@opengeni/api-router 0.23.1 → 0.26.1

package/src/mcp/server.ts

@@ -12,16 +12,22 @@ import {
   SessionEventResultMode,
   SessionEventSemanticClass,
   SessionEventType,
+  stableJson,
   compactSessionEventResult,
   sessionEventLatestClassToSemanticClass,
+  MemorySlackPublicationDistribution,
   SessionMcpCredentialUpdateInput,
+  ToolAuthNeededPayload,
   VariableSetVariableName,
+  capabilityCatalogItemIsTrustedForExposure,
   type AccessGrant,
+  type CapabilityCatalogItem,
   type GitHubRepository,
   type FirstPartyMcpToolName,
   type Permission,
   type ResourceRef,
   type SessionAuthorizationOperation,
+  type SessionAuthorizationActor,
   type SessionAuthorizationSurface,
   type Session,
   type ScheduledTask,
@@ -30,7 +36,6 @@ import {
   WORKSPACE_ARTIFACT_HTML_MAX_UTF8_BYTES,
 } from "@opengeni/contracts";
 import {
-  correctWorkspaceMemory,
   countVariableSets,
   beginRigChangeVerificationAttempt,
   createVariableSet,
@@ -67,7 +72,6 @@ import {
   MEMORY_SEARCH_TOOL_DESCRIPTION,
   requireScheduledTask,
   requireSession,
-  saveWorkspaceMemory,
   searchWorkspaceMemories,
   serializeEffectiveSessionControl,
   setSessionGoalStatusWithEvent,
@@ -75,7 +79,6 @@ import {
   updateScheduledTask,
   updateSessionGoalWithEvent,
   upsertSessionGoalWithEvent,
-  RigChangeAlreadyVerifyingError,
   RigChangeTransitionError,
   createWorkspaceArtifact,
   getWorkspaceArtifact,
@@ -84,7 +87,11 @@ import {
   publishWorkspaceArtifactVersion,
   rollbackWorkspaceArtifact,
 } from "@opengeni/db";
-import { appendAndPublishEvents, publishDurableSessionEvents } from "@opengeni/events";
+import {
+  appendAndPublishEvents,
+  appendAndPublishTurnEventsFenced,
+  publishDurableSessionEvents,
+} from "@opengeni/events";
 import {
   createSignedState,
   GitHubAppConfigurationError,
@@ -102,9 +109,15 @@ import {
   hasLiteralPermission,
   hasPermission,
   authorizedSocialConnectionsForGrant,
+  authorizedAtlassianConnectionsForGrant,
+  buildCapabilityCatalog,
+  nativeConnectionCapabilityRecommendations,
+  correctWorkspaceMemoryWithSlackPublication,
   requireLiveAgentAttemptAuthorization,
   requireSessionAuthorization,
   requireSessionAuthorizationListScope,
+  saveWorkspaceMemoryWithSlackPublication,
+  searchCapabilityCatalogItems,
   type ResolvedSessionAuthorization,
 } from "@opengeni/core";
 import { recordWorkspaceUsage, requireLimit } from "@opengeni/core";
@@ -116,12 +129,14 @@ import {
 } from "../github-access";
 import { githubBrowserBaseUrl, githubBrowserGrantClaims } from "../github-browser-flow";
 import {
+  assertSocialConnectionProvider,
   socialMentionsLive,
   socialOwnPostsLive,
   socialPostReply,
   socialSearchLive,
   socialThreadLive,
 } from "../integrations/social-api";
+import { revokeKnowledgeSourceScheduleAuthorization } from "../integrations/google-drive";
 import {
   promoteVerifiedDefinitionEditChangeForApi,
   proposeRigChangeForApi,
@@ -186,18 +201,24 @@ import {
   boundScheduledTaskMcpPage,
   scheduledTaskMcpSummary,
 } from "./scheduled-task-view";
-import type { ToolspaceMcpSurface } from "./toolspace";
 import { ensureSessionGroupReady as ensureViewerSessionGroupReady } from "../sandbox/viewer";
 import {
   createOpenGeniSlackBotClient,
   resolveSlackBotConnectionForTool,
 } from "../integrations/slack-bot";
+import {
+  browseAtlassianSources,
+  getAtlassianLiveItem,
+  revokeAtlassianScheduleAuthorization,
+  searchAtlassianLive,
+} from "../integrations/atlassian";
+import { AtlassianConnectionMetadata } from "@opengeni/contracts/atlassian";
+import { registerEditableArtifactAgentTools } from "./editable-artifacts";
 
 export type McpServerOptions = {
   // Origin of the HTTP request that reached the MCP route. Browser-oriented
   // tools use it only when no configured public base URL is available.
   requestOrigin?: string | null;
-  toolspace?: ToolspaceMcpSurface | null;
   workspaceMemoryEnabled?: boolean | undefined;
 };
 
@@ -246,6 +267,20 @@ const FIRST_PARTY_TOOL_AUTHORIZATION = {
   session_resume: { allOf: ["sessions:control"] },
   session_steer: { sessionRequired: true, allOf: ["sessions:control"] },
   set_other_session_title: { allOf: ["sessions:control"] },
+  interaction_discover: { sessionRequired: true, allOf: ["sessions:read"] },
+  browser_open: { sessionRequired: true, allOf: ["sessions:control"] },
+  browser_tabs: { sessionRequired: true, allOf: ["sessions:control"] },
+  browser_observe: { sessionRequired: true, allOf: ["sessions:read"] },
+  browser_act: { sessionRequired: true, allOf: ["sessions:control"] },
+  browser_debug: { sessionRequired: true, allOf: ["sessions:read"] },
+  browser_identity: { sessionRequired: true, allOf: ["sessions:control"] },
+  browser_publish: { sessionRequired: true, allOf: ["sessions:control"] },
+  browser_lifecycle: { sessionRequired: true, allOf: ["sessions:control"] },
+  computer_open: { sessionRequired: true, allOf: ["sessions:control"] },
+  computer_targets: { sessionRequired: true, allOf: ["sessions:read"] },
+  computer_observe: { sessionRequired: true, allOf: ["sessions:read"] },
+  computer_act: { sessionRequired: true, allOf: ["sessions:control"] },
+  computer_lifecycle: { sessionRequired: true, allOf: ["sessions:control"] },
   variable_set_list: { allOf: ["variable-sets:list", "secrets:list"] },
   environment_list: { allOf: ["variable-sets:list", "secrets:list"] },
   variable_set_get_variable: {
@@ -256,6 +291,11 @@ const FIRST_PARTY_TOOL_AUTHORIZATION = {
     allOf: ["variable-sets:write", "secrets:write"],
   },
   environment_set_variable: { allOf: ["variable-sets:write", "secrets:write"] },
+  capability_catalog_search: { sessionRequired: true, allOf: ["workspace:read"] },
+  capability_authorization_request: {
+    sessionRequired: true,
+    allOf: ["workspace:read"],
+  },
   github_connect_link: { allOf: ["github:use"] },
   github_repositories_list: { allOf: ["github:use"] },
   social_connections_list: { allOf: ["connections:read"] },
@@ -270,6 +310,18 @@ const FIRST_PARTY_TOOL_AUTHORIZATION = {
   // Publishes under the user's identity: connections:write keeps it out of the
   // default agent permission set, unlike the read-only social tools above.
   social_post_reply: { allOf: ["connections:write"] },
+  x_accounts_list: { allOf: ["connections:read"] },
+  x_search_live: { allOf: ["connections:read"] },
+  x_mentions_live: { allOf: ["connections:read"] },
+  x_thread_fetch: { allOf: ["connections:read"] },
+  x_posts_sync: { allOf: ["connections:write"] },
+  x_post_reply: { allOf: ["connections:write"] },
+  reddit_accounts_list: { allOf: ["connections:read"] },
+  reddit_search_live: { allOf: ["connections:read"] },
+  reddit_mentions_live: { allOf: ["connections:read"] },
+  reddit_thread_fetch: { allOf: ["connections:read"] },
+  reddit_posts_sync: { allOf: ["connections:write"] },
+  reddit_post_reply: { allOf: ["connections:write"] },
   scheduled_tasks_list: {
     anyOf: ["scheduled_tasks:manage", "scheduled_tasks:run"],
   },
@@ -294,11 +346,31 @@ const FIRST_PARTY_TOOL_AUTHORIZATION = {
   slack_bot_file_content: { allOf: ["connections:read"] },
   slack_bot_post_message: { allOf: ["connections:read"] },
   slack_bot_delete_message: { allOf: ["connections:read"] },
+  atlassian_sources_list: { allOf: ["connections:read"] },
+  atlassian_search: { allOf: ["connections:read"] },
+  atlassian_get: { allOf: ["connections:read"] },
   artifacts_list: { sessionRequired: true, allOf: ["artifacts:read"] },
   artifacts_get_source: { sessionRequired: true, allOf: ["artifacts:read"] },
   artifacts_create: { sessionRequired: true, allOf: ["artifacts:publish"] },
   artifacts_publish: { sessionRequired: true, allOf: ["artifacts:publish"] },
   artifacts_rollback: { sessionRequired: true, allOf: ["artifacts:publish"] },
+  editable_artifact_list: { sessionRequired: true, allOf: ["artifacts:read"] },
+  editable_artifact_create: { sessionRequired: true, allOf: ["artifacts:publish"] },
+  editable_artifact_import: {
+    sessionRequired: true,
+    allOf: ["artifacts:publish", "files:read"],
+  },
+  editable_artifact_get: { sessionRequired: true, allOf: ["artifacts:read"] },
+  editable_artifact_inspect: { sessionRequired: true, allOf: ["artifacts:read"] },
+  editable_artifact_apply: { sessionRequired: true, allOf: ["artifacts:publish"] },
+  editable_artifact_export: {
+    sessionRequired: true,
+    allOf: ["artifacts:read"],
+  },
+  editable_artifact_export_status: {
+    sessionRequired: true,
+    allOf: ["artifacts:read", "files:upload"],
+  },
 } satisfies Record<FirstPartyMcpToolName, FirstPartyToolAuthorization>;
 
