@opengeni/api-router 3.0.1 → 3.0.2-canary.38894290271001

package/src/app.ts

@@ -1,33 +1,92 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+
+import { registerClaudeSubscriptionAccountRoutes } from "./routes/claude-subscription-accounts";
+import { isPreparedMcpConnectPath } from "./prepared-mcp-permissions";
+import { registerWorkspaceModelProviderRoutes } from "./routes/workspace-model-providers";
+import { registerClaudeSubscriptionOAuthRoutes } from "./routes/claude-subscription-oauth";
 import { registerConnectCallbackReturns } from "./integrations/connect-callback-return";
 import { registerFeedbackRoutes } from "./routes/feedback";
+import { registerInboxRoutes } from "./routes/inbox";
+import { registerWorkspaceIntegrationRoutes } from "./routes/workspace-integrations";
+import { registerOrganizationIntegrationRoutes } from "./routes/organization-integrations";
+import {
+  resolveWorkspaceToolTarget,
+  invokeWorkspaceToolTarget,
+  approveWorkspaceToolTarget,
+  resolveWorkspaceToolManifest,
+} from "./workspace-tool-target";
+import type { TargetAuthorityFence } from "./workspace-tool-target-fence";
+import { recordWorkspaceToolTargetOperation } from "./workspace-tool-gateway-observability";
+import {
+  CLIENT_ERRORS_PATH,
+  isClientErrorReportRequest,
+  registerClientErrorRoutes,
+} from "./routes/client-errors";
+import {
+  ANALYTICS_CONSENT_PATH,
+  isAnalyticsConsentReportRequest,
+  registerAnalyticsConsentRoutes,
+} from "./routes/analytics-consent";
 import { codemodeSessionRequest } from "./codemode";
-import { SiteSessionPathError } from "@opengeni/contracts";
+import { siteClampedAgentGuard } from "./site-agent-guard";
+import { siteFrameGuard } from "./site-frame-guard";
+import { SiteDataUnsupportedError } from "@opengeni/contracts/site-session-http";
+import {
+  SiteSessionPathError,
+  OrganizationIntegrationDeniedError,
+  normalizeOrganizationAccessPolicy,
+} from "@opengeni/contracts";
+import {
+  httpRejectionFactsFromEnvelope,
+  httpRejectionFactsFromError,
+  readRejectionEnvelope,
+  type HttpRejectionFacts,
+} from "./http/rejection-telemetry";
+import { observeInteractionRouteOutcome } from "./interaction-metrics";
+import {
+  isOAuthCallbackRoute,
+  observeConnectAttemptTransition,
+  observeOAuthCallback,
+} from "./integration-connect-metrics";
 import { registerModelConnectionAccessRoutes } from "./routes/model-connection-access";
 import {
-  canonicalizeConfiguredModelId,
-  configuredAllowedModels,
+  codeSearchDeploymentPolicy,
+  agentConfigDeploymentPolicy,
+  canonicalPublicOrigin,
   configuredAllowedReasoningEfforts,
-  configuredModels,
+  environmentsEncryptionKeyBytes,
   resolveFirstPartyMcpToolPolicy,
-  resolveVoiceInputProviderRegistry,
-  withCodexCatalogProvider,
-  withXaiSubscriptionCatalogProvider,
+  UnsupportedLatencyModeError,
+  voiceInputPricingIssues,
+  type Settings,
+  type FirstPartyMcpToolPolicySettings,
 } from "@opengeni/config";
 import {
+  AGENT_CAPABILITY_IDS,
   ClientConfig,
   CodemodeCallRequest,
   ErrorEnvelope,
   OPENGENI_API_CONTRACT_HEADER,
   OPENGENI_API_CONTRACT_REVISION,
   OPENGENI_CORRELATION_HEADER,
+  resolveAgentToolFamilies,
   resolveWorkspaceMemoryEnabled,
   resolveWorkspaceMemoryPromptMode,
   VOICE_INPUT_ACCEPTED_MIME_TYPES,
+  WorkspaceVoiceInputSettings,
   TRANSCRIPTION_RECORDING_PROVIDER_SEGMENT_SECONDS,
   ToolGatewayApprovalRequest,
   ToolGatewayCallRequest,
+  ToolGatewayResolveRequest,
+  ToolGatewayInvokeRequest,
+  ToolGatewayTargetApprovalRequest,
+  ToolGatewayManifestRequest,
   type AccessGrant,
+  type ClientAgentConfig,
+  type ClientSitesConfig,
   type ErrorCode,
+  type FirstPartyMcpToolName,
+  type Session,
 } from "@opengeni/contracts";
 import {
   createDocumentServices,
@@ -39,53 +98,106 @@ import {
   CodemodeOperationConflictError,
   CodemodeOperationNotExecutableError,
   CodemodePayloadTooLargeError,
+  CodemodeOperationLimitError,
   CodemodeToolApprovalRequiredError,
   CodemodeToolNotInCatalogError,
   ConnectAttemptConflictError,
   ConnectAttemptNotFoundError,
   configureChildLifecycleNotices,
+  configureCodeSearchDeploymentPolicy,
   configureWorkspaceControlRequestLockTimeoutMs,
+  setConnectAttemptTransitionObserver,
   dbSql,
   getManagedAuthSessionSetSnapshot,
   getWorkspace,
   reapManagedAuthIsolatedSessions,
   reapExpiredManagedAuthSessionSets,
   resolveSessionMemoryAgentScope,
+  resolveSessionAdminAuthority,
   rlsContextForWorkspace,
 } from "@opengeni/db";
 import { requireSessionEventDurableFanoutCapability } from "@opengeni/events";
 import { githubAppBotIdentityWarnings } from "@opengeni/github";
-import { createObservability } from "@opengeni/observability";
+import {
+  createObservability,
+  errorCauseAttributes,
+  failureDiagnostic,
+  withTraceContext,
+  withMcpTelemetry,
+} from "@opengeni/observability";
 import { createObjectStorage } from "@opengeni/storage";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
+import { SUPPORTED_PROTOCOL_VERSIONS } from "@modelcontextprotocol/sdk/types.js";
 import { handleMcpRequestWithClientAbort } from "./mcp/request-abort";
-import { Hono } from "hono";
+import { Hono, type Context } from "hono";
 import { bodyLimit } from "hono/body-limit";
 import { compress } from "hono/compress";
 import { cors } from "hono/cors";
 import { getCookie } from "hono/cookie";
 import { HTTPException } from "hono/http-exception";
-import { ApiHttpError, workspaceControlBusyHttpError } from "./http/api-error";
+import {
+  ApiHttpError,
+  agentConfigHttpError,
+  allowanceExhaustedHttpError,
+  DATABASE_CONTENTION_ERROR_DETAIL_CODE,
+  DATABASE_UNAVAILABLE_ERROR_DETAIL_CODE,
+  databaseContentionHttpError,
+  databaseUnavailableHttpError,
+  modelUnavailableHttpError,
+  scheduledTaskTargetAccessHttpError,
+  sessionUsageLimitHttpError,
+  workspaceControlBusyHttpError,
+} from "./http/api-error";
+import {
+  isRequestBodyValidationError,
+  requestBodyValidationHttpError,
+  tagRequestJsonParseErrors,
+} from "./http/request-body";
+import { invalidPathIdentifierHttpError } from "./http/path-identifier";
+import { replaceTrustedClientAddressHeader } from "./http/request-source";
+import { unmatchedRoute } from "./http/unmatched-route";
 import type { ContentfulStatusCode } from "hono/utils/http-status";
+import { bearerApiContractHeaderCompatibility } from "./http/api-contract-compat";
+import { deprecationHeadersMiddleware } from "./http/deprecation";
+import {
+  boundedRegisteredRouteLabel,
+  registeredHandlerRoutePath,
+} from "./http/registered-route-label";
 import type { ApiRouteDeps, AppDependencies } from "@opengeni/core";
+import { sessionUsageLimitsProducerEnabled } from "@opengeni/core";
 import {
   CodexCompactionV2ProviderLockedError,
   ManagedAuthActorLeaseOutcomeUnknownError,
   hasPermission,
   requireAccessGrant,
   requireAccessGrantAuthorization,
+  requireFreshAccessGrant,
+  accountScopedApiKeyWorkspaceAuthority,
+  requireAccessContext,
   requirePermission,
   releaseManagedAuthRequestActorLease,
   resolveCatalogSettings,
   resolveWorkspaceCatalogSettings,
+  resolveCallerWorkspaceModelSelections,
+  resolveDefaultSessionModelForSelections,
+  selectDefaultSessionModel,
+  isWorkspaceModelAdmissible,
+  resolveWorkspaceModelSelection,
   validateManagedAuthRequestActorLease,
   requireSessionAuthorization,
   SessionAuthorizationDeniedError,
+  withSessionAuthorizationReadReuse,
   SessionAuthorizationUnavailableError,
+  createUserPresenceRecorder,
+  registerProductUsageMetricBaselines,
+  stampPersonalApiKeyRequest,
+  verifiedDelegatedHumanAuthorizationForRequest,
 } from "@opengeni/core";
+import { createManagedAuthNewSignupsGate } from "./auth/new-signups-gate";
 import {
   createManagedAuth,
   isolatedManagedAuthOAuthCallbackRequest,
+  managedAuthNewSignupsPausedResponse,
   managedAuthOAuthReturnMatches,
   resolveManagedAuthOAuthAttempt,
 } from "./auth/managed-auth";
@@ -106,6 +218,7 @@ import {
   runManagedAuthProvider,
 } from "./auth/managed-auth-attempt-context";
 import { createManagedEmailTransport } from "./auth/managed-email";
+import { startManagedSignInNotificationDelivery } from "./auth/managed-sign-in-notifications";
 import {
   assertManagedEmailTransportMetadata,
   assertOrganizationUserSetupQueryTransportConfigured,
@@ -115,19 +228,26 @@ import { buildOpenGeniMcpServer } from "./mcp/server";
 import {
   buildWorkspaceToolGatewayMcpServer,
   approveWorkspaceToolGatewayCall,
-  callWorkspaceToolGateway,
+  callWorkspaceToolGatewayForCaller,
   grantUsesAttemptScopedMcp,
+  prepareAttestedWorkspaceToolGateway,
   prepareMcpOAuthWorkspaceToolGateway,
