7 +53955,7 @@
       "post": {
         "operationId": "minds_engineProceduralMemoryPostMemoryProceduresUpdate",
         "summary": "procedural-memory: POST /v1/memory/procedures/update",
-        "description": "Calls `POST /v1/memory/procedures/update` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `update` on `memory:procedural` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/memory/procedures/update` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `update`, `query` on `memory:procedural` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -53825,7 +53996,8 @@
           "daemon_path": "/v1/memory/procedures/update",
           "actions": [
             "read",
-            "update"
+            "update",
+            "query"
           ],
           "keyspaces": [
             "memory:procedural"
@@ -54952,7 +55124,7 @@
       "post": {
         "operationId": "minds_engineVaultPostMemoryVault",
         "summary": "vault: POST /v1/memory/vault",
-        "description": "Calls `POST /v1/memory/vault` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write` on `memory:vault` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/memory/vault` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `read`, `update` on `memory:vault` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -54992,7 +55164,9 @@
           "daemon_method": "POST",
           "daemon_path": "/v1/memory/vault",
           "actions": [
-            "write"
+            "write",
+            "read",
+            "update"
           ],
           "keyspaces": [
             "memory:vault"
@@ -55127,7 +55301,7 @@
       "post": {
         "operationId": "minds_engineVaultPostMemoryVaultDelete",
         "summary": "vault: POST /v1/memory/vault/delete",
-        "description": "Calls `POST /v1/memory/vault/delete` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `delete` on `memory:vault` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/memory/vault/delete` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `delete`, `read`, `write`, `update` on `memory:vault` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -55167,7 +55341,10 @@
           "daemon_method": "POST",
           "daemon_path": "/v1/memory/vault/delete",
           "actions": [
-            "delete"
+            "delete",
+            "read",
+            "write",
+            "update"
           ],
           "keyspaces": [
             "memory:vault"
@@ -55213,7 +55390,7 @@
       "post": {
         "operationId": "minds_engineVaultPostMemoryVaultGet",
         "summary": "vault: POST /v1/memory/vault/get",
-        "description": "Calls `POST /v1/memory/vault/get` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `memory:vault` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/memory/vault/get` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `write`, `update` on `memory:vault` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -55248,17 +55425,19 @@
             }
           }
         },
-        "x-required-scope": "minds:read",
+        "x-required-scope": "minds:write",
         "x-minds-engine": {
           "daemon_method": "POST",
           "daemon_path": "/v1/memory/vault/get",
           "actions": [
-            "read"
+            "read",
+            "write",
+            "update"
           ],
           "keyspaces": [
             "memory:vault"
           ],
-          "scope": "minds:instances:read",
+          "scope": "minds:instances:update",
           "mintable": true,
           "flag": "enable_memory",
           "grant": "table"
@@ -55299,7 +55478,7 @@
       "post": {
         "operationId": "minds_engineVaultPostMemoryVaultSearch",
         "summary": "vault: POST /v1/memory/vault/search",
-        "description": "Calls `POST /v1/memory/vault/search` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query` on `memory:vault` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/memory/vault/search` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query`, `read`, `write` on `memory:vault` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -55334,17 +55513,19 @@
             }
           }
         },
-        "x-required-scope": "minds:read",
+        "x-required-scope": "minds:write",
         "x-minds-engine": {
           "daemon_method": "POST",
           "daemon_path": "/v1/memory/vault/search",
           "actions": [
-            "query"
+            "query",
+            "read",
+            "write"
           ],
           "keyspaces": [
             "memory:vault"
           ],
-          "scope": "minds:instances:read",
+          "scope": "minds:instances:update",
           "mintable": true,
           "flag": "enable_memory",
           "grant": "table"
@@ -55453,7 +55634,7 @@
       "post": {
         "operationId": "minds_engineVaultPostMemoryVaultUpdate",
         "summary": "vault: POST /v1/memory/vault/update",
-        "description": "Calls `POST /v1/memory/vault/update` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `update` on `memory:vault` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/memory/vault/update` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `update`, `read`, `write` on `memory:vault` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -55493,7 +55674,9 @@
           "daemon_method": "POST",
           "daemon_path": "/v1/memory/vault/update",
           "actions": [
-            "update"
+            "update",
+            "read",
+            "write"
           ],
           "keyspaces": [
             "memory:vault"
@@ -55539,7 +55722,7 @@
       "post": {
         "operationId": "minds_engineMachineLearningPostMlEmbed",
         "summary": "machine-learning: POST /v1/ml/embed",
-        "description": "Calls `POST /v1/ml/embed` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/ml/embed` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -55579,7 +55762,8 @@
           "daemon_method": "POST",
           "daemon_path": "/v1/ml/embed",
           "actions": [
-            "read"
+            "read",
+            "query"
           ],
           "keyspaces": [
             "*"
@@ -55629,7 +55813,7 @@
       "post": {
         "operationId": "minds_engineMachineLearningPostMlGenerate",