 const FIRST_PARTY_MCP_TOOL_NAME_SET = new Set<string>(FIRST_PARTY_MCP_TOOL_NAMES);
@@ -310,7 +382,6 @@ class PolicyMcpServer extends McpServer {
     private readonly grant: AccessGrant,
     private readonly sessionId: string | null,
     private readonly selectedTools: ReadonlySet<FirstPartyMcpToolName> | null,
-    private readonly allowUncatalogued: boolean,
   ) {
     super({ name: "opengeni", version: "1.0.0" });
   }
@@ -331,7 +402,7 @@ class PolicyMcpServer extends McpServer {
     cb: ToolCallback<InputArgs>,
   ): RegisteredTool {
     const catalogued = FIRST_PARTY_MCP_TOOL_NAME_SET.has(name);
-    let admitted = this.allowUncatalogued && !catalogued;
+    let admitted = false;
     if (catalogued) {
       const toolName = name as FirstPartyMcpToolName;
       const policy: FirstPartyToolAuthorization = FIRST_PARTY_TOOL_AUTHORIZATION[toolName];
@@ -388,7 +459,6 @@ export function buildOpenGeniMcpServer(
     content: [{ type: "text" as const, text: JSON.stringify(value, null, 2) }],
   });
   const can = (permission: Permission) => hasPermission(grant.permissions, permission);
-  const toolspaceMode = options.toolspace != null;
   let socialConnectionsPromise: ReturnType<typeof authorizedSocialConnectionsForGrant> | undefined;
   const authorizedSocialConnections = () =>
     (socialConnectionsPromise ??= authorizedSocialConnectionsForGrant({
@@ -403,6 +473,14 @@ export function buildOpenGeniMcpServer(
     if (!authority) throw new Error(`Unknown or unavailable social connection: ${connectionId}`);
     return authority;
   };
+  const requireAuthorizedSocialConnectionForProvider = async (
+    provider: "x" | "reddit",
+    connectionId: string,
+  ) => {
+    const authority = await requireAuthorizedSocialConnection(connectionId);
+    assertSocialConnectionProvider(authority.connection, provider);
+    return authority;
+  };
 
   // Session-scoped tools key off the worker-asserted sessionId claim (signed
   // into the delegated token by the worker, never agent-controlled).
@@ -411,17 +489,17 @@ export function buildOpenGeniMcpServer(
       ? (grant.metadata["sessionId"] as string)
       : null;
   const selectedTools =
-    sessionId !== null && !toolspaceMode
+    sessionId !== null
       ? new Set(
           (grant.metadata?.["firstPartyMcpTools"] as FirstPartyMcpToolName[] | undefined) ??
             DEFAULT_FIRST_PARTY_MCP_TOOLS,
         )
       : null;
-  const server = new PolicyMcpServer(grant, sessionId, selectedTools, toolspaceMode);
+  const server = new PolicyMcpServer(grant, sessionId, selectedTools);
   // set_session_title names the agent's OWN session — pure session metadata,
   // not a goal operation — so it is available on every session, gated only on
   // the signed sessionId (NOT goals:manage, and NOT on a goal existing).
-  if (sessionId !== null && (!toolspaceMode || can("sessions:control"))) {
+  if (sessionId !== null) {
     server.registerTool(
       "set_session_title",
       {
@@ -444,18 +522,23 @@ export function buildOpenGeniMcpServer(
   if (sessionId !== null && can("goals:manage")) {
     registerGoalTools(server, deps, grant, sessionId, json);
   }
-  // Toolspace grants are the sandbox's narrowed proxy surface. Unlike the
-  // normal first-party worker token, a bare toolspace:call token does not see
-  // unpermissioned session tools; memory follows that title/goal parity and
-  // stays on the normal first-party MCP surface only.
-  if (!toolspaceMode && sessionId !== null && options.workspaceMemoryEnabled === true) {
+  if (sessionId !== null && options.workspaceMemoryEnabled === true) {
     registerMemoryTools(server, deps, grant, sessionId, json);
   }
-  if (!toolspaceMode && sessionId !== null && preferenceAttemptClaims(grant) !== null) {
+  if (sessionId !== null && exactAgentAttemptClaims(grant) !== null) {
     registerPreferenceRegistryTools(server, deps, grant, json);
   }
-  if (!toolspaceMode && sessionId !== null && preferenceAttemptClaims(grant) !== null) {
+  if (sessionId !== null && exactAgentAttemptClaims(grant) !== null) {
     registerWorkspaceArtifactTools(server, deps, grant, sessionId, json);
+    registerEditableArtifactAgentTools({
+      server,
+      deps,
+      grant,
+      sessionId,
+      authorize: async () => {
+        await authorizeFirstPartySession(deps, grant, sessionId, "session.first_party_mcp.call");
+      },
+    });
   }
 
   // Fleet tools (M7 bring-your-own-compute): list / attach / swap / run_on /
@@ -464,16 +547,15 @@ export function buildOpenGeniMcpServer(
   // so they register only when the grant carries the worker-signed sessionId claim
   // (never agent-controlled). Gated on the selfhosted feature flag: the active
   // pointer + swap are only meaningful when bring-your-own-compute is enabled.
-  if (!toolspaceMode && sessionId !== null && deps.settings.sandboxSelfhostedEnabled) {
+  if (sessionId !== null && deps.settings.sandboxSelfhostedEnabled) {
     registerFleetTools(server, deps, grant, sessionId, json);
   }
-  if (!toolspaceMode && can("enrollments:manage") && deps.settings.sandboxSelfhostedEnabled) {
+  if (can("enrollments:manage") && deps.settings.sandboxSelfhostedEnabled) {
     registerConnectedMachineTools(server, deps, grant, json);
   }
-  if (!toolspaceMode) {
-    registerRigTools(server, deps, grant, can, sessionId, json);
-    registerSlackBotTools(server, deps, grant, sessionId, json);
-  }
+  registerRigTools(server, deps, grant, can, sessionId, json);
+  registerSlackBotTools(server, deps, grant, sessionId, json);
+  registerAtlassianTools(server, deps, grant, json);
 
