@opengeni/api-router 0.23.1 → 0.30.0

package/src/mcp/server.ts

@@ -1,7 +1,6 @@
 import { createHash, randomUUID } from "node:crypto";
 import {
   CreateScheduledTaskRequest,
-  DEFAULT_FIRST_PARTY_MCP_TOOLS,
   FIRST_PARTY_MCP_TOOL_NAMES,
   defaultRepositoryMountPath,
   SESSION_EVENT_RAW_DELTA_TYPES,
@@ -12,25 +11,41 @@ import {
   SessionEventResultMode,
   SessionEventSemanticClass,
   SessionEventType,
+  stableJson,
   compactSessionEventResult,
   sessionEventLatestClassToSemanticClass,
+  MemorySlackPublicationDistribution,
   SessionMcpCredentialUpdateInput,
+  ToolAuthNeededPayload,
   VariableSetVariableName,
+  capabilityCatalogItemIsTrustedForExposure,
   type AccessGrant,
+  type CapabilityCatalogItem,
   type GitHubRepository,
   type FirstPartyMcpToolName,
   type Permission,
   type ResourceRef,
   type SessionAuthorizationOperation,
+  type SessionAuthorizationActor,
   type SessionAuthorizationSurface,
   type Session,
+  type WorkspaceMemoryPromptMode,
   type ScheduledTask,
   UpdateScheduledTaskRequest,
   normalizeWorkspaceArtifactSlug,
   WORKSPACE_ARTIFACT_HTML_MAX_UTF8_BYTES,
+  SESSION_GOAL_PROGRESS_MAX_BYTES,
+  SESSION_GOAL_RATIONALE_MAX_BYTES,
+  SESSION_GOAL_SUCCESS_CRITERIA_MAX_BYTES,
+  SESSION_GOAL_TEXT_MAX_BYTES,
+  sessionGoalUtf8Bytes,
+  TASK_NOTE_LIST_DEFAULT_LIMIT,
+  TASK_NOTE_LIST_MAX_LIMIT,
+  TASK_NOTE_MAX_LIFETIME_DAYS,
+  TASK_NOTE_REASON_MAX_BYTES,
+  TASK_NOTE_TEXT_MAX_BYTES,
 } from "@opengeni/contracts";
 import {
-  correctWorkspaceMemory,
   countVariableSets,
   beginRigChangeVerificationAttempt,
   createVariableSet,
@@ -67,15 +82,14 @@ import {
   MEMORY_SEARCH_TOOL_DESCRIPTION,
   requireScheduledTask,
   requireSession,
-  saveWorkspaceMemory,
   searchWorkspaceMemories,
   serializeEffectiveSessionControl,
   setSessionGoalStatusWithEvent,
+  recordSessionGoalProgressWithEvent,
   setVariableSetVariable,
   updateScheduledTask,
   updateSessionGoalWithEvent,
   upsertSessionGoalWithEvent,
-  RigChangeAlreadyVerifyingError,
   RigChangeTransitionError,
   createWorkspaceArtifact,
   getWorkspaceArtifact,
@@ -83,8 +97,16 @@ import {
   listWorkspaceArtifacts,
   publishWorkspaceArtifactVersion,
   rollbackWorkspaceArtifact,
+  archiveTaskNote,
+  createTaskNote,
+  listTaskNotes,
 } from "@opengeni/db";
-import { appendAndPublishEvents, publishDurableSessionEvents } from "@opengeni/events";
+import {
+  appendAndPublishEvents,
+  appendAndPublishTurnEventsFenced,
+  publishDurableSessionEvents,
+} from "@opengeni/events";
+import { allowedFirstPartyMcpToolsForSession } from "@opengeni/config";
 import {
   createSignedState,
   GitHubAppConfigurationError,
@@ -97,14 +119,23 @@ import {
 } from "@modelcontextprotocol/sdk/server/mcp.js";
 import type { AnySchema, ZodRawShapeCompat } from "@modelcontextprotocol/sdk/server/zod-compat.js";
 import type { ToolAnnotations } from "@modelcontextprotocol/sdk/types.js";
+import { HTTPException } from "hono/http-exception";
 import * as z4 from "zod/v4";
 import {
   hasLiteralPermission,
   hasPermission,
   authorizedSocialConnectionsForGrant,
+  authorizedAtlassianConnectionsForGrant,
+  buildCapabilityCatalog,
+  nativeConnectionCapabilityRecommendations,
+  correctWorkspaceMemoryWithSlackPublication,
   requireLiveAgentAttemptAuthorization,
   requireSessionAuthorization,
   requireSessionAuthorizationListScope,
+  SessionAuthorizationDeniedError,
+  SessionAuthorizationUnavailableError,
+  saveWorkspaceMemoryWithSlackPublication,
+  searchCapabilityCatalogItems,
   type ResolvedSessionAuthorization,
 } from "@opengeni/core";
 import { recordWorkspaceUsage, requireLimit } from "@opengeni/core";
@@ -116,12 +147,14 @@ import {
 } from "../github-access";
 import { githubBrowserBaseUrl, githubBrowserGrantClaims } from "../github-browser-flow";
 import {
+  assertSocialConnectionProvider,
   socialMentionsLive,
   socialOwnPostsLive,
   socialPostReply,
   socialSearchLive,
   socialThreadLive,
 } from "../integrations/social-api";
+import { revokeKnowledgeSourceScheduleAuthorization } from "../integrations/google-drive";
 import {
   promoteVerifiedDefinitionEditChangeForApi,
   proposeRigChangeForApi,
@@ -186,21 +219,140 @@ import {
   boundScheduledTaskMcpPage,
   scheduledTaskMcpSummary,
 } from "./scheduled-task-view";
-import type { ToolspaceMcpSurface } from "./toolspace";
 import { ensureSessionGroupReady as ensureViewerSessionGroupReady } from "../sandbox/viewer";
 import {
   createOpenGeniSlackBotClient,
   resolveSlackBotConnectionForTool,
 } from "../integrations/slack-bot";
+import { createFikenClient, resolveFikenConnectionForTool } from "../integrations/fiken";
+import {
+  browseAtlassianSources,
+  getAtlassianLiveItem,
+  revokeAtlassianScheduleAuthorization,
+  searchAtlassianLive,
+} from "../integrations/atlassian";
+import { AtlassianConnectionMetadata } from "@opengeni/contracts/atlassian";
+import { registerEditableArtifactAgentTools } from "./editable-artifacts";
 
 export type McpServerOptions = {
   // Origin of the HTTP request that reached the MCP route. Browser-oriented
   // tools use it only when no configured public base URL is available.
   requestOrigin?: string | null;
-  toolspace?: ToolspaceMcpSurface | null;
   workspaceMemoryEnabled?: boolean | undefined;
+  workspaceMemoryPromptMode?: WorkspaceMemoryPromptMode | undefined;
 };
 
+const ORCHESTRATION_FAILURE_CODE_MAX_LENGTH = 128;
+const ORCHESTRATION_FAILURE_MESSAGE_MAX_UTF8_BYTES = 1_024;
+
+type OrchestrationToolName = "session_create" | "session_send_message";
+
+function boundedOrchestrationFailureMessage(value: string): string {
+  const normalized = value.replace(/[\u0000-\u001f\u007f]+/g, " ").trim();
+  if (!normalized) return "OpenGeni could not complete the request.";
+  const encoded = new TextEncoder().encode(normalized);
+  if (encoded.byteLength <= ORCHESTRATION_FAILURE_MESSAGE_MAX_UTF8_BYTES) return normalized;
+  let end = ORCHESTRATION_FAILURE_MESSAGE_MAX_UTF8_BYTES;
+  while (end > 0 && (encoded[end]! & 0xc0) === 0x80) end -= 1;
+  return new TextDecoder().decode(encoded.slice(0, end)).trim();
+}
+
+function orchestrationFailureCode(tool: OrchestrationToolName, error: HTTPException): string {
+  const suffix =
+    error.status === 401
+      ? "unauthenticated"
+      : error.status === 403
+        ? "forbidden"
+        : error.status === 404
+          ? "not_found"
+          : error.status === 409
+            ? "conflict"
+            : error.status === 429
+              ? "limit_exceeded"
+              : error.status >= 500
+                ? "unavailable"
+                : "rejected";
+  return `${tool}_${suffix}`.slice(0, ORCHESTRATION_FAILURE_CODE_MAX_LENGTH);
+}
+
+function orchestrationFailureEnvelope(tool: OrchestrationToolName, error: unknown) {
+  if (error instanceof SessionSpawnDeniedError) {
+    const denial = sessionSpawnDenialEnvelope(error);
+    return {
+      error: {
+        ...denial.error,
+        message: boundedOrchestrationFailureMessage(denial.error.message),
+      },
+    };
+  }
+  if (error instanceof HTTPException) {
+    return {
+      error: {
+        code: orchestrationFailureCode(tool, error),
+        message:
+          error.status >= 500
+            ? "OpenGeni is temporarily unavailable — retry."
+            : boundedOrchestrationFailureMessage(error.message),
+      },
+    };
+  }
+  if (error instanceof SessionAuthorizationDeniedError) {
+    return {
+      error: {
+        code: `${tool}_not_found_or_denied`,
+        message: "Session not found or access denied.",
+      },
+    };
+  }
+  if (error instanceof SessionAuthorizationUnavailableError) {
+    return {
+      error: {
+        code: `${tool}_authorization_unavailable`,
+        message: "Session authorization is temporarily unavailable — retry.",
+      },
+    };
+  }
+  const typedCode =
+    error && typeof error === "object" && "code" in error
+      ? (error as { code?: unknown }).code
+      : null;
+  const knownFailure =
+    typedCode === "CALLER_STALE"
+      ? ["caller_stale", "The calling session no longer owns this attempt."]
+      : typedCode === "CALLER_INTERRUPTED"
+        ? ["caller_interrupted", "The calling session was interrupted before delivery."]
+        : typedCode === "TARGET_NOT_VERTICAL"
+          ? ["target_not_vertical", "Agents may message only their parent or immediate children."]
+          : typedCode === "CONTROL_CHANGED"
+            ? ["conflict", "The target session control state changed; refresh and retry."]
+            : typedCode === "IDEMPOTENCY_KEY_REUSED"
+              ? ["idempotency_key_reused", "The idempotency key was reused with different input."]
+              : null;
+  if (knownFailure) {
+    return {
+      error: {
+        code: `${tool}_${knownFailure[0]}`,
+        message: knownFailure[1],
+      },
+    };
+  }
+  return {
+    error: {
+      code: `${tool}_failed`,
+      message: "OpenGeni could not complete the request.",
+    },
+  };
+}
+
+function orchestrationFailureResult(tool: OrchestrationToolName, error: unknown) {
+  const envelope = orchestrationFailureEnvelope(tool, error);
+  return {
+    content: [{ type: "text" as const, text: JSON.stringify(envelope, null, 2) }],
+    structuredContent: envelope,
+    isError: true as const,
+  };
+}
+
 type FirstPartyToolAuthorization = {
   sessionRequired?: true;
   allOf?: readonly Permission[];
@@ -216,6 +368,7 @@ const FIRST_PARTY_TOOL_AUTHORIZATION = {
   set_session_title: { sessionRequired: true, allOf: ["sessions:control"] },
   goal_set: { sessionRequired: true, allOf: ["goals:manage"] },
   goal_update: { sessionRequired: true, allOf: ["goals:manage"] },
+  goal_progress: { sessionRequired: true, allOf: ["goals:manage"] },
   goal_complete: { sessionRequired: true, allOf: ["goals:manage"] },
   goal_pause: { sessionRequired: true, allOf: ["goals:manage"] },
   memory_search: { sessionRequired: true, allOf: ["documents:search"] },
@@ -226,6 +379,9 @@ const FIRST_PARTY_TOOL_AUTHORIZATION = {
     allOf: ["workspace:read"],
   },
   preference_registry_get: { sessionRequired: true, allOf: ["workspace:read"] },
+  task_notes_list: { sessionRequired: true, allOf: ["sessions:read"] },
+  task_note_save: { sessionRequired: true, allOf: ["sessions:control"] },
+  task_note_archive: { sessionRequired: true, allOf: ["sessions:control"] },
   sandboxes_list: { sessionRequired: true, allOf: ["sessions:read"] },
   sandbox_attach: { sessionRequired: true, allOf: ["sessions:control"] },
   sandbox_swap: { sessionRequired: true, allOf: ["sessions:control"] },
@@ -246,6 +402,27 @@ const FIRST_PARTY_TOOL_AUTHORIZATION = {
   session_resume: { allOf: ["sessions:control"] },
   session_steer: { sessionRequired: true, allOf: ["sessions:control"] },
   set_other_session_title: { allOf: ["sessions:control"] },
+  interaction_discover: { sessionRequired: true, allOf: ["sessions:read"] },
+  browser_open: { sessionRequired: true, allOf: ["sessions:control"] },
+  browser_tabs: { sessionRequired: true, allOf: ["sessions:control"] },
+  browser_observe: { sessionRequired: true, allOf: ["sessions:read"] },
+  browser_act: { sessionRequired: true, allOf: ["sessions:control"] },
+  browser_clipboard: { sessionRequired: true, allOf: ["sessions:read"] },
+  browser_debug: { sessionRequired: true, allOf: ["sessions:read"] },
+  browser_auth: { sessionRequired: true, allOf: ["sessions:control"] },
+  interaction_request_human: {
+    sessionRequired: true,
+    allOf: ["sessions:control"],
+  },
+  browser_identity: { sessionRequired: true, allOf: ["sessions:control"] },
+  browser_publish: { sessionRequired: true, allOf: ["sessions:control"] },
+  browser_lifecycle: { sessionRequired: true, allOf: ["sessions:control"] },
+  computer_open: { sessionRequired: true, allOf: ["sessions:control"] },
+  computer_targets: { sessionRequired: true, allOf: ["sessions:read"] },
+  computer_observe: { sessionRequired: true, allOf: ["sessions:read"] },
+  computer_clipboard: { sessionRequired: true, allOf: ["sessions:read"] },
+  computer_act: { sessionRequired: true, allOf: ["sessions:control"] },
+  computer_lifecycle: { sessionRequired: true, allOf: ["sessions:control"] },
   variable_set_list: { allOf: ["variable-sets:list", "secrets:list"] },
   environment_list: { allOf: ["variable-sets:list", "secrets:list"] },
   variable_set_get_variable: {
@@ -256,6 +433,14 @@ const FIRST_PARTY_TOOL_AUTHORIZATION = {
     allOf: ["variable-sets:write", "secrets:write"],
   },
   environment_set_variable: { allOf: ["variable-sets:write", "secrets:write"] },
+  capability_catalog_search: {
+    sessionRequired: true,
+    allOf: ["workspace:read"],
+  },
+  capability_authorization_request: {
+    sessionRequired: true,
+    allOf: ["workspace:read"],
+  },
   github_connect_link: { allOf: ["github:use"] },
   github_repositories_list: { allOf: ["github:use"] },
   social_connections_list: { allOf: ["connections:read"] },
@@ -270,6 +455,18 @@ const FIRST_PARTY_TOOL_AUTHORIZATION = {
   // Publishes under the user's identity: connections:write keeps it out of the
   // default agent permission set, unlike the read-only social tools above.
   social_post_reply: { allOf: ["connections:write"] },
+  x_accounts_list: { allOf: ["connections:read"] },
+  x_search_live: { allOf: ["connections:read"] },
+  x_mentions_live: { allOf: ["connections:read"] },
+  x_thread_fetch: { allOf: ["connections:read"] },
+  x_posts_sync: { allOf: ["connections:write"] },
+  x_post_reply: { allOf: ["connections:write"] },
+  reddit_accounts_list: { allOf: ["connections:read"] },
+  reddit_search_live: { allOf: ["connections:read"] },
+  reddit_mentions_live: { allOf: ["connections:read"] },
+  reddit_thread_fetch: { allOf: ["connections:read"] },
+  reddit_posts_sync: { allOf: ["connections:write"] },
+  reddit_post_reply: { allOf: ["connections:write"] },
   scheduled_tasks_list: {
     anyOf: ["scheduled_tasks:manage", "scheduled_tasks:run"],
   },
@@ -294,11 +491,52 @@ const FIRST_PARTY_TOOL_AUTHORIZATION = {
   slack_bot_file_content: { allOf: ["connections:read"] },
   slack_bot_post_message: { allOf: ["connections:read"] },
   slack_bot_delete_message: { allOf: ["connections:read"] },
+  fiken_companies_list: { allOf: ["connections:read"] },
+  fiken_contacts_list: { allOf: ["connections:read"] },
+  fiken_products_list: { allOf: ["connections:read"] },
+  fiken_invoices_list: { allOf: ["connections:read"] },
+  fiken_invoice_get: { allOf: ["connections:read"] },
+  fiken_bank_accounts_list: { allOf: ["connections:read"] },
+  fiken_purchases_list: { allOf: ["connections:read"] },
+  fiken_sales_list: { allOf: ["connections:read"] },
+  // Writes into the workspace's real accounting ledger surface take the write
+  // scope, keeping them out of the default agent permission set.
+  fiken_contact_create: { allOf: ["connections:write"] },
+  fiken_invoice_draft_create: { allOf: ["connections:write"] },
+  atlassian_sources_list: { allOf: ["connections:read"] },
+  atlassian_search: { allOf: ["connections:read"] },
+  atlassian_get: { allOf: ["connections:read"] },
   artifacts_list: { sessionRequired: true, allOf: ["artifacts:read"] },
   artifacts_get_source: { sessionRequired: true, allOf: ["artifacts:read"] },
   artifacts_create: { sessionRequired: true, allOf: ["artifacts:publish"] },
   artifacts_publish: { sessionRequired: true, allOf: ["artifacts:publish"] },
   artifacts_rollback: { sessionRequired: true, allOf: ["artifacts:publish"] },
+  editable_artifact_list: { sessionRequired: true, allOf: ["artifacts:read"] },
+  editable_artifact_create: {
+    sessionRequired: true,
+    allOf: ["artifacts:publish"],
+  },
+  editable_artifact_import: {
+    sessionRequired: true,
+    allOf: ["artifacts:publish", "files:read"],
+  },
+  editable_artifact_get: { sessionRequired: true, allOf: ["artifacts:read"] },
+  editable_artifact_inspect: {
+    sessionRequired: true,
+    allOf: ["artifacts:read"],
+  },
+  editable_artifact_apply: {
+    sessionRequired: true,
+    allOf: ["artifacts:publish"],
+  },
+  editable_artifact_export: {
+    sessionRequired: true,
+    allOf: ["artifacts:read"],
+  },
+  editable_artifact_export_status: {
+    sessionRequired: true,
+    allOf: ["artifacts:read", "files:upload"],
+  },
 } satisfies Record<FirstPartyMcpToolName, FirstPartyToolAuthorization>;
 