         "summary": "machine-learning: POST /v1/ml/generate",
-        "description": "Calls `POST /v1/ml/generate` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/ml/generate` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -55669,7 +55853,8 @@
           "daemon_method": "POST",
           "daemon_path": "/v1/ml/generate",
           "actions": [
-            "read"
+            "read",
+            "query"
           ],
           "keyspaces": [
             "*"
@@ -55721,7 +55906,7 @@
       "post": {
         "operationId": "minds_engineMachineLearningPostMlMetrics",
         "summary": "machine-learning: POST /v1/ml/metrics",
-        "description": "Calls `POST /v1/ml/metrics` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/ml/metrics` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -55761,7 +55946,8 @@
           "daemon_method": "POST",
           "daemon_path": "/v1/ml/metrics",
           "actions": [
-            "read"
+            "read",
+            "query"
           ],
           "keyspaces": [
             "*"
@@ -55807,7 +55993,7 @@
       "get": {
         "operationId": "minds_engineMachineLearningGetMlModels",
         "summary": "machine-learning: GET /v1/ml/models",
-        "description": "Calls `GET /v1/ml/models` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/ml/models` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -55847,7 +56033,8 @@
           "daemon_method": "GET",
           "daemon_path": "/v1/ml/models",
           "actions": [
-            "read"
+            "read",
+            "query"
           ],
           "keyspaces": [
             "*"
@@ -55874,7 +56061,7 @@
       "post": {
         "operationId": "minds_engineMachineLearningPostMlModelsLoad",
         "summary": "machine-learning: POST /v1/ml/models/load",
-        "description": "Calls `POST /v1/ml/models/load` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/ml/models/load` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -55914,7 +56101,9 @@
           "daemon_method": "POST",
           "daemon_path": "/v1/ml/models/load",
           "actions": [
-            "write"
+            "write",
+            "read",
+            "query"
           ],
           "keyspaces": [
             "*"
@@ -55970,7 +56159,7 @@
       "post": {
         "operationId": "minds_engineMachineLearningPostMlModelsUnload",
         "summary": "machine-learning: POST /v1/ml/models/unload",
-        "description": "Calls `POST /v1/ml/models/unload` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `delete` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/ml/models/unload` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `delete`, `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -56010,7 +56199,9 @@
           "daemon_method": "POST",
           "daemon_path": "/v1/ml/models/unload",
           "actions": [
-            "delete"
+            "delete",
+            "read",
+            "query"
           ],
           "keyspaces": [
             "*"
@@ -56056,7 +56247,7 @@
       "post": {
         "operationId": "minds_engineMachineLearningPostMlTokenizersLoad",
         "summary": "machine-learning: POST /v1/ml/tokenizers/load",
-        "description": "Calls `POST /v1/ml/tokenizers/load` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/ml/tokenizers/load` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -56096,7 +56287,8 @@
           "daemon_method": "POST",
           "daemon_path": "/v1/ml/tokenizers/load",
           "actions": [
-            "read"
+            "read",
+            "query"
           ],
           "keyspaces": [
             "*"
@@ -56142,7 +56334,7 @@
       "post": {
         "operationId": "minds_engineMachineLearningPostMlTrainHrm",
         "summary": "machine-learning: POST /v1/ml/train/hrm",
-        "description": "Calls `POST /v1/ml/train/hrm` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/ml/train/hrm` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -56182,7 +56374,8 @@
           "daemon_method": "POST",
           "daemon_path": "/v1/ml/train/hrm",
           "actions": [
-            "read"
+            "read",
+            "query"
           ],
           "keyspaces": [
             "*"
@@ -56249,7 +56442,7 @@
       "post": {
         "operationId": "minds_engineMachineLearningPostMlTrainSupervised",
         "summary": "machine-learning: POST /v1/ml/train/supervised",
-        "description": "Calls `POST /v1/ml/train/supervised` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/ml/train/supervised` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -56289,7 +56482,8 @@
           "daemon_method": "POST",
           "daemon_path": "/v1/ml/train/supervised",
           "actions": [
-            "read"
+            "read",
+            "query"
           ],
           "keyspaces": [
             "*"
@@ -56353,7 +56547,7 @@
       "get": {
         "operationId": "minds_engineVectorsGetMlVector",
         "summary": "vectors: GET /v1/ml/vector",
-        "description": "Calls `GET /v1/ml/vector` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_vector` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/ml/vector` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_vector` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -56393,7 +56587,8 @@
           "daemon_method": "GET",
           "daemon_path": "/v1/ml/vector",
           "actions": [
-            "read"
+            "read",
+            "query"
           ],
           "keyspaces": [
             "*"
@@ -56420,7 +56615,7 @@
       "post": {
         "operationId": "minds_engineVectorsPostMlVectorAdd",
         "summary": "vectors: POST /v1/ml/vector/add",
-        "description": "Calls `POST /v1/ml/vector/add` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_vector` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/ml/vector/add` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_vector` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -56462,7 +56657,8 @@
           "actions": [
             "write",
             "update",
-            "read"
+            "read",
+            "query"
           ],
           "keyspaces": [
             "*"
@@ -56519,7 +56715,7 @@
       "post": {
