@onesi/genesis 0.2.6 → 0.2.7

package/dist/genesis.openapi.json

@@ -47045,7 +47045,7 @@
       "post": {
         "operationId": "minds_engineAssociativeMemoryPostAssocMhnClear",
         "summary": "associative-memory: POST /v1/assoc/mhn/clear",
-        "description": "Calls `POST /v1/assoc/mhn/clear` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `mhn:admin` on `memory:mhn`, `assoc_mem` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/assoc/mhn/clear` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `mhn:admin`, `query`, `delete` on `memory:mhn`, `assoc_mem` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -47085,7 +47085,9 @@
           "daemon_method": "POST",
           "daemon_path": "/v1/assoc/mhn/clear",
           "actions": [
-            "mhn:admin"
+            "mhn:admin",
+            "query",
+            "delete"
           ],
           "keyspaces": [
             "memory:mhn",
@@ -47125,7 +47127,7 @@
       "post": {
         "operationId": "minds_engineAssociativeMemoryPostAssocMhnConfig",
         "summary": "associative-memory: POST /v1/assoc/mhn/config",
-        "description": "Calls `POST /v1/assoc/mhn/config` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `mhn:read` on `memory:mhn`, `assoc_mem` (minds:instances:read). Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/assoc/mhn/config` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `mhn:read`, `query` on `memory:mhn`, `assoc_mem` (minds:instances:read). Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -47165,7 +47167,8 @@
           "daemon_method": "POST",
           "daemon_path": "/v1/assoc/mhn/config",
           "actions": [
-            "mhn:read"
+            "mhn:read",
+            "query"
           ],
           "keyspaces": [
             "memory:mhn",
@@ -47205,7 +47208,7 @@
       "post": {
         "operationId": "minds_engineAssociativeMemoryPostAssocMhnList",
         "summary": "associative-memory: POST /v1/assoc/mhn/list",
-        "description": "Calls `POST /v1/assoc/mhn/list` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `mhn:read` on `memory:mhn`, `assoc_mem` (minds:instances:read). Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/assoc/mhn/list` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `mhn:read`, `query` on `memory:mhn`, `assoc_mem` (minds:instances:read). Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -47245,7 +47248,8 @@
           "daemon_method": "POST",
           "daemon_path": "/v1/assoc/mhn/list",
           "actions": [
-            "mhn:read"
+            "mhn:read",
+            "query"
           ],
           "keyspaces": [
             "memory:mhn",
@@ -47285,7 +47289,7 @@
       "post": {
         "operationId": "minds_engineAssociativeMemoryPostAssocMhnNew",
         "summary": "associative-memory: POST /v1/assoc/mhn/new",
-        "description": "Calls `POST /v1/assoc/mhn/new` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `mhn:admin`, `mhn:write` on `memory:mhn`, `assoc_mem` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/assoc/mhn/new` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `mhn:admin`, `mhn:write`, `query` on `memory:mhn`, `assoc_mem` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -47326,7 +47330,8 @@
           "daemon_path": "/v1/assoc/mhn/new",
           "actions": [
             "mhn:admin",
-            "mhn:write"
+            "mhn:write",
+            "query"
           ],
           "keyspaces": [
             "memory:mhn",
@@ -47366,7 +47371,7 @@
       "post": {
         "operationId": "minds_engineAssociativeMemoryPostAssocMhnRetrieve",
         "summary": "associative-memory: POST /v1/assoc/mhn/retrieve",
-        "description": "Calls `POST /v1/assoc/mhn/retrieve` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `mhn:read` on `memory:mhn`, `assoc_mem` (minds:instances:read). Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/assoc/mhn/retrieve` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `mhn:read`, `query` on `memory:mhn`, `assoc_mem` (minds:instances:read). Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -47406,7 +47411,8 @@
           "daemon_method": "POST",
           "daemon_path": "/v1/assoc/mhn/retrieve",
           "actions": [
-            "mhn:read"
+            "mhn:read",
+            "query"
           ],
           "keyspaces": [
             "memory:mhn",
@@ -47446,7 +47452,7 @@
       "post": {
         "operationId": "minds_engineAssociativeMemoryPostAssocMhnRetrieveByKey",
         "summary": "associative-memory: POST /v1/assoc/mhn/retrieve_by_key",
-        "description": "Calls `POST /v1/assoc/mhn/retrieve_by_key` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `mhn:read` on `memory:mhn`, `assoc_mem` (minds:instances:read). Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/assoc/mhn/retrieve_by_key` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `mhn:read`, `query` on `memory:mhn`, `assoc_mem` (minds:instances:read). Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -47486,7 +47492,8 @@
           "daemon_method": "POST",
           "daemon_path": "/v1/assoc/mhn/retrieve_by_key",
           "actions": [
-            "mhn:read"
+            "mhn:read",
+            "query"
           ],
           "keyspaces": [
             "memory:mhn",
@@ -47526,7 +47533,7 @@
       "post": {
         "operationId": "minds_engineAssociativeMemoryPostAssocMhnRetrieveByVector",
         "summary": "associative-memory: POST /v1/assoc/mhn/retrieve_by_vector",
-        "description": "Calls `POST /v1/assoc/mhn/retrieve_by_vector` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `mhn:read` on `memory:mhn`, `assoc_mem` (minds:instances:read). Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/assoc/mhn/retrieve_by_vector` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `mhn:read`, `query` on `memory:mhn`, `assoc_mem` (minds:instances:read). Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -47566,7 +47573,8 @@
           "daemon_method": "POST",
           "daemon_path": "/v1/assoc/mhn/retrieve_by_vector",
           "actions": [
-            "mhn:read"
+            "mhn:read",
+            "query"
           ],
           "keyspaces": [
             "memory:mhn",
@@ -47606,7 +47614,7 @@
       "post": {
         "operationId": "minds_engineAssociativeMemoryPostAssocMhnStats",
         "summary": "associative-memory: POST /v1/assoc/mhn/stats",
-        "description": "Calls `POST /v1/assoc/mhn/stats` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `mhn:read` on `memory:mhn`, `assoc_mem` (minds:instances:read). Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/assoc/mhn/stats` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `mhn:read`, `query` on `memory:mhn`, `assoc_mem` (minds:instances:read). Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -47646,7 +47654,8 @@
           "daemon_method": "POST",
           "daemon_path": "/v1/assoc/mhn/stats",
           "actions": [
-            "mhn:read"
+            "mhn:read",
+            "query"
           ],
           "keyspaces": [
             "memory:mhn",
@@ -47686,7 +47695,7 @@
       "post": {
         "operationId": "minds_engineAssociativeMemoryPostAssocMhnStore",
         "summary": "associative-memory: POST /v1/assoc/mhn/store",
-        "description": "Calls `POST /v1/assoc/mhn/store` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `mhn:write` on `memory:mhn`, `assoc_mem` (minds:instances:update). Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/assoc/mhn/store` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `mhn:write`, `query`, `read`, `update` on `memory:mhn`, `assoc_mem` (minds:instances:update). Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -47726,7 +47735,10 @@
           "daemon_method": "POST",
           "daemon_path": "/v1/assoc/mhn/store",
           "actions": [
-            "mhn:write"
+            "mhn:write",
+            "query",
+            "read",
+            "update"
           ],
           "keyspaces": [
             "memory:mhn",
@@ -47766,7 +47778,7 @@
       "post": {
         "operationId": "minds_engineAssociativeMemoryPostAssocMhnSystemInfo",
         "summary": "associative-memory: POST /v1/assoc/mhn/system_info",
-        "description": "Calls `POST /v1/assoc/mhn/system_info` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `mhn:read` on `memory:mhn`, `assoc_mem` (minds:instances:read). Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/assoc/mhn/system_info` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `mhn:read`, `query` on `memory:mhn`, `assoc_mem` (minds:instances:read). Exists only on Minds created with `enable_mhn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -47806,7 +47818,8 @@
           "daemon_method": "POST",
           "daemon_path": "/v1/assoc/mhn/system_info",
           "actions": [
-            "mhn:read"
+            "mhn:read",
+            "query"
           ],
           "keyspaces": [