   // Orchestration, variableSet, and GitHub status tools are permission-gated
   // at registration: a grant without the permission does not see the tool.
@@ -486,13 +568,16 @@ export function buildOpenGeniMcpServer(
   // never returned through a model-visible MCP tool. A user DEMOTES a specific
   // session by setting a narrower session.firstPartyMcpPermissions (capped to
   // the creator's own grant); operators still cap what any session can be given.
-  registerWorkspaceOrchestrationTools(server, deps, grant, can, sessionId, toolspaceMode, json);
-  registerVariableSetTools(server, deps, grant, can, sessionId, toolspaceMode, json);
+  registerWorkspaceOrchestrationTools(server, deps, grant, can, sessionId, json);
+  registerVariableSetTools(server, deps, grant, can, sessionId, json);
+  if (sessionId !== null && can("workspace:read")) {
+    registerCapabilityDiscoveryTools(server, deps, grant, sessionId, json);
+  }
   if (can("github:use")) {
     registerGitHubConnectTool(server, deps, grant, options, json);
   }
 
-  if (!toolspaceMode || can("github:use")) {
+  if (can("github:use")) {
     server.registerTool(
       "github_repositories_list",
       {
@@ -521,7 +606,7 @@ export function buildOpenGeniMcpServer(
     );
   }
 
-  if (!toolspaceMode || can("connections:read")) {
+  if (can("connections:read")) {
     server.registerTool(
       "social_connections_list",
       {
@@ -726,12 +811,122 @@ export function buildOpenGeniMcpServer(
         });
       },
     );
+
+    // Provider-scoped aliases are the canonical tools advertised by the X and
+    // Reddit Integration cards. The legacy social_* names remain available to
+    // existing Packs/sessions, but these names bind the provider in the tool
+    // identity and reject a near-identical Connection from the other adapter.
+    for (const provider of ["x", "reddit"] as const) {
+      const providerName = provider === "x" ? "X" : "Reddit";
+      server.registerTool(
+        `${provider}_accounts_list`,
+        {
+          description: `List the exact visible ${providerName} accounts available to this work.`,
+          inputSchema: { limit: z4.number().int().positive().optional() },
+        },
+        async ({ limit }) =>
+          json({
+            connections: (await authorizedSocialConnections())
+              .filter(
+                ({ connection }) =>
+                  connection.provider === provider && connection.status !== "disabled",
+              )
+              .slice(0, boundedMcpLimit(limit))
+              .map(({ connection }) => connection),
+          }),
+      );
+      server.registerTool(
+        `${provider}_search_live`,
+        {
+          description:
+            provider === "x"
+              ? "Search recent X conversations through one exact connected X account."
+              : "Search Reddit through one exact connected Reddit account; optionally scope to a subreddit.",
+          inputSchema: {
+            connectionId: z4.string().uuid(),
+            query: z4.string().min(1).max(512),
+            subreddit: z4.string().min(1).max(100).optional(),
+            limit: z4.number().int().positive().optional(),
+          },
+        },
+        async ({ connectionId, query, subreddit, limit }) => {
+          const authority = await requireAuthorizedSocialConnectionForProvider(
+            provider,
+            connectionId,
+          );
+          const result = await socialSearchLive(
+            deps,
+            {
+              workspaceId: grant.workspaceId,
+              connectionId,
+              subjectId: authority.subjectId,
+            },
+            { query, subreddit, limit },
+          );
+          return json({ provider: result.connection.provider, posts: result.posts });
+        },
+      );
+      server.registerTool(
+        `${provider}_mentions_live`,
+        {
+          description: `Fetch live ${providerName} mentions and replies through one exact connected account.`,
+          inputSchema: {
+            connectionId: z4.string().uuid(),
+            sinceId: z4.string().optional(),
+            limit: z4.number().int().positive().optional(),
+          },
+        },
+        async ({ connectionId, sinceId, limit }) => {
+          const authority = await requireAuthorizedSocialConnectionForProvider(
+            provider,
+            connectionId,
+          );
+          const result = await socialMentionsLive(
+            deps,
+            {
+              workspaceId: grant.workspaceId,
+              connectionId,
+              subjectId: authority.subjectId,
+            },
+            { sinceId, limit },
+          );
+          return json({ provider: result.connection.provider, posts: result.posts });
+        },
+      );
+      server.registerTool(
+        `${provider}_thread_fetch`,
+        {
+          description: `Fetch one live ${providerName} conversation thread through an exact connected account.`,
+          inputSchema: {
+            connectionId: z4.string().uuid(),
+            id: z4.string().min(1).max(100),
+            limit: z4.number().int().positive().optional(),
+          },
+        },
+        async ({ connectionId, id, limit }) => {
+          const authority = await requireAuthorizedSocialConnectionForProvider(
+            provider,
+            connectionId,
+          );
+          const result = await socialThreadLive(
+            deps,
+            {
+              workspaceId: grant.workspaceId,
+              connectionId,
+              subjectId: authority.subjectId,
+            },
+            { id, limit },
+          );
+          return json({ provider: result.connection.provider, posts: result.posts });
+        },
+      );
+    }
   }
 
   // Writes are gated on connections:write (never in the default first-party
   // agent permission set) so scheduled tasks must opt in, and deployments can
   // additionally wrap posting in a requireApproval policy.
-  if (!toolspaceMode || can("connections:write")) {
+  if (can("connections:write")) {
     server.registerTool(
       "social_posts_sync",
       {
@@ -827,9 +1022,106 @@ export function buildOpenGeniMcpServer(
         });
       },
     );
+
+    for (const provider of ["x", "reddit"] as const) {
+      const providerName = provider === "x" ? "X" : "Reddit";
+      server.registerTool(
+        `${provider}_posts_sync`,
+        {
+          description: `Sync one exact connected ${providerName} account's recent posts into OpenGeni (idempotent).`,
+          inputSchema: {
+            connectionId: z4.string().uuid(),
+            limit: z4.number().int().positive().optional(),
+          },
+        },
+        async ({ connectionId, limit }) => {
+          const authority = await requireAuthorizedSocialConnectionForProvider(
+            provider,
+            connectionId,
+          );
+          const result = await socialOwnPostsLive(
+            deps,
+            {
+              workspaceId: grant.workspaceId,
+              connectionId,
+              subjectId: authority.subjectId,
+            },
+            { limit },
+          );
+          const datedPosts = result.posts.filter((post) => post.createdAt !== null);
+          const synced = await recordSyncedSocialPosts(deps.db, {
+            accountId: grant.accountId,
+            workspaceId: grant.workspaceId,
+            connectionId,
+            subjectId: authority.subjectId,
+            posts: datedPosts.map((post) => ({
+              externalPostId: post.id,
+              url: post.url,
+              authorHandle: post.author,
+              text: post.text,
+              publishedAt: new Date(post.createdAt!),
+              metrics: post.metrics,
+            })),
+          });
+          return json({
+            provider: result.connection.provider,
+            fetched: result.posts.length,
+            inserted: synced.inserted,
+            skipped: synced.skipped,
+            skippedMissingDate: result.posts.length - datedPosts.length,
+          });
+        },
+      );
+      server.registerTool(
+        `${provider}_post_reply`,
+        {
+          description: `Publish a reply from one exact connected ${providerName} account. This is a public write and should require approval.`,
+          inputSchema: {
+            connectionId: z4.string().uuid(),
+            inReplyToId: z4.string().min(1).max(100),
+            text: z4.string().min(1).max(10000),
+          },
+        },
+        async ({ connectionId, inReplyToId, text }) => {
+          const authority = await requireAuthorizedSocialConnectionForProvider(
+            provider,
+            connectionId,
+          );
+          const result = await socialPostReply(
+            deps,
+            {
+              workspaceId: grant.workspaceId,
+              connectionId,
+              subjectId: authority.subjectId,
+            },
+            { inReplyToId, text },
+          );
+          await recordAuditEvent(deps.db, {
+            accountId: grant.accountId,
+            workspaceId: grant.workspaceId,
+            subjectId: grant.subjectId,
+            action: "social.post_reply",
+            targetType: "social_connection",
+            targetId: connectionId,
+            metadata: {
+              provider: result.connection.provider,
+              adapterTool: `${provider}_post_reply`,
+              inReplyToId,
+              postedId: result.postedId,
+              url: result.url,
+            },
+          });
+          return json({
+            provider: result.connection.provider,
+            postedId: result.postedId,
+            url: result.url,
+          });
+        },
+      );
+    }
   }
 
