@opengeni/api-router 0.30.1 → 1.0.0

package/src/app.ts

@@ -1,71 +1,200 @@
+import { registerClaudeSubscriptionAccountRoutes } from "./routes/claude-subscription-accounts";
+import { registerWorkspaceModelProviderRoutes } from "./routes/workspace-model-providers";
+import { registerClaudeSubscriptionOAuthRoutes } from "./routes/claude-subscription-oauth";
+import { registerConnectCallbackReturns } from "./integrations/connect-callback-return";
+import { registerFeedbackRoutes } from "./routes/feedback";
+import { registerWorkspaceIntegrationRoutes } from "./routes/workspace-integrations";
+import { registerOrganizationIntegrationRoutes } from "./routes/organization-integrations";
 import {
-  canonicalizeConfiguredModelId,
-  configuredAllowedModels,
+  CLIENT_ERRORS_PATH,
+  isClientErrorReportRequest,
+  registerClientErrorRoutes,
+} from "./routes/client-errors";
+import {
+  ANALYTICS_CONSENT_PATH,
+  isAnalyticsConsentReportRequest,
+  registerAnalyticsConsentRoutes,
+} from "./routes/analytics-consent";
+import { codemodeSessionRequest } from "./codemode";
+import { SiteSessionPathError, OrganizationIntegrationDeniedError } from "@opengeni/contracts";
+import { registerModelConnectionAccessRoutes } from "./routes/model-connection-access";
+import {
+  codeSearchDeploymentPolicy,
+  agentConfigDeploymentPolicy,
   configuredAllowedReasoningEfforts,
-  configuredModels,
   resolveFirstPartyMcpToolPolicy,
-  withCodexCatalogProvider,
-  withXaiSubscriptionCatalogProvider,
+  resolveVoiceInputProviderRegistry,
+  UnsupportedLatencyModeError,
+  type Settings,
 } from "@opengeni/config";
 import {
+  AGENT_CAPABILITY_IDS,
   ClientConfig,
   CodemodeCallRequest,
   ErrorEnvelope,
   OPENGENI_API_CONTRACT_HEADER,
   OPENGENI_API_CONTRACT_REVISION,
   OPENGENI_CORRELATION_HEADER,
+  resolveAgentToolFamilies,
   resolveWorkspaceMemoryEnabled,
   resolveWorkspaceMemoryPromptMode,
   VOICE_INPUT_ACCEPTED_MIME_TYPES,
   TRANSCRIPTION_RECORDING_PROVIDER_SEGMENT_SECONDS,
+  ToolGatewayApprovalRequest,
+  ToolGatewayCallRequest,
   type AccessGrant,
+  type ClientAgentConfig,
   type ErrorCode,
+  type FirstPartyMcpToolName,
+  type Session,
 } from "@opengeni/contracts";
 import {
   createDocumentServices,
-  getDocument,
+  getDocumentForIndexing,
   indexDocumentNow,
   type DocumentServices,
 } from "@opengeni/documents";
 import {
-  CodemodeCallBudgetExceededError,
   CodemodeOperationConflictError,
   CodemodeOperationNotExecutableError,
   CodemodePayloadTooLargeError,
   CodemodeToolApprovalRequiredError,
   CodemodeToolNotInCatalogError,
+  ConnectAttemptConflictError,
+  ConnectAttemptNotFoundError,
+  configureChildLifecycleNotices,
+  configureCodeSearchDeploymentPolicy,
+  configureWorkspaceControlRequestLockTimeoutMs,
   dbSql,
+  getManagedAuthSessionSetSnapshot,
   getWorkspace,
+  reapManagedAuthIsolatedSessions,
+  reapExpiredManagedAuthSessionSets,
+  resolveSessionMemoryAgentScope,
   rlsContextForWorkspace,
-  withSessionRlsActorContext,
 } from "@opengeni/db";
-import { createObservability } from "@opengeni/observability";
+import { requireSessionEventDurableFanoutCapability } from "@opengeni/events";
+import { githubAppBotIdentityWarnings } from "@opengeni/github";
+import {
+  createObservability,
+  failureDiagnostic,
+  withTraceContext,
+  withMcpTelemetry,
+} from "@opengeni/observability";
 import { createObjectStorage } from "@opengeni/storage";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
-import { Hono } from "hono";
+import { SUPPORTED_PROTOCOL_VERSIONS } from "@modelcontextprotocol/sdk/types.js";
+import { handleMcpRequestWithClientAbort } from "./mcp/request-abort";
+import { Hono, type Context } from "hono";
 import { bodyLimit } from "hono/body-limit";
 import { compress } from "hono/compress";
 import { cors } from "hono/cors";
+import { getCookie } from "hono/cookie";
 import { HTTPException } from "hono/http-exception";
-import { ApiHttpError } from "./http/api-error";
+import {
+  ApiHttpError,
+  agentConfigHttpError,
+  allowanceExhaustedHttpError,
+  modelUnavailableHttpError,
+  scheduledTaskTargetAccessHttpError,
+  workspaceControlBusyHttpError,
+} from "./http/api-error";
+import {
+  isRequestBodyValidationError,
+  requestBodyValidationHttpError,
+  tagRequestJsonParseErrors,
+} from "./http/request-body";
+import { invalidPathIdentifierHttpError } from "./http/path-identifier";
+import { replaceTrustedClientAddressHeader } from "./http/request-source";
+import { unmatchedRoute } from "./http/unmatched-route";
 import type { ContentfulStatusCode } from "hono/utils/http-status";
+import { bearerApiContractHeaderCompatibility } from "./http/api-contract-compat";
+import { deprecationHeadersMiddleware } from "./http/deprecation";
+import {
+  boundedRegisteredRouteLabel,
+  registeredHandlerRoutePath,
+} from "./http/registered-route-label";
 import type { ApiRouteDeps, AppDependencies } from "@opengeni/core";
 import {
   CodexCompactionV2ProviderLockedError,
+  ManagedAuthActorLeaseOutcomeUnknownError,
   hasPermission,
   requireAccessGrant,
-  requireLiveAgentAttemptAuthorization,
+  requireAccessGrantAuthorization,
+  accountScopedApiKeyWorkspaceAuthority,
+  requireAccessContext,
   requirePermission,
+  releaseManagedAuthRequestActorLease,
+  resolveCatalogSettings,
+  resolveWorkspaceCatalogSettings,
+  resolveCallerWorkspaceModelSelections,
+  resolveDefaultSessionModelForSelections,
+  selectDefaultSessionModel,
+  isWorkspaceModelAdmissible,
+  resolveWorkspaceModelSelection,
+  validateManagedAuthRequestActorLease,
   requireSessionAuthorization,
   SessionAuthorizationDeniedError,
+  withSessionAuthorizationReadReuse,
   SessionAuthorizationUnavailableError,
+  createUserPresenceRecorder,
+  registerProductUsageMetricBaselines,
 } from "@opengeni/core";
-import { createManagedAuth } from "./auth/managed-auth";
+import { createManagedAuthNewSignupsGate } from "./auth/new-signups-gate";
+import {
+  createManagedAuth,
+  isolatedManagedAuthOAuthCallbackRequest,
+  managedAuthNewSignupsPausedResponse,
+  managedAuthOAuthReturnMatches,
+  resolveManagedAuthOAuthAttempt,
+} from "./auth/managed-auth";
+import {
+  adoptManagedAuthSession,
+  MANAGED_AUTH_SESSION_SET_COOKIE,
+  ManagedAuthActorChangeError,
+  managedAuthCsrfHash,
+  managedAuthDerivedUuid,
+  managedAuthSecretRequestDigest,
+  managedAuthSha256,
+} from "@opengeni/core/managed-auth-session-sets";
+import { createBetterAuthSessionAdapter } from "./auth/managed-auth-session-adapter";
+import {
+  currentManagedAuthCreatedSessionId,
+  runManagedAuthAttempt,
+  runManagedAuthDiscardedProviderSession,
+  runManagedAuthProvider,
+} from "./auth/managed-auth-attempt-context";
+import { createManagedEmailTransport } from "./auth/managed-email";
+import { startManagedSignInNotificationDelivery } from "./auth/managed-sign-in-notifications";
+import {
+  assertManagedEmailTransportMetadata,
+  assertOrganizationUserSetupQueryTransportConfigured,
+} from "./auth/organization-user-setup";
 import { createApiSandboxClient, makeResumeBoxById } from "./sandbox/access";
-import { requireLimit } from "@opengeni/core";
 import { buildOpenGeniMcpServer } from "./mcp/server";
+import {
+  buildWorkspaceToolGatewayMcpServer,
+  approveWorkspaceToolGatewayCall,
+  callWorkspaceToolGateway,
+  grantUsesAttemptScopedMcp,
+  prepareMcpOAuthWorkspaceToolGateway,
+  prepareWorkspaceToolGateway,
+  workspaceToolGatewayDeclarations,
+} from "./workspace-tool-gateway";
+import {
+  isMcpOAuthResourcePath,
+  mcpOAuthAuthenticateHeader,
+  mcpOAuthBearerToken,
+  ORGANIZATION_MCP_PATH,
+  registerMcpOAuthRoutes,
+  resolveMcpOAuthRouteAccess,
+  resolveOrganizationMcpOAuthAccess,
+} from "./mcp-oauth";
+import { buildOrganizationMcpServer, type OrganizationMcpCaller } from "./organization-mcp";
 import {
   CodemodeAuthorityError,
+  CodemodeCatalogNotReadyError,
+  CodemodeCatalogStaleError,
   isCodemodeGrant,
   readCodemodeOperation,
   requireActiveCodemodeCatalog,
@@ -77,49 +206,97 @@ import {
   BrowserControlTransportError,
 } from "@opengeni/runtime/sandbox";
 import { requireAccessKey } from "./http/auth";
+import {
+  publicListenerServesMetrics,
+  registerPrometheusMetricsRoute,
+} from "./http/metrics-listener";
 import { allowedCorsOrigin } from "./http/cors";
+import {
+  createLocalBrowserBoundary,
+  localBrowserRequestHost,
+  markLocalInternalDispatch,
+} from "./http/local-browser-boundary";
+import { withAccessGrantSessionRlsContext } from "./access-grant-rls";
 import { registerCapabilityRoutes } from "./routes/capabilities";
 import { registerCatalogAssetRoutes } from "./routes/catalog-assets";
 import { registerCodexRoutes } from "./routes/codex";
+import { registerOrganizationModelProviderRoutes } from "./routes/organization-model-providers";
+import { registerOrganizationIntegrationPolicyRoutes } from "./routes/organization-integration-policy";
 import { registerSuperGrokRoutes } from "./routes/supergrok";
 import { registerConnectionRoutes } from "./routes/connections";
+import { registerConnectRoutes } from "./routes/connect";
+
+import { registerExternalIdentityLinkRoutes } from "./routes/external-identity-links";
 import { registerDocumentRoutes } from "./routes/documents";
+import { registerKnowledgeRoutes } from "./routes/knowledge";
 import { registerEnrollmentRoutes } from "./routes/enrollments";
 import { registerMachineRoutes } from "./routes/machines";
 import { registerMemorySlackPublicationRoutes } from "./routes/memory-slack-publications";
 import { registerEnvironmentRoutes } from "./routes/environments";
 import { registerFileRoutes } from "./routes/files";
 import { registerApiKeyRoutes } from "./routes/api-keys";
+import { registerOrganizationMcpConnectionRoutes } from "./routes/organization-mcp-connections";
+import { registerOrganizationServiceAccountRoutes } from "./routes/organization-service-accounts";
 import { registerBillingRoutes } from "./routes/billing";
 import { registerBrowserIdentityRoutes } from "./routes/browser-identities";
 import { registerBrowserSessionRoutes } from "./routes/browser-sessions";
 import { registerComputerSessionRoutes } from "./routes/computer-sessions";
 import { registerGitHubRoutes } from "./routes/github";
+import { registerPersonalGitHubRoutes } from "./routes/personal-github";
+import {
+  isPersonalGitHubGitBrokerRequest,
+  registerPersonalGitHubGitBrokerRoutes,
+} from "./routes/personal-github-git-broker";
 import { registerInstallRoutes } from "./routes/install";
 import { registerApiIntegrationRoutes } from "./routes/api-integrations";
 import { registerIntegrationFacetRoutes } from "./routes/integration-facets";
 import { registerInteractionResourceRoutes } from "./routes/interaction-resources";
-import { registerPackRoutes } from "./routes/packs";
+import { registerPrReviewRoutes } from "./routes/pr-review";
+import { registerAutomationRoutes } from "./routes/automations";
 import { registerPluginRoutes } from "./routes/plugins";
 import { registerSkillRoutes } from "./routes/skills";
 import { registerChannelRoutes } from "./routes/channels";
 import { registerRigRoutes } from "./routes/rigs";
 import { registerScheduledTaskRoutes } from "./routes/scheduled-tasks";
 import { registerSessionRoutes } from "./routes/sessions";
+import {
+  archivedSessionImportErrorResponse,
+  isSessionHistoryImportRequest,
+  registerSessionHistoryImportRoutes,
+} from "./routes/session-history-imports";
 import { registerSocialRoutes } from "./routes/social";
 import { registerWorkspaceRoutes } from "./routes/workspaces";
+import { registerUsageAllowanceRoutes } from "./routes/usage-allowances";
 import { registerWorkspaceInstructionPolicyRoutes } from "./routes/workspace-instruction-policies";
+import { registerWorkspaceLearningRoutes } from "./routes/workspace-learning";
 import { registerCompanyProfileRoutes } from "./routes/company-profile";
+import { registerCompanyBrainRoutes } from "./routes/company-brain";
 import { registerSlackTaskPolicyRoutes } from "./routes/slack-task-policy";
 import { registerWorkspaceStateRoutes } from "./routes/workspace-state";
 import { registerWorkspaceArtifactRoutes } from "./routes/workspace-artifacts";
+import { registerArtifactCatalogRoutes } from "./routes/artifact-catalog";
 import { registerPreferenceRegistryRoutes } from "./routes/preference-registry";
 import { registerInsightsRoutes } from "./routes/insights";
+import { registerInsightsUsageRoutes } from "./routes/insights-usage";
 import { registerTranscriptionRoutes } from "./routes/transcriptions";
 import { registerEditableArtifactRoutes } from "./routes/editable-artifacts";
+import { registerSessionArtifactAssociationRoutes } from "./routes/session-artifact-associations";
 import { registerVideoGenerationRoutes } from "./routes/video-generation";
 import { registerCanonicalHumanIdentityRoutes } from "./routes/canonical-human-identities";
 import { registerOrganizationMembershipRoutes } from "./routes/organization-memberships";
+import { registerOrganizationSessionRoutes } from "./routes/organization-sessions";
+import { registerOrganizationRecoveryRoutes } from "./routes/organization-recovery";
+import { registerManagedOnboardingRoutes } from "./routes/managed-onboarding";
+import {
+  registerManagedSignInMethodRoutes,
+  handleManagedSignInConnectCallback,
+} from "./routes/managed-sign-in-methods";
+import {
+  registerManagedAuthSessionSetRoutes,
+  requireManagedAuthProviderRouteAllowed,
+  scrubManagedAuthProviderResponse,
+} from "./routes/managed-auth-session-sets";
+import { registerUserResourceAuthorityRoutes } from "./routes/user-resource-authorities";
 import { projectClientModel } from "./model-catalog";
 import { createTranscriptionService } from "./transcription/service";
 import { createFfmpegTranscriptionSegmenter } from "./transcription/segmenter";
@@ -149,6 +326,8 @@ export { workflowIdForSession } from "@opengeni/core";
 export { replaySessionEvents, sseSessionStream, sseWorkspaceControlStream } from "./http/sse";
 
 export const API_MAX_REQUEST_BODY_BYTES = 32 * 1024 * 1024;
+const managedAuthReaperDatabases = new WeakSet<object>();
+const MANAGED_AUTH_REAPER_INTERVAL_MS = 60_000;
 
