@opengeni/api-router 0.22.2 → 0.26.1

package/src/mcp/server.ts

@@ -1,4 +1,4 @@
-import { createHash } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import {
   CreateScheduledTaskRequest,
   DEFAULT_FIRST_PARTY_MCP_TOOLS,
@@ -12,27 +12,34 @@ import {
   SessionEventResultMode,
   SessionEventSemanticClass,
   SessionEventType,
+  stableJson,
   compactSessionEventResult,
   sessionEventLatestClassToSemanticClass,
+  MemorySlackPublicationDistribution,
   SessionMcpCredentialUpdateInput,
+  ToolAuthNeededPayload,
   VariableSetVariableName,
+  capabilityCatalogItemIsTrustedForExposure,
   type AccessGrant,
+  type CapabilityCatalogItem,
   type GitHubRepository,
   type FirstPartyMcpToolName,
   type Permission,
   type ResourceRef,
   type SessionAuthorizationOperation,
+  type SessionAuthorizationActor,
   type SessionAuthorizationSurface,
   type Session,
+  type ScheduledTask,
   UpdateScheduledTaskRequest,
   normalizeWorkspaceArtifactSlug,
   WORKSPACE_ARTIFACT_HTML_MAX_UTF8_BYTES,
 } from "@opengeni/contracts";
 import {
-  correctWorkspaceMemory,
   countVariableSets,
   beginRigChangeVerificationAttempt,
   createVariableSet,
+  decryptVariableSetValue,
   deleteScheduledTask,
   encryptVariableSetValue,
   getSession,
@@ -56,6 +63,8 @@ import {
   listRigVersionMonitoringSummaries,
   listSocialPosts,
   recordAuditEvent,
+  removeEnrollment,
+  readVariableSetSecretAtomically,
   recordSyncedSocialPosts,
   listVariableSets,
   MEMORY_CORRECT_TOOL_DESCRIPTION,
@@ -63,7 +72,6 @@ import {
   MEMORY_SEARCH_TOOL_DESCRIPTION,
   requireScheduledTask,
   requireSession,
-  saveWorkspaceMemory,
   searchWorkspaceMemories,
   serializeEffectiveSessionControl,
   setSessionGoalStatusWithEvent,
@@ -71,7 +79,6 @@ import {
   updateScheduledTask,
   updateSessionGoalWithEvent,
   upsertSessionGoalWithEvent,
-  RigChangeAlreadyVerifyingError,
   RigChangeTransitionError,
   createWorkspaceArtifact,
   getWorkspaceArtifact,
@@ -80,7 +87,11 @@ import {
   publishWorkspaceArtifactVersion,
   rollbackWorkspaceArtifact,
 } from "@opengeni/db";
-import { appendAndPublishEvents, publishDurableSessionEvents } from "@opengeni/events";
+import {
+  appendAndPublishEvents,
+  appendAndPublishTurnEventsFenced,
+  publishDurableSessionEvents,
+} from "@opengeni/events";
 import {
   createSignedState,
   GitHubAppConfigurationError,
@@ -95,10 +106,18 @@ import type { AnySchema, ZodRawShapeCompat } from "@modelcontextprotocol/sdk/ser
 import type { ToolAnnotations } from "@modelcontextprotocol/sdk/types.js";
 import * as z4 from "zod/v4";
 import {
+  hasLiteralPermission,
   hasPermission,
   authorizedSocialConnectionsForGrant,
+  authorizedAtlassianConnectionsForGrant,
+  buildCapabilityCatalog,
+  nativeConnectionCapabilityRecommendations,
+  correctWorkspaceMemoryWithSlackPublication,
+  requireLiveAgentAttemptAuthorization,
   requireSessionAuthorization,
   requireSessionAuthorizationListScope,
+  saveWorkspaceMemoryWithSlackPublication,
+  searchCapabilityCatalogItems,
   type ResolvedSessionAuthorization,
 } from "@opengeni/core";
 import { recordWorkspaceUsage, requireLimit } from "@opengeni/core";
@@ -110,12 +129,14 @@ import {
 } from "../github-access";
 import { githubBrowserBaseUrl, githubBrowserGrantClaims } from "../github-browser-flow";
 import {
+  assertSocialConnectionProvider,
   socialMentionsLive,
   socialOwnPostsLive,
   socialPostReply,
   socialSearchLive,
   socialThreadLive,
 } from "../integrations/social-api";
+import { revokeKnowledgeSourceScheduleAuthorization } from "../integrations/google-drive";
 import {
   promoteVerifiedDefinitionEditChangeForApi,
   proposeRigChangeForApi,
@@ -132,17 +153,21 @@ import {
   createValidatedScheduledTask,
   manualScheduledTaskTriggerUsageKey,
   manualScheduledTaskTriggerWorkflowId,
+  scheduledTaskForGrant,
+  scheduledTaskRunForGrant,
   scheduledTaskToolsProvided,
   scheduledTaskTriggerToken,
+  ScheduledTaskSyncError,
   syncCreatedScheduledTask,
   syncUpdatedScheduledTask,
+  validateScheduledTaskTarget,
   validatedScheduledTaskUpdate,
 } from "@opengeni/core";
 import {
-  acceptSessionUserMessage,
+  acceptSessionUserMessageWithOutcome,
   controlAgentSessionWorkstream,
   controlHumanSessionWorkstream,
-  createSessionForRequest,
+  createSessionForRequestWithOutcome,
   SessionSpawnDeniedError,
   sessionSpawnDenialEnvelope,
   sendAgentSessionMessage,
@@ -170,18 +195,30 @@ import {
   boundRigDetailMcp,
   SESSION_EVENT_MCP_MAX_BYTES,
 } from "./session-view";
-import type { ToolspaceMcpSurface } from "./toolspace";
+import { mcpMutationReceipt, sessionCreateMutationReceipt } from "./receipts";
+import {
+  boundScheduledTaskDetailMcp,
+  boundScheduledTaskMcpPage,
+  scheduledTaskMcpSummary,
+} from "./scheduled-task-view";
 import { ensureSessionGroupReady as ensureViewerSessionGroupReady } from "../sandbox/viewer";
 import {
   createOpenGeniSlackBotClient,
   resolveSlackBotConnectionForTool,
 } from "../integrations/slack-bot";
+import {
+  browseAtlassianSources,
+  getAtlassianLiveItem,
+  revokeAtlassianScheduleAuthorization,
+  searchAtlassianLive,
+} from "../integrations/atlassian";
+import { AtlassianConnectionMetadata } from "@opengeni/contracts/atlassian";
+import { registerEditableArtifactAgentTools } from "./editable-artifacts";
 
 export type McpServerOptions = {
   // Origin of the HTTP request that reached the MCP route. Browser-oriented
   // tools use it only when no configured public base URL is available.
   requestOrigin?: string | null;
-  toolspace?: ToolspaceMcpSurface | null;
   workspaceMemoryEnabled?: boolean | undefined;
 };
 
@@ -205,13 +242,17 @@ const FIRST_PARTY_TOOL_AUTHORIZATION = {
   memory_search: { sessionRequired: true, allOf: ["documents:search"] },
   memory_save: { sessionRequired: true, allOf: ["documents:search"] },
   memory_correct: { sessionRequired: true, allOf: ["documents:search"] },
-  preference_registry_summary: { sessionRequired: true, allOf: ["workspace:read"] },
+  preference_registry_summary: {
+    sessionRequired: true,
+    allOf: ["workspace:read"],
+  },
   preference_registry_get: { sessionRequired: true, allOf: ["workspace:read"] },
   sandboxes_list: { sessionRequired: true, allOf: ["sessions:read"] },
   sandbox_attach: { sessionRequired: true, allOf: ["sessions:control"] },
   sandbox_swap: { sessionRequired: true, allOf: ["sessions:control"] },
   run_on: { sessionRequired: true, allOf: ["sessions:control"] },
   sandbox_provision: { sessionRequired: true, allOf: ["sessions:control"] },
+  connected_machine_remove: { allOf: ["enrollments:manage"] },
   rig_list: { allOf: ["rigs:use"] },
   rig_get: { allOf: ["rigs:use"] },
   rig_propose_change: { allOf: ["rigs:use"] },
@@ -226,10 +267,35 @@ const FIRST_PARTY_TOOL_AUTHORIZATION = {
   session_resume: { allOf: ["sessions:control"] },
   session_steer: { sessionRequired: true, allOf: ["sessions:control"] },
   set_other_session_title: { allOf: ["sessions:control"] },
-  variable_set_list: { allOf: ["variable-sets:use"] },
-  environment_list: { allOf: ["variable-sets:use"] },
-  variable_set_set_variable: { allOf: ["variable-sets:manage"] },
-  environment_set_variable: { allOf: ["variable-sets:manage"] },
+  interaction_discover: { sessionRequired: true, allOf: ["sessions:read"] },
+  browser_open: { sessionRequired: true, allOf: ["sessions:control"] },
+  browser_tabs: { sessionRequired: true, allOf: ["sessions:control"] },
+  browser_observe: { sessionRequired: true, allOf: ["sessions:read"] },
+  browser_act: { sessionRequired: true, allOf: ["sessions:control"] },
+  browser_debug: { sessionRequired: true, allOf: ["sessions:read"] },
+  browser_identity: { sessionRequired: true, allOf: ["sessions:control"] },
+  browser_publish: { sessionRequired: true, allOf: ["sessions:control"] },
+  browser_lifecycle: { sessionRequired: true, allOf: ["sessions:control"] },
+  computer_open: { sessionRequired: true, allOf: ["sessions:control"] },
+  computer_targets: { sessionRequired: true, allOf: ["sessions:read"] },
+  computer_observe: { sessionRequired: true, allOf: ["sessions:read"] },
+  computer_act: { sessionRequired: true, allOf: ["sessions:control"] },
+  computer_lifecycle: { sessionRequired: true, allOf: ["sessions:control"] },
+  variable_set_list: { allOf: ["variable-sets:list", "secrets:list"] },
+  environment_list: { allOf: ["variable-sets:list", "secrets:list"] },
+  variable_set_get_variable: {
+    sessionRequired: true,
+    allOf: ["variable-sets:read", "secrets:read"],
+  },
+  variable_set_set_variable: {
+    allOf: ["variable-sets:write", "secrets:write"],
+  },
+  environment_set_variable: { allOf: ["variable-sets:write", "secrets:write"] },
+  capability_catalog_search: { sessionRequired: true, allOf: ["workspace:read"] },
+  capability_authorization_request: {
+    sessionRequired: true,
+    allOf: ["workspace:read"],
+  },
   github_connect_link: { allOf: ["github:use"] },
   github_repositories_list: { allOf: ["github:use"] },
   social_connections_list: { allOf: ["connections:read"] },
@@ -244,15 +310,33 @@ const FIRST_PARTY_TOOL_AUTHORIZATION = {
   // Publishes under the user's identity: connections:write keeps it out of the
   // default agent permission set, unlike the read-only social tools above.
   social_post_reply: { allOf: ["connections:write"] },
-  scheduled_tasks_list: { anyOf: ["scheduled_tasks:manage", "scheduled_tasks:run"] },
-  scheduled_tasks_get: { anyOf: ["scheduled_tasks:manage", "scheduled_tasks:run"] },
+  x_accounts_list: { allOf: ["connections:read"] },
+  x_search_live: { allOf: ["connections:read"] },
+  x_mentions_live: { allOf: ["connections:read"] },
+  x_thread_fetch: { allOf: ["connections:read"] },
+  x_posts_sync: { allOf: ["connections:write"] },
+  x_post_reply: { allOf: ["connections:write"] },
+  reddit_accounts_list: { allOf: ["connections:read"] },
+  reddit_search_live: { allOf: ["connections:read"] },
+  reddit_mentions_live: { allOf: ["connections:read"] },
+  reddit_thread_fetch: { allOf: ["connections:read"] },
+  reddit_posts_sync: { allOf: ["connections:write"] },
+  reddit_post_reply: { allOf: ["connections:write"] },
+  scheduled_tasks_list: {
+    anyOf: ["scheduled_tasks:manage", "scheduled_tasks:run"],
+  },
+  scheduled_tasks_get: {
+    anyOf: ["scheduled_tasks:manage", "scheduled_tasks:run"],
+  },
   scheduled_tasks_create: { allOf: ["scheduled_tasks:manage"] },
   scheduled_tasks_update: { allOf: ["scheduled_tasks:manage"] },
   scheduled_tasks_pause: { allOf: ["scheduled_tasks:manage"] },
   scheduled_tasks_resume: { allOf: ["scheduled_tasks:manage"] },
   scheduled_tasks_trigger: { allOf: ["scheduled_tasks:run"] },
   scheduled_tasks_delete: { allOf: ["scheduled_tasks:manage"] },
-  scheduled_task_runs_list: { anyOf: ["scheduled_tasks:manage", "scheduled_tasks:run"] },
+  scheduled_task_runs_list: {
+    anyOf: ["scheduled_tasks:manage", "scheduled_tasks:run"],
+  },
   slack_bot_list_channels: { allOf: ["connections:read"] },
   slack_bot_channel_history: { allOf: ["connections:read"] },
   slack_bot_thread_replies: { allOf: ["connections:read"] },
@@ -262,11 +346,31 @@ const FIRST_PARTY_TOOL_AUTHORIZATION = {
   slack_bot_file_content: { allOf: ["connections:read"] },
   slack_bot_post_message: { allOf: ["connections:read"] },
   slack_bot_delete_message: { allOf: ["connections:read"] },
+  atlassian_sources_list: { allOf: ["connections:read"] },
+  atlassian_search: { allOf: ["connections:read"] },
+  atlassian_get: { allOf: ["connections:read"] },
   artifacts_list: { sessionRequired: true, allOf: ["artifacts:read"] },
   artifacts_get_source: { sessionRequired: true, allOf: ["artifacts:read"] },
   artifacts_create: { sessionRequired: true, allOf: ["artifacts:publish"] },
   artifacts_publish: { sessionRequired: true, allOf: ["artifacts:publish"] },
   artifacts_rollback: { sessionRequired: true, allOf: ["artifacts:publish"] },
+  editable_artifact_list: { sessionRequired: true, allOf: ["artifacts:read"] },
+  editable_artifact_create: { sessionRequired: true, allOf: ["artifacts:publish"] },
+  editable_artifact_import: {
+    sessionRequired: true,
+    allOf: ["artifacts:publish", "files:read"],
+  },
+  editable_artifact_get: { sessionRequired: true, allOf: ["artifacts:read"] },
+  editable_artifact_inspect: { sessionRequired: true, allOf: ["artifacts:read"] },
+  editable_artifact_apply: { sessionRequired: true, allOf: ["artifacts:publish"] },
+  editable_artifact_export: {
+    sessionRequired: true,
+    allOf: ["artifacts:read"],
+  },
+  editable_artifact_export_status: {
+    sessionRequired: true,
+    allOf: ["artifacts:read", "files:upload"],
+  },
 } satisfies Record<FirstPartyMcpToolName, FirstPartyToolAuthorization>;
 