-  if (!toolspaceMode || can("scheduled_tasks:manage") || can("scheduled_tasks:run")) {
+  if (can("scheduled_tasks:manage") || can("scheduled_tasks:run")) {
     server.registerTool(
       "scheduled_tasks_list",
       {
@@ -977,6 +1269,9 @@ export function buildOpenGeniMcpServer(
           sessionAuthorization: deps.sessionAuthorization,
           authorizationSurface: "first_party_mcp",
         });
+        if (!scheduledTaskUpdateChangesState(existing, update)) {
+          return json(scheduledTaskReceipt("scheduled_tasks_update", existing, "unchanged", false));
+        }
         const task = await updateScheduledTask(deps.db, grant.workspaceId, id, update);
         await syncUpdatedScheduledTask({
           db: deps.db,
@@ -984,7 +1279,7 @@ export function buildOpenGeniMcpServer(
           previous,
           task,
         });
-        return json(scheduledTaskForGrant(task, grant));
+        return json(scheduledTaskReceipt("scheduled_tasks_update", task, "updated", true));
       },
     );
 
@@ -996,6 +1291,9 @@ export function buildOpenGeniMcpServer(
       },
       async ({ id }) => {
         const existing = await requireScheduledTask(deps.db, grant.workspaceId, id);
+        if (existing.status === "paused") {
+          return json(scheduledTaskReceipt("scheduled_tasks_pause", existing, "unchanged", false));
+        }
         const previous = await captureScheduledTaskRestoreState(deps.db, existing);
         const task = await updateScheduledTask(deps.db, grant.workspaceId, id, {
           status: "paused",
@@ -1006,7 +1304,7 @@ export function buildOpenGeniMcpServer(
           previous,
           task,
         });
-        return json(scheduledTaskForGrant(task, grant));
+        return json(scheduledTaskReceipt("scheduled_tasks_pause", task, "updated", true));
       },
     );
 
@@ -1018,6 +1316,9 @@ export function buildOpenGeniMcpServer(
       },
       async ({ id }) => {
         const existing = await requireScheduledTask(deps.db, grant.workspaceId, id);
+        if (existing.status === "active") {
+          return json(scheduledTaskReceipt("scheduled_tasks_resume", existing, "unchanged", false));
+        }
         const previous = await captureScheduledTaskRestoreState(deps.db, existing);
         const task = await updateScheduledTask(deps.db, grant.workspaceId, id, {
           status: "active",
@@ -1028,7 +1329,7 @@ export function buildOpenGeniMcpServer(
           previous,
           task,
         });
-        return json(scheduledTaskForGrant(task, grant));
+        return json(scheduledTaskReceipt("scheduled_tasks_resume", task, "updated", true));
       },
     );
 
@@ -1044,31 +1345,32 @@ export function buildOpenGeniMcpServer(
       },
       async ({ id, triggerId }) => {
         const task = await requireScheduledTask(deps.db, grant.workspaceId, id);
-        await validateScheduledTaskTarget({
-          db: deps.db,
-          sessionAuthorization: deps.sessionAuthorization,
-          authorizationSurface: "first_party_mcp",
-          grant,
-          targetSessionId: task.targetSessionId,
-          runMode: task.runMode,
-          variableSetId: task.variableSetId,
-          rigId: task.rigId,
-          agentConfig: task.agentConfig,
-          missingTargetStatus: 404,
-        });
-        await requireLimit(deps, {
-          accountId: grant.accountId,
-          workspaceId: grant.workspaceId,
-          action: "agent_run:create",
-          quantity: 1,
-          model: task.agentConfig.model ?? deps.settings.openaiModel,
-        });
+        if (task.action.kind === "agent_turn") {
+          await validateScheduledTaskTarget({
+            db: deps.db,
+            sessionAuthorization: deps.sessionAuthorization,
+            authorizationSurface: "first_party_mcp",
+            grant,
+            targetSessionId: task.targetSessionId,
+            runMode: task.runMode,
+            variableSetId: task.variableSetId,
+            rigId: task.rigId,
+            agentConfig: task.agentConfig,
+            missingTargetStatus: 404,
+          });
+          await requireLimit(deps, {
+            accountId: grant.accountId,
+            workspaceId: grant.workspaceId,
+            action: "agent_run:create",
+            quantity: 1,
+            model: task.agentConfig.model ?? deps.settings.openaiModel,
+          });
+        }
         const triggerToken = scheduledTaskTriggerToken(triggerId);
-        const agentRunUsageIdempotencyKey = manualScheduledTaskTriggerUsageKey(
-          grant.workspaceId,
-          task.id,
-          triggerToken,
-        );
+        const agentRunUsageIdempotencyKey =
+          task.action.kind === "agent_turn"
+            ? manualScheduledTaskTriggerUsageKey(grant.workspaceId, task.id, triggerToken)
+            : `knowledge-source-sync:manual:${grant.workspaceId}:${task.id}:${triggerToken}`;
         const triggerWorkflowId = manualScheduledTaskTriggerWorkflowId(task.id, triggerToken);
         await deps.workflowClient.triggerScheduledTask({
           task,
@@ -1077,6 +1379,14 @@ export function buildOpenGeniMcpServer(
           initiator: { kind: "subject", subjectId: grant.subjectId },
         });
         try {
+          if (task.action.kind !== "agent_turn") {
+            return json(
+              scheduledTaskReceipt("scheduled_tasks_trigger", task, "triggered", true, {
+                idempotencyStatus: triggerId ? "unknown" : "not_requested",
+                facts: { triggerWorkflowId },
+              }),
+            );
+          }
           await recordWorkspaceUsage(deps, {
             accountId: grant.accountId,
             workspaceId: grant.workspaceId,
@@ -1117,6 +1427,17 @@ export function buildOpenGeniMcpServer(
       },
       async ({ id }) => {
         const task = await requireScheduledTask(deps.db, grant.workspaceId, id);
+        if (task.metadata.connectorKind === "atlassian") {
+          await revokeAtlassianScheduleAuthorization(deps, {
+            task,
+            subjectId: grant.subjectId,
+          });
+        } else {
+          await revokeKnowledgeSourceScheduleAuthorization(deps, {
+            task,
+            subjectId: grant.subjectId,
+          });
+        }
         await deps.workflowClient.deleteScheduledTaskSchedule({
           temporalScheduleId: task.temporalScheduleId,
         });
@@ -1163,7 +1484,6 @@ export function buildOpenGeniMcpServer(
     );
   }
 
