@opengeni/api-router 2.1.0-canary.0 → 2.3.2-canary.0

package/src/integrations/slack-routing.ts

@@ -175,11 +175,24 @@ function labelFor(
  * override beats configuration beats derivation beats asking.
  */
 export function resolveSlackWorkspaceRoute(input: SlackRouteInputs): SlackRouteResolution {
+  // A personal workspace is only ever a destination for that person's own bot
+  // DM. Offering it in a channel would be wrong twice over: routing a shared
+  // conversation into one member's private space hides it from everyone else
+  // in the channel, and - because managed tenancy provisions a personal
+  // workspace for every member - counting it as a candidate means nobody ever
+  // has exactly one. That defeats the sole-candidate rule below, so an
+  // organization with a single shared workspace would be asked to choose in
+  // every channel despite having no choice to make.
+  const directMessage = isSlackDirectMessageConversation(input.entry);
+  const candidates = directMessage
+    ? input.candidates
+    : input.candidates.filter((candidate) => !candidate.personal);
+
   const installation = {
     kind: "resolved" as const,
     accountId: input.home.accountId,
     workspaceId: input.home.workspaceId,
-    label: labelFor(input.candidates, input.home.workspaceId),
+    label: labelFor(candidates, input.home.workspaceId),
     source: "installation" as const,
   };
 
@@ -206,7 +219,7 @@ export function resolveSlackWorkspaceRoute(input: SlackRouteInputs): SlackRouteR
       kind: "resolved",
       accountId: input.threadTenancy.accountId,
       workspaceId: input.threadTenancy.workspaceId,
-      label: labelFor(input.candidates, input.threadTenancy.workspaceId),
+      label: labelFor(candidates, input.threadTenancy.workspaceId),
       source: "thread",
     };
   }
@@ -221,13 +234,13 @@ export function resolveSlackWorkspaceRoute(input: SlackRouteInputs): SlackRouteR
     ? parseSlackWorkspacePrefix(splitSlackLeadingMention(input.entry.text, input.botUserId).rest)
     : null;
   if (prefix) {
-    const named = matchCandidate(input.candidates, prefix.requested);
+    const named = matchCandidate(candidates, prefix.requested);
     if (named === "ambiguous" || !named) {
       return {
         kind: "denied",
         reason: "no_access_to_named",
         requested: prefix.requested,
-        candidates: input.candidates,
+        candidates: candidates,
       };
     }
     return {
@@ -245,7 +258,7 @@ export function resolveSlackWorkspaceRoute(input: SlackRouteInputs): SlackRouteR
       kind: "resolved",
       accountId: input.channelRoute.targetAccountId,
       workspaceId: input.channelRoute.targetWorkspaceId,
-      label: labelFor(input.candidates, input.channelRoute.targetWorkspaceId),
+      label: labelFor(candidates, input.channelRoute.targetWorkspaceId),
       source: "channel",
     };
   }
@@ -254,13 +267,13 @@ export function resolveSlackWorkspaceRoute(input: SlackRouteInputs): SlackRouteR
   //    lands in their own workspace unless they chose otherwise. The personal
   //    workspace id is DERIVED from an active organization membership pointer;
   //    it is never accepted from a Slack payload or a route row.
-  if (isSlackDirectMessageConversation(input.entry)) {
+  if (directMessage) {
     if (input.dmRoute) {
       return {
         kind: "resolved",
         accountId: input.dmRoute.targetAccountId,
         workspaceId: input.dmRoute.targetWorkspaceId,
-        label: labelFor(input.candidates, input.dmRoute.targetWorkspaceId),
+        label: labelFor(candidates, input.dmRoute.targetWorkspaceId),
         source: "dm_route",
       };
     }
@@ -269,7 +282,7 @@ export function resolveSlackWorkspaceRoute(input: SlackRouteInputs): SlackRouteR
         kind: "resolved",
         accountId: input.home.accountId,
         workspaceId: input.personalWorkspaceId,
-        label: labelFor(input.candidates, input.personalWorkspaceId),
+        label: labelFor(candidates, input.personalWorkspaceId),
         source: "dm_personal",
       };
     }
@@ -280,8 +293,8 @@ export function resolveSlackWorkspaceRoute(input: SlackRouteInputs): SlackRouteR
 
   // 5. One workspace is not a choice. This is what keeps the flag quiet for
   //    installs that only ever had one workspace.
-  const sole = input.candidates[0];
-  if (input.candidates.length === 1 && sole) {
+  const sole = candidates[0];
+  if (candidates.length === 1 && sole) {
     return {
       kind: "resolved",
       accountId: sole.accountId,
@@ -291,13 +304,13 @@ export function resolveSlackWorkspaceRoute(input: SlackRouteInputs): SlackRouteR
     };
   }
 