 const FIRST_PARTY_MCP_TOOL_NAME_SET = new Set<string>(FIRST_PARTY_MCP_TOOL_NAMES);
@@ -310,7 +548,6 @@ class PolicyMcpServer extends McpServer {
     private readonly grant: AccessGrant,
     private readonly sessionId: string | null,
     private readonly selectedTools: ReadonlySet<FirstPartyMcpToolName> | null,
-    private readonly allowUncatalogued: boolean,
   ) {
     super({ name: "opengeni", version: "1.0.0" });
   }
@@ -331,7 +568,7 @@ class PolicyMcpServer extends McpServer {
     cb: ToolCallback<InputArgs>,
   ): RegisteredTool {
     const catalogued = FIRST_PARTY_MCP_TOOL_NAME_SET.has(name);
-    let admitted = this.allowUncatalogued && !catalogued;
+    let admitted = false;
     if (catalogued) {
       const toolName = name as FirstPartyMcpToolName;
       const policy: FirstPartyToolAuthorization = FIRST_PARTY_TOOL_AUTHORIZATION[toolName];
@@ -388,7 +625,6 @@ export function buildOpenGeniMcpServer(
     content: [{ type: "text" as const, text: JSON.stringify(value, null, 2) }],
   });
   const can = (permission: Permission) => hasPermission(grant.permissions, permission);
-  const toolspaceMode = options.toolspace != null;
   let socialConnectionsPromise: ReturnType<typeof authorizedSocialConnectionsForGrant> | undefined;
   const authorizedSocialConnections = () =>
     (socialConnectionsPromise ??= authorizedSocialConnectionsForGrant({
@@ -403,6 +639,14 @@ export function buildOpenGeniMcpServer(
     if (!authority) throw new Error(`Unknown or unavailable social connection: ${connectionId}`);
     return authority;
   };
+  const requireAuthorizedSocialConnectionForProvider = async (
+    provider: "x" | "reddit",
+    connectionId: string,
+  ) => {
+    const authority = await requireAuthorizedSocialConnection(connectionId);
+    assertSocialConnectionProvider(authority.connection, provider);
+    return authority;
+  };
 
   // Session-scoped tools key off the worker-asserted sessionId claim (signed
   // into the delegated token by the worker, never agent-controlled).
@@ -411,17 +655,28 @@ export function buildOpenGeniMcpServer(
       ? (grant.metadata["sessionId"] as string)
       : null;
   const selectedTools =
-    sessionId !== null && !toolspaceMode
+    sessionId !== null
       ? new Set(
-          (grant.metadata?.["firstPartyMcpTools"] as FirstPartyMcpToolName[] | undefined) ??
-            DEFAULT_FIRST_PARTY_MCP_TOOLS,
+          allowedFirstPartyMcpToolsForSession(
+            deps.settings,
+            grant.metadata?.["firstPartyMcpTools"] as FirstPartyMcpToolName[] | undefined,
+          ),
         )
       : null;
-  const server = new PolicyMcpServer(grant, sessionId, selectedTools, toolspaceMode);
+  const nestedAgentDepth = grant.metadata?.["nestedAgentDepth"];
+  const effectiveMaxNestedAgentDepth = grant.metadata?.["effectiveMaxNestedAgentDepth"];
+  // Optional claims keep rolling deployments compatible. When both trusted
+  // facts are present, an exhausted session does not receive an unusable spawn
+  // tool; stale/legacy callers still meet the authoritative DB admission gate.
+  const sessionCreateVisible =
+    typeof nestedAgentDepth !== "number" ||
+    typeof effectiveMaxNestedAgentDepth !== "number" ||
+    nestedAgentDepth < effectiveMaxNestedAgentDepth;
+  const server = new PolicyMcpServer(grant, sessionId, selectedTools);
   // set_session_title names the agent's OWN session — pure session metadata,
   // not a goal operation — so it is available on every session, gated only on
   // the signed sessionId (NOT goals:manage, and NOT on a goal existing).
-  if (sessionId !== null && (!toolspaceMode || can("sessions:control"))) {
+  if (sessionId !== null) {
     server.registerTool(
       "set_session_title",
       {
@@ -444,18 +699,31 @@ export function buildOpenGeniMcpServer(
   if (sessionId !== null && can("goals:manage")) {
     registerGoalTools(server, deps, grant, sessionId, json);
   }
-  // Toolspace grants are the sandbox's narrowed proxy surface. Unlike the
-  // normal first-party worker token, a bare toolspace:call token does not see
-  // unpermissioned session tools; memory follows that title/goal parity and
-  // stays on the normal first-party MCP surface only.
-  if (!toolspaceMode && sessionId !== null && options.workspaceMemoryEnabled === true) {
-    registerMemoryTools(server, deps, grant, sessionId, json);
+  if (sessionId !== null && options.workspaceMemoryEnabled === true) {
+    registerMemoryTools(
+      server,
+      deps,
+      grant,
+      sessionId,
+      json,
+      options.workspaceMemoryPromptMode ?? "legacy_standing",
+    );
   }
-  if (!toolspaceMode && sessionId !== null && preferenceAttemptClaims(grant) !== null) {
+  if (sessionId !== null && exactAgentAttemptClaims(grant) !== null) {
     registerPreferenceRegistryTools(server, deps, grant, json);
+    registerTaskNoteTools(server, deps, grant, sessionId, json);
   }
-  if (!toolspaceMode && sessionId !== null && preferenceAttemptClaims(grant) !== null) {
+  if (sessionId !== null && exactAgentAttemptClaims(grant) !== null) {
     registerWorkspaceArtifactTools(server, deps, grant, sessionId, json);
+    registerEditableArtifactAgentTools({
+      server,
+      deps,
+      grant,
+      sessionId,
+      authorize: async () => {
+        await authorizeFirstPartySession(deps, grant, sessionId, "session.first_party_mcp.call");
+      },
+    });
   }
 
   // Fleet tools (M7 bring-your-own-compute): list / attach / swap / run_on /
@@ -464,16 +732,16 @@ export function buildOpenGeniMcpServer(
   // so they register only when the grant carries the worker-signed sessionId claim
   // (never agent-controlled). Gated on the selfhosted feature flag: the active
   // pointer + swap are only meaningful when bring-your-own-compute is enabled.
-  if (!toolspaceMode && sessionId !== null && deps.settings.sandboxSelfhostedEnabled) {
+  if (sessionId !== null && deps.settings.sandboxSelfhostedEnabled) {
     registerFleetTools(server, deps, grant, sessionId, json);
   }
-  if (!toolspaceMode && can("enrollments:manage") && deps.settings.sandboxSelfhostedEnabled) {
+  if (can("enrollments:manage") && deps.settings.sandboxSelfhostedEnabled) {
     registerConnectedMachineTools(server, deps, grant, json);
   }
-  if (!toolspaceMode) {
-    registerRigTools(server, deps, grant, can, sessionId, json);
-    registerSlackBotTools(server, deps, grant, sessionId, json);
-  }
+  registerRigTools(server, deps, grant, can, sessionId, json);
+  registerSlackBotTools(server, deps, grant, sessionId, json);
+  registerFikenTools(server, deps, grant, sessionId, json);
+  registerAtlassianTools(server, deps, grant, json);
 
   // Orchestration, variableSet, and GitHub status tools are permission-gated
   // at registration: a grant without the permission does not see the tool.
@@ -486,13 +754,24 @@ export function buildOpenGeniMcpServer(
   // never returned through a model-visible MCP tool. A user DEMOTES a specific
   // session by setting a narrower session.firstPartyMcpPermissions (capped to
   // the creator's own grant); operators still cap what any session can be given.
-  registerWorkspaceOrchestrationTools(server, deps, grant, can, sessionId, toolspaceMode, json);
-  registerVariableSetTools(server, deps, grant, can, sessionId, toolspaceMode, json);
+  registerWorkspaceOrchestrationTools(
+    server,
+    deps,
+    grant,
+    can,
+    sessionId,
+    sessionCreateVisible,
+    json,
+  );
+  registerVariableSetTools(server, deps, grant, can, sessionId, json);
+  if (sessionId !== null && can("workspace:read")) {
+    registerCapabilityDiscoveryTools(server, deps, grant, sessionId, json);
+  }
   if (can("github:use")) {
     registerGitHubConnectTool(server, deps, grant, options, json);
   }
 
-  if (!toolspaceMode || can("github:use")) {
+  if (can("github:use")) {
     server.registerTool(
       "github_repositories_list",
       {
@@ -521,7 +800,7 @@ export function buildOpenGeniMcpServer(
     );
   }
 