             "memory:mhn",
@@ -47846,7 +47859,7 @@
       "get": {
         "operationId": "minds_engineCognitiveCycleGetCognitiveCycles",
         "summary": "cognitive-cycle: GET /v1/cognitive/cycles",
-        "description": "Calls `GET /v1/cognitive/cycles` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `cognitive_cycle_history` (minds:instances:read). Exists only on Minds created with `enable_cognitive_cycle` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/cognitive/cycles` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `query` on `cognitive_cycle_history` (minds:instances:read). Exists only on Minds created with `enable_cognitive_cycle` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -47886,7 +47899,8 @@
           "daemon_method": "GET",
           "daemon_path": "/v1/cognitive/cycles",
           "actions": [
-            "read"
+            "read",
+            "query"
           ],
           "keyspaces": [
             "cognitive_cycle_history"
@@ -47911,7 +47925,7 @@
       "post": {
         "operationId": "minds_engineCognitiveCyclePostCognitiveCycles",
         "summary": "cognitive-cycle: POST /v1/cognitive/cycles",
-        "description": "Calls `POST /v1/cognitive/cycles` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write` on `cognitive_cycle_history` (minds:instances:update). Exists only on Minds created with `enable_cognitive_cycle` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/cognitive/cycles` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `query`, `delete` on `cognitive_cycle_history` (minds:instances:update). Exists only on Minds created with `enable_cognitive_cycle` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -47951,7 +47965,9 @@
           "daemon_method": "POST",
           "daemon_path": "/v1/cognitive/cycles",
           "actions": [
-            "write"
+            "write",
+            "query",
+            "delete"
           ],
           "keyspaces": [
             "cognitive_cycle_history"
@@ -48072,7 +48088,7 @@
       "get": {
         "operationId": "minds_engineCognitiveCycleGetCognitiveStats",
         "summary": "cognitive-cycle: GET /v1/cognitive/stats",
-        "description": "Calls `GET /v1/cognitive/stats` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `cognitive_cycle_history` (minds:instances:read). Exists only on Minds created with `enable_cognitive_cycle` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/cognitive/stats` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `query` on `cognitive_cycle_history` (minds:instances:read). Exists only on Minds created with `enable_cognitive_cycle` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -48112,7 +48128,8 @@
           "daemon_method": "GET",
           "daemon_path": "/v1/cognitive/stats",
           "actions": [
-            "read"
+            "read",
+            "query"
           ],
           "keyspaces": [
             "cognitive_cycle_history"
@@ -49371,7 +49388,7 @@
       "post": {
         "operationId": "minds_engineForgettingPostForgettingRequests",
         "summary": "forgetting: POST /v1/forgetting/requests",
-        "description": "Calls `POST /v1/forgetting/requests` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query`, `read` on `_system_forgetting_requests` (minds:instances:read). Registered on every Mind with a storage service (kv, graph, analytics, ml, inference, vector or memory) enabled. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/forgetting/requests` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query`, `read`, `write` on `_system_forgetting_requests` (minds:instances:update). Registered on every Mind with a storage service (kv, graph, analytics, ml, inference, vector or memory) enabled. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -49406,18 +49423,19 @@
             }
           }
         },
-        "x-required-scope": "minds:read",
+        "x-required-scope": "minds:write",
         "x-minds-engine": {
           "daemon_method": "POST",
           "daemon_path": "/v1/forgetting/requests",
           "actions": [
             "query",
-            "read"
+            "read",
+            "write"
           ],
           "keyspaces": [
             "_system_forgetting_requests"
           ],
-          "scope": "minds:instances:read",
+          "scope": "minds:instances:update",
           "mintable": true,
           "flag": "database(enable_kv|graph|analytics|ml|inference|vector|memory)",
           "grant": "table"
@@ -49870,7 +49888,7 @@
       "post": {
         "operationId": "minds_engineKnowledgeGraphPostGraphCypher",
         "summary": "knowledge-graph: POST /v1/graph/cypher",
-        "description": "Calls `POST /v1/graph/cypher` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/graph/cypher` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query`, `read` on `*` (minds:instances:manage). A write (`allow_updates: true`, or a CREATE, MERGE, DELETE, DETACH, SET or REMOVE clause anywhere in the query) is also minted `write` and `update`, plus `delete` for a DELETE or DETACH clause. SET, MERGE and REMOVE are not supported by the engine yet and answer 501 `MINDS_CYPHER_CLAUSE_UNSUPPORTED` (clause names it). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -49957,7 +49975,7 @@
       "post": {
         "operationId": "minds_engineKnowledgeGraphPostGraphCypherLite",
         "summary": "knowledge-graph: POST /v1/graph/cypher-lite",
-        "description": "Calls `POST /v1/graph/cypher-lite` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/graph/cypher-lite` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query`, `read` on `*` (minds:instances:manage). A write (`allow_updates: true`, which cypher-lite needs before it runs a write clause, or a CREATE, MERGE, DELETE, DETACH, SET or REMOVE clause anywhere in the query) is also minted `write` and `update`, plus `delete` for a DELETE or DETACH clause. SET, MERGE and REMOVE are not supported by the engine yet and answer 501 `MINDS_CYPHER_CLAUSE_UNSUPPORTED` (clause names it). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -50135,7 +50153,7 @@
       "post": {
         "operationId": "minds_engineKnowledgeGraphPostGraphIndexEnsureComposite",
         "summary": "knowledge-graph: POST /v1/graph/index/ensure/composite",
-        "description": "Calls `POST /v1/graph/index/ensure/composite` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/graph/index/ensure/composite` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -50177,7 +50195,8 @@
           "actions": [
             "write",
             "update",
-            "read"
+            "read",
+            "query"
           ],
           "keyspaces": [
             "*"
@@ -50226,7 +50245,7 @@
       "post": {
         "operationId": "minds_engineKnowledgeGraphPostGraphIndexEnsureProperty",
         "summary": "knowledge-graph: POST /v1/graph/index/ensure/property",
-        "description": "Calls `POST /v1/graph/index/ensure/property` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/graph/index/ensure/property` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -50268,7 +50287,8 @@
           "actions": [
             "write",
             "update",
-            "read"
+            "read",
+            "query"
           ],
           "keyspaces": [
             "*"
@@ -50314,7 +50334,7 @@
       "get": {
         "operationId": "minds_engineKnowledgeGraphGetGraphIndexStats",
         "summary": "knowledge-graph: GET /v1/graph/index/stats",
-        "description": "Calls `GET /v1/graph/index/stats` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/graph/index/stats` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -50354,7 +50374,8 @@
           "daemon_method": "GET",
           "daemon_path": "/v1/graph/index/stats",
           "actions": [
-            "read"
+            "read",
+            "query"
           ],
           "keyspaces": [
             "*"
@@ -50381,7 +50402,7 @@
       "post": {
         "operationId": "minds_engineKnowledgeGraphPostGraphMicrotheoryKeyspace",
         "summary": "knowledge-graph: POST /v1/graph/microtheory/keyspace",
-        "description": "Calls `POST /v1/graph/microtheory/keyspace` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/graph/microtheory/keyspace` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -50423,7 +50444,8 @@
           "actions": [
             "write",
             "update",
-            "read"
+            "read",
+            "query"
           ],
           "keyspaces": [
             "*"
@@ -50469,7 +50491,7 @@
       "post": {
         "operationId": "minds_engineKnowledgeGraphPostGraphMicrotheorySwitch",
         "summary": "knowledge-graph: POST /v1/graph/microtheory/switch",
-        "description": "Calls `POST /v1/graph/microtheory/switch` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/graph/microtheory/switch` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -50511,7 +50533,8 @@