-  if (input.candidates.length === 0) {
+  if (candidates.length === 0) {
     return { kind: "denied", reason: "no_candidates", requested: null, candidates: [] };
   }
 
   // 6. Genuinely ambiguous. Until the picker exists, keep the installation's
   //    workspace rather than inventing an answer.
-  return input.askEnabled ? { kind: "ask", candidates: input.candidates } : installation;
+  return input.askEnabled ? { kind: "ask", candidates: candidates } : installation;
 }
 
 /**

package/src/mcp/company-brain-governed-writes.ts

@@ -125,7 +125,7 @@ export function registerCompanyBrainGovernedWriteTools(
     {
       description:
         "Atomically promote one still-active note from this exact root task tree into an inactive workspace instruction-policy draft. The note bytes remain exact evidence and draft content. " +
-        `Once a human activates the draft, those bytes are composed verbatim into the prompt of every session the target applies to, so a note over ${AGENT_AUTHORED_INSTRUCTION_POLICY_CONTENT_MAX_CHARS} characters is rejected here rather than truncated: write a fresh short imperative note instead of promoting a long working note. ` +
+        `Use this only for a universal always-on rule, never for an incident, fact, decision, outcome, or conditional procedure. Once a human activates the draft, those bytes are composed verbatim into the prompt of every session the target applies to, so a note over ${AGENT_AUTHORED_INSTRUCTION_POLICY_CONTENT_MAX_CHARS} characters is rejected here rather than truncated: write a fresh minimal imperative note instead of promoting a long working note. ` +
         "The frozen learning policy records a decision receipt, but mandatory policy still requires human activation even under Automatic; this never widens scope.",
       inputSchema: {
         ...taskNotePromotion,
@@ -149,7 +149,7 @@ export function registerCompanyBrainGovernedWriteTools(
     "task_note_promote_preference",
     {
       description:
-        "Atomically promote one still-active note from this exact root task tree into a workspace preference proposal. The note bytes remain exact evidence and full proposal content. " +
+        "Atomically promote one still-active note from this exact root task tree into a workspace Skill proposal backed by the structured preference authority. Use this for reusable conditional how-to guidance, never for an incident, fact, decision, outcome, or universal always-on rule. The note bytes remain exact evidence and full proposal content. " +
         `The title and description you supply are what gets composed into every session prompt, so write them as one short imperative statement; the note content is retrieved on demand and a note over ${AGENT_AUTHORED_PREFERENCE_CONTENT_MAX_CHARS} characters is rejected here rather than truncated. ` +
         "Under Suggest the proposal waits for human review; under Automatic an eligible decision is activated through the preference lifecycle and remains undoable. This never widens scope.",
       inputSchema: {
@@ -186,7 +186,7 @@ export function registerCompanyBrainGovernedWriteTools(
     {
       description:
         "Materialize an evidence-backed inactive workspace instruction-policy draft. " +
-        `Once a human activates it, this content is composed verbatim into the prompt of every session the target applies to (every session in this workspace for a global charter or policy, every session bound to the role for a role policy), so keep it under ${AGENT_AUTHORED_INSTRUCTION_POLICY_CONTENT_MAX_CHARS} characters. ${AGENT_AUTHORED_DURABLE_TEXT_STYLE} ` +
+        `Use this only for a minimal universal rule, never for an incident, fact, decision, outcome, or conditional procedure. Once a human activates it, this content is composed verbatim into the prompt of every session the target applies to (every session in this workspace for a global charter or policy, every session bound to the role for a role policy), so keep it under ${AGENT_AUTHORED_INSTRUCTION_POLICY_CONTENT_MAX_CHARS} characters. ${AGENT_AUTHORED_DURABLE_TEXT_STYLE} ` +
         "The frozen learning policy records a decision receipt, but this tool cannot activate mandatory behavior, including when learning mode is Automatic; a human must activate the draft.",
       inputSchema: {
         ...evidence,
@@ -219,7 +219,7 @@ export function registerCompanyBrainGovernedWriteTools(
     "preference_propose",
     {
       description:
-        "Materialize an evidence-backed workspace preference proposal. " +
+        "Materialize an evidence-backed workspace Skill proposal in the structured preference authority. Use this only for reusable conditional how-to guidance, never for an incident, fact, decision, outcome, or universal always-on rule. " +
         `Its short title and description are what get composed into every session prompt; the content is retrieved on demand, so its length is retrieval cost rather than standing prompt cost. Keep the content under ${AGENT_AUTHORED_PREFERENCE_CONTENT_MAX_CHARS} characters. ${AGENT_AUTHORED_DURABLE_TEXT_STYLE} ` +
         "Under Suggest it stays inactive for human review; under Automatic an eligible decision is activated through the governed preference lifecycle with an undoable receipt. It never creates mandatory authority.",
       inputSchema: {