-  if (!toolspaceMode || can("connections:read")) {
+  if (can("connections:read")) {
     server.registerTool(
       "social_connections_list",
       {
@@ -726,12 +1005,131 @@ export function buildOpenGeniMcpServer(
         });
       },
     );
+
+    // Provider-scoped aliases are the canonical tools advertised by the X and
+    // Reddit Integration cards. The legacy social_* names remain available to
+    // existing Packs/sessions, but these names bind the provider in the tool
+    // identity and reject a near-identical Connection from the other adapter.
+    for (const provider of ["x", "reddit"] as const) {
+      const providerName = provider === "x" ? "X" : "Reddit";
+      server.registerTool(
+        `${provider}_accounts_list`,
+        {
+          description: `List the exact visible ${providerName} accounts available to this work.`,
+          inputSchema: { limit: z4.number().int().positive().optional() },
+        },
+        async ({ limit }) =>
+          json({
+            connections: (await authorizedSocialConnections())
+              .filter(
+                ({ connection }) =>
+                  connection.provider === provider && connection.status !== "disabled",
+              )
+              .slice(0, boundedMcpLimit(limit))
+              .map(({ connection }) => connection),
+          }),
+      );
+      server.registerTool(
+        `${provider}_search_live`,
+        {
+          description:
+            provider === "x"
+              ? "Search recent X conversations through one exact connected X account."
+              : "Search Reddit through one exact connected Reddit account; optionally scope to a subreddit.",
+          inputSchema: {
+            connectionId: z4.string().uuid(),
+            query: z4.string().min(1).max(512),
+            subreddit: z4.string().min(1).max(100).optional(),
+            limit: z4.number().int().positive().optional(),
+          },
+        },
+        async ({ connectionId, query, subreddit, limit }) => {
+          const authority = await requireAuthorizedSocialConnectionForProvider(
+            provider,
+            connectionId,
+          );
+          const result = await socialSearchLive(
+            deps,
+            {
+              workspaceId: grant.workspaceId,
+              connectionId,
+              subjectId: authority.subjectId,
+            },
+            { query, subreddit, limit },
+          );
+          return json({
+            provider: result.connection.provider,
+            posts: result.posts,
+          });
+        },
+      );
+      server.registerTool(
+        `${provider}_mentions_live`,
+        {
+          description: `Fetch live ${providerName} mentions and replies through one exact connected account.`,
+          inputSchema: {
+            connectionId: z4.string().uuid(),
+            sinceId: z4.string().optional(),
+            limit: z4.number().int().positive().optional(),
+          },
+        },
+        async ({ connectionId, sinceId, limit }) => {
+          const authority = await requireAuthorizedSocialConnectionForProvider(
+            provider,
+            connectionId,
+          );
+          const result = await socialMentionsLive(
+            deps,
+            {
+              workspaceId: grant.workspaceId,
+              connectionId,
+              subjectId: authority.subjectId,
+            },
+            { sinceId, limit },
+          );
+          return json({
+            provider: result.connection.provider,
+            posts: result.posts,
+          });
+        },
+      );
+      server.registerTool(
+        `${provider}_thread_fetch`,
+        {
+          description: `Fetch one live ${providerName} conversation thread through an exact connected account.`,
+          inputSchema: {
+            connectionId: z4.string().uuid(),
+            id: z4.string().min(1).max(100),
+            limit: z4.number().int().positive().optional(),
+          },
+        },
+        async ({ connectionId, id, limit }) => {
+          const authority = await requireAuthorizedSocialConnectionForProvider(
+            provider,
+            connectionId,
+          );
+          const result = await socialThreadLive(
+            deps,
+            {
+              workspaceId: grant.workspaceId,
+              connectionId,
+              subjectId: authority.subjectId,
+            },
+            { id, limit },
+          );
+          return json({
+            provider: result.connection.provider,
+            posts: result.posts,
+          });
+        },
+      );
+    }
   }
 
   // Writes are gated on connections:write (never in the default first-party
   // agent permission set) so scheduled tasks must opt in, and deployments can
   // additionally wrap posting in a requireApproval policy.
-  if (!toolspaceMode || can("connections:write")) {
+  if (can("connections:write")) {
     server.registerTool(
       "social_posts_sync",
       {
@@ -827,9 +1225,106 @@ export function buildOpenGeniMcpServer(
         });
       },
     );
+
+    for (const provider of ["x", "reddit"] as const) {
+      const providerName = provider === "x" ? "X" : "Reddit";
+      server.registerTool(
+        `${provider}_posts_sync`,
+        {
+          description: `Sync one exact connected ${providerName} account's recent posts into OpenGeni (idempotent).`,
+          inputSchema: {
+            connectionId: z4.string().uuid(),
+            limit: z4.number().int().positive().optional(),
+          },
+        },
+        async ({ connectionId, limit }) => {
+          const authority = await requireAuthorizedSocialConnectionForProvider(
+            provider,
+            connectionId,
+          );
+          const result = await socialOwnPostsLive(
+            deps,
+            {
+              workspaceId: grant.workspaceId,
+              connectionId,
+              subjectId: authority.subjectId,
+            },
+            { limit },
+          );
+          const datedPosts = result.posts.filter((post) => post.createdAt !== null);
+          const synced = await recordSyncedSocialPosts(deps.db, {
+            accountId: grant.accountId,
+            workspaceId: grant.workspaceId,
+            connectionId,
+            subjectId: authority.subjectId,
+            posts: datedPosts.map((post) => ({
+              externalPostId: post.id,
+              url: post.url,
+              authorHandle: post.author,
+              text: post.text,
+              publishedAt: new Date(post.createdAt!),
+              metrics: post.metrics,
+            })),
+          });
+          return json({
+            provider: result.connection.provider,
+            fetched: result.posts.length,
+            inserted: synced.inserted,
+            skipped: synced.skipped,
+            skippedMissingDate: result.posts.length - datedPosts.length,
+          });
+        },
+      );
+      server.registerTool(
+        `${provider}_post_reply`,
+        {
+          description: `Publish a reply from one exact connected ${providerName} account. This is a public write and should require approval.`,
+          inputSchema: {
+            connectionId: z4.string().uuid(),
+            inReplyToId: z4.string().min(1).max(100),
+            text: z4.string().min(1).max(10000),
+          },
+        },
+        async ({ connectionId, inReplyToId, text }) => {
+          const authority = await requireAuthorizedSocialConnectionForProvider(
+            provider,
+            connectionId,
+          );
+          const result = await socialPostReply(
+            deps,
+            {
+              workspaceId: grant.workspaceId,
+              connectionId,
+              subjectId: authority.subjectId,
+            },
+            { inReplyToId, text },
+          );
+          await recordAuditEvent(deps.db, {
+            accountId: grant.accountId,
+            workspaceId: grant.workspaceId,
+            subjectId: grant.subjectId,
+            action: "social.post_reply",
+            targetType: "social_connection",
+            targetId: connectionId,
+            metadata: {
+              provider: result.connection.provider,
+              adapterTool: `${provider}_post_reply`,
+              inReplyToId,
+              postedId: result.postedId,
+              url: result.url,
+            },
+          });
+          return json({
+            provider: result.connection.provider,
+            postedId: result.postedId,
+            url: result.url,
+          });
+        },
+      );
+    }
   }
 
-  if (!toolspaceMode || can("scheduled_tasks:manage") || can("scheduled_tasks:run")) {
+  if (can("scheduled_tasks:manage") || can("scheduled_tasks:run")) {
     server.registerTool(
       "scheduled_tasks_list",
       {
@@ -977,6 +1472,9 @@ export function buildOpenGeniMcpServer(
           sessionAuthorization: deps.sessionAuthorization,
           authorizationSurface: "first_party_mcp",
         });
+        if (!scheduledTaskUpdateChangesState(existing, update)) {
+          return json(scheduledTaskReceipt("scheduled_tasks_update", existing, "unchanged", false));
+        }
         const task = await updateScheduledTask(deps.db, grant.workspaceId, id, update);
         await syncUpdatedScheduledTask({
           db: deps.db,
@@ -984,7 +1482,7 @@ export function buildOpenGeniMcpServer(
           previous,
           task,
         });
-        return json(scheduledTaskForGrant(task, grant));
+        return json(scheduledTaskReceipt("scheduled_tasks_update", task, "updated", true));
       },
     );
 
@@ -996,6 +1494,9 @@ export function buildOpenGeniMcpServer(
       },
       async ({ id }) => {
         const existing = await requireScheduledTask(deps.db, grant.workspaceId, id);
+        if (existing.status === "paused") {
+          return json(scheduledTaskReceipt("scheduled_tasks_pause", existing, "unchanged", false));
+        }
         const previous = await captureScheduledTaskRestoreState(deps.db, existing);
         const task = await updateScheduledTask(deps.db, grant.workspaceId, id, {
           status: "paused",
@@ -1006,7 +1507,7 @@ export function buildOpenGeniMcpServer(
           previous,
           task,
         });
-        return json(scheduledTaskForGrant(task, grant));
+        return json(scheduledTaskReceipt("scheduled_tasks_pause", task, "updated", true));
       },
     );
 
@@ -1018,6 +1519,9 @@ export function buildOpenGeniMcpServer(
       },
       async ({ id }) => {
         const existing = await requireScheduledTask(deps.db, grant.workspaceId, id);
+        if (existing.status === "active") {
+          return json(scheduledTaskReceipt("scheduled_tasks_resume", existing, "unchanged", false));
+        }
         const previous = await captureScheduledTaskRestoreState(deps.db, existing);
         const task = await updateScheduledTask(deps.db, grant.workspaceId, id, {
           status: "active",
@@ -1028,7 +1532,7 @@ export function buildOpenGeniMcpServer(
           previous,
           task,
         });
-        return json(scheduledTaskForGrant(task, grant));
+        return json(scheduledTaskReceipt("scheduled_tasks_resume", task, "updated", true));
       },
     );
 
@@ -1044,31 +1548,32 @@ export function buildOpenGeniMcpServer(
       },
       async ({ id, triggerId }) => {
         const task = await requireScheduledTask(deps.db, grant.workspaceId, id);
-        await validateScheduledTaskTarget({
-          db: deps.db,
-          sessionAuthorization: deps.sessionAuthorization,
-          authorizationSurface: "first_party_mcp",
-          grant,
-          targetSessionId: task.targetSessionId,
-          runMode: task.runMode,
-          variableSetId: task.variableSetId,
-          rigId: task.rigId,
-          agentConfig: task.agentConfig,
-          missingTargetStatus: 404,
-        });
-        await requireLimit(deps, {
-          accountId: grant.accountId,
-          workspaceId: grant.workspaceId,
-          action: "agent_run:create",
-          quantity: 1,
-          model: task.agentConfig.model ?? deps.settings.openaiModel,
-        });
+        if (task.action.kind === "agent_turn") {
+          await validateScheduledTaskTarget({
+            db: deps.db,
+            sessionAuthorization: deps.sessionAuthorization,
+            authorizationSurface: "first_party_mcp",
+            grant,
+            targetSessionId: task.targetSessionId,
+            runMode: task.runMode,
+            variableSetId: task.variableSetId,
+            rigId: task.rigId,
+            agentConfig: task.agentConfig,
+            missingTargetStatus: 404,
+          });
+          await requireLimit(deps, {
+            accountId: grant.accountId,
+            workspaceId: grant.workspaceId,
+            action: "agent_run:create",
+            quantity: 1,
+            model: task.agentConfig.model ?? deps.settings.openaiModel,
+          });
+        }
         const triggerToken = scheduledTaskTriggerToken(triggerId);
-        const agentRunUsageIdempotencyKey = manualScheduledTaskTriggerUsageKey(
-          grant.workspaceId,
-          task.id,
-          triggerToken,
-        );
+        const agentRunUsageIdempotencyKey =
+          task.action.kind === "agent_turn"
+            ? manualScheduledTaskTriggerUsageKey(grant.workspaceId, task.id, triggerToken)
+            : `knowledge-source-sync:manual:${grant.workspaceId}:${task.id}:${triggerToken}`;
         const triggerWorkflowId = manualScheduledTaskTriggerWorkflowId(task.id, triggerToken);
         await deps.workflowClient.triggerScheduledTask({
           task,
@@ -1077,6 +1582,14 @@ export function buildOpenGeniMcpServer(
           initiator: { kind: "subject", subjectId: grant.subjectId },
         });
         try {
+          if (task.action.kind !== "agent_turn") {
+            return json(
+              scheduledTaskReceipt("scheduled_tasks_trigger", task, "triggered", true, {
+                idempotencyStatus: triggerId ? "unknown" : "not_requested",
+                facts: { triggerWorkflowId },
+              }),
+            );
+          }
           await recordWorkspaceUsage(deps, {
             accountId: grant.accountId,
             workspaceId: grant.workspaceId,
@@ -1117,6 +1630,17 @@ export function buildOpenGeniMcpServer(
       },
       async ({ id }) => {
         const task = await requireScheduledTask(deps.db, grant.workspaceId, id);
+        if (task.metadata.connectorKind === "atlassian") {
+          await revokeAtlassianScheduleAuthorization(deps, {
+            task,
+            subjectId: grant.subjectId,
+          });
+        } else {
+          await revokeKnowledgeSourceScheduleAuthorization(deps, {
+            task,
+            subjectId: grant.subjectId,
+          });
+        }
         await deps.workflowClient.deleteScheduledTaskSchedule({
           temporalScheduleId: task.temporalScheduleId,
         });
@@ -1163,7 +1687,6 @@ export function buildOpenGeniMcpServer(
     );
   }
 