   prepareWorkspaceToolGateway,
   workspaceToolGatewayDeclarations,
+  workspaceToolGatewayServerTiming,
 } from "./workspace-tool-gateway";
+import { createWorkspaceToolGatewayCatalogAttestations } from "./workspace-tool-gateway-attestations";
+import { recordWorkspaceToolGatewayPreparation } from "./workspace-tool-gateway-observability";
 import {
   isMcpOAuthResourcePath,
   mcpOAuthAuthenticateHeader,
   mcpOAuthBearerToken,
+  ORGANIZATION_MCP_PATH,
   registerMcpOAuthRoutes,
   resolveMcpOAuthRouteAccess,
+  resolveOrganizationMcpOAuthAccess,
 } from "./mcp-oauth";
+import { buildOrganizationMcpServer, type OrganizationMcpCaller } from "./organization-mcp";
 import {
   CodemodeAuthorityError,
   CodemodeCatalogNotReadyError,
@@ -143,42 +263,65 @@ import {
   BrowserControlTransportError,
 } from "@opengeni/runtime/sandbox";
 import { requireAccessKey } from "./http/auth";
+import {
+  publicListenerServesMetrics,
+  registerPrometheusMetricsRoute,
+} from "./http/metrics-listener";
 import { allowedCorsOrigin } from "./http/cors";
+import {
+  createLocalBrowserBoundary,
+  localBrowserRequestHost,
+  markLocalInternalDispatch,
+} from "./http/local-browser-boundary";
 import { withAccessGrantSessionRlsContext } from "./access-grant-rls";
 import { registerCapabilityRoutes } from "./routes/capabilities";
 import { registerCatalogAssetRoutes } from "./routes/catalog-assets";
 import { registerCodexRoutes } from "./routes/codex";
 import { registerOrganizationModelProviderRoutes } from "./routes/organization-model-providers";
+import { registerOrganizationModelDefaultsRoutes } from "./routes/organization-model-defaults";
+import {
+  registerModelAccountSettingsRoutes,
+  subscriptionSettingsLockedHttpError,
+} from "./routes/model-account-settings";
+import { registerModelAccountChoiceRoutes } from "./routes/model-account-choice";
+import { registerSessionAdminAccessRoutes } from "./routes/session-admin-access";
+import { registerOrganizationIntegrationPolicyRoutes } from "./routes/organization-integration-policy";
 import { registerSuperGrokRoutes } from "./routes/supergrok";
 import { registerConnectionRoutes } from "./routes/connections";
+import { registerVaultProviderRoutes, vaultProviderRegistryFor } from "./routes/vault-providers";
 import { registerConnectRoutes } from "./routes/connect";
-import { registerHostMcpBindingRoutes } from "./routes/host-mcp-bindings";
-import { registerHostMcpResolverRoutes } from "./routes/host-mcp-resolvers";
+
 import { registerExternalIdentityLinkRoutes } from "./routes/external-identity-links";
 import { registerDocumentRoutes } from "./routes/documents";
 import { registerKnowledgeRoutes } from "./routes/knowledge";
 import { registerEnrollmentRoutes } from "./routes/enrollments";
 import { registerMachineRoutes } from "./routes/machines";
 import { registerMemorySlackPublicationRoutes } from "./routes/memory-slack-publications";
-import { registerEnvironmentRoutes } from "./routes/environments";
+import { registerVariableSetsRemovedRoutes } from "./routes/variable-sets-removed";
+import { variableSetsRemovedErrorResponse } from "./http/variable-sets-removed";
+import { registerVaultRoutes } from "./routes/vaults";
 import { registerFileRoutes } from "./routes/files";
 import { registerApiKeyRoutes } from "./routes/api-keys";
+import { registerOrganizationMcpConnectionRoutes } from "./routes/organization-mcp-connections";
+import { registerPersonalApiKeyRoutes } from "./routes/personal-api-keys";
+import { registerOrganizationServiceAccountRoutes } from "./routes/organization-service-accounts";
 import { registerBillingRoutes } from "./routes/billing";
 import { registerBrowserIdentityRoutes } from "./routes/browser-identities";
 import { registerBrowserSessionRoutes } from "./routes/browser-sessions";
 import { registerComputerSessionRoutes } from "./routes/computer-sessions";
+import { createVaultInteractionSecretsPort } from "./interaction-secrets-vault";
 import { registerGitHubRoutes } from "./routes/github";
 import { registerPersonalGitHubRoutes } from "./routes/personal-github";
 import {
   isPersonalGitHubGitBrokerRequest,
   registerPersonalGitHubGitBrokerRoutes,
 } from "./routes/personal-github-git-broker";
+import { registerDesktopDistributionRoutes } from "./routes/desktop-distribution";
 import { registerInstallRoutes } from "./routes/install";
 import { registerApiIntegrationRoutes } from "./routes/api-integrations";
 import { registerIntegrationFacetRoutes } from "./routes/integration-facets";
 import { registerInteractionResourceRoutes } from "./routes/interaction-resources";
 import { registerPrReviewRoutes } from "./routes/pr-review";
-import { registerPackRoutes } from "./routes/packs";
 import { registerAutomationRoutes } from "./routes/automations";
 import { registerPluginRoutes } from "./routes/plugins";
 import { registerSkillRoutes } from "./routes/skills";
@@ -186,37 +329,58 @@ import { registerChannelRoutes } from "./routes/channels";
 import { registerRigRoutes } from "./routes/rigs";
 import { registerScheduledTaskRoutes } from "./routes/scheduled-tasks";
 import { registerSessionRoutes } from "./routes/sessions";
+import {
+  archivedSessionImportErrorResponse,
+  isSessionHistoryImportRequest,
+  registerSessionHistoryImportRoutes,
+} from "./routes/session-history-imports";
 import { registerSocialRoutes } from "./routes/social";
 import { registerWorkspaceRoutes } from "./routes/workspaces";
+import { registerUsageAllowanceRoutes } from "./routes/usage-allowances";
 import { registerWorkspaceInstructionPolicyRoutes } from "./routes/workspace-instruction-policies";
 import { registerWorkspaceLearningRoutes } from "./routes/workspace-learning";
 import { registerCompanyProfileRoutes } from "./routes/company-profile";
 import { registerCompanyBrainRoutes } from "./routes/company-brain";
 import { registerSlackTaskPolicyRoutes } from "./routes/slack-task-policy";
+import { registerSlackBotAccessRoutes } from "./routes/slack-bot-access";
 import { registerWorkspaceStateRoutes } from "./routes/workspace-state";
 import { registerWorkspaceArtifactRoutes } from "./routes/workspace-artifacts";
+import { isSiteDataFileUploadRequest, registerSiteDataRoutes } from "./routes/site-data";
+import { registerSitePublishingRoutes } from "./routes/site-publishing";
+import { configuredSitesDomain } from "./site-publishing/service";
+import { registerSiteRuntimeRoutes } from "./routes/site-runtime";
 import { registerArtifactCatalogRoutes } from "./routes/artifact-catalog";
+import { registerSiteSqlRoutes } from "./routes/site-sql";
 import { registerPreferenceRegistryRoutes } from "./routes/preference-registry";
 import { registerInsightsRoutes } from "./routes/insights";
+import { registerInsightsUsageRoutes } from "./routes/insights-usage";
 import { registerTranscriptionRoutes } from "./routes/transcriptions";
+import { registerChatCompletionRoutes } from "./routes/chat-completions";
+import { createModelCallService } from "./model-calls/service";
 import { registerEditableArtifactRoutes } from "./routes/editable-artifacts";
+import { registerSessionArtifactAssociationRoutes } from "./routes/session-artifact-associations";
 import { registerVideoGenerationRoutes } from "./routes/video-generation";
 import { registerCanonicalHumanIdentityRoutes } from "./routes/canonical-human-identities";
 import { registerOrganizationMembershipRoutes } from "./routes/organization-memberships";
 import { registerOrganizationSessionRoutes } from "./routes/organization-sessions";
 import { registerOrganizationRecoveryRoutes } from "./routes/organization-recovery";
 import { registerManagedOnboardingRoutes } from "./routes/managed-onboarding";
+import {
+  registerManagedSignInMethodRoutes,
+  handleManagedSignInConnectCallback,
+} from "./routes/managed-sign-in-methods";
+import { registerNativeAppAuthRoutes } from "./routes/native-app-auth";
 import {
   registerManagedAuthSessionSetRoutes,
   requireManagedAuthProviderRouteAllowed,
   scrubManagedAuthProviderResponse,
 } from "./routes/managed-auth-session-sets";
 import { registerUserResourceAuthorityRoutes } from "./routes/user-resource-authorities";
-import { registerConnectionAuthorityRoutes } from "./routes/connection-authorities";
 import { projectClientModel } from "./model-catalog";
 import { createTranscriptionService } from "./transcription/service";
 import { createFfmpegTranscriptionSegmenter } from "./transcription/segmenter";
 import { registerSlackInteractionRoutes } from "./integrations/slack-interactions";
+import { resolveSignedStateSecret } from "./signed-state-secret";
 
 export { allowedCorsOrigin } from "./http/cors";
 