package/src/mcp/company-profile-agent-admin.ts

@@ -1,10 +1,8 @@
 import {
-  AGENT_AUTHORED_COMPANY_PROFILE_CONTENT_MAX_UTF8_BYTES,
   AGENT_AUTHORED_COMPANY_PROFILE_ENTRY_MAX_CHARS,
   AGENT_AUTHORED_COMPANY_PROFILE_SCALAR_MAX_CHARS,
   AGENT_AUTHORED_COMPANY_PROFILE_TOO_LONG_MESSAGE,
   AgentAuthoredCompanyProfileContent,
-  COMPANY_PROFILE_ENTRY_MAX_COUNT,
   COMPANY_PROFILE_REASON_MAX_CHARS,
   COMPANY_PROFILE_STABLE_KEY_MAX_CHARS,
   normalizeCompanyProfileStableKey,
@@ -32,9 +30,9 @@ export type RegisterCompanyProfileAgentAdminToolsInput = {
   router?: Pick<ReturnType<typeof createCompanyProfileAgentAdminRouter>, "propose" | "confirm">;
 };
 
-// Agent-only bounds. The human `account:admin` route keeps the wider
-// `COMPANY_PROFILE_*` limits; this profile is the largest always-on prompt
-// surface in the product, so an agent gets a much smaller budget for it.
+// Agent-only bounds. The human `account:admin` API keeps the wider historical
+// `COMPANY_PROFILE_*` limits; the current agent tool authors only the two
+// always-on identity fields and therefore gets a much smaller budget.
 const scalar = z
   .string()
   .trim()
@@ -55,8 +53,7 @@ const entry = z.object({
       AGENT_AUTHORED_COMPANY_PROFILE_TOO_LONG_MESSAGE,
     ),
 });
-const entries = z.array(entry).max(COMPANY_PROFILE_ENTRY_MAX_COUNT);
-const DEFAULT_PROPOSAL_REASON = "Activate agent-proposed organization company profile";
+const DEFAULT_PROPOSAL_REASON = "Activate agent-proposed organization identity";
 const STABLE_KEY_WORDS = 6;
 
 type EntryInput = z.infer<typeof entry>;
@@ -127,18 +124,14 @@ export function registerCompanyProfileAgentAdminTools(
     "company_profile_propose",
     {
       description:
-        "Prepare one complete organization company profile covering identity, mission, products, customers, strategic goals, and critical constraints. Omitted list keys are derived from content. " +
-        "Once activated, every field here is mandatory prompt context in every session for the whole organization, so write it as a concise profile rather than a document: one plain descriptive statement per field, no numbered procedure and no marketing copy. Longer source material belongs in organization Documents and is retrieved as evidence; never copy it into the profile. " +
-        `Bounds for this tool are ${AGENT_AUTHORED_COMPANY_PROFILE_SCALAR_MAX_CHARS} characters for identity and mission, ${AGENT_AUTHORED_COMPANY_PROFILE_ENTRY_MAX_CHARS} per list entry, ${COMPANY_PROFILE_ENTRY_MAX_COUNT} entries per list, and ${AGENT_AUTHORED_COMPANY_PROFILE_CONTENT_MAX_UTF8_BYTES} UTF-8 bytes for the whole profile. ` +
+        "Prepare the organization's small, stable identity: identity says who the organization is, and mission says why it exists. " +
+        "Once activated, both fields are mandatory prompt context in every root session for the whole organization, so use one plain descriptive statement per field with no products, customers, goals, constraints, procedures, or marketing copy. Those details belong in organization-scoped Documents and are retrieved only when relevant. " +
+        `Each field is bounded to ${AGENT_AUTHORED_COMPANY_PROFILE_SCALAR_MAX_CHARS} characters for agent-authored proposals. ` +
         "This creates only an immutable inactive proposal for the exact live turn initiated by the organization owner and does not use workspace learning policy. The receipt returns the exact `humanInput` payload; call `request_human_input` with it verbatim, then call `company_profile_confirm` with the returned requestId.",
       inputSchema: {
         operationId: z.string().uuid(),
         identity: scalar,
         mission: scalar,
-        products: entries,
-        customers: entries,
-        goals: entries,
-        constraints: entries,
         reason: z.string().trim().min(1).max(COMPANY_PROFILE_REASON_MAX_CHARS).optional(),
       },
     },
@@ -147,10 +140,10 @@ export function registerCompanyProfileAgentAdminTools(
       const parsed = AgentAuthoredCompanyProfileContent.safeParse({
         identity: request.identity,
         mission: request.mission,
-        products: resolveCompanyProfileEntries(request.products),
-        customers: resolveCompanyProfileEntries(request.customers),
-        goals: resolveCompanyProfileEntries(request.goals),
-        constraints: resolveCompanyProfileEntries(request.constraints),
+        products: [],
+        customers: [],
+        goals: [],
+        constraints: [],
       });
       if (!parsed.success) {
         return input.json({

