@opengeni/api-router 2.6.4 → 2.8.1-canary.0

package/src/integrations/personal-github-repositories.ts

@@ -8,11 +8,17 @@ import {
   type PersonalGitHubRepository as PersonalGitHubRepositoryContract,
   type PersonalGitHubRepositorySelectionInput,
 } from "@opengeni/contracts/personal-github";
+import {
+  GitHubRepositoryBranchesResponse,
+  type GitHubRepositoryBranchesResponse as GitHubRepositoryBranchesResponseContract,
+  type ListGitHubRepositoryBranchesQuery,
+} from "@opengeni/contracts/github-repository-contracts";
 import type { ApiRouteDeps } from "@opengeni/core";
 import {
   buildConnectionTokenResolver,
   getConnectionMetadata,
   getPersonalGitHubRepositorySelectionState,
+  type PersonalGitHubRepositorySelectionState as DbPersonalGitHubRepositorySelectionState,
 } from "@opengeni/db";
 import { readResponseTextBounded } from "@opengeni/network";
 import { HTTPException } from "hono/http-exception";
@@ -21,6 +27,7 @@ import JSONBig from "json-bigint";
 const GITHUB_API_VERSION = "2022-11-28";
 const GITHUB_REQUEST_TIMEOUT_MS = 10_000;
 const GITHUB_REPOSITORIES_RESPONSE_MAX_BYTES = 1024 * 1024;
+const GITHUB_BRANCHES_RESPONSE_MAX_BYTES = 256 * 1024;
 const personalGitHubProviderJsonParser = JSONBig({
   storeAsString: true,
   protoAction: "error",
@@ -31,6 +38,60 @@ export type PersonalGitHubRepositoryConnection = NonNullable<
   Awaited<ReturnType<typeof getConnectionMetadata>>
 >;
 
+type PersonalGitHubRepositoryProviderOperation =
+  | "repositories_list"
+  | "repository_branches_list"
+  | "repository_verify";
+
+type ExpectedPersonalGitHubRepositoryAuthority = {
+  selectionGeneration: number;
+  repositoryId: string;
+  fullName: string;
+};
+
+type PersonalGitHubProviderJsonOptions = {
+  operation: PersonalGitHubRepositoryProviderOperation;
+  expectedRepositoryAuthority?: ExpectedPersonalGitHubRepositoryAuthority;
+  responseLabel?: string;
+  responseMaxBytes?: number;
+};
+
+export type PersonalGitHubRepositoryBranchServices = {
+  requireConnection: typeof requirePersonalGitHubRepositoryConnection;
+  getSelectionState: (
+    deps: ApiRouteDeps,
+    input: {
+      accountId: string;
+      originWorkspaceId: string;
+      subjectId: string;
+      connectionId: string;
+    },
+  ) => Promise<DbPersonalGitHubRepositorySelectionState | null>;
+  providerJson: (input: {
+    deps: ApiRouteDeps;
+    connection: PersonalGitHubRepositoryConnection;
+    subjectId: string;
+    url: URL;
+    expectedConnectionAuthorityGeneration: number;
+    options: PersonalGitHubProviderJsonOptions;
+  }) => Promise<unknown>;
+};
+
+const personalGitHubRepositoryBranchServices: PersonalGitHubRepositoryBranchServices = {
+  requireConnection: requirePersonalGitHubRepositoryConnection,
+  getSelectionState: async (deps, input) =>
+    await getPersonalGitHubRepositorySelectionState(deps.db, input),
+  providerJson: async (input) =>
+    await personalGitHubProviderJson(
+      input.deps,
+      input.connection,
+      input.subjectId,
+      input.url,
+      input.expectedConnectionAuthorityGeneration,
+      input.options,
+    ),
+};
+
 export type PersonalGitHubRepositoryProviderErrorCode =
   | "connection_changed"
   | "connection_inactive"
@@ -40,7 +101,9 @@ export type PersonalGitHubRepositoryProviderErrorCode =
   | "provider_unavailable"
   | "repository_archived"
   | "repository_not_found"
+  | "repository_not_selected"
   | "repository_read_denied"
+  | "repository_selection_changed"
   | "repository_write_denied";
 
 export class PersonalGitHubRepositoryProviderError extends Error {
@@ -104,6 +167,7 @@ export async function listLivePersonalGitHubRepositories(
     input.subjectId,
     url,
     input.expectedConnectionAuthorityGeneration,
+    { operation: "repositories_list" },
   );
   if (!Array.isArray(payload) || payload.length > PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX) {
     throw new PersonalGitHubRepositoryProviderError("invalid_provider_response");
@@ -124,6 +188,93 @@ export async function listLivePersonalGitHubRepositories(
   };
 }
 