@@ -278,6 +442,25 @@ export async function resolveWorkspaceMcpRouteDeps(
   return { ...routeDeps, catalogSourceSettings, settings: resolvedCatalog.settings };
 }
 
+/**
+ * Signed browser state must verify on every API replica; see
+ * {@link resolveSignedStateSecret}. A per-process key is announced once so a
+ * multi-replica operator knows why such round trips fail.
+ */
+function signedStateSecret(
+  settings: AppDependencies["settings"],
+  observability: Pick<ReturnType<typeof createObservability>, "warn">,
+): string {
+  const resolved = resolveSignedStateSecret(settings);
+  if (resolved.source === "process_random" && !["local", "test"].includes(settings.environment)) {
+    observability.warn(
+      "Signed browser state uses a per-process key; set OPENGENI_GITHUB_APP_MANIFEST_STATE_SECRET or OPENGENI_INTEGRATIONS_STATE_SECRET before running more than one API replica",
+      { source: resolved.source },
+    );
+  }
+  return resolved.secret;
+}
+
 export function createAppComposition(deps: AppDependencies): {
   app: Hono;
   routeDeps: ApiRouteDeps;
@@ -291,14 +474,34 @@ export function createAppComposition(deps: AppDependencies): {
   // Pause) run inside API-originated db commands; install the boot-validated
   // rollout flag once for this process.
   configureChildLifecycleNotices({ enabled: deps.settings.childLifecycleNoticesEnabled });
+  // Sessions created by this process freeze their code_search decision from
+  // the boot-parsed deployment policy.
+  configureCodeSearchDeploymentPolicy(codeSearchDeploymentPolicy(deps.settings));
   const managedEmailTransport =
     deps.managedEmailTransport ?? createManagedEmailTransport(deps.settings);
   assertManagedEmailTransportMetadata(managedEmailTransport);
+  const observability =
+    deps.observability ?? createObservability(deps.settings, { component: "api" });
+  // Connect attempt state lives in the db layer; count its committed
+  // transitions with bounded provider/state labels (integration-connect-metrics).
+  setConnectAttemptTransitionObserver((transition) =>
+    observeConnectAttemptTransition(observability, transition),
+  );
+  const managedAuthNewSignupsGate = createManagedAuthNewSignupsGate({
+    db: deps.db,
+    settings: deps.settings,
+    observability,
+  });
   const managedAuth =
-    deps.managedAuth ?? createManagedAuth(deps.settings, deps.db, managedEmailTransport);
+    deps.managedAuth ??
+    createManagedAuth(deps.settings, deps.db, managedEmailTransport, {
+      observability,
+      newSignupsGate: managedAuthNewSignupsGate,
+    });
   const managedAuthSessionAdapter =
     deps.managedAuthSessionAdapter ??
     (managedAuth ? createBetterAuthSessionAdapter(managedAuth, deps.db) : null);
+  if (managedAuth) startManagedSignInNotificationDelivery(deps.db, managedEmailTransport);
   const objectStorage =
     deps.objectStorage === undefined ? createObjectStorage(deps.settings) : deps.objectStorage;
   let documentServices: DocumentServices | null = deps.documentServices ?? null;
@@ -369,8 +572,6 @@ export function createAppComposition(deps: AppDependencies): {
   // concrete for routes; it throws SandboxResumeError when sandboxBackend=none.
   const sandboxClient = deps.sandboxClient ?? createApiSandboxClient(deps.settings);
   const resumeBoxById = deps.resumeBoxById ?? makeResumeBoxById(sandboxClient);
-  const observability =
-    deps.observability ?? createObservability(deps.settings, { component: "api" });
   if (
     managedAuth &&
     deps.settings.managedAuthSessionSetMode !== "legacy" &&
@@ -389,12 +590,27 @@ export function createAppComposition(deps: AppDependencies): {
     }, MANAGED_AUTH_REAPER_INTERVAL_MS);
     (timer as ReturnType<typeof setInterval> & { unref?: () => void }).unref?.();
   }
+  if (deps.transcription === undefined) {
+    // Voice pricing problems never fail boot (workers share this config); the
+    // affected provider is withheld and the operator sees exactly why, once.
+    for (const issue of voiceInputPricingIssues(deps.settings)) {
+      observability.error(
+        `Voice input provider ${issue.providerId} is unavailable: ${issue.message}`,
+        {
+          providerId: issue.providerId,
+          env: issue.env,
+          reason: issue.reason,
+        },
+      );
+    }
+  }
   const transcription =
     deps.transcription === undefined
       ? createTranscriptionService({
           settings: deps.settings,
           db: deps.db,
           ...(deps.codexFetch ? { codexFetch: deps.codexFetch } : {}),
+          log: (message, attributes) => observability.error(message, attributes),
         })
       : deps.transcription;
   const transcriptionSegmenter =
@@ -403,12 +619,36 @@ export function createAppComposition(deps: AppDependencies): {
           ffmpegPath: deps.settings.voiceInputFfmpegPath,
         })
       : deps.transcriptionSegmenter;
+  const modelCalls =
+    deps.modelCalls === undefined
+      ? createModelCallService({
+          db: deps.db,
+          settings: deps.settings,
+          ...(deps.catalogSourceSettings
+            ? { catalogSourceSettings: deps.catalogSourceSettings }
+            : {}),
+          entitlements: deps.entitlements ?? null,
+          ...(deps.codexFetch ? { codexFetch: deps.codexFetch } : {}),
+          log: (message, attributes) => observability.error(message, attributes),
+          usageLimitMetrics: observability,
+        })
+      : deps.modelCalls;
+  registerProductUsageMetricBaselines(observability);
+  // Server-side presence counts managed people, so it exists only where
+  // canonical managed browser sessions exist. Writes are batched off the
+  // request path; see packages/core/src/user-presence.ts.
+  const userPresence =
+    deps.userPresence !== undefined
+      ? deps.userPresence
+      : deps.settings.productAccessMode === "managed"
+        ? createUserPresenceRecorder({ db: deps.db, observability })
+        : null;
   const routeDeps: ApiRouteDeps = {
     ...deps,
     resolveCatalogSettings: () => resolveCatalogSettings(deps.db, deps.settings),
     observability,
-    githubStateSecret:
-      deps.githubStateSecret ?? deps.settings.githubAppManifestStateSecret ?? crypto.randomUUID(),
+    userPresence,
+    githubStateSecret: deps.githubStateSecret ?? signedStateSecret(deps.settings, observability),
     managedAuth,
     managedAuthSessionAdapter,
     managedEmailTransport,
@@ -417,20 +657,101 @@ export function createAppComposition(deps: AppDependencies): {
     getDocumentServices,
     transcription,
     transcriptionSegmenter,
+    modelCalls,
     ...(sandboxClient ? { sandboxClient } : {}),
     resumeBoxById,
   };
   const app = new Hono();
-  const correlationIds = new WeakMap<Request, string>();
+  // Body/auth middleware may replace c.req.raw. The Hono context remains the
+  // same for the response, diagnostic and completion log of this request.
+  const correlationIds = new WeakMap<Context, string>();
+  const loggedHttpFailures = new WeakSet<Context>();
+  const logHttpFailure = (c: Context, status: number, code: ErrorCode, error?: unknown) => {
+    if (loggedHttpFailures.has(c)) return;
+    loggedHttpFailures.add(c);
+    const correlationId = correlationIds.get(c) ?? crypto.randomUUID();
+    const route = routeLabel(new URL(c.req.url).pathname, registeredHandlerRoutePath(c));
+    const input =
+      error === undefined
+        ? null
+        : {
+            code: "http_request_failed" as const,
+            stage: "http.request" as const,
+            error,
+          };
+    const diagnostic = input ? failureDiagnostic(input, deps.settings.deploymentRevision) : null;
+    // Diagnostics and logging are observers, never a new response failure.
+    try {
+      if (input && diagnostic) {
+        observability.recordFailureDiagnostic({ ...input, diagnosticId: diagnostic.diagnosticId });
+      }
+    } catch {
+      /* Preserve the original error response if the diagnostic sink fails. */
+    }
+    try {
+      observability.error("HTTP request failed", {
+        method: c.req.method,
+        route,
+        status,
+        correlationId,
+        errorCode: code,
+        errorClass: "HttpOperationError",
+        origin: "api",
+        reasonKind: diagnostic?.causes[0]?.kind ?? "Response",
+        ...(diagnostic ? { diagnosticId: diagnostic.diagnosticId } : {}),
+        ...(error === undefined ? {} : errorCauseAttributes(error)),
+      });
+      observability.incrementCounter({
+        name: "opengeni_http_errors_total",
+        help: "Total Opengeni HTTP request failures by bounded route, status, and stable code.",
+        labels: { route, status: String(status), code },
+      });
+    } catch {
+      /* Preserve the original error response if the logger fails. */
+    }
+  };
 
   app.use("*", async (c, next) => {
     const correlationId =
       boundedCorrelationId(c.req.header(OPENGENI_CORRELATION_HEADER)) ?? crypto.randomUUID();
-    correlationIds.set(c.req.raw, correlationId);
+    correlationIds.set(c, correlationId);
     c.header(OPENGENI_CORRELATION_HEADER, correlationId);
     await next();
   });
 