-  registerToolspaceProxyTools(server, options.toolspace ?? null);
   server.ensureToolsListHandler();
 
   return server;
@@ -1404,48 +1724,114 @@ function registerSlackBotTools(
   );
 }
 
-function registerToolspaceProxyTools(server: McpServer, surface: ToolspaceMcpSurface | null): void {
-  if (!surface) {
-    return;
-  }
-  // McpServer installs its tools/list handler lazily on the first registered
-  // tool. A legitimate empty Toolspace surface (no selected proxyable servers,
-  // no active turn, or all optional upstreams unavailable) must therefore seed
-  // and disable one invisible tool; otherwise `ogtool list` receives JSON-RPC
-  // "Method not found" instead of the valid `{ tools: [] }` response.
-  if (surface.tools.length === 0) {
-    server
-      .registerTool(
-        "__opengeni_empty_toolspace_surface__",
-        {
-          description: "Internal disabled placeholder for an empty Toolspace surface.",
-          inputSchema: z4.object({}),
-        },
-        async () => ({
-          content: [{ type: "text" as const, text: '{"unavailable":true}' }],
+function registerAtlassianTools(
+  server: McpServer,
+  deps: ApiRouteDeps,
+  grant: AccessGrant,
+  json: JsonResult,
+): void {
+  const connectionFor = async (connectionId?: string) => {
+    const authorized = await authorizedAtlassianConnectionsForGrant({ db: deps.db, grant });
+    const candidates = authorized.filter(({ connection }) =>
+      connectionId ? connection.id === connectionId : true,
+    );
+    if (candidates.length === 0) {
+      throw new Error(
+        connectionId
+          ? "the requested Atlassian connection is unavailable for this turn"
+          : "no Atlassian connection is available for this turn",
+      );
+    }
+    if (!connectionId && candidates.length > 1) {
+      throw new Error(
+        "connectionId is required because multiple Atlassian connections are available",
+      );
+    }
+    const authority = candidates[0]!;
+    const metadata = AtlassianConnectionMetadata.safeParse(authority.connection.metadata);
+    if (!metadata.success) throw new Error("Atlassian connection metadata is invalid");
+    return {
+      connection: authority.connection,
+      metadata: metadata.data,
+      subjectId: authority.subjectId ?? grant.subjectId,
+    };
+  };
+
+  server.registerTool(
+    "atlassian_sources_list",
+    {
+      description:
+        "List the Jira projects and Confluence spaces available through the authorized Atlassian connection, including which sources are selected for OpenGeni. Use this before search when the site or boundary is unclear.",
+      inputSchema: { connectionId: z4.string().uuid().optional() },
+    },
+    async ({ connectionId }) => {
+      const authority = await connectionFor(connectionId);
+      const response = await browseAtlassianSources(deps, {
+        workspaceId: grant.workspaceId,
+        subjectId: authority.subjectId,
+        connectionId: authority.connection.id,
+      });
+      const selected = new Set(authority.metadata.selectedSources.map((source) => source.id));
+      return json({
+        connectionId: authority.connection.id,
+        account: authority.metadata.displayName,
+        items: response.items.map((item) => ({ ...item, selected: selected.has(item.id) })),
+      });
+    },
+  );
+
+  server.registerTool(
+    "atlassian_search",
+    {
+      description:
+        "Search Jira issues and Confluence pages live within the projects and spaces selected for OpenGeni. Results reflect current Atlassian data and permissions, independent of the knowledge sync index.",
+      inputSchema: {
+        connectionId: z4.string().uuid().optional(),
+        query: z4.string().min(1).max(500),
+        product: z4.enum(["jira", "confluence"]).optional(),
+        limit: z4.number().int().min(1).max(50).optional(),
+      },
+    },
+    async ({ connectionId, query, product, limit }) => {
+      const authority = await connectionFor(connectionId);
+      return json({
+        connectionId: authority.connection.id,
+        results: await searchAtlassianLive(deps, {
+          workspaceId: grant.workspaceId,
+          subjectId: authority.subjectId,
+          connectionId: authority.connection.id,
+          query,
+          ...(product ? { product } : {}),
+          limit: limit ?? 20,
         }),
-      )
-      .disable();
-    return;
-  }
-  for (const tool of surface.tools) {
-    server.registerTool(
-      tool.name,
-      {
-        ...(tool.description ? { description: tool.description } : {}),
-        inputSchema: z4.object({}).passthrough(),
-        _meta: {
-          opengeni: {
-            origin: "toolspace",
-            subjectId: surface.subjectId,
-            sessionId: surface.sessionId,
-            ...(tool.inputSchema ? { inputSchema: tool.inputSchema } : {}),
-          },
-        },
+      });
+    },
+  );
+
+  server.registerTool(
+    "atlassian_get",
+    {
+      description:
+        "Open one current Jira issue or Confluence page, including description or page content and comments. The item must belong to a project or space selected for OpenGeni.",
+      inputSchema: {
+        connectionId: z4.string().uuid().optional(),
+        kind: z4.enum(["jira_issue", "confluence_page"]),
+        id: z4.string().min(1).max(256),
       },
-      async (args) => await tool.call(args),
-    );
-  }
+    },
+    async ({ connectionId, kind, id }) => {
+      const authority = await connectionFor(connectionId);
+      return json(
+        await getAtlassianLiveItem(deps, {
+          workspaceId: grant.workspaceId,
+          subjectId: authority.subjectId,
+          connectionId: authority.connection.id,
+          kind,
+          id,
+        }),
+      );
+    },
+  );
 }
 
 /** Only a prompt explicitly supplied through the human/API channel may redirect a user-paused goal. */
@@ -1519,7 +1905,7 @@ function registerGoalTools(
           ? (grant.metadata["turnId"] as string)
           : null;
       await assertGoalReactivationAllowed(deps, grant.workspaceId, sessionId, callerTurnId);
-      const { goal, events } = await upsertSessionGoalWithEvent(deps.db, {
+      const { goal, replaced, events } = await upsertSessionGoalWithEvent(deps.db, {
         accountId: grant.accountId,
         workspaceId: grant.workspaceId,
         sessionId,
@@ -1532,7 +1918,24 @@ function registerGoalTools(
       if (events.length > 0) {
         await deps.bus.publish(grant.workspaceId, sessionId, events);
       }
-      return json(goal);
+      return json(
+        mcpMutationReceipt({
+          operation: "goal_set",
+          committed: true,
+          outcome: replaced ? "updated" : "created",
+          changed: true,
+          resource: {
+            type: "session_goal",
+            id: goal.id,
+            version: goal.version,
+            state: goal.status,
+          },
+          timestamp: goal.updatedAt,
+          idempotency: { status: "not_supported" },
+          facts: { replaced },
+          nextAction: { tool: "session_get", arguments: { sessionId } },
+        }),
+      );
     },
   );
 
@@ -1706,7 +2109,7 @@ function registerWorkspaceArtifactTools(
   json: JsonResult,
 ): void {
   const attempt = () => {
-    const claims = preferenceAttemptClaims(grant);
+    const claims = exactAgentAttemptClaims(grant);
     if (!claims) throw new Error("Exact signed artifact attempt authority is required.");
     return claims;
   };
@@ -1894,7 +2297,7 @@ function registerWorkspaceArtifactTools(
   );
 }
 
-function preferenceAttemptClaims(grant: AccessGrant): {
+function exactAgentAttemptClaims(grant: AccessGrant): {
   sessionId: string;
   turnId: string;
   attemptId: string;
@@ -1927,7 +2330,7 @@ function registerPreferenceRegistryTools(
   json: JsonResult,
 ): void {
   const attemptClaims = () => {
-    const resolved = preferenceAttemptClaims(grant);
+    const resolved = exactAgentAttemptClaims(grant);
     if (!resolved) throw new Error("Exact signed preference attempt authority is required.");
     return {
       accountId: grant.accountId,
@@ -1992,11 +2395,69 @@ function scheduledTaskReceipt(
   });
 }
 