-  registerToolspaceProxyTools(server, options.toolspace ?? null);
   server.ensureToolsListHandler();
 
   return server;
@@ -1354,98 +1877,385 @@ function registerSlackBotTools(
   );
 
   server.registerTool(
-    "slack_bot_post_message",
+    "slack_bot_delete_message",
     {
       description:
-        "Post as the workspace-shared OpenGeni bot. Pass channelId for a channel where the bot is already a member, or userId to open/post a DM; pass exactly one. To reply in a thread, also pass its parent message timestamp as threadTimestamp. Generate one operationId UUID per intended message and reuse that same UUID on every retry.",
+        "Delete a message authored by the workspace-shared OpenGeni bot. Pass the channel ID and exact message timestamp returned by a prior post or channel/thread read. Generate one operationId UUID per intended deletion and reuse it on every retry, including after an unknown outcome. Slack refuses deletion of messages not authored by this bot.",
       inputSchema: {
         connectionId: z4.string().uuid().optional(),
         operationId: z4.string().uuid(),
-        channelId: z4.string().min(1).max(64).optional(),
-        userId: z4.string().min(1).max(64).optional(),
-        threadTimestamp: z4.string().min(1).max(64).optional(),
-        text: z4.string().min(1).max(40_000),
+        channelId: z4.string().min(1).max(64),
+        timestamp: z4.string().min(1).max(64),
       },
     },
-    async ({ connectionId, operationId, channelId, userId, threadTimestamp, text }) => {
-      if (Boolean(channelId) === Boolean(userId)) {
-        throw new Error("exactly one of channelId or userId is required");
-      }
-      return json(
+    async ({ connectionId, operationId, channelId, timestamp }) =>
+      json(
+        await (await clientFor(connectionId)).deleteMessage({ operationId, channelId, timestamp }),
+      ),
+  );
+}
+
+function registerFikenTools(
+  server: McpServer,
+  deps: ApiRouteDeps,
+  grant: AccessGrant,
+  sessionId: string | null,
+  json: JsonResult,
+): void {
+  // One resolution per requested connection per MCP server instance: the
+  // bound row cannot change mid-request, and re-resolving on every tool call
+  // would pay an extra connections read each time.
+  const clients = new Map<string, Promise<ReturnType<typeof createFikenClient>>>();
+  const clientFor = (connectionId?: string) => {
+    const cacheKey = connectionId ?? "";
+    let client = clients.get(cacheKey);
+    if (!client) {
+      client = resolveFikenConnectionForTool({
+        db: deps.db,
+        grant,
+        sessionId,
+        ...(connectionId ? { requestedConnectionId: connectionId } : {}),
+      }).then((resolved) => createFikenClient(deps, resolved));
+      // A failed resolution must not be cached as a poisoned entry.
+      client.catch(() => clients.delete(cacheKey));
+      clients.set(cacheKey, client);
+    }
+    return client;
+  };
+  const companySlugInput = z4
+    .string()
+    .min(1)
+    .max(128)
+    .optional()
+    .describe(
+      "Fiken company slug. Optional when the connection has a default company or access to exactly one company.",
+    );
+  const pageInputs = {
+    page: z4.number().int().min(0).optional(),
+    pageSize: z4.number().int().min(1).max(100).optional(),
+  };
+  const isoDate = z4
+    .string()
+    .regex(/^\d{4}-\d{2}-\d{2}$/)
+    .optional();
+
+  server.registerTool(
+    "fiken_companies_list",
+    {
+      description:
+        "List the Fiken companies this workspace's Fiken connection can act on. Use the returned slug as companySlug in other fiken tools.",
+      inputSchema: {
+        connectionId: z4.string().uuid().optional(),
+        ...pageInputs,
+      },
+    },
+    async ({ connectionId, page, pageSize }) =>
+      json(
         await (
           await clientFor(connectionId)
-        ).postMessage({
-          operationId,
-          ...(channelId ? { channelId } : {}),
-          ...(userId ? { userId } : {}),
-          ...(threadTimestamp ? { threadTimestamp } : {}),
-          text,
+        ).listCompanies({
+          ...(page !== undefined ? { page } : {}),
+          ...(pageSize !== undefined ? { pageSize } : {}),
         }),
-      );
+      ),
+  );
+
+  server.registerTool(
+    "fiken_contacts_list",
+    {
+      description:
+        "List or search contacts (customers and suppliers) in a Fiken company. Filters combine with AND. customerId used elsewhere equals a contact's contactId where customer is true.",
+      inputSchema: {
+        connectionId: z4.string().uuid().optional(),
+        companySlug: companySlugInput,
+        ...pageInputs,
+        name: z4.string().min(1).max(256).optional(),
+        email: z4.string().min(1).max(256).optional(),
+        organizationNumber: z4.string().min(1).max(64).optional(),
+        customer: z4.boolean().optional(),
+        supplier: z4.boolean().optional(),
+        inactive: z4.boolean().optional(),
+      },
     },
+    async ({ connectionId, ...input }) =>
+      json(await (await clientFor(connectionId)).listContacts(input)),
   );
 
   server.registerTool(
-    "slack_bot_delete_message",
+    "fiken_contact_create",
     {
       description:
-        "Delete a message authored by the workspace-shared OpenGeni bot. Pass the channel ID and exact message timestamp returned by a prior post or channel/thread read. Generate one operationId UUID per intended deletion and reuse it on every retry, including after an unknown outcome. Slack refuses deletion of messages not authored by this bot.",
+        "Create a contact in a Fiken company. Retrying after an unknown outcome may create a duplicate; search fiken_contacts_list first when unsure.",
+      inputSchema: {
+        connectionId: z4.string().uuid().optional(),
+        companySlug: companySlugInput,
+        name: z4.string().min(1).max(256),
+        email: z4.string().min(1).max(256).optional(),
+        organizationNumber: z4.string().min(1).max(64).optional(),
+        phoneNumber: z4.string().min(1).max(64).optional(),
+        customer: z4.boolean().optional(),
+        supplier: z4.boolean().optional(),
+      },
+    },
+    async ({ connectionId, ...input }) =>
+      json(await (await clientFor(connectionId)).createContact(input)),
+  );
+
+  server.registerTool(
+    "fiken_products_list",
+    {
+      description: "List products in a Fiken company.",
+      inputSchema: {
+        connectionId: z4.string().uuid().optional(),
+        companySlug: companySlugInput,
+        ...pageInputs,
+        name: z4.string().min(1).max(256).optional(),
+        active: z4.boolean().optional(),
+      },
+    },
+    async ({ connectionId, ...input }) =>
+      json(await (await clientFor(connectionId)).listProducts(input)),
+  );
+
+  server.registerTool(
+    "fiken_invoices_list",
+    {
+      description:
+        "List invoices in a Fiken company. Dates are yyyy-mm-dd; monetary amounts in results are in cents/øre of the invoice currency.",
+      inputSchema: {
+        connectionId: z4.string().uuid().optional(),
+        companySlug: companySlugInput,
+        ...pageInputs,
+        issueDateGe: isoDate,
+        issueDateLe: isoDate,
+        customerId: z4.number().int().positive().optional(),
+        settled: z4.boolean().optional(),
+        invoiceNumber: z4.string().min(1).max(64).optional(),
+      },
+    },
+    async ({ connectionId, ...input }) =>
+      json(await (await clientFor(connectionId)).listInvoices(input)),
+  );
+
+  server.registerTool(
+    "fiken_invoice_get",
+    {
+      description: "Read a single Fiken invoice by its invoiceId.",
       inputSchema: {
         connectionId: z4.string().uuid().optional(),
+        companySlug: companySlugInput,
+        invoiceId: z4.number().int().positive(),
+      },
+    },
+    async ({ connectionId, ...input }) =>
+      json(await (await clientFor(connectionId)).getInvoice(input)),
+  );
+
+  server.registerTool(
+    "fiken_invoice_draft_create",
+    {
+      description:
+        "Create an invoice DRAFT in Fiken. Drafts are not sent to the customer; a human finishes and sends them from Fiken. unitPriceCents is the net price per unit in cents/øre. Each line needs either productId or an incomeAccount + vatType. Generate one operationId UUID per intended draft and reuse that same UUID on every retry; a retry returns the existing draft instead of duplicating it.",
+      inputSchema: {
+        connectionId: z4.string().uuid().optional(),
+        companySlug: companySlugInput,
         operationId: z4.string().uuid(),
-        channelId: z4.string().min(1).max(64),
-        timestamp: z4.string().min(1).max(64),
+        customerId: z4.number().int().positive(),
+        daysUntilDueDate: z4.number().int().min(0).max(365),
+        invoiceText: z4.string().max(500).optional(),
+        yourReference: z4.string().max(128).optional(),
+        ourReference: z4.string().max(128).optional(),
+        currency: z4
+          .string()
+          .regex(/^[A-Z]{3}$/)
+          .optional(),
+        bankAccountNumber: z4.string().min(1).max(64).optional(),
+        lines: z4
+          .array(
+            z4.object({
+              description: z4.string().max(200).optional(),
+              productId: z4.number().int().positive().optional(),
+              unitPriceCents: z4.number().int().optional(),
+              vatType: z4.string().min(1).max(64).optional(),
+              quantity: z4.number().positive(),
+              discountPercent: z4.number().min(0).max(100).optional(),
+              incomeAccount: z4.string().min(1).max(16).optional(),
+              comment: z4.string().max(200).optional(),
+            }),
+          )
+          .min(1)
+          .max(100),
       },
     },
-    async ({ connectionId, operationId, channelId, timestamp }) =>
-      json(
-        await (await clientFor(connectionId)).deleteMessage({ operationId, channelId, timestamp }),
-      ),
+    async ({ connectionId, ...input }) =>
+      json(await (await clientFor(connectionId)).createInvoiceDraft(input)),
+  );
+
+  server.registerTool(
+    "fiken_bank_accounts_list",
+    {
+      description:
+        "List bank accounts in a Fiken company, including reconciled balances in cents/øre.",
+      inputSchema: {
+        connectionId: z4.string().uuid().optional(),
+        companySlug: companySlugInput,
+        ...pageInputs,
+        inactive: z4.boolean().optional(),
+      },
+    },
+    async ({ connectionId, ...input }) =>
+      json(await (await clientFor(connectionId)).listBankAccounts(input)),
+  );
+
+  server.registerTool(
+    "fiken_purchases_list",
+    {
+      description: "List purchases in a Fiken company. Dates are yyyy-mm-dd.",
+      inputSchema: {
+        connectionId: z4.string().uuid().optional(),
+        companySlug: companySlugInput,
+        ...pageInputs,
+        dateGe: isoDate,
+        dateLe: isoDate,
+        paid: z4.boolean().optional(),
+      },
+    },
+    async ({ connectionId, ...input }) =>
+      json(await (await clientFor(connectionId)).listPurchases(input)),
+  );
+
+  server.registerTool(
+    "fiken_sales_list",
+    {
+      description: "List sales in a Fiken company. Dates are yyyy-mm-dd.",
+      inputSchema: {
+        connectionId: z4.string().uuid().optional(),
+        companySlug: companySlugInput,
+        ...pageInputs,
+        dateGe: isoDate,
+        dateLe: isoDate,
+        settled: z4.boolean().optional(),
+      },
+    },
+    async ({ connectionId, ...input }) =>
+      json(await (await clientFor(connectionId)).listSales(input)),
   );
 }
 
-function registerToolspaceProxyTools(server: McpServer, surface: ToolspaceMcpSurface | null): void {
-  if (!surface) {
-    return;
-  }
-  // McpServer installs its tools/list handler lazily on the first registered
-  // tool. A legitimate empty Toolspace surface (no selected proxyable servers,
-  // no active turn, or all optional upstreams unavailable) must therefore seed
-  // and disable one invisible tool; otherwise `ogtool list` receives JSON-RPC
-  // "Method not found" instead of the valid `{ tools: [] }` response.
-  if (surface.tools.length === 0) {
-    server
-      .registerTool(
-        "__opengeni_empty_toolspace_surface__",
-        {
-          description: "Internal disabled placeholder for an empty Toolspace surface.",
-          inputSchema: z4.object({}),
-        },
-        async () => ({
-          content: [{ type: "text" as const, text: '{"unavailable":true}' }],
+function registerAtlassianTools(
+  server: McpServer,
+  deps: ApiRouteDeps,
+  grant: AccessGrant,
+  json: JsonResult,
+): void {
+  const connectionFor = async (connectionId?: string) => {
+    const authorized = await authorizedAtlassianConnectionsForGrant({
+      db: deps.db,
+      grant,
+    });
+    const candidates = authorized.filter(({ connection }) =>
+      connectionId ? connection.id === connectionId : true,
+    );
+    if (candidates.length === 0) {
+      throw new Error(
+        connectionId
+          ? "the requested Atlassian connection is unavailable for this turn"
+          : "no Atlassian connection is available for this turn",
+      );
+    }
+    if (!connectionId && candidates.length > 1) {
+      throw new Error(
+        "connectionId is required because multiple Atlassian connections are available",
+      );
+    }
+    const authority = candidates[0]!;
+    const metadata = AtlassianConnectionMetadata.safeParse(authority.connection.metadata);
+    if (!metadata.success) throw new Error("Atlassian connection metadata is invalid");
+    return {
+      connection: authority.connection,
+      metadata: metadata.data,
+      subjectId: authority.subjectId ?? grant.subjectId,
+    };
+  };
+
+  server.registerTool(
+    "atlassian_sources_list",
+    {
+      description:
+        "List the Jira projects and Confluence spaces available through the authorized Atlassian connection, including which sources are selected for OpenGeni. Use this before search when the site or boundary is unclear.",
+      inputSchema: { connectionId: z4.string().uuid().optional() },
+    },
+    async ({ connectionId }) => {
+      const authority = await connectionFor(connectionId);
+      const response = await browseAtlassianSources(deps, {
+        workspaceId: grant.workspaceId,
+        subjectId: authority.subjectId,
+        connectionId: authority.connection.id,
+      });
+      const selected = new Set(authority.metadata.selectedSources.map((source) => source.id));
+      return json({
+        connectionId: authority.connection.id,
+        account: authority.metadata.displayName,
+        items: response.items.map((item) => ({
+          ...item,
+          selected: selected.has(item.id),
+        })),
+      });
+    },
+  );
+
+  server.registerTool(
+    "atlassian_search",
+    {
+      description:
+        "Search Jira issues and Confluence pages live within the projects and spaces selected for OpenGeni. Results reflect current Atlassian data and permissions, independent of the knowledge sync index.",
+      inputSchema: {
+        connectionId: z4.string().uuid().optional(),
+        query: z4.string().min(1).max(500),
+        product: z4.enum(["jira", "confluence"]).optional(),
+        limit: z4.number().int().min(1).max(50).optional(),
+      },
+    },
+    async ({ connectionId, query, product, limit }) => {
+      const authority = await connectionFor(connectionId);
+      return json({
+        connectionId: authority.connection.id,
+        results: await searchAtlassianLive(deps, {
+          workspaceId: grant.workspaceId,
+          subjectId: authority.subjectId,
+          connectionId: authority.connection.id,
+          query,
+          ...(product ? { product } : {}),
+          limit: limit ?? 20,
         }),
-      )
-      .disable();
-    return;
-  }
-  for (const tool of surface.tools) {
-    server.registerTool(
-      tool.name,
-      {
-        ...(tool.description ? { description: tool.description } : {}),
-        inputSchema: z4.object({}).passthrough(),
-        _meta: {
-          opengeni: {
-            origin: "toolspace",
-            subjectId: surface.subjectId,
-            sessionId: surface.sessionId,
-            ...(tool.inputSchema ? { inputSchema: tool.inputSchema } : {}),
-          },
-        },
+      });
+    },
+  );
+
+  server.registerTool(
+    "atlassian_get",
+    {
+      description:
+        "Open one current Jira issue or Confluence page, including description or page content and comments. The item must belong to a project or space selected for OpenGeni.",
+      inputSchema: {
+        connectionId: z4.string().uuid().optional(),
+        kind: z4.enum(["jira_issue", "confluence_page"]),
+        id: z4.string().min(1).max(256),
       },
-      async (args) => await tool.call(args),
-    );
-  }
+    },
+    async ({ connectionId, kind, id }) => {
+      const authority = await connectionFor(connectionId);
+      return json(
+        await getAtlassianLiveItem(deps, {
+          workspaceId: grant.workspaceId,
+          subjectId: authority.subjectId,
+          connectionId: authority.connection.id,
+          kind,
+          id,
+        }),
+      );
+    },
+  );
 }
 