+  // Unauthenticated local mode: admit only requests addressed to this computer
+  // and, when a browser sent them, from this stack's web app (see
+  // http/local-browser-boundary.ts). Runs before CORS so a refused preflight
+  // carries no CORS grant, and logs each distinct refused Host or Origin once
+  // because the browser shows only a generic CORS error. Null outside local
+  // development.
+  const localBrowserBoundary = createLocalBrowserBoundary(deps.settings, {
+    warn: (message, attributes) => observability.warn(message, attributes),
+  });
+  if (localBrowserBoundary) {
+    app.use("*", async (c, next) => {
+      const rejection = localBrowserBoundary.rejection(c.req.raw);
+      if (rejection) {
+        throw new ApiHttpError(rejection.status, {
+          code: "forbidden",
+          message: rejection.message,
+          retryable: false,
+          details: { code: rejection.code },
+        });
+      }
+      await next();
+    });
+  }
+
+  // Better Auth keys its rate limits and session addresses on a request
+  // header. Drop any caller-supplied copy everywhere and stamp the trusted
+  // source address on managed-auth routes before any route derives a Better
+  // Auth request from this one.
+  app.use("*", async (c, next) => {
+    replaceTrustedClientAddressHeader(c, deps.settings, c.req.path.startsWith("/v1/auth/"));
+    await next();
+  });
+
   app.use("*", async (c, next) => {
     const oauthToken = mcpOAuthBearerToken(c.req.raw);
     if (
@@ -452,15 +773,28 @@ export function createAppComposition(deps: AppDependencies): {
       "X-OpenGeni-Access-Key",
       "X-OpenGeni-Api-Contract",
       "X-OpenGeni-Actor-Epoch",
+      // Resumable voice-input chunk integrity/timing (cross-origin embeds).
+      "X-OpenGeni-Chunk-Duration-Milliseconds",
+      "X-OpenGeni-Chunk-Sha256",
+      "X-OpenGeni-Chunk-Start-Milliseconds",
       "X-OpenGeni-Correlation-Id",
       "X-OpenGeni-Session-Csrf",
+      // Session scope for a session proxy; the API itself ignores it.
+      "X-OpenGeni-Session-Id",
+      // Set by Site bridges on every bridged request (Site Data frame clamp).
+      "X-OpenGeni-Site-Frame",
+      "X-OpenGeni-Site-Frame-Id",
       "X-OpenGeni-Site-Id",
       "X-OpenGeni-Site-Version",
       "X-OpenGeni-Subject",
+      "X-OpenGeni-User-Activity",
     ],
     exposeHeaders: [
       "Accept-Ranges",
       "Content-Range",
+      "Deprecation",
+      "Link",
+      "Sunset",
       "X-OpenGeni-Api-Contract",
       "X-OpenGeni-Actor-Epoch",
       "X-OpenGeni-Actor-State",
@@ -471,6 +805,8 @@ export function createAppComposition(deps: AppDependencies): {
       "X-OpenGeni-Event-Mode",
       "X-OpenGeni-Event-Result",
       "X-OpenGeni-Event-Result-Mode",
+      "X-OpenGeni-Export-Next-Cursor",
+      "X-OpenGeni-Export-Truncated",
       "X-OpenGeni-Forensic-Exact",
       "X-OpenGeni-Has-More",
       "X-OpenGeni-Next-After",
@@ -494,8 +830,25 @@ export function createAppComposition(deps: AppDependencies): {
       allowedCorsOrigin(deps.settings.corsAllowOriginRegex, origin) ? origin : null,
   });
 
+  const localCors = localBrowserBoundary
+    ? cors({
+        ...corsHeaders,
+        credentials: true,
+        origin: (origin, c) =>
+          localBrowserBoundary.originAllowed(origin, localBrowserRequestHost(c.req.raw))
+            ? origin
+            : null,
+      })
+    : null;
+
   app.use("*", (c, next) => {
     const origin = c.req.header("origin");
+    if (localCors) {
+      // The boundary above already refused every other origin. Local mode
+      // never answers with wildcard CORS: a request without credentials acts
+      // as the local user, so any site could otherwise read its responses.
+      return origin ? localCors(c, next) : next();
+    }
     const middleware =
       origin && allowedCorsOrigin(deps.settings.corsAllowOriginRegex, origin)
         ? credentialedCors
@@ -512,7 +865,19 @@ export function createAppComposition(deps: AppDependencies): {
     // Git packfiles must stay streaming and can legitimately exceed the JSON
     // request ceiling. The exact closed broker routes apply their own method,
     // content-type, authority, and idle-deadline checks.
-    if (isPersonalGitHubGitBrokerRequest(c.req.method, new URL(c.req.url).pathname)) {
+    const pathname = new URL(c.req.url).pathname;
+    if (isPersonalGitHubGitBrokerRequest(c.req.method, pathname)) {
+      await next();
+      return;
+    }
+    // The anonymous web beacons and Site Data uploads enforce their own limits
+    // on the streamed body; the generic ceiling would buffer far more first.
+    if (
+      isClientErrorReportRequest(c.req.method, pathname) ||
+      isAnalyticsConsentReportRequest(c.req.method, pathname) ||
+      isSessionHistoryImportRequest(c.req.method, pathname) ||
+      isSiteDataFileUploadRequest(c.req.method, pathname)
+    ) {
       await next();
       return;
     }
@@ -533,75 +898,126 @@ export function createAppComposition(deps: AppDependencies): {
     }
   });
 
+  // Public-route deprecations (docs/design/api-compatibility-policy.md) are
+  // advertised on every response of the affected route, errors included.
+  app.use("/v1/*", deprecationHeadersMiddleware());
+  // A pinned SDK must not be told about a revision it is built to reject; see
+  // the policy's contract-header rule. Registered before the contract fence so
+  // it observes the header that fence sets.
+  app.use("/v1/*", bearerApiContractHeaderCompatibility());
+
   app.use("*", async (c, next) => {
     const url = new URL(c.req.url);
-    const route = routeLabel(url.pathname);
-    const correlationId = correlationIds.get(c.req.raw) ?? crypto.randomUUID();
+    const route = routeLabel(url.pathname, registeredHandlerRoutePath(c));
+    const correlationId = correlationIds.get(c) ?? crypto.randomUUID();
     const start = performance.now();
-    const span = observability.startSpan(`HTTP ${c.req.method} ${route}`, {
-      "http.request.method": c.req.method,
-      "opengeni.route": route,
-    });
-    try {
-      await next();
-      const status = c.res.status || 200;
-      const durationSeconds = (performance.now() - start) / 1000;
-      observability.recordHttpRequest({
-        method: c.req.method,
-        route,
-        status,
-        durationSeconds,
-      });
-      span.end({
-        attributes: {
-          "http.response.status_code": status,
-          "opengeni.duration_ms": Math.round(durationSeconds * 1000),
-        },
-      });
-      observability.info("HTTP request completed", {
-        method: c.req.method,
-        route,
-        status,
-        durationMs: Math.round(durationSeconds * 1000),
-        traceId: span.traceId,
-        spanId: span.spanId,
-        correlationId,
-      });
-    } catch (error) {
-      const status = httpStatusForError(error);
-      const errorCode = errorCodeForStatus(status);
-      const durationSeconds = (performance.now() - start) / 1000;
-      observability.recordHttpRequest({
-        method: c.req.method,
-        route,
-        status,
-        durationSeconds,
-      });
-      observability.incrementCounter({
-        name: "opengeni_http_errors_total",
-        help: "Total OpenGeni HTTP request failures by bounded route, status, and stable code.",
-        labels: { route, status: String(status), code: errorCode },
-      });
-      span.end({
-        attributes: {
-          "http.response.status_code": status,
-          "opengeni.duration_ms": Math.round(durationSeconds * 1000),
-        },
-        error,
-      });
-      observability.error("HTTP request failed", {
-        method: c.req.method,
-        route,
-        status,
-        durationMs: Math.round(durationSeconds * 1000),
-        traceId: span.traceId,
-        spanId: span.spanId,
-        correlationId,
-        errorCode,
-        errorClass: "HttpOperationError",
-      });
-      throw error;
-    }
+    const span = observability.startSpan(
+      `HTTP ${c.req.method} ${route}`,
+      {
+        "http.request.method": c.req.method,
+        "opengeni.route": route,
+      },
+      { parent: null },
+    );
+    return await withMcpTelemetry(observability, span.traceId, () =>
+      withTraceContext(span, async () => {
+        try {
+          await next();
+          const status = c.res.status || 200;
+          // Hono normally handles exceptions in onError before next() resolves.
+          // Also cover a handler returning a 5xx without throwing.
+          if (status >= 500) logHttpFailure(c, status, errorCodeForStatus(status), c.error);
+          const durationSeconds = (performance.now() - start) / 1000;
+          observability.recordHttpRequest({
+            method: c.req.method,
+            route,
+            status,
+            durationSeconds,
+          });
+          span.end({
+            attributes: {
+              "http.response.status_code": status,
+              "opengeni.duration_ms": Math.round(durationSeconds * 1000),
+            },
+            ...(c.error ? { error: c.error } : {}),
+          });
+          const rejection =
+            status >= 400
+              ? httpRejectionFactsFromEnvelope(
+                  await readRejectionEnvelope(c.res),
+                  errorCodeForStatus(status),
+                )
+              : null;
+          observeInteractionRouteOutcome(observability, {
+            method: c.req.method,
+            route,
+            status,
+            durationMs: durationSeconds * 1000,
+            rejectionReason: rejection?.reason,
+          });
+          if (isOAuthCallbackRoute(route)) {
+            observeOAuthCallback(observability, {
+              route,
+              status,
+              location: c.res.headers.get("location"),
+            });
+          }
+          if (rejection) {
+            observability.recordHttpRejection({
+              method: c.req.method,
+              route,
+              status,
+              code: rejection.code,
+              reason: rejection.reason,
+            });
+          }
+          observability.info("HTTP request completed", {
+            method: c.req.method,
+            route,
+            status,
+            durationMs: Math.round(durationSeconds * 1000),
+            traceId: span.traceId,
+            spanId: span.spanId,
+            correlationId,
+            ...(rejection ? rejectionLogAttributes(rejection) : {}),
+          });
+        } catch (error) {
+          const status = httpStatusForError(error);
+          const errorCode = errorCodeForStatus(status);
+          const durationSeconds = (performance.now() - start) / 1000;
+          observability.recordHttpRequest({
+            method: c.req.method,
+            route,
+            status,
+            durationSeconds,
+          });
+          const rejection = httpRejectionFactsFromError(error, errorCode);
+          observeInteractionRouteOutcome(observability, {
+            method: c.req.method,
+            route,
+            status,
+            durationMs: durationSeconds * 1000,
+            rejectionReason: rejection.reason,
+          });
+          observability.recordHttpRejection({
+            method: c.req.method,
+            route,
+            status,
+            code: rejection.code,
+            reason: rejection.reason,
+          });
+          span.end({
+            attributes: {
+              "http.response.status_code": status,
+              "opengeni.duration_ms": Math.round(durationSeconds * 1000),
+            },
+            error,
+          });
+          logHttpFailure(c, status, errorCode, error);
+          throw error;
+        }
+      }),
+    );
   });
 