+function scheduledTaskUpdateChangesState(
+  task: ScheduledTask,
+  update: Awaited<ReturnType<typeof validatedScheduledTaskUpdate>>,
+): boolean {
+  if (update.name !== undefined && update.name !== task.name) return true;
+  if (update.status !== undefined && update.status !== task.status) return true;
+  if (update.schedule !== undefined && stableJson(update.schedule) !== stableJson(task.schedule)) {
+    return true;
+  }
+  if (update.runMode !== undefined && update.runMode !== task.runMode) return true;
+  if (update.overlapPolicy !== undefined && update.overlapPolicy !== task.overlapPolicy)
+    return true;
+  if (
+    update.agentConfig !== undefined &&
+    stableJson(update.agentConfig) !== stableJson(task.agentConfig)
+  ) {
+    return true;
+  }
+  if (update.targetSessionId !== undefined && update.targetSessionId !== task.targetSessionId) {
+    return true;
+  }
+  if (
+    update.reusableSessionId !== undefined &&
+    update.reusableSessionId !== task.reusableSessionId
+  ) {
+    return true;
+  }
+  if (update.variableSetId !== undefined && update.variableSetId !== task.variableSetId)
+    return true;
+  if (update.rigId !== undefined && update.rigId !== task.rigId) return true;
+  if (update.metadata !== undefined && stableJson(update.metadata) !== stableJson(task.metadata)) {
+    return true;
+  }
+  // Personal-connection delegations are recomputed with agentConfig and can
+  // change even when the visible config is byte-identical (for example after a
+  // connection rotation), so preserve that refresh as a real mutation.
+  if (update.personalConnectionDelegations !== undefined) return true;
+  return false;
+}
+
 function memoryPreview(text: string): string {
   const normalized = text.replace(/\s+/g, " ").trim();
   return normalized.length <= 120 ? normalized : `${normalized.slice(0, 119)}…`;
 }
 
+export function memorySlackPublicationActor(
+  actor: Extract<SessionAuthorizationActor, { kind: "agent_attempt" }>,
+  sessionId: string,
+  fallbackOwnerLabel: string | null,
+) {
+  return {
+    actor: {
+      kind: actor.initiator.kind === "subject" ? ("human" as const) : ("service" as const),
+      subjectId: actor.initiator.subjectId,
+      initiatingHumanSubjectId: actor.initiatingHumanSubjectId,
+      sessionId,
+      turnId: actor.turnId,
+      attemptId: actor.attemptId,
+    },
+    ownerLabel: actor.initiator.label ?? fallbackOwnerLabel,
+  };
+}
+
 function registerMemoryTools(
   server: McpServer,
   deps: ApiRouteDeps,
@@ -2004,6 +2465,17 @@ function registerMemoryTools(
   sessionId: string,
   json: JsonResult,
 ): void {
+  const publicationActor = async () => {
+    const actor = await requireLiveAgentAttemptAuthorization(deps.db, grant, sessionId);
+    return memorySlackPublicationActor(actor, sessionId, grant.subjectLabel ?? null);
+  };
+  const publicationInputSchema = z4.object({
+    importance: z4.enum(["major", "normal", "minor"]),
+    audience: z4.literal("workspace"),
+    slackMode: z4.enum(["auto", "review", "never"]),
+    shareSummary: z4.string().trim().min(1).max(4_096),
+  });
+
   server.registerTool(
     "memory_search",
     {
@@ -2038,10 +2510,12 @@ function registerMemoryTools(
         kind: MemoryKindSchema,
         confidence: z4.number().min(0).max(1).optional(),
         replaces_id: z4.string().min(1).optional(),
+        slack_publication: publicationInputSchema.optional(),
       },
     },
-    async ({ text, kind, confidence, replaces_id }) => {
-      const result = await saveWorkspaceMemory(
+    async ({ text, kind, confidence, replaces_id, slack_publication }) => {
+      const principal = slack_publication ? await publicationActor() : null;
+      const result = await saveWorkspaceMemoryWithSlackPublication(
         deps.db,
         {
           accountId: grant.accountId,
@@ -2053,6 +2527,13 @@ function registerMemoryTools(
           ...(replaces_id ? { replacesId: replaces_id } : {}),
           origin: "agent",
         },
+        slack_publication
+          ? {
+              distribution: MemorySlackPublicationDistribution.parse(slack_publication),
+              actor: principal!.actor,
+              ownerLabel: principal!.ownerLabel,
+            }
+          : null,
         deps.getDocumentServices().embedder,
       );
       await appendAndPublishEvents(deps.db, deps.bus, grant.workspaceId, sessionId, [
@@ -2104,6 +2585,19 @@ function registerMemoryTools(
             dedupeReason: result.dedupeReason,
             updatedInPlace: result.updated,
             embedded: result.embedded,
+            slackPublicationDecision: result.slackPublication.decision?.eligible
+              ? "eligible"
+              : (result.slackPublication.decision?.reason ?? "not_requested"),
+            slackPublicationId:
+              result.slackPublication.enqueue?.kind === "enqueued" ||
+              result.slackPublication.enqueue?.kind === "replayed"
+                ? result.slackPublication.enqueue.publication.id
+                : null,
+            slackPublicationState:
+              result.slackPublication.enqueue?.kind === "enqueued" ||
+              result.slackPublication.enqueue?.kind === "replayed"
+                ? result.slackPublication.enqueue.publication.state
+                : null,
           },
         }),
       );
@@ -2118,10 +2612,12 @@ function registerMemoryTools(
         id: z4.string().min(1),
         reason: z4.string().min(1).optional(),
         replacement_text: z4.string().min(1).optional(),
+        slack_publication: publicationInputSchema.optional(),
       },
     },
-    async ({ id, reason, replacement_text }) => {
-      const result = await correctWorkspaceMemory(
+    async ({ id, reason, replacement_text, slack_publication }) => {
+      const principal = slack_publication ? await publicationActor() : null;
+      const result = await correctWorkspaceMemoryWithSlackPublication(
         deps.db,
         {
           accountId: grant.accountId,
@@ -2131,6 +2627,13 @@ function registerMemoryTools(
           ...(reason ? { reason } : {}),
           ...(replacement_text ? { replacementText: replacement_text } : {}),
         },
+        slack_publication
+          ? {
+              distribution: MemorySlackPublicationDistribution.parse(slack_publication),
+              actor: principal!.actor,
+              ownerLabel: principal!.ownerLabel,
+            }
+          : null,
         deps.getDocumentServices().embedder,
       );
       await appendAndPublishEvents(deps.db, deps.bus, grant.workspaceId, sessionId, [
@@ -2173,7 +2676,22 @@ function registerMemoryTools(
             : undefined,
           timestamp: (result.replacement ?? result.memory).updatedAt,
           idempotency: { status: "not_supported" },
-          facts: { correctionAction: result.action },
+          facts: {
+            correctionAction: result.action,
+            slackPublicationDecision: result.slackPublication.decision?.eligible
+              ? "eligible"
+              : (result.slackPublication.decision?.reason ?? "not_requested"),
+            slackPublicationId:
+              result.slackPublication.enqueue?.kind === "enqueued" ||
+              result.slackPublication.enqueue?.kind === "replayed"
+                ? result.slackPublication.enqueue.publication.id
+                : null,
+            slackPublicationState:
+              result.slackPublication.enqueue?.kind === "enqueued" ||
+              result.slackPublication.enqueue?.kind === "replayed"
+                ? result.slackPublication.enqueue.publication.state
+                : null,
+          },
         }),
       );
     },
@@ -2309,7 +2827,7 @@ function registerConnectedMachineTools(
     "connected_machine_remove",
     {
       description:
-        "Remove one enrolled self-hosted machine while it is offline. Access is revoked, future heartbeat/reconnect credentials are rejected, session/route/lease/archive history is retained, and a fresh human-approved device-flow enrollment is required to reconnect. Pass the enrollmentId from the Machines surface, never a Modal sandbox id. Blocked outcomes include the exact active dependency and the action needed before retrying.",
+        "Remove one enrolled self-hosted machine while it is offline. Access is revoked, future heartbeat/reconnect credentials are rejected, session/route/lease/archive history is retained, and a fresh human-approved device-flow enrollment is required to reconnect. Pass the enrollmentId from the Machines surface, never a Modal sandbox id. Blocked outcomes include every dependent session and the action needed before retrying. Move each dependent session through the canonical sandbox_swap target=default path before retrying removal; the removal authority never rewrites routes directly.",
       inputSchema: {
         enrollmentId: z4.string().uuid(),
         expectedUpdatedAt: z4.string().datetime({ offset: true }).optional(),
@@ -2341,12 +2859,10 @@ async function beginMcpRigVerificationAttempt(
   try {
     return await beginRigChangeVerificationAttempt(deps.db, workspaceId, changeId, {
       startedAt: new Date().toISOString(),
+      allowAlreadyVerifying: true,
     });
   } catch (error) {
-    if (
-      error instanceof RigChangeAlreadyVerifyingError ||
-      error instanceof RigChangeTransitionError
-    ) {
+    if (error instanceof RigChangeTransitionError) {
       throw new Error(error.message, { cause: error });
     }
     throw error;
@@ -2685,7 +3201,6 @@ function registerWorkspaceOrchestrationTools(
   grant: AccessGrant,
   can: (permission: Permission) => boolean,
   callerSessionId: string | null,
-  toolspaceMode: boolean,
   json: JsonResult,
 ): void {
   if (can("sessions:read")) {
@@ -2763,7 +3278,7 @@ function registerWorkspaceOrchestrationTools(
         );
         return json(
           boundSessionDetailMcp(
-            await withMcpEffectivePolicy(deps, grant.workspaceId, {
+            await withMcpEffectivePolicy(deps, grant.workspaceId, grant.subjectId, {
               ...projected,
               effectiveControl: queue?.effectiveControl ?? projected.effectiveControl,
             }),
@@ -2911,9 +3426,21 @@ function registerWorkspaceOrchestrationTools(
           // Bind the spawned session to a rig (freezes its active version);
           // declared so MCP validation doesn't strip it before the domain reads it.
           rigId: z4.string().uuid().optional(),
-          model: z4.string().min(1).optional(),
-          reasoningEffort: z4.string().optional(),
-          latencyMode: z4.enum(["standard", "priority", "fast"]).optional(),
+          model: z4
+            .string()
+            .min(1)
+            .optional()
+            .describe(
+              "Model for the worker. Omit to inherit the exact calling turn's model, including its Codex subscription billing path.",
+            ),
+          reasoningEffort: z4
+            .string()
+            .optional()
+            .describe("Omit to inherit the exact calling turn's reasoning effort."),
+          latencyMode: z4
+            .enum(["standard", "priority", "fast"])
+            .optional()
+            .describe("Omit to inherit the exact calling turn's latency mode."),
           sandboxBackend: z4.string().optional(),
           // Create-time machine targeting: an enrolled sandbox id (from
           // sandboxes_list) to run the spawned session on. Seeds the active-sandbox
@@ -3007,7 +3534,7 @@ function registerWorkspaceOrchestrationTools(
     );
   }
 