         "operationId": "minds_engineVectorsPostMlVectorCreate",
         "summary": "vectors: POST /v1/ml/vector/create",
-        "description": "Calls `POST /v1/ml/vector/create` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_vector` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/ml/vector/create` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_vector` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -56561,7 +56757,8 @@
           "actions": [
             "write",
             "update",
-            "read"
+            "read",
+            "query"
           ],
           "keyspaces": [
             "*"
@@ -56615,7 +56812,7 @@
       "post": {
         "operationId": "minds_engineVectorsPostMlVectorSave",
         "summary": "vectors: POST /v1/ml/vector/save",
-        "description": "Calls `POST /v1/ml/vector/save` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_vector` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/ml/vector/save` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_vector` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -56657,7 +56854,8 @@
           "actions": [
             "write",
             "update",
-            "read"
+            "read",
+            "query"
           ],
           "keyspaces": [
             "*"
@@ -58314,7 +58512,7 @@
       "post": {
         "operationId": "minds_engineSpikingNetworksPostSnnNetworkBuild",
         "summary": "spiking-networks: POST /v1/snn/network/build",
-        "description": "Calls `POST /v1/snn/network/build` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `snn:admin`, `snn:write` on `memory:snn`, `snn_networks`, `snn_compiled`, `snn_runs` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_snn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/snn/network/build` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `snn:admin`, `snn:write`, `snn:query` on `memory:snn`, `snn_networks`, `snn_compiled`, `snn_runs` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_snn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -58355,7 +58553,8 @@
           "daemon_path": "/v1/snn/network/build",
           "actions": [
             "snn:admin",
-            "snn:write"
+            "snn:write",
+            "snn:query"
           ],
           "keyspaces": [
             "memory:snn",
@@ -58480,7 +58679,7 @@
       "post": {
         "operationId": "minds_engineSpikingNetworksPostSnnNetworkState",
         "summary": "spiking-networks: POST /v1/snn/network/state",
-        "description": "Calls `POST /v1/snn/network/state` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `snn:read` on `memory:snn`, `snn_networks`, `snn_compiled`, `snn_runs` (minds:instances:read). Exists only on Minds created with `enable_snn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/snn/network/state` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `snn:read`, `snn:query` on `memory:snn`, `snn_networks`, `snn_compiled`, `snn_runs` (minds:instances:read). Exists only on Minds created with `enable_snn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -58520,7 +58719,8 @@
           "daemon_method": "POST",
           "daemon_path": "/v1/snn/network/state",
           "actions": [
-            "snn:read"
+            "snn:read",
+            "snn:query"
           ],
           "keyspaces": [
             "memory:snn",
@@ -74186,6 +74386,71 @@
         "x-mcp": true
       }
     },
+    "/v1/auto/mcp": {
+      "post": {
+        "operationId": "auto_callMcp",
+        "summary": "Send one MCP JSON-RPC message to Auto",
+        "description": "Auto's own MCP server (streamable HTTP, stateless): one JSON-RPC 2.0 message per request, one JSON-RPC response back. Methods: `initialize`, `ping`, `tools/list`, `tools/call`, `resources/list` and `resources/read` (the approval card, `ui://auto/approval-card.html`). Notifications (no `id`, e.g. `notifications/initialized`) answer 202 with no body. Batches (a JSON array) are refused with 400 (Auto's code `batch_unsupported`; the gateway answers it as `BATCH_UNSUPPORTED`). Scope `auto:read` to reach the endpoint; `tools/list` lists only the tools your scopes allow, and each tool checks its own scope (`auto:read` or `auto:write`): a call without it is a result with `isError: true` (\"Requires scope auto:write\"). Tool errors (invalid input, not found, conflict) are results with `isError: true` as well; an unknown tool or method is a JSON-RPC error (`-32602`, `-32601`). `auto_decide_approval` is app-only: only the mandate approver may decide, from the approval card. Each tool mirrors a REST operation (`auto_list_orgs` is `listOrgs`, `auto_propose_action` is `proposeAction`). Protocol version `2025-06-18`.",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/Auto.McpRequest"
+              },
+              "example": {
+                "jsonrpc": "2.0",
+                "id": 1,
+                "method": "tools/call",
+                "params": {
+                  "name": "auto_list_orgs",
+                  "arguments": {}
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "The JSON-RPC response, a result or a JSON-RPC error",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Auto.McpResponse"
+                }
+              }
+            }
+          },
+          "202": {
+            "description": "A notification was accepted; no body"
+          },
+          "400": {
+            "description": "A batch (`batch_unsupported` from Auto, `BATCH_UNSUPPORTED` through the gateway) or a body that is not JSON",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Auto.AutoError"
+                }
+              }
+            }
+          },
+          "403": {
+            "$ref": "#/components/responses/Auto.Forbidden"
+          }
+        },
+        "tags": [
+          "auto"
+        ],
+        "x-genesis-service": "auto",
+        "x-upstream": {
+          "base": "https://auto-808958844152.us-central1.run.app",
+          "method": "POST",
+          "path": "/v1/mcp",
+          "status": "unverified"
+        },
+        "x-mcp": true
+      }
+    },
     "/v1/scopes/whoami": {
       "get": {
         "operationId": "scopes_whoami",
@@ -95561,6 +95826,654 @@
         "x-mcp": false