 const FIRST_PARTY_MCP_TOOL_NAME_SET = new Set<string>(FIRST_PARTY_MCP_TOOL_NAMES);
@@ -278,7 +382,6 @@ class PolicyMcpServer extends McpServer {
     private readonly grant: AccessGrant,
     private readonly sessionId: string | null,
     private readonly selectedTools: ReadonlySet<FirstPartyMcpToolName> | null,
-    private readonly allowUncatalogued: boolean,
   ) {
     super({ name: "opengeni", version: "1.0.0" });
   }
@@ -299,7 +402,7 @@ class PolicyMcpServer extends McpServer {
     cb: ToolCallback<InputArgs>,
   ): RegisteredTool {
     const catalogued = FIRST_PARTY_MCP_TOOL_NAME_SET.has(name);
-    let admitted = this.allowUncatalogued && !catalogued;
+    let admitted = false;
     if (catalogued) {
       const toolName = name as FirstPartyMcpToolName;
       const policy: FirstPartyToolAuthorization = FIRST_PARTY_TOOL_AUTHORIZATION[toolName];
@@ -356,7 +459,6 @@ export function buildOpenGeniMcpServer(
     content: [{ type: "text" as const, text: JSON.stringify(value, null, 2) }],
   });
   const can = (permission: Permission) => hasPermission(grant.permissions, permission);
-  const toolspaceMode = options.toolspace != null;
   let socialConnectionsPromise: ReturnType<typeof authorizedSocialConnectionsForGrant> | undefined;
   const authorizedSocialConnections = () =>
     (socialConnectionsPromise ??= authorizedSocialConnectionsForGrant({
@@ -371,6 +473,14 @@ export function buildOpenGeniMcpServer(
     if (!authority) throw new Error(`Unknown or unavailable social connection: ${connectionId}`);
     return authority;
   };
+  const requireAuthorizedSocialConnectionForProvider = async (
+    provider: "x" | "reddit",
+    connectionId: string,
+  ) => {
+    const authority = await requireAuthorizedSocialConnection(connectionId);
+    assertSocialConnectionProvider(authority.connection, provider);
+    return authority;
+  };
 
   // Session-scoped tools key off the worker-asserted sessionId claim (signed
   // into the delegated token by the worker, never agent-controlled).
@@ -379,17 +489,17 @@ export function buildOpenGeniMcpServer(
       ? (grant.metadata["sessionId"] as string)
       : null;
   const selectedTools =
-    sessionId !== null && !toolspaceMode
+    sessionId !== null
       ? new Set(
           (grant.metadata?.["firstPartyMcpTools"] as FirstPartyMcpToolName[] | undefined) ??
             DEFAULT_FIRST_PARTY_MCP_TOOLS,
         )
       : null;
-  const server = new PolicyMcpServer(grant, sessionId, selectedTools, toolspaceMode);
+  const server = new PolicyMcpServer(grant, sessionId, selectedTools);
   // set_session_title names the agent's OWN session — pure session metadata,
   // not a goal operation — so it is available on every session, gated only on
   // the signed sessionId (NOT goals:manage, and NOT on a goal existing).
-  if (sessionId !== null && (!toolspaceMode || can("sessions:control"))) {
+  if (sessionId !== null) {
     server.registerTool(
       "set_session_title",
       {
@@ -412,18 +522,23 @@ export function buildOpenGeniMcpServer(
   if (sessionId !== null && can("goals:manage")) {
     registerGoalTools(server, deps, grant, sessionId, json);
   }
-  // Toolspace grants are the sandbox's narrowed proxy surface. Unlike the
-  // normal first-party worker token, a bare toolspace:call token does not see
-  // unpermissioned session tools; memory follows that title/goal parity and
-  // stays on the normal first-party MCP surface only.
-  if (!toolspaceMode && sessionId !== null && options.workspaceMemoryEnabled === true) {
+  if (sessionId !== null && options.workspaceMemoryEnabled === true) {
     registerMemoryTools(server, deps, grant, sessionId, json);
   }
-  if (!toolspaceMode && sessionId !== null && preferenceAttemptClaims(grant) !== null) {
+  if (sessionId !== null && exactAgentAttemptClaims(grant) !== null) {
     registerPreferenceRegistryTools(server, deps, grant, json);
   }
-  if (!toolspaceMode && sessionId !== null && preferenceAttemptClaims(grant) !== null) {
+  if (sessionId !== null && exactAgentAttemptClaims(grant) !== null) {
     registerWorkspaceArtifactTools(server, deps, grant, sessionId, json);
+    registerEditableArtifactAgentTools({
+      server,
+      deps,
+      grant,
+      sessionId,
+      authorize: async () => {
+        await authorizeFirstPartySession(deps, grant, sessionId, "session.first_party_mcp.call");
+      },
+    });
   }
 
   // Fleet tools (M7 bring-your-own-compute): list / attach / swap / run_on /
@@ -432,13 +547,15 @@ export function buildOpenGeniMcpServer(
   // so they register only when the grant carries the worker-signed sessionId claim
   // (never agent-controlled). Gated on the selfhosted feature flag: the active
   // pointer + swap are only meaningful when bring-your-own-compute is enabled.
-  if (!toolspaceMode && sessionId !== null && deps.settings.sandboxSelfhostedEnabled) {
+  if (sessionId !== null && deps.settings.sandboxSelfhostedEnabled) {
     registerFleetTools(server, deps, grant, sessionId, json);
   }
-  if (!toolspaceMode) {
-    registerRigTools(server, deps, grant, can, sessionId, json);
-    registerSlackBotTools(server, deps, grant, sessionId, json);
+  if (can("enrollments:manage") && deps.settings.sandboxSelfhostedEnabled) {
+    registerConnectedMachineTools(server, deps, grant, json);
   }
+  registerRigTools(server, deps, grant, can, sessionId, json);
+  registerSlackBotTools(server, deps, grant, sessionId, json);
+  registerAtlassianTools(server, deps, grant, json);
 
   // Orchestration, variableSet, and GitHub status tools are permission-gated
   // at registration: a grant without the permission does not see the tool.
@@ -451,13 +568,16 @@ export function buildOpenGeniMcpServer(
   // never returned through a model-visible MCP tool. A user DEMOTES a specific
   // session by setting a narrower session.firstPartyMcpPermissions (capped to
   // the creator's own grant); operators still cap what any session can be given.
-  registerWorkspaceOrchestrationTools(server, deps, grant, can, sessionId, toolspaceMode, json);
-  registerVariableSetTools(server, deps, grant, can, json);
+  registerWorkspaceOrchestrationTools(server, deps, grant, can, sessionId, json);
+  registerVariableSetTools(server, deps, grant, can, sessionId, json);
+  if (sessionId !== null && can("workspace:read")) {
+    registerCapabilityDiscoveryTools(server, deps, grant, sessionId, json);
+  }
   if (can("github:use")) {
     registerGitHubConnectTool(server, deps, grant, options, json);
   }
 
-  if (!toolspaceMode || can("github:use")) {
+  if (can("github:use")) {
     server.registerTool(
       "github_repositories_list",
       {
@@ -486,7 +606,7 @@ export function buildOpenGeniMcpServer(
     );
   }
 
-  if (!toolspaceMode || can("connections:read")) {
+  if (can("connections:read")) {
     server.registerTool(
       "social_connections_list",
       {
@@ -620,10 +740,17 @@ export function buildOpenGeniMcpServer(
         const authority = await requireAuthorizedSocialConnection(connectionId);
         const result = await socialSearchLive(
           deps,
-          { workspaceId: grant.workspaceId, connectionId, subjectId: authority.subjectId },
+          {
+            workspaceId: grant.workspaceId,
+            connectionId,
+            subjectId: authority.subjectId,
+          },
           { query, subreddit, limit },
         );
-        return json({ provider: result.connection.provider, posts: result.posts });
+        return json({
+          provider: result.connection.provider,
+          posts: result.posts,
+        });
       },
     );
 
@@ -642,10 +769,17 @@ export function buildOpenGeniMcpServer(
         const authority = await requireAuthorizedSocialConnection(connectionId);
         const result = await socialMentionsLive(
           deps,
-          { workspaceId: grant.workspaceId, connectionId, subjectId: authority.subjectId },
+          {
+            workspaceId: grant.workspaceId,
+            connectionId,
+            subjectId: authority.subjectId,
+          },
           { sinceId, limit },
         );
-        return json({ provider: result.connection.provider, posts: result.posts });
+        return json({
+          provider: result.connection.provider,
+          posts: result.posts,
+        });
       },
     );
 
@@ -664,18 +798,135 @@ export function buildOpenGeniMcpServer(
         const authority = await requireAuthorizedSocialConnection(connectionId);
         const result = await socialThreadLive(
           deps,
-          { workspaceId: grant.workspaceId, connectionId, subjectId: authority.subjectId },
+          {
+            workspaceId: grant.workspaceId,
+            connectionId,
+            subjectId: authority.subjectId,
+          },
           { id, limit },
         );
-        return json({ provider: result.connection.provider, posts: result.posts });
+        return json({
+          provider: result.connection.provider,
+          posts: result.posts,
+        });
       },
     );
+
+    // Provider-scoped aliases are the canonical tools advertised by the X and
+    // Reddit Integration cards. The legacy social_* names remain available to
+    // existing Packs/sessions, but these names bind the provider in the tool
+    // identity and reject a near-identical Connection from the other adapter.
+    for (const provider of ["x", "reddit"] as const) {
+      const providerName = provider === "x" ? "X" : "Reddit";
+      server.registerTool(
+        `${provider}_accounts_list`,
+        {
+          description: `List the exact visible ${providerName} accounts available to this work.`,
+          inputSchema: { limit: z4.number().int().positive().optional() },
+        },
+        async ({ limit }) =>
+          json({
+            connections: (await authorizedSocialConnections())
+              .filter(
+                ({ connection }) =>
+                  connection.provider === provider && connection.status !== "disabled",
+              )
+              .slice(0, boundedMcpLimit(limit))
+              .map(({ connection }) => connection),
+          }),
+      );
+      server.registerTool(
+        `${provider}_search_live`,
+        {
+          description:
+            provider === "x"
+              ? "Search recent X conversations through one exact connected X account."
+              : "Search Reddit through one exact connected Reddit account; optionally scope to a subreddit.",
+          inputSchema: {
+            connectionId: z4.string().uuid(),
+            query: z4.string().min(1).max(512),
+            subreddit: z4.string().min(1).max(100).optional(),
+            limit: z4.number().int().positive().optional(),
+          },
+        },
+        async ({ connectionId, query, subreddit, limit }) => {
+          const authority = await requireAuthorizedSocialConnectionForProvider(
+            provider,
+            connectionId,
+          );
+          const result = await socialSearchLive(
+            deps,
+            {
+              workspaceId: grant.workspaceId,
+              connectionId,
+              subjectId: authority.subjectId,
+            },
+            { query, subreddit, limit },
+          );
+          return json({ provider: result.connection.provider, posts: result.posts });
+        },
+      );
+      server.registerTool(
+        `${provider}_mentions_live`,
+        {
+          description: `Fetch live ${providerName} mentions and replies through one exact connected account.`,
+          inputSchema: {
+            connectionId: z4.string().uuid(),
+            sinceId: z4.string().optional(),
+            limit: z4.number().int().positive().optional(),
+          },
+        },
+        async ({ connectionId, sinceId, limit }) => {
+          const authority = await requireAuthorizedSocialConnectionForProvider(
+            provider,
+            connectionId,
+          );
+          const result = await socialMentionsLive(
+            deps,
+            {
+              workspaceId: grant.workspaceId,
+              connectionId,
+              subjectId: authority.subjectId,
+            },
+            { sinceId, limit },
+          );
+          return json({ provider: result.connection.provider, posts: result.posts });
+        },
+      );
+      server.registerTool(
+        `${provider}_thread_fetch`,
+        {
+          description: `Fetch one live ${providerName} conversation thread through an exact connected account.`,
+          inputSchema: {
+            connectionId: z4.string().uuid(),
+            id: z4.string().min(1).max(100),
+            limit: z4.number().int().positive().optional(),
+          },
+        },
+        async ({ connectionId, id, limit }) => {
+          const authority = await requireAuthorizedSocialConnectionForProvider(
+            provider,
+            connectionId,
+          );
+          const result = await socialThreadLive(
+            deps,
+            {
+              workspaceId: grant.workspaceId,
+              connectionId,
+              subjectId: authority.subjectId,
+            },
+            { id, limit },
+          );
+          return json({ provider: result.connection.provider, posts: result.posts });
+        },
+      );
+    }
   }
 