+export async function listLivePersonalGitHubRepositoryBranches(
+  deps: ApiRouteDeps,
+  input: {
+    workspaceId: string;
+    accountId: string;
+    subjectId: string;
+    connectionId: string;
+    repositoryId: string;
+    query: ListGitHubRepositoryBranchesQuery;
+  },
+  services: PersonalGitHubRepositoryBranchServices = personalGitHubRepositoryBranchServices,
+): Promise<GitHubRepositoryBranchesResponseContract> {
+  const connection = await services.requireConnection(deps, input);
+  const current = await requireSelectedPersonalGitHubRepository(
+    deps,
+    connection,
+    input,
+    null,
+    services.getSelectionState,
+  );
+  const [owner, repositoryName] = current.repository.fullName.split("/");
+  if (!owner || !repositoryName) {
+    throw new PersonalGitHubRepositoryProviderError("invalid_provider_response");
+  }
+  const url = new URL(
+    `/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repositoryName)}/branches`,
+    PERSONAL_GITHUB_API_ORIGIN,
+  );
+  url.searchParams.set("page", String(input.query.cursor));
+  url.searchParams.set("per_page", String(input.query.limit));
+  const expectedRepositoryAuthority = {
+    selectionGeneration: current.selectionGeneration,
+    repositoryId: current.repository.repositoryId,
+    fullName: current.repository.fullName,
+  };
+  const payload = await services.providerJson({
+    deps,
+    connection,
+    subjectId: input.subjectId,
+    url,
+    expectedConnectionAuthorityGeneration: current.connectionAuthorityGeneration,
+    options: {
+      operation: "repository_branches_list",
+      expectedRepositoryAuthority,
+      responseLabel: "GitHub repository branches response",
+      responseMaxBytes: GITHUB_BRANCHES_RESPONSE_MAX_BYTES,
+    },
+  });
+  if (!Array.isArray(payload) || payload.length > input.query.limit) {
+    throw new PersonalGitHubRepositoryProviderError("invalid_provider_response");
+  }
+  const branches: string[] = [];
+  const seen = new Set<string>();
+  for (const value of payload) {
+    const name =
+      value && typeof value === "object" && !Array.isArray(value)
+        ? (value as Record<string, unknown>).name
+        : null;
+    if (typeof name !== "string" || name.length === 0 || name.length > 1024 || seen.has(name)) {
+      throw new PersonalGitHubRepositoryProviderError("invalid_provider_response");
+    }
+    seen.add(name);
+    branches.push(name);
+  }
+  await requireSelectedPersonalGitHubRepository(
+    deps,
+    connection,
+    input,
+    expectedRepositoryAuthority,
+    services.getSelectionState,
+  );
+  const response = GitHubRepositoryBranchesResponse.safeParse({
+    branches: branches.map((name) => ({
+      name,
+      isDefault: name === current.repository.defaultBranch,
+    })),
+    nextCursor:
+      branches.length === input.query.limit && input.query.cursor < 10_000
+        ? input.query.cursor + 1
+        : null,
+  });
+  if (!response.success) {
+    throw new PersonalGitHubRepositoryProviderError("invalid_provider_response");
+  }
+  return response.data;
+}
+
 /** Serial by design: one bounded provider request and one authority check at a time. */
 export async function verifyLivePersonalGitHubRepositories(
   deps: ApiRouteDeps,
@@ -154,7 +305,7 @@ export async function verifyLivePersonalGitHubRepositories(
       input.subjectId,
       url,
       input.expectedConnectionAuthorityGeneration,
-      true,
+      { operation: "repository_verify" },
     );
     const repository = parsePersonalGitHubRepository(payload);
     if (
@@ -179,6 +330,58 @@ export async function verifyLivePersonalGitHubRepositories(
   return verified;
 }
 