 /** Only a prompt explicitly supplied through the human/API channel may redirect a user-paused goal. */
@@ -1500,26 +2310,49 @@ function registerGoalTools(
   sessionId: string,
   json: (value: unknown) => { content: Array<{ type: "text"; text: string }> },
 ): void {
+  const boundedGoalToolString = (maxBytes: number, field: string) =>
+    z4
+      .string()
+      .min(1)
+      .refine((value) => sessionGoalUtf8Bytes(value) <= maxBytes, {
+        message: `${field} exceeds ${maxBytes} UTF-8 bytes`,
+      });
+  const goalText = boundedGoalToolString(SESSION_GOAL_TEXT_MAX_BYTES, "goal text");
+  const successCriteriaSchema = boundedGoalToolString(
+    SESSION_GOAL_SUCCESS_CRITERIA_MAX_BYTES,
+    "goal success criteria",
+  );
+  const goalRationale = boundedGoalToolString(SESSION_GOAL_RATIONALE_MAX_BYTES, "goal rationale");
+  const progressNoteSchema = boundedGoalToolString(
+    SESSION_GOAL_PROGRESS_MAX_BYTES,
+    "goal progress note",
+  );
   server.registerTool(
     "goal_set",
     {
       description:
-        "Set or replace this session's goal. While a goal is active the session keeps working: idle moments synthesize continuation turns until goal_complete or goal_pause is called. Replacing a goal reactivates it and resets the continuation budget.",
+        "Create a goal when this session has none. While active, idle moments synthesize continuation turns until goal_complete or goal_pause. To change an existing goal, use goal_update with its objective revision, a change kind, and rationale.",
       inputSchema: {
-        text: z4.string().min(1),
-        successCriteria: z4.string().min(1).optional(),
+        text: goalText,
+        successCriteria: successCriteriaSchema.optional(),
         maxAutoContinuations: z4.number().int().positive().optional(),
       },
     },
     async ({ text, successCriteria, maxAutoContinuations }) => {
       await authorizeFirstPartySession(deps, grant, sessionId, "session.goal.write");
       await requireSession(deps.db, grant.workspaceId, sessionId);
+      const existing = await getSessionGoal(deps.db, grant.workspaceId, sessionId);
+      if (existing) {
+        throw new Error(
+          `this session already has a goal at objective revision ${existing.objectiveRevision}; use goal_update to revise it`,
+        );
+      }
       const callerTurnId =
         typeof grant.metadata?.["turnId"] === "string"
           ? (grant.metadata["turnId"] as string)
           : null;
       await assertGoalReactivationAllowed(deps, grant.workspaceId, sessionId, callerTurnId);
-      const { goal, events } = await upsertSessionGoalWithEvent(deps.db, {
+      const { goal, replaced, events } = await upsertSessionGoalWithEvent(deps.db, {
         accountId: grant.accountId,
         workspaceId: grant.workspaceId,
         sessionId,
@@ -1532,7 +2365,24 @@ function registerGoalTools(
       if (events.length > 0) {
         await deps.bus.publish(grant.workspaceId, sessionId, events);
       }
-      return json(goal);
+      return json(
+        mcpMutationReceipt({
+          operation: "goal_set",
+          committed: true,
+          outcome: replaced ? "updated" : "created",
+          changed: true,
+          resource: {
+            type: "session_goal",
+            id: goal.id,
+            version: goal.version,
+            state: goal.status,
+          },
+          timestamp: goal.updatedAt,
+          idempotency: { status: "not_supported" },
+          facts: { replaced },
+          nextAction: { tool: "session_get", arguments: { sessionId } },
+        }),
+      );
     },
   );
 
@@ -1540,26 +2390,100 @@ function registerGoalTools(
     "goal_update",
     {
       description:
-        "Revise the session goal's text or success criteria, or record a progress note. Counts as progress for the no-progress detector; the goal stays active.",
+        "Propose or apply a semantic goal revision under the session's mutation policy. Retain the standing goal unless explicit user direction or meaningful new evidence justifies the declared refinement, adaptation, or replacement. A rewrite never counts as execution progress; use goal_progress for that.",
       inputSchema: {
-        text: z4.string().min(1).optional(),
-        successCriteria: z4.string().min(1).optional(),
-        progressNote: z4.string().min(1).optional(),
+        text: goalText.optional(),
+        successCriteria: successCriteriaSchema.nullable().optional(),
+        // Optional for rolling compatibility with the former goal_update
+        // surface. Omitted semantic metadata is classified as a refinement of
+        // the currently fenced objective; new callers should always supply it.
+        changeKind: z4.enum(["refinement", "adaptation", "replacement"]).optional(),
+        rationale: goalRationale.optional(),
+        expectedObjectiveRevision: z4.number().int().positive().optional(),
+        // Deprecated compatibility input. It is committed through the new
+        // progress operation and never makes a semantic rewrite count itself.
+        progressNote: progressNoteSchema.optional(),
         idempotencyKey: z4.string().uuid(),
       },
     },
-    async ({ text, successCriteria, progressNote, idempotencyKey }) => {
+    async ({
+      text,
+      successCriteria,
+      changeKind,
+      rationale,
+      expectedObjectiveRevision,
+      progressNote,
+      idempotencyKey,
+    }) => {
       await authorizeFirstPartySession(deps, grant, sessionId, "session.goal.write");
+      if (text === undefined && successCriteria === undefined && progressNote === undefined) {
+        throw new Error("goal_update requires semantic content or a progressNote");
+      }
       const context = exactAgentCommandContext(grant, sessionId);
-      const { goal, events, operationId, replay } = await updateSessionGoalWithEvent(
+      const command = {
+        accountId: grant.accountId,
+        actor: {
+          type: "agent_attempt" as const,
+          attemptId: context.callerAttemptId,
+          sessionId: context.callerSessionId,
+          turnId: context.callerTurnId,
+          executionGeneration: context.callerExecutionGeneration,
+        },
+        operationKey: idempotencyKey,
+      };
+      const semantic =
+        text !== undefined || successCriteria !== undefined
+          ? await updateSessionGoalWithEvent(deps.db, grant.workspaceId, sessionId, {
+              ...(text !== undefined ? { text } : {}),
+              ...(successCriteria !== undefined ? { successCriteria } : {}),
+              changeKind: changeKind ?? "refinement",
+              rationale: rationale ?? "Compatibility refinement from goal_update",
+              ...(expectedObjectiveRevision !== undefined ? { expectedObjectiveRevision } : {}),
+              actor: "agent",
+              command,
+            })
+          : null;
+      const progress = progressNote
+        ? await recordSessionGoalProgressWithEvent(deps.db, grant.workspaceId, sessionId, {
+            progressNote,
+            command,
+          })
+        : null;
+      await publishDurableSessionEvents(deps.bus, grant.workspaceId, sessionId, [
+        ...(semantic?.events ?? []),
+        ...(progress?.events ?? []),
+      ]);
+      const goal = progress?.goal ?? semantic?.goal;
+      if (!goal) throw new Error("goal_update produced no mutation");
+      return json({
+        ...goal,
+        operationId: semantic?.operationId ?? progress?.operationId ?? null,
+        replay: Boolean(semantic?.replay || progress?.replay),
+        outcome: semantic?.outcome ?? "progress_recorded",
+        proposalId: semantic?.proposalId ?? null,
+      });
+    },
+  );
+
+  server.registerTool(
+    "goal_progress",
+    {
+      description:
+        "Record concrete progress toward the unchanged active goal. This does not change goal text, success criteria, mutation policy, or objective revision. Do not use it merely to keep the continuation loop alive.",
+      inputSchema: {
+        progressNote: progressNoteSchema,
+        idempotencyKey: z4.string().uuid(),
+      },
+    },
+    async ({ progressNote, idempotencyKey }) => {
+      await authorizeFirstPartySession(deps, grant, sessionId, "session.goal.write");
+      const context = exactAgentCommandContext(grant, sessionId);
+      const { goal, events, operationId, replay } = await recordSessionGoalProgressWithEvent(
         deps.db,
         grant.workspaceId,
         sessionId,
         {
-          ...(text !== undefined ? { text } : {}),
-          ...(successCriteria !== undefined ? { successCriteria } : {}),
-          ...(progressNote !== undefined ? { progressNote } : {}),
-          actor: "agent",
+          progressNote,
           command: {
             accountId: grant.accountId,
             actor: {
@@ -1631,7 +2555,7 @@ function registerGoalTools(
     {
       description:
         "Pause the session goal with a rationale (blocked, not productive, needs human input). No further continuation turns are synthesized until the goal is resumed or replaced.",
-      inputSchema: { rationale: z4.string().min(1) },
+      inputSchema: { rationale: goalRationale },
     },
     async ({ rationale }) => {
       await authorizeFirstPartySession(deps, grant, sessionId, "session.goal.write");
@@ -1706,7 +2630,7 @@ function registerWorkspaceArtifactTools(
   json: JsonResult,
 ): void {
   const attempt = () => {
-    const claims = preferenceAttemptClaims(grant);
+    const claims = exactAgentAttemptClaims(grant);
     if (!claims) throw new Error("Exact signed artifact attempt authority is required.");
     return claims;
   };
@@ -1806,7 +2730,7 @@ function registerWorkspaceArtifactTools(
     "artifacts_create",
     {
       description:
-        "Create and publish a generic static workspace artifact from a complete, self-contained HTML document with inline CSS. JavaScript and active or navigation-capable markup do not render in the MVP.",
+        "Create and publish a generic workspace artifact from a complete HTML document. The exact HTML runs in an opaque-origin sandboxed iframe with JavaScript, external resources, forms, popups, and downloads enabled, but without parent-origin authority or top-level navigation.",
       inputSchema: {
         title: z4.string().min(1).max(120),
         description: z4.string().max(2000).nullable().optional(),
@@ -1841,7 +2765,7 @@ function registerWorkspaceArtifactTools(
     "artifacts_publish",
     {
       description:
-        "Publish a new immutable static HTML/CSS version. JavaScript and active or navigation-capable markup do not render in the MVP. First read the current source and pass its version id for optimistic concurrency.",
+        "Publish a new immutable HTML version. The exact HTML runs in an opaque-origin sandboxed iframe. First read the current source and pass its version id for optimistic concurrency.",
       inputSchema: {
         artifactId: z4.string().uuid(),
         expectedCurrentVersionId: z4.string().uuid(),
@@ -1894,12 +2818,13 @@ function registerWorkspaceArtifactTools(
   );
 }
 
-function preferenceAttemptClaims(grant: AccessGrant): {
+function exactAgentAttemptClaims(grant: AccessGrant): {
   sessionId: string;
   turnId: string;
   attemptId: string;
   executionGeneration: number;
 } | null {
+  if (grant.principalKind !== "agent_attempt") return null;
   const metadata = grant.metadata ?? {};
   if (
     typeof metadata["sessionId"] !== "string" ||
@@ -1920,6 +2845,109 @@ function preferenceAttemptClaims(grant: AccessGrant): {
   };
 }
 