       }
     },
+    "/v1/boxes/mail/agents": {
+      "get": {
+        "operationId": "boxes_mail_agents_list",
+        "summary": "List the project's agent mailboxes",
+        "description": "Every active agent mailbox in the key's project tenant, One first. One's mailbox is provided by default and is created here if it does not exist yet, even under boxes:read. Org API keys only; a signed-in session gets 404 on every agent mailbox route. Needs boxes:read.",
+        "responses": {
+          "200": {
+            "description": "Agent mailboxes",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "success": {
+                      "type": "boolean"
+                    },
+                    "data": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/components/schemas/Boxes.MailAgentMailbox"
+                      }
+                    }
+                  },
+                  "required": [
+                    "success",
+                    "data"
+                  ]
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Missing or invalid authentication"
+          },
+          "403": {
+            "description": "Missing boxes:read"
+          }
+        },
+        "tags": [
+          "boxes"
+        ],
+        "x-genesis-service": "boxes",
+        "x-upstream": {
+          "base": "https://api.boxes.sh",
+          "method": "GET",
+          "path": "/v1/mail/agents",
+          "status": "not_deployed"
+        },
+        "x-mcp": true
+      },
+      "post": {
+        "operationId": "boxes_mail_agents_create",
+        "summary": "Create an agent's mailbox",
+        "description": "Gives an agent identity a mailbox in the key's project tenant. agentId is \"one\" or an OpenAgentID a_<ULID>. It is idempotent; an existing mailbox answers 200, a new or restored one 201. A deleted mailbox comes back with its mail and address. The address is assigned by Boxes on the first-party domain. A project holds at most 500 active agent mailboxes (One not counted), checked on create and on restore. Agent mailboxes are metered per agent-month (boxes.agent_mailbox_months). Needs boxes:write.",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/Boxes.MailAgentCreateRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "The agent already has a mailbox",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Boxes.MailAgentMailboxResponse"
+                }
+              }
+            }
+          },
+          "201": {
+            "description": "Mailbox created or restored",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Boxes.MailAgentMailboxResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Malformed body or agentId"
+          },
+          "401": {
+            "description": "Missing or invalid authentication"
+          },
+          "403": {
+            "description": "Missing boxes:write"
+          },
+          "409": {
+            "description": "ADDRESS_CONFLICT (the address is already reserved) or AGENT_MAILBOX_LIMIT (the project already has 500 active agent mailboxes; One is not counted)"
+          }
+        },
+        "tags": [
+          "boxes"
+        ],
+        "x-genesis-service": "boxes",
+        "x-upstream": {
+          "base": "https://api.boxes.sh",
+          "method": "POST",
+          "path": "/v1/mail/agents",
+          "status": "not_deployed"
+        },
+        "x-mcp": true
+      }
+    },
+    "/v1/boxes/mail/agents/{agentId}": {
+      "get": {
+        "operationId": "boxes_mail_agents_get",
+        "summary": "Get an agent's mailbox",
+        "description": "Needs boxes:read. For \"one\" the default mailbox is created if missing, so it never answers 404.",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/Boxes.AgentId"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Agent mailbox",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Boxes.MailAgentMailboxResponse"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Missing or invalid authentication"
+          },
+          "404": {
+            "description": "The agent has no active mailbox in this project"
+          }
+        },
+        "tags": [
+          "boxes"
+        ],
+        "x-genesis-service": "boxes",
+        "x-upstream": {
+          "base": "https://api.boxes.sh",
+          "method": "GET",
+          "path": "/v1/mail/agents/{agentId}",
+          "status": "not_deployed"
+        },
+        "x-mcp": true
+      },
+      "delete": {
+        "operationId": "boxes_mail_agents_delete",
+        "summary": "Delete an agent's mailbox",
+        "description": "Stops the agent's mailbox. Its mail and address are kept, and creating it again restores it. One's default mailbox cannot be deleted (409 DEFAULT_AGENT_MAILBOX). Needs boxes:write.",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/Boxes.AgentId"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Mailbox deleted (status deleted)",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Boxes.MailAgentMailboxResponse"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Missing or invalid authentication"
+          },
+          "404": {
+            "description": "The agent has no active mailbox in this project"
+          },
+          "409": {
+            "description": "One's default mailbox cannot be deleted"
+          }
+        },
+        "tags": [
+          "boxes"
+        ],
+        "x-genesis-service": "boxes",
+        "x-upstream": {
+          "base": "https://api.boxes.sh",
+          "method": "DELETE",
+          "path": "/v1/mail/agents/{agentId}",
+          "status": "not_deployed"
+        },
+        "x-mcp": true
+      }
+    },
+    "/v1/boxes/mail/agents/{agentId}/inbox": {
+      "get": {
+        "operationId": "boxes_mail_agents_inbox_list",
+        "summary": "As the agent, list messages in a folder",
+        "description": "Messages in a folder of the agent's own mailbox, newest first. Needs boxes:read.",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/Boxes.AgentId"
+          },
+          {
+            "name": "folder",
+            "in": "query",
+            "schema": {
+              "type": "string",
+              "default": "inbox"
+            },
+            "required": false,