   // Writes are gated on connections:write (never in the default first-party
   // agent permission set) so scheduled tasks must opt in, and deployments can
   // additionally wrap posting in a requireApproval policy.
-  if (!toolspaceMode || can("connections:write")) {
+  if (can("connections:write")) {
     server.registerTool(
       "social_posts_sync",
       {
@@ -690,7 +941,11 @@ export function buildOpenGeniMcpServer(
         const authority = await requireAuthorizedSocialConnection(connectionId);
         const result = await socialOwnPostsLive(
           deps,
-          { workspaceId: grant.workspaceId, connectionId, subjectId: authority.subjectId },
+          {
+            workspaceId: grant.workspaceId,
+            connectionId,
+            subjectId: authority.subjectId,
+          },
           { limit },
         );
         // A post without a provider timestamp is skipped rather than recorded
@@ -736,7 +991,11 @@ export function buildOpenGeniMcpServer(
         const authority = await requireAuthorizedSocialConnection(connectionId);
         const result = await socialPostReply(
           deps,
-          { workspaceId: grant.workspaceId, connectionId, subjectId: authority.subjectId },
+          {
+            workspaceId: grant.workspaceId,
+            connectionId,
+            subjectId: authority.subjectId,
+          },
           { inReplyToId, text },
         );
         // Outbound publishes leave a durable, secret-free receipt (house
@@ -763,28 +1022,150 @@ export function buildOpenGeniMcpServer(
         });
       },
     );
+
+    for (const provider of ["x", "reddit"] as const) {
+      const providerName = provider === "x" ? "X" : "Reddit";
+      server.registerTool(
+        `${provider}_posts_sync`,
+        {
+          description: `Sync one exact connected ${providerName} account's recent posts into OpenGeni (idempotent).`,
+          inputSchema: {
+            connectionId: z4.string().uuid(),
+            limit: z4.number().int().positive().optional(),
+          },
+        },
+        async ({ connectionId, limit }) => {
+          const authority = await requireAuthorizedSocialConnectionForProvider(
+            provider,
+            connectionId,
+          );
+          const result = await socialOwnPostsLive(
+            deps,
+            {
+              workspaceId: grant.workspaceId,
+              connectionId,
+              subjectId: authority.subjectId,
+            },
+            { limit },
+          );
+          const datedPosts = result.posts.filter((post) => post.createdAt !== null);
+          const synced = await recordSyncedSocialPosts(deps.db, {
+            accountId: grant.accountId,
+            workspaceId: grant.workspaceId,
+            connectionId,
+            subjectId: authority.subjectId,
+            posts: datedPosts.map((post) => ({
+              externalPostId: post.id,
+              url: post.url,
+              authorHandle: post.author,
+              text: post.text,
+              publishedAt: new Date(post.createdAt!),
+              metrics: post.metrics,
+            })),
+          });
+          return json({
+            provider: result.connection.provider,
+            fetched: result.posts.length,
+            inserted: synced.inserted,
+            skipped: synced.skipped,
+            skippedMissingDate: result.posts.length - datedPosts.length,
+          });
+        },
+      );
+      server.registerTool(
+        `${provider}_post_reply`,
+        {
+          description: `Publish a reply from one exact connected ${providerName} account. This is a public write and should require approval.`,
+          inputSchema: {
+            connectionId: z4.string().uuid(),
+            inReplyToId: z4.string().min(1).max(100),
+            text: z4.string().min(1).max(10000),
+          },
+        },
+        async ({ connectionId, inReplyToId, text }) => {
+          const authority = await requireAuthorizedSocialConnectionForProvider(
+            provider,
+            connectionId,
+          );
+          const result = await socialPostReply(
+            deps,
+            {
+              workspaceId: grant.workspaceId,
+              connectionId,
+              subjectId: authority.subjectId,
+            },
+            { inReplyToId, text },
+          );
+          await recordAuditEvent(deps.db, {
+            accountId: grant.accountId,
+            workspaceId: grant.workspaceId,
+            subjectId: grant.subjectId,
+            action: "social.post_reply",
+            targetType: "social_connection",
+            targetId: connectionId,
+            metadata: {
+              provider: result.connection.provider,
+              adapterTool: `${provider}_post_reply`,
+              inReplyToId,
+              postedId: result.postedId,
+              url: result.url,
+            },
+          });
+          return json({
+            provider: result.connection.provider,
+            postedId: result.postedId,
+            url: result.url,
+          });
+        },
+      );
+    }
   }
 
-  if (!toolspaceMode || can("scheduled_tasks:manage") || can("scheduled_tasks:run")) {
+  if (can("scheduled_tasks:manage") || can("scheduled_tasks:run")) {
     server.registerTool(
       "scheduled_tasks_list",
       {
-        description: "List scheduled tasks.",
-        inputSchema: { limit: z4.number().int().positive().optional() },
+        description:
+          "List compact scheduled-task summaries. Prompts, goal text, resource/tool bodies, and metadata values are represented by byte/count facts; page with offset and use scheduled_tasks_get for a bounded explicit detail projection.",
+        inputSchema: {
+          limit: z4.number().int().positive().max(50).optional(),
+          offset: z4.number().int().nonnegative().max(10_000).optional(),
+        },
+      },
+      async ({ limit: requestedLimit, offset: requestedOffset }) => {
+        const limit = requestedLimit ?? 25;
+        const offset = requestedOffset ?? 0;
+        const rows = await listScheduledTasks(deps.db, grant.workspaceId, limit + 1, offset);
+        return json(
+          boundScheduledTaskMcpPage({
+            tasks: rows.slice(0, limit).map((task) => scheduledTaskForGrant(task, grant)),
+            limit,
+            offset,
+            sourceHasMore: rows.length > limit,
+          }),
+        );
       },
-      async ({ limit }) =>
-        json({
-          tasks: await listScheduledTasks(deps.db, grant.workspaceId, limit ?? 100),
-        }),
     );
 
     server.registerTool(
       "scheduled_tasks_get",
       {
-        description: "Get one scheduled task.",
-        inputSchema: { id: z4.string().uuid() },
+        description:
+          "Get one scheduled task. The default is the same compact summary used by scheduled_tasks_list; pass includeEntity=true for a bounded projection with an 8 KiB prompt preview, bounded goal fields, resource/tool identity previews, and metadata keys without values.",
+        inputSchema: {
+          id: z4.string().uuid(),
+          includeEntity: z4.boolean().optional(),
+        },
+      },
+      async ({ id, includeEntity }) => {
+        const task = scheduledTaskForGrant(
+          await requireScheduledTask(deps.db, grant.workspaceId, id),
+          grant,
+        );
+        return json(
+          includeEntity ? boundScheduledTaskDetailMcp(task) : scheduledTaskMcpSummary(task),
+        );
       },
-      async ({ id }) => json(await requireScheduledTask(deps.db, grant.workspaceId, id)),
     );
 
     server.registerTool(
@@ -795,6 +1176,7 @@ export function buildOpenGeniMcpServer(
           name: z4.string(),
           schedule: z4.unknown(),
           runMode: z4.string().optional(),
+          targetSessionId: z4.string().uuid().nullable().optional(),
           overlapPolicy: z4.string().optional(),
           agentConfig: z4.unknown(),
           status: z4.string().optional(),
@@ -823,13 +1205,29 @@ export function buildOpenGeniMcpServer(
           grant,
           payload,
           toolsProvided: scheduledTaskToolsProvided(args),
+          sessionAuthorization: deps.sessionAuthorization,
+          authorizationSurface: "first_party_mcp",
         });
-        await syncCreatedScheduledTask({
-          db: deps.db,
-          workflowClient: deps.workflowClient,
-          task,
-        });
-        return json(task);
+        try {
+          await syncCreatedScheduledTask({
+            db: deps.db,
+            workflowClient: deps.workflowClient,
+            task,
+          });
+        } catch (error) {
+          if (!(error instanceof ScheduledTaskSyncError) || error.persistenceRestored) {
+            throw error;
+          }
+          return json(
+            scheduledTaskReceipt("scheduled_tasks_create", task, "partial_failure", true, {
+              partialFailure: { stage: "schedule_sync", retryable: true },
+              warnings: [
+                "The task database record committed, but Temporal schedule synchronization failed.",
+              ],
+            }),
+          );
+        }
+        return json(scheduledTaskReceipt("scheduled_tasks_create", task, "created", true));
       },
     );
 
@@ -842,6 +1240,7 @@ export function buildOpenGeniMcpServer(
           name: z4.string().optional(),
           schedule: z4.unknown().optional(),
           runMode: z4.string().optional(),
+          targetSessionId: z4.string().uuid().nullable().optional(),
           overlapPolicy: z4.string().optional(),
           agentConfig: z4.unknown().optional(),
           status: z4.string().optional(),
@@ -867,7 +1266,12 @@ export function buildOpenGeniMcpServer(
           existing,
           payload,
           toolsProvided: scheduledTaskToolsProvided(raw),
+          sessionAuthorization: deps.sessionAuthorization,
+          authorizationSurface: "first_party_mcp",
         });
+        if (!scheduledTaskUpdateChangesState(existing, update)) {
+          return json(scheduledTaskReceipt("scheduled_tasks_update", existing, "unchanged", false));
+        }
         const task = await updateScheduledTask(deps.db, grant.workspaceId, id, update);
         await syncUpdatedScheduledTask({
           db: deps.db,
@@ -875,7 +1279,7 @@ export function buildOpenGeniMcpServer(
           previous,
           task,
         });
-        return json(task);
+        return json(scheduledTaskReceipt("scheduled_tasks_update", task, "updated", true));
       },
     );
 
@@ -887,6 +1291,9 @@ export function buildOpenGeniMcpServer(
       },
       async ({ id }) => {
         const existing = await requireScheduledTask(deps.db, grant.workspaceId, id);
+        if (existing.status === "paused") {
+          return json(scheduledTaskReceipt("scheduled_tasks_pause", existing, "unchanged", false));
+        }
         const previous = await captureScheduledTaskRestoreState(deps.db, existing);
         const task = await updateScheduledTask(deps.db, grant.workspaceId, id, {
           status: "paused",
@@ -897,7 +1304,7 @@ export function buildOpenGeniMcpServer(
           previous,
           task,
         });
-        return json(task);
+        return json(scheduledTaskReceipt("scheduled_tasks_pause", task, "updated", true));
       },
     );
 
@@ -909,6 +1316,9 @@ export function buildOpenGeniMcpServer(
       },
       async ({ id }) => {
         const existing = await requireScheduledTask(deps.db, grant.workspaceId, id);
+        if (existing.status === "active") {
+          return json(scheduledTaskReceipt("scheduled_tasks_resume", existing, "unchanged", false));
+        }
         const previous = await captureScheduledTaskRestoreState(deps.db, existing);
         const task = await updateScheduledTask(deps.db, grant.workspaceId, id, {
           status: "active",
@@ -919,7 +1329,7 @@ export function buildOpenGeniMcpServer(
           previous,
           task,
         });
-        return json(task);
+        return json(scheduledTaskReceipt("scheduled_tasks_resume", task, "updated", true));
       },
     );
 