 /** Effective Hono bodyLimit — API JSON ceiling or voice multipart + multipart overhead. */
 export function apiRequestBodyLimitBytes(settings: {
@@ -167,11 +346,58 @@ export function createApp(deps: AppDependencies): Hono {
   return createAppComposition(deps).app;
 }
 
+export async function resolveWorkspaceMcpRouteDeps(
+  routeDeps: ApiRouteDeps,
+  grant: AccessGrant,
+): Promise<ApiRouteDeps> {
+  const catalogSourceSettings = routeDeps.catalogSourceSettings ?? routeDeps.settings;
+  const resolvedCatalog = await resolveWorkspaceCatalogSettings(
+    routeDeps.db,
+    catalogSourceSettings,
+    {
+      accountId: grant.accountId,
+      workspaceId: grant.workspaceId,
+    },
+  );
+  return { ...routeDeps, catalogSourceSettings, settings: resolvedCatalog.settings };
+}
+
 export function createAppComposition(deps: AppDependencies): {
   app: Hono;
   routeDeps: ApiRouteDeps;
 } {
-  const managedAuth = deps.managedAuth ?? createManagedAuth(deps.settings, deps.db);
+  assertOrganizationUserSetupQueryTransportConfigured(deps.settings);
+  // The request-scoped workspace control-prefix budget is validated once by
+  // @opengeni/config at boot; install it for every request-scoped db command
+  // (Send/Steer/control/queue/settings/delete) built by this app.
+  configureWorkspaceControlRequestLockTimeoutMs(deps.settings.workspaceControlLockTimeoutMs);
+  // Child lifecycle notice producers (human-input/approval resolutions, direct
+  // Pause) run inside API-originated db commands; install the boot-validated
+  // rollout flag once for this process.
+  configureChildLifecycleNotices({ enabled: deps.settings.childLifecycleNoticesEnabled });
+  // Sessions created by this process freeze their code_search decision from
+  // the boot-parsed deployment policy.
+  configureCodeSearchDeploymentPolicy(codeSearchDeploymentPolicy(deps.settings));
+  const managedEmailTransport =
+    deps.managedEmailTransport ?? createManagedEmailTransport(deps.settings);
+  assertManagedEmailTransportMetadata(managedEmailTransport);
+  const observability =
+    deps.observability ?? createObservability(deps.settings, { component: "api" });
+  const managedAuthNewSignupsGate = createManagedAuthNewSignupsGate({
+    db: deps.db,
+    settings: deps.settings,
+    observability,
+  });
+  const managedAuth =
+    deps.managedAuth ??
+    createManagedAuth(deps.settings, deps.db, managedEmailTransport, {
+      observability,
+      newSignupsGate: managedAuthNewSignupsGate,
+    });
+  const managedAuthSessionAdapter =
+    deps.managedAuthSessionAdapter ??
+    (managedAuth ? createBetterAuthSessionAdapter(managedAuth, deps.db) : null);
+  if (managedAuth) startManagedSignInNotificationDelivery(deps.db, managedEmailTransport);
   const objectStorage =
     deps.objectStorage === undefined ? createObjectStorage(deps.settings) : deps.objectStorage;
   let documentServices: DocumentServices | null = deps.documentServices ?? null;
@@ -204,9 +430,12 @@ export function createAppComposition(deps: AppDependencies): {
       if (context.accountId !== accountId) {
         throw new Error("document account/workspace authority mismatch");
       }
-      const claimedDocument = await getDocument(deps.db, workspaceId, documentId, {
-        viewerSubjectId: authoritySubjectId,
-      });
+      // This is a metadata-only authority-tuple fence. Workspace and
+      // organization documents intentionally have no authority subject, so a
+      // viewer-scoped public read cannot supply the immutable human needed for
+      // Drive ACL evaluation. The byte boundary below reconstructs that
+      // subject from the stored document through indexDocumentNow.
+      const claimedDocument = await getDocumentForIndexing(deps.db, workspaceId, documentId);
       if (
         !claimedDocument ||
         claimedDocument.authorityKind !== authorityKind ||
@@ -221,16 +450,6 @@ export function createAppComposition(deps: AppDependencies): {
         workspaceId,
         documentId,
         getDocumentServices(),
-        {
-          beforeEmbed: async ({ chunkCount }) => {
-            await requireLimit(routeDeps, {
-              accountId,
-              workspaceId,
-              action: "document:index",
-              quantity: chunkCount,
-            });
-          },
-        },
         { viewerSubjectId: authoritySubjectId },
       );
       if (
@@ -249,8 +468,24 @@ export function createAppComposition(deps: AppDependencies): {
   // concrete for routes; it throws SandboxResumeError when sandboxBackend=none.
   const sandboxClient = deps.sandboxClient ?? createApiSandboxClient(deps.settings);
   const resumeBoxById = deps.resumeBoxById ?? makeResumeBoxById(sandboxClient);
-  const observability =
-    deps.observability ?? createObservability(deps.settings, { component: "api" });
+  if (
+    managedAuth &&
+    deps.settings.managedAuthSessionSetMode !== "legacy" &&
+    !managedAuthReaperDatabases.has(deps.db as object)
+  ) {
+    managedAuthReaperDatabases.add(deps.db as object);
+    const timer = setInterval(() => {
+      void Promise.all([
+        reapManagedAuthIsolatedSessions(deps.db, 100),
+        reapExpiredManagedAuthSessionSets(deps.db, 100),
+      ]).catch((error) => {
+        observability.error("Managed isolated-auth orphan reap failed", {
+          errorClass: error instanceof Error ? error.name : "UnknownError",
+        });
+      });
+    }, MANAGED_AUTH_REAPER_INTERVAL_MS);
+    (timer as ReturnType<typeof setInterval> & { unref?: () => void }).unref?.();
+  }
   const transcription =
     deps.transcription === undefined
       ? createTranscriptionService({
@@ -265,12 +500,26 @@ export function createAppComposition(deps: AppDependencies): {
           ffmpegPath: deps.settings.voiceInputFfmpegPath,
         })
       : deps.transcriptionSegmenter;
+  registerProductUsageMetricBaselines(observability);
+  // Server-side presence counts managed people, so it exists only where
+  // canonical managed browser sessions exist. Writes are batched off the
+  // request path; see packages/core/src/user-presence.ts.
+  const userPresence =
+    deps.userPresence !== undefined
+      ? deps.userPresence
+      : deps.settings.productAccessMode === "managed"
+        ? createUserPresenceRecorder({ db: deps.db, observability })
+        : null;
   const routeDeps: ApiRouteDeps = {
     ...deps,
+    resolveCatalogSettings: () => resolveCatalogSettings(deps.db, deps.settings),
     observability,
+    userPresence,
     githubStateSecret:
       deps.githubStateSecret ?? deps.settings.githubAppManifestStateSecret ?? crypto.randomUUID(),
     managedAuth,
+    managedAuthSessionAdapter,
+    managedEmailTransport,
     objectStorage,
     documentIndexer,
     getDocumentServices,
@@ -280,16 +529,107 @@ export function createAppComposition(deps: AppDependencies): {
     resumeBoxById,
   };
   const app = new Hono();
-  const correlationIds = new WeakMap<Request, string>();
+  // Body/auth middleware may replace c.req.raw. The Hono context remains the
+  // same for the response, diagnostic and completion log of this request.
+  const correlationIds = new WeakMap<Context, string>();
+  const loggedHttpFailures = new WeakSet<Context>();
+  const logHttpFailure = (c: Context, status: number, code: ErrorCode, error?: unknown) => {
+    if (loggedHttpFailures.has(c)) return;
+    loggedHttpFailures.add(c);
+    const correlationId = correlationIds.get(c) ?? crypto.randomUUID();
+    const route = routeLabel(new URL(c.req.url).pathname, registeredHandlerRoutePath(c));
+    const input =
+      error === undefined
+        ? null
+        : {
+            code: "http_request_failed" as const,
+            stage: "http.request" as const,
+            error,
+          };
+    const diagnostic = input ? failureDiagnostic(input, deps.settings.deploymentRevision) : null;
+    // Diagnostics and logging are observers, never a new response failure.
+    try {
+      if (input && diagnostic) {
+        observability.recordFailureDiagnostic({ ...input, diagnosticId: diagnostic.diagnosticId });
+      }
+    } catch {
+      /* Preserve the original error response if the diagnostic sink fails. */
+    }
+    try {
+      observability.error("HTTP request failed", {
+        method: c.req.method,
+        route,
+        status,
+        correlationId,
+        errorCode: code,
+        errorClass: "HttpOperationError",
+        origin: "api",
+        reasonKind: diagnostic?.causes[0]?.kind ?? "Response",
+        ...(diagnostic ? { diagnosticId: diagnostic.diagnosticId } : {}),
+      });
+      observability.incrementCounter({
+        name: "opengeni_http_errors_total",
+        help: "Total OpenGeni HTTP request failures by bounded route, status, and stable code.",
+        labels: { route, status: String(status), code },
+      });
+    } catch {
+      /* Preserve the original error response if the logger fails. */
+    }
+  };
 
   app.use("*", async (c, next) => {
     const correlationId =
       boundedCorrelationId(c.req.header(OPENGENI_CORRELATION_HEADER)) ?? crypto.randomUUID();
-    correlationIds.set(c.req.raw, correlationId);
+    correlationIds.set(c, correlationId);
     c.header(OPENGENI_CORRELATION_HEADER, correlationId);
     await next();
   });
 
+  // Unauthenticated local mode: admit only requests addressed to this computer
+  // and, when a browser sent them, from this stack's web app (see
+  // http/local-browser-boundary.ts). Runs before CORS so a refused preflight
+  // carries no CORS grant, and logs each distinct refused Host or Origin once
+  // because the browser shows only a generic CORS error. Null outside local
+  // development.
+  const localBrowserBoundary = createLocalBrowserBoundary(deps.settings, {
+    warn: (message, attributes) => observability.warn(message, attributes),
+  });
+  if (localBrowserBoundary) {
+    app.use("*", async (c, next) => {
+      const rejection = localBrowserBoundary.rejection(c.req.raw);
+      if (rejection) {
+        throw new ApiHttpError(rejection.status, {
+          code: "forbidden",
+          message: rejection.message,
+          retryable: false,
+          details: { code: rejection.code },
+        });
+      }
+      await next();
+    });
+  }
+
+  // Better Auth keys its rate limits and session addresses on a request
+  // header. Drop any caller-supplied copy everywhere and stamp the trusted
+  // source address on managed-auth routes before any route derives a Better
+  // Auth request from this one.
+  app.use("*", async (c, next) => {
+    replaceTrustedClientAddressHeader(c, deps.settings, c.req.path.startsWith("/v1/auth/"));
+    await next();
+  });
+
+  app.use("*", async (c, next) => {
+    const oauthToken = mcpOAuthBearerToken(c.req.raw);
+    if (
+      oauthToken &&
+      (!deps.settings.mcpOauthEnabled || !isMcpOAuthResourcePath(new URL(c.req.url).pathname))
+    ) {
+      c.header("www-authenticate", 'Bearer error="invalid_token"');
+      return c.json({ error: "invalid_token" }, 401);
+    }
+    await next();
+  });
+
   const corsHeaders = {
     allowHeaders: [
       "Accept",
@@ -298,14 +638,39 @@ export function createAppComposition(deps: AppDependencies): {
       "Range",
       "X-OpenGeni-Access-Key",
       "X-OpenGeni-Api-Contract",
+      "X-OpenGeni-Actor-Epoch",
       "X-OpenGeni-Correlation-Id",
+      "X-OpenGeni-Session-Csrf",
+      "X-OpenGeni-Site-Id",
+      "X-OpenGeni-Site-Version",
       "X-OpenGeni-Subject",
+      "X-OpenGeni-User-Activity",
     ],
     exposeHeaders: [
       "Accept-Ranges",
       "Content-Range",
+      "Deprecation",
+      "Link",
+      "Sunset",
       "X-OpenGeni-Api-Contract",
+      "X-OpenGeni-Actor-Epoch",
+      "X-OpenGeni-Actor-State",
       "X-OpenGeni-Correlation-Id",
+      "X-OpenGeni-Covered-First",
+      "X-OpenGeni-Covered-Last",
+      "X-OpenGeni-Event-Direction",
+      "X-OpenGeni-Event-Mode",
+      "X-OpenGeni-Event-Result",
+      "X-OpenGeni-Event-Result-Mode",
+      "X-OpenGeni-Forensic-Exact",
+      "X-OpenGeni-Has-More",
+      "X-OpenGeni-Next-After",
+      "X-OpenGeni-Next-Before",
+      "X-OpenGeni-Page-Bytes",
+      "X-OpenGeni-Page-Max-Bytes",
+      "X-OpenGeni-Page-Truncated",
+      "X-OpenGeni-Payload-Mode",
+      "X-OpenGeni-Truncated-By",
     ],
   };
   const publicApiCors = cors({
@@ -320,8 +685,25 @@ export function createAppComposition(deps: AppDependencies): {
       allowedCorsOrigin(deps.settings.corsAllowOriginRegex, origin) ? origin : null,
   });
 
+  const localCors = localBrowserBoundary
+    ? cors({
+        ...corsHeaders,
+        credentials: true,
+        origin: (origin, c) =>
+          localBrowserBoundary.originAllowed(origin, localBrowserRequestHost(c.req.raw))
+            ? origin
+            : null,
+      })
+    : null;
+
   app.use("*", (c, next) => {
     const origin = c.req.header("origin");
+    if (localCors) {
+      // The boundary above already refused every other origin. Local mode
+      // never answers with wildcard CORS: a request without credentials acts
+      // as the local user, so any site could otherwise read its responses.
+      return origin ? localCors(c, next) : next();
+    }
     const middleware =
       origin && allowedCorsOrigin(deps.settings.corsAllowOriginRegex, origin)
         ? credentialedCors
@@ -329,14 +711,32 @@ export function createAppComposition(deps: AppDependencies): {
     return middleware(c, next);
   });
 
-  app.use(
-    "*",
-    bodyLimit({
-      maxSize: apiRequestBodyLimitBytes(deps.settings),
-      onError: (c) =>
-        c.json({ code: "PAYLOAD_TOO_LARGE", message: "Request body is too large." }, 413),
-    }),
-  );
+  const standardRequestBodyLimit = bodyLimit({
+    maxSize: apiRequestBodyLimitBytes(deps.settings),
+    onError: (c) =>
+      c.json({ code: "PAYLOAD_TOO_LARGE", message: "Request body is too large." }, 413),
+  });
+  app.use("*", async (c, next) => {
+    // Git packfiles must stay streaming and can legitimately exceed the JSON
+    // request ceiling. The exact closed broker routes apply their own method,
+    // content-type, authority, and idle-deadline checks.
+    const pathname = new URL(c.req.url).pathname;
+    if (isPersonalGitHubGitBrokerRequest(c.req.method, pathname)) {
+      await next();
+      return;
+    }
+    // The anonymous web beacons enforce their own small limits on the
+    // streamed body; the generic ceiling would buffer far more first.
+    if (
+      isClientErrorReportRequest(c.req.method, pathname) ||
+      isAnalyticsConsentReportRequest(c.req.method, pathname) ||
+      isSessionHistoryImportRequest(c.req.method, pathname)
+    ) {
+      await next();
+      return;
+    }
+    return await standardRequestBodyLimit(c, next);
+  });
 