+async function requireSelectedPersonalGitHubRepository(
+  deps: ApiRouteDeps,
+  connection: PersonalGitHubRepositoryConnection,
+  input: {
+    accountId: string;
+    subjectId: string;
+    connectionId: string;
+    repositoryId: string;
+  },
+  expected: ExpectedPersonalGitHubRepositoryAuthority | null,
+  getSelectionState: PersonalGitHubRepositoryBranchServices["getSelectionState"],
+): Promise<{
+  connectionAuthorityGeneration: number;
+  selectionGeneration: number;
+  repository: NonNullable<
+    Awaited<ReturnType<typeof getPersonalGitHubRepositorySelectionState>>
+  >["repositories"][number];
+}> {
+  const selection = await getSelectionState(deps, {
+    accountId: input.accountId,
+    originWorkspaceId: connection.workspaceId,
+    subjectId: input.subjectId,
+    connectionId: input.connectionId,
+  });
+  if (!selection) {
+    throw new PersonalGitHubRepositoryProviderError(
+      expected ? "repository_selection_changed" : "repository_not_selected",
+    );
+  }
+  const repository = selection.repositories.find(
+    (candidate) => candidate.repositoryId === input.repositoryId,
+  );
+  if (!repository) {
+    throw new PersonalGitHubRepositoryProviderError(
+      expected ? "repository_selection_changed" : "repository_not_selected",
+    );
+  }
+  if (
+    expected &&
+    (selection.selectionGeneration !== expected.selectionGeneration ||
+      repository.repositoryId !== expected.repositoryId ||
+      repository.fullName !== expected.fullName)
+  ) {
+    throw new PersonalGitHubRepositoryProviderError("repository_selection_changed");
+  }
+  return {
+    connectionAuthorityGeneration: selection.connectionAuthorityGeneration,
+    selectionGeneration: selection.selectionGeneration,
+    repository,
+  };
+}
+
 export function personalGitHubRepositoryProviderHttpError(
   error: PersonalGitHubRepositoryProviderError,
 ): HTTPException {
@@ -194,6 +397,14 @@ export function personalGitHubRepositoryProviderHttpError(
       return new HTTPException(503, { message: "GitHub is temporarily rate limited" });
     case "repository_not_found":
       return new HTTPException(422, { message: "a selected GitHub repository is unavailable" });
+    case "repository_not_selected":
+      return new HTTPException(404, {
+        message: "personal GitHub repository is not selected for this connection",
+      });
+    case "repository_selection_changed":
+      return new HTTPException(409, {
+        message: "personal GitHub repository selection changed; refresh and try again",
+      });
     case "repository_archived":
       return new HTTPException(422, {
         message: "an archived or disabled GitHub repository cannot be selected for write access",
@@ -218,7 +429,7 @@ async function personalGitHubProviderJson(
   subjectId: string,
   url: URL,
   expectedConnectionAuthorityGeneration: number,
-  repositoryLookup = false,
+  options: PersonalGitHubProviderJsonOptions,
 ): Promise<unknown> {
   if (url.origin !== PERSONAL_GITHUB_API_ORIGIN) {
     throw new PersonalGitHubRepositoryProviderError("invalid_provider_response");
@@ -229,7 +440,8 @@ async function personalGitHubProviderJson(
     subjectId,
     url,
     expectedConnectionAuthorityGeneration,
-    repositoryLookup,
+    options.operation,
+    options.expectedRepositoryAuthority,
     false,
   );
   if (response.status === 401) {
@@ -240,7 +452,8 @@ async function personalGitHubProviderJson(
       subjectId,
       url,
       expectedConnectionAuthorityGeneration,
-      repositoryLookup,
+      options.operation,
+      options.expectedRepositoryAuthority,
       true,
     );
   }
@@ -264,7 +477,7 @@ async function personalGitHubProviderJson(
     if (status === 429) {
       throw new PersonalGitHubRepositoryProviderError("provider_rate_limited");
     }
-    if (status === 404 && repositoryLookup) {
+    if (status === 404 && options.operation !== "repositories_list") {
       throw new PersonalGitHubRepositoryProviderError("repository_not_found");
     }
     throw new PersonalGitHubRepositoryProviderError("provider_unavailable");
@@ -273,8 +486,11 @@ async function personalGitHubProviderJson(
     return parsePersonalGitHubProviderJson(
       await readResponseTextBounded(
         response,
-        GITHUB_REPOSITORIES_RESPONSE_MAX_BYTES,
-        repositoryLookup ? "GitHub repository response" : "GitHub repositories response",
+        options.responseMaxBytes ?? GITHUB_REPOSITORIES_RESPONSE_MAX_BYTES,
+        options.responseLabel ??
+          (options.operation === "repositories_list"
+            ? "GitHub repositories response"
+            : "GitHub repository response"),
       ),
     );
   } catch {
@@ -293,7 +509,8 @@ async function personalGitHubProviderFetch(
   subjectId: string,
   url: URL,
   expectedConnectionAuthorityGeneration: number,
-  repositoryLookup: boolean,
+  operation: PersonalGitHubRepositoryProviderOperation,
+  expectedRepositoryAuthority: ExpectedPersonalGitHubRepositoryAuthority | undefined,
   forceRefresh: boolean,
 ): Promise<Response> {
   const resolver = buildConnectionTokenResolver(deps.db, deps.settings, undefined, {
@@ -305,7 +522,7 @@ async function personalGitHubProviderFetch(
     workspaceId: connection.workspaceId,
     subjectId,
     serverId: "github-personal-repository-picker",
-    toolName: repositoryLookup ? "repository_verify" : "repositories_list",
+    toolName: operation,
     connectionRef: {
       connectionId: connection.id,
       providerDomain: PERSONAL_GITHUB_PROVIDER_DOMAIN,
@@ -350,6 +567,18 @@ async function personalGitHubProviderFetch(
   ) {
     throw new PersonalGitHubRepositoryProviderError("connection_changed");
   }
+  if (expectedRepositoryAuthority) {
+    const repository = authority.repositories.find(
+      (candidate) => candidate.repositoryId === expectedRepositoryAuthority.repositoryId,
+    );
+    if (
+      authority.selectionGeneration !== expectedRepositoryAuthority.selectionGeneration ||
+      !repository ||
+      repository.fullName !== expectedRepositoryAuthority.fullName
+    ) {
+      throw new PersonalGitHubRepositoryProviderError("repository_selection_changed");
+    }
+  }
   const authorization = Object.entries(credential.headers).find(
     ([name]) => name.toLowerCase() === "authorization",
   )?.[1];