@@ -935,19 +1345,32 @@ export function buildOpenGeniMcpServer(
       },
       async ({ id, triggerId }) => {
         const task = await requireScheduledTask(deps.db, grant.workspaceId, id);
-        await requireLimit(deps, {
-          accountId: grant.accountId,
-          workspaceId: grant.workspaceId,
-          action: "agent_run:create",
-          quantity: 1,
-          model: task.agentConfig.model ?? deps.settings.openaiModel,
-        });
+        if (task.action.kind === "agent_turn") {
+          await validateScheduledTaskTarget({
+            db: deps.db,
+            sessionAuthorization: deps.sessionAuthorization,
+            authorizationSurface: "first_party_mcp",
+            grant,
+            targetSessionId: task.targetSessionId,
+            runMode: task.runMode,
+            variableSetId: task.variableSetId,
+            rigId: task.rigId,
+            agentConfig: task.agentConfig,
+            missingTargetStatus: 404,
+          });
+          await requireLimit(deps, {
+            accountId: grant.accountId,
+            workspaceId: grant.workspaceId,
+            action: "agent_run:create",
+            quantity: 1,
+            model: task.agentConfig.model ?? deps.settings.openaiModel,
+          });
+        }
         const triggerToken = scheduledTaskTriggerToken(triggerId);
-        const agentRunUsageIdempotencyKey = manualScheduledTaskTriggerUsageKey(
-          grant.workspaceId,
-          task.id,
-          triggerToken,
-        );
+        const agentRunUsageIdempotencyKey =
+          task.action.kind === "agent_turn"
+            ? manualScheduledTaskTriggerUsageKey(grant.workspaceId, task.id, triggerToken)
+            : `knowledge-source-sync:manual:${grant.workspaceId}:${task.id}:${triggerToken}`;
         const triggerWorkflowId = manualScheduledTaskTriggerWorkflowId(task.id, triggerToken);
         await deps.workflowClient.triggerScheduledTask({
           task,
@@ -955,18 +1378,44 @@ export function buildOpenGeniMcpServer(
           triggerWorkflowId,
           initiator: { kind: "subject", subjectId: grant.subjectId },
         });
-        await recordWorkspaceUsage(deps, {
-          accountId: grant.accountId,
-          workspaceId: grant.workspaceId,
-          subjectId: grant.subjectId,
-          eventType: "agent_run.created",
-          quantity: 1,
-          unit: "run",
-          sourceResourceType: "scheduled_task",
-          sourceResourceId: task.id,
-          idempotencyKey: agentRunUsageIdempotencyKey,
-        });
-        return json(task);
+        try {
+          if (task.action.kind !== "agent_turn") {
+            return json(
+              scheduledTaskReceipt("scheduled_tasks_trigger", task, "triggered", true, {
+                idempotencyStatus: triggerId ? "unknown" : "not_requested",
+                facts: { triggerWorkflowId },
+              }),
+            );
+          }
+          await recordWorkspaceUsage(deps, {
+            accountId: grant.accountId,
+            workspaceId: grant.workspaceId,
+            subjectId: grant.subjectId,
+            eventType: "agent_run.created",
+            quantity: 1,
+            unit: "run",
+            sourceResourceType: "scheduled_task",
+            sourceResourceId: task.id,
+            idempotencyKey: agentRunUsageIdempotencyKey,
+          });
+        } catch {
+          return json(
+            scheduledTaskReceipt("scheduled_tasks_trigger", task, "partial_failure", true, {
+              partialFailure: { stage: "usage_recording", retryable: true },
+              warnings: [
+                "The Temporal run trigger completed, but usage recording failed; retry with the same triggerId.",
+              ],
+              idempotencyStatus: triggerId ? "unknown" : "not_requested",
+              facts: { triggerWorkflowId },
+            }),
+          );
+        }
+        return json(
+          scheduledTaskReceipt("scheduled_tasks_trigger", task, "triggered", true, {
+            idempotencyStatus: triggerId ? "unknown" : "not_requested",
+            facts: { triggerWorkflowId },
+          }),
+        );
       },
     );
 
@@ -978,11 +1427,42 @@ export function buildOpenGeniMcpServer(
       },
       async ({ id }) => {
         const task = await requireScheduledTask(deps.db, grant.workspaceId, id);
+        if (task.metadata.connectorKind === "atlassian") {
+          await revokeAtlassianScheduleAuthorization(deps, {
+            task,
+            subjectId: grant.subjectId,
+          });
+        } else {
+          await revokeKnowledgeSourceScheduleAuthorization(deps, {
+            task,
+            subjectId: grant.subjectId,
+          });
+        }
         await deps.workflowClient.deleteScheduledTaskSchedule({
           temporalScheduleId: task.temporalScheduleId,
         });
-        await deleteScheduledTask(deps.db, grant.workspaceId, id);
-        return json({ ok: true });
+        try {
+          await deleteScheduledTask(deps.db, grant.workspaceId, id);
+        } catch {
+          return json(
+            scheduledTaskReceipt("scheduled_tasks_delete", task, "partial_failure", true, {
+              partialFailure: { stage: "database_delete", retryable: true },
+              warnings: [
+                "The Temporal schedule was deleted, but the task database record remains.",
+              ],
+            }),
+          );
+        }
+        return json(
+          mcpMutationReceipt({
+            operation: "scheduled_tasks_delete",
+            committed: true,
+            outcome: "deleted",
+            changed: true,
+            resource: { type: "scheduled_task", id: task.id, state: "deleted" },
+            idempotency: { status: "not_supported" },
+          }),
+        );
       },
     );
 
@@ -997,12 +1477,13 @@ export function buildOpenGeniMcpServer(
       },
       async ({ taskId, limit }) =>
         json({
-          runs: await listScheduledTaskRuns(deps.db, grant.workspaceId, taskId, limit ?? 100),
+          runs: (await listScheduledTaskRuns(deps.db, grant.workspaceId, taskId, limit ?? 100)).map(
+            (run) => scheduledTaskRunForGrant(run, grant),
+          ),
         }),
     );
   }
 
-  registerToolspaceProxyTools(server, options.toolspace ?? null);
   server.ensureToolsListHandler();
 
   return server;
@@ -1243,54 +1724,120 @@ function registerSlackBotTools(
   );
 }
 
-function registerToolspaceProxyTools(server: McpServer, surface: ToolspaceMcpSurface | null): void {
-  if (!surface) {
-    return;
-  }
-  // McpServer installs its tools/list handler lazily on the first registered
-  // tool. A legitimate empty Toolspace surface (no selected proxyable servers,
-  // no active turn, or all optional upstreams unavailable) must therefore seed
-  // and disable one invisible tool; otherwise `ogtool list` receives JSON-RPC
-  // "Method not found" instead of the valid `{ tools: [] }` response.
-  if (surface.tools.length === 0) {
-    server
-      .registerTool(
-        "__opengeni_empty_toolspace_surface__",
-        {
-          description: "Internal disabled placeholder for an empty Toolspace surface.",
-          inputSchema: z4.object({}),
-        },
-        async () => ({
-          content: [{ type: "text" as const, text: '{"unavailable":true}' }],
-        }),
-      )
-      .disable();
-    return;
-  }
-  for (const tool of surface.tools) {
-    server.registerTool(
-      tool.name,
-      {
-        ...(tool.description ? { description: tool.description } : {}),
-        inputSchema: z4.object({}).passthrough(),
-        _meta: {
-          opengeni: {
-            origin: "toolspace",
-            subjectId: surface.subjectId,
-            sessionId: surface.sessionId,
-            ...(tool.inputSchema ? { inputSchema: tool.inputSchema } : {}),
-          },
-        },
-      },
-      async (args) => await tool.call(args),
+function registerAtlassianTools(
+  server: McpServer,
+  deps: ApiRouteDeps,
+  grant: AccessGrant,
+  json: JsonResult,
+): void {
+  const connectionFor = async (connectionId?: string) => {
+    const authorized = await authorizedAtlassianConnectionsForGrant({ db: deps.db, grant });
+    const candidates = authorized.filter(({ connection }) =>
+      connectionId ? connection.id === connectionId : true,
     );
-  }
-}
+    if (candidates.length === 0) {
+      throw new Error(
+        connectionId
+          ? "the requested Atlassian connection is unavailable for this turn"
+          : "no Atlassian connection is available for this turn",
+      );
+    }
+    if (!connectionId && candidates.length > 1) {
+      throw new Error(
+        "connectionId is required because multiple Atlassian connections are available",
+      );
+    }
+    const authority = candidates[0]!;
+    const metadata = AtlassianConnectionMetadata.safeParse(authority.connection.metadata);
+    if (!metadata.success) throw new Error("Atlassian connection metadata is invalid");
+    return {
+      connection: authority.connection,
+      metadata: metadata.data,
+      subjectId: authority.subjectId ?? grant.subjectId,
+    };
+  };
 
-/** Only a prompt explicitly supplied through the human/API channel may redirect a user-paused goal. */
-export function isHumanDirectedTurn(turn: { source: string }): boolean {
-  return turn.source === "user" || turn.source === "api";
-}
+  server.registerTool(
+    "atlassian_sources_list",
+    {
+      description:
+        "List the Jira projects and Confluence spaces available through the authorized Atlassian connection, including which sources are selected for OpenGeni. Use this before search when the site or boundary is unclear.",
+      inputSchema: { connectionId: z4.string().uuid().optional() },
+    },
+    async ({ connectionId }) => {
+      const authority = await connectionFor(connectionId);
+      const response = await browseAtlassianSources(deps, {
+        workspaceId: grant.workspaceId,
+        subjectId: authority.subjectId,
+        connectionId: authority.connection.id,
+      });
+      const selected = new Set(authority.metadata.selectedSources.map((source) => source.id));
+      return json({
+        connectionId: authority.connection.id,
+        account: authority.metadata.displayName,
+        items: response.items.map((item) => ({ ...item, selected: selected.has(item.id) })),
+      });
+    },
+  );
+
+  server.registerTool(
+    "atlassian_search",
+    {
+      description:
+        "Search Jira issues and Confluence pages live within the projects and spaces selected for OpenGeni. Results reflect current Atlassian data and permissions, independent of the knowledge sync index.",
+      inputSchema: {
+        connectionId: z4.string().uuid().optional(),
+        query: z4.string().min(1).max(500),
+        product: z4.enum(["jira", "confluence"]).optional(),
+        limit: z4.number().int().min(1).max(50).optional(),
+      },
+    },
+    async ({ connectionId, query, product, limit }) => {
+      const authority = await connectionFor(connectionId);
+      return json({
+        connectionId: authority.connection.id,
+        results: await searchAtlassianLive(deps, {
+          workspaceId: grant.workspaceId,
+          subjectId: authority.subjectId,
+          connectionId: authority.connection.id,
+          query,
+          ...(product ? { product } : {}),
+          limit: limit ?? 20,
+        }),
+      });
+    },
+  );
+
+  server.registerTool(
+    "atlassian_get",
+    {
+      description:
+        "Open one current Jira issue or Confluence page, including description or page content and comments. The item must belong to a project or space selected for OpenGeni.",
+      inputSchema: {
+        connectionId: z4.string().uuid().optional(),
+        kind: z4.enum(["jira_issue", "confluence_page"]),
+        id: z4.string().min(1).max(256),
+      },
+    },
+    async ({ connectionId, kind, id }) => {
+      const authority = await connectionFor(connectionId);
+      return json(
+        await getAtlassianLiveItem(deps, {
+          workspaceId: grant.workspaceId,
+          subjectId: authority.subjectId,
+          connectionId: authority.connection.id,
+          kind,
+          id,
+        }),
+      );
+    },
+  );
+}
+
+/** Only a prompt explicitly supplied through the human/API channel may redirect a user-paused goal. */
+export function isHumanDirectedTurn(turn: { source: string }): boolean {
+  return turn.source === "user" || turn.source === "api";
+}
 
 /**
  * Sacred user pause: a goal a human paused (pausedReason 'user_pause') must
@@ -1358,7 +1905,7 @@ function registerGoalTools(
           ? (grant.metadata["turnId"] as string)
           : null;
       await assertGoalReactivationAllowed(deps, grant.workspaceId, sessionId, callerTurnId);
-      const { goal, events } = await upsertSessionGoalWithEvent(deps.db, {
+      const { goal, replaced, events } = await upsertSessionGoalWithEvent(deps.db, {
         accountId: grant.accountId,
         workspaceId: grant.workspaceId,
         sessionId,
@@ -1371,7 +1918,24 @@ function registerGoalTools(
       if (events.length > 0) {
         await deps.bus.publish(grant.workspaceId, sessionId, events);
       }
-      return json(goal);
+      return json(
+        mcpMutationReceipt({
+          operation: "goal_set",
+          committed: true,
+          outcome: replaced ? "updated" : "created",
+          changed: true,
+          resource: {
+            type: "session_goal",
+            id: goal.id,
+            version: goal.version,
+            state: goal.status,
+          },
+          timestamp: goal.updatedAt,
+          idempotency: { status: "not_supported" },
+          facts: { replaced },
+          nextAction: { tool: "session_get", arguments: { sessionId } },
+        }),
+      );
     },
   );
 
@@ -1441,10 +2005,27 @@ function registerGoalTools(
           event: { type: "goal.completed", evidence },
         },
       );
+      const changed = events.length > 0;
       if (events.length > 0) {
         await deps.bus.publish(grant.workspaceId, sessionId, events);
       }
-      return json(goal);
+      return json(
+        mcpMutationReceipt({
+          operation: "goal_complete",
+          committed: true,
+          outcome: changed ? "updated" : "unchanged",
+          changed,
+          resource: {
+            type: "session_goal",
+            id: goal.id,
+            version: goal.version,
+            state: goal.status,
+          },
+          timestamp: goal.updatedAt,
+          idempotency: { status: "not_supported" },
+          nextAction: { tool: "session_get", arguments: { sessionId } },
+        }),
+      );
     },
   );
 
@@ -1478,10 +2059,27 @@ function registerGoalTools(
           },
         },
       );
+      const changed = events.length > 0;
       if (events.length > 0) {
         await deps.bus.publish(grant.workspaceId, sessionId, events);
       }
-      return json(goal);
+      return json(
+        mcpMutationReceipt({
+          operation: "goal_pause",
+          committed: true,
+          outcome: changed ? "updated" : "unchanged",
+          changed,
+          resource: {
+            type: "session_goal",
+            id: goal.id,
+            version: goal.version,
+            state: goal.status,
+          },
+          timestamp: goal.updatedAt,
+          idempotency: { status: "not_supported" },
+          nextAction: { tool: "session_get", arguments: { sessionId } },
+        }),
+      );
     },
   );
 }
@@ -1511,7 +2109,7 @@ function registerWorkspaceArtifactTools(
   json: JsonResult,
 ): void {
   const attempt = () => {
-    const claims = preferenceAttemptClaims(grant);
+    const claims = exactAgentAttemptClaims(grant);
     if (!claims) throw new Error("Exact signed artifact attempt authority is required.");
     return claims;
   };
@@ -1599,7 +2197,11 @@ function registerWorkspaceArtifactTools(
       const actualHash = createHash("sha256").update(object.bytes).digest("hex");
       if (actualHash !== ref.version.contentSha256)
         throw new Error("Artifact content failed integrity verification");
-      return json({ detail, version: ref.version, html: new TextDecoder().decode(object.bytes) });
+      return json({
+        detail,
+        version: ref.version,
+        html: new TextDecoder().decode(object.bytes),
+      });
     },
   );
 