   // Large catalog, capture, and session-list responses are on the browser's
   // critical path. Compress JSON at the API boundary while leaving SSE and
@@ -352,90 +752,146 @@ export function createAppComposition(deps: AppDependencies): {
     }
   });
 
+  // Public-route deprecations (docs/design/api-compatibility-policy.md) are
+  // advertised on every response of the affected route, errors included.
+  app.use("/v1/*", deprecationHeadersMiddleware());
+  // A pinned SDK must not be told about a revision it is built to reject; see
+  // the policy's contract-header rule. Registered before the contract fence so
+  // it observes the header that fence sets.
+  app.use("/v1/*", bearerApiContractHeaderCompatibility());
+
   app.use("*", async (c, next) => {
     const url = new URL(c.req.url);
-    const route = routeLabel(url.pathname);
-    const correlationId = correlationIds.get(c.req.raw) ?? crypto.randomUUID();
+    const route = routeLabel(url.pathname, registeredHandlerRoutePath(c));
+    const correlationId = correlationIds.get(c) ?? crypto.randomUUID();
     const start = performance.now();
-    const span = observability.startSpan(`HTTP ${c.req.method} ${route}`, {
-      "http.request.method": c.req.method,
-      "opengeni.route": route,
-    });
-    try {
+    const span = observability.startSpan(
+      `HTTP ${c.req.method} ${route}`,
+      {
+        "http.request.method": c.req.method,
+        "opengeni.route": route,
+      },
+      { parent: null },
+    );
+    return await withMcpTelemetry(observability, span.traceId, () =>
+      withTraceContext(span, async () => {
+        try {
+          await next();
+          const status = c.res.status || 200;
+          // Hono normally handles exceptions in onError before next() resolves.
+          // Also cover a handler returning a 5xx without throwing.
+          if (status >= 500) logHttpFailure(c, status, errorCodeForStatus(status), c.error);
+          const durationSeconds = (performance.now() - start) / 1000;
+          observability.recordHttpRequest({
+            method: c.req.method,
+            route,
+            status,
+            durationSeconds,
+          });
+          span.end({
+            attributes: {
+              "http.response.status_code": status,
+              "opengeni.duration_ms": Math.round(durationSeconds * 1000),
+            },
+            ...(c.error ? { error: c.error } : {}),
+          });
+          observability.info("HTTP request completed", {
+            method: c.req.method,
+            route,
+            status,
+            durationMs: Math.round(durationSeconds * 1000),
+            traceId: span.traceId,
+            spanId: span.spanId,
+            correlationId,
+          });
+        } catch (error) {
+          const status = httpStatusForError(error);
+          const errorCode = errorCodeForStatus(status);
+          const durationSeconds = (performance.now() - start) / 1000;
+          observability.recordHttpRequest({
+            method: c.req.method,
+            route,
+            status,
+            durationSeconds,
+          });
+          span.end({
+            attributes: {
+              "http.response.status_code": status,
+              "opengeni.duration_ms": Math.round(durationSeconds * 1000),
+            },
+            error,
+          });
+          logHttpFailure(c, status, errorCode, error);
+          throw error;
+        }
+      }),
+    );
+  });
+
+  const accessKeyBoundary = requireAccessKey(deps.settings);
+  app.use("*", async (c, next) => {
+    // Git's credential helper supplies the exact encrypted broker bearer in
+    // Authorization. It cannot also supply the deployment access key, and the
+    // route performs its own attempt-bound authorization before every use.
+    if (isPersonalGitHubGitBrokerRequest(c.req.method, new URL(c.req.url).pathname)) {
       await next();
-      const status = c.res.status || 200;
-      const durationSeconds = (performance.now() - start) / 1000;
-      observability.recordHttpRequest({
-        method: c.req.method,
-        route,
-        status,
-        durationSeconds,
-      });
-      span.end({
-        attributes: {
-          "http.response.status_code": status,
-          "opengeni.duration_ms": Math.round(durationSeconds * 1000),
-        },
-      });
-      observability.info("HTTP request completed", {
-        method: c.req.method,
-        route,
-        status,
-        durationMs: Math.round(durationSeconds * 1000),
-        traceId: span.traceId,
-        spanId: span.spanId,
-        correlationId,
-      });
-    } catch (error) {
-      const status = httpStatusForError(error);
-      const errorCode = errorCodeForStatus(status);
-      const durationSeconds = (performance.now() - start) / 1000;
-      observability.recordHttpRequest({
-        method: c.req.method,
-        route,
-        status,
-        durationSeconds,
-      });
-      observability.incrementCounter({
-        name: "opengeni_http_errors_total",
-        help: "Total OpenGeni HTTP request failures by bounded route, status, and stable code.",
-        labels: { route, status: String(status), code: errorCode },
-      });
-      span.end({
-        attributes: {
-          "http.response.status_code": status,
-          "opengeni.duration_ms": Math.round(durationSeconds * 1000),
-        },
-        error,
-      });
-      observability.error("HTTP request failed", {
-        method: c.req.method,
-        route,
-        status,
-        durationMs: Math.round(durationSeconds * 1000),
-        traceId: span.traceId,
-        spanId: span.spanId,
-        correlationId,
-        errorCode,
-        errorClass: "HttpOperationError",
-      });
-      throw error;
+      return;
     }
+    return await accessKeyBoundary(c, next);
+  });
+
+  // Malformed JSON in a client request body is a 400 wherever a route reads it.
+  app.use("/v1/*", async (c, next) => {
+    tagRequestJsonParseErrors(c);
+    await next();
   });
 
-  app.use("*", requireAccessKey(deps.settings));
+  // A request no registered handler answers is a 404 (or a 405 when the path
+  // exists for other methods) before any authentication, authorization, or
+  // contract middleware can turn it into a misleading 401/409/503. This runs
+  // after the deployment perimeter so an unauthenticated caller of a
+  // key-protected deployment learns nothing new.
+  app.use("/v1/*", async (c, next) => {
+    const unmatched = unmatchedRoute(app, c);
+    if (!unmatched) {
+      await next();
+      return;
+    }
+    const requestId = correlationIds.get(c) ?? crypto.randomUUID();
+    c.header(OPENGENI_API_CONTRACT_HEADER, OPENGENI_API_CONTRACT_REVISION);
+    if (unmatched.status === 405) c.header("allow", unmatched.allow.join(", "));
+    return c.json(
+      ErrorEnvelope.parse({
+        error: {
+          status: unmatched.status,
+          code: "not_found",
+          message:
+            unmatched.status === 405
+              ? `Method ${c.req.method} is not supported for this resource. Allowed: ${unmatched.allow.join(", ")}.`
+              : "Resource not found.",
+          retryable: false,
+          requestId,
+        },
+      }),
+      unmatched.status,
+    );
+  });
 
   app.use("/v1/*", async (c, next) => {
     c.header(OPENGENI_API_CONTRACT_HEADER, OPENGENI_API_CONTRACT_REVISION);
     if (
       deps.settings.environment !== "test" &&
-      isApiContractProtectedMutation(c.req.method, new URL(c.req.url).pathname) &&
-      c.req.header(OPENGENI_API_CONTRACT_HEADER) !== OPENGENI_API_CONTRACT_REVISION
+      apiContractAdmission({
+        method: c.req.method,
+        pathname: new URL(c.req.url).pathname,
+        authorization: c.req.header("authorization"),
+        claimedRevision: c.req.header(OPENGENI_API_CONTRACT_HEADER),
+      }) === "reject"
     ) {
       return c.json(
         {
           code: "API_CONTRACT_CHANGED",
-          message: "OpenGeni updated. Reload this client before changing state.",
+          message: "Opengeni updated. Reload this client before changing state.",
           apiContractRevision: OPENGENI_API_CONTRACT_REVISION,
         },
         409,
@@ -444,19 +900,255 @@ export function createAppComposition(deps: AppDependencies): {
     await next();
   });
 
+  app.use("/v1/*", async (c, next) => {
+    try {
+      await next();
+      try {
+        await validateManagedAuthRequestActorLease(c.req.raw);
+      } catch (error) {
+        if (error instanceof ManagedAuthActorChangeError) {
+          c.header("x-opengeni-actor-state", "changed");
+          throw new HTTPException(409, { message: error.code, cause: error });
+        }
+        if (error instanceof ManagedAuthActorLeaseOutcomeUnknownError) {
+          throw new ApiHttpError(503, {
+            code: "upstream_unavailable",
+            message: error.code,
+            retryable: true,
+            outcomeUnknown: true,
+            details: { managedAuthCode: error.code },
+          });
+        }
+        throw error;
+      }
+    } finally {
+      await releaseManagedAuthRequestActorLease(c.req.raw).catch((error) => {
+        observability.error("Managed actor mutation lease release failed", {
+          errorClass: error instanceof Error ? error.name : "UnknownError",
+        });
+      });
+    }
+  });
+
+  // These product-owned auth routes must be registered before Better Auth's
+  // wildcard handler or the provider returns its own 404 first.
+  registerManagedOnboardingRoutes(app, routeDeps);
+  registerManagedAuthSessionSetRoutes(app, routeDeps);
+  registerManagedSignInMethodRoutes(app, routeDeps);
   if (managedAuth) {
-    app.on(["GET", "POST"], "/v1/auth/*", (c) => managedAuth.handler(c.req.raw));
+    app.on(["GET", "POST"], "/v1/auth/*", async (c) => {
+      const pathname = new URL(c.req.url).pathname;
+      const oauthCallbackProvider = managedAuthOAuthCallbackProvider(pathname);
+      if (
+        pathname === "/v1/auth/sign-up/email" &&
+        c.req.method === "POST" &&
+        !(await managedAuthNewSignupsGate.signupsOpen())
+      ) {
+        // Launch-load safety switch: refuse before Better Auth hashes the
+        // password or sends mail. Better Auth's own disableSignUp flags and
+        // the user-create hook remain the backstop for every other path.
+        return managedAuthNewSignupsPausedResponse();
+      }
+      if (pathname === "/v1/auth/sign-in/social" && c.req.method === "POST") {
+        const body = await c.req.raw
+          .clone()
+          .json()
+          .catch(() => null);
+        if (
+          !body ||
+          !["google", "github"].includes(body.provider) ||
+          Object.prototype.hasOwnProperty.call(body, "idToken")
+        ) {
+          return c.json(
+            {
+              code: "SIGN_IN_METHOD_OAUTH_REDIRECT_REQUIRED",
+              message: "Use the browser OAuth sign-in redirect",
+            },
+            403,
+          );
+        }
+      }
+      if (oauthCallbackProvider) {
+        const connectResponse = await handleManagedSignInConnectCallback(
+          c,
+          routeDeps,
+          oauthCallbackProvider,
+        );
+        if (connectResponse) return connectResponse;
+      }
+      if (
+        new Set([
+          "link-social",
+          "unlink-account",
+          "list-accounts",
+          "set-password",
+          "change-password",
+          "change-email",
+          "update-user",
+          "delete-user",
+          "get-access-token",
+          "refresh-token",
+          "account-info",
+        ]).has(pathname.slice("/v1/auth/".length))
+      ) {
+        return c.json(
+          {
+            code: "SIGN_IN_METHOD_PRODUCT_ROUTE_REQUIRED",
+            message: "Use personal sign-in method settings",
+          },
+          403,
+        );
+      }
+      if (deps.settings.managedAuthSessionSetMode === "legacy") {
+        return oauthCallbackProvider
+          ? await runManagedAuthProvider(
+              oauthCallbackProvider,
+              async () => await managedAuth.handler(c.req.raw),
+            )
+          : await managedAuth.handler(c.req.raw);
+      }
+      requireManagedAuthProviderRouteAllowed(c.req.method, pathname);
+      // Provider authentication/recovery is isolated from whichever actor the
+      // browser currently renders. Selected-session capabilities are all
+      // product-owned above this wildcard and generation/epoch fenced.
+      const authority = getCookie(c, MANAGED_AUTH_SESSION_SET_COOKIE);
+      let providerResponse: Response;
+      let preserveCookieNames: readonly string[] | undefined;
+      if (oauthCallbackProvider) {
+        const attempt = await resolveManagedAuthOAuthAttempt(
+          managedAuth,
+          c.req.raw,
+          oauthCallbackProvider,
+          deps.settings.publicBaseUrl!,
+        );
+        if (!attempt || !authority || attempt.authorityHash !== managedAuthSha256(authority)) {
+          throw new HTTPException(409, { message: "provider_route_blocked" });
+        }
+        const isolated = await isolatedManagedAuthOAuthCallbackRequest(managedAuth, c.req.raw);
+        preserveCookieNames = [isolated.stateCookieName];
+        const handled = await runManagedAuthAttempt(
+          attempt.transactionId,
+          oauthCallbackProvider,
+          async () => {
+            const response = await managedAuth.handler(isolated.request);
+            return {
+              response,
+              authSessionId: currentManagedAuthCreatedSessionId(),
+            };
+          },
+        );
+        providerResponse = handled.response;
+        if (
+          !handled.authSessionId &&
+          managedAuthOAuthReturnMatches(
+            providerResponse.headers.get("location") ?? "",
+            new URL(deps.settings.publicBaseUrl!).origin,
+            attempt.transactionId,
+            "complete",
+          )
+        ) {
+          const location = new URL("/account-auth", deps.settings.publicBaseUrl!);
+          location.searchParams.set("transaction", attempt.transactionId);
+          location.searchParams.set("social", "error");
+          providerResponse = Response.redirect(location, 302);
+        } else if (handled.authSessionId) {
+          try {
+            await adoptManagedAuthSession({
+              db: deps.db,
+              adapter: managedAuthSessionAdapter!,
+              authority,
+              authorityHash: attempt.authorityHash,
+              csrfHash: managedAuthCsrfHash(authority),
+              operationId: managedAuthDerivedUuid(
+                "opengeni:managed-auth:social-completion",
+                `${attempt.transactionId}:${attempt.provider}`,
+              ),
+              requestDigest: managedAuthSecretRequestDigest(deps.settings.betterAuthSecret!, {
+                operation: "social_completion",
+                transactionId: attempt.transactionId,
+                provider: attempt.provider,
+                expectedGeneration: attempt.expectedGeneration,
+                expectedActorEpoch: attempt.expectedActorEpoch,
+              }),
+              expectedGeneration: attempt.expectedGeneration,
+              expectedActorEpoch: attempt.expectedActorEpoch,
+              transactionId: attempt.transactionId,
+              transactionSecretHash: attempt.transactionSecretHash,
+              authSessionId: handled.authSessionId,
+              mode: deps.settings.managedAuthSessionSetMode,
+            });
+          } catch {
+            // adoptManagedAuthSession revokes only when durable reconciliation
+            // proves that completion did not commit. An uncertain outcome may
+            // already point the selected slot at this session, so the callback
+            // must not independently revoke it.
+            const location = new URL("/account-auth", deps.settings.publicBaseUrl!);
+            location.searchParams.set("transaction", attempt.transactionId);
+            location.searchParams.set("social", "error");
+            providerResponse = Response.redirect(location, 302);
+          }
+        }
+      } else {
+        const headers = new Headers(c.req.raw.headers);
+        headers.delete("cookie");
+        headers.delete("authorization");
+        headers.delete("x-forwarded-user");
+        const providerRequest = new Request(c.req.raw, { headers });
+        const discardProviderSession =
+          deps.settings.managedAuthSessionSetMode === "broker" || authority !== undefined;
+        providerResponse = discardProviderSession
+          ? await runManagedAuthDiscardedProviderSession(
+              async () => await managedAuth.handler(providerRequest),
+            )
+          : await managedAuth.handler(providerRequest);
+      }
+      let replacementCookies: readonly string[] | undefined;
+      if (deps.settings.managedAuthSessionSetMode === "broker") {
+        replacementCookies = await managedAuthSessionAdapter!.createLegacySelectedSessionCookies(
+          null,
+          c.req.header("cookie") ?? null,
+        );
+      } else {
+        if (authority !== undefined) {
+          const snapshot = await getManagedAuthSessionSetSnapshot(deps.db, {
+            authorityHash: managedAuthSha256(authority),
+            mode: "dual",
+            includeInternal: true,
+            readOnly: true,
+          });
+          if (snapshot) {
+            replacementCookies =
+              await managedAuthSessionAdapter!.createLegacySelectedSessionCookies(
+                snapshot.selected,
+                c.req.header("cookie") ?? null,
+              );
+          } else {
+            replacementCookies =
+              await managedAuthSessionAdapter!.createLegacySelectedSessionCookies(
+                null,
+                c.req.header("cookie") ?? null,
+              );
+          }
+        }
+      }
+      return await scrubManagedAuthProviderResponse(providerResponse, {
+        replacementCookies,
+        preserveCookieNames,
+      });
+    });
   }
 