+function registerTaskNoteTools(
+  server: McpServer,
+  deps: ApiRouteDeps,
+  grant: AccessGrant,
+  sessionId: string,
+  json: JsonResult,
+): void {
+  const attemptClaims = () => {
+    const resolved = exactAgentAttemptClaims(grant);
+    if (!resolved || resolved.sessionId !== sessionId) {
+      throw new Error("Exact signed task-note attempt authority is required.");
+    }
+    return { accountId: grant.accountId, workspaceId: grant.workspaceId, ...resolved };
+  };
+  const authorize = async () => {
+    await authorizeFirstPartySession(deps, grant, sessionId, "session.first_party_mcp.call");
+  };
+  const boundedUtf8 = (maxBytes: number, label: string) =>
+    z4
+      .string()
+      .min(1)
+      .refine((value) => value === value.trim(), {
+        message: `${label} must not have leading or trailing whitespace`,
+      })
+      .refine((value) => new TextEncoder().encode(value).byteLength <= maxBytes, {
+        message: `${label} must be at most ${maxBytes} UTF-8 bytes`,
+      });
+
+  server.registerTool(
+    "task_notes_list",
+    {
+      description:
+        "Explicitly retrieve bounded, unexpired coordination notes shared by this session's root task tree. Notes are non-authoritative and are never injected into prompts automatically.",
+      inputSchema: {
+        includeArchived: z4.boolean().optional().default(false),
+        limit: z4
+          .number()
+          .int()
+          .min(1)
+          .max(TASK_NOTE_LIST_MAX_LIMIT)
+          .optional()
+          .default(TASK_NOTE_LIST_DEFAULT_LIMIT),
+      },
+    },
+    async ({ includeArchived, limit }) => {
+      await authorize();
+      return json(await listTaskNotes(deps.db, { ...attemptClaims(), includeArchived, limit }));
+    },
+  );
+
+  server.registerTool(
+    "task_note_save",
+    {
+      description:
+        "Save one bounded, expiring, non-authoritative coordination note for agents in this root task tree. Use a fresh operationId; exact retries of the same attempt and input replay safely.",
+      inputSchema: {
+        operationId: z4.string().uuid(),
+        kind: z4.enum(["finding", "decision", "blocker", "ownership", "artifact", "handoff"]),
+        text: boundedUtf8(TASK_NOTE_TEXT_MAX_BYTES, "Task note text"),
+        expiresInDays: z4.number().int().min(1).max(TASK_NOTE_MAX_LIFETIME_DAYS),
+      },
+    },
+    async ({ operationId, kind, text, expiresInDays }) => {
+      await authorize();
+      return json(
+        await createTaskNote(deps.db, {
+          ...attemptClaims(),
+          operationId,
+          kind,
+          text,
+          expiresInDays,
+        }),
+      );
+    },
+  );
+
+  server.registerTool(
+    "task_note_archive",
+    {
+      description:
+        "Archive a coordination note from this root task tree with optimistic version fencing. This preserves its immutable create receipt and records a separate archive receipt.",
+      inputSchema: {
+        operationId: z4.string().uuid(),
+        noteId: z4.string().uuid(),
+        expectedVersion: z4.number().int().min(1).max(1),
+        reason: boundedUtf8(TASK_NOTE_REASON_MAX_BYTES, "Task note archive reason"),
+      },
+    },
+    async ({ operationId, noteId, expectedVersion, reason }) => {
+      await authorize();
+      return json(
+        await archiveTaskNote(deps.db, {
+          ...attemptClaims(),
+          operationId,
+          noteId,
+          expectedVersion,
+          reason,
+        }),
+      );
+    },
+  );
+}
+
 function registerPreferenceRegistryTools(
   server: McpServer,
   deps: ApiRouteDeps,
@@ -1927,7 +2955,7 @@ function registerPreferenceRegistryTools(
   json: JsonResult,
 ): void {
   const attemptClaims = () => {
-    const resolved = preferenceAttemptClaims(grant);
+    const resolved = exactAgentAttemptClaims(grant);
     if (!resolved) throw new Error("Exact signed preference attempt authority is required.");
     return {
       accountId: grant.accountId,
@@ -1992,22 +3020,95 @@ function scheduledTaskReceipt(
   });
 }
 
+function scheduledTaskUpdateChangesState(
+  task: ScheduledTask,
+  update: Awaited<ReturnType<typeof validatedScheduledTaskUpdate>>,
+): boolean {
+  if (update.name !== undefined && update.name !== task.name) return true;
+  if (update.status !== undefined && update.status !== task.status) return true;
+  if (update.schedule !== undefined && stableJson(update.schedule) !== stableJson(task.schedule)) {
+    return true;
+  }
+  if (update.runMode !== undefined && update.runMode !== task.runMode) return true;
+  if (update.overlapPolicy !== undefined && update.overlapPolicy !== task.overlapPolicy)
+    return true;
+  if (
+    update.agentConfig !== undefined &&
+    stableJson(update.agentConfig) !== stableJson(task.agentConfig)
+  ) {
+    return true;
+  }
+  if (update.targetSessionId !== undefined && update.targetSessionId !== task.targetSessionId) {
+    return true;
+  }
+  if (
+    update.reusableSessionId !== undefined &&
+    update.reusableSessionId !== task.reusableSessionId
+  ) {
+    return true;
+  }
+  if (update.variableSetId !== undefined && update.variableSetId !== task.variableSetId)
+    return true;
+  if (update.rigId !== undefined && update.rigId !== task.rigId) return true;
+  if (update.metadata !== undefined && stableJson(update.metadata) !== stableJson(task.metadata)) {
+    return true;
+  }
+  // Personal-connection delegations are recomputed with agentConfig and can
+  // change even when the visible config is byte-identical (for example after a
+  // connection rotation), so preserve that refresh as a real mutation.
+  if (update.personalConnectionDelegations !== undefined) return true;
+  return false;
+}
+
 function memoryPreview(text: string): string {
   const normalized = text.replace(/\s+/g, " ").trim();
   return normalized.length <= 120 ? normalized : `${normalized.slice(0, 119)}…`;
 }
 
+export function memorySlackPublicationActor(
+  actor: Extract<SessionAuthorizationActor, { kind: "agent_attempt" }>,
+  sessionId: string,
+  fallbackOwnerLabel: string | null,
+) {
+  return {
+    actor: {
+      kind: actor.initiator.kind === "subject" ? ("human" as const) : ("service" as const),
+      subjectId: actor.initiator.subjectId,
+      initiatingHumanSubjectId: actor.initiatingHumanSubjectId,
+      sessionId,
+      turnId: actor.turnId,
+      attemptId: actor.attemptId,
+    },
+    ownerLabel: actor.initiator.label ?? fallbackOwnerLabel,
+  };
+}
+
 function registerMemoryTools(
   server: McpServer,
   deps: ApiRouteDeps,
   grant: AccessGrant,
   sessionId: string,
   json: JsonResult,
+  promptMode: WorkspaceMemoryPromptMode,
 ): void {
+  const publicationActor = async () => {
+    const actor = await requireLiveAgentAttemptAuthorization(deps.db, grant, sessionId);
+    return memorySlackPublicationActor(actor, sessionId, grant.subjectLabel ?? null);
+  };
+  const publicationInputSchema = z4.object({
+    importance: z4.enum(["major", "normal", "minor"]),
+    audience: z4.literal("workspace"),
+    slackMode: z4.enum(["auto", "review", "never"]),
+    shareSummary: z4.string().trim().min(1).max(4_096),
+  });
+
   server.registerTool(
     "memory_search",
     {
-      description: MEMORY_SEARCH_TOOL_DESCRIPTION,
+      description:
+        promptMode === "retrieval_only"
+          ? `${MEMORY_SEARCH_TOOL_DESCRIPTION} Legacy preference-kind records are excluded here because structured preferences are the only behavioral authority.`
+          : MEMORY_SEARCH_TOOL_DESCRIPTION,
       inputSchema: {
         query: z4.string().min(1),
         kind: MemoryKindSchema.optional(),
@@ -2023,6 +3124,7 @@ function registerMemoryTools(
             query,
             ...(kind ? { kind } : {}),
             ...(limit ? { limit } : {}),
+            agentPromptMode: promptMode,
           },
           deps.getDocumentServices().embedder,
         ),
@@ -2032,16 +3134,21 @@ function registerMemoryTools(
   server.registerTool(
     "memory_save",
     {
-      description: MEMORY_SAVE_TOOL_DESCRIPTION,
+      description:
+        promptMode === "retrieval_only"
+          ? `${MEMORY_SAVE_TOOL_DESCRIPTION} A preference-kind save is retained only as a legacy observation and cannot become behavioral authority; use the structured preference proposal surface for behavioral guidance.`
+          : MEMORY_SAVE_TOOL_DESCRIPTION,
       inputSchema: {
         text: z4.string().min(1),
         kind: MemoryKindSchema,
         confidence: z4.number().min(0).max(1).optional(),
         replaces_id: z4.string().min(1).optional(),
+        slack_publication: publicationInputSchema.optional(),
       },
     },
-    async ({ text, kind, confidence, replaces_id }) => {
-      const result = await saveWorkspaceMemory(
+    async ({ text, kind, confidence, replaces_id, slack_publication }) => {
+      const principal = slack_publication ? await publicationActor() : null;
+      const result = await saveWorkspaceMemoryWithSlackPublication(
         deps.db,
         {
           accountId: grant.accountId,
@@ -2053,6 +3160,13 @@ function registerMemoryTools(
           ...(replaces_id ? { replacesId: replaces_id } : {}),
           origin: "agent",
         },
+        slack_publication
+          ? {
+              distribution: MemorySlackPublicationDistribution.parse(slack_publication),
+              actor: principal!.actor,
+              ownerLabel: principal!.ownerLabel,
+            }
+          : null,
         deps.getDocumentServices().embedder,
       );
       await appendAndPublishEvents(deps.db, deps.bus, grant.workspaceId, sessionId, [
@@ -2104,6 +3218,19 @@ function registerMemoryTools(
             dedupeReason: result.dedupeReason,
             updatedInPlace: result.updated,
             embedded: result.embedded,
+            slackPublicationDecision: result.slackPublication.decision?.eligible
+              ? "eligible"
+              : (result.slackPublication.decision?.reason ?? "not_requested"),
+            slackPublicationId:
+              result.slackPublication.enqueue?.kind === "enqueued" ||
+              result.slackPublication.enqueue?.kind === "replayed"
+                ? result.slackPublication.enqueue.publication.id
+                : null,
+            slackPublicationState:
+              result.slackPublication.enqueue?.kind === "enqueued" ||
+              result.slackPublication.enqueue?.kind === "replayed"
+                ? result.slackPublication.enqueue.publication.state
+                : null,
           },
         }),
       );
@@ -2118,10 +3245,12 @@ function registerMemoryTools(
         id: z4.string().min(1),
         reason: z4.string().min(1).optional(),
         replacement_text: z4.string().min(1).optional(),
+        slack_publication: publicationInputSchema.optional(),
       },
     },
-    async ({ id, reason, replacement_text }) => {
-      const result = await correctWorkspaceMemory(
+    async ({ id, reason, replacement_text, slack_publication }) => {
+      const principal = slack_publication ? await publicationActor() : null;
+      const result = await correctWorkspaceMemoryWithSlackPublication(
         deps.db,
         {
           accountId: grant.accountId,
@@ -2131,6 +3260,13 @@ function registerMemoryTools(
           ...(reason ? { reason } : {}),
           ...(replacement_text ? { replacementText: replacement_text } : {}),
         },
+        slack_publication
+          ? {
+              distribution: MemorySlackPublicationDistribution.parse(slack_publication),
+              actor: principal!.actor,
+              ownerLabel: principal!.ownerLabel,
+            }
+          : null,
         deps.getDocumentServices().embedder,
       );
       await appendAndPublishEvents(deps.db, deps.bus, grant.workspaceId, sessionId, [
@@ -2173,7 +3309,22 @@ function registerMemoryTools(
             : undefined,
           timestamp: (result.replacement ?? result.memory).updatedAt,
           idempotency: { status: "not_supported" },
-          facts: { correctionAction: result.action },
+          facts: {
+            correctionAction: result.action,
+            slackPublicationDecision: result.slackPublication.decision?.eligible
+              ? "eligible"
+              : (result.slackPublication.decision?.reason ?? "not_requested"),
+            slackPublicationId:
+              result.slackPublication.enqueue?.kind === "enqueued" ||
+              result.slackPublication.enqueue?.kind === "replayed"
+                ? result.slackPublication.enqueue.publication.id
+                : null,
+            slackPublicationState:
+              result.slackPublication.enqueue?.kind === "enqueued" ||
+              result.slackPublication.enqueue?.kind === "replayed"
+                ? result.slackPublication.enqueue.publication.state
+                : null,
+          },
         }),
       );
     },
@@ -2309,7 +3460,7 @@ function registerConnectedMachineTools(
     "connected_machine_remove",
     {
       description:
-        "Remove one enrolled self-hosted machine while it is offline. Access is revoked, future heartbeat/reconnect credentials are rejected, session/route/lease/archive history is retained, and a fresh human-approved device-flow enrollment is required to reconnect. Pass the enrollmentId from the Machines surface, never a Modal sandbox id. Blocked outcomes include the exact active dependency and the action needed before retrying.",
+        "Remove one enrolled self-hosted machine while it is offline. Access is revoked, future heartbeat/reconnect credentials are rejected, session/route/lease/archive history is retained, and a fresh human-approved device-flow enrollment is required to reconnect. Pass the enrollmentId from the Machines surface, never a Modal sandbox id. Blocked outcomes include every dependent session and the action needed before retrying. Move each dependent session through the canonical sandbox_swap target=default path before retrying removal; the removal authority never rewrites routes directly.",
       inputSchema: {
         enrollmentId: z4.string().uuid(),
         expectedUpdatedAt: z4.string().datetime({ offset: true }).optional(),
@@ -2341,12 +3492,10 @@ async function beginMcpRigVerificationAttempt(
   try {
     return await beginRigChangeVerificationAttempt(deps.db, workspaceId, changeId, {
       startedAt: new Date().toISOString(),
+      allowAlreadyVerifying: true,
     });
   } catch (error) {
-    if (
-      error instanceof RigChangeAlreadyVerifyingError ||
-      error instanceof RigChangeTransitionError
-    ) {
+    if (error instanceof RigChangeTransitionError) {
       throw new Error(error.message, { cause: error });
     }
     throw error;
@@ -2685,7 +3834,7 @@ function registerWorkspaceOrchestrationTools(
   grant: AccessGrant,
   can: (permission: Permission) => boolean,
   callerSessionId: string | null,
-  toolspaceMode: boolean,
+  sessionCreateVisible: boolean,
   json: JsonResult,
 ): void {
   if (can("sessions:read")) {
@@ -2763,7 +3912,7 @@ function registerWorkspaceOrchestrationTools(
         );
         return json(
           boundSessionDetailMcp(
-            await withMcpEffectivePolicy(deps, grant.workspaceId, {
+            await withMcpEffectivePolicy(deps, grant.workspaceId, grant.subjectId, {
               ...projected,
               effectiveControl: queue?.effectiveControl ?? projected.effectiveControl,
             }),
@@ -2885,129 +4034,100 @@ function registerWorkspaceOrchestrationTools(
     );
   }
 