+            "description": "Folder name; defaults to inbox"
+          },
+          {
+            "name": "page",
+            "in": "query",
+            "schema": {
+              "type": "integer",
+              "format": "int64",
+              "minimum": 1,
+              "default": 1
+            },
+            "required": false
+          },
+          {
+            "name": "limit",
+            "in": "query",
+            "schema": {
+              "type": "integer",
+              "format": "int64",
+              "minimum": 1,
+              "maximum": 100,
+              "default": 20
+            },
+            "required": false,
+            "description": "Values outside 1-100 are clamped"
+          },
+          {
+            "name": "unreadOnly",
+            "in": "query",
+            "schema": {
+              "type": "boolean"
+            },
+            "required": false,
+            "description": "Only unread messages"
+          },
+          {
+            "name": "starred",
+            "in": "query",
+            "schema": {
+              "type": "boolean"
+            },
+            "required": false,
+            "description": "Only starred messages"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Messages page",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "success": {
+                      "type": "boolean"
+                    },
+                    "data": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/components/schemas/Boxes.MailMessage"
+                      }
+                    },
+                    "meta": {
+                      "$ref": "#/components/schemas/Boxes.MailListMeta"
+                    }
+                  },
+                  "required": [
+                    "success",
+                    "data"
+                  ]
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Malformed JSON body or query parameters"
+          },
+          "401": {
+            "description": "Missing or invalid authentication"
+          },
+          "403": {
+            "description": "Missing scope"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        },
+        "tags": [
+          "boxes"
+        ],
+        "x-genesis-service": "boxes",
+        "x-upstream": {
+          "base": "https://api.boxes.sh",
+          "method": "GET",
+          "path": "/v1/mail/agents/{agentId}/inbox",
+          "status": "not_deployed"
+        },
+        "x-mcp": true
+      }
+    },
+    "/v1/boxes/mail/agents/{agentId}/send": {
+      "post": {
+        "operationId": "boxes_mail_agents_send",
+        "summary": "As the agent, send an email or save a draft",
+        "description": "Sends from the agent's own mailbox (or saves a draft with isDraft). Needs boxes:write. At least one of bodyPlain or bodyHtml is required. Mail leaving the organization is checked with Auto as the org API key, not as the agent. Idempotency-Key, if given, must be a UUID (422 otherwise); a replay of the same key returns 200 with the original message.",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/Boxes.AgentId"
+          },
+          {
+            "$ref": "#/components/parameters/Boxes.IdempotencyKey"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/Boxes.MailSendRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Idempotent replay of an earlier send",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "success": {
+                      "type": "boolean"
+                    },
+                    "data": {
+                      "$ref": "#/components/schemas/Boxes.MailMessage"
+                    }
+                  },
+                  "required": [
+                    "success",
+                    "data"
+                  ]
+                }
+              }
+            },
+            "headers": {
+              "Idempotency-Key": {
+                "description": "The request idempotency key (the supplied UUID, or the generated one) under the Resend transport.",
+                "schema": {
+                  "type": "string",
+                  "format": "uuid"
+                }
+              }
+            }
+          },
+          "201": {
+            "description": "Message created",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "success": {
+                      "type": "boolean"
+                    },
+                    "data": {
+                      "$ref": "#/components/schemas/Boxes.MailMessage"
+                    }
+                  },
+                  "required": [
+                    "success",
+                    "data"
+                  ]
+                }
+              }
+            },
+            "headers": {
+              "Idempotency-Key": {
+                "description": "The request idempotency key (the supplied UUID, or the generated one) under the Resend transport.",
+                "schema": {
+                  "type": "string",
+                  "format": "uuid"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Malformed JSON body or query parameters"
+          },
+          "401": {
+            "description": "Missing or invalid authentication"
+          },
+          "403": {
+            "description": "Forbidden"
+          },
+          "404": {
+            "description": "Not found"
+          },
+          "422": {
+            "description": "Validation error"
+          },
+          "429": {
+            "description": "Rate limited"
+          }
+        },
+        "tags": [
+          "boxes"
+        ],
+        "x-genesis-service": "boxes",
+        "x-upstream": {
+          "base": "https://api.boxes.sh",
+          "method": "POST",
+          "path": "/v1/mail/agents/{agentId}/send",
+          "status": "not_deployed"
+        },
+        "x-mcp": true
+      }
+    },
+    "/v1/boxes/mail/agents/{agentId}/threads": {
+      "get": {
+        "operationId": "boxes_mail_agents_threads_list",
+        "summary": "As the agent, list conversation threads",
+        "description": "Threads of the agent's own mailbox, newest activity first. Needs boxes:read.",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/Boxes.AgentId"
+          },
+          {
+            "name": "page",