-  app.get("/healthz", (c) =>
-    c.json({
+  app.get("/healthz", (c) => {
+    const warnings = githubAppBotIdentityWarnings(deps.settings);
+    return c.json({
       service: deps.settings.serviceName,
       environment: deps.settings.environment,
       deploymentRevision: deps.settings.deploymentRevision,
       ...(deps.settings.serverVersion ? { serverVersion: deps.settings.serverVersion } : {}),
+      ...(warnings.length > 0 ? { warnings } : {}),
       ok: true,
-    }),
-  );
+    });
+  });
 
   app.get("/readyz", async (c) => {
     const result = await runReadinessChecks(readinessChecks(deps), 2_000);
@@ -469,44 +1161,146 @@ export function createAppComposition(deps: AppDependencies): {
     return c.json(result, result.ok ? 200 : 503);
   });
 
-  app.get("/metrics", async (c) =>
-    c.text(await observability.prometheusMetrics(), 200, {
-      "content-type": "text/plain; version=0.0.4; charset=utf-8",
-    }),
-  );
+  if (publicListenerServesMetrics(deps.settings)) {
+    registerPrometheusMetricsRoute(app, observability);
+  }
+
+  registerMcpOAuthRoutes(app, routeDeps);
+
+  registerClientErrorRoutes(app, { observability, settings: deps.settings });
+  registerAnalyticsConsentRoutes(app, { observability, settings: deps.settings });
 
   app.get("/v1/config/client", async (c) => {
     c.header("cache-control", "no-store");
-    const codexCatalogSettings = deps.settings.codexSubscriptionEnabled
-      ? withCodexCatalogProvider(deps.settings)
-      : deps.settings;
-    const catalogSettings = deps.settings.supergrokSubscriptionEnabled
-      ? withXaiSubscriptionCatalogProvider(codexCatalogSettings)
-      : codexCatalogSettings;
+    const resolvedCatalog = await resolveCatalogSettings(deps.db, deps.settings);
+    let catalogSettings = resolvedCatalog.settings;
+    let selections = resolveWorkspaceModelSelection({
+      settings: catalogSettings,
+      policy: null,
+      codexSubscriptionActive: false,
+    });
+    let defaultSelection = selectDefaultSessionModel({
+      settings: catalogSettings,
+      selections,
+      workspaceDefaults: null,
+      creditsAvailable: false,
+    });
+    let modelSelectionForbidden = false;
+    const requestedWorkspaceId = c.req.query("workspaceId");
+    if (requestedWorkspaceId !== undefined && requestedWorkspaceId.trim() === "") {
+      throw new HTTPException(422, { message: "workspaceId must not be empty" });
+    }
+    const callerScoped =
+      requestedWorkspaceId !== undefined ||
+      deps.settings.productAccessMode !== "managed" ||
+      c.req.header("authorization") !== undefined ||
+      // Browser bootstrap precedes session-set reconciliation. A cookie alone
+      // cannot scope this public read (broker/changed actors need an epoch).
+      c.req.header("x-opengeni-actor-epoch") !== undefined ||
+      c.req.header("x-opengeni-external-actor") !== undefined;
+    if (callerScoped) {
+      let context: Awaited<ReturnType<typeof requireAccessContext>> | null = null;
+      try {
+        context = await requireAccessContext(c, routeDeps);
+      } catch (error) {
+        // A stale browser cookie must not break the signed-out bootstrap.
+        // Explicit workspace/bearer/external-actor requests fail closed.
+        if (
+          !(error instanceof HTTPException && error.status === 401) ||
+          requestedWorkspaceId !== undefined ||
+          c.req.header("authorization") !== undefined ||
+          c.req.header("x-opengeni-actor-epoch") !== undefined ||
+          c.req.header("x-opengeni-external-actor") !== undefined
+        ) {
+          throw error;
+        }
+      }
+      const workspaceId = requestedWorkspaceId ?? context?.defaultWorkspaceId;
+      if (context && workspaceId) {
+        const grant = await requireAccessGrant(c, routeDeps, workspaceId);
+        await withAccessGrantSessionRlsContext(routeDeps, grant, async () => {
+          catalogSettings = (
+            await resolveWorkspaceCatalogSettings(deps.db, deps.settings, {
+              accountId: grant.accountId,
+              workspaceId,
+            })
+          ).settings;
+          selections = await resolveCallerWorkspaceModelSelections(
+            deps.db,
+            catalogSettings,
+            { accountId: grant.accountId, workspaceId, subjectId: grant.subjectId },
+            { observeAvailability: true },
+          );
+          if (!hasPermission(grant.permissions, "sessions:create")) {
+            modelSelectionForbidden = true;
+            selections = [];
+          }
+          const workspace = await getWorkspace(deps.db, workspaceId);
+          defaultSelection = await resolveDefaultSessionModelForSelections(deps.db, {
+            settings: catalogSettings,
+            accountId: grant.accountId,
+            workspaceSettings: workspace?.settings ?? {},
+            selections,
+          });
+        });
+      } else if (context) {
+        // An organization key has no implicit workspace. Do not advertise
+        // another workspace's authority; it can request an exact workspace.
+        selections = [];
+        modelSelectionForbidden = true;
+      }
+    }
+    const models = selections.filter(isWorkspaceModelAdmissible);
+    const defaultModel = defaultSelection.model;
+    const fallbackDefinition = selections.find(
+      ({ model }) => model.id === defaultModel || model.aliases.includes(defaultModel),
+    );
+    const legacyModelFallback =
+      models.length === 0
+        ? {
+            id: defaultModel,
+            availability: {
+              status: "unavailable" as const,
+              selectable: false as const,
+              reason: modelSelectionForbidden
+                ? ("policy_blocked" as const)
+                : (fallbackDefinition?.availability.reason ?? ("unsupported" as const)),
+              checkedAt: fallbackDefinition?.availability.checkedAt ?? null,
+            },
+          }
+        : undefined;
     return c.json(
       ClientConfig.parse({
         deploymentRevision: deps.settings.deploymentRevision,
+        claudeSubscriptionEnabled: deps.settings.claudeSubscriptionEnabled,
         apiContractRevision: OPENGENI_API_CONTRACT_REVISION,
         ...(deps.settings.serverVersion ? { serverVersion: deps.settings.serverVersion } : {}),
-        defaultModel: canonicalizeConfiguredModelId(catalogSettings, catalogSettings.openaiModel),
-        allowedModels: configuredAllowedModels(catalogSettings),
-        // Provider-grouped model list for the picker. configuredModels() carries the
-        // union of the built-in allow-list and every registry provider's models, in
-        // selection order (default model first); project each to the client-safe
-        // provider-blind ClientModel shape (execution topology remains server-side).
-        models: configuredModels(catalogSettings).map(projectClientModel),
-        defaultReasoningEffort: deps.settings.openaiReasoningEffort,
+        defaultModel,
+        allowedModels: models.length > 0 ? models.map(({ model }) => model.id) : [defaultModel],
+        ...(legacyModelFallback ? { legacyModelFallback } : {}),
+        // Availability remains an observation hint, not the admission predicate.
+        models: models.map(({ model, availability }) => ({
+          ...projectClientModel(model),
+          availability,
+        })),
+        defaultReasoningEffort: defaultSelection.reasoningEffort,
         allowedReasoningEfforts: configuredAllowedReasoningEfforts(deps.settings),
+        defaultSandboxBackend: deps.settings.sandboxBackend,
         mcpServers: deps.settings.mcpServers.map((server) => ({
           id: server.id,
           name: server.name ?? server.id,
         })),
         firstPartyMcpTools: resolveFirstPartyMcpToolPolicy(deps.settings),
+        codeSearch: codeSearchDeploymentPolicy(deps.settings),
+        agentConfig: clientAgentConfig(deps.settings),
         fileUploads: {
           enabled: objectStorage !== null,
           maxSizeBytes: objectStorage?.maxSinglePutSizeBytes ?? 5_000_000_000,
         },
         voiceInput: {
+          providers: resolveVoiceInputProviderRegistry(deps.settings).map(
+            (provider) => provider.id,
+          ),
           available: (await transcription?.available()) ?? false,
           maxDurationSeconds: deps.settings.voiceInputMaxDurationSeconds,
           maxSizeBytes: deps.settings.voiceInputMaxSizeBytes,
@@ -531,8 +1325,18 @@ export function createAppComposition(deps: AppDependencies): {
             : {}),
         },
         productAccessMode: deps.settings.productAccessMode,
-        auth: clientAuthConfig(deps.settings),
+        billingMode: deps.settings.billingMode,
+        managedAuthSessionSetMode: deps.settings.managedAuthSessionSetMode,
+        auth: clientAuthConfig(
+          deps.settings,
+          deps.settings.productAccessMode === "managed"
+            ? await managedAuthNewSignupsGate.signupsOpen()
+            : true,
+        ),
+        documentationUrl: deps.settings.documentationUrl,
         analytics: clientAnalyticsConfig(deps.settings),
+        legal: clientLegalConfig(deps.settings),
+        ...(deps.settings.supportEmail ? { supportEmail: deps.settings.supportEmail } : {}),
         // Channel-A structured services (P4.4) ride exec/readFile/createEditor,
         // available on every real backend; `none` has no box so they are all off.
         // Per-session availability is still negotiated on /stream-capabilities.
@@ -541,6 +1345,67 @@ export function createAppComposition(deps: AppDependencies): {
     );
   });
 
+  // The organization MCP server: every public action, as a person who signed
+  // in (capped by their connection's access setting) or as an organization
+  // API key. Each action runs the real route in this process.
+  app.all(ORGANIZATION_MCP_PATH, async (c) => {
+    let boundedRequest: Request;
+    try {
+      boundedRequest = await boundedMcpRequest(c.req.raw);
+    } catch (error) {
+      if (error instanceof McpPayloadTooLargeError) {
+        throw new HTTPException(413, { message: "MCP request body exceeds the safety limit" });
+      }
+      throw error;
+    }
+    const challenge = () => {
+      if (deps.settings.mcpOauthEnabled) {
+        c.header("www-authenticate", mcpOAuthAuthenticateHeader(routeDeps, ORGANIZATION_MCP_PATH));
+      }
+    };
+    let caller: OrganizationMcpCaller;
+    try {
+      const connection = await resolveOrganizationMcpOAuthAccess(routeDeps, c.req.raw);
+      if (connection) {
+        caller = {
+          kind: "person",
+          accountId: connection.accountId,
+          subjectId: connection.subjectId,
+          access: connection.organizationAccess,
+        };
+      } else {
+        const context = await requireAccessContext(c, routeDeps);
+        const authorization = c.req.header("authorization");
+        if (!accountScopedApiKeyWorkspaceAuthority(context) || !authorization) {
+          throw new HTTPException(403, {
+            message: "Connect with Opengeni sign-in or an organization API key.",
+          });
+        }
+        caller = {
+          kind: "key",
+          authorization,
+          accessKey: c.req.header("x-opengeni-access-key") ?? null,
+        };
+      }
+    } catch (error) {
+      if (error instanceof HTTPException && error.status === 401) challenge();
+      throw error;
+    }
+    const transport = new WebStandardStreamableHTTPServerTransport({ enableJsonResponse: true });
+    const mcp = buildOrganizationMcpServer({
+      caller,
+      origin: new URL(c.req.url).origin,
+      dispatch: async (request) => await app.fetch(request, c.env),
+      signal: c.req.raw.signal,
+    });
+    try {
+      await mcp.connect(transport);
+      return await handleMcpRequestWithClientAbort(transport, boundedRequest, c.req.raw.signal);
+    } finally {
+      await mcp.close().catch(() => undefined);
+    }
+  });
+
   app.use("/v1/workspaces/:workspaceId/*", async (c, next) => {
     const workspaceId = c.req.param("workspaceId");
     if (workspaceRequestRequiresCodexAccountPrevalidation(c.req.raw)) {
@@ -559,6 +1424,27 @@ export function createAppComposition(deps: AppDependencies): {
 