-  if (can("sessions:create")) {
+  if (can("sessions:create") && sessionCreateVisible) {
+    const sessionCreateInput = z4
+      .object({
+        initialMessage: z4.string().min(1),
+        instructions: z4.string().min(1).max(32768).optional(),
+        goal: z4.unknown().optional(),
+        resources: z4.array(z4.unknown()).optional(),
+        tools: z4.array(z4.unknown()).optional(),
+        mcpServers: z4.array(z4.unknown()).optional(),
+        variableSetId: z4.string().uuid().optional(),
+        environmentId: z4.string().uuid().optional(),
+        rigId: z4.string().uuid().optional(),
+        model: z4
+          .string()
+          .min(1)
+          .optional()
+          .describe(
+            "Model for the worker. Omit to inherit the exact calling turn's model, including its Codex subscription billing path.",
+          ),
+        reasoningEffort: z4
+          .string()
+          .optional()
+          .describe("Omit to inherit the exact calling turn's reasoning effort."),
+        latencyMode: z4
+          .enum(["standard", "priority", "fast"])
+          .optional()
+          .describe("Omit to inherit the exact calling turn's latency mode."),
+        sandboxBackend: z4.string().optional(),
+        // Model-only structural coupling: workingDir cannot exist without a
+        // targetSandboxId because both live inside one optional object. The
+        // handler maps this back to the stable public REST/SDK request fields.
+        machineTarget: z4
+          .object({
+            targetSandboxId: z4.string().uuid(),
+            workingDir: z4.string().optional(),
+          })
+          .strict()
+          .optional(),
+        metadata: z4.record(z4.string(), z4.unknown()).optional(),
+        idempotencyKey: z4.string().min(1).max(200).optional(),
+        firstPartyMcpPermissions: z4
+          .array(z4.string())
+          .optional()
+          .describe(
+            "Optional first-party capability set for the child. Omit to inherit this session's effective permissions. An explicit set may only narrow capabilities held by this session. A goal-bearing child requires goals:manage in the resulting set; creation fails rather than adding it implicitly.",
+          ),
+        firstPartyMcpTools: z4
+          .array(z4.enum(FIRST_PARTY_MCP_TOOL_NAMES))
+          .optional()
+          .describe(
+            "Exact model-visible first-party tool selection for the child. Omit to inherit this session's effective selection. To create a non-delegating leaf, provide a selection that omits session_create. This does not grant permissions.",
+          ),
+        // Omission is the ordinary safe sharing path. Literal "shared" remains
+        // available to advanced REST/SDK callers but is intentionally absent
+        // from the model surface because it turns compatibility drift into a
+        // deterministic failure instead of the omission path's safe own-box fallback.
+        sandbox: z4
+          .union([z4.literal("new"), z4.object({ groupId: z4.string().uuid() })])
+          .optional(),
+      })
+      .strict();
     server.registerTool(
       "session_create",
       {
         description:
-          "Spawn a new agent session (a worker) with an initial message and optional goal, resources (e.g. repositories from github_repositories_list), tools, and variable set attachment. VariableSet attachment happens at creation only — it cannot be added to a running session — and requires the variable-sets:use permission. When targetSandboxId names a machine, workingDir sets the working directory (cwd) the spawned session runs under on that machine.",
-        inputSchema: {
-          initialMessage: z4.string().min(1),
-          // Per-session agent persona/system instructions for the spawned worker
-          // (a per-agent-type prompt). Delivered system-level, composed AFTER the
-          // workspace persona; never shown in the worker's timeline. Trimmed,
-          // non-empty, max 32768 chars (re-validated by the contracts schema).
-          instructions: z4.string().min(1).max(32768).optional(),
-          goal: z4.unknown().optional(),
-          resources: z4.array(z4.unknown()).optional(),
-          tools: z4.array(z4.unknown()).optional(),
-          // Per-session third-party MCP servers. Credential header values are
-          // accepted only at create and never appear in responses/events.
-          mcpServers: z4.array(z4.unknown()).optional(),
-          variableSetId: z4.string().uuid().optional(),
-          // Deprecated alias of variableSetId (rename back-compat); declared so MCP
-          // validation doesn't strip it before createSessionForRequest maps it.
-          environmentId: z4.string().uuid().optional(),
-          // Bind the spawned session to a rig (freezes its active version);
-          // declared so MCP validation doesn't strip it before the domain reads it.
-          rigId: z4.string().uuid().optional(),
-          model: z4.string().min(1).optional(),
-          reasoningEffort: z4.string().optional(),
-          latencyMode: z4.enum(["standard", "priority", "fast"]).optional(),
-          sandboxBackend: z4.string().optional(),
-          // Create-time machine targeting: an enrolled sandbox id (from
-          // sandboxes_list) to run the spawned session on. Seeds the active-sandbox
-          // pointer at creation so the FIRST turn lands on the chosen machine
-          // (race-free). Ownership + liveness are validated in the domain via the
-          // same path as sandbox_swap; an unowned/offline/unknown target 422s.
-          targetSandboxId: z4.string().uuid().optional(),
-          // The working directory (cwd) for a machine target: the path/cwd base the
-          // spawned session's agent exec, terminal, and file dock run under. A
-          // workspace_root-relative subdir or an absolute machine path. Only valid
-          // WITH targetSandboxId (workingDir alone 422s); omitted ⇒ workspace_root.
-          workingDir: z4.string().optional(),
-          metadata: z4.record(z4.string(), z4.unknown()).optional(),
-          // Workspace-scoped CREATE idempotency key: a retried session_create with
-          // the same key returns the already-spawned worker instead of a duplicate.
-          idempotencyKey: z4.string().min(1).max(200).optional(),
-          // Per-session/agent descendant policy. Reductions need only create;
-          // increases are authorized server-side with workspace:admin.
-          maxNestedAgentDepth: z4.number().int().nonnegative().optional(),
-          // First-party MCP token permissions for the spawned session; every
-          // permission must be held by this grant (validated in the domain).
-          // A goal requires goals:manage in the resulting set; it is never
-          // silently added beyond the inherited or explicit authority.
-          firstPartyMcpPermissions: z4
-            .array(z4.string())
-            .optional()
-            .describe(
-              "Optional first-party capability set for the child. Omit to inherit this session's effective permissions. An explicit set may only narrow capabilities held by this session. A goal-bearing child requires goals:manage in the resulting set; creation fails rather than adding it implicitly.",
-            ),
-          firstPartyMcpTools: z4
-            .array(z4.enum(FIRST_PARTY_MCP_TOOL_NAMES))
-            .optional()
-            .describe(
-              "Exact model-visible first-party tool selection for the child. Omit to inherit this session's effective selection. This does not grant permissions.",
-            ),
-          // Shared-sandbox placement (addendum 05 §D). OMIT (default) to SHARE the
-          // creator's box — one filesystem/repo/desktop, N independent conversations;
-          // this is the SAFE DEFAULT. Pass "new" for a fresh isolated box (a different
-          // repo set or a genuinely separate filesystem), or {groupId} (a sibling
-          // session's `sandboxGroupId` from a prior session_create response) to join
-          // that specific sibling's box.
-          // Shared state must be compatible: a shared box requires the SAME image
-          // (rejected at the lease layer, B3) and — because the box's variable set is
-          // fixed at creation under the current mechanics — the SAME workspace
-          // VariableSet. The domain layer is env-aware: an inherited default with a
-          // different variableSetId silently gets its OWN box (the spawn still works),
-          // while an explicit shared/{groupId} with a mismatched variableSet 422s at
-          // create. When the VariableSet is eventually evicted from the box manifest
-          // (per-exec, like the git token), the env check dissolves on its own.
-          // The description below is what the AGENT sees (this comment is invisible to
-          // it); keep the two in sync.
-          sandbox: z4
-            .union([
-              z4.literal("shared"),
-              z4.literal("new"),
-              z4.object({ groupId: z4.string().uuid() }),
-            ])
-            .describe(
-              "Sandbox placement. OMIT (default) to SHARE the creator's box — one filesystem/repo/desktop, N independent conversations; this is the safe default. If the new session attaches a DIFFERENT variableSet than the creator's box, the platform automatically gives it its own box (the box variable set is fixed at creation), so omitting stays safe. Pass 'new' for a fresh isolated box (different repo set or a genuinely separate filesystem). Pass {groupId} to join a specific sibling's box — requires the same variableSet (a mismatch is rejected at create) and the same image (a conflicting image is rejected when the box warms).",
-            )
-            .optional(),
-          // The parent (manager) session is auto-inferred from the caller's
-          // worker-signed sessionId claim, so a spawned worker's completion wakes
-          // its manager automatically. There is deliberately no caller-supplied
-          // parent parameter: it would let a sessions:create grant target an
-          // arbitrary session's wake channel without sessions:control on it.
-        },
+          "Spawn a new agent session (a worker). Omit sandbox for the safe default: compatible children share the creator's box, while a different Variable Set or Rig gets its own compatible box. Use 'new' for deliberate isolation or {groupId} for a strict compatible sibling join. Put targetSandboxId and its optional workingDir together inside machineTarget. To create a non-delegating leaf, pass a narrowed firstPartyMcpTools list that omits session_create; do not use a child-local depth override. Public REST/SDK callers retain advanced absolute depth and explicit shared-placement controls.",
+        inputSchema: sessionCreateInput,
       },
       async (args) => {
         try {
           if (callerSessionId !== null) {
             await authorizeFirstPartySession(deps, grant, callerSessionId, "session.child.create");
           }
-          const result = await createSessionForRequestWithOutcome(
-            deps,
-            grant,
-            grant.workspaceId,
-            args,
-          );
-          return json(sessionCreateMutationReceipt(result, Boolean(args.idempotencyKey)));
+          const { machineTarget, ...request } = args;
+          const result = await createSessionForRequestWithOutcome(deps, grant, grant.workspaceId, {
+            ...request,
+            ...(machineTarget
+              ? {
+                  targetSandboxId: machineTarget.targetSandboxId,
+                  ...(machineTarget.workingDir !== undefined
+                    ? { workingDir: machineTarget.workingDir }
+                    : {}),
+                }
+              : {}),
+          });
+          return json(sessionCreateMutationReceipt(result, Boolean(request.idempotencyKey)));
         } catch (error) {
-          if (error instanceof SessionSpawnDeniedError) {
-            return {
-              ...json(sessionSpawnDenialEnvelope(error)),
-              isError: true,
-            };
-          }
-          throw error;
+          return orchestrationFailureResult("session_create", error);
         }
       },
     );
   }
 
-  if (can("sessions:control") && !toolspaceMode) {
+  if (can("sessions:control")) {
     server.registerTool(
       "session_send_message",
       {
@@ -3023,81 +4143,87 @@ function registerWorkspaceOrchestrationTools(
         },
       },
       async ({ sessionId: targetSessionId, text, idempotencyKey, mcpCredentialUpdates }) => {
-        await authorizeFirstPartySession(deps, grant, targetSessionId, "session.append");
-        if (callerSessionId !== null) {
-          if ((mcpCredentialUpdates?.length ?? 0) > 0) {
-            throw new Error("internal session updates cannot change MCP credentials");
+        try {
+          await authorizeFirstPartySession(deps, grant, targetSessionId, "session.append");
+          if (callerSessionId !== null) {
+            if ((mcpCredentialUpdates?.length ?? 0) > 0) {
+              throw new HTTPException(422, {
+                message: "internal session updates cannot change MCP credentials",
+              });
+            }
+            const result = await sendAgentSessionMessage(
+              deps,
+              exactAgentCommandContext(grant, callerSessionId),
+              { targetSessionId, text, idempotencyKey },
+            );
+            return json(
+              mcpMutationReceipt({
+                operation: "session_send_message",
+                committed: true,
+                outcome: result.replay ? "replayed" : "accepted",
+                changed: !result.replay,
+                resource: {
+                  type: "session_system_update",
+                  id: result.updateId,
+                  state: result.effectiveState,
+                },
+                relatedResources: [{ type: "session", id: targetSessionId }],
+                timestamp: result.receipt.createdAt.toISOString(),
+                idempotency: { status: result.replay ? "replayed" : "applied" },
+                facts: {
+                  delivery: "coalesced_internal_update",
+                  wakeRequested: result.wakeRevision !== null,
+                  resumeRequired: result.effectiveState === "paused",
+                },
+                nextAction: {
+                  tool: "session_get",
+                  arguments: { sessionId: targetSessionId },
+                },
+              }),
+            );
           }
-          const result = await sendAgentSessionMessage(
+          const { accepted, turn, replay } = await acceptSessionUserMessageWithOutcome(
             deps,
-            exactAgentCommandContext(grant, callerSessionId),
-            { targetSessionId, text, idempotencyKey },
+            grant,
+            grant.workspaceId,
+            targetSessionId,
+            {
+              text,
+              delivery: "send",
+              origin: "operator",
+              clientEventId: idempotencyKey,
+              mcpCredentialUpdates: (mcpCredentialUpdates ?? []).map((update) =>
+                SessionMcpCredentialUpdateInput.parse(update),
+              ),
+            },
           );
           return json(
             mcpMutationReceipt({
               operation: "session_send_message",
               committed: true,
-              outcome: result.replay ? "replayed" : "accepted",
-              changed: !result.replay,
+              outcome: replay ? "replayed" : "accepted",
+              changed: !replay,
               resource: {
-                type: "session_system_update",
-                id: result.updateId,
-                state: result.effectiveState,
-              },
-              relatedResources: [{ type: "session", id: targetSessionId }],
-              timestamp: result.receipt.createdAt.toISOString(),
-              idempotency: { status: result.replay ? "replayed" : "applied" },
-              facts: {
-                delivery: "coalesced_internal_update",
-                wakeRequested: result.wakeRevision !== null,
-                resumeRequired: result.effectiveState === "paused",
+                type: "session_turn",
+                id: turn.id,
+                version: turn.version,
+                state: turn.status,
               },
+              relatedResources: [
+                { type: "session", id: targetSessionId },
+                { type: "session_event", id: accepted.id, state: accepted.type },
+              ],
+              timestamp: accepted.occurredAt,
+              idempotency: { status: replay ? "replayed" : "applied" },
               nextAction: {
                 tool: "session_get",
                 arguments: { sessionId: targetSessionId },
               },
             }),
           );
+        } catch (error) {
+          return orchestrationFailureResult("session_send_message", error);
         }
-        const { accepted, turn, replay } = await acceptSessionUserMessageWithOutcome(
-          deps,
-          grant,
-          grant.workspaceId,
-          targetSessionId,
-          {
-            text,
-            delivery: "send",
-            origin: "operator",
-            clientEventId: idempotencyKey,
-            mcpCredentialUpdates: (mcpCredentialUpdates ?? []).map((update) =>
-              SessionMcpCredentialUpdateInput.parse(update),
-            ),
-          },
-        );
-        return json(
-          mcpMutationReceipt({
-            operation: "session_send_message",
-            committed: true,
-            outcome: replay ? "replayed" : "accepted",
-            changed: !replay,
-            resource: {
-              type: "session_turn",
-              id: turn.id,
-              version: turn.version,
-              state: turn.status,
-            },
-            relatedResources: [
-              { type: "session", id: targetSessionId },
-              { type: "session_event", id: accepted.id, state: accepted.type },
-            ],
-            timestamp: accepted.occurredAt,
-            idempotency: { status: replay ? "replayed" : "applied" },
-            nextAction: {
-              tool: "session_get",
-              arguments: { sessionId: targetSessionId },
-            },
-          }),
-        );
       },
     );
 