           "actions": [
             "write",
             "update",
-            "read"
+            "read",
+            "query"
           ],
           "keyspaces": [
             "*"
@@ -50557,7 +50580,7 @@
       "get": {
         "operationId": "minds_engineKnowledgeGraphGetGraphSchema",
         "summary": "knowledge-graph: GET /v1/graph/schema",
-        "description": "Calls `GET /v1/graph/schema` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/graph/schema` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -50597,7 +50620,8 @@
           "daemon_method": "GET",
           "daemon_path": "/v1/graph/schema",
           "actions": [
-            "read"
+            "read",
+            "query"
           ],
           "keyspaces": [
             "*"
@@ -50720,7 +50744,7 @@
       "post": {
         "operationId": "minds_engineKnowledgeGraphPostGraphTxBegin",
         "summary": "knowledge-graph: POST /v1/graph/tx/begin",
-        "description": "Calls `POST /v1/graph/tx/begin` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/graph/tx/begin` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -50762,7 +50786,8 @@
           "actions": [
             "write",
             "update",
-            "read"
+            "read",
+            "query"
           ],
           "keyspaces": [
             "*"
@@ -50789,7 +50814,7 @@
       "post": {
         "operationId": "minds_engineKnowledgeGraphPostGraphTxCommit",
         "summary": "knowledge-graph: POST /v1/graph/tx/commit",
-        "description": "Calls `POST /v1/graph/tx/commit` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/graph/tx/commit` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -50831,7 +50856,8 @@
           "actions": [
             "write",
             "update",
-            "read"
+            "read",
+            "query"
           ],
           "keyspaces": [
             "*"
@@ -50877,7 +50903,7 @@
       "post": {
         "operationId": "minds_engineKnowledgeGraphPostGraphTxRollback",
         "summary": "knowledge-graph: POST /v1/graph/tx/rollback",
-        "description": "Calls `POST /v1/graph/tx/rollback` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/graph/tx/rollback` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -50919,7 +50945,8 @@
           "actions": [
             "write",
             "update",
-            "read"
+            "read",
+            "query"
           ],
           "keyspaces": [
             "*"
@@ -51955,7 +51982,7 @@
       "get": {
         "operationId": "minds_engineLineageGetLineageNodesId",
         "summary": "lineage: GET /v1/lineage/nodes/:id",
-        "description": "Calls `GET /v1/lineage/nodes/:id` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/lineage/nodes/:id` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -52004,7 +52031,8 @@
           "daemon_method": "GET",
           "daemon_path": "/v1/lineage/nodes/:id",
           "actions": [
-            "read"
+            "read",
+            "query"
           ],
           "keyspaces": [
             "*"
@@ -52031,7 +52059,7 @@
       "get": {
         "operationId": "minds_engineLineageGetLineageStats",
         "summary": "lineage: GET /v1/lineage/stats",
-        "description": "Calls `GET /v1/lineage/stats` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/lineage/stats` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_graph` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -52071,7 +52099,8 @@
           "daemon_method": "GET",
           "daemon_path": "/v1/lineage/stats",
           "actions": [
-            "read"
+            "read",
+            "query"
           ],
           "keyspaces": [
             "*"
@@ -53596,7 +53625,7 @@
       "post": {
         "operationId": "minds_engineProceduralMemoryPostMemoryProceduresDelete",
         "summary": "procedural-memory: POST /v1/memory/procedures/delete",
-        "description": "Calls `POST /v1/memory/procedures/delete` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `delete` on `memory:procedural` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/memory/procedures/delete` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `delete`, `read`, `query` on `memory:procedural` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -53636,7 +53665,9 @@
           "daemon_method": "POST",
           "daemon_path": "/v1/memory/procedures/delete",
           "actions": [
-            "delete"
+            "delete",
+            "read",
+            "query"
           ],
           "keyspaces": [
             "memory:procedural"
@@ -53682,7 +53713,7 @@
       "post": {
         "operationId": "minds_engineProceduralMemoryPostMemoryProceduresGet",
         "summary": "procedural-memory: POST /v1/memory/procedures/get",
-        "description": "Calls `POST /v1/memory/procedures/get` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `memory:procedural` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/memory/procedures/get` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `query` on `memory:procedural` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -53722,7 +53753,8 @@
           "daemon_method": "POST",
           "daemon_path": "/v1/memory/procedures/get",
           "actions": [
-            "read"
+            "read",
+            "query"
           ],
           "keyspaces": [
             "memory:procedural"
@@ -53836,7 +53868,7 @@
       "post": {
         "operationId": "minds_engineProceduralMemoryPostMemoryProceduresSearch",
         "summary": "procedural-memory: POST /v1/memory/procedures/search",
-        "description": "Calls `POST /v1/memory/procedures/search` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query` on `memory:procedural` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/memory/procedures/search` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query`, `read` on `memory:procedural` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -53876,7 +53908,8 @@
           "daemon_method": "POST",
           "daemon_path": "/v1/memory/procedures/search",
           "actions": [
-            "query"
+            "query",
+            "read"
           ],
           "keyspaces": [
             "memory:procedural"
@@ -53922,7 +53955,7 @@
       "post": {
         "operationId": "minds_engineProceduralMemoryPostMemoryProceduresUpdate",
         "summary": "procedural-memory: POST /v1/memory/procedures/update",
-        "description": "Calls `POST /v1/memory/procedures/update` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `update` on `memory:procedural` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/memory/procedures/update` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `update`, `query` on `memory:procedural` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -53963,7 +53996,8 @@
           "daemon_path": "/v1/memory/procedures/update",
           "actions": [
             "read",
-            "update"
+            "update",
+            "query"
           ],
           "keyspaces": [
             "memory:procedural"
@@ -55090,7 +55124,7 @@
       "post": {
         "operationId": "minds_engineVaultPostMemoryVault",
         "summary": "vault: POST /v1/memory/vault",
-        "description": "Calls `POST /v1/memory/vault` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write` on `memory:vault` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/memory/vault` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `read`, `update` on `memory:vault` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -55130,7 +55164,9 @@
           "daemon_method": "POST",
           "daemon_path": "/v1/memory/vault",
           "actions": [
-            "write"
+            "write",
+            "read",
+            "update"
           ],
           "keyspaces": [
             "memory:vault"
@@ -55265,7 +55301,7 @@
       "post": {
         "operationId": "minds_engineVaultPostMemoryVaultDelete",
         "summary": "vault: POST /v1/memory/vault/delete",
-        "description": "Calls `POST /v1/memory/vault/delete` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `delete` on `memory:vault` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/memory/vault/delete` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `delete`, `read`, `write`, `update` on `memory:vault` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -55305,7 +55341,10 @@
           "daemon_method": "POST",
           "daemon_path": "/v1/memory/vault/delete",
           "actions": [
-            "delete"
+            "delete",
+            "read",
+            "write",
+            "update"
           ],
           "keyspaces": [
             "memory:vault"
@@ -55351,7 +55390,7 @@
       "post": {
         "operationId": "minds_engineVaultPostMemoryVaultGet",
         "summary": "vault: POST /v1/memory/vault/get",