+            "in": "query",
+            "schema": {
+              "type": "integer",
+              "format": "int64",
+              "minimum": 1,
+              "default": 1
+            },
+            "required": false
+          },
+          {
+            "name": "limit",
+            "in": "query",
+            "schema": {
+              "type": "integer",
+              "format": "int64",
+              "minimum": 1,
+              "maximum": 100,
+              "default": 20
+            },
+            "required": false,
+            "description": "Values outside 1-100 are clamped"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Threads page",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "success": {
+                      "type": "boolean"
+                    },
+                    "data": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/components/schemas/Boxes.MailThread"
+                      }
+                    },
+                    "meta": {
+                      "$ref": "#/components/schemas/Boxes.MailListMeta"
+                    }
+                  },
+                  "required": [
+                    "success",
+                    "data"
+                  ]
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Malformed JSON body or query parameters"
+          },
+          "401": {
+            "description": "Missing or invalid authentication"
+          },
+          "403": {
+            "description": "Missing scope"
+          },
+          "404": {
+            "description": "The agent has no active mailbox in this project"
+          }
+        },
+        "tags": [
+          "boxes"
+        ],
+        "x-genesis-service": "boxes",
+        "x-upstream": {
+          "base": "https://api.boxes.sh",
+          "method": "GET",
+          "path": "/v1/mail/agents/{agentId}/threads",
+          "status": "not_deployed"
+        },
+        "x-mcp": true
+      }
+    },
+    "/v1/boxes/mail/agents/{agentId}/threads/{id}": {
+      "get": {
+        "operationId": "boxes_mail_agents_threads_get",
+        "summary": "As the agent, get a thread with all its messages",
+        "description": "A thread of the agent's own mailbox. Needs boxes:read.",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/Boxes.AgentId"
+          },
+          {
+            "name": "id",
+            "in": "path",
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            },
+            "required": true
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Thread detail",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "success": {
+                      "type": "boolean"
+                    },
+                    "data": {
+                      "$ref": "#/components/schemas/Boxes.MailThreadDetail"
+                    }
+                  },
+                  "required": [
+                    "success",
+                    "data"
+                  ]
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Missing or invalid authentication"
+          },
+          "403": {
+            "description": "Missing scope"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        },
+        "tags": [
+          "boxes"
+        ],
+        "x-genesis-service": "boxes",
+        "x-upstream": {
+          "base": "https://api.boxes.sh",
+          "method": "GET",
+          "path": "/v1/mail/agents/{agentId}/threads/{id}",
+          "status": "not_deployed"
+        },
+        "x-mcp": true
+      }
+    },
+    "/v1/boxes/mail/agents/{agentId}/messages/{id}": {
+      "get": {
+        "operationId": "boxes_mail_agents_messages_get",
+        "summary": "As the agent, get a message with its labels",
+        "description": "A message of the agent's own mailbox. Needs boxes:read.",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/Boxes.AgentId"
+          },
+          {
+            "name": "id",
+            "in": "path",
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            },
+            "required": true
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Message and labels",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "success": {
+                      "type": "boolean"
+                    },
+                    "data": {
+                      "$ref": "#/components/schemas/Boxes.MailMessageWithLabels"
+                    }
+                  },
+                  "required": [
+                    "success",
+                    "data"
+                  ]
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Missing or invalid authentication"
+          },
+          "403": {
+            "description": "Missing scope"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        },
+        "tags": [
+          "boxes"
+        ],
+        "x-genesis-service": "boxes",
+        "x-upstream": {
+          "base": "https://api.boxes.sh",
+          "method": "GET",
+          "path": "/v1/mail/agents/{agentId}/messages/{id}",
+          "status": "not_deployed"
+        },
+        "x-mcp": true
+      }
+    },
     "/v1/brews/create": {
       "post": {
         "operationId": "brews_createBrew",
@@ -104302,6 +105215,72 @@
           }
         }
       },
+      "Hives.CloudResource_GenesisCellsStorageWriteReceipt": {
+        "type": "object",
+        "description": "The funded storage write operation receipt. A settled first write (201) carries the object acknowledgement as `result`; a same-key replay (200) returns the original receipt without `result`; a write that is not settled yet (202) names its operation_id.",
+        "required": [
+          "object",
+          "operation_id",
+          "state"
+        ],
+        "properties": {
+          "object": {
+            "type": "string",
+            "enum": [
+              "storage_write_operation"
+            ]
+          },
+          "operation_id": {
+            "type": "string",
+            "pattern": "^fop_[0-9a-f]{32}$"
+          },
+          "state": {
+            "type": "string"
+          },
+          "code": {
+            "type": "string"
+          },
+          "funding_source": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "reservation_id": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "native_meter": {