@@ -1695,7 +2297,7 @@ function registerWorkspaceArtifactTools(
   );
 }
 
-function preferenceAttemptClaims(grant: AccessGrant): {
+function exactAgentAttemptClaims(grant: AccessGrant): {
   sessionId: string;
   turnId: string;
   attemptId: string;
@@ -1728,7 +2330,7 @@ function registerPreferenceRegistryTools(
   json: JsonResult,
 ): void {
   const attemptClaims = () => {
-    const resolved = preferenceAttemptClaims(grant);
+    const resolved = exactAgentAttemptClaims(grant);
     if (!resolved) throw new Error("Exact signed preference attempt authority is required.");
     return {
       accountId: grant.accountId,
@@ -1761,11 +2363,101 @@ function registerPreferenceRegistryTools(
 
 const MemoryKindSchema = z4.enum(["preference", "semantic", "procedural", "decision", "episodic"]);
 
+function scheduledTaskReceipt(
+  operation: string,
+  task: ScheduledTask,
+  outcome: "created" | "updated" | "unchanged" | "triggered" | "partial_failure",
+  changed: boolean,
+  options: {
+    partialFailure?: { stage: string; retryable: boolean };
+    warnings?: string[];
+    idempotencyStatus?: "not_supported" | "not_requested" | "applied" | "replayed" | "unknown";
+    facts?: Record<string, string | number | boolean | null>;
+  } = {},
+) {
+  return mcpMutationReceipt({
+    operation,
+    committed: true,
+    outcome,
+    changed,
+    resource: {
+      type: "scheduled_task",
+      id: task.id,
+      version: task.updatedAt,
+      state: task.status,
+    },
+    timestamp: task.updatedAt,
+    idempotency: { status: options.idempotencyStatus ?? "not_supported" },
+    ...(options.partialFailure ? { partialFailure: options.partialFailure } : {}),
+    ...(options.warnings ? { warnings: options.warnings } : {}),
+    ...(options.facts ? { facts: options.facts } : {}),
+    nextAction: { tool: "scheduled_tasks_get", arguments: { id: task.id } },
+  });
+}
+
+function scheduledTaskUpdateChangesState(
+  task: ScheduledTask,
+  update: Awaited<ReturnType<typeof validatedScheduledTaskUpdate>>,
+): boolean {
+  if (update.name !== undefined && update.name !== task.name) return true;
+  if (update.status !== undefined && update.status !== task.status) return true;
+  if (update.schedule !== undefined && stableJson(update.schedule) !== stableJson(task.schedule)) {
+    return true;
+  }
+  if (update.runMode !== undefined && update.runMode !== task.runMode) return true;
+  if (update.overlapPolicy !== undefined && update.overlapPolicy !== task.overlapPolicy)
+    return true;
+  if (
+    update.agentConfig !== undefined &&
+    stableJson(update.agentConfig) !== stableJson(task.agentConfig)
+  ) {
+    return true;
+  }
+  if (update.targetSessionId !== undefined && update.targetSessionId !== task.targetSessionId) {
+    return true;
+  }
+  if (
+    update.reusableSessionId !== undefined &&
+    update.reusableSessionId !== task.reusableSessionId
+  ) {
+    return true;
+  }
+  if (update.variableSetId !== undefined && update.variableSetId !== task.variableSetId)
+    return true;
+  if (update.rigId !== undefined && update.rigId !== task.rigId) return true;
+  if (update.metadata !== undefined && stableJson(update.metadata) !== stableJson(task.metadata)) {
+    return true;
+  }
+  // Personal-connection delegations are recomputed with agentConfig and can
+  // change even when the visible config is byte-identical (for example after a
+  // connection rotation), so preserve that refresh as a real mutation.
+  if (update.personalConnectionDelegations !== undefined) return true;
+  return false;
+}
+
 function memoryPreview(text: string): string {
   const normalized = text.replace(/\s+/g, " ").trim();
   return normalized.length <= 120 ? normalized : `${normalized.slice(0, 119)}…`;
 }
 
+export function memorySlackPublicationActor(
+  actor: Extract<SessionAuthorizationActor, { kind: "agent_attempt" }>,
+  sessionId: string,
+  fallbackOwnerLabel: string | null,
+) {
+  return {
+    actor: {
+      kind: actor.initiator.kind === "subject" ? ("human" as const) : ("service" as const),
+      subjectId: actor.initiator.subjectId,
+      initiatingHumanSubjectId: actor.initiatingHumanSubjectId,
+      sessionId,
+      turnId: actor.turnId,
+      attemptId: actor.attemptId,
+    },
+    ownerLabel: actor.initiator.label ?? fallbackOwnerLabel,
+  };
+}
+
 function registerMemoryTools(
   server: McpServer,
   deps: ApiRouteDeps,
@@ -1773,6 +2465,17 @@ function registerMemoryTools(
   sessionId: string,
   json: JsonResult,
 ): void {
+  const publicationActor = async () => {
+    const actor = await requireLiveAgentAttemptAuthorization(deps.db, grant, sessionId);
+    return memorySlackPublicationActor(actor, sessionId, grant.subjectLabel ?? null);
+  };
+  const publicationInputSchema = z4.object({
+    importance: z4.enum(["major", "normal", "minor"]),
+    audience: z4.literal("workspace"),
+    slackMode: z4.enum(["auto", "review", "never"]),
+    shareSummary: z4.string().trim().min(1).max(4_096),
+  });
+
   server.registerTool(
     "memory_search",
     {
@@ -1807,10 +2510,12 @@ function registerMemoryTools(
         kind: MemoryKindSchema,
         confidence: z4.number().min(0).max(1).optional(),
         replaces_id: z4.string().min(1).optional(),
+        slack_publication: publicationInputSchema.optional(),
       },
     },
-    async ({ text, kind, confidence, replaces_id }) => {
-      const result = await saveWorkspaceMemory(
+    async ({ text, kind, confidence, replaces_id, slack_publication }) => {
+      const principal = slack_publication ? await publicationActor() : null;
+      const result = await saveWorkspaceMemoryWithSlackPublication(
         deps.db,
         {
           accountId: grant.accountId,
@@ -1822,6 +2527,13 @@ function registerMemoryTools(
           ...(replaces_id ? { replacesId: replaces_id } : {}),
           origin: "agent",
         },
+        slack_publication
+          ? {
+              distribution: MemorySlackPublicationDistribution.parse(slack_publication),
+              actor: principal!.actor,
+              ownerLabel: principal!.ownerLabel,
+            }
+          : null,
         deps.getDocumentServices().embedder,
       );
       await appendAndPublishEvents(deps.db, deps.bus, grant.workspaceId, sessionId, [
@@ -1836,7 +2548,59 @@ function registerMemoryTools(
           },
         },
       ]);
-      return json(result);
+      const changed = !result.deduped || result.updated || result.superseded !== null;
+      const outcome =
+        result.updated || result.superseded !== null
+          ? "updated"
+          : result.deduped
+            ? "unchanged"
+            : "created";
+      return json(
+        mcpMutationReceipt({
+          operation: "memory_save",
+          committed: true,
+          outcome,
+          changed,
+          resource: {
+            type: "knowledge_memory",
+            id: result.memory.id,
+            state: result.memory.status,
+          },
+          relatedResources: result.superseded
+            ? [
+                {
+                  type: "knowledge_memory",
+                  id: result.superseded.id,
+                  state: result.superseded.status,
+                },
+              ]
+            : undefined,
+          timestamp: result.memory.updatedAt,
+          idempotency: { status: "not_supported" },
+          warnings: !result.embedded
+            ? ["Memory committed without a vector embedding; keyword search remains available."]
+            : [],
+          facts: {
+            deduped: result.deduped,
+            dedupeReason: result.dedupeReason,
+            updatedInPlace: result.updated,
+            embedded: result.embedded,
+            slackPublicationDecision: result.slackPublication.decision?.eligible
+              ? "eligible"
+              : (result.slackPublication.decision?.reason ?? "not_requested"),
+            slackPublicationId:
+              result.slackPublication.enqueue?.kind === "enqueued" ||
+              result.slackPublication.enqueue?.kind === "replayed"
+                ? result.slackPublication.enqueue.publication.id
+                : null,
+            slackPublicationState:
+              result.slackPublication.enqueue?.kind === "enqueued" ||
+              result.slackPublication.enqueue?.kind === "replayed"
+                ? result.slackPublication.enqueue.publication.state
+                : null,
+          },
+        }),
+      );
     },
   );
 
@@ -1848,10 +2612,12 @@ function registerMemoryTools(
         id: z4.string().min(1),
         reason: z4.string().min(1).optional(),
         replacement_text: z4.string().min(1).optional(),
+        slack_publication: publicationInputSchema.optional(),
       },
     },
-    async ({ id, reason, replacement_text }) => {
-      const result = await correctWorkspaceMemory(
+    async ({ id, reason, replacement_text, slack_publication }) => {
+      const principal = slack_publication ? await publicationActor() : null;
+      const result = await correctWorkspaceMemoryWithSlackPublication(
         deps.db,
         {
           accountId: grant.accountId,
@@ -1861,6 +2627,13 @@ function registerMemoryTools(
           ...(reason ? { reason } : {}),
           ...(replacement_text ? { replacementText: replacement_text } : {}),
         },
+        slack_publication
+          ? {
+              distribution: MemorySlackPublicationDistribution.parse(slack_publication),
+              actor: principal!.actor,
+              ownerLabel: principal!.ownerLabel,
+            }
+          : null,
         deps.getDocumentServices().embedder,
       );
       await appendAndPublishEvents(deps.db, deps.bus, grant.workspaceId, sessionId, [
@@ -1881,7 +2654,46 @@ function registerMemoryTools(
           },
         },
       ]);
-      return json(result);
+      return json(
+        mcpMutationReceipt({
+          operation: "memory_correct",
+          committed: true,
+          outcome: "updated",
+          changed: true,
+          resource: {
+            type: "knowledge_memory",
+            id: result.memory.id,
+            state: result.memory.status,
+          },
+          relatedResources: result.replacement
+            ? [
+                {
+                  type: "knowledge_memory",
+                  id: result.replacement.id,
+                  state: result.replacement.status,
+                },
+              ]
+            : undefined,
+          timestamp: (result.replacement ?? result.memory).updatedAt,
+          idempotency: { status: "not_supported" },
+          facts: {
+            correctionAction: result.action,
+            slackPublicationDecision: result.slackPublication.decision?.eligible
+              ? "eligible"
+              : (result.slackPublication.decision?.reason ?? "not_requested"),
+            slackPublicationId:
+              result.slackPublication.enqueue?.kind === "enqueued" ||
+              result.slackPublication.enqueue?.kind === "replayed"
+                ? result.slackPublication.enqueue.publication.id
+                : null,
+            slackPublicationState:
+              result.slackPublication.enqueue?.kind === "enqueued" ||
+              result.slackPublication.enqueue?.kind === "replayed"
+                ? result.slackPublication.enqueue.publication.state
+                : null,
+          },
+        }),
+      );
     },
   );
 }
@@ -1928,7 +2740,7 @@ function registerFleetTools(
     "sandboxes_list",
     {
       description:
-        "List the sandboxes this session can run on: its own session sandbox plus enrolled selfhosted machines. `liveness` is conservative: online requires observed provider existence and verified workspace readiness. An idle session-home sandbox may report offline/cold/draining and still wake or restore on the next ordinary sandbox operation; never infer that shell/files are unavailable from list liveness alone—only a typed operation/attach failure proves that. Provider, lease, route, archive, restore, workspace, lease epoch, and route epoch are also reported separately. Use an entry `id` as an attach/swap/run_on target.",
+        "List the sandboxes this session can run on: its own session sandbox plus enrolled selfhosted machines. `operationAvailability` is authoritative for ordinary shell/files use: `wakeable` means the next ordinary operation will wake or restore the idle managed home sandbox, even when `liveness=offline`, `leaseLiveness=cold|draining`, or `attachable=false`. `attachable` describes an already-live swap target, not ordinary operation availability. `recovering` requires a bounded retry/typed recovery result; `unavailable` is not usable. Provider, lease, route, archive, restore, workspace, lease epoch, and route epoch remain separate truth dimensions. Use an entry `id` as an attach/swap/run_on target.",
       inputSchema: {},
     },
     async () => json(await listFleet(services, await fleetContext())),
@@ -2000,6 +2812,45 @@ function registerFleetTools(
   );
 }
 