-        "description": "Calls `POST /v1/memory/vault/get` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `memory:vault` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/memory/vault/get` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `write`, `update` on `memory:vault` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -55386,17 +55425,19 @@
             }
           }
         },
-        "x-required-scope": "minds:read",
+        "x-required-scope": "minds:write",
         "x-minds-engine": {
           "daemon_method": "POST",
           "daemon_path": "/v1/memory/vault/get",
           "actions": [
-            "read"
+            "read",
+            "write",
+            "update"
           ],
           "keyspaces": [
             "memory:vault"
           ],
-          "scope": "minds:instances:read",
+          "scope": "minds:instances:update",
           "mintable": true,
           "flag": "enable_memory",
           "grant": "table"
@@ -55437,7 +55478,7 @@
       "post": {
         "operationId": "minds_engineVaultPostMemoryVaultSearch",
         "summary": "vault: POST /v1/memory/vault/search",
-        "description": "Calls `POST /v1/memory/vault/search` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query` on `memory:vault` (minds:instances:read). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/memory/vault/search` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `query`, `read`, `write` on `memory:vault` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -55472,17 +55513,19 @@
             }
           }
         },
-        "x-required-scope": "minds:read",
+        "x-required-scope": "minds:write",
         "x-minds-engine": {
           "daemon_method": "POST",
           "daemon_path": "/v1/memory/vault/search",
           "actions": [
-            "query"
+            "query",
+            "read",
+            "write"
           ],
           "keyspaces": [
             "memory:vault"
           ],
-          "scope": "minds:instances:read",
+          "scope": "minds:instances:update",
           "mintable": true,
           "flag": "enable_memory",
           "grant": "table"
@@ -55591,7 +55634,7 @@
       "post": {
         "operationId": "minds_engineVaultPostMemoryVaultUpdate",
         "summary": "vault: POST /v1/memory/vault/update",
-        "description": "Calls `POST /v1/memory/vault/update` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `update` on `memory:vault` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/memory/vault/update` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `update`, `read`, `write` on `memory:vault` (minds:instances:update). Exists only on Minds created with `enable_memory` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:write`. Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -55631,7 +55674,9 @@
           "daemon_method": "POST",
           "daemon_path": "/v1/memory/vault/update",
           "actions": [
-            "update"
+            "update",
+            "read",
+            "write"
           ],
           "keyspaces": [
             "memory:vault"
@@ -55677,7 +55722,7 @@
       "post": {
         "operationId": "minds_engineMachineLearningPostMlEmbed",
         "summary": "machine-learning: POST /v1/ml/embed",
-        "description": "Calls `POST /v1/ml/embed` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/ml/embed` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -55717,7 +55762,8 @@
           "daemon_method": "POST",
           "daemon_path": "/v1/ml/embed",
           "actions": [
-            "read"
+            "read",
+            "query"
           ],
           "keyspaces": [
             "*"
@@ -55767,7 +55813,7 @@
       "post": {
         "operationId": "minds_engineMachineLearningPostMlGenerate",
         "summary": "machine-learning: POST /v1/ml/generate",
-        "description": "Calls `POST /v1/ml/generate` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/ml/generate` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -55807,7 +55853,8 @@
           "daemon_method": "POST",
           "daemon_path": "/v1/ml/generate",
           "actions": [
-            "read"
+            "read",
+            "query"
           ],
           "keyspaces": [
             "*"
@@ -55859,7 +55906,7 @@
       "post": {
         "operationId": "minds_engineMachineLearningPostMlMetrics",
         "summary": "machine-learning: POST /v1/ml/metrics",
-        "description": "Calls `POST /v1/ml/metrics` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/ml/metrics` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -55899,7 +55946,8 @@
           "daemon_method": "POST",
           "daemon_path": "/v1/ml/metrics",
           "actions": [
-            "read"
+            "read",
+            "query"
           ],
           "keyspaces": [
             "*"
@@ -55945,7 +55993,7 @@
       "get": {
         "operationId": "minds_engineMachineLearningGetMlModels",
         "summary": "machine-learning: GET /v1/ml/models",
-        "description": "Calls `GET /v1/ml/models` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/ml/models` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -55985,7 +56033,8 @@
           "daemon_method": "GET",
           "daemon_path": "/v1/ml/models",
           "actions": [
-            "read"
+            "read",
+            "query"
           ],
           "keyspaces": [
             "*"
@@ -56012,7 +56061,7 @@
       "post": {
         "operationId": "minds_engineMachineLearningPostMlModelsLoad",
         "summary": "machine-learning: POST /v1/ml/models/load",
-        "description": "Calls `POST /v1/ml/models/load` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/ml/models/load` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -56052,7 +56101,9 @@
           "daemon_method": "POST",
           "daemon_path": "/v1/ml/models/load",
           "actions": [
-            "write"
+            "write",
+            "read",
+            "query"
           ],
           "keyspaces": [
             "*"
@@ -56108,7 +56159,7 @@
       "post": {
         "operationId": "minds_engineMachineLearningPostMlModelsUnload",
         "summary": "machine-learning: POST /v1/ml/models/unload",
-        "description": "Calls `POST /v1/ml/models/unload` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `delete` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/ml/models/unload` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `delete`, `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -56148,7 +56199,9 @@
           "daemon_method": "POST",
           "daemon_path": "/v1/ml/models/unload",
           "actions": [
-            "delete"
+            "delete",
+            "read",
+            "query"
           ],
           "keyspaces": [
             "*"
@@ -56194,7 +56247,7 @@
       "post": {
         "operationId": "minds_engineMachineLearningPostMlTokenizersLoad",
         "summary": "machine-learning: POST /v1/ml/tokenizers/load",
-        "description": "Calls `POST /v1/ml/tokenizers/load` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/ml/tokenizers/load` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -56234,7 +56287,8 @@
           "daemon_method": "POST",
           "daemon_path": "/v1/ml/tokenizers/load",
           "actions": [
-            "read"
+            "read",
+            "query"
           ],
           "keyspaces": [
             "*"
@@ -56280,7 +56334,7 @@
       "post": {
         "operationId": "minds_engineMachineLearningPostMlTrainHrm",
         "summary": "machine-learning: POST /v1/ml/train/hrm",
-        "description": "Calls `POST /v1/ml/train/hrm` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/ml/train/hrm` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -56320,7 +56374,8 @@
           "daemon_method": "POST",
           "daemon_path": "/v1/ml/train/hrm",
           "actions": [
-            "read"
+            "read",
+            "query"
           ],
           "keyspaces": [
             "*"
@@ -56387,7 +56442,7 @@
       "post": {
         "operationId": "minds_engineMachineLearningPostMlTrainSupervised",
         "summary": "machine-learning: POST /v1/ml/train/supervised",
-        "description": "Calls `POST /v1/ml/train/supervised` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/ml/train/supervised` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_ml` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -56427,7 +56482,8 @@
           "daemon_method": "POST",
           "daemon_path": "/v1/ml/train/supervised",
           "actions": [
-            "read"
+            "read",
+            "query"
           ],
           "keyspaces": [
             "*"
@@ -56491,7 +56547,7 @@
       "get": {
         "operationId": "minds_engineVectorsGetMlVector",
         "summary": "vectors: GET /v1/ml/vector",
-        "description": "Calls `GET /v1/ml/vector` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_vector` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `GET /v1/ml/vector` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_vector` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -56531,7 +56587,8 @@