   const accessKeyBoundary = requireAccessKey(deps.settings);
@@ -616,17 +1032,66 @@ export function createAppComposition(deps: AppDependencies): {
     return await accessKeyBoundary(c, next);
   });
 
+  // Malformed JSON in a client request body is a 400 wherever a route reads it.
+  app.use("/v1/*", async (c, next) => {
+    tagRequestJsonParseErrors(c);
+    await next();
+  });
+
+  // A request no registered handler answers is a 404 (or a 405 when the path
+  // exists for other methods) before any authentication, authorization, or
+  // contract middleware can turn it into a misleading 401/409/503. This runs
+  // after the deployment perimeter so an unauthenticated caller of a
+  // key-protected deployment learns nothing new.
+  app.use("/v1/*", async (c, next) => {
+    const unmatched = unmatchedRoute(app, c);
+    if (!unmatched) {
+      await next();
+      return;
+    }
+    const requestId = correlationIds.get(c) ?? crypto.randomUUID();
+    c.header(OPENGENI_API_CONTRACT_HEADER, OPENGENI_API_CONTRACT_REVISION);
+    if (unmatched.status === 405) c.header("allow", unmatched.allow.join(", "));
+    return c.json(
+      ErrorEnvelope.parse({
+        error: {
+          status: unmatched.status,
+          code: "not_found",
+          message:
+            unmatched.status === 405
+              ? `Method ${c.req.method} is not supported for this resource. Allowed: ${unmatched.allow.join(", ")}.`
+              : "Resource not found.",
+          retryable: false,
+          requestId,
+        },
+      }),
+      unmatched.status,
+    );
+  });
+
+  // A personal API key acts as its owner. Verify it and stamp this exact raw
+  // Request before any route resolves access; the body limit above may have
+  // rebuilt the Request, so this runs after it.
+  app.use("/v1/*", async (c, next) => {
+    await stampPersonalApiKeyRequest(c.req.raw, deps);
+    await next();
+  });
+
   app.use("/v1/*", async (c, next) => {
     c.header(OPENGENI_API_CONTRACT_HEADER, OPENGENI_API_CONTRACT_REVISION);
     if (
       deps.settings.environment !== "test" &&
-      isApiContractProtectedMutation(c.req.method, new URL(c.req.url).pathname) &&
-      c.req.header(OPENGENI_API_CONTRACT_HEADER) !== OPENGENI_API_CONTRACT_REVISION
+      apiContractAdmission({
+        method: c.req.method,
+        pathname: new URL(c.req.url).pathname,
+        authorization: c.req.header("authorization"),
+        claimedRevision: c.req.header(OPENGENI_API_CONTRACT_HEADER),
+      }) === "reject"
     ) {
       return c.json(
         {
           code: "API_CONTRACT_CHANGED",
-          message: "OpenGeni updated. Reload this client before changing state.",
+          message: "Opengeni updated. Reload this client before changing state.",
           apiContractRevision: OPENGENI_API_CONTRACT_REVISION,
         },
         409,
@@ -669,10 +1134,72 @@ export function createAppComposition(deps: AppDependencies): {
   // wildcard handler or the provider returns its own 404 first.
   registerManagedOnboardingRoutes(app, routeDeps);
   registerManagedAuthSessionSetRoutes(app, routeDeps);
+  registerManagedSignInMethodRoutes(app, routeDeps);
+  registerNativeAppAuthRoutes(app, routeDeps);
   if (managedAuth) {
     app.on(["GET", "POST"], "/v1/auth/*", async (c) => {
       const pathname = new URL(c.req.url).pathname;
       const oauthCallbackProvider = managedAuthOAuthCallbackProvider(pathname);
+      if (
+        pathname === "/v1/auth/sign-up/email" &&
+        c.req.method === "POST" &&
+        !(await managedAuthNewSignupsGate.signupsOpen())
+      ) {
+        // Launch-load safety switch: refuse before Better Auth hashes the
+        // password or sends mail. Better Auth's own disableSignUp flags and
+        // the user-create hook remain the backstop for every other path.
+        return managedAuthNewSignupsPausedResponse();
+      }
+      if (pathname === "/v1/auth/sign-in/social" && c.req.method === "POST") {
+        const body = await c.req.raw
+          .clone()
+          .json()
+          .catch(() => null);
+        if (
+          !body ||
+          !["google", "github"].includes(body.provider) ||
+          Object.prototype.hasOwnProperty.call(body, "idToken")
+        ) {
+          return c.json(
+            {
+              code: "SIGN_IN_METHOD_OAUTH_REDIRECT_REQUIRED",
+              message: "Use the browser OAuth sign-in redirect",
+            },
+            403,
+          );
+        }
+      }
+      if (oauthCallbackProvider) {
+        const connectResponse = await handleManagedSignInConnectCallback(
+          c,
+          routeDeps,
+          oauthCallbackProvider,
+        );
+        if (connectResponse) return connectResponse;
+      }
+      if (
+        new Set([
+          "link-social",
+          "unlink-account",
+          "list-accounts",
+          "set-password",
+          "change-password",
+          "change-email",
+          "update-user",
+          "delete-user",
+          "get-access-token",
+          "refresh-token",
+          "account-info",
+        ]).has(pathname.slice("/v1/auth/".length))
+      ) {
+        return c.json(
+          {
+            code: "SIGN_IN_METHOD_PRODUCT_ROUTE_REQUIRED",
+            message: "Use personal sign-in method settings",
+          },
+          403,
+        );
+      }
       if (deps.settings.managedAuthSessionSetMode === "legacy") {
         return oauthCallbackProvider
           ? await runManagedAuthProvider(
@@ -835,37 +1362,151 @@ export function createAppComposition(deps: AppDependencies): {
     return c.json(result, result.ok ? 200 : 503);
   });
 
-  app.get("/metrics", async (c) =>
-    c.text(await observability.prometheusMetrics(), 200, {
-      "content-type": "text/plain; version=0.0.4; charset=utf-8",
-    }),
-  );
+  if (publicListenerServesMetrics(deps.settings)) {
+    registerPrometheusMetricsRoute(app, observability);
+  }
 
   registerMcpOAuthRoutes(app, routeDeps);
 