+// Workspace-admin/operator surface for removing a connected machine. This is
+// deliberately separate from the session-scoped fleet tools: a worker can list,
+// attach, or run on a machine only with session authority, while removal requires
+// the explicit high-trust enrollments:manage permission and never accepts a
+// sandbox id. A Modal record therefore cannot be removed through this operation.
+function registerConnectedMachineTools(
+  server: McpServer,
+  deps: ApiRouteDeps,
+  grant: AccessGrant,
+  json: JsonResult,
+): void {
+  server.registerTool(
+    "connected_machine_remove",
+    {
+      description:
+        "Remove one enrolled self-hosted machine while it is offline. Access is revoked, future heartbeat/reconnect credentials are rejected, session/route/lease/archive history is retained, and a fresh human-approved device-flow enrollment is required to reconnect. Pass the enrollmentId from the Machines surface, never a Modal sandbox id. Blocked outcomes include every dependent session and the action needed before retrying. Move each dependent session through the canonical sandbox_swap target=default path before retrying removal; the removal authority never rewrites routes directly.",
+      inputSchema: {
+        enrollmentId: z4.string().uuid(),
+        expectedUpdatedAt: z4.string().datetime({ offset: true }).optional(),
+        idempotencyKey: z4.string().trim().min(1).max(200).optional(),
+      },
+    },
+    async ({ enrollmentId, expectedUpdatedAt, idempotencyKey }) => {
+      const result = await removeEnrollment(deps.db, {
+        accountId: grant.accountId,
+        workspaceId: grant.workspaceId,
+        enrollmentId,
+        operationKey: idempotencyKey?.trim() || randomUUID(),
+        ...(expectedUpdatedAt ? { expectedUpdatedAt } : {}),
+        subjectId: grant.subjectId,
+      });
+      if (!result) {
+        throw new Error("machine enrollment not found in this workspace");
+      }
+      return json({ revoked: result.removed, ...result });
+    },
+  );
+}
+
 async function beginMcpRigVerificationAttempt(
   deps: ApiRouteDeps,
   workspaceId: string,
@@ -2008,12 +2859,10 @@ async function beginMcpRigVerificationAttempt(
   try {
     return await beginRigChangeVerificationAttempt(deps.db, workspaceId, changeId, {
       startedAt: new Date().toISOString(),
+      allowAlreadyVerifying: true,
     });
   } catch (error) {
-    if (
-      error instanceof RigChangeAlreadyVerifyingError ||
-      error instanceof RigChangeTransitionError
-    ) {
+    if (error instanceof RigChangeTransitionError) {
       throw new Error(error.message, { cause: error });
     }
     throw error;
@@ -2101,12 +2950,60 @@ function registerRigTools(
           sessionId ? { proposedBy: `session:${sessionId}` } : {},
         );
         const verifying = await beginMcpRigVerificationAttempt(deps, grant.workspaceId, change.id);
-        await deps.workflowClient.startRigVerification({
-          workspaceId: grant.workspaceId,
-          changeId: change.id,
-          workflowId: `rig-verification-change-${change.id}-attempt-${verificationAttempt(verifying)}`,
-        });
-        return json({ change: verifying, verificationStarted: true });
+        const attempt = verificationAttempt(verifying);
+        try {
+          await deps.workflowClient.startRigVerification({
+            workspaceId: grant.workspaceId,
+            changeId: change.id,
+            workflowId: `rig-verification-change-${change.id}-attempt-${attempt}`,
+          });
+        } catch {
+          return json(
+            mcpMutationReceipt({
+              operation: "rig_propose_change",
+              committed: true,
+              outcome: "partial_failure",
+              changed: true,
+              resource: {
+                type: "rig_change",
+                id: verifying.id,
+                version: verifying.updatedAt,
+                state: verifying.status,
+              },
+              relatedResources: [{ type: "rig", id: rig.id }],
+              timestamp: verifying.updatedAt,
+              idempotency: { status: "not_supported" },
+              partialFailure: {
+                stage: "verification_workflow_start",
+                retryable: true,
+              },
+              warnings: [
+                "The rig change and verifying transition committed, but verification workflow start failed.",
+              ],
+              facts: { verificationAttempt: attempt },
+              nextAction: { tool: "rig_get", arguments: { rigId: rig.id } },
+            }),
+          );
+        }
+        return json(
+          mcpMutationReceipt({
+            operation: "rig_propose_change",
+            committed: true,
+            outcome: "created",
+            changed: true,
+            resource: {
+              type: "rig_change",
+              id: verifying.id,
+              version: verifying.updatedAt,
+              state: verifying.status,
+            },
+            relatedResources: [{ type: "rig", id: rig.id }],
+            timestamp: verifying.updatedAt,
+            idempotency: { status: "not_supported" },
+            facts: { verificationStarted: true, verificationAttempt: attempt },
+            nextAction: { tool: "rig_get", arguments: { rigId: rig.id } },
+          }),
+        );
       },
     );
 
@@ -2129,12 +3026,63 @@ function registerRigTools(
             grant.workspaceId,
             change.id,
           );
-          await deps.workflowClient.startRigVerification({
-            workspaceId: grant.workspaceId,
-            changeId: change.id,
-            workflowId: `rig-verification-change-${change.id}-attempt-${verificationAttempt(verifying)}`,
-          });
-          return json({ ok: true, changeId: change.id });
+          const attempt = verificationAttempt(verifying);
+          try {
+            await deps.workflowClient.startRigVerification({
+              workspaceId: grant.workspaceId,
+              changeId: change.id,
+              workflowId: `rig-verification-change-${change.id}-attempt-${attempt}`,
+            });
+          } catch {
+            return json(
+              mcpMutationReceipt({
+                operation: "rig_verify",
+                committed: true,
+                outcome: "partial_failure",
+                changed: true,
+                resource: {
+                  type: "rig_change",
+                  id: verifying.id,
+                  version: verifying.updatedAt,
+                  state: verifying.status,
+                },
+                relatedResources: [{ type: "rig", id: rig.id }],
+                timestamp: verifying.updatedAt,
+                idempotency: { status: "not_supported" },
+                partialFailure: {
+                  stage: "verification_workflow_start",
+                  retryable: true,
+                },
+                warnings: [
+                  "The verifying transition committed, but verification workflow start failed.",
+                ],
+                facts: { verificationAttempt: attempt },
+                nextAction: { tool: "rig_get", arguments: { rigId: rig.id } },
+              }),
+            );
+          }
+          return json(
+            mcpMutationReceipt({
+              operation: "rig_verify",
+              committed: true,
+              outcome: "accepted",
+              changed: true,
+              resource: {
+                type: "rig_change",
+                id: verifying.id,
+                version: verifying.updatedAt,
+                state: verifying.status,
+              },
+              relatedResources: [{ type: "rig", id: rig.id }],
+              timestamp: verifying.updatedAt,
+              idempotency: { status: "not_supported" },
+              facts: {
+                verificationStarted: true,
+                verificationAttempt: attempt,
+              },
+              nextAction: { tool: "rig_get", arguments: { rigId: rig.id } },
+            }),
+          );
         }
         if (!rig.activeVersion) {
           throw new Error("rig has no active version");
@@ -2144,7 +3092,23 @@ function registerRigTools(
           versionId: rig.activeVersion.id,
           workflowId: `rig-verification-version-${rig.activeVersion.id}-${crypto.randomUUID()}`,
         });
-        return json({ ok: true, versionId: rig.activeVersion.id });
+        return json(
+          mcpMutationReceipt({
+            operation: "rig_verify",
+            committed: true,
+            outcome: "accepted",
+            changed: true,
+            resource: {
+              type: "rig_version",
+              id: rig.activeVersion.id,
+              version: rig.activeVersion.version,
+              state: "verification_started",
+            },
+            relatedResources: [{ type: "rig", id: rig.id }],
+            idempotency: { status: "not_supported" },
+            nextAction: { tool: "rig_get", arguments: { rigId: rig.id } },
+          }),
+        );
       },
     );
   }
@@ -2163,8 +3127,36 @@ function registerRigTools(
       async ({ rigId, changeId }) => {
         const rig = await requireRigForApi(deps.db, grant.workspaceId, rigId);
         const change = await requireRigChangeForApi(deps.db, grant.workspaceId, rig.id, changeId);
+        const promoted = await promoteVerifiedDefinitionEditChangeForApi(
+          { db: deps.db },
+          grant,
+          rig,
+          change,
+        );
         return json(
-          await promoteVerifiedDefinitionEditChangeForApi({ db: deps.db }, grant, rig, change),
+          mcpMutationReceipt({
+            operation: "rig_promote",
+            committed: true,
+            outcome: "updated",
+            changed: true,
+            resource: {
+              type: "rig_version",
+              id: promoted.version.id,
+              version: promoted.version.version,
+              state: "active",
+            },
+            relatedResources: [
+              {
+                type: "rig_change",
+                id: promoted.change.id,
+                state: promoted.change.status,
+              },
+              { type: "rig", id: rig.id },
+            ],
+            timestamp: promoted.version.createdAt,
+            idempotency: { status: "not_supported" },
+            nextAction: { tool: "rig_get", arguments: { rigId: rig.id } },
+          }),
         );
       },
     );
@@ -2209,7 +3201,6 @@ function registerWorkspaceOrchestrationTools(
   grant: AccessGrant,
   can: (permission: Permission) => boolean,
   callerSessionId: string | null,
-  toolspaceMode: boolean,
   json: JsonResult,
 ): void {
   if (can("sessions:read")) {
@@ -2287,7 +3278,7 @@ function registerWorkspaceOrchestrationTools(
         );
         return json(
           boundSessionDetailMcp(
-            await withMcpEffectivePolicy(deps, grant.workspaceId, {
+            await withMcpEffectivePolicy(deps, grant.workspaceId, grant.subjectId, {
               ...projected,
               effectiveControl: queue?.effectiveControl ?? projected.effectiveControl,
             }),
@@ -2384,7 +3375,10 @@ function registerWorkspaceOrchestrationTools(
                   compactSessionEventResult(
                     event,
                     latestClass!,
-                    dbPage.coveredSequence ?? { first: event.sequence, last: event.sequence },
+                    dbPage.coveredSequence ?? {
+                      first: event.sequence,
+                      last: event.sequence,
+                    },
                   ),
                 )
               : null,
@@ -2432,9 +3426,21 @@ function registerWorkspaceOrchestrationTools(
           // Bind the spawned session to a rig (freezes its active version);
           // declared so MCP validation doesn't strip it before the domain reads it.
           rigId: z4.string().uuid().optional(),
-          model: z4.string().min(1).optional(),
-          reasoningEffort: z4.string().optional(),
-          latencyMode: z4.enum(["standard", "priority", "fast"]).optional(),
+          model: z4
+            .string()
+            .min(1)
+            .optional()
+            .describe(
+              "Model for the worker. Omit to inherit the exact calling turn's model, including its Codex subscription billing path.",
+            ),
+          reasoningEffort: z4
+            .string()
+            .optional()
+            .describe("Omit to inherit the exact calling turn's reasoning effort."),
+          latencyMode: z4
+            .enum(["standard", "priority", "fast"])
+            .optional()
+            .describe("Omit to inherit the exact calling turn's latency mode."),
           sandboxBackend: z4.string().optional(),
           // Create-time machine targeting: an enrolled sandbox id (from
           // sandboxes_list) to run the spawned session on. Seeds the active-sandbox
@@ -2508,8 +3514,13 @@ function registerWorkspaceOrchestrationTools(
           if (callerSessionId !== null) {
             await authorizeFirstPartySession(deps, grant, callerSessionId, "session.child.create");
           }
-          const created = await createSessionForRequest(deps, grant, grant.workspaceId, args);
-          return json(await withMcpEffectivePolicy(deps, grant.workspaceId, created));
+          const result = await createSessionForRequestWithOutcome(
+            deps,
+            grant,
+            grant.workspaceId,
+            args,
+          );
+          return json(sessionCreateMutationReceipt(result, Boolean(args.idempotencyKey)));
         } catch (error) {
           if (error instanceof SessionSpawnDeniedError) {
             return {
@@ -2523,7 +3534,7 @@ function registerWorkspaceOrchestrationTools(
     );
   }
 
-  if (can("sessions:control") && !toolspaceMode) {
+  if (can("sessions:control")) {
     server.registerTool(
       "session_send_message",
       {
@@ -2549,17 +3560,33 @@ function registerWorkspaceOrchestrationTools(
             exactAgentCommandContext(grant, callerSessionId),
             { targetSessionId, text, idempotencyKey },
           );
-          return json({
-            delivered: true,
-            updateId: result.updateId,
-            delivery: "coalesced_internal_update",
-            effectiveState: result.effectiveState,
-            wakeRequested: result.wakeRevision !== null,
-            resumeRequired: result.effectiveState === "paused",
-            replay: result.replay,
-          });
+          return json(
+            mcpMutationReceipt({
+              operation: "session_send_message",
+              committed: true,
+              outcome: result.replay ? "replayed" : "accepted",
+              changed: !result.replay,
+              resource: {
+                type: "session_system_update",
+                id: result.updateId,
+                state: result.effectiveState,
+              },
+              relatedResources: [{ type: "session", id: targetSessionId }],
+              timestamp: result.receipt.createdAt.toISOString(),
+              idempotency: { status: result.replay ? "replayed" : "applied" },
+              facts: {
+                delivery: "coalesced_internal_update",
+                wakeRequested: result.wakeRevision !== null,
+                resumeRequired: result.effectiveState === "paused",
+              },
+              nextAction: {
+                tool: "session_get",
+                arguments: { sessionId: targetSessionId },
+              },
+            }),
+          );
         }
-        const { accepted, turn } = await acceptSessionUserMessage(
+        const { accepted, turn, replay } = await acceptSessionUserMessageWithOutcome(
           deps,
           grant,
           grant.workspaceId,
@@ -2574,7 +3601,30 @@ function registerWorkspaceOrchestrationTools(
             ),
           },
         );
-        return json({ event: accepted, turnId: turn.id });
+        return json(
+          mcpMutationReceipt({
+            operation: "session_send_message",
+            committed: true,
+            outcome: replay ? "replayed" : "accepted",
+            changed: !replay,
+            resource: {
+              type: "session_turn",
+              id: turn.id,
+              version: turn.version,
+              state: turn.status,
+            },
+            relatedResources: [
+              { type: "session", id: targetSessionId },
+              { type: "session_event", id: accepted.id, state: accepted.type },
+            ],
+            timestamp: accepted.occurredAt,
+            idempotency: { status: replay ? "replayed" : "applied" },
+            nextAction: {
+              tool: "session_get",
+              arguments: { sessionId: targetSessionId },
+            },
+          }),
+        );
       },
     );
 