           "daemon_method": "GET",
           "daemon_path": "/v1/ml/vector",
           "actions": [
-            "read"
+            "read",
+            "query"
           ],
           "keyspaces": [
             "*"
@@ -56558,7 +56615,7 @@
       "post": {
         "operationId": "minds_engineVectorsPostMlVectorAdd",
         "summary": "vectors: POST /v1/ml/vector/add",
-        "description": "Calls `POST /v1/ml/vector/add` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_vector` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/ml/vector/add` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_vector` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -56600,7 +56657,8 @@
           "actions": [
             "write",
             "update",
-            "read"
+            "read",
+            "query"
           ],
           "keyspaces": [
             "*"
@@ -56657,7 +56715,7 @@
       "post": {
         "operationId": "minds_engineVectorsPostMlVectorCreate",
         "summary": "vectors: POST /v1/ml/vector/create",
-        "description": "Calls `POST /v1/ml/vector/create` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_vector` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/ml/vector/create` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_vector` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -56699,7 +56757,8 @@
           "actions": [
             "write",
             "update",
-            "read"
+            "read",
+            "query"
           ],
           "keyspaces": [
             "*"
@@ -56753,7 +56812,7 @@
       "post": {
         "operationId": "minds_engineVectorsPostMlVectorSave",
         "summary": "vectors: POST /v1/ml/vector/save",
-        "description": "Calls `POST /v1/ml/vector/save` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_vector` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/ml/vector/save` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `write`, `update`, `read`, `query` on `*` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_vector` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -56795,7 +56854,8 @@
           "actions": [
             "write",
             "update",
-            "read"
+            "read",
+            "query"
           ],
           "keyspaces": [
             "*"
@@ -58452,7 +58512,7 @@
       "post": {
         "operationId": "minds_engineSpikingNetworksPostSnnNetworkBuild",
         "summary": "spiking-networks: POST /v1/snn/network/build",
-        "description": "Calls `POST /v1/snn/network/build` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `snn:admin`, `snn:write` on `memory:snn`, `snn_networks`, `snn_compiled`, `snn_runs` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_snn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/snn/network/build` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `snn:admin`, `snn:write`, `snn:query` on `memory:snn`, `snn_networks`, `snn_compiled`, `snn_runs` (minds:instances:manage). Human sessions: Genesis cannot mint minds:instances:manage on the Sandbox delegation path yet, so this route answers 403 `MINDS_ENGINE_MANAGE_REQUIRED` (required_scope minds:instances:manage) until it can. Exists only on Minds created with `enable_snn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` and `minds:manage` (minds:manage does not imply read). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -58493,7 +58553,8 @@
           "daemon_path": "/v1/snn/network/build",
           "actions": [
             "snn:admin",
-            "snn:write"
+            "snn:write",
+            "snn:query"
           ],
           "keyspaces": [
             "memory:snn",
@@ -58618,7 +58679,7 @@
       "post": {
         "operationId": "minds_engineSpikingNetworksPostSnnNetworkState",
         "summary": "spiking-networks: POST /v1/snn/network/state",
-        "description": "Calls `POST /v1/snn/network/state` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `snn:read` on `memory:snn`, `snn_networks`, `snn_compiled`, `snn_runs` (minds:instances:read). Exists only on Minds created with `enable_snn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
+        "description": "Calls `POST /v1/snn/network/state` on the selected Sandbox Mind's engine with a capability minted for this request only. Grant: actions `snn:read`, `snn:query` on `memory:snn`, `snn_networks`, `snn_compiled`, `snn_runs` (minds:instances:read). Exists only on Minds created with `enable_snn` set; elsewhere the Mind answers 404. Requires a `genesis login` session with a Console Sandbox selection, or an org API key. Org API keys with a Sandbox binding are admitted with `minds:read` (or `minds:write`). Missing scopes answer 403 `SCOPE_MISSING` with required_scope.",
         "parameters": [
           {
             "name": "mind_id",
@@ -58658,7 +58719,8 @@
           "daemon_method": "POST",
           "daemon_path": "/v1/snn/network/state",
           "actions": [
-            "snn:read"
+            "snn:read",
+            "snn:query"
           ],
           "keyspaces": [
             "memory:snn",
@@ -74324,6 +74386,71 @@
         "x-mcp": true
       }
     },
+    "/v1/auto/mcp": {
+      "post": {
+        "operationId": "auto_callMcp",
+        "summary": "Send one MCP JSON-RPC message to Auto",
+        "description": "Auto's own MCP server (streamable HTTP, stateless): one JSON-RPC 2.0 message per request, one JSON-RPC response back. Methods: `initialize`, `ping`, `tools/list`, `tools/call`, `resources/list` and `resources/read` (the approval card, `ui://auto/approval-card.html`). Notifications (no `id`, e.g. `notifications/initialized`) answer 202 with no body. Batches (a JSON array) are refused with 400 (Auto's code `batch_unsupported`; the gateway answers it as `BATCH_UNSUPPORTED`). Scope `auto:read` to reach the endpoint; `tools/list` lists only the tools your scopes allow, and each tool checks its own scope (`auto:read` or `auto:write`): a call without it is a result with `isError: true` (\"Requires scope auto:write\"). Tool errors (invalid input, not found, conflict) are results with `isError: true` as well; an unknown tool or method is a JSON-RPC error (`-32602`, `-32601`). `auto_decide_approval` is app-only: only the mandate approver may decide, from the approval card. Each tool mirrors a REST operation (`auto_list_orgs` is `listOrgs`, `auto_propose_action` is `proposeAction`). Protocol version `2025-06-18`.",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/Auto.McpRequest"
+              },
+              "example": {
+                "jsonrpc": "2.0",
+                "id": 1,
+                "method": "tools/call",
+                "params": {
+                  "name": "auto_list_orgs",
+                  "arguments": {}
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "The JSON-RPC response, a result or a JSON-RPC error",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Auto.McpResponse"
+                }
+              }
+            }
+          },
+          "202": {
+            "description": "A notification was accepted; no body"
+          },
+          "400": {
+            "description": "A batch (`batch_unsupported` from Auto, `BATCH_UNSUPPORTED` through the gateway) or a body that is not JSON",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Auto.AutoError"
+                }
+              }
+            }
+          },
+          "403": {
+            "$ref": "#/components/responses/Auto.Forbidden"
+          }
+        },
+        "tags": [
+          "auto"
+        ],
+        "x-genesis-service": "auto",
+        "x-upstream": {
+          "base": "https://auto-808958844152.us-central1.run.app",
+          "method": "POST",
+          "path": "/v1/mcp",
+          "status": "unverified"
+        },
+        "x-mcp": true
+      }
+    },
     "/v1/scopes/whoami": {
       "get": {
         "operationId": "scopes_whoami",
@@ -95699,6 +95826,654 @@
         "x-mcp": false
       }
     },
+    "/v1/boxes/mail/agents": {
+      "get": {
+        "operationId": "boxes_mail_agents_list",
+        "summary": "List the project's agent mailboxes",
+        "description": "Every active agent mailbox in the key's project tenant, One first. One's mailbox is provided by default and is created here if it does not exist yet, even under boxes:read. Org API keys only; a signed-in session gets 404 on every agent mailbox route. Needs boxes:read.",
+        "responses": {
+          "200": {
+            "description": "Agent mailboxes",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "success": {
+                      "type": "boolean"
+                    },
+                    "data": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/components/schemas/Boxes.MailAgentMailbox"
+                      }