package/src/integrations/slack-app-home.ts

@@ -1,4 +1,4 @@
-import { AUTOMATIC_SESSION_TITLE_FALLBACK, type Session } from "@opengeni/contracts";
+import { deriveSessionDisplayTitle, type Session } from "@opengeni/contracts";
 import type { SlackHomeBlock } from "./slack-bot";
 
 const ATTENTION_LIMIT = 5;
@@ -186,7 +186,7 @@ function appendSessionGroup(
   );
   for (const session of sessions) {
     const url = sessionUrl(session.id);
-    const title = (session.title?.trim() || AUTOMATIC_SESSION_TITLE_FALLBACK).slice(0, 180);
+    const title = deriveSessionDisplayTitle(session).slice(0, 180);
     blocks.push({
       type: "section",
       block_id: `opengeni_home_session_${session.id}`,

package/src/integrations/slack-interactions.ts

@@ -123,6 +123,7 @@ import {
   requireAccessContext,
   requireAccessGrant,
   requireSessionAuthorizationListScope,
+  resolveWorkspaceCatalogSettings,
   type ApiRouteDeps,
 } from "@opengeni/core";
 import { publishDurableSessionEvents } from "@opengeni/events";
@@ -1058,6 +1059,23 @@ export function registerSlackInteractionRoutes(app: Hono, deps: ApiRouteDeps): v
   });
 }
 