+            "type": "string"
+          },
+          "quantity_base": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "upper_bound_quantity_base": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "retry_send": {
+            "type": "boolean"
+          },
+          "storage_operation_id": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "result": {
+            "$ref": "#/components/schemas/Hives.CloudResource_GenesisCellsObjectAcknowledgement"
+          }
+        }
+      },
       "Hives.CloudResource_GenesisCellsObjectAcknowledgement": {
         "type": "object",
         "required": [
@@ -131521,6 +132500,86 @@
           }
         }
       },
+      "Auto.McpRequest": {
+        "type": "object",
+        "description": "One JSON-RPC 2.0 message. Omit `id` for a notification.",
+        "required": [
+          "jsonrpc",
+          "method"
+        ],
+        "properties": {
+          "jsonrpc": {
+            "type": "string",
+            "enum": [
+              "2.0"
+            ]
+          },
+          "id": {
+            "type": [
+              "string",
+              "integer"
+            ]
+          },
+          "method": {
+            "type": "string",
+            "examples": [
+              "initialize",
+              "ping",
+              "tools/list",
+              "tools/call",
+              "resources/list",
+              "resources/read"
+            ]
+          },
+          "params": {
+            "type": "object",
+            "additionalProperties": true,
+            "description": "For `tools/call`, `{name, arguments}`; for `resources/read`, `{uri}`."
+          }
+        }
+      },
+      "Auto.McpResponse": {
+        "type": "object",
+        "description": "A JSON-RPC 2.0 response: `result` (for `tools/call`, `{content, structuredContent?, isError?, _meta?}`; for `tools/list`, `{tools}`) or `error` (`{code, message}`).",
+        "required": [
+          "jsonrpc"
+        ],
+        "properties": {
+          "jsonrpc": {
+            "type": "string",
+            "enum": [
+              "2.0"
+            ]
+          },
+          "id": {
+            "type": [
+              "string",
+              "integer",
+              "null"
+            ],
+            "description": "The request's id; absent when a known method was sent without one."
+          },
+          "result": {
+            "type": "object",
+            "additionalProperties": true
+          },
+          "error": {
+            "type": "object",
+            "required": [
+              "code",
+              "message"
+            ],
+            "properties": {
+              "code": {
+                "type": "integer"
+              },
+              "message": {
+                "type": "string"
+              }
+            }
+          }
+        }
+      },
       "Auto.AutoError": {
         "type": "object",
         "required": [
@@ -144013,6 +145072,88 @@
           "updatedAt"
         ]
       },
+      "Boxes.MailAgentCreateRequest": {
+        "type": "object",
+        "additionalProperties": false,
+        "properties": {
+          "agentId": {
+            "type": "string",
+            "pattern": "^(one|a_[0-7][0-9A-HJKMNP-TV-Z]{25})$",
+            "description": "\"one\" or an OpenAgentID a_<ULID>"
+          },
+          "displayName": {
+            "type": "string",
+            "maxLength": 80,
+            "description": "Shown as the sender name; defaults to \"One\" or \"Agent\""
+          }
+        },
+        "required": [
+          "agentId"
+        ]
+      },
+      "Boxes.MailAgentMailbox": {
+        "type": "object",
+        "properties": {
+          "agentId": {
+            "type": "string"
+          },
+          "agentDid": {
+            "type": "string",
+            "description": "did:oas:one:agent:one for One, did:oas:oneos:agent:<ulid> for an OpenAgentID"
+          },
+          "default": {
+            "type": "boolean",
+            "description": "True for One's default mailbox"
+          },
+          "displayName": {
+            "type": "string"
+          },
+          "mailboxId": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "address": {
+            "type": "string",
+            "description": "The mailbox's primary address"
+          },
+          "status": {
+            "type": "string",
+            "enum": [
+              "active",
+              "deleted"
+            ]
+          },
+          "createdAt": {
+            "type": "string",
+            "format": "date-time"
+          }
+        },
+        "required": [
+          "agentId",
+          "agentDid",
+          "default",
+          "displayName",
+          "mailboxId",
+          "address",
+          "status",
+          "createdAt"
+        ]
+      },
+      "Boxes.MailAgentMailboxResponse": {
+        "type": "object",
+        "properties": {
+          "success": {
+            "type": "boolean"
+          },
+          "data": {
+            "$ref": "#/components/schemas/Boxes.MailAgentMailbox"
+          }
+        },
+        "required": [
+          "success",
+          "data"
+        ]
+      },
       "Boxes.MailMailbox": {
         "type": "object",
         "properties": {
@@ -150007,6 +151148,16 @@
           }
         }
       },
+      "Minds.MindsGone": {
+        "description": "MIND_GONE: the Mind was deleted and released; its data is archived and it cannot be resumed or used. Not retryable. (Deleting or resizing an already deleted Mind answers 409 MIND_DELETED instead.)",
+        "content": {
+          "application/json": {
+            "schema": {
+              "$ref": "#/components/schemas/Minds.MindsError"
+            }
+          }
+        }
+      },
       "Auto.Forbidden": {
         "description": "Missing scope, not the approver, or no authority over the record",
         "content": {
@@ -151320,7 +152471,17 @@
           "type": "string",
           "format": "uuid"
         },
-        "description": "Must be a UUID. Optional: the service generates one when absent and rejects a malformed value with 422. Only mail send and agent batch send read it."