@@ -3123,16 +4249,31 @@ function registerWorkspaceOrchestrationTools(
               reason: reason ?? "agent_mcp_pause",
             },
           );
-          return json({
-            receiptId: controlled.receipt.id,
-            effectiveControl: projectEffectiveControlForRelatedAccess(
-              serializeEffectiveSessionControl(controlled.control),
-              sessionId,
-              controlled.authorization?.relatedSessionAccess ?? "root",
-            ),
-            interruptionCount: controlled.interruptionCount,
-            replay: controlled.replay,
-          });
+          const effectiveControl = projectEffectiveControlForRelatedAccess(
+            serializeEffectiveSessionControl(controlled.control),
+            sessionId,
+            controlled.authorization?.relatedSessionAccess ?? "root",
+          );
+          return json(
+            mcpMutationReceipt({
+              operation: "session_pause",
+              committed: true,
+              outcome: controlled.replay ? "replayed" : "updated",
+              changed: !controlled.replay,
+              resource: {
+                type: "session",
+                id: sessionId,
+                state: effectiveControl.state,
+              },
+              relatedResources: [{ type: "session_command_receipt", id: controlled.receipt.id }],
+              timestamp: controlled.receipt.createdAt.toISOString(),
+              idempotency: {
+                status: controlled.replay ? "replayed" : "applied",
+              },
+              facts: { interruptionCount: controlled.interruptionCount },
+              nextAction: { tool: "session_get", arguments: { sessionId } },
+            }),
+          );
         }
         const controlled = await controlHumanSessionWorkstream(
           deps,
@@ -3176,16 +4317,31 @@ function registerWorkspaceOrchestrationTools(
               reason: reason ?? "agent_mcp_resume",
             },
           );
-          return json({
-            receiptId: controlled.receipt.id,
-            effectiveControl: projectEffectiveControlForRelatedAccess(
-              serializeEffectiveSessionControl(controlled.control),
-              sessionId,
-              controlled.authorization?.relatedSessionAccess ?? "root",
-            ),
-            interruptionCount: controlled.interruptionCount,
-            replay: controlled.replay,
-          });
+          const effectiveControl = projectEffectiveControlForRelatedAccess(
+            serializeEffectiveSessionControl(controlled.control),
+            sessionId,
+            controlled.authorization?.relatedSessionAccess ?? "root",
+          );
+          return json(
+            mcpMutationReceipt({
+              operation: "session_resume",
+              committed: true,
+              outcome: controlled.replay ? "replayed" : "updated",
+              changed: !controlled.replay,
+              resource: {
+                type: "session",
+                id: sessionId,
+                state: effectiveControl.state,
+              },
+              relatedResources: [{ type: "session_command_receipt", id: controlled.receipt.id }],
+              timestamp: controlled.receipt.createdAt.toISOString(),
+              idempotency: {
+                status: controlled.replay ? "replayed" : "applied",
+              },
+              facts: { interruptionCount: controlled.interruptionCount },
+              nextAction: { tool: "session_get", arguments: { sessionId } },
+            }),
+          );
         }
         const controlled = await controlHumanSessionWorkstream(
           deps,
@@ -3283,7 +4439,6 @@ function registerVariableSetTools(
   grant: AccessGrant,
   can: (permission: Permission) => boolean,
   sessionId: string | null,
-  toolspaceMode: boolean,
   json: JsonResult,
 ): void {
   const registerListTool = (name: string, description: string): void => {
@@ -3435,7 +4590,6 @@ function registerVariableSetTools(
   }
 
   if (
-    !toolspaceMode &&
     sessionId !== null &&
     can("variable-sets:read") &&
     hasLiteralPermission(grant.permissions, "secrets:read")
@@ -3475,7 +4629,7 @@ function registerVariableSetTools(
           throw new Error("variable set variable names must match ^[A-Z][A-Z0-9_]*$");
         }
         assertAllowedVariableSetVariableName(parsedName.data);
-        const claims = preferenceAttemptClaims(grant);
+        const claims = exactAgentAttemptClaims(grant);
         if (!claims || claims.sessionId !== sessionId) {
           throw new Error("Exact signed secret-read attempt authority is required.");
         }
@@ -3515,6 +4669,252 @@ function registerVariableSetTools(
   }
 }
 
+type CapabilitySetupProjection =
+  | { status: "ready"; action: null; detail: string }
+  | {
+      status: "authorization_required";
+      action: "connect" | "add_credentials" | "enable";
+      detail: string;
+    }
+  | { status: "unavailable"; action: null; detail: string };
+
+function registerCapabilityDiscoveryTools(
+  server: McpServer,
+  deps: ApiRouteDeps,
+  grant: AccessGrant,
+  sessionId: string,
+  json: JsonResult,
+): void {
+  const catalog = () =>
+    buildCapabilityCatalog({
+      db: deps.db,
+      workspaceId: grant.workspaceId,
+      settings: deps.settings,
+      subjectId: grant.subjectId,
+    });
+  const authorize = async () => {
+    await authorizeFirstPartySession(deps, grant, sessionId, "session.first_party_mcp.call");
+  };
+
+  server.registerTool(
+    "capability_catalog_search",
+    {
+      description:
+        "Search OpenGeni's reviewed workspace capability catalog when the user asks to add an integration or the task needs a capability that is not currently usable. Search by the outcome needed (for example `GitHub repositories`, `product analytics`, or `Slack notifications`), compare the returned candidates, and prefer a ready or verified exact match. This only reads secret-free metadata; it never installs, connects, or authorizes anything.",
+      inputSchema: {
+        query: z4.string().min(1).max(500),
+        limit: z4.number().int().min(1).max(20).optional(),
+      },
+    },
+    async ({ query, limit }) => {
+      await authorize();
+      const current = await catalog();
+      const ranked = searchCapabilityCatalogItems(
+        [...current.items, ...nativeConnectionCapabilityRecommendations()],
+        query,
+        limit ?? 8,
+      );
+      const matches = await Promise.all(
+        ranked.map(async ({ item, matchedOn }) => ({
+          capabilityId: item.id,
+          name: item.name,
+          description: item.description,
+          kind: item.kind,
+          source: item.source,
+          category: item.category,
+          tags: item.tags.slice(0, 16),
+          providerDomain: item.providerDomain,
+          authKind: item.authKind,
+          tier: item.tier,
+          matchedOn,
+          setup: {
+            ...(await capabilitySetupProjection(deps, grant.workspaceId, item)),
+            requiredVariables: capabilityRequiredVariables(item),
+          },
+        })),
+      );
+      return json({ query, matches });
+    },
+  );
+
+  server.registerTool(
+    "capability_authorization_request",
+    {
+      description:
+        "After capability_catalog_search and after explaining one chosen recommendation to the user, post exactly one in-session human authorization card for that catalog capability. This tool never grants access, enables a capability, reads a secret, or mints provider credentials; the authenticated user must click and confirm the provider/domain flow. Do not call it for a candidate reported ready or unavailable.",
+      inputSchema: {
+        capabilityId: z4.string().min(1).max(512),
+        rationale: z4.string().min(1).max(2000),
+      },
+    },
+    async ({ capabilityId, rationale }) => {
+      await authorize();
+      const current = await catalog();
+      const item = [...current.items, ...nativeConnectionCapabilityRecommendations()].find(
+        (candidate) => candidate.id === capabilityId,
+      );
+      if (!item || !capabilityCatalogItemIsTrustedForExposure(item)) {
+        throw new Error("Unknown or untrusted capability; search the catalog again.");
+      }
+      const setup = await capabilitySetupProjection(deps, grant.workspaceId, item);
+      if (setup.status === "ready") {
+        return json({
+          capabilityId: item.id,
+          status: "ready",
+          message: setup.detail,
+        });
+      }
+      if (setup.status === "unavailable") {
+        return json({
+          capabilityId: item.id,
+          status: "unavailable",
+          message: setup.detail,
+        });
+      }
+      const claims = exactAgentCommandContext(grant, sessionId);
+      const payload = ToolAuthNeededPayload.parse({
+        serverId: item.runtime.mcpServerId ?? "opengeni",
+        toolName: "capability_authorization_request",
+        providerDomain: capabilityProviderDomain(item),
+        reason: "missing_connection",
+        capability: {
+          id: item.id,
+          name: item.name,
+          kind: item.kind,
+          source: item.source,
+          action: setup.action,
+          rationale,
+          requiredVariables: capabilityRequiredVariables(item),
+        },
+      });
+      const appended = await appendAndPublishTurnEventsFenced(
+        deps.db,
+        deps.bus,
+        grant.workspaceId,
+        sessionId,
+        claims.callerTurnId,
+        claims.callerExecutionGeneration,
+        claims.callerAttemptId,
+        [{ type: "tool.auth_needed", payload }],
+      );
+      if (!appended.accepted) {
+        throw new Error(
+          "The calling turn was replaced before the authorization request committed.",
+        );
+      }
+      return json({
+        capabilityId: item.id,
+        status: "authorization_requested",
+        action: setup.action,
+        eventId: appended.events[0]?.id ?? null,
+        message:
+          "The recommendation was posted for human confirmation. No access has been granted yet.",
+      });
+    },
+  );
+}
+
+async function capabilitySetupProjection(
+  deps: ApiRouteDeps,
+  workspaceId: string,
+  item: CapabilityCatalogItem,
+): Promise<CapabilitySetupProjection> {
+  if (item.id === "api:github-app" || item.surfaceType === "first_party_github") {
+    const missing = githubAppMissingSettings(deps.settings);
+    if (missing.length > 0) {
+      return {
+        status: "unavailable",
+        action: null,
+        detail:
+          deps.settings.productAccessMode === "managed"
+            ? "GitHub is not available on this deployment."
+            : `The operator must configure the GitHub App first (${missing.join(", ")}).`,
+      };
+    }
+    const installations = await listWorkspaceGitHubInstallationBindings(deps, workspaceId);
+    if (githubBindingStatus(true, installations) === "bound") {
+      return {
+        status: "ready",
+        action: null,
+        detail: "GitHub is connected and ready.",
+      };
+    }
+    return {
+      status: "authorization_required",
+      action: "connect",
+      detail: "A GitHub owner must approve an installation and repository allowlist.",
+    };
+  }
+  if (item.surfaceType === "codex_apps") {
+    return item.enabled
+      ? {
+          status: "ready",
+          action: null,
+          detail: "Codex Apps is connected and ready.",
+        }
+      : {
+          status: "authorization_required",
+          action: "connect",
+          detail: "A workspace admin must designate an authorized Codex Apps subscription.",
+        };
+  }
+  if (item.enabled) {
+    return {
+      status: "ready",
+      action: null,
+      detail: "This capability is already enabled.",
+    };
+  }
+  if (!item.runtime.available) {
+    return {
+      status: "unavailable",
+      action: null,
+      detail: item.runtime.notes ?? "This catalog entry has no executable runtime adapter.",
+    };
+  }
+  if (item.authKind === "oauth2" || item.surfaceType === "first_party_social") {
+    return {
+      status: "authorization_required",
+      action: "connect",
+      detail: "The user must confirm the provider domain and complete sign-in.",
+    };
+  }
+  if (item.authKind === "api_key" || item.authModel?.toLowerCase().includes("key")) {
+    return {
+      status: "authorization_required",
+      action: "add_credentials",
+      detail: "The user must provide the required credential through the protected setup form.",
+    };
+  }
+  return {
+    status: "authorization_required",
+    action: "enable",
+    detail: "A workspace admin must review and enable this capability.",
+  };
+}
+
+function capabilityRequiredVariables(item: CapabilityCatalogItem): string[] {
+  const variableSet = item.metadata.variableSet;
+  if (!variableSet || typeof variableSet !== "object" || Array.isArray(variableSet)) return [];
+  const required = (variableSet as Record<string, unknown>).requiredVariables;
+  return Array.isArray(required)
+    ? required.filter((name): name is string => typeof name === "string").slice(0, 64)
+    : [];
+}
+
+function capabilityProviderDomain(item: CapabilityCatalogItem): string {
+  if (item.providerDomain?.trim()) return item.providerDomain.trim();
+  for (const candidate of [item.homepageUrl, item.endpointUrl, item.mcpUrl]) {
+    if (!candidate) continue;
+    try {
+      return new URL(candidate).hostname;
+    } catch {
+      // Continue to the local, non-provider fallback below.
+    }
+  }
+  return "opengeni.local";
+}
+
 function registerGitHubConnectTool(
   server: McpServer,
   deps: ApiRouteDeps,
@@ -4051,11 +5451,12 @@ function parseMcpDate(raw: string, label: string): Date {
 async function withMcpEffectivePolicy(
   deps: ApiRouteDeps,
   workspaceId: string,
+  subjectId: string,
   session: Session,
 ): Promise<Session> {
   const [workspaceServerIds, workspaceDefaultServerIds] = await Promise.all([
-    workspaceSessionToolPolicyServerIds(deps.db, workspaceId, deps.settings),
-    workspaceSessionToolPolicyDefaultServerIds(deps.db, workspaceId, deps.settings),
+    workspaceSessionToolPolicyServerIds(deps.db, workspaceId, deps.settings, subjectId),
+    workspaceSessionToolPolicyDefaultServerIds(deps.db, workspaceId, deps.settings, subjectId),
   ]);
   return sessionWithEffectiveToolPolicy(session, workspaceServerIds, workspaceDefaultServerIds);
 }