   app.all("/v1/workspaces/:workspaceId/mcp", async (c) => {
     const workspaceId = c.req.param("workspaceId");
+    // This endpoint uses a fresh stateless JSON-response transport per POST;
+    // there is no persistent server-to-client stream. Refuse GET only after
+    // the existing OAuth/workspace/session authorization, before tool setup.
+    const unsupportedGet = () => {
+      const version = c.req.header("mcp-protocol-version");
+      if (version && !SUPPORTED_PROTOCOL_VERSIONS.includes(version)) {
+        return c.json(
+          {
+            jsonrpc: "2.0",
+            id: null,
+            error: { code: -32000, message: "Unsupported protocol version." },
+          },
+          400,
+        );
+      }
+      return c.json(
+        { jsonrpc: "2.0", id: null, error: { code: -32000, message: "Method not allowed." } },
+        405,
+        { allow: "POST" },
+      );
+    };
     let boundedRequest: Request;
     try {
       boundedRequest = await boundedMcpRequest(c.req.raw);
@@ -570,42 +1456,253 @@ export function createAppComposition(deps: AppDependencies): {
       }
       throw error;
     }
-    const grant = await requireMcpAccessGrant(c, routeDeps, workspaceId);
-    return await withAccessGrantSessionRlsContext(routeDeps, grant, async () => {
-      const boundSessionId = grant.metadata?.sessionId;
-      if (typeof boundSessionId === "string") {
+    let oauthAccess: Awaited<ReturnType<typeof resolveMcpOAuthRouteAccess>>;
+    try {
+      oauthAccess = await resolveMcpOAuthRouteAccess(routeDeps, c.req.raw, workspaceId);
+    } catch (error) {
+      if (error instanceof HTTPException && error.status === 401) {
+        c.header(
+          "www-authenticate",
+          mcpOAuthAuthenticateHeader(routeDeps, new URL(c.req.url).pathname),
+        );
+      }
+      throw error;
+    }
+    if (oauthAccess) {
+      return await withAccessGrantSessionRlsContext(routeDeps, oauthAccess.grant, async () => {
+        if (c.req.method === "GET") return unsupportedGet();
+        const prepared = await prepareMcpOAuthWorkspaceToolGateway(
+          routeDeps,
+          oauthAccess.grant,
+          oauthAccess.allowedToolIdentities,
+        );
+        const transport = new WebStandardStreamableHTTPServerTransport({
+          enableJsonResponse: true,
+        });
+        const mcp = buildWorkspaceToolGatewayMcpServer(
+          prepared,
+          oauthAccess.grant,
+          routeDeps.observability,
+        );
         try {
-          await requireSessionAuthorization(routeDeps, grant, {
-            sessionId: boundSessionId,
-            operation: "session.first_party_mcp.call",
-            surface: "first_party_mcp",
-          });
-        } catch (error) {
-          if (error instanceof SessionAuthorizationDeniedError) {
-            throw new HTTPException(404, { message: "session not found" });
-          }
-          if (error instanceof SessionAuthorizationUnavailableError) {
-            throw new HTTPException(503, {
-              message: "session authorization is unavailable",
+          await mcp.connect(transport);
+          return await handleMcpRequestWithClientAbort(transport, boundedRequest, c.req.raw.signal);
+        } finally {
+          await Promise.allSettled([mcp.close(), prepared.close()]);
+        }
+      });
+    }
+    let authorization: Awaited<ReturnType<typeof requireMcpAccessGrantAuthorization>>;
+    try {
+      authorization = await requireMcpAccessGrantAuthorization(c, routeDeps, workspaceId);
+    } catch (error) {
+      if (deps.settings.mcpOauthEnabled && error instanceof HTTPException && error.status === 401) {
+        c.header(
+          "www-authenticate",
+          mcpOAuthAuthenticateHeader(routeDeps, new URL(c.req.url).pathname),
+        );
+      }
+      throw error;
+    }
+    const grant = authorization.grant;
+    // The agent-attempt context, this route check, and a tool's own entry check
+    // re-read the same caller session and attempt; share those reads.
+    return await withSessionAuthorizationReadReuse((reads) =>
+      withAccessGrantSessionRlsContext(routeDeps, grant, async () => {
+        const boundSessionId = grant.metadata?.sessionId;
+        if (typeof boundSessionId === "string") {
+          try {
+            await requireSessionAuthorization(routeDeps, grant, {
+              sessionId: boundSessionId,
+              operation: "session.first_party_mcp.call",
+              surface: "first_party_mcp",
             });
+          } catch (error) {
+            if (error instanceof SessionAuthorizationDeniedError) {
+              throw new HTTPException(404, { message: "session not found" });
+            }
+            if (error instanceof SessionAuthorizationUnavailableError) {
+              throw new HTTPException(503, {
+                message: "session authorization is unavailable",
+              });
+            }
+            throw error;
           }
-          throw error;
         }
-      }
-      const workspace = await getWorkspace(routeDeps.db, workspaceId);
-      const workspaceMemoryEnabled = resolveWorkspaceMemoryEnabled(workspace?.settings);
-      const workspaceMemoryPromptMode = resolveWorkspaceMemoryPromptMode(workspace?.settings);
-      const transport = new WebStandardStreamableHTTPServerTransport({
-        enableJsonResponse: true,
-      });
-      const mcp = buildOpenGeniMcpServer(routeDeps, grant, {
-        requestOrigin: new URL(c.req.url).origin,
-        workspaceMemoryEnabled,
-        workspaceMemoryPromptMode,
+        if (c.req.method === "GET") return unsupportedGet();
+        reads.handOffToToolDispatch();
+        const workspace = await getWorkspace(routeDeps.db, workspaceId);
+        const workspaceMemoryEnabled = resolveWorkspaceMemoryEnabled(workspace?.settings);
+        const workspaceMemoryPromptMode = resolveWorkspaceMemoryPromptMode();
+        const transport = new WebStandardStreamableHTTPServerTransport({
+          enableJsonResponse: true,
+        });
+        if (!grantUsesAttemptScopedMcp(grant)) {
+          const prepared = await prepareWorkspaceToolGateway(routeDeps, authorization);
+          const mcp = buildWorkspaceToolGatewayMcpServer(prepared, grant, routeDeps.observability);
+          try {
+            await mcp.connect(transport);
+            return await handleMcpRequestWithClientAbort(
+              transport,
+              boundedRequest,
+              c.req.raw.signal,
+            );
+          } finally {
+            await Promise.allSettled([mcp.close(), prepared.close()]);
+          }
+        }
+        const mcpDeps = await resolveWorkspaceMcpRouteDeps(routeDeps, grant);
+        // The bound session's frozen Memory selector (migration 0427) decides
+        // which Memory tools the attempt receives and which typed layers they
+        // read and write. A missing row resolves to no Memory tools.
+        const sessionMemory =
+          typeof boundSessionId === "string"
+            ? ((await resolveSessionMemoryAgentScope(
+                routeDeps.db,
+                workspaceId,
+                boundSessionId,
+                grant.metadata,
+              )) ?? {
+                mode: "off" as const,
+                userSubjectId: null,
+                rootSessionId: null,
+              })
+            : null;
+        const mcp = buildOpenGeniMcpServer(mcpDeps, grant, {
+          requestOrigin: new URL(c.req.url).origin,
+          workspaceMemoryEnabled,
+          workspaceMemoryPromptMode,
+          sessionMemory,
+        });
+        // Bind tool handlers' `extra.signal` to the HTTP client's connection: a
+        // worker that drops the call (Steer/Pause) aborts a blocking tool here.
+        // Each POST builds a fresh server; close it once the JSON response is
+        // ready, like the gateway paths above, so it can't outlive the request.
+        try {
+          await mcp.connect(transport);
+          return await handleMcpRequestWithClientAbort(transport, boundedRequest, c.req.raw.signal);
+        } finally {
+          await mcp.close().catch(() => undefined);
+        }
+      }),
+    );
+  });
+
+  app.get("/v1/workspaces/:workspaceId/tools/catalog", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const authorization = await requireAccessGrantAuthorization(
+      c,
+      routeDeps,
+      workspaceId,
+      "workspace:read",
+    );
+    const prepared = await prepareWorkspaceToolGateway(routeDeps, authorization);
+    try {
+      c.header("cache-control", "no-store");
+      return c.json(prepared.toolGatewayCatalog);
+    } finally {
+      await prepared.close();
+    }
+  });
+
+  app.post("/v1/workspaces/:workspaceId/tools/calls", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const authorization = await requireAccessGrantAuthorization(
+      c,
+      routeDeps,
+      workspaceId,
+      "workspace:read",
+    );
+    const grant = authorization.grant;
+    const parsed = ToolGatewayCallRequest.safeParse(await c.req.json().catch(() => null));
+    if (!parsed.success) {
+      throw new HTTPException(400, { message: "Invalid tool gateway call" });
+    }
+    const prepared = await prepareWorkspaceToolGateway(routeDeps, authorization);
+    try {
+      return c.json(
+        await callWorkspaceToolGateway(
+          prepared,
+          grant,
+          parsed.data,
+          routeDeps.db,
+          undefined,
+          routeDeps.observability,
+        ),
+      );
+    } finally {
+      await prepared.close();
+    }
+  });
+
+  app.post("/v1/workspaces/:workspaceId/tools/approvals", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const authorization = await requireAccessGrantAuthorization(
+      c,
+      routeDeps,
+      workspaceId,
+      "workspace:read",
+    );
+    const parsed = ToolGatewayApprovalRequest.safeParse(await c.req.json().catch(() => null));
+    if (!parsed.success) {
+      throw new HTTPException(400, { message: "Invalid tool gateway approval" });
+    }
+    const prepared = await prepareWorkspaceToolGateway(routeDeps, authorization);
+    try {
+      return c.json(
+        await approveWorkspaceToolGatewayCall(
+          prepared,
+          authorization.grant,
+          routeDeps.db,
+          parsed.data,
+          undefined,
+          routeDeps.observability,
+        ),
+        201,
+      );
+    } finally {
+      await prepared.close();
+    }
+  });
+
+  app.get("/v1/workspaces/:workspaceId/tools/declarations", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const authorization = await requireAccessGrantAuthorization(
+      c,
+      routeDeps,
+      workspaceId,
+      "workspace:read",
+    );
+    const prepared = await prepareWorkspaceToolGateway(routeDeps, authorization);
+    try {
+      c.header("cache-control", "no-store");
+      return c.json(workspaceToolGatewayDeclarations(prepared));
+    } finally {
+      await prepared.close();
+    }
+  });
+
+  app.all("/v1/workspaces/:workspaceId/codemode/sdk/*", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, routeDeps, workspaceId);
+    const url = new URL(c.req.url);
+    const prefix = `/v1/workspaces/${workspaceId}/codemode/sdk`;
+    let forwarded: Request;
+    try {
+      const path = url.pathname.slice(prefix.length) + url.search;
+      forwarded = await codemodeSessionRequest(routeDeps, grant, c.req.raw, path, (session) => {
+        assertConfiguredCodemodeSessionProxyPath(session, path, c.req.method);
+        const proxyTools = configuredCodemodeSessionProxyTools(routeDeps.settings, session);
+        return proxyTools === null
+          ? routeDeps.settings
+          : { ...routeDeps.settings, allowedFirstPartyMcpTools: proxyTools };
       });
-      await mcp.connect(transport);
-      return await transport.handleRequest(boundedRequest);
-    });
+    } catch (error) {
+      throw codemodeHttpError(error);
+    }
+    // The forwarded request drops the caller's Host and names a non-sandbox
+    // path; the request it was built from already passed the local boundary.
+    return app.fetch(markLocalInternalDispatch(forwarded));
   });
 
   app.get("/v1/workspaces/:workspaceId/codemode/catalog", async (c) => {
@@ -661,27 +1758,42 @@ export function createAppComposition(deps: AppDependencies): {
     }
   });
 
+  registerConnectCallbackReturns(app, routeDeps);
   registerFileRoutes(app, routeDeps);
+  registerSessionArtifactAssociationRoutes(app, routeDeps);
   registerApiKeyRoutes(app, routeDeps);
+  registerOrganizationMcpConnectionRoutes(app, routeDeps);
+  registerOrganizationServiceAccountRoutes(app, routeDeps);
   registerBillingRoutes(app, routeDeps);
   registerBrowserIdentityRoutes(app, routeDeps);
   registerBrowserSessionRoutes(app, routeDeps);
   registerComputerSessionRoutes(app, routeDeps);
   registerDocumentRoutes(app, routeDeps);
+  registerKnowledgeRoutes(app, routeDeps);
   registerGitHubRoutes(app, routeDeps);
   registerInstallRoutes(app, routeDeps);
   registerInteractionResourceRoutes(app, routeDeps);
   registerWorkspaceRoutes(app, routeDeps);
+  registerUsageAllowanceRoutes(app, routeDeps);
   registerInsightsRoutes(app, routeDeps);
+  registerInsightsUsageRoutes(app, routeDeps);
   registerWorkspaceInstructionPolicyRoutes(app, routeDeps);
+  registerWorkspaceLearningRoutes(app, routeDeps);
   registerCompanyProfileRoutes(app, routeDeps);
+  registerCompanyBrainRoutes(app, routeDeps);
   registerSlackTaskPolicyRoutes(app, routeDeps);
   registerWorkspaceStateRoutes(app, routeDeps);
   registerMemorySlackPublicationRoutes(app, routeDeps);
   registerWorkspaceArtifactRoutes(app, routeDeps);
+  registerArtifactCatalogRoutes(app, routeDeps);
   registerPreferenceRegistryRoutes(app, routeDeps);
   registerSocialRoutes(app, routeDeps);
+  registerPersonalGitHubRoutes(app, routeDeps);
+  registerPersonalGitHubGitBrokerRoutes(app, routeDeps);
   registerConnectionRoutes(app, routeDeps);
+  registerConnectRoutes(app, routeDeps);
+
+  registerExternalIdentityLinkRoutes(app, routeDeps);
   registerCapabilityRoutes(app, routeDeps);
   registerApiIntegrationRoutes(app, routeDeps);
   registerIntegrationFacetRoutes(app, routeDeps);
@@ -691,23 +1803,37 @@ export function createAppComposition(deps: AppDependencies): {
   registerEnvironmentRoutes(app, routeDeps);
   registerChannelRoutes(app, routeDeps);
   registerRigRoutes(app, routeDeps);
-  registerPackRoutes(app, routeDeps);
+  registerAutomationRoutes(app, routeDeps);
+  registerPrReviewRoutes(app, routeDeps);
   registerPluginRoutes(app, routeDeps);
   registerSkillRoutes(app, routeDeps);
   registerSessionRoutes(app, routeDeps);
+  registerSessionHistoryImportRoutes(app, routeDeps);
+  registerFeedbackRoutes(app, routeDeps);
+  registerWorkspaceIntegrationRoutes(app, routeDeps);
+  registerOrganizationIntegrationRoutes(app, routeDeps);
   registerScheduledTaskRoutes(app, routeDeps);
   registerCodexRoutes(app, routeDeps);
+  registerOrganizationModelProviderRoutes(app, routeDeps);
+  registerWorkspaceModelProviderRoutes(app, routeDeps);
+  registerClaudeSubscriptionOAuthRoutes(app, routeDeps);
+  registerOrganizationIntegrationPolicyRoutes(app, routeDeps);
+  registerModelConnectionAccessRoutes(app, routeDeps);
   registerSuperGrokRoutes(app, routeDeps);
+  registerClaudeSubscriptionAccountRoutes(app, routeDeps);
   registerTranscriptionRoutes(app, routeDeps);
   registerEditableArtifactRoutes(app, routeDeps);
   registerVideoGenerationRoutes(app, routeDeps);
   registerCanonicalHumanIdentityRoutes(app, routeDeps);
   registerOrganizationMembershipRoutes(app, routeDeps);
+  registerOrganizationSessionRoutes(app, routeDeps);
+  registerOrganizationRecoveryRoutes(app, routeDeps);
+  registerUserResourceAuthorityRoutes(app, routeDeps);
   registerSlackInteractionRoutes(app, routeDeps);
 
   app.notFound((c) => {
     if (!new URL(c.req.url).pathname.startsWith("/v1/")) return c.text("Not Found", 404);
-    const requestId = correlationIds.get(c.req.raw) ?? crypto.randomUUID();
+    const requestId = correlationIds.get(c) ?? crypto.randomUUID();
     return c.json(
       ErrorEnvelope.parse({
         error: {
@@ -722,18 +1848,49 @@ export function createAppComposition(deps: AppDependencies): {
     );
   });
 