package/src/mcp/remember.ts

@@ -70,9 +70,9 @@ export function registerRememberTools(input: RegisterRememberToolsInput): void {
     "remember",
     {
       description:
-        "Durably remember something the user explicitly asked to keep for this workspace. Use lane=preference for how agents should act, lane=instruction_policy only when the user stated a hard always/never rule, lane=knowledge for a company/product/people fact. " +
-        `Write it short. A lane=instruction_policy rule is composed verbatim into the prompt of every session it applies to (every session in this workspace for a global rule, every session bound to the role for a role rule) for as long as it stays active, so keep it under ${AGENT_AUTHORED_INSTRUCTION_POLICY_CONTENT_MAX_CHARS} characters: one imperative rule in 1-3 sentences, no numbered steps, no examples, no rationale, no restating of defaults. At most three rules compose at once, so this is a standing budget you share. Keep a lane=preference under ${AGENT_AUTHORED_PREFERENCE_CONTENT_MAX_CHARS} characters; there only its short title and description are composed and the content is retrieved on demand, so length is retrieval cost rather than standing prompt cost. Prefer several small entries over one long one, and put procedure in a Document or Skill that the rule references instead of inlining it. ` +
-        "Under Automatic learning a preference activates immediately; otherwise the receipt returns status=confirmation_required with the exact `humanInput` payload: call `request_human_input` with it verbatim, then call `remember_confirm` with the returned requestId. Mandatory rules always need that confirmation. Do not use this for facts you merely inferred; use knowledge_propose or task notes for those. A confirmed lane=knowledge fact enters the human-reviewed Knowledge claim lifecycle; it does not become workspace memory, so do not expect to find it later through `memory_search`.",
+        "Durably remember something the user explicitly asked to keep for this workspace. Route by purpose: lane=knowledge for a fact, decision, incident, bug fix, or outcome that should become searchable Memory; lane=preference creates a Skill for reusable conditional how-to guidance; lane=instruction_policy is only for a universal always/never rule that should apply to nearly every task. " +
+        `Write the instruction lane as the shortest complete rule, at most ${AGENT_AUTHORED_INSTRUCTION_POLICY_CONTENT_MAX_CHARS} characters and normally 1-3 imperative sentences, with no numbered steps, examples, rationale, or restated defaults. Keep a Skill under ${AGENT_AUTHORED_PREFERENCE_CONTENT_MAX_CHARS} characters; only its one-sentence descriptor is composed and the full instructions are retrieved on demand. Do not copy one item into multiple lanes. ` +
+        "Under Automatic learning a Skill may activate immediately; otherwise the receipt returns status=confirmation_required with the exact `humanInput` payload: call `request_human_input` with it verbatim, then call `remember_confirm` with the returned requestId. Workspace instructions and Memory always need that confirmation. Do not use this for facts you merely inferred; use knowledge_propose or task notes for those. Confirmed lane=knowledge content keeps its reviewed claim provenance and materializes its exact approved text into Memory for later `memory_search` retrieval.",
       inputSchema: {
         lane: z.enum(["preference", "instruction_policy", "knowledge"]),
         ...laneFields,
@@ -130,7 +130,7 @@ export function registerRememberTools(input: RegisterRememberToolsInput): void {
     "remember_confirm",
     {
       description:
-        "Complete a `remember` that returned status=confirmation_required after the human answered the bound `request_human_input` question. For preference/instruction_policy pass proposalId and learning.receiptId (as decisionReceiptId) from that receipt; for knowledge pass claimId. Always pass the requestId returned by request_human_input. Activation only succeeds when the exact initiating human answered Save on this turn; otherwise the proposal stays for review.",
+        "Complete a `remember` that returned status=confirmation_required after the human answered the bound `request_human_input` question. For preference/instruction_policy pass proposalId and learning.receiptId (as decisionReceiptId) from that receipt; for knowledge pass claimId. Always pass the requestId returned by request_human_input. Activation only succeeds when the exact initiating human answered Save on this turn; confirmed knowledge is materialized into searchable Memory from the exact approved text.",
       inputSchema: {
         operationId: z.string().uuid(),
         proposalId: z.string().uuid().optional(),