+  registerClientErrorRoutes(app, { observability, settings: deps.settings });
+  registerAnalyticsConsentRoutes(app, { observability, settings: deps.settings });
+
   app.get("/v1/config/client", async (c) => {
     c.header("cache-control", "no-store");
     const resolvedCatalog = await resolveCatalogSettings(deps.db, deps.settings);
-    const baseCatalogSettings = resolvedCatalog.settings;
-    const codexCatalogSettings = baseCatalogSettings.codexSubscriptionEnabled
-      ? withCodexCatalogProvider(baseCatalogSettings)
-      : baseCatalogSettings;
-    const catalogSettings = baseCatalogSettings.supergrokSubscriptionEnabled
-      ? withXaiSubscriptionCatalogProvider(codexCatalogSettings)
-      : codexCatalogSettings;
+    let catalogSettings = resolvedCatalog.settings;
+    let selections = resolveWorkspaceModelSelection({
+      settings: catalogSettings,
+      policy: null,
+      codexSubscriptionActive: false,
+    });
+    let defaultSelection = selectDefaultSessionModel({
+      settings: catalogSettings,
+      selections,
+      workspaceDefaults: null,
+      creditsAvailable: false,
+    });
+    let modelSelectionForbidden = false;
+    let voiceInputAvailable = false;
+    let voiceInputProviders: string[] = [];
+    const requestedWorkspaceId = c.req.query("workspaceId");
+    if (requestedWorkspaceId !== undefined && requestedWorkspaceId.trim() === "") {
+      throw new HTTPException(422, { message: "workspaceId must not be empty" });
+    }
+    const callerScoped =
+      requestedWorkspaceId !== undefined ||
+      deps.settings.productAccessMode !== "managed" ||
+      c.req.header("authorization") !== undefined ||
+      // Browser bootstrap precedes session-set reconciliation. A cookie alone
+      // cannot scope this public read (broker/changed actors need an epoch).
+      c.req.header("x-opengeni-actor-epoch") !== undefined ||
+      c.req.header("x-opengeni-external-actor") !== undefined;
+    if (callerScoped) {
+      let context: Awaited<ReturnType<typeof requireAccessContext>> | null = null;
+      try {
+        context = await requireAccessContext(c, routeDeps);
+      } catch (error) {
+        // A stale browser cookie must not break the signed-out bootstrap.
+        // Explicit workspace/bearer/external-actor requests fail closed.
+        if (
+          !(error instanceof HTTPException && error.status === 401) ||
+          requestedWorkspaceId !== undefined ||
+          c.req.header("authorization") !== undefined ||
+          c.req.header("x-opengeni-actor-epoch") !== undefined ||
+          c.req.header("x-opengeni-external-actor") !== undefined
+        ) {
+          throw error;
+        }
+      }
+      const workspaceId = requestedWorkspaceId ?? context?.defaultWorkspaceId;
+      if (context && workspaceId) {
+        const grant = await requireAccessGrant(c, routeDeps, workspaceId);
+        await withAccessGrantSessionRlsContext(routeDeps, grant, async () => {
+          catalogSettings = (
+            await resolveWorkspaceCatalogSettings(deps.db, deps.settings, {
+              accountId: grant.accountId,
+              workspaceId,
+            })
+          ).settings;
+          selections = await resolveCallerWorkspaceModelSelections(
+            deps.db,
+            catalogSettings,
+            { accountId: grant.accountId, workspaceId, subjectId: grant.subjectId },
+            { observeAvailability: true },
+          );
+          if (!hasPermission(grant.permissions, "sessions:create")) {
+            modelSelectionForbidden = true;
+            selections = [];
+          }
+          const workspace = await getWorkspace(deps.db, workspaceId);
+          const voicePreferences = WorkspaceVoiceInputSettings.safeParse(
+            workspace?.settings.voiceInput,
+          ).data;
+          const voiceContext = {
+            workspaceId,
+            subjectId: grant.subjectId,
+            preferredProvider: voicePreferences?.preferredProvider,
+            fallbackEnabled: voicePreferences?.fallbackEnabled,
+          };
+          if (hasPermission(grant.permissions, "sessions:create") && transcription) {
+            // `providers` lists every ready provider (the workspace picker);
+            // `available` honours the workspace preference and fallback, so
+            // the composer never offers a mic every request would refuse.
+            voiceInputProviders = (await transcription.availableProviderIds?.(voiceContext)) ?? [];
+            voiceInputAvailable =
+              voiceInputProviders.length > 0 &&
+              (await Promise.resolve(transcription.available(voiceContext)).catch(() => false));
+          }
+
+          defaultSelection = await resolveDefaultSessionModelForSelections(deps.db, {
+            settings: catalogSettings,
+            accountId: grant.accountId,
+            workspaceSettings: workspace?.settings ?? {},
+            selections,
+          });
+        });
+      } else if (context) {
+        // An organization key has no implicit workspace. Do not advertise
+        // another workspace's authority; it can request an exact workspace.
+        selections = [];
+        modelSelectionForbidden = true;
+      }
+    }
+    const models = selections.filter(isWorkspaceModelAdmissible);
+    const defaultModel = defaultSelection.model;
+    const fallbackDefinition = selections.find(
+      ({ model }) => model.id === defaultModel || model.aliases.includes(defaultModel),
+    );
+    const legacyModelFallback =
+      models.length === 0
+        ? {
+            id: defaultModel,
+            availability: {
+              status: "unavailable" as const,
+              selectable: false as const,
+              reason: modelSelectionForbidden
+                ? ("policy_blocked" as const)
+                : (fallbackDefinition?.availability.reason ?? ("unsupported" as const)),
+              checkedAt: fallbackDefinition?.availability.checkedAt ?? null,
+            },
+          }
+        : undefined;
     return c.json(
       ClientConfig.parse({
         deploymentRevision: deps.settings.deploymentRevision,
+        claudeSubscriptionEnabled: deps.settings.claudeSubscriptionEnabled,
+        connectedMachines: deps.settings.sandboxSelfhostedEnabled,
         apiContractRevision: OPENGENI_API_CONTRACT_REVISION,
         ...(deps.settings.serverVersion ? { serverVersion: deps.settings.serverVersion } : {}),
-        defaultModel: canonicalizeConfiguredModelId(catalogSettings, catalogSettings.openaiModel),
-        allowedModels: configuredAllowedModels(catalogSettings),
-        // Provider-grouped model list for the picker. configuredModels() carries the
-        // union of the built-in allow-list and every registry provider's models, in
-        // selection order (default model first); project each to the client-safe
-        // provider-blind ClientModel shape (execution topology remains server-side).
-        models: configuredModels(catalogSettings).map(projectClientModel),
-        defaultReasoningEffort: deps.settings.openaiReasoningEffort,
+        defaultModel,
+        allowedModels: models.length > 0 ? models.map(({ model }) => model.id) : [defaultModel],
+        ...(legacyModelFallback ? { legacyModelFallback } : {}),
+        // Availability remains an observation hint, not the admission predicate.
+        models: models.map(({ model, availability }) => ({
+          ...projectClientModel(model),
+          availability,
+        })),
+        defaultReasoningEffort: defaultSelection.reasoningEffort,
         allowedReasoningEfforts: configuredAllowedReasoningEfforts(deps.settings),
         defaultSandboxBackend: deps.settings.sandboxBackend,
         mcpServers: deps.settings.mcpServers.map((server) => ({
@@ -873,15 +1514,29 @@ export function createAppComposition(deps: AppDependencies): {
           name: server.name ?? server.id,
         })),
         firstPartyMcpTools: resolveFirstPartyMcpToolPolicy(deps.settings),
+        codeSearch: codeSearchDeploymentPolicy(deps.settings),
+        // Archiving needs object storage; without it the worker never archives.
+        ...(deps.settings.sessionArchiveEnabled && objectStorage
+          ? {
+              sessionArchive: {
+                enabled: true as const,
+                idleDays: deps.settings.sessionArchiveIdleDays,
+              },
+            }
+          : {}),
+        agentConfig: clientAgentConfig(deps.settings),
+        // Producer capability for per-task usage limits. Clients only offer a
+        // new limit when enabled; existing limits stay visible and removable.
+        sessionUsageLimits: {
+          enabled: sessionUsageLimitsProducerEnabled(deps.settings),
+        },
         fileUploads: {
           enabled: objectStorage !== null,
           maxSizeBytes: objectStorage?.maxSinglePutSizeBytes ?? 5_000_000_000,
         },
         voiceInput: {
-          providers: resolveVoiceInputProviderRegistry(deps.settings).map(
-            (provider) => provider.id,
-          ),
-          available: (await transcription?.available()) ?? false,
+          providers: voiceInputProviders,
+          available: voiceInputAvailable,
           maxDurationSeconds: deps.settings.voiceInputMaxDurationSeconds,
           maxSizeBytes: deps.settings.voiceInputMaxSizeBytes,
           acceptedMimeTypes: [...VOICE_INPUT_ACCEPTED_MIME_TYPES],
@@ -889,7 +1544,7 @@ export function createAppComposition(deps: AppDependencies): {
           objectStorage &&
           transcription &&
           transcriptionSegmenter &&
-          (await transcription.available()) &&
+          voiceInputAvailable &&
           (await transcriptionSegmenter.available())
             ? {
                 resumable: {
@@ -907,16 +1562,126 @@ export function createAppComposition(deps: AppDependencies): {
         productAccessMode: deps.settings.productAccessMode,
         billingMode: deps.settings.billingMode,
         managedAuthSessionSetMode: deps.settings.managedAuthSessionSetMode,
-        auth: clientAuthConfig(deps.settings),
+        auth: clientAuthConfig(
+          deps.settings,
+          deps.settings.productAccessMode === "managed"
+            ? await managedAuthNewSignupsGate.signupsOpen()
+            : true,
+        ),
+        documentationUrl: deps.settings.documentationUrl,
         analytics: clientAnalyticsConfig(deps.settings),
+        legal: clientLegalConfig(deps.settings),
+        ...(deps.settings.supportEmail ? { supportEmail: deps.settings.supportEmail } : {}),
         // Channel-A structured services (P4.4) ride exec/readFile/createEditor,
         // available on every real backend; `none` has no box so they are all off.
         // Per-session availability is still negotiated on /stream-capabilities.
         structuredServices: structuredServicesHint(deps.settings.sandboxBackend),
+        sites: clientSitesConfig(deps.settings),
       }),
     );
   });
 