@@ -2600,16 +3650,25 @@ function registerWorkspaceOrchestrationTools(
               reason: reason ?? "agent_mcp_pause",
             },
           );
-          return json({
-            receiptId: controlled.receipt.id,
-            effectiveControl: projectEffectiveControlForRelatedAccess(
-              serializeEffectiveSessionControl(controlled.control),
-              sessionId,
-              controlled.authorization?.relatedSessionAccess ?? "root",
-            ),
-            interruptionCount: controlled.interruptionCount,
-            replay: controlled.replay,
-          });
+          const effectiveControl = projectEffectiveControlForRelatedAccess(
+            serializeEffectiveSessionControl(controlled.control),
+            sessionId,
+            controlled.authorization?.relatedSessionAccess ?? "root",
+          );
+          return json(
+            mcpMutationReceipt({
+              operation: "session_pause",
+              committed: true,
+              outcome: controlled.replay ? "replayed" : "updated",
+              changed: !controlled.replay,
+              resource: { type: "session", id: sessionId, state: effectiveControl.state },
+              relatedResources: [{ type: "session_command_receipt", id: controlled.receipt.id }],
+              timestamp: controlled.receipt.createdAt.toISOString(),
+              idempotency: { status: controlled.replay ? "replayed" : "applied" },
+              facts: { interruptionCount: controlled.interruptionCount },
+              nextAction: { tool: "session_get", arguments: { sessionId } },
+            }),
+          );
         }
         const controlled = await controlHumanSessionWorkstream(
           deps,
@@ -2653,16 +3712,25 @@ function registerWorkspaceOrchestrationTools(
               reason: reason ?? "agent_mcp_resume",
             },
           );
-          return json({
-            receiptId: controlled.receipt.id,
-            effectiveControl: projectEffectiveControlForRelatedAccess(
-              serializeEffectiveSessionControl(controlled.control),
-              sessionId,
-              controlled.authorization?.relatedSessionAccess ?? "root",
-            ),
-            interruptionCount: controlled.interruptionCount,
-            replay: controlled.replay,
-          });
+          const effectiveControl = projectEffectiveControlForRelatedAccess(
+            serializeEffectiveSessionControl(controlled.control),
+            sessionId,
+            controlled.authorization?.relatedSessionAccess ?? "root",
+          );
+          return json(
+            mcpMutationReceipt({
+              operation: "session_resume",
+              committed: true,
+              outcome: controlled.replay ? "replayed" : "updated",
+              changed: !controlled.replay,
+              resource: { type: "session", id: sessionId, state: effectiveControl.state },
+              relatedResources: [{ type: "session_command_receipt", id: controlled.receipt.id }],
+              timestamp: controlled.receipt.createdAt.toISOString(),
+              idempotency: { status: controlled.replay ? "replayed" : "applied" },
+              facts: { interruptionCount: controlled.interruptionCount },
+              nextAction: { tool: "session_get", arguments: { sessionId } },
+            }),
+          );
         }
         const controlled = await controlHumanSessionWorkstream(
           deps,
@@ -2701,13 +3769,28 @@ function registerWorkspaceOrchestrationTools(
             exactAgentCommandContext(grant, callerSessionId, "first_party_mcp"),
             { targetSessionId: sessionId, instruction, idempotencyKey },
           );
-          return json({
-            updateId: result.updateId,
-            interruptionCount: result.interruptionCount,
-            stoppingPreviousAttempt: result.interruptionCount > 0,
-            effectiveState: result.effectiveState,
-            replay: result.replay,
-          });
+          return json(
+            mcpMutationReceipt({
+              operation: "session_steer",
+              committed: true,
+              outcome: result.replay ? "replayed" : "updated",
+              changed: !result.replay,
+              resource: {
+                type: "session_system_update",
+                id: result.updateId,
+                state: result.effectiveState,
+              },
+              relatedResources: [{ type: "session", id: sessionId }],
+              timestamp: result.receipt.createdAt.toISOString(),
+              idempotency: { status: result.replay ? "replayed" : "applied" },
+              facts: {
+                interruptionCount: result.interruptionCount,
+                stoppingPreviousAttempt: result.interruptionCount > 0,
+              },
+              updateId: result.updateId,
+              nextAction: { tool: "session_get", arguments: { sessionId } },
+            }),
+          );
         },
       );
     }
@@ -2736,15 +3819,15 @@ function registerWorkspaceOrchestrationTools(
   }
 }
 
-// VariableSet management for manager-style agents. v1 deliberately accepts
-// variable VALUES in plain tool arguments: the calling model is trusted with
-// the secrets it is persisting (see docs/variable-sets.md). Reads stay
-// write-only — responses carry names and metadata, never values.
+// Variable-set management for agents. Generic reads remain metadata-only.
+// Plaintext has one dedicated tool that additionally requires literal
+// secrets:read plus exact live attempt/session authorization.
 function registerVariableSetTools(
   server: McpServer,
   deps: ApiRouteDeps,
   grant: AccessGrant,
   can: (permission: Permission) => boolean,
+  sessionId: string | null,
   json: JsonResult,
 ): void {
   const registerListTool = (name: string, description: string): void => {
@@ -2760,93 +3843,114 @@ function registerVariableSetTools(
       },
     );
   };
-  const setVariableHandler = async ({
-    variableSetId,
-    variableSetName,
-    environmentId,
-    environmentName,
-    name,
-    value,
-  }: {
-    variableSetId?: string | undefined;
-    variableSetName?: string | undefined;
-    environmentId?: string | undefined;
-    environmentName?: string | undefined;
-    name: string;
-    value: string;
-  }) => {
-    const key = requireVariableSetEncryption(deps.settings);
-    const parsedName = VariableSetVariableName.safeParse(name);
-    if (!parsedName.success) {
-      throw new Error("variable set/environment variable names must match ^[A-Z][A-Z0-9_]*$");
-    }
-    assertAllowedVariableSetVariableName(parsedName.data);
-    const targetId = variableSetId ?? environmentId;
-    const targetName = variableSetName ?? environmentName;
-    if ((targetId === undefined) === (targetName === undefined)) {
-      throw new Error(
-        "provide exactly one of variableSetId or variableSetName; deprecated aliases must provide exactly one of environmentId or environmentName",
-      );
-    }
-    const trimmedVariableSetName = targetName?.trim();
-    if (targetName !== undefined && !trimmedVariableSetName) {
-      throw new Error("variable set name is required");
-    }
-    let created = false;
-    let variableSet =
-      targetId !== undefined
-        ? await getVariableSet(deps.db, grant.workspaceId, targetId)
-        : await getVariableSetByName(deps.db, grant.workspaceId, trimmedVariableSetName!);
-    if (!variableSet && targetId !== undefined) {
-      throw new Error("variable set/environment not found");
-    }
-    if (!variableSet) {
-      if ((await countVariableSets(deps.db, grant.workspaceId)) >= MAX_ENVIRONMENTS_PER_WORKSPACE) {
+  const setVariableHandler =
+    (operation: "variable_set_set_variable" | "environment_set_variable") =>
+    async ({
+      variableSetId,
+      variableSetName,
+      environmentId,
+      environmentName,
+      name,
+      value,
+    }: {
+      variableSetId?: string | undefined;
+      variableSetName?: string | undefined;
+      environmentId?: string | undefined;
+      environmentName?: string | undefined;
+      name: string;
+      value: string;
+    }) => {
+      const key = requireVariableSetEncryption(deps.settings);
+      const parsedName = VariableSetVariableName.safeParse(name);
+      if (!parsedName.success) {
+        throw new Error("variable set/environment variable names must match ^[A-Z][A-Z0-9_]*$");
+      }
+      assertAllowedVariableSetVariableName(parsedName.data);
+      const targetId = variableSetId ?? environmentId;
+      const targetName = variableSetName ?? environmentName;
+      if ((targetId === undefined) === (targetName === undefined)) {
+        throw new Error(
+          "provide exactly one of variableSetId or variableSetName; deprecated aliases must provide exactly one of environmentId or environmentName",
+        );
+      }
+      const trimmedVariableSetName = targetName?.trim();
+      if (targetName !== undefined && !trimmedVariableSetName) {
+        throw new Error("variable set name is required");
+      }
+      let created = false;
+      let variableSet =
+        targetId !== undefined
+          ? await getVariableSet(deps.db, grant.workspaceId, targetId)
+          : await getVariableSetByName(deps.db, grant.workspaceId, trimmedVariableSetName!);
+      if (!variableSet && targetId !== undefined) {
+        throw new Error("variable set/environment not found");
+      }
+      if (!variableSet) {
+        if (
+          (await countVariableSets(deps.db, grant.workspaceId)) >= MAX_ENVIRONMENTS_PER_WORKSPACE
+        ) {
+          throw new Error(
+            `a workspace supports at most ${MAX_ENVIRONMENTS_PER_WORKSPACE} variable sets`,
+          );
+        }
+        variableSet = await createVariableSet(deps.db, {
+          accountId: grant.accountId,
+          workspaceId: grant.workspaceId,
+          name: trimmedVariableSetName!,
+        });
+        created = true;
+        await recordVariableSetAuditEvent(deps.db, {
+          grant,
+          action: "variable_set.created",
+          variableSetId: variableSet.id,
+        });
+      }
+      const exists = variableSet.variables.some((variable) => variable.name === parsedName.data);
+      if (!exists && variableSet.variables.length >= MAX_VARIABLES_PER_ENVIRONMENT) {
         throw new Error(
-          `a workspace supports at most ${MAX_ENVIRONMENTS_PER_WORKSPACE} variable sets`,
+          `a variable set supports at most ${MAX_VARIABLES_PER_ENVIRONMENT} variables`,
         );
       }
-      variableSet = await createVariableSet(deps.db, {
+      const metadata = await setVariableSetVariable(deps.db, {
         accountId: grant.accountId,
         workspaceId: grant.workspaceId,
-        name: trimmedVariableSetName!,
+        variableSetId: variableSet.id,
+        name: parsedName.data,
+        valueEncrypted: encryptVariableSetValue(key, value),
       });
-      created = true;
       await recordVariableSetAuditEvent(deps.db, {
         grant,
-        action: "variable_set.created",
+        action: "variable_set.variable.set",
         variableSetId: variableSet.id,
+        variableName: parsedName.data,
       });
-    }
-    const exists = variableSet.variables.some((variable) => variable.name === parsedName.data);
-    if (!exists && variableSet.variables.length >= MAX_VARIABLES_PER_ENVIRONMENT) {
-      throw new Error(`a variable set supports at most ${MAX_VARIABLES_PER_ENVIRONMENT} variables`);
-    }
-    const metadata = await setVariableSetVariable(deps.db, {
-      accountId: grant.accountId,
-      workspaceId: grant.workspaceId,
-      variableSetId: variableSet.id,
-      name: parsedName.data,
-      valueEncrypted: encryptVariableSetValue(key, value),
-    });
-    await recordVariableSetAuditEvent(deps.db, {
-      grant,
-      action: "variable_set.variable.set",
-      variableSetId: variableSet.id,
-      variableName: parsedName.data,
-    });
-    const responseVariableSet = {
-      id: variableSet.id,
-      name: variableSet.name,
-      created,
+      return json(
+        mcpMutationReceipt({
+          operation,
+          committed: true,
+          outcome: exists ? "updated" : "created",
+          changed: true,
+          resource: {
+            type: "variable_set",
+            id: variableSet.id,
+            version: metadata.version,
+            state: "variable_written",
+          },
+          timestamp: metadata.updatedAt,
+          idempotency: { status: "not_supported" },
+          facts: {
+            variableCreated: !exists,
+            variableSetCreated: created,
+            deprecatedAlias: operation === "environment_set_variable",
+          },
+          nextAction: { tool: "variable_set_list", arguments: {} },
+        }),
+      );
     };
-    return json({
-      variableSet: responseVariableSet,
-      environment: responseVariableSet,
-      variable: metadata,
-    });
-  };
-  const registerSetTool = (name: string, description: string): void => {
+  const registerSetTool = (
+    name: "variable_set_set_variable" | "environment_set_variable",
+    description: string,
+  ): void => {
     server.registerTool(
       name,
       {
@@ -2860,32 +3964,334 @@ function registerVariableSetTools(
           value: z4.string().min(1).max(32768),
         },
       },
-      setVariableHandler,
+      setVariableHandler(name),
     );
   };
-  if (can("variable-sets:use")) {
+  if (can("variable-sets:list") && can("secrets:list")) {
     registerListTool(
       "variable_set_list",
-      "List variable sets with variable names and metadata (versions, timestamps). Values are write-only and never returned.",
+      "List variable sets with variable names and metadata (versions, timestamps). Plaintext values are never returned by list operations.",
     );
     registerListTool(
       "environment_list",
-      "(deprecated alias of variable_set_list) List variable sets with variable names and metadata (versions, timestamps). Values are write-only and never returned.",
+      "(deprecated alias of variable_set_list) List variable sets with variable names and metadata (versions, timestamps). Plaintext values are never returned by list operations.",
+    );
+  }
+
+  if (
+    sessionId !== null &&
+    can("variable-sets:read") &&
+    hasLiteralPermission(grant.permissions, "secrets:read")
+  ) {
+    server.registerTool(
+      "variable_set_get_variable",
+      {
+        description:
+          "Retrieve one exact plaintext variable value. This is a dedicated high-trust read: use it only when the current task requires the configured value. The access is audited against this exact live attempt.",
+        inputSchema: {
+          variableSetId: z4.string().uuid().optional(),
+          variableSetName: z4.string().min(1).max(120).optional(),
+          name: z4.string().min(1),
+        },
+      },
+      async ({ variableSetId, variableSetName, name }) => {
+        let target: { variableSetId: string } | { variableSetName: string };
+        if (variableSetId !== undefined) {
+          if (variableSetName !== undefined) {
+            throw new Error("provide exactly one of variableSetId or variableSetName");
+          }
+          target = { variableSetId };
+        } else {
+          if (variableSetName === undefined) {
+            throw new Error("provide exactly one of variableSetId or variableSetName");
+          }
+          target = { variableSetName };
+        }
+        if (
+          ("variableSetId" in target && target.variableSetId.length === 0) ||
+          ("variableSetName" in target && target.variableSetName.trim().length === 0)
+        ) {
+          throw new Error("provide exactly one of variableSetId or variableSetName");
+        }
+        const parsedName = VariableSetVariableName.safeParse(name);
+        if (!parsedName.success) {
+          throw new Error("variable set variable names must match ^[A-Z][A-Z0-9_]*$");
+        }
+        assertAllowedVariableSetVariableName(parsedName.data);
+        const claims = exactAgentAttemptClaims(grant);
+        if (!claims || claims.sessionId !== sessionId) {
+          throw new Error("Exact signed secret-read attempt authority is required.");
+        }
+        await requireLiveAgentAttemptAuthorization(deps.db, grant, sessionId);
+        await authorizeFirstPartySession(deps, grant, sessionId, "session.secret.read");
+        const key = requireVariableSetEncryption(deps.settings);
+        const secret = await readVariableSetSecretAtomically(deps.db, {
+          accountId: grant.accountId,
+          workspaceId: grant.workspaceId,
+          subjectId: grant.subjectId,
+          ...target,
+          name: parsedName.data,
+          actor: {
+            kind: "agent_attempt",
+            sessionId: claims.sessionId,
+            turnId: claims.turnId,
+            attemptId: claims.attemptId,
+            executionGeneration: claims.executionGeneration,
+          },
+          decrypt: (valueEncrypted) => decryptVariableSetValue(key, valueEncrypted),
+        });
+        if (!secret) throw new Error("variable set variable not found");
+        return json(secret);
+      },
     );
   }
 