package/src/mcp/server.ts

@@ -38,6 +38,7 @@ import {
   SESSION_GOAL_SUCCESS_CRITERIA_MAX_BYTES,
   SESSION_GOAL_TEXT_MAX_BYTES,
   SESSION_INSTRUCTIONS_MAX_CHARACTERS,
+  MAX_SELECTED_VARIABLE_SETS,
   sessionGoalUtf8Bytes,
   TASK_NOTE_LIST_DEFAULT_LIMIT,
   TASK_NOTE_LIST_MAX_LIMIT,
@@ -755,7 +756,7 @@ export function buildOpenGeniMcpServer(
       "set_session_title",
       {
         description:
-          "Set this session's display title to a concise 3-7 word summary. The title persists across turns: call once on a new untitled session, then only when the topic materially changes. Never call it as routine setup after a continuation, resume, or interruption, or merely to reassert the same title. A human-set title cannot be replaced.",
+          "Set this session's display title to a concise 3-7 word topic label. Use a stable noun phrase about the actual task or subject, never a quote/prefix of a prompt, greeting, request boilerplate, URL, identifier, credential, token, or other sensitive value. Call once on a new session, then only when the topic materially changes. Never call it as routine setup after a continuation, resume, or interruption, or merely to reassert the same title. A human-set title cannot be replaced.",
         inputSchema: { title: z4.string().min(1).max(200) },
       },
       async ({ title }) => {
@@ -3256,7 +3257,7 @@ function registerPreferenceRegistryTools(
     "preference_registry_summary",
     {
       description:
-        "List bounded deterministic descriptors for organization, workspace, and immutable initiating-human preferences frozen to this exact attempt. Full content is omitted; retrieve only a relevant returned handle.",
+        "List bounded deterministic Skill descriptors for organization, workspace, and the immutable initiating human, frozen to this exact attempt. Full Skill instructions are omitted; retrieve only a relevant returned handle.",
       inputSchema: {},
     },
     async () => json(await getOrCreatePreferenceRegistrySnapshot(deps.db, attemptClaims())),
@@ -3266,7 +3267,7 @@ function registerPreferenceRegistryTools(
     "preference_registry_get",
     {
       description:
-        "Retrieve full content for one preference in this exact attempt snapshot. Handles from another account, workspace, human, or attempt are rejected.",
+        "Retrieve the full instructions for one Skill in this exact attempt snapshot. Handles from another account, workspace, human, or attempt are rejected.",
       inputSchema: { retrievalHandle: z4.string().min(1).max(512) },
     },
     async ({ retrievalHandle }) =>
@@ -4295,6 +4296,7 @@ function registerWorkspaceOrchestrationTools(
         tools: z4.array(z4.unknown()).optional(),
         mcpServers: z4.array(z4.unknown()).optional(),
         variableSetId: z4.string().uuid().optional(),
+        variableSetIds: z4.array(z4.string().uuid()).max(MAX_SELECTED_VARIABLE_SETS).optional(),
         environmentId: z4.string().uuid().optional(),
         rigId: z4.string().uuid().optional(),
         model: z4
@@ -4345,6 +4347,26 @@ function registerWorkspaceOrchestrationTools(
           .union([z4.literal("new"), z4.object({ groupId: z4.string().uuid() })])
           .optional(),
       })
+      .superRefine((value, context) => {
+        if (!value.variableSetIds) return;
+        if (new Set(value.variableSetIds).size !== value.variableSetIds.length) {
+          context.addIssue({
+            code: z4.ZodIssueCode.custom,
+            path: ["variableSetIds"],
+            message: "variableSetIds must not contain duplicates",
+          });
+        }
+        const singular = value.variableSetId ?? value.environmentId;
+        if (singular === undefined) return;
+        const expected = value.variableSetIds[value.variableSetIds.length - 1];
+        if (singular !== expected) {
+          context.addIssue({
+            code: z4.ZodIssueCode.custom,
+            path: ["variableSetId"],
+            message: "variableSetId must match the last variableSetIds entry",
+          });
+        }
+      })
       .strict();
     server.registerTool(
       "session_create",
@@ -4355,6 +4377,11 @@ function registerWorkspaceOrchestrationTools(
       },
       async (args) => {
         try {
+          requireVariableSetsUseForMcpAttachments(grant, {
+            variableSetIds: args.variableSetIds,
+            variableSetId: args.variableSetId,
+            environmentId: args.environmentId,
+          });
           if (callerSessionId !== null) {
             await authorizeFirstPartySession(deps, grant, callerSessionId, "session.child.create");
           }
@@ -4744,7 +4771,7 @@ function registerWorkspaceOrchestrationTools(
       "set_other_session_title",
       {
         description:
-          "Set another session's display title to a concise 3-7 word summary. The target session must belong to this workspace. Replaces an existing title unless a human has manually set it.",
+          "Set another session's display title to a concise 3-7 word topic label. Use a stable noun phrase about the actual task or subject, never a quote/prefix of a prompt, greeting, request boilerplate, URL, identifier, credential, token, or other sensitive value. The target session must belong to this workspace. Replaces an existing automatic title unless a human has manually set it.",
         inputSchema: {
           session_id: z4.string().uuid(),
           title: z4.string().min(1).max(200),
@@ -5342,6 +5369,25 @@ function requireVariableSetsUseForMcpAttachment(
   }
 }
 