+                    }
+                  },
+                  "required": [
+                    "success",
+                    "data"
+                  ]
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Missing or invalid authentication"
+          },
+          "403": {
+            "description": "Missing boxes:read"
+          }
+        },
+        "tags": [
+          "boxes"
+        ],
+        "x-genesis-service": "boxes",
+        "x-upstream": {
+          "base": "https://api.boxes.sh",
+          "method": "GET",
+          "path": "/v1/mail/agents",
+          "status": "not_deployed"
+        },
+        "x-mcp": true
+      },
+      "post": {
+        "operationId": "boxes_mail_agents_create",
+        "summary": "Create an agent's mailbox",
+        "description": "Gives an agent identity a mailbox in the key's project tenant. agentId is \"one\" or an OpenAgentID a_<ULID>. It is idempotent; an existing mailbox answers 200, a new or restored one 201. A deleted mailbox comes back with its mail and address. The address is assigned by Boxes on the first-party domain. A project holds at most 500 active agent mailboxes (One not counted), checked on create and on restore. Agent mailboxes are metered per agent-month (boxes.agent_mailbox_months). Needs boxes:write.",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/Boxes.MailAgentCreateRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "The agent already has a mailbox",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Boxes.MailAgentMailboxResponse"
+                }
+              }
+            }
+          },
+          "201": {
+            "description": "Mailbox created or restored",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Boxes.MailAgentMailboxResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Malformed body or agentId"
+          },
+          "401": {
+            "description": "Missing or invalid authentication"
+          },
+          "403": {
+            "description": "Missing boxes:write"
+          },
+          "409": {
+            "description": "ADDRESS_CONFLICT (the address is already reserved) or AGENT_MAILBOX_LIMIT (the project already has 500 active agent mailboxes; One is not counted)"
+          }
+        },
+        "tags": [
+          "boxes"
+        ],
+        "x-genesis-service": "boxes",
+        "x-upstream": {
+          "base": "https://api.boxes.sh",
+          "method": "POST",
+          "path": "/v1/mail/agents",
+          "status": "not_deployed"
+        },
+        "x-mcp": true
+      }
+    },
+    "/v1/boxes/mail/agents/{agentId}": {
+      "get": {
+        "operationId": "boxes_mail_agents_get",
+        "summary": "Get an agent's mailbox",
+        "description": "Needs boxes:read. For \"one\" the default mailbox is created if missing, so it never answers 404.",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/Boxes.AgentId"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Agent mailbox",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Boxes.MailAgentMailboxResponse"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Missing or invalid authentication"
+          },
+          "404": {
+            "description": "The agent has no active mailbox in this project"
+          }
+        },
+        "tags": [
+          "boxes"
+        ],
+        "x-genesis-service": "boxes",
+        "x-upstream": {
+          "base": "https://api.boxes.sh",
+          "method": "GET",
+          "path": "/v1/mail/agents/{agentId}",
+          "status": "not_deployed"
+        },
+        "x-mcp": true
+      },
+      "delete": {
+        "operationId": "boxes_mail_agents_delete",
+        "summary": "Delete an agent's mailbox",
+        "description": "Stops the agent's mailbox. Its mail and address are kept, and creating it again restores it. One's default mailbox cannot be deleted (409 DEFAULT_AGENT_MAILBOX). Needs boxes:write.",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/Boxes.AgentId"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Mailbox deleted (status deleted)",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Boxes.MailAgentMailboxResponse"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Missing or invalid authentication"
+          },
+          "404": {
+            "description": "The agent has no active mailbox in this project"
+          },
+          "409": {
+            "description": "One's default mailbox cannot be deleted"
+          }
+        },
+        "tags": [
+          "boxes"
+        ],
+        "x-genesis-service": "boxes",
+        "x-upstream": {
+          "base": "https://api.boxes.sh",
+          "method": "DELETE",
+          "path": "/v1/mail/agents/{agentId}",
+          "status": "not_deployed"
+        },
+        "x-mcp": true
+      }
+    },
+    "/v1/boxes/mail/agents/{agentId}/inbox": {
+      "get": {
+        "operationId": "boxes_mail_agents_inbox_list",
+        "summary": "As the agent, list messages in a folder",
+        "description": "Messages in a folder of the agent's own mailbox, newest first. Needs boxes:read.",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/Boxes.AgentId"
+          },
+          {
+            "name": "folder",
+            "in": "query",
+            "schema": {
+              "type": "string",
+              "default": "inbox"
+            },
+            "required": false,
+            "description": "Folder name; defaults to inbox"
+          },
+          {
+            "name": "page",
+            "in": "query",
+            "schema": {
+              "type": "integer",
+              "format": "int64",
+              "minimum": 1,
+              "default": 1
+            },
+            "required": false
+          },
+          {
+            "name": "limit",
+            "in": "query",
+            "schema": {
+              "type": "integer",
+              "format": "int64",
+              "minimum": 1,
+              "maximum": 100,
+              "default": 20
+            },
+            "required": false,
+            "description": "Values outside 1-100 are clamped"
+          },
+          {
+            "name": "unreadOnly",
+            "in": "query",
+            "schema": {
+              "type": "boolean"
+            },
+            "required": false,
+            "description": "Only unread messages"
+          },
+          {
+            "name": "starred",
+            "in": "query",
+            "schema": {
+              "type": "boolean"
+            },
+            "required": false,
+            "description": "Only starred messages"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Messages page",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "success": {
+                      "type": "boolean"
+                    },
+                    "data": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/components/schemas/Boxes.MailMessage"
+                      }
+                    },
+                    "meta": {
+                      "$ref": "#/components/schemas/Boxes.MailListMeta"
+                    }
+                  },
+                  "required": [
+                    "success",
+                    "data"
+                  ]
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Malformed JSON body or query parameters"
+          },
+          "401": {
+            "description": "Missing or invalid authentication"
+          },
+          "403": {
+            "description": "Missing scope"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        },
+        "tags": [
+          "boxes"
+        ],
+        "x-genesis-service": "boxes",
+        "x-upstream": {
+          "base": "https://api.boxes.sh",
+          "method": "GET",
+          "path": "/v1/mail/agents/{agentId}/inbox",
+          "status": "not_deployed"
+        },
+        "x-mcp": true
+      }
+    },
+    "/v1/boxes/mail/agents/{agentId}/send": {
+      "post": {
+        "operationId": "boxes_mail_agents_send",
+        "summary": "As the agent, send an email or save a draft",
+        "description": "Sends from the agent's own mailbox (or saves a draft with isDraft). Needs boxes:write. At least one of bodyPlain or bodyHtml is required. Mail leaving the organization is checked with Auto as the org API key, not as the agent. Idempotency-Key, if given, must be a UUID (422 otherwise); a replay of the same key returns 200 with the original message.",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/Boxes.AgentId"
+          },
+          {
+            "$ref": "#/components/parameters/Boxes.IdempotencyKey"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/Boxes.MailSendRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Idempotent replay of an earlier send",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "success": {
+                      "type": "boolean"
+                    },
+                    "data": {