+async function withCatalogSettings(
+  deps: ApiRouteDeps,
+  grant: Pick<AccessGrant, "accountId" | "workspaceId">,
+): Promise<ApiRouteDeps> {
+  const catalogSourceSettings = deps.catalogSourceSettings ?? deps.settings;
+  return {
+    ...deps,
+    catalogSourceSettings,
+    settings: (
+      await resolveWorkspaceCatalogSettings(deps.db, catalogSourceSettings, {
+        accountId: grant.accountId,
+        workspaceId: grant.workspaceId,
+      })
+    ).settings,
+  };
+}
+
 async function publishSlackAppHome(
   deps: ApiRouteDeps,
   installation: SlackInstallationRoute,
@@ -2152,17 +2170,22 @@ async function processSlackInboxEntry(deps: ApiRouteDeps, entry: SlackInteractio
       preparedAttachments,
       preparedModelContext,
     );
-    session = await createSessionForRequest(deps, grant, interaction.workspaceId, {
-      requestedSessionId: interaction.sessionReservationId,
-      initialMessage: prepared.entry.text,
-      ...(prepared.modelContext ? { modelContext: prepared.modelContext } : {}),
-      instructions: SLACK_SESSION_INSTRUCTIONS,
-      firstPartyMcpTools: slackTaskFirstPartyMcpTools(deps.settings),
-      resources: preparedAttachments.resources,
-      ...(preferredModel ? { model: preferredModel } : {}),
-      idempotencyKey: `slack:${entry.connectionId}:${entry.providerEventId}`,
-      clientEventId: `slack:${entry.providerEventId}`,
-    });
+    session = await createSessionForRequest(
+      await withCatalogSettings(deps, grant),
+      grant,
+      interaction.workspaceId,
+      {
+        requestedSessionId: interaction.sessionReservationId,
+        initialMessage: prepared.entry.text,
+        ...(prepared.modelContext ? { modelContext: prepared.modelContext } : {}),
+        instructions: SLACK_SESSION_INSTRUCTIONS,
+        firstPartyMcpTools: slackTaskFirstPartyMcpTools(deps.settings),
+        resources: preparedAttachments.resources,
+        ...(preferredModel ? { model: preferredModel } : {}),
+        idempotencyKey: `slack:${entry.connectionId}:${entry.providerEventId}`,
+        clientEventId: `slack:${entry.providerEventId}`,
+      },
+    );
   } catch (error) {
     if (error instanceof HTTPException) {
       await client.postMessage({
@@ -2741,21 +2764,26 @@ async function processSlackReactionInboxEntry(
   const preparedEntry = slackReactionPreparedEntry(entry, context, preparedTask);
   let session: Awaited<ReturnType<typeof createSessionForRequest>>;
   try {
-    session = await createSessionForRequest(deps, grant, interaction.workspaceId, {
-      requestedSessionId: interaction.sessionReservationId,
-      initialMessage: preparedEntry.text,
-      instructions: SLACK_SESSION_INSTRUCTIONS,
-      // The exact reacted message and bounded containing thread are already in
-      // the prompt; do not expose general Slack history tools for this trigger.
-      firstPartyMcpTools: resolveFirstPartyMcpToolPolicy(deps.settings).default,
-      resources: preparedTask.resources,
-      ...(preferredModel ? { model: preferredModel } : {}),
-      // Every reaction entry converging on this route must use the same create
-      // key. This closes the same-owner multi-event race while the owner check
-      // above prevents a different subject from winning creation authority.
-      idempotencyKey: `slack-interaction:${interaction.id}`,
-      clientEventId: `slack:${entry.providerEventId}`,
-    });
+    session = await createSessionForRequest(
+      await withCatalogSettings(deps, grant),
+      grant,
+      interaction.workspaceId,
+      {
+        requestedSessionId: interaction.sessionReservationId,
+        initialMessage: preparedEntry.text,
+        instructions: SLACK_SESSION_INSTRUCTIONS,
+        // The exact reacted message and bounded containing thread are already in
+        // the prompt; do not expose general Slack history tools for this trigger.
+        firstPartyMcpTools: resolveFirstPartyMcpToolPolicy(deps.settings).default,
+        resources: preparedTask.resources,
+        ...(preferredModel ? { model: preferredModel } : {}),
+        // Every reaction entry converging on this route must use the same create
+        // key. This closes the same-owner multi-event race while the owner check
+        // above prevents a different subject from winning creation authority.
+        idempotencyKey: `slack-interaction:${interaction.id}`,
+        clientEventId: `slack:${entry.providerEventId}`,
+      },
+    );
     // The route-wide create key converges every replica on one reserved
     // session, but its first writer's initial message is the only event created
     // by that operation. Replay this exact Slack event through the normal
@@ -3143,11 +3171,17 @@ async function acceptSlackReactionTask(
     }
     return;
   }
-  await acceptSessionUserMessage(deps, grant, grant.workspaceId, sessionId, {
-    text: entry.text,
-    resources,
-    clientEventId,
-  });
+  await acceptSessionUserMessage(
+    await withCatalogSettings(deps, grant),
+    grant,
+    grant.workspaceId,
+    sessionId,
+    {
+      text: entry.text,
+      resources,
+      clientEventId,
+    },
+  );
 }
 