-  app.onError((error, c) => {
+  app.onError((rawError, c) => {
+    const requestId = correlationIds.get(c) ?? crypto.randomUUID();
+    c.header(OPENGENI_CORRELATION_HEADER, requestId);
+    if (new URL(c.req.url).pathname.startsWith("/v1/")) {
+      c.header(OPENGENI_API_CONTRACT_HEADER, OPENGENI_API_CONTRACT_REVISION);
+    }
+    // Archives remain read-only through the existing Send/Steer/control paths.
+    const importErrorResponse = archivedSessionImportErrorResponse(c, rawError);
+    if (importErrorResponse) return importErrorResponse;
+    // One central mapping for every Send/Steer/control route: a bounded
+    // control-prefix wait that expired is a known, retryable, not-applied 503.
+    const error =
+      rawError instanceof OrganizationIntegrationDeniedError
+        ? new HTTPException(403, { message: rawError.message })
+        : (allowanceExhaustedHttpError(rawError) ??
+          workspaceControlBusyHttpError(rawError) ??
+          scheduledTaskTargetAccessHttpError(rawError) ??
+          agentConfigHttpError(rawError) ??
+          modelUnavailableHttpError(rawError) ??
+          (rawError instanceof UnsupportedLatencyModeError
+            ? new ApiHttpError(422, {
+                code: "validation_failed",
+                message: rawError.message,
+                retryable: false,
+                outcomeUnknown: false,
+                details: {
+                  code: rawError.code,
+                  modelId: rawError.modelId,
+                  latencyMode: rawError.latencyMode,
+                  allowedLatencyModes: [...rawError.allowedLatencyModes],
+                },
+              })
+            : null) ??
+          requestBodyValidationHttpError(rawError) ??
+          invalidPathIdentifierHttpError(rawError, new URL(c.req.url).pathname) ??
+          rawError);
     const compactionLock = codexCompactionV2ProviderLockedError(error);
     const apiError = error instanceof ApiHttpError ? error : null;
     const status = compactionLock ? 422 : httpStatusForError(error);
     const code: ErrorCode = compactionLock
       ? compactionLock.code
       : (apiError?.code ?? errorCodeForStatus(status));
-    const requestId = correlationIds.get(c.req.raw) ?? crypto.randomUUID();
-    c.header(OPENGENI_CORRELATION_HEADER, requestId);
-    if (new URL(c.req.url).pathname.startsWith("/v1/")) {
-      c.header(OPENGENI_API_CONTRACT_HEADER, OPENGENI_API_CONTRACT_REVISION);
-    }
+    if (status >= 500) logHttpFailure(c, status, code, rawError);
     const envelope = ErrorEnvelope.parse({
       error: {
         status,
@@ -744,7 +1901,9 @@ export function createAppComposition(deps: AppDependencies): {
             ? (boundedPublicMessage(apiError.message) ?? "Request failed.")
             : publicErrorMessage(error, status),
         retryable: apiError?.retryable ?? retryableHttpStatus(status),
-        ...(mutationOutcomeUnknown(error, c.req.method) ? { outcomeUnknown: true } : {}),
+        ...((apiError?.outcomeUnknown ?? mutationOutcomeUnknown(error, c.req.method))
+          ? { outcomeUnknown: true }
+          : {}),
         requestId,
         ...(apiError?.details ? { details: apiError.details } : {}),
       },
@@ -755,6 +1914,11 @@ export function createAppComposition(deps: AppDependencies): {
   return { app, routeDeps };
 }
 
+function managedAuthOAuthCallbackProvider(pathname: string): "google" | "github" | null {
+  const match = pathname.match(/^\/v1\/auth\/callback\/(google|github)$/u);
+  return match?.[1] === "google" || match?.[1] === "github" ? match[1] : null;
+}
+
 function mutationOutcomeUnknown(error: unknown, method: string): boolean {
   if (method === "GET" || method === "HEAD" || method === "OPTIONS") return false;
   const cause = error instanceof HTTPException ? error.cause : error;
@@ -781,7 +1945,41 @@ const publicWorkspaceBrowserRoutePatterns = [
 ] as const;
 
 export function workspaceActorContextExempt(method: string, pathname: string): boolean {
-  if (/^\/v1\/workspaces\/[^/]+\/mcp$/.test(pathname)) return true;
+  // The account-scoped provisioning route shares the workspace collection prefix.
+  // Hono's trailing wildcard also matches it, but "external" is not a workspace UUID;
+  // the route performs its own organization API-key authorization.
+  if (method === "PUT" && pathname === "/v1/workspaces/external") return true;
+  // Import adapters apply their own exact create/control gates and request-local
+  // RLS in core. Tenant mirrors first resolve the organization-local mapping;
+  // "external" itself is not a native workspace id.
+  if (isSessionHistoryImportRequest(method, pathname)) return true;
+  // Organization budget authority is independent of ordinary workspace
+  // membership; these routes apply their own exact account/workspace gate.
+  if (
+    (["GET", "PUT", "DELETE"].includes(method) &&
+      /^\/v1\/workspaces\/[^/]+\/allowance$/.test(pathname)) ||
+    (method === "GET" && /^\/v1\/workspaces\/[^/]+\/allowance\/state$/.test(pathname)) ||
+    (method === "POST" && /^\/v1\/workspaces\/[^/]+\/allowance\/grants$/.test(pathname))
+  )
+    return true;
+  // Allowance tenant mirrors resolve the workspace by exact organization-local
+  // external identity before applying the ordinary workspace authorization.
+  if (
+    (["GET", "PUT", "DELETE"].includes(method) &&
+      /^\/v1\/workspaces\/external\/[^/]+\/[^/]+\/allowance$/.test(pathname)) ||
+    (method === "GET" &&
+      /^\/v1\/workspaces\/external\/[^/]+\/[^/]+\/allowance\/state$/.test(pathname)) ||
+    (method === "POST" &&
+      /^\/v1\/workspaces\/external\/[^/]+\/[^/]+\/allowance\/grants$/.test(pathname)) ||
+    (method === "GET" &&
+      /^\/v1\/workspaces\/external\/[^/]+\/[^/]+\/usage(?:\/me)?$/.test(pathname)) ||
+    (method === "PUT" &&
+      /^\/v1\/workspaces\/external\/[^/]+\/[^/]+\/members\/(?:[^/]+|external\/[^/]+\/[^/]+)\/allowance$/.test(
+        pathname,
+      ))
+  )
+    return true;
+  if (/^\/v1\/workspaces\/[^/]+\/mcp(?:\/(?:docs|files))?$/.test(pathname)) return true;
   if (
     method === "GET" &&
     publicWorkspaceBrowserRoutePatterns.some((route) => route.test(pathname))
@@ -810,46 +2008,15 @@ async function validateCodexAccountTarget(request: Request): Promise<void> {
   }
 }
 
-async function withAccessGrantSessionRlsContext<T>(
-  deps: ApiRouteDeps,
-  grant: AccessGrant,
-  fn: () => Promise<T>,
-): Promise<T> {
-  if (grant.principalKind !== "agent_attempt") {
-    return await withSessionRlsActorContext({ subjectId: grant.subjectId }, fn);
-  }
-  const callerSessionId = grant.metadata?.sessionId;
-  if (typeof callerSessionId !== "string") {
-    throw new HTTPException(403, { message: "agent attempt authority is invalid" });
-  }
-  try {
-    const actor = await requireLiveAgentAttemptAuthorization(deps.db, grant, callerSessionId);
-    return await withSessionRlsActorContext(
-      {
-        subjectId: actor.subjectId,
-        initiatingHumanSubjectId: actor.initiatingHumanSubjectId,
-      },
-      fn,
-    );
-  } catch (error) {
-    if (error instanceof SessionAuthorizationDeniedError) {
-      throw new HTTPException(403, {
-        message: "agent attempt authority is invalid",
-        cause: error,
-      });
-    }
-    throw error;
-  }
-}
-
-async function requireMcpAccessGrant(
+async function requireMcpAccessGrantAuthorization(
   c: Parameters<typeof requireAccessGrant>[0],
   deps: ApiRouteDeps,
   workspaceId: string,
-): Promise<AccessGrant> {
-  const grant = await requireAccessGrant(c, deps, workspaceId);
+): Promise<Awaited<ReturnType<typeof requireAccessGrantAuthorization>>> {
+  const authorization = await requireAccessGrantAuthorization(c, deps, workspaceId);
+  const grant = authorization.grant;
   if (hasPermission(grant.permissions, "workspace:read")) {
-    return grant;
+    return authorization;
   }
   if (isCodemodeGrant(grant)) {
     requirePermission(grant, "workspace:read");
@@ -859,15 +2026,28 @@ async function requireMcpAccessGrant(
   // authorization seam runs immediately after this gate, and tool registration
   // still exposes only capabilities permitted by the delegated grant.
   if (grant.metadata?.delegated === true && typeof grant.metadata.sessionId === "string") {
-    return grant;
+    return authorization;
   }
   requirePermission(grant, "workspace:read");
-  return grant;
+  return authorization;
 }
 
-function clientAuthConfig(settings: AppDependencies["settings"]) {
+function clientAuthConfig(settings: AppDependencies["settings"], newSignupsEnabled: boolean) {
   if (settings.productAccessMode === "managed") {
-    return { mode: "managedSession" as const, session: "cookie" as const };
+    return {
+      mode: "managedSession" as const,
+      session: "cookie" as const,
+      emailVerificationRequired: settings.environment !== "local",
+      newSignupsEnabled,
+      socialProviders: [
+        ...(settings.managedAuthGoogleClientId && settings.managedAuthGoogleClientSecret
+          ? (["google"] as const)
+          : []),
+        ...(settings.managedAuthGithubClientId && settings.managedAuthGithubClientSecret
+          ? (["github"] as const)
+          : []),
+      ],
+    };
   }
   if (settings.productAccessMode === "configured") {
     return {
@@ -885,7 +2065,143 @@ function clientAuthConfig(settings: AppDependencies["settings"]) {
   return { mode: "none" as const };
 }
 
+/** Configured SDK credentials cannot regain tools from widened legacy columns. */
+export function configuredCodemodeSessionProxyTools(
+  settings: Pick<Settings, "defaultFirstPartyMcpTools" | "allowedFirstPartyMcpTools">,
+  session: Pick<Session, "agent">,
+): FirstPartyMcpToolName[] | null {
+  if (!session.agent) return null;
+  const families = resolveAgentToolFamilies(session.agent);
+  return resolveFirstPartyMcpToolPolicy(settings).allowed.filter((tool) =>
+    families.allowsFirstPartyTool(tool),
+  );
+}
+
+/**
+ * Permissions span capabilities: project_create grants sessions:create,
+ * and runtime titling grants sessions:control. Fence the endpoint family
+ * too, without changing null-config routing or ordinary REST authorization.
+ */
+export function assertConfiguredCodemodeSessionProxyPath(
+  session: Pick<Session, "id" | "agent">,
+  path: string,
+  method: string,
+): void {
+  if (!session.agent) return;
+  const families = resolveAgentToolFamilies(session.agent);
+  const pathname = new URL(path, "http://codemode.invalid").pathname;
+  const segments = pathname.split("/").filter(Boolean);
+  const verb = method.toUpperCase();
+  const read = verb === "GET" || verb === "HEAD";
+  const allows = (tool: FirstPartyMcpToolName) => families.allowsFirstPartyTool(tool);
+  let allowed = false;
+  if (pathname === "/v1/config/client") {
+    allowed = read;
+  } else if (segments[0] === "v1" && segments[1] === "workspaces" && segments[2] === "site-host") {
+    const [surface, targetSessionId, operation] = segments.slice(3);
+    if (!surface) {
+      allowed = read;
+    } else if (surface === "sessions") {
+      const ownSession = targetSessionId === session.id;
+      const targetAllowed = ownSession || families.subagents;
+      if (!targetSessionId) {
+        allowed = families.subagents;
+      } else if (ownSession && !operation && read) {
+        allowed = true;
+      } else if (ownSession && !operation && verb === "PATCH") {
+        allowed = allows("set_session_title");
+      } else if (ownSession && operation === "background-commands") {
+        allowed = read && allows("command_read");
+      } else if (operation === "goal") {
+        allowed = allows("goal_set") && targetAllowed;
+      } else if (operation === "browser" || operation === "computer") {
+        allowed = allows("browser_open") && targetAllowed;
+      } else if (operation === "human-input-requests") {
+        allowed = families.humanInput && targetAllowed;
+      } else if (operation === "artifacts") {
+        allowed = allows("artifacts_list") && targetAllowed;
+      } else if (ownSession && ["fs", "git", "terminal", "workspace"].includes(operation ?? "")) {
+        // Resource-derived sandbox mechanics are not platform capabilities.
+        allowed = true;
+      } else if (
+        [
+          "agent",
+          "tool-policy",
+          "mcp-servers",
+          "mcp-credentials",
+          "variable-sets",
+          "project",
+        ].includes(operation ?? "")
+      ) {
+        allowed = allows("project_get") && targetAllowed;
+      } else {
+        allowed = families.subagents;
+      }
+    } else if (surface === "files") {
+      allowed = families.allowsMcpServer("files");
+    } else if (surface === "skills") {
+      allowed = families.skills === "manage" || (families.skills === "read" && read);
+    } else if (surface === "human-input-requests") {
+      allowed = families.humanInput;
+    } else {
+      const owners: Record<string, FirstPartyMcpToolName> = {
+        "model-catalog": "sessions_list",
+        "realtime-model-catalog": "sessions_list",
+        "model-policy": "sessions_list",
+        "gateway-custom-models": "sessions_list",
+        "openrouter-custom-models": "sessions_list",
+        "new-session-draft": "session_create",
+        "session-tenancy": "session_create",
+        "session-message-search": "session_events",
+        "agent-topology": "sessions_list",
+        projects: "project_get",
+        sandboxes: "sandboxes_list",
+        machines: "sandboxes_list",
+        rigs: "rig_list",
+        environments: "environment_list",
+        "variable-sets": "variable_set_list",
+        capabilities: "capability_catalog_search",
+        catalog: "capability_catalog_search",
+        members: "project_get",
+        "member-candidates": "project_get",
+        "control-events": "project_get",
+        "browser-identities": "browser_identity",
+        "browser-sessions": "browser_open",
+        "computer-sessions": "computer_open",
+        "attached-browsers": "browser_open",
+        documents: "knowledge_search",
+        knowledge: "knowledge_search",
+        memory: "knowledge_search",
+        "instruction-policy": "instruction_policy_get",
+        preferences: "preference_registry_get",
+        "company-profile": "company_profile_propose",
+        artifacts: "artifacts_list",
+        "scheduled-tasks": "scheduled_tasks_list",
+        automations: "scheduled_tasks_list",
+        connections: "github_connect_link",
+        integrations: "github_connect_link",
+        github: "github_connect_link",
+        social: "social_connections_list",
+        mcp: "github_connect_link",
+      };
+      const tool = owners[surface];
+      allowed = tool !== undefined && allows(tool);
+    }
+  }
+  if (!allowed) {
+    throw new HTTPException(403, {
+      message: "Agent configuration does not allow this Codemode SDK operation",
+    });
+  }
+}
+
 function codemodeHttpError(error: unknown): HTTPException {
+  if (error instanceof SiteSessionPathError) {
+    // The proxied Site/SDK surface is an explicit allowlist; a route outside
+    // it (tool policy, visibility, forks, Steer, control, ...) does not exist
+    // for this caller rather than being a server fault.
+    return new HTTPException(404, { message: error.message, cause: error });
+  }
   if (error instanceof SessionAuthorizationDeniedError) {
     return new HTTPException(404, {
       message: "session not found",
@@ -898,18 +2214,39 @@ function codemodeHttpError(error: unknown): HTTPException {
       cause: error,
     });
   }
-  if (
-    error instanceof CodemodeAuthorityError ||
-    error instanceof CodemodeOperationNotExecutableError
-  ) {
+  if (error instanceof CodemodeCatalogNotReadyError) {
+    return new ApiHttpError(409, {
+      code: "conflict",
+      message: error.message,
+      retryable: true,
+      outcomeUnknown: false,
+      details: { code: error.code },
+    });
+  }
+  if (error instanceof CodemodeCatalogStaleError) {
+    return new ApiHttpError(409, {
+      code: "conflict",
+      message: error.message,
+      retryable: true,
+      outcomeUnknown: false,
+      details: { code: error.code },
+    });
+  }
+  if (error instanceof CodemodeAuthorityError) {
+    return new ApiHttpError(error.reason === "invalid_grant" ? 403 : 409, {
+      code: error.reason === "invalid_grant" ? "forbidden" : "conflict",
+      message: error.message,
+      retryable: false,
+      outcomeUnknown: false,
+      details: { code: error.code },
+    });
+  }
+  if (error instanceof CodemodeOperationNotExecutableError) {
     return new HTTPException(409, { message: error.message, cause: error });
   }
   if (error instanceof CodemodeOperationConflictError) {
     return new HTTPException(409, { message: error.message, cause: error });
   }
-  if (error instanceof CodemodeCallBudgetExceededError) {
-    return new HTTPException(429, { message: error.message, cause: error });
-  }
   if (error instanceof CodemodeToolNotInCatalogError) {
     return new HTTPException(404, { message: error.message, cause: error });
   }
@@ -952,6 +2289,15 @@ function clientAnalyticsConfig(settings: AppDependencies["settings"]) {
   };
 }
 