+                      "$ref": "#/components/schemas/Boxes.MailMessage"
+                    }
+                  },
+                  "required": [
+                    "success",
+                    "data"
+                  ]
+                }
+              }
+            },
+            "headers": {
+              "Idempotency-Key": {
+                "description": "The request idempotency key (the supplied UUID, or the generated one) under the Resend transport.",
+                "schema": {
+                  "type": "string",
+                  "format": "uuid"
+                }
+              }
+            }
+          },
+          "201": {
+            "description": "Message created",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "success": {
+                      "type": "boolean"
+                    },
+                    "data": {
+                      "$ref": "#/components/schemas/Boxes.MailMessage"
+                    }
+                  },
+                  "required": [
+                    "success",
+                    "data"
+                  ]
+                }
+              }
+            },
+            "headers": {
+              "Idempotency-Key": {
+                "description": "The request idempotency key (the supplied UUID, or the generated one) under the Resend transport.",
+                "schema": {
+                  "type": "string",
+                  "format": "uuid"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Malformed JSON body or query parameters"
+          },
+          "401": {
+            "description": "Missing or invalid authentication"
+          },
+          "403": {
+            "description": "Forbidden"
+          },
+          "404": {
+            "description": "Not found"
+          },
+          "422": {
+            "description": "Validation error"
+          },
+          "429": {
+            "description": "Rate limited"
+          }
+        },
+        "tags": [
+          "boxes"
+        ],
+        "x-genesis-service": "boxes",
+        "x-upstream": {
+          "base": "https://api.boxes.sh",
+          "method": "POST",
+          "path": "/v1/mail/agents/{agentId}/send",
+          "status": "not_deployed"
+        },
+        "x-mcp": true
+      }
+    },
+    "/v1/boxes/mail/agents/{agentId}/threads": {
+      "get": {
+        "operationId": "boxes_mail_agents_threads_list",
+        "summary": "As the agent, list conversation threads",
+        "description": "Threads of the agent's own mailbox, newest activity first. Needs boxes:read.",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/Boxes.AgentId"
+          },
+          {
+            "name": "page",
+            "in": "query",
+            "schema": {
+              "type": "integer",
+              "format": "int64",
+              "minimum": 1,
+              "default": 1
+            },
+            "required": false
+          },
+          {
+            "name": "limit",
+            "in": "query",
+            "schema": {
+              "type": "integer",
+              "format": "int64",
+              "minimum": 1,
+              "maximum": 100,
+              "default": 20
+            },
+            "required": false,
+            "description": "Values outside 1-100 are clamped"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Threads page",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "success": {
+                      "type": "boolean"
+                    },
+                    "data": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/components/schemas/Boxes.MailThread"
+                      }
+                    },
+                    "meta": {
+                      "$ref": "#/components/schemas/Boxes.MailListMeta"
+                    }
+                  },
+                  "required": [
+                    "success",
+                    "data"
+                  ]
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Malformed JSON body or query parameters"
+          },
+          "401": {
+            "description": "Missing or invalid authentication"
+          },
+          "403": {
+            "description": "Missing scope"
+          },
+          "404": {
+            "description": "The agent has no active mailbox in this project"
+          }
+        },
+        "tags": [
+          "boxes"
+        ],
+        "x-genesis-service": "boxes",
+        "x-upstream": {
+          "base": "https://api.boxes.sh",
+          "method": "GET",
+          "path": "/v1/mail/agents/{agentId}/threads",
+          "status": "not_deployed"
+        },
+        "x-mcp": true
+      }
+    },
+    "/v1/boxes/mail/agents/{agentId}/threads/{id}": {
+      "get": {
+        "operationId": "boxes_mail_agents_threads_get",
+        "summary": "As the agent, get a thread with all its messages",
+        "description": "A thread of the agent's own mailbox. Needs boxes:read.",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/Boxes.AgentId"
+          },
+          {
+            "name": "id",
+            "in": "path",
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            },
+            "required": true
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Thread detail",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "success": {
+                      "type": "boolean"
+                    },
+                    "data": {
+                      "$ref": "#/components/schemas/Boxes.MailThreadDetail"
+                    }
+                  },
+                  "required": [
+                    "success",
+                    "data"
+                  ]
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Missing or invalid authentication"
+          },
+          "403": {
+            "description": "Missing scope"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        },
+        "tags": [
+          "boxes"
+        ],
+        "x-genesis-service": "boxes",
+        "x-upstream": {
+          "base": "https://api.boxes.sh",
+          "method": "GET",
+          "path": "/v1/mail/agents/{agentId}/threads/{id}",
+          "status": "not_deployed"
+        },
+        "x-mcp": true
+      }
+    },
+    "/v1/boxes/mail/agents/{agentId}/messages/{id}": {
+      "get": {
+        "operationId": "boxes_mail_agents_messages_get",
+        "summary": "As the agent, get a message with its labels",
+        "description": "A message of the agent's own mailbox. Needs boxes:read.",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/Boxes.AgentId"
+          },
+          {
+            "name": "id",
+            "in": "path",
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            },
+            "required": true
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Message and labels",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "success": {
+                      "type": "boolean"
+                    },
+                    "data": {
+                      "$ref": "#/components/schemas/Boxes.MailMessageWithLabels"
+                    }
+                  },
+                  "required": [
+                    "success",
+                    "data"
+                  ]
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Missing or invalid authentication"
+          },
+          "403": {
+            "description": "Missing scope"
+          },
+          "404": {
+            "description": "Not found"
+          }
+        },
+        "tags": [
+          "boxes"
+        ],
+        "x-genesis-service": "boxes",
+        "x-upstream": {
+          "base": "https://api.boxes.sh",
+          "method": "GET",
+          "path": "/v1/mail/agents/{agentId}/messages/{id}",
+          "status": "not_deployed"
+        },
+        "x-mcp": true
+      }
+    },
     "/v1/brews/create": {
       "post": {
         "operationId": "brews_createBrew",
@@ -131725,6 +132500,86 @@
           }
         }
       },
+      "Auto.McpRequest": {
+        "type": "object",
+        "description": "One JSON-RPC 2.0 message. Omit `id` for a notification.",
+        "required": [
+          "jsonrpc",
+          "method"
+        ],
+        "properties": {
+          "jsonrpc": {
+            "type": "string",
+            "enum": [
+              "2.0"
+            ]
+          },
+          "id": {
+            "type": [
+              "string",
+              "integer"
+            ]
+          },
+          "method": {
+            "type": "string",
+            "examples": [
+              "initialize",
+              "ping",
+              "tools/list",
+              "tools/call",
+              "resources/list",
+              "resources/read"
+            ]
+          },
+          "params": {
+            "type": "object",
+            "additionalProperties": true,
+            "description": "For `tools/call`, `{name, arguments}`; for `resources/read`, `{uri}`."