+function requireVariableSetsUseForMcpAttachments(
+  grant: AccessGrant,
+  selection: {
+    variableSetIds?: string[] | undefined;
+    variableSetId?: string | undefined;
+    environmentId?: string | undefined;
+  },
+): void {
+  const singular = selection.variableSetId ?? selection.environmentId;
+  const variableSetIds = selection.variableSetIds ?? (singular ? [singular] : undefined);
+  if (variableSetIds === undefined) return;
+  if (!hasPermission(grant.permissions, "variable-sets:attach")) {
+    throw new HTTPException(403, { message: "missing permission: variable-sets:attach" });
+  }
+  if (variableSetIds.length > 0 && !hasPermission(grant.permissions, "variable-sets:use")) {
+    throw new HTTPException(403, { message: "missing permission: variable-sets:use" });
+  }
+}
+
 /**
  * Project one allowlisted GitHub App repository into the resource an agent or
  * scheduled task attaches. Every listed repository is in the workspace

package/src/mcp/session-view.ts

@@ -534,6 +534,11 @@ export function boundSessionDetailMcp(
   effectiveControl: unknown = session.effectiveControl,
   maxBytes = SESSION_DETAIL_MCP_MAX_BYTES,
 ) {
+  const variableSetIds = session.variableSetIds;
+  // The plural selection is authoritative. Keep the singular/environment
+  // fields only as final-entry compatibility aliases so they cannot be read as
+  // complete attachment membership by newer consumers.
+  const variableSetId = variableSetIds.at(-1) ?? null;
   const title = session.title === null ? null : modelStringProjection(session.title, 512);
   const initialMessage = modelStringProjection(session.initialMessage, 4_000);
   const instructions =
@@ -592,8 +597,9 @@ export function boundSessionDetailMcp(
     sandboxGroupId: session.sandboxGroupId,
     activeSandboxId: session.activeSandboxId,
     activeEpoch: session.activeEpoch,
-    variableSetId: session.variableSetId,
-    environmentId: session.environmentId,
+    variableSetIds,
+    variableSetId,
+    environmentId: variableSetId,
     rigId: session.rigId,
     rigVersionId: session.rigVersionId,
     firstPartyMcpPermissions: permissions.value,

package/src/routes/automations.ts

@@ -278,7 +278,7 @@ export function registerAutomationRoutes(app: Hono, deps: ApiRouteDeps): void {
     });
     const bytes = new TextEncoder().encode(stableJson(request));
     return c.json(
-      await acceptEvent(deps, source, {
+      await acceptAutomationEvent(deps, source, {
         deliveryKey:
           request.deliveryId ?? `manual:${automationRequestDigest(source.adapterId, bytes)}`,
         requestDigest: automationRequestDigest(source.adapterId, bytes),
@@ -335,7 +335,7 @@ export function registerAutomationRoutes(app: Hono, deps: ApiRouteDeps): void {
     }
     const requestDigest = automationRequestDigest(source.adapterId, rawBody);
     try {
-      const result = await acceptEvent(deps, source, {
+      const result = await acceptAutomationEvent(deps, source, {
         deliveryKey: adapter.deliveryKey({
           headers: c.req.raw.headers,
           requestDigest,
@@ -357,7 +357,7 @@ export function registerAutomationRoutes(app: Hono, deps: ApiRouteDeps): void {
   });
 }
 