-  if (can("sessions:control") && !toolspaceMode) {
+  if (can("sessions:control")) {
     server.registerTool(
       "session_send_message",
       {
@@ -3123,16 +3650,25 @@ function registerWorkspaceOrchestrationTools(
               reason: reason ?? "agent_mcp_pause",
             },
           );
-          return json({
-            receiptId: controlled.receipt.id,
-            effectiveControl: projectEffectiveControlForRelatedAccess(
-              serializeEffectiveSessionControl(controlled.control),
-              sessionId,
-              controlled.authorization?.relatedSessionAccess ?? "root",
-            ),
-            interruptionCount: controlled.interruptionCount,
-            replay: controlled.replay,
-          });
+          const effectiveControl = projectEffectiveControlForRelatedAccess(
+            serializeEffectiveSessionControl(controlled.control),
+            sessionId,
+            controlled.authorization?.relatedSessionAccess ?? "root",
+          );
+          return json(
+            mcpMutationReceipt({
+              operation: "session_pause",
+              committed: true,
+              outcome: controlled.replay ? "replayed" : "updated",
+              changed: !controlled.replay,
+              resource: { type: "session", id: sessionId, state: effectiveControl.state },
+              relatedResources: [{ type: "session_command_receipt", id: controlled.receipt.id }],
+              timestamp: controlled.receipt.createdAt.toISOString(),
+              idempotency: { status: controlled.replay ? "replayed" : "applied" },
+              facts: { interruptionCount: controlled.interruptionCount },
+              nextAction: { tool: "session_get", arguments: { sessionId } },
+            }),
+          );
         }
         const controlled = await controlHumanSessionWorkstream(
           deps,
@@ -3176,16 +3712,25 @@ function registerWorkspaceOrchestrationTools(
               reason: reason ?? "agent_mcp_resume",
             },
           );
-          return json({
-            receiptId: controlled.receipt.id,
-            effectiveControl: projectEffectiveControlForRelatedAccess(
-              serializeEffectiveSessionControl(controlled.control),
-              sessionId,
-              controlled.authorization?.relatedSessionAccess ?? "root",
-            ),
-            interruptionCount: controlled.interruptionCount,
-            replay: controlled.replay,
-          });
+          const effectiveControl = projectEffectiveControlForRelatedAccess(
+            serializeEffectiveSessionControl(controlled.control),
+            sessionId,
+            controlled.authorization?.relatedSessionAccess ?? "root",
+          );
+          return json(
+            mcpMutationReceipt({
+              operation: "session_resume",
+              committed: true,
+              outcome: controlled.replay ? "replayed" : "updated",
+              changed: !controlled.replay,
+              resource: { type: "session", id: sessionId, state: effectiveControl.state },
+              relatedResources: [{ type: "session_command_receipt", id: controlled.receipt.id }],
+              timestamp: controlled.receipt.createdAt.toISOString(),
+              idempotency: { status: controlled.replay ? "replayed" : "applied" },
+              facts: { interruptionCount: controlled.interruptionCount },
+              nextAction: { tool: "session_get", arguments: { sessionId } },
+            }),
+          );
         }
         const controlled = await controlHumanSessionWorkstream(
           deps,
@@ -3283,7 +3828,6 @@ function registerVariableSetTools(
   grant: AccessGrant,
   can: (permission: Permission) => boolean,
   sessionId: string | null,
-  toolspaceMode: boolean,
   json: JsonResult,
 ): void {
   const registerListTool = (name: string, description: string): void => {
@@ -3435,7 +3979,6 @@ function registerVariableSetTools(
   }
 
   if (
-    !toolspaceMode &&
     sessionId !== null &&
     can("variable-sets:read") &&
     hasLiteralPermission(grant.permissions, "secrets:read")
@@ -3475,7 +4018,7 @@ function registerVariableSetTools(
           throw new Error("variable set variable names must match ^[A-Z][A-Z0-9_]*$");
         }
         assertAllowedVariableSetVariableName(parsedName.data);
-        const claims = preferenceAttemptClaims(grant);
+        const claims = exactAgentAttemptClaims(grant);
         if (!claims || claims.sessionId !== sessionId) {
           throw new Error("Exact signed secret-read attempt authority is required.");
         }
@@ -3515,6 +4058,240 @@ function registerVariableSetTools(
   }
 }
 