 async function continueSlackSession(
@@ -3230,12 +3264,18 @@ async function continueSlackSession(
   if (!hasPermission(grant.permissions, "sessions:control")) {
     throw new SlackInteractionPermanentError("sessions_control_denied");
   }
-  await acceptSessionUserMessage(deps, grant, interaction.workspaceId, interaction.sessionId, {
-    text: entry.text,
-    ...(options.modelContext ? { modelContext: options.modelContext } : {}),
-    resources,
-    clientEventId: `slack:${entry.providerEventId}`,
-  });
+  await acceptSessionUserMessage(
+    await withCatalogSettings(deps, grant),
+    grant,
+    interaction.workspaceId,
+    interaction.sessionId,
+    {
+      text: entry.text,
+      ...(options.modelContext ? { modelContext: options.modelContext } : {}),
+      resources,
+      clientEventId: `slack:${entry.providerEventId}`,
+    },
+  );
 }
 
 const SLACK_ACTION_ID_BY_KIND: Record<SlackInteractionActionKind, string> = {

package/src/mcp/company-brain-governed-writes.ts

@@ -141,7 +141,7 @@ export function registerCompanyBrainGovernedWriteTools(
       description:
         "Atomically promote one still-active note from this exact root task tree into a workspace instruction-policy proposal. The note bytes remain exact evidence and draft content. " +
         `Use this only for a universal always-on rule, never for an incident, fact, decision, outcome, or conditional procedure. Once active, those bytes are composed verbatim into the prompt of every session the target applies to, so a note over ${AGENT_AUTHORED_INSTRUCTION_POLICY_CONTENT_MAX_CHARS} characters is rejected here rather than truncated: write a fresh minimal imperative note instead of promoting a long working note. ` +
-        "Off creates nothing; Review first keeps the proposal inactive; Autonomous may activate an eligible proposal through the governed instruction lifecycle with an undoable receipt. This never widens scope.",
+        "Off creates nothing; Require approval keeps the proposal inactive; Autonomous may activate an eligible proposal through the governed instruction lifecycle with an undoable receipt. This never widens scope.",
       inputSchema: {
         ...taskNotePromotion,
         target: WorkspaceInstructionPolicyTarget,
@@ -202,7 +202,7 @@ export function registerCompanyBrainGovernedWriteTools(
       description:
         "Materialize an evidence-backed workspace instruction-policy proposal. " +
         `Use this only for a minimal universal rule, never for an incident, fact, decision, outcome, or conditional procedure. Once active, this content is composed verbatim into the prompt of every session the target applies to (every session in this workspace for a global charter or policy, every session bound to the role for a role policy), so keep it under ${AGENT_AUTHORED_INSTRUCTION_POLICY_CONTENT_MAX_CHARS} characters. ${AGENT_AUTHORED_INSTRUCTION_POLICY_STYLE} ` +
-        "Off creates nothing; Review first keeps the proposal inactive; Autonomous may activate an eligible proposal through the governed instruction lifecycle with an undoable receipt.",
+        "Off creates nothing; Require approval keeps the proposal inactive; Autonomous may activate an eligible proposal through the governed instruction lifecycle with an undoable receipt.",
       inputSchema: {
         ...evidence,
         target: WorkspaceInstructionPolicyTarget,

package/src/mcp/company-profile-agent-admin.ts

@@ -127,7 +127,7 @@ export function registerCompanyProfileAgentAdminTools(
         "Prepare the organization's small, stable identity: identity says who the organization is, and mission says why it exists. " +
         "Once activated, both fields are mandatory prompt context in every root session for the whole organization, so use one plain descriptive statement per field with no products, customers, goals, constraints, procedures, or marketing copy. Those details belong in organization-scoped Documents and are retrieved only when relevant. " +
         `Each field is bounded to ${AGENT_AUTHORED_COMPANY_PROFILE_SCALAR_MAX_CHARS} characters for agent-authored proposals. ` +
-        "This is independent of workspace learning policy and follows the organization owner's Agent-managed identity mode. Off creates nothing. Review first returns status=confirmation_required with the exact `humanInput` payload; call `request_human_input` with it verbatim, then call `company_profile_confirm` with the returned requestId. Autonomous may return status=activated immediately after exact live-owner, stale-head, and compare-and-swap checks; do not ask for another confirmation in that case.",
+        "This is independent of workspace learning policy and follows the organization owner's Agent-managed identity mode. Off creates nothing. Require approval returns status=confirmation_required with the exact `humanInput` payload; call `request_human_input` with it verbatim, then call `company_profile_confirm` with the returned requestId. Autonomous may return status=activated immediately after exact live-owner, stale-head, and compare-and-swap checks; do not ask for another confirmation in that case.",
       inputSchema: {
         operationId: z.string().uuid(),
         identity: scalar,