+        "description": "Must be a UUID. Optional: the service generates one when absent and rejects a malformed value with 422. Only mail send, agent batch send and agent mailbox send read it."
+      },
+      "Boxes.AgentId": {
+        "name": "agentId",
+        "in": "path",
+        "required": true,
+        "schema": {
+          "type": "string",
+          "pattern": "^(one|a_[0-7][0-9A-HJKMNP-TV-Z]{25})$"
+        },
+        "description": "The agent identity that owns the mailbox. \"one\" is One, the default agent in every project; a_<ULID> is an OpenAgentID enrolled at Auth."
       },
       "Brews.DecisionId": {
         "name": "decisionId",
@@ -151542,9 +152703,9 @@
       "title": "Auto (operating structure)",
       "upstream": "https://auto-808958844152.us-central1.run.app",
       "status": "unverified",
-      "statusNote": "Closed gateway admission behind AUTO_GATEWAY_ENABLED: /v1/auto/* with a v2 signed identity (API key, M2M token or login session); auto:read | auto:write | auto:*. Two POSTs need only auto:read: the authority check (POST /v1/auto/authority/check; a read-only caller gets a dry run) and token verification (POST /v1/auto/authority/verify). Deciding an approval needs the approver principal and refuses M2M tokens. If-Match, Idempotency-Key and ETag pass through unchanged. Auto never runs or controls agents. Auto's verification documents (GET /v1/auto/.well-known/jwks.json, /.well-known/did.json, /credentials/cred_*/status) are anonymous: no credential is read or forwarded and no identity envelope is sent. The plugin service route /v1/auto/internal/v1/authority/* forwards the plugin's own bearer to Auto, which verifies it, and is not described here. POST /v1/auto/mcp and the hosted /approvals/apr_* page are not described here either.",
+      "statusNote": "Closed gateway admission behind AUTO_GATEWAY_ENABLED: /v1/auto/* with a v2 signed identity (API key, M2M token or login session); auto:read | auto:write | auto:*. Three POSTs need only auto:read: the authority check (POST /v1/auto/authority/check; a read-only caller gets a dry run), token verification (POST /v1/auto/authority/verify) and the MCP endpoint (POST /v1/auto/mcp). Deciding an approval needs the approver principal and refuses M2M tokens. If-Match, Idempotency-Key and ETag pass through unchanged. Auto never runs or controls agents. Auto's verification documents (GET /v1/auto/.well-known/jwks.json, /.well-known/did.json, /credentials/cred_*/status) are anonymous: no credential is read or forwarded and no identity envelope is sent. The plugin service route /v1/auto/internal/v1/authority/* forwards the plugin's own bearer to Auto, which verifies it, and is not described here. POST /v1/auto/mcp is Auto's own MCP endpoint (callMcp): one JSON-RPC message per request, auto:read to reach it, each tool checks its own scope. The hosted /approvals/apr_* page is not described here.",
       "gatewayRoute": "dedicated",
-      "operations": 73
+      "operations": 74
     },
     {
       "name": "scopes",
@@ -151607,7 +152768,7 @@
       "status": "not_deployed",
       "statusNote": "Gateway Boxes relay (BOXES_RELAY_ENABLED) admits only a pf_boxes DPoP credential on /v1/boxes/mail today; org API key lane (BOXES_RELAY_KEY_LANE_ENABLED; `genesis login` sessions also need BOXES_RELAY_SESSION_LANE_ENABLED, default off, human-only routes stay HUMAN_REQUIRED) and the other families are not live yet. GET needs boxes:read, everything else boxes:write.",
       "gatewayRoute": "dedicated",
-      "operations": 163
+      "operations": 172
     },
     {
       "name": "brews",