+type CapabilitySetupProjection =
+  | { status: "ready"; action: null; detail: string }
+  | {
+      status: "authorization_required";
+      action: "connect" | "add_credentials" | "enable";
+      detail: string;
+    }
+  | { status: "unavailable"; action: null; detail: string };
+
+function registerCapabilityDiscoveryTools(
+  server: McpServer,
+  deps: ApiRouteDeps,
+  grant: AccessGrant,
+  sessionId: string,
+  json: JsonResult,
+): void {
+  const catalog = () =>
+    buildCapabilityCatalog({
+      db: deps.db,
+      workspaceId: grant.workspaceId,
+      settings: deps.settings,
+      subjectId: grant.subjectId,
+    });
+  const authorize = async () => {
+    await authorizeFirstPartySession(deps, grant, sessionId, "session.first_party_mcp.call");
+  };
+
+  server.registerTool(
+    "capability_catalog_search",
+    {
+      description:
+        "Search OpenGeni's reviewed workspace capability catalog when the user asks to add an integration or the task needs a capability that is not currently usable. Search by the outcome needed (for example `GitHub repositories`, `product analytics`, or `Slack notifications`), compare the returned candidates, and prefer a ready or verified exact match. This only reads secret-free metadata; it never installs, connects, or authorizes anything.",
+      inputSchema: {
+        query: z4.string().min(1).max(500),
+        limit: z4.number().int().min(1).max(20).optional(),
+      },
+    },
+    async ({ query, limit }) => {
+      await authorize();
+      const current = await catalog();
+      const ranked = searchCapabilityCatalogItems(
+        [...current.items, ...nativeConnectionCapabilityRecommendations()],
+        query,
+        limit ?? 8,
+      );
+      const matches = await Promise.all(
+        ranked.map(async ({ item, matchedOn }) => ({
+          capabilityId: item.id,
+          name: item.name,
+          description: item.description,
+          kind: item.kind,
+          source: item.source,
+          category: item.category,
+          tags: item.tags.slice(0, 16),
+          providerDomain: item.providerDomain,
+          authKind: item.authKind,
+          tier: item.tier,
+          matchedOn,
+          setup: {
+            ...(await capabilitySetupProjection(deps, grant.workspaceId, item)),
+            requiredVariables: capabilityRequiredVariables(item),
+          },
+        })),
+      );
+      return json({ query, matches });
+    },
+  );
+
+  server.registerTool(
+    "capability_authorization_request",
+    {
+      description:
+        "After capability_catalog_search and after explaining one chosen recommendation to the user, post exactly one in-session human authorization card for that catalog capability. This tool never grants access, enables a capability, reads a secret, or mints provider credentials; the authenticated user must click and confirm the provider/domain flow. Do not call it for a candidate reported ready or unavailable.",
+      inputSchema: {
+        capabilityId: z4.string().min(1).max(512),
+        rationale: z4.string().min(1).max(2000),
+      },
+    },
+    async ({ capabilityId, rationale }) => {
+      await authorize();
+      const current = await catalog();
+      const item = [...current.items, ...nativeConnectionCapabilityRecommendations()].find(
+        (candidate) => candidate.id === capabilityId,
+      );
+      if (!item || !capabilityCatalogItemIsTrustedForExposure(item)) {
+        throw new Error("Unknown or untrusted capability; search the catalog again.");
+      }
+      const setup = await capabilitySetupProjection(deps, grant.workspaceId, item);
+      if (setup.status === "ready") {
+        return json({
+          capabilityId: item.id,
+          status: "ready",
+          message: setup.detail,
+        });
+      }
+      if (setup.status === "unavailable") {
+        return json({
+          capabilityId: item.id,
+          status: "unavailable",
+          message: setup.detail,
+        });
+      }
+      const claims = exactAgentCommandContext(grant, sessionId);
+      const payload = ToolAuthNeededPayload.parse({
+        serverId: item.runtime.mcpServerId ?? "opengeni",
+        toolName: "capability_authorization_request",
+        providerDomain: capabilityProviderDomain(item),
+        reason: "missing_connection",
+        capability: {
+          id: item.id,
+          name: item.name,
+          kind: item.kind,
+          source: item.source,
+          action: setup.action,
+          rationale,
+          requiredVariables: capabilityRequiredVariables(item),
+        },
+      });
+      const appended = await appendAndPublishTurnEventsFenced(
+        deps.db,
+        deps.bus,
+        grant.workspaceId,
+        sessionId,
+        claims.callerTurnId,
+        claims.callerExecutionGeneration,
+        claims.callerAttemptId,
+        [{ type: "tool.auth_needed", payload }],
+      );
+      if (!appended.accepted) {
+        throw new Error(
+          "The calling turn was replaced before the authorization request committed.",
+        );
+      }
+      return json({
+        capabilityId: item.id,
+        status: "authorization_requested",
+        action: setup.action,
+        eventId: appended.events[0]?.id ?? null,
+        message:
+          "The recommendation was posted for human confirmation. No access has been granted yet.",
+      });
+    },
+  );
+}
+
+async function capabilitySetupProjection(
+  deps: ApiRouteDeps,
+  workspaceId: string,
+  item: CapabilityCatalogItem,
+): Promise<CapabilitySetupProjection> {
+  if (item.id === "api:github-app" || item.surfaceType === "first_party_github") {
+    const missing = githubAppMissingSettings(deps.settings);
+    if (missing.length > 0) {
+      return {
+        status: "unavailable",
+        action: null,
+        detail:
+          deps.settings.productAccessMode === "managed"
+            ? "GitHub is not available on this deployment."
+            : `The operator must configure the GitHub App first (${missing.join(", ")}).`,
+      };
+    }
+    const installations = await listWorkspaceGitHubInstallationBindings(deps, workspaceId);
+    if (githubBindingStatus(true, installations) === "bound") {
+      return { status: "ready", action: null, detail: "GitHub is connected and ready." };
+    }
+    return {
+      status: "authorization_required",
+      action: "connect",
+      detail: "A GitHub owner must approve an installation and repository allowlist.",
+    };
+  }
+  if (item.surfaceType === "codex_apps") {
+    return item.enabled
+      ? { status: "ready", action: null, detail: "Codex Apps is connected and ready." }
+      : {
+          status: "authorization_required",
+          action: "connect",
+          detail: "A workspace admin must designate an authorized Codex Apps subscription.",
+        };
+  }
+  if (item.enabled) {
+    return { status: "ready", action: null, detail: "This capability is already enabled." };
+  }
+  if (!item.runtime.available) {
+    return {
+      status: "unavailable",
+      action: null,
+      detail: item.runtime.notes ?? "This catalog entry has no executable runtime adapter.",
+    };
+  }
+  if (item.authKind === "oauth2" || item.surfaceType === "first_party_social") {
+    return {
+      status: "authorization_required",
+      action: "connect",
+      detail: "The user must confirm the provider domain and complete sign-in.",
+    };
+  }
+  if (item.authKind === "api_key" || item.authModel?.toLowerCase().includes("key")) {
+    return {
+      status: "authorization_required",
+      action: "add_credentials",
+      detail: "The user must provide the required credential through the protected setup form.",
+    };
+  }
+  return {
+    status: "authorization_required",
+    action: "enable",
+    detail: "A workspace admin must review and enable this capability.",
+  };
+}
+
+function capabilityRequiredVariables(item: CapabilityCatalogItem): string[] {
+  const variableSet = item.metadata.variableSet;
+  if (!variableSet || typeof variableSet !== "object" || Array.isArray(variableSet)) return [];
+  const required = (variableSet as Record<string, unknown>).requiredVariables;
+  return Array.isArray(required)
+    ? required.filter((name): name is string => typeof name === "string").slice(0, 64)
+    : [];
+}
+
+function capabilityProviderDomain(item: CapabilityCatalogItem): string {
+  if (item.providerDomain?.trim()) return item.providerDomain.trim();
+  for (const candidate of [item.homepageUrl, item.endpointUrl, item.mcpUrl]) {
+    if (!candidate) continue;
+    try {
+      return new URL(candidate).hostname;
+    } catch {
+      // Continue to the local, non-provider fallback below.
+    }
+  }
+  return "opengeni.local";
+}
+
 function registerGitHubConnectTool(
   server: McpServer,
   deps: ApiRouteDeps,
@@ -4051,11 +4828,12 @@ function parseMcpDate(raw: string, label: string): Date {
 async function withMcpEffectivePolicy(
   deps: ApiRouteDeps,
   workspaceId: string,
+  subjectId: string,
   session: Session,
 ): Promise<Session> {
   const [workspaceServerIds, workspaceDefaultServerIds] = await Promise.all([
-    workspaceSessionToolPolicyServerIds(deps.db, workspaceId, deps.settings),
-    workspaceSessionToolPolicyDefaultServerIds(deps.db, workspaceId, deps.settings),
+    workspaceSessionToolPolicyServerIds(deps.db, workspaceId, deps.settings, subjectId),
+    workspaceSessionToolPolicyDefaultServerIds(deps.db, workspaceId, deps.settings, subjectId),
   ]);
   return sessionWithEffectiveToolPolicy(session, workspaceServerIds, workspaceDefaultServerIds);
 }