package/src/mcp/remember.ts

@@ -72,7 +72,7 @@ export function registerRememberTools(input: RegisterRememberToolsInput): void {
       description:
         "Create governed durable knowledge, a Skill, or a mandatory workspace instruction. When the agent-only memory_save tool is available, use it instead for ordinary durable facts, decisions, incidents, bug fixes, and confirmed outcomes; those Memory writes are autonomous and independent of Learning mode. Use lane=knowledge only when memory_save is unavailable and the user explicitly requests reviewed workspace knowledge; lane=preference creates a Skill for reusable conditional how-to guidance; lane=instruction_policy is only for a universal always/never rule that should apply to nearly every task. " +
         `Write the instruction lane as the shortest complete rule, at most ${AGENT_AUTHORED_INSTRUCTION_POLICY_CONTENT_MAX_CHARS} characters and normally 1-3 imperative sentences, with no numbered steps, examples, rationale, or restated defaults. Keep a Skill under ${AGENT_AUTHORED_PREFERENCE_CONTENT_MAX_CHARS} characters with one clear trigger and outcome, only the necessary steps, checks, and exceptions, and a one-sentence descriptor. Do not copy one item into multiple lanes. ` +
-        "Under Autonomous learning, an eligible Skill or workspace instruction may activate immediately through its governed lifecycle. Under Review first, it remains inactive and the receipt returns status=confirmation_required with the exact `humanInput` payload: call `request_human_input` with it verbatim, then call `remember_confirm` with the returned requestId. Off creates no governed change. Reviewed Knowledge always needs confirmation. Do not use lane=knowledge for facts you merely inferred; use memory_save when available, otherwise knowledge_propose or task notes. Confirmed lane=knowledge content keeps its reviewed claim provenance and materializes its exact approved text into Memory for later `memory_search` retrieval.",
+        "Under Autonomous learning, an eligible Skill or workspace instruction may activate immediately through its governed lifecycle. Under Require approval, it remains inactive and the receipt returns status=confirmation_required with the exact `humanInput` payload: call `request_human_input` with it verbatim, then call `remember_confirm` with the returned requestId. Off creates no governed change. Reviewed Knowledge always needs confirmation. Do not use lane=knowledge for facts you merely inferred; use memory_save when available, otherwise knowledge_propose or task notes. Confirmed lane=knowledge content keeps its reviewed claim provenance and materializes its exact approved text into Memory for later `memory_search` retrieval.",
       inputSchema: {
         lane: z.enum(["preference", "instruction_policy", "knowledge"]),
         ...laneFields,

package/src/mcp/server.ts

@@ -154,6 +154,7 @@ import {
   requireLiveAgentAttemptAuthorization,
   requireSessionAuthorization,
   requireSessionAuthorizationListScope,
+  resolveWorkspaceCatalogSettings,
   SessionAuthorizationDeniedError,
   SessionAuthorizationUnavailableError,
   saveWorkspaceMemoryWithSlackPublication,
@@ -1718,7 +1719,7 @@ export function buildOpenGeniMcpServer(
       async ({ id, triggerId }) => {
         const task = await requireScheduledTask(deps.db, grant.workspaceId, id);
         if (task.action.kind === "agent_turn") {
-          await validateScheduledTaskTarget({
+          const targetSession = await validateScheduledTaskTarget({
             db: deps.db,
             sessionAuthorization: deps.sessionAuthorization,
             authorizationSurface: "first_party_mcp",
@@ -1730,8 +1731,16 @@ export function buildOpenGeniMcpServer(
             agentConfig: task.agentConfig,
             missingTargetStatus: 404,
           });
+          const catalogSourceSettings = deps.catalogSourceSettings ?? deps.settings;
+          const catalogSettings = (
+            await resolveWorkspaceCatalogSettings(deps.db, catalogSourceSettings, {
+              accountId: grant.accountId,
+              workspaceId: grant.workspaceId,
+              ...(targetSession ? { retainedProductModelId: targetSession.model } : {}),
+            })
+          ).settings;
           await validateScheduledTaskMachineTarget({
-            settings: deps.settings,
+            settings: catalogSettings,
             db: deps.db,
             grant,
             runMode: task.runMode,