+  // The organization MCP server: every public action, as a person who signed
+  // in (capped by their connection's access setting) or as an organization
+  // API key. Each action runs the real route in this process.
+  app.all(ORGANIZATION_MCP_PATH, async (c) => {
+    let boundedRequest: Request;
+    try {
+      boundedRequest = await boundedMcpRequest(c.req.raw);
+    } catch (error) {
+      if (error instanceof McpPayloadTooLargeError) {
+        throw new HTTPException(413, { message: "MCP request body exceeds the safety limit" });
+      }
+      throw error;
+    }
+    const challenge = () => {
+      if (deps.settings.mcpOauthEnabled) {
+        c.header("www-authenticate", mcpOAuthAuthenticateHeader(routeDeps, ORGANIZATION_MCP_PATH));
+      }
+    };
+    let caller: OrganizationMcpCaller;
+    try {
+      const connection = await resolveOrganizationMcpOAuthAccess(routeDeps, c.req.raw);
+      const personalKey = connection
+        ? null
+        : verifiedDelegatedHumanAuthorizationForRequest(c.req.raw);
+      if (connection) {
+        caller = {
+          kind: "person",
+          accountId: connection.accountId,
+          subjectId: connection.subjectId,
+          access: connection.organizationAccess,
+        };
+      } else if (personalKey) {
+        // A personal API key: the person who created it, with its access.
+        // Each action rechecks their live access, exactly as for sign-in.
+        await requireAccessContext(c, routeDeps);
+        caller = {
+          kind: "person",
+          accountId: personalKey.organizationId,
+          subjectId: personalKey.subjectId,
+          access: normalizeOrganizationAccessPolicy({
+            preset: "custom",
+            permissions: [...personalKey.permissions],
+            workspaceScope: personalKey.workspaceScope,
+          }),
+        };
+      } else {
+        const context = await requireAccessContext(c, routeDeps);
+        const authorization = c.req.header("authorization");
+        if (!accountScopedApiKeyWorkspaceAuthority(context) || !authorization) {
+          throw new HTTPException(403, {
+            message:
+              "Connect with Opengeni sign-in, a personal API key or an organization API key.",
+          });
+        }
+        caller = {
+          kind: "key",
+          authorization,
+          accessKey: c.req.header("x-opengeni-access-key") ?? null,
+        };
+      }
+    } catch (error) {
+      if (error instanceof HTTPException && error.status === 401) challenge();
+      throw error;
+    }
+    // Stateless JSON-response transport: there is no server-to-client stream.
+    // Answering GET with an empty 200 made clients (Claude) reconnect every
+    // second; refuse it after authorization, as the workspace endpoint does.
+    if (c.req.method === "GET") {
+      const version = c.req.header("mcp-protocol-version");
+      if (version && !SUPPORTED_PROTOCOL_VERSIONS.includes(version)) {
+        return c.json(
+          {
+            jsonrpc: "2.0",
+            id: null,
+            error: { code: -32000, message: "Unsupported protocol version." },
+          },
+          400,
+        );
+      }
+      return c.json(
+        { jsonrpc: "2.0", id: null, error: { code: -32000, message: "Method not allowed." } },
+        405,
+        { allow: "POST" },
+      );
+    }
+    const transport = new WebStandardStreamableHTTPServerTransport({ enableJsonResponse: true });
+    const mcp = buildOrganizationMcpServer({
+      caller,
+      origin: new URL(c.req.url).origin,
+      publicOrigin: canonicalPublicOrigin(deps.settings.publicBaseUrl),
+      dispatch: async (request) => await app.fetch(request, c.env),
+      signal: c.req.raw.signal,
+    });
+    try {
+      await mcp.connect(transport);
+      return await handleMcpRequestWithClientAbort(transport, boundedRequest, c.req.raw.signal);
+    } finally {
+      await mcp.close().catch(() => undefined);
+    }
+  });
+
   app.use("/v1/workspaces/:workspaceId/*", async (c, next) => {
     const workspaceId = c.req.param("workspaceId");
     if (workspaceRequestRequiresCodexAccountPrevalidation(c.req.raw)) {
@@ -929,12 +1694,47 @@ export function createAppComposition(deps: AppDependencies): {
       await next();
       return;
     }
-    const grant = await requireAccessGrant(c, routeDeps, workspaceId);
+    // Match Hono's decoded routing path before first-use membership and RLS.
+    const permission =
+      c.req.method === "PUT" &&
+      /^\/v1\/workspaces\/[^/]+\/artifact-catalog\/[^/]+\/[^/]+\/pin$/.test(c.req.path)
+        ? "artifacts:publish"
+        : undefined;
+    const grant = await requireAccessGrant(c, routeDeps, workspaceId, permission);
     await withAccessGrantSessionRlsContext(routeDeps, grant, next);
   });
 
+  // Requests a host forwarded from a Site frame: SITE_OPERATIONS only, only
+  // the frame's own sessions, and the validated Site origin as provenance.
+  app.use("/v1/workspaces/:workspaceId/*", siteFrameGuard(routeDeps));
+  // Agents started from a Site page do not learn or widen access: their
+  // workspace writes are held to an allowlist (their tools, conversations,
+  // files and content); everything else is refused.
+  app.use("/v1/workspaces/:workspaceId/*", siteClampedAgentGuard(routeDeps));
+
   app.all("/v1/workspaces/:workspaceId/mcp", async (c) => {
     const workspaceId = c.req.param("workspaceId");
+    // This endpoint uses a fresh stateless JSON-response transport per POST;
+    // there is no persistent server-to-client stream. Refuse GET only after
+    // the existing OAuth/workspace/session authorization, before tool setup.
+    const unsupportedGet = () => {
+      const version = c.req.header("mcp-protocol-version");
+      if (version && !SUPPORTED_PROTOCOL_VERSIONS.includes(version)) {
+        return c.json(
+          {
+            jsonrpc: "2.0",
+            id: null,
+            error: { code: -32000, message: "Unsupported protocol version." },
+          },
+          400,
+        );
+      }
+      return c.json(
+        { jsonrpc: "2.0", id: null, error: { code: -32000, message: "Method not allowed." } },
+        405,
+        { allow: "POST" },
+      );
+    };
     let boundedRequest: Request;
     try {
       boundedRequest = await boundedMcpRequest(c.req.raw);
@@ -960,6 +1760,7 @@ export function createAppComposition(deps: AppDependencies): {
     }
     if (oauthAccess) {
       return await withAccessGrantSessionRlsContext(routeDeps, oauthAccess.grant, async () => {
+        if (c.req.method === "GET") return unsupportedGet();
         const prepared = await prepareMcpOAuthWorkspaceToolGateway(
           routeDeps,
           oauthAccess.grant,
@@ -994,73 +1795,203 @@ export function createAppComposition(deps: AppDependencies): {
       throw error;
     }
     const grant = authorization.grant;
-    return await withAccessGrantSessionRlsContext(routeDeps, grant, async () => {
-      const boundSessionId = grant.metadata?.sessionId;
-      if (typeof boundSessionId === "string") {
-        try {
-          await requireSessionAuthorization(routeDeps, grant, {
-            sessionId: boundSessionId,
-            operation: "session.first_party_mcp.call",
-            surface: "first_party_mcp",
-          });
-        } catch (error) {
-          if (error instanceof SessionAuthorizationDeniedError) {
-            throw new HTTPException(404, { message: "session not found" });
-          }
-          if (error instanceof SessionAuthorizationUnavailableError) {
-            throw new HTTPException(503, {
-              message: "session authorization is unavailable",
+    // Admin actions dispatch back into this API as a person. Capture the
+    // context now, before this request takes on the agent's database and
+    // billing scope, so none of it carries into those actions.
+    const outsideAgentContext = AsyncLocalStorage.snapshot();
+    // The agent-attempt context, this route check, and a tool's own entry check
+    // re-read the same caller session and attempt; share those reads.
+    return await withSessionAuthorizationReadReuse((reads) =>
+      withAccessGrantSessionRlsContext(routeDeps, grant, async () => {
+        const boundSessionId = grant.metadata?.sessionId;
+        if (typeof boundSessionId === "string") {
+          try {
+            await requireSessionAuthorization(routeDeps, grant, {
+              sessionId: boundSessionId,
+              operation: "session.first_party_mcp.call",
+              surface: "first_party_mcp",
             });
+          } catch (error) {
+            if (error instanceof SessionAuthorizationDeniedError) {
+              throw new HTTPException(404, { message: "session not found" });
+            }
+            if (error instanceof SessionAuthorizationUnavailableError) {
+              throw new HTTPException(503, {
+                message: "session authorization is unavailable",
+              });
+            }
+            throw error;
           }
-          throw error;
         }
-      }
-      const workspace = await getWorkspace(routeDeps.db, workspaceId);
-      const workspaceMemoryEnabled = resolveWorkspaceMemoryEnabled(workspace?.settings);
-      const workspaceMemoryPromptMode = resolveWorkspaceMemoryPromptMode();
-      const transport = new WebStandardStreamableHTTPServerTransport({
-        enableJsonResponse: true,
-      });
-      if (!grantUsesAttemptScopedMcp(grant)) {
-        const prepared = await prepareWorkspaceToolGateway(routeDeps, authorization);
-        const mcp = buildWorkspaceToolGatewayMcpServer(prepared, grant, routeDeps.observability);
+        if (c.req.method === "GET") return unsupportedGet();
+        reads.handOffToToolDispatch();
+        const workspace = await getWorkspace(routeDeps.db, workspaceId);
+        const workspaceMemoryEnabled = resolveWorkspaceMemoryEnabled(workspace?.settings);
+        const workspaceMemoryPromptMode = resolveWorkspaceMemoryPromptMode();
+        const transport = new WebStandardStreamableHTTPServerTransport({
+          enableJsonResponse: true,
+        });
+        if (!grantUsesAttemptScopedMcp(grant)) {
+          const prepared = await prepareWorkspaceToolGateway(routeDeps, authorization);
+          const mcp = buildWorkspaceToolGatewayMcpServer(prepared, grant, routeDeps.observability);
+          try {
+            await mcp.connect(transport);
+            return await handleMcpRequestWithClientAbort(
+              transport,
+              boundedRequest,
+              c.req.raw.signal,
+            );
+          } finally {
+            await Promise.allSettled([mcp.close(), prepared.close()]);
+          }
+        }
+        const mcpDeps = await resolveWorkspaceMcpRouteDeps(routeDeps, grant);
+        // The bound session's frozen Memory selector (migration 0427) decides
+        // which Memory tools the attempt receives and which typed layers they
+        // read and write. A missing row resolves to no Memory tools.
+        const sessionMemory =
+          typeof boundSessionId === "string"
+            ? ((await resolveSessionMemoryAgentScope(
+                routeDeps.db,
+                workspaceId,
+                boundSessionId,
+                grant.metadata,
+              )) ?? {
+                mode: "off" as const,
+                userSubjectId: null,
+                rootSessionId: null,
+              })
+            : null;
+        // Checked live: allowed by the organization, given to this session,
+        // and the person who gave it is still an owner or admin.
+        const sessionAdminAccess =
+          typeof boundSessionId === "string" &&
+          (await resolveSessionAdminAuthority(routeDeps.db, {
+            accountId: grant.accountId,
+            workspaceId,
+            sessionId: boundSessionId,
+          }))
+            ? {
+                origin: new URL(c.req.url).origin,
+                dispatch: (request: Request) =>
+                  outsideAgentContext(async () => await app.fetch(request, c.env)),
+                signal: c.req.raw.signal,
+              }
+            : null;
+        const mcp = buildOpenGeniMcpServer(mcpDeps, grant, {
+          requestOrigin: new URL(c.req.url).origin,
+          workspaceMemoryEnabled,
+          workspaceMemoryPromptMode,
+          sessionMemory,
+          sessionAdminAccess,
+        });
+        // Bind tool handlers' `extra.signal` to the HTTP client's connection: a
+        // worker that drops the call (Steer/Pause) aborts a blocking tool here.
+        // Each POST builds a fresh server; close it once the JSON response is
+        // ready, like the gateway paths above, so it can't outlive the request.
         try {
           await mcp.connect(transport);
           return await handleMcpRequestWithClientAbort(transport, boundedRequest, c.req.raw.signal);
         } finally {
-          await Promise.allSettled([mcp.close(), prepared.close()]);
+          await mcp.close().catch(() => undefined);
         }
-      }
-      const mcpDeps = await resolveWorkspaceMcpRouteDeps(routeDeps, grant);
-      // The bound session's frozen Memory selector (migration 0427) decides
-      // which Memory tools the attempt receives and which typed layers they
-      // read and write. A missing row resolves to no Memory tools.
-      const sessionMemory =
-        typeof boundSessionId === "string"
-          ? ((await resolveSessionMemoryAgentScope(
-              routeDeps.db,
-              workspaceId,
-              boundSessionId,
-              grant.metadata,
-            )) ?? {
-              mode: "off" as const,
-              userSubjectId: null,
-              rootSessionId: null,
-            })
-          : null;
-      const mcp = buildOpenGeniMcpServer(mcpDeps, grant, {
-        requestOrigin: new URL(c.req.url).origin,
-        workspaceMemoryEnabled,
-        workspaceMemoryPromptMode,
-        sessionMemory,
-      });
-      await mcp.connect(transport);
-      // Bind tool handlers' `extra.signal` to the HTTP client's connection: a
-      // worker that drops the call (Steer/Pause) aborts a blocking tool here.
-      return await handleMcpRequestWithClientAbort(transport, boundedRequest, c.req.raw.signal);
-    });
+      }),
+    );
   });
 