+          }
+        }
+      },
+      "Auto.McpResponse": {
+        "type": "object",
+        "description": "A JSON-RPC 2.0 response: `result` (for `tools/call`, `{content, structuredContent?, isError?, _meta?}`; for `tools/list`, `{tools}`) or `error` (`{code, message}`).",
+        "required": [
+          "jsonrpc"
+        ],
+        "properties": {
+          "jsonrpc": {
+            "type": "string",
+            "enum": [
+              "2.0"
+            ]
+          },
+          "id": {
+            "type": [
+              "string",
+              "integer",
+              "null"
+            ],
+            "description": "The request's id; absent when a known method was sent without one."
+          },
+          "result": {
+            "type": "object",
+            "additionalProperties": true
+          },
+          "error": {
+            "type": "object",
+            "required": [
+              "code",
+              "message"
+            ],
+            "properties": {
+              "code": {
+                "type": "integer"
+              },
+              "message": {
+                "type": "string"
+              }
+            }
+          }
+        }
+      },
       "Auto.AutoError": {
         "type": "object",
         "required": [
@@ -144217,6 +145072,88 @@
           "updatedAt"
         ]
       },
+      "Boxes.MailAgentCreateRequest": {
+        "type": "object",
+        "additionalProperties": false,
+        "properties": {
+          "agentId": {
+            "type": "string",
+            "pattern": "^(one|a_[0-7][0-9A-HJKMNP-TV-Z]{25})$",
+            "description": "\"one\" or an OpenAgentID a_<ULID>"
+          },
+          "displayName": {
+            "type": "string",
+            "maxLength": 80,
+            "description": "Shown as the sender name; defaults to \"One\" or \"Agent\""
+          }
+        },
+        "required": [
+          "agentId"
+        ]
+      },
+      "Boxes.MailAgentMailbox": {
+        "type": "object",
+        "properties": {
+          "agentId": {
+            "type": "string"
+          },
+          "agentDid": {
+            "type": "string",
+            "description": "did:oas:one:agent:one for One, did:oas:oneos:agent:<ulid> for an OpenAgentID"
+          },
+          "default": {
+            "type": "boolean",
+            "description": "True for One's default mailbox"
+          },
+          "displayName": {
+            "type": "string"
+          },
+          "mailboxId": {
+            "type": "string",
+            "format": "uuid"
+          },
+          "address": {
+            "type": "string",
+            "description": "The mailbox's primary address"
+          },
+          "status": {
+            "type": "string",
+            "enum": [
+              "active",
+              "deleted"
+            ]
+          },
+          "createdAt": {
+            "type": "string",
+            "format": "date-time"
+          }
+        },
+        "required": [
+          "agentId",
+          "agentDid",
+          "default",
+          "displayName",
+          "mailboxId",
+          "address",
+          "status",
+          "createdAt"
+        ]
+      },
+      "Boxes.MailAgentMailboxResponse": {
+        "type": "object",
+        "properties": {
+          "success": {
+            "type": "boolean"
+          },
+          "data": {
+            "$ref": "#/components/schemas/Boxes.MailAgentMailbox"
+          }
+        },
+        "required": [
+          "success",
+          "data"
+        ]
+      },
       "Boxes.MailMailbox": {
         "type": "object",
         "properties": {
@@ -151534,7 +152471,17 @@
           "type": "string",
           "format": "uuid"
         },
-        "description": "Must be a UUID. Optional: the service generates one when absent and rejects a malformed value with 422. Only mail send and agent batch send read it."
+        "description": "Must be a UUID. Optional: the service generates one when absent and rejects a malformed value with 422. Only mail send, agent batch send and agent mailbox send read it."
+      },
+      "Boxes.AgentId": {
+        "name": "agentId",
+        "in": "path",
+        "required": true,
+        "schema": {
+          "type": "string",
+          "pattern": "^(one|a_[0-7][0-9A-HJKMNP-TV-Z]{25})$"
+        },
+        "description": "The agent identity that owns the mailbox. \"one\" is One, the default agent in every project; a_<ULID> is an OpenAgentID enrolled at Auth."
       },
       "Brews.DecisionId": {
         "name": "decisionId",
@@ -151756,9 +152703,9 @@
       "title": "Auto (operating structure)",
       "upstream": "https://auto-808958844152.us-central1.run.app",
       "status": "unverified",
-      "statusNote": "Closed gateway admission behind AUTO_GATEWAY_ENABLED: /v1/auto/* with a v2 signed identity (API key, M2M token or login session); auto:read | auto:write | auto:*. Two POSTs need only auto:read: the authority check (POST /v1/auto/authority/check; a read-only caller gets a dry run) and token verification (POST /v1/auto/authority/verify). Deciding an approval needs the approver principal and refuses M2M tokens. If-Match, Idempotency-Key and ETag pass through unchanged. Auto never runs or controls agents. Auto's verification documents (GET /v1/auto/.well-known/jwks.json, /.well-known/did.json, /credentials/cred_*/status) are anonymous: no credential is read or forwarded and no identity envelope is sent. The plugin service route /v1/auto/internal/v1/authority/* forwards the plugin's own bearer to Auto, which verifies it, and is not described here. POST /v1/auto/mcp and the hosted /approvals/apr_* page are not described here either.",
+      "statusNote": "Closed gateway admission behind AUTO_GATEWAY_ENABLED: /v1/auto/* with a v2 signed identity (API key, M2M token or login session); auto:read | auto:write | auto:*. Three POSTs need only auto:read: the authority check (POST /v1/auto/authority/check; a read-only caller gets a dry run), token verification (POST /v1/auto/authority/verify) and the MCP endpoint (POST /v1/auto/mcp). Deciding an approval needs the approver principal and refuses M2M tokens. If-Match, Idempotency-Key and ETag pass through unchanged. Auto never runs or controls agents. Auto's verification documents (GET /v1/auto/.well-known/jwks.json, /.well-known/did.json, /credentials/cred_*/status) are anonymous: no credential is read or forwarded and no identity envelope is sent. The plugin service route /v1/auto/internal/v1/authority/* forwards the plugin's own bearer to Auto, which verifies it, and is not described here. POST /v1/auto/mcp is Auto's own MCP endpoint (callMcp): one JSON-RPC message per request, auto:read to reach it, each tool checks its own scope. The hosted /approvals/apr_* page is not described here.",
       "gatewayRoute": "dedicated",
-      "operations": 73
+      "operations": 74
     },
     {
       "name": "scopes",
@@ -151821,7 +152768,7 @@
       "status": "not_deployed",
       "statusNote": "Gateway Boxes relay (BOXES_RELAY_ENABLED) admits only a pf_boxes DPoP credential on /v1/boxes/mail today; org API key lane (BOXES_RELAY_KEY_LANE_ENABLED; `genesis login` sessions also need BOXES_RELAY_SESSION_LANE_ENABLED, default off, human-only routes stay HUMAN_REQUIRED) and the other families are not live yet. GET needs boxes:read, everything else boxes:write.",
       "gatewayRoute": "dedicated",
-      "operations": 163
+      "operations": 172
     },
     {
       "name": "brews",