+function clientLegalConfig(settings: AppDependencies["settings"]) {
+  return {
+    ...(settings.legalPrivacyPolicyUrl ? { privacyPolicyUrl: settings.legalPrivacyPolicyUrl } : {}),
+    ...(settings.legalTermsOfServiceUrl
+      ? { termsOfServiceUrl: settings.legalTermsOfServiceUrl }
+      : {}),
+  };
+}
+
 function structuredServicesHint(backend: string): {
   fileSystem: boolean;
   git: boolean;
@@ -975,9 +2321,17 @@ function codexCompactionV2ProviderLockedError(
 }
 
 export function httpStatusForError(error: unknown): number {
+  if (error instanceof ConnectAttemptConflictError) return 409;
+  if (error instanceof ConnectAttemptNotFoundError) return 404;
   if (codexCompactionV2ProviderLockedError(error)) {
     return 422;
   }
+  if (workspaceControlBusyHttpError(error)) {
+    return 503;
+  }
+  if (isRequestBodyValidationError(error)) {
+    return 400;
+  }
   if (error instanceof HTTPException) {
     return error.status;
   }
@@ -991,7 +2345,7 @@ export function errorCodeForStatus(status: number): ErrorCode {
   if (status === 401) return "unauthenticated";
   if (status === 402) return "payment_required";
   if (status === 403) return "forbidden";
-  if (status === 404) return "not_found";
+  if (status === 404 || status === 405) return "not_found";
   if (status === 409) return "conflict";
   if (status === 413 || status === 422 || status === 400) return "validation_failed";
   if (status === 429) return "limit_exceeded";
@@ -1004,11 +2358,14 @@ function retryableHttpStatus(status: number): boolean {
 }
 
 function publicErrorMessage(error: unknown, status: number): string {
+  if (error instanceof ConnectAttemptConflictError)
+    return "Connection setup changed or is still in progress. Reload its current status before retrying.";
+  if (error instanceof ConnectAttemptNotFoundError) return "Connection setup not found.";
   if (status === 502 || status === 503 || status === 504) {
-    return "OpenGeni is temporarily unavailable — retry.";
+    return "Opengeni is temporarily unavailable — retry.";
   }
   if (status >= 500) {
-    return "OpenGeni could not complete the request.";
+    return "Opengeni could not complete the request.";
   }
   if (error instanceof HTTPException) {
     return boundedPublicMessage(error.message) ?? "Request failed.";
@@ -1038,19 +2395,26 @@ type ReadinessChecks = Record<ReadinessCheckName, ReadinessCheck>;
 type ReadinessCheckResult = { ok: boolean; error?: string };
 
 function readinessChecks(deps: AppDependencies): ReadinessChecks {
+  const configuredNatsCheck = deps.readinessChecks?.nats;
   return {
-    db:
-      deps.readinessChecks?.db ??
-      (async () => {
+    db: async () => {
+      if (deps.readinessChecks?.db) {
+        await deps.readinessChecks.db();
+      } else {
         await deps.db.execute(dbSql`select 1`);
-      }),
-    nats:
-      deps.readinessChecks?.nats ??
-      (() => {
+      }
+      await resolveCatalogSettings(deps.db, deps.settings);
+    },
+    nats: async () => {
+      requireSessionEventDurableFanoutCapability(deps.bus);
+      if (configuredNatsCheck) {
+        await configuredNatsCheck();
+      } else {
         if (deps.bus.isConnected && !deps.bus.isConnected()) {
           throw new Error("NATS is not connected");
         }
-      }),
+      }
+    },
     temporal:
       deps.readinessChecks?.temporal ??
       deps.workflowClient.check ??
@@ -1115,8 +2479,37 @@ const routeLabelPatterns: Array<{
   pattern: RegExp;
   label: string | ((match: RegExpMatchArray) => string);
 }> = [
+  {
+    pattern: /^\/\.well-known\/oauth-authorization-server$/,
+    label: "/.well-known/oauth-authorization-server",
+  },
+  {
+    pattern:
+      /^\/\.well-known\/oauth-protected-resource\/v1\/workspaces\/[^/]+\/mcp(?:\/(docs|files))?$/,
+    label: (match) =>
+      `/.well-known/oauth-protected-resource/v1/workspaces/:workspaceId/mcp${match[1] ? `/${match[1]}` : ""}`,
+  },
+  {
+    pattern: /^\/oauth\/(register|authorize|token)$/,
+    label: (match) => `/oauth/${match[1]}`,
+  },
   { pattern: /^\/healthz$/, label: "/healthz" },
   { pattern: /^\/readyz$/, label: "/readyz" },
+  // Better Auth answers these behind one `/v1/auth/*` registration, so the
+  // provider endpoints need an explicit closed set to stay distinguishable.
+  {
+    pattern:
+      /^\/v1\/auth\/(sign-up\/email|sign-in\/email|sign-in\/social|sign-out|send-verification-email|verify-email|request-password-reset|reset-password|error|ok)$/,
+    label: (match) => `/v1/auth/${match[1]}`,
+  },
+  { pattern: /^\/v1\/auth\/reset-password\/[^/]+$/, label: "/v1/auth/reset-password/:token" },
+  {
+    pattern: /^\/v1\/auth\/callback\/([^/]+)$/,
+    label: (match) =>
+      match[1] === "google" || match[1] === "github"
+        ? `/v1/auth/callback/${match[1]}`
+        : "/v1/auth/callback/:providerId",
+  },
   { pattern: /^\/traffic-readyz$/, label: "/traffic-readyz" },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/codex\/connect\/start$/,
@@ -1130,6 +2523,22 @@ const routeLabelPatterns: Array<{
     pattern: /^\/v1\/workspaces\/[^/]+\/codex\/status$/,
     label: "/v1/workspaces/:workspaceId/codex/status",
   },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/codex\/source$/,
+    label: "/v1/workspaces/:workspaceId/codex/source",
+  },
+  {
+    pattern: /^\/v1\/organizations\/[^/]+\/codex\/(accounts|settings)$/,
+    label: (match) => `/v1/organizations/:organizationId/codex/${match[1]}`,
+  },
+  {
+    pattern: /^\/v1\/organizations\/[^/]+\/codex\/connect\/(start|poll)$/,
+    label: (match) => `/v1/organizations/:organizationId/codex/connect/${match[1]}`,
+  },
+  {
+    pattern: /^\/v1\/organizations\/[^/]+\/codex\/accounts\/[^/]+(?:\/activate)?$/,
+    label: "/v1/organizations/:organizationId/codex/accounts/:accountId",
+  },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/supergrok\/connect\/(start|poll)$/,
     label: (match) => `/v1/workspaces/:workspaceId/supergrok/connect/${match[1]}`,
@@ -1156,6 +2565,8 @@ const routeLabelPatterns: Array<{
   },
   { pattern: /^\/metrics$/, label: "/metrics" },
   { pattern: /^\/v1\/config\/client$/, label: "/v1/config/client" },
+  { pattern: /^\/v1\/client-errors$/, label: "/v1/client-errors" },
+  { pattern: /^\/v1\/analytics-consent$/, label: "/v1/analytics-consent" },
   { pattern: /^\/v1\/billing$/, label: "/v1/billing" },
   { pattern: /^\/v1\/billing\/checkout$/, label: "/v1/billing/checkout" },
   { pattern: /^\/v1\/billing\/usage$/, label: "/v1/billing/usage" },
@@ -1163,11 +2574,31 @@ const routeLabelPatterns: Array<{
     pattern: /^\/v1\/workspaces\/[^/]+\/insights$/,
     label: "/v1/workspaces/:workspaceId/insights",
   },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/insights\/usage$/,
+    label: "/v1/workspaces/:workspaceId/insights/usage",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/insights\/calls$/,
+    label: "/v1/workspaces/:workspaceId/insights/calls",
+  },
+  {
+    pattern: /^\/v1\/organizations\/[^/]+\/insights\/usage$/,
+    label: "/v1/organizations/:accountId/insights/usage",
+  },
+  {
+    pattern: /^\/v1\/organizations\/[^/]+\/insights\/calls$/,
+    label: "/v1/organizations/:accountId/insights/calls",
+  },
   {
     pattern: /^\/v1\/billing\/entitlements$/,
     label: "/v1/billing/entitlements",
   },
   { pattern: /^\/v1\/webhooks\/stripe$/, label: "/v1/webhooks/stripe" },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/pr-review\/(registrations|repositories)(?:\/[^/]+)?$/,
+    label: (match) => `/v1/workspaces/:workspaceId/pr-review/${match[1]}`,
+  },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/mcp$/,
     label: "/v1/workspaces/:workspaceId/mcp",
@@ -1180,6 +2611,22 @@ const routeLabelPatterns: Array<{
     pattern: /^\/v1\/workspaces\/[^/]+\/mcp\/files$/,
     label: "/v1/workspaces/:workspaceId/mcp/files",
   },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/tools\/catalog$/,
+    label: "/v1/workspaces/:workspaceId/tools/catalog",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/tools\/calls$/,
+    label: "/v1/workspaces/:workspaceId/tools/calls",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/tools\/approvals$/,
+    label: "/v1/workspaces/:workspaceId/tools/approvals",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/tools\/declarations$/,
+    label: "/v1/workspaces/:workspaceId/tools/declarations",
+  },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/default-rig$/,
     label: "/v1/workspaces/:workspaceId/default-rig",
@@ -1188,6 +2635,18 @@ const routeLabelPatterns: Array<{
     pattern: /^\/v1\/workspaces\/[^/]+\/sessions$/,
     label: "/v1/workspaces/:workspaceId/sessions",
   },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/session-imports$/,
+    label: "/v1/workspaces/:workspaceId/session-imports",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/session-imports\/[^/]+\/events$/,
+    label: "/v1/workspaces/:workspaceId/session-imports/:importId/events",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/session-message-search$/,
+    label: "/v1/workspaces/:workspaceId/session-message-search",
+  },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/control-events\/stream$/,
     label: "/v1/workspaces/:workspaceId/control-events/stream",
@@ -1285,6 +2744,11 @@ const routeLabelPatterns: Array<{
     label:
       "/v1/workspaces/:workspaceId/computer-sessions/:computerSessionId/targets/:targetId/observation",
   },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/computer-sessions\/[^/]+\/targets\/[^/]+\/screenshot$/,
+    label:
+      "/v1/workspaces/:workspaceId/computer-sessions/:computerSessionId/targets/:targetId/screenshot",
+  },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/computer-sessions\/[^/]+\/operations\/[^/]+$/,
     label:
@@ -1348,6 +2812,10 @@ const routeLabelPatterns: Array<{
     pattern: /^\/v1\/workspaces\/[^/]+\/inference-control$/,
     label: "/v1/workspaces/:workspaceId/inference-control",
   },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/pause-timer$/,
+    label: "/v1/workspaces/:workspaceId/pause-timer",
+  },
   {
     pattern:
       /^\/v1\/workspaces\/[^/]+\/sessions\/[^/]+\/fs\/(list|list-batch|read|write|delete|move|mkdir)$/,
@@ -1369,6 +2837,10 @@ const routeLabelPatterns: Array<{
     pattern: /^\/v1\/workspaces\/[^/]+\/sessions\/[^/]+\/events\/stream$/,
     label: "/v1/workspaces/:workspaceId/sessions/:id/events/stream",
   },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/sessions\/[^/]+\/(visibility|forks)$/,
+    label: (match) => `/v1/workspaces/:workspaceId/sessions/:id/${match[1]}`,
+  },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/sessions\/[^/]+\/lineage$/,
     label: "/v1/workspaces/:workspaceId/sessions/:id/lineage",
@@ -1377,6 +2849,10 @@ const routeLabelPatterns: Array<{
     pattern: /^\/v1\/workspaces\/[^/]+\/sessions\/[^/]+\/events$/,
     label: "/v1/workspaces/:workspaceId/sessions/:id/events",
   },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/sessions\/[^/]+\/turns$/,
+    label: "/v1/workspaces/:workspaceId/sessions/:id/turns",
+  },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/sessions\/[^/]+\/queue\/[^/]+\/(move|edit|steer|delete)$/,
     label: "/v1/workspaces/:workspaceId/sessions/:id/queue/:turnId/:action",
@@ -1385,6 +2861,10 @@ const routeLabelPatterns: Array<{
     pattern: /^\/v1\/workspaces\/[^/]+\/sessions\/[^/]+\/queue$/,
     label: "/v1/workspaces/:workspaceId/sessions/:id/queue",
   },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/sessions\/[^/]+\/composer-draft\/submit$/,
+    label: "/v1/workspaces/:workspaceId/sessions/:id/composer-draft/submit",
+  },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/sessions\/[^/]+\/composer-draft$/,
     label: "/v1/workspaces/:workspaceId/sessions/:id/composer-draft",
@@ -1449,6 +2929,84 @@ const routeLabelPatterns: Array<{
     pattern: /^\/v1\/workspaces\/[^/]+\/api-keys\/[^/]+$/,
     label: "/v1/workspaces/:workspaceId/api-keys/:id",
   },
+  {
+    pattern: /^\/v1\/organizations\/[^/]+\/api-keys$/,
+    label: "/v1/organizations/:organizationId/api-keys",
+  },
+  {
+    pattern: /^\/v1\/organizations\/[^/]+\/api-keys\/[^/]+$/,
+    label: "/v1/organizations/:organizationId/api-keys/:id",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/external$/,
+    label: "/v1/workspaces/external",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/external\/[^/]+\/[^/]+\/session-imports$/,
+    label: "/v1/workspaces/external/:source/:externalId/session-imports",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/external\/[^/]+\/[^/]+\/session-imports\/[^/]+\/events$/,
+    label: "/v1/workspaces/external/:source/:externalId/session-imports/:importId/events",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/external\/[^/]+\/[^/]+\/allowance\/grants$/,
+    label: "/v1/workspaces/external/:source/:externalId/allowance/grants",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/external\/[^/]+\/[^/]+\/allowance$/,
+    label: "/v1/workspaces/external/:source/:externalId/allowance",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/external\/[^/]+\/[^/]+\/allowance\/state$/,
+    label: "/v1/workspaces/external/:source/:externalId/allowance/state",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/external\/[^/]+\/[^/]+\/usage\/me$/,
+    label: "/v1/workspaces/external/:source/:externalId/usage/me",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/external\/[^/]+\/[^/]+\/usage$/,
+    label: "/v1/workspaces/external/:source/:externalId/usage",
+  },
+  {
+    pattern:
+      /^\/v1\/workspaces\/external\/[^/]+\/[^/]+\/members\/external\/[^/]+\/[^/]+\/allowance$/,
+    label:
+      "/v1/workspaces/external/:source/:externalId/members/external/:memberSource/:memberExternalId/allowance",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/external\/[^/]+\/[^/]+\/members\/[^/]+\/allowance$/,
+    label: "/v1/workspaces/external/:source/:externalId/members/:subjectId/allowance",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/allowance\/grants$/,
+    label: "/v1/workspaces/:workspaceId/allowance/grants",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/allowance$/,
+    label: "/v1/workspaces/:workspaceId/allowance",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/allowance\/state$/,
+    label: "/v1/workspaces/:workspaceId/allowance/state",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/usage\/me$/,
+    label: "/v1/workspaces/:workspaceId/usage/me",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/usage$/,
+    label: "/v1/workspaces/:workspaceId/usage",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/members\/external\/[^/]+\/[^/]+\/allowance$/,
+    label: "/v1/workspaces/:workspaceId/members/external/:source/:externalId/allowance",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/members\/[^/]+\/allowance$/,
+    label: "/v1/workspaces/:workspaceId/members/:subjectId/allowance",
+  },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/scheduled-tasks$/,
     label: "/v1/workspaces/:workspaceId/scheduled-tasks",
@@ -1513,6 +3071,10 @@ const routeLabelPatterns: Array<{
     pattern: /^\/v1\/workspaces\/[^/]+\/github\/app$/,
     label: "/v1/workspaces/:workspaceId/github/app",
   },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/github\/action-policies$/,
+    label: "/v1/workspaces/:workspaceId/github/action-policies",
+  },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/github\/repositories$/,
     label: "/v1/workspaces/:workspaceId/github/repositories",
@@ -1545,6 +3107,22 @@ const routeLabelPatterns: Array<{
     pattern: /^\/v1\/workspaces\/[^/]+\/github\/app-manifest$/,
     label: "/v1/workspaces/:workspaceId/github/app-manifest",
   },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/pr-review\/github$/,
+    label: "/v1/workspaces/:workspaceId/pr-review/github",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/pr-review\/github\/connect$/,
+    label: "/v1/workspaces/:workspaceId/pr-review/github/connect",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/pr-review\/github\/installations\/select$/,
+    label: "/v1/workspaces/:workspaceId/pr-review/github/installations/select",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/pr-review\/github\/installations\/[^/]+\/configure$/,
+    label: "/v1/workspaces/:workspaceId/pr-review/github/installations/:installationId/configure",
+  },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/capabilities$/,
     label: "/v1/workspaces/:workspaceId/capabilities",
@@ -1647,26 +3225,7 @@ const routeLabelPatterns: Array<{
     pattern: /^\/v1\/workspaces\/[^/]+\/environments\/[^/]+$/,
     label: "/v1/workspaces/:workspaceId/environments/:id",
   },
-  {
-    pattern: /^\/v1\/workspaces\/[^/]+\/packs$/,
-    label: "/v1/workspaces/:workspaceId/packs",
-  },
-  {
-    pattern: /^\/v1\/workspaces\/[^/]+\/packs\/installations$/,
-    label: "/v1/workspaces/:workspaceId/packs/installations",
-  },
-  {
-    pattern: /^\/v1\/workspaces\/[^/]+\/packs\/marketing-social-daily-analysis\/scheduled-tasks$/,
-    label: "/v1/workspaces/:workspaceId/packs/marketing-social-daily-analysis/scheduled-tasks",
-  },
-  {
-    pattern: /^\/v1\/workspaces\/[^/]+\/packs\/[^/]+\/enable$/,
-    label: "/v1/workspaces/:workspaceId/packs/:id/enable",
-  },
-  {
-    pattern: /^\/v1\/workspaces\/[^/]+\/packs\/[^/]+$/,
-    label: "/v1/workspaces/:workspaceId/packs/:id",
-  },
+
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/plugins\/preview$/,
     label: "/v1/workspaces/:workspaceId/plugins/preview",
@@ -1703,6 +3262,26 @@ const routeLabelPatterns: Array<{
     pattern: /^\/v1\/workspaces\/[^/]+\/connections\/oauth\/start$/,
     label: "/v1/workspaces/:workspaceId/connections/oauth/start",
   },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/connections\/github$/,
+    label: "/v1/workspaces/:workspaceId/connections/github",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/connections\/github\/oauth\/start$/,
+    label: "/v1/workspaces/:workspaceId/connections/github/oauth/start",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/connections\/[^/]+\/github\/reconnect$/,
+    label: "/v1/workspaces/:workspaceId/connections/:connectionId/github/reconnect",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/connections\/[^/]+\/github\/repositories\/verify$/,
+    label: "/v1/workspaces/:workspaceId/connections/:connectionId/github/repositories/verify",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/connections\/[^/]+\/github\/repositories$/,
+    label: "/v1/workspaces/:workspaceId/connections/:connectionId/github/repositories",
+  },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/integrations\/oauth\/start$/,
     label: "/v1/workspaces/:workspaceId/integrations/oauth/start",
@@ -1727,6 +3306,18 @@ const routeLabelPatterns: Array<{
     pattern: /^\/v1\/workspaces\/[^/]+\/connections\/[^/]+$/,
     label: "/v1/workspaces/:workspaceId/connections/:connectionId",
   },
+  {
+    pattern: /^\/v1\/git\/personal\/[^/]+\/info\/refs$/,
+    label: "/v1/git/personal/:routeId/info/refs",
+  },
+  {
+    pattern: /^\/v1\/git\/personal\/[^/]+\/git-upload-pack$/,
+    label: "/v1/git/personal/:routeId/git-upload-pack",
+  },
+  {
+    pattern: /^\/v1\/git\/personal\/[^/]+\/git-receive-pack$/,
+    label: "/v1/git/personal/:routeId/git-receive-pack",
+  },
   { pattern: /^\/v1\/catalog-assets\/.+$/, label: "/v1/catalog-assets/*" },
   {
     pattern: /^\/v1\/integrations\/oauth\/callback$/,
@@ -1736,6 +3327,10 @@ const routeLabelPatterns: Array<{
     pattern: /^\/v1\/integrations\/provider-oauth\/callback$/,
     label: "/v1/integrations/provider-oauth/callback",
   },
+  {
+    pattern: /^\/v1\/integrations\/github-personal\/oauth\/callback$/,
+    label: "/v1/integrations/github-personal/oauth/callback",
+  },
   {
     pattern: /^\/v1\/integrations\/google-drive\/callback$/,
     label: "/v1/integrations/google-drive/callback",
@@ -1776,6 +3371,14 @@ const routeLabelPatterns: Array<{
     pattern: /^\/v1\/workspaces\/[^/]+\/machines\/[^/]+\/metrics\/series$/,
     label: "/v1/workspaces/:workspaceId/machines/:enrollmentId/metrics/series",
   },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/machines\/[^/]+\/operation-policy$/,
+    label: "/v1/workspaces/:workspaceId/machines/:enrollmentId/operation-policy",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/machines\/[^/]+\/update$/,
+    label: "/v1/workspaces/:workspaceId/machines/:enrollmentId/update",
+  },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/machines$/,
     label: "/v1/workspaces/:workspaceId/machines",
@@ -1793,18 +3396,105 @@ const routeLabelPatterns: Array<{
     pattern: /^\/v1\/github\/oauth\/callback$/,
     label: "/v1/github/oauth/callback",
   },
+  { pattern: /^\/v1\/pr-review\/github\/setup$/, label: "/v1/pr-review/github/setup" },
+  {
+    pattern: /^\/v1\/pr-review\/github\/install\/callback$/,
+    label: "/v1/pr-review/github/install/callback",
+  },
+  {
+    pattern: /^\/v1\/pr-review\/github\/oauth\/callback$/,
+    label: "/v1/pr-review/github/oauth/callback",
+  },
+  {
+    pattern: /^\/v1\/webhooks\/pr-review\/github$/,
+    label: "/v1/webhooks/pr-review/github",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+$/,
+    label: "/v1/workspaces/:workspaceId",
+  },
 ];
 