-async function acceptEvent(
+export async function acceptAutomationEvent(
   deps: ApiRouteDeps,
   source: AutomationSourceSecret,
   input: {

package/src/routes/documents.ts

@@ -7,6 +7,8 @@ import {
   DocumentAuthorityReclassification,
   DocumentBase,
   DocumentDefaultCollectionBackfill,
+  DocumentDefaultCollectionBackfillAudit,
+  GetDocumentDefaultCollectionBackfillAuditQuery,
   DocumentSearchRequest,
   DocumentSearchResponse,
   FileAsset,
@@ -15,6 +17,9 @@ import {
   KnowledgeMemorySearchRequest,
   ListDocumentAuthorityReclassificationsQuery,
   ListDocumentAuthorityReclassificationsResponse,
+  ListDocumentDefaultCollectionBackfillRunsResponse,
+  ListDocumentMigrationAuditQuery,
+  ListOrganizationDocumentAuthorityReclassificationsResponse,
   MoveDocumentRequest,
   ReclassifyDocumentAuthorityRequest,
   RunDocumentDefaultCollectionBackfillRequest,
@@ -40,10 +45,13 @@ import {
   getDocument,
   getDocumentOriginalFile,
   getDocumentBase,
+  getDocumentDefaultCollectionBackfillAudit,
   listAccessibleDocuments,
   listDocumentAuthorityReclassifications,
+  listDocumentDefaultCollectionBackfillRuns,
   listDocumentBasesEnsuringDefault,
   listDocuments,
+  listOrganizationDocumentAuthorityReclassifications,
   moveDocumentToBase,
   queueDocumentForReindex,
   reclassifyDocumentAuthority,
@@ -132,6 +140,106 @@ export function registerDocumentRoutes(app: Hono, deps: ApiRouteDeps): void {
     }
   });
 
+  app.get("/v1/workspaces/:workspaceId/document-default-collection-backfills", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const authorization = await requireAccessGrantAuthorization(
+      c,
+      deps,
+      workspaceId,
+      "documents:manage",
+    );
+    if (!hasAccountAdminAuthority(authorization)) {
+      throw new HTTPException(403, { message: "missing permission: account:admin" });
+    }
+    const query = ListDocumentMigrationAuditQuery.safeParse(c.req.query());
+    if (!query.success) {
+      throw new HTTPException(400, { message: "invalid document migration audit query" });
+    }
+    try {
+      return c.json(
+        ListDocumentDefaultCollectionBackfillRunsResponse.parse(
+          await listDocumentDefaultCollectionBackfillRuns(db, {
+            accountId: authorization.grant.accountId,
+            workspaceId,
+            actorSubjectId: authorization.grant.subjectId,
+            accountAdminAuthorization: requireAccountAdminAuthorizationStamp(authorization),
+            ...query.data,
+          }),
+        ),
+      );
+    } catch (error) {
+      throw documentHttpException(error);
+    }
+  });
+
+  app.get("/v1/workspaces/:workspaceId/document-default-collection-backfills/:runId", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const authorization = await requireAccessGrantAuthorization(
+      c,
+      deps,
+      workspaceId,
+      "documents:manage",
+    );
+    if (!hasAccountAdminAuthority(authorization)) {
+      throw new HTTPException(403, { message: "missing permission: account:admin" });
+    }
+    const runId = RunDocumentDefaultCollectionBackfillRequest.shape.runId.safeParse(
+      c.req.param("runId"),
+    );
+    const query = GetDocumentDefaultCollectionBackfillAuditQuery.safeParse(c.req.query());
+    if (!runId.success || !query.success) {
+      throw new HTTPException(400, { message: "invalid document migration audit query" });
+    }
+    try {
+      return c.json(
+        DocumentDefaultCollectionBackfillAudit.parse(
+          await getDocumentDefaultCollectionBackfillAudit(db, {
+            accountId: authorization.grant.accountId,
+            workspaceId,
+            actorSubjectId: authorization.grant.subjectId,
+            accountAdminAuthorization: requireAccountAdminAuthorizationStamp(authorization),
+            runId: runId.data,
+            ...query.data,
+          }),
+        ),
+      );
+    } catch (error) {
+      throw documentHttpException(error);
+    }
+  });
+
+  app.get("/v1/workspaces/:workspaceId/document-authority-reclassifications", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const authorization = await requireAccessGrantAuthorization(
+      c,
+      deps,
+      workspaceId,
+      "documents:manage",
+    );
+    if (!hasAccountAdminAuthority(authorization)) {
+      throw new HTTPException(403, { message: "missing permission: account:admin" });
+    }
+    const query = ListDocumentMigrationAuditQuery.safeParse(c.req.query());
+    if (!query.success) {
+      throw new HTTPException(400, { message: "invalid document migration audit query" });
+    }
+    try {
+      return c.json(
+        ListOrganizationDocumentAuthorityReclassificationsResponse.parse(
+          await listOrganizationDocumentAuthorityReclassifications(db, {
+            accountId: authorization.grant.accountId,
+            workspaceId,
+            actorSubjectId: authorization.grant.subjectId,
+            accountAdminAuthorization: requireAccountAdminAuthorizationStamp(authorization),
+            ...query.data,
+          }),
+        ),
+      );
+    } catch (error) {
+      throw documentHttpException(error);
+    }
+  });
+
   app.post("/v1/workspaces/:workspaceId/document-bases/:baseId/documents", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const access = await requireAccessGrantAuthorization(c, deps, workspaceId, "documents:manage");
@@ -486,6 +594,7 @@ export function registerDocumentRoutes(app: Hono, deps: ApiRouteDeps): void {
             limit: payload.limit,
             mode: payload.mode,
             sourceKinds: payload.sourceKinds,
+            authorityKinds: payload.authorityKinds,
             aclTags: payload.aclTags,
             initiatingSubjectId: grant.subjectId,
             surface: "human",
@@ -512,6 +621,7 @@ export function registerDocumentRoutes(app: Hono, deps: ApiRouteDeps): void {
             limit: payload.limit,
             mode: payload.mode,
             sourceKinds: payload.sourceKinds,
+            authorityKinds: payload.authorityKinds,
             aclTags: payload.aclTags,
             initiatingSubjectId: grant.subjectId,
             surface: "human",
@@ -879,13 +989,16 @@ function dropFilename(preferred: string | undefined): string {
 }
 