-  if (can("variable-sets:manage")) {
+  if (can("variable-sets:write") && can("secrets:write")) {
     registerSetTool(
       "variable_set_set_variable",
-      "Set or rotate one variable in a variable set. Target by variableSetId, or by variableSetName (created if it does not exist). The value is encrypted at rest and injected into sandboxes of sessions the variable set is attached to; it is never readable back through any API.",
+      "Set or rotate one variable in a variable set. Target by variableSetId, or by variableSetName (created if it does not exist). The value is encrypted at rest and injected into sandboxes of sessions the variable set is attached to. Reading it requires the dedicated permissioned secret-read operation.",
     );
     registerSetTool(
       "environment_set_variable",
-      "(deprecated alias of variable_set_set_variable) Set or rotate one variable in a variable set. Target by variableSetId, or by variableSetName (created if it does not exist). The value is encrypted at rest and injected into sandboxes of sessions the variable set is attached to; it is never readable back through any API.",
+      "(deprecated alias of variable_set_set_variable) Set or rotate one variable in a variable set. Target by variableSetId, or by variableSetName (created if it does not exist). The value is encrypted at rest and injected into sandboxes of sessions the variable set is attached to. Reading it requires the dedicated permissioned secret-read operation.",
     );
   }
 }
 
+type CapabilitySetupProjection =
+  | { status: "ready"; action: null; detail: string }
+  | {
+      status: "authorization_required";
+      action: "connect" | "add_credentials" | "enable";
+      detail: string;
+    }
+  | { status: "unavailable"; action: null; detail: string };
+
+function registerCapabilityDiscoveryTools(
+  server: McpServer,
+  deps: ApiRouteDeps,
+  grant: AccessGrant,
+  sessionId: string,
+  json: JsonResult,
+): void {
+  const catalog = () =>
+    buildCapabilityCatalog({
+      db: deps.db,
+      workspaceId: grant.workspaceId,
+      settings: deps.settings,
+      subjectId: grant.subjectId,
+    });
+  const authorize = async () => {
+    await authorizeFirstPartySession(deps, grant, sessionId, "session.first_party_mcp.call");
+  };
+
+  server.registerTool(
+    "capability_catalog_search",
+    {
+      description:
+        "Search OpenGeni's reviewed workspace capability catalog when the user asks to add an integration or the task needs a capability that is not currently usable. Search by the outcome needed (for example `GitHub repositories`, `product analytics`, or `Slack notifications`), compare the returned candidates, and prefer a ready or verified exact match. This only reads secret-free metadata; it never installs, connects, or authorizes anything.",
+      inputSchema: {
+        query: z4.string().min(1).max(500),
+        limit: z4.number().int().min(1).max(20).optional(),
+      },
+    },
+    async ({ query, limit }) => {
+      await authorize();
+      const current = await catalog();
+      const ranked = searchCapabilityCatalogItems(
+        [...current.items, ...nativeConnectionCapabilityRecommendations()],
+        query,
+        limit ?? 8,
+      );
+      const matches = await Promise.all(
+        ranked.map(async ({ item, matchedOn }) => ({
+          capabilityId: item.id,
+          name: item.name,
+          description: item.description,
+          kind: item.kind,
+          source: item.source,
+          category: item.category,
+          tags: item.tags.slice(0, 16),
+          providerDomain: item.providerDomain,
+          authKind: item.authKind,
+          tier: item.tier,
+          matchedOn,
+          setup: {
+            ...(await capabilitySetupProjection(deps, grant.workspaceId, item)),
+            requiredVariables: capabilityRequiredVariables(item),
+          },
+        })),
+      );
+      return json({ query, matches });
+    },
+  );
+
+  server.registerTool(
+    "capability_authorization_request",
+    {
+      description:
+        "After capability_catalog_search and after explaining one chosen recommendation to the user, post exactly one in-session human authorization card for that catalog capability. This tool never grants access, enables a capability, reads a secret, or mints provider credentials; the authenticated user must click and confirm the provider/domain flow. Do not call it for a candidate reported ready or unavailable.",
+      inputSchema: {
+        capabilityId: z4.string().min(1).max(512),
+        rationale: z4.string().min(1).max(2000),
+      },
+    },
+    async ({ capabilityId, rationale }) => {
+      await authorize();
+      const current = await catalog();
+      const item = [...current.items, ...nativeConnectionCapabilityRecommendations()].find(
+        (candidate) => candidate.id === capabilityId,
+      );
+      if (!item || !capabilityCatalogItemIsTrustedForExposure(item)) {
+        throw new Error("Unknown or untrusted capability; search the catalog again.");
+      }
+      const setup = await capabilitySetupProjection(deps, grant.workspaceId, item);
+      if (setup.status === "ready") {
+        return json({
+          capabilityId: item.id,
+          status: "ready",
+          message: setup.detail,
+        });
+      }
+      if (setup.status === "unavailable") {
+        return json({
+          capabilityId: item.id,
+          status: "unavailable",
+          message: setup.detail,
+        });
+      }
+      const claims = exactAgentCommandContext(grant, sessionId);
+      const payload = ToolAuthNeededPayload.parse({
+        serverId: item.runtime.mcpServerId ?? "opengeni",
+        toolName: "capability_authorization_request",
+        providerDomain: capabilityProviderDomain(item),
+        reason: "missing_connection",
+        capability: {
+          id: item.id,
+          name: item.name,
+          kind: item.kind,
+          source: item.source,
+          action: setup.action,
+          rationale,
+          requiredVariables: capabilityRequiredVariables(item),
+        },
+      });
+      const appended = await appendAndPublishTurnEventsFenced(
+        deps.db,
+        deps.bus,
+        grant.workspaceId,
+        sessionId,
+        claims.callerTurnId,
+        claims.callerExecutionGeneration,
+        claims.callerAttemptId,
+        [{ type: "tool.auth_needed", payload }],
+      );
+      if (!appended.accepted) {
+        throw new Error(
+          "The calling turn was replaced before the authorization request committed.",
+        );
+      }
+      return json({
+        capabilityId: item.id,
+        status: "authorization_requested",
+        action: setup.action,
+        eventId: appended.events[0]?.id ?? null,
+        message:
+          "The recommendation was posted for human confirmation. No access has been granted yet.",
+      });
+    },
+  );
+}
+
+async function capabilitySetupProjection(
+  deps: ApiRouteDeps,
+  workspaceId: string,
+  item: CapabilityCatalogItem,
+): Promise<CapabilitySetupProjection> {
+  if (item.id === "api:github-app" || item.surfaceType === "first_party_github") {
+    const missing = githubAppMissingSettings(deps.settings);
+    if (missing.length > 0) {
+      return {
+        status: "unavailable",
+        action: null,
+        detail:
+          deps.settings.productAccessMode === "managed"
+            ? "GitHub is not available on this deployment."
+            : `The operator must configure the GitHub App first (${missing.join(", ")}).`,
+      };
+    }
+    const installations = await listWorkspaceGitHubInstallationBindings(deps, workspaceId);
+    if (githubBindingStatus(true, installations) === "bound") {
+      return { status: "ready", action: null, detail: "GitHub is connected and ready." };
+    }
+    return {
+      status: "authorization_required",
+      action: "connect",
+      detail: "A GitHub owner must approve an installation and repository allowlist.",
+    };
+  }
+  if (item.surfaceType === "codex_apps") {
+    return item.enabled
+      ? { status: "ready", action: null, detail: "Codex Apps is connected and ready." }
+      : {
+          status: "authorization_required",
+          action: "connect",
+          detail: "A workspace admin must designate an authorized Codex Apps subscription.",
+        };
+  }
+  if (item.enabled) {
+    return { status: "ready", action: null, detail: "This capability is already enabled." };
+  }
+  if (!item.runtime.available) {
+    return {
+      status: "unavailable",
+      action: null,
+      detail: item.runtime.notes ?? "This catalog entry has no executable runtime adapter.",
+    };
+  }
+  if (item.authKind === "oauth2" || item.surfaceType === "first_party_social") {
+    return {
+      status: "authorization_required",
+      action: "connect",
+      detail: "The user must confirm the provider domain and complete sign-in.",
+    };
+  }
+  if (item.authKind === "api_key" || item.authModel?.toLowerCase().includes("key")) {
+    return {
+      status: "authorization_required",
+      action: "add_credentials",
+      detail: "The user must provide the required credential through the protected setup form.",
+    };
+  }
+  return {
+    status: "authorization_required",
+    action: "enable",
+    detail: "A workspace admin must review and enable this capability.",
+  };
+}
+
+function capabilityRequiredVariables(item: CapabilityCatalogItem): string[] {
+  const variableSet = item.metadata.variableSet;
+  if (!variableSet || typeof variableSet !== "object" || Array.isArray(variableSet)) return [];
+  const required = (variableSet as Record<string, unknown>).requiredVariables;
+  return Array.isArray(required)
+    ? required.filter((name): name is string => typeof name === "string").slice(0, 64)
+    : [];
+}
+
+function capabilityProviderDomain(item: CapabilityCatalogItem): string {
+  if (item.providerDomain?.trim()) return item.providerDomain.trim();
+  for (const candidate of [item.homepageUrl, item.endpointUrl, item.mcpUrl]) {
+    if (!candidate) continue;
+    try {
+      return new URL(candidate).hostname;
+    } catch {
+      // Continue to the local, non-provider fallback below.
+    }
+  }
+  return "opengeni.local";
+}
+
 function registerGitHubConnectTool(
   server: McpServer,
   deps: ApiRouteDeps,
@@ -2976,7 +4382,8 @@ function repositoryWithScheduledTaskResource(
       kind: "repository",
       uri,
       ref: repository.defaultBranch,
-      mountPath: defaultRepositoryMountPath(uri),
+      provider: "github",
+      mountPath: defaultRepositoryMountPath(uri, "github"),
       ...(repository.private
         ? {
             githubInstallationId: repository.installationId,
@@ -3421,11 +4828,12 @@ function parseMcpDate(raw: string, label: string): Date {
 async function withMcpEffectivePolicy(
   deps: ApiRouteDeps,
   workspaceId: string,
+  subjectId: string,
   session: Session,
 ): Promise<Session> {
   const [workspaceServerIds, workspaceDefaultServerIds] = await Promise.all([
-    workspaceSessionToolPolicyServerIds(deps.db, workspaceId, deps.settings),
-    workspaceSessionToolPolicyDefaultServerIds(deps.db, workspaceId, deps.settings),
+    workspaceSessionToolPolicyServerIds(deps.db, workspaceId, deps.settings, subjectId),
+    workspaceSessionToolPolicyDefaultServerIds(deps.db, workspaceId, deps.settings, subjectId),
   ]);
   return sessionWithEffectiveToolPolicy(session, workspaceServerIds, workspaceDefaultServerIds);
 }