-export function routeLabel(pathname: string): string {
+/**
+ * Bounded route label for metrics, spans, and request logs. Explicit patterns
+ * keep established label spellings stable; any other request answered by a
+ * registered handler uses that handler's code-owned path template (see
+ * `registeredHandlerRoutePath`). Only unregistered paths fall into `unknown`.
+ */
+export function routeLabel(pathname: string, registeredRoutePath?: string | null): string {
+  if (/^\/v1\/workspaces\/[^/]+\/transcriptions$/.test(pathname))
+    return "/v1/workspaces/:workspaceId/transcriptions";
+  const transcription = pathname.match(
+    /^\/v1\/workspaces\/[^/]+\/transcription-recordings(?:\/[^/]+(\/(?:finalize|process-next)|\/chunks\/\d+)?)?$/,
+  );
+  if (transcription) {
+    const base = "/v1/workspaces/:workspaceId/transcription-recordings";
+    if (pathname.split("/").length === 5) return base;
+    return (
+      base +
+      "/:recordingId" +
+      (transcription[1]?.startsWith("/chunks/") ? "/chunks/:chunkNumber" : (transcription[1] ?? ""))
+    );
+  }
   for (const candidate of routeLabelPatterns) {
     const match = pathname.match(candidate.pattern);
     if (match) {
       return typeof candidate.label === "string" ? candidate.label : candidate.label(match);
     }
   }
+  const registered = boundedRegisteredRouteLabel(registeredRoutePath);
+  if (registered) return registered;
   return pathname.startsWith("/v1/") ? "/v1/unknown" : "/unknown";
 }
 
+/**
+ * API contract revisions no longer admitted from ANY caller, including bearer
+ * integrations that would otherwise be accepted across revisions. Add a
+ * revision here only for a truly breaking wire change (which also requires a
+ * major release-train change); ordinary revision bumps stay additive.
+ */
+export const REFUSED_API_CONTRACT_REVISIONS: ReadonlySet<string> = new Set<string>([]);
+
+const BEARER_AUTHORIZATION = /^bearer\s+\S/i;
+
+/**
+ * The rollout fence for state-changing product calls.
+ *
+ * The exact-revision check exists to stop a stale first-party browser tab
+ * (cookie session, or unauthenticated local mode) from writing with an old
+ * request shape after a deployment; it answers 409 so the page reloads onto
+ * the matching bundle. That tab never sends `Authorization`, so this is not a
+ * header a stale bundle can choose to bypass it with.
+ *
+ * Bearer-authenticated callers (organization/workspace API keys, delegated
+ * tokens, the deployment key sent as a bearer) are integrations pinned to an
+ * SDK version: reloading cannot upgrade them, and the API is additive within a
+ * major release train. They are admitted with an older revision or with no
+ * revision claim at all. Only a revision listed in
+ * `REFUSED_API_CONTRACT_REVISIONS` is refused for them.
+ *
+ * This is a compatibility fence, not an authorization boundary: every route
+ * still authenticates and authorizes the request independently.
+ */
+export function apiContractAdmission(
+  input: {
+    method: string;
+    pathname: string;
+    authorization: string | undefined;
+    claimedRevision: string | undefined;
+  },
+  refusedRevisions: ReadonlySet<string> = REFUSED_API_CONTRACT_REVISIONS,
+): "admit" | "reject" {
+  if (!isApiContractProtectedMutation(input.method, input.pathname)) return "admit";
+  if (input.claimedRevision === OPENGENI_API_CONTRACT_REVISION) return "admit";
+  if (input.claimedRevision !== undefined && refusedRevisions.has(input.claimedRevision)) {
+    return "reject";
+  }
+  return input.authorization !== undefined && BEARER_AUTHORIZATION.test(input.authorization)
+    ? "admit"
+    : "reject";
+}
+
 /**
  * State-changing OpenGeni HTTP calls must never cross an incompatible rollout
  * boundary. Standard third-party protocols and externally initiated callbacks
@@ -1817,19 +3507,47 @@ export function isApiContractProtectedMutation(method: string, pathname: string)
   if (!pathname.startsWith("/v1/")) {
     return false;
   }
+  if (
+    pathname === "/v1/auth/organization-onboarding" ||
+    pathname === "/v1/auth/organization-setup"
+  ) {
+    return true;
+  }
   if (
     pathname.startsWith("/v1/auth/") ||
     pathname.startsWith("/v1/webhooks/") ||
     pathname.startsWith("/v1/integrations/oauth/") ||
+    isPersonalGitHubGitBrokerRequest(method, pathname) ||
     pathname === "/v1/integrations/slack/events" ||
     pathname === "/v1/integrations/slack/commands" ||
     pathname === "/v1/integrations/slack/interactions" ||
     pathname.startsWith("/v1/github/") ||
+    // A stale tab must still report the error that follows a rollout.
+    pathname === CLIENT_ERRORS_PATH ||
+    pathname === ANALYTICS_CONSENT_PATH ||
     pathname === "/v1/enrollments/device/start" ||
     pathname === "/v1/enrollments/device/poll" ||
-    pathname === "/v1/enrollments/token/exchange"
+    pathname === "/v1/enrollments/token/exchange" ||
+    // The runner authenticates this protocol with its install-key proof, not
+    // a browser cookie or the product-client revision header.
+    pathname === "/v1/enrollments/renew"
   ) {
     return false;
   }
-  return !pathname.split("/").includes("mcp");
+  const segments = pathname.split("/");
+  return !segments.includes("mcp") && !segments.includes("codemode");
+}
+
+/** Client-safe agent-configuration projection. */
+function clientAgentConfig(settings: Settings): ClientAgentConfig {
+  const policy = agentConfigDeploymentPolicy(settings);
+  return {
+    // Deprecated: agent configuration is always on. Kept for client compatibility.
+    enabled: true,
+    defaultForNewSessions: true,
+    capabilities: AGENT_CAPABILITY_IDS.map((id) => {
+      const reason = policy.unavailable[id];
+      return reason === undefined ? { id, available: true } : { id, available: false, reason };
+    }),
+  };
 }