 function documentHttpException(error: unknown): HTTPException {
-  const message = error instanceof Error ? error.message : String(error);
+  const message = documentDomainErrorMessage(error);
   if (message.includes("organization document") && message.includes("exact account authority")) {
     return new HTTPException(403, { message: "missing permission: account:admin" });
   }
   if (message.includes("not found")) {
     return new HTTPException(404, { message });
   }
+  if (message.includes("document Default collection backfill audit run is unavailable")) {
+    return new HTTPException(404, { message });
+  }
   if (message.includes("already exists")) {
     return new HTTPException(409, { message });
   }
@@ -898,7 +1011,9 @@ function documentHttpException(error: unknown): HTTPException {
   }
   if (
     message.includes("reclassification requires") ||
-    message.includes("backfill requires organization administration")
+    message.includes("backfill requires organization administration") ||
+    message.includes("document migration audit requires organization administration") ||
+    message.includes("document migration audit scope is invalid")
   ) {
     return new HTTPException(403, { message });
   }
@@ -906,7 +1021,12 @@ function documentHttpException(error: unknown): HTTPException {
     message.includes("reclassification input is invalid") ||
     message.includes("reclassification authority is invalid") ||
     message.includes("invalid document authority receipt cursor") ||
-    message.includes("document authority receipt limit")
+    message.includes("document authority receipt limit") ||
+    message.includes("invalid document migration audit cursor") ||
+    message.includes("document migration audit cursor is invalid") ||
+    message.includes("document migration audit limit") ||
+    message.includes("document migration audit authority is incomplete") ||
+    message.includes("document Default collection backfill audit run id is required")
   ) {
     return new HTTPException(400, { message });
   }
@@ -929,6 +1049,19 @@ function documentHttpException(error: unknown): HTTPException {
   return new HTTPException(500, { message });
 }
 
+function documentDomainErrorMessage(error: unknown): string {
+  let current: unknown = error;
+  let message = error instanceof Error ? error.message : String(error);
+  const seen = new Set<unknown>();
+  while (current && typeof current === "object" && !seen.has(current) && seen.size < 8) {
+    seen.add(current);
+    const record = current as { cause?: unknown; message?: unknown };
+    if (typeof record.message === "string") message = record.message;
+    current = record.cause;
+  }
+  return message;
+}
+
 function hasAccountAdminAuthority(
   authorization: Awaited<ReturnType<typeof requireAccessGrantAuthorization>>,
 ): boolean {