+  // Known calls need no preceding full-catalog discovery or replica-local attestation.
+  for (const operation of ["resolve", "invoke", "target-approvals", "manifest"] as const) {
+    app.post(`/v1/workspaces/:workspaceId/tools/${operation}`, async (c) => {
+      const workspaceId = c.req.param("workspaceId");
+      const authorization = await requireAccessGrantAuthorization(
+        c,
+        routeDeps,
+        workspaceId,
+        "workspace:read",
+      );
+      let fence: TargetAuthorityFence | undefined;
+      const options = {
+        signal: c.req.raw.signal,
+        // Human callers keep their fresh grant. Organization keys and external
+        // actors are re-read by the request fence itself.
+        reauthorize: async () => {
+          const live = await requireFreshAccessGrant(c, routeDeps, workspaceId, "workspace:read");
+          const original = authorization.grant;
+          if (
+            live.accountId !== original.accountId ||
+            live.subjectId !== original.subjectId ||
+            live.principalKind !== original.principalKind ||
+            original.permissions.some((permission) => !hasPermission(live.permissions, permission))
+          )
+            throw new HTTPException(403, { message: "tool_access_changed" });
+        },
+        onFence: (created: TargetAuthorityFence) => {
+          fence = created;
+        },
+      };
+      const body: unknown = await c.req.json().catch(() => null);
+      const schema =
+        operation === "resolve"
+          ? ToolGatewayResolveRequest
+          : operation === "invoke"
+            ? ToolGatewayInvokeRequest
+            : operation === "manifest"
+              ? ToolGatewayManifestRequest
+              : ToolGatewayTargetApprovalRequest;
+      if (!schema.safeParse(body).success)
+        throw new HTTPException(400, { message: "Invalid targeted tool request" });
+      c.header("cache-control", "no-store");
+      const started = performance.now();
+      let outcome: "ok" | "failed" = "failed";
+      try {
+        const response =
+          operation === "resolve"
+            ? await resolveWorkspaceToolTarget(
+                routeDeps,
+                authorization,
+                ToolGatewayResolveRequest.parse(body),
+                options,
+              )
+            : operation === "invoke"
+              ? await invokeWorkspaceToolTarget(
+                  routeDeps,
+                  authorization,
+                  ToolGatewayInvokeRequest.parse(body),
+                  options,
+                )
+              : operation === "manifest"
+                ? await resolveWorkspaceToolManifest(
+                    routeDeps,
+                    authorization,
+                    ToolGatewayManifestRequest.parse(body),
+                    options,
+                  )
+                : await approveWorkspaceToolTarget(
+                    routeDeps,
+                    authorization,
+                    ToolGatewayTargetApprovalRequest.parse(body),
+                    options,
+                  );
+        c.header(
+          "server-timing",
+          `gw-target;dur=${(performance.now() - started).toFixed(1)};desc="${operation}"` +
+            (fence
+              ? `, gw-fence;dur=${fence.stats.durationMs.toFixed(1)};desc="${fence.stats.evaluations}"`
+              : ""),
+        );
+        outcome = "ok";
+        return c.json(response, operation === "target-approvals" ? 201 : 200);
+      } finally {
+        recordWorkspaceToolTargetOperation(routeDeps.observability, {
+          operation,
+          outcome,
+          durationSeconds: (performance.now() - started) / 1000,
+        });
+      }
+    });
+  }
+  // Legacy calls retain their content-free, per-process catalog attestations.
+  const toolGatewayCatalogAttestations = createWorkspaceToolGatewayCatalogAttestations();
   app.get("/v1/workspaces/:workspaceId/tools/catalog", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const authorization = await requireAccessGrantAuthorization(
@@ -1069,9 +2000,22 @@ export function createAppComposition(deps: AppDependencies): {
       workspaceId,
       "workspace:read",
     );
-    const prepared = await prepareWorkspaceToolGateway(routeDeps, authorization);
+    const startedAt = performance.now();
+    const prepared = await prepareAttestedWorkspaceToolGateway(
+      routeDeps,
+      authorization,
+      toolGatewayCatalogAttestations,
+    );
     try {
+      const prepareMs = performance.now() - startedAt;
+      recordWorkspaceToolGatewayPreparation(routeDeps.observability, {
+        operation: "catalog",
+        scope: "complete",
+        attestation: "record",
+        durationSeconds: prepareMs / 1_000,
+      });
       c.header("cache-control", "no-store");
+      c.header("server-timing", workspaceToolGatewayServerTiming({ prepareMs, scope: "complete" }));
       return c.json(prepared.toolGatewayCatalog);
     } finally {
       await prepared.close();
@@ -1086,26 +2030,28 @@ export function createAppComposition(deps: AppDependencies): {
       workspaceId,
       "workspace:read",
     );
-    const grant = authorization.grant;
     const parsed = ToolGatewayCallRequest.safeParse(await c.req.json().catch(() => null));
     if (!parsed.success) {
       throw new HTTPException(400, { message: "Invalid tool gateway call" });
     }
-    const prepared = await prepareWorkspaceToolGateway(routeDeps, authorization);
-    try {
-      return c.json(
-        await callWorkspaceToolGateway(
-          prepared,
-          grant,
-          parsed.data,
-          routeDeps.db,
-          undefined,
-          routeDeps.observability,
-        ),
-      );
-    } finally {
-      await prepared.close();
-    }
+    const { response, timing } = await callWorkspaceToolGatewayForCaller(
+      routeDeps,
+      authorization,
+      parsed.data,
+      {
+        attestations: toolGatewayCatalogAttestations,
+        ...(routeDeps.observability ? { observability: routeDeps.observability } : {}),
+        onPreparation: (preparation) =>
+          recordWorkspaceToolGatewayPreparation(routeDeps.observability, {
+            operation: "call",
+            scope: preparation.scope,
+            attestation: preparation.attestation,
+            durationSeconds: preparation.prepareMs / 1_000,
+          }),
+      },
+    );
+    c.header("server-timing", workspaceToolGatewayServerTiming(timing));
+    return c.json(response);
   });
 
   app.post("/v1/workspaces/:workspaceId/tools/approvals", async (c) => {
@@ -1146,7 +2092,11 @@ export function createAppComposition(deps: AppDependencies): {
       workspaceId,
       "workspace:read",
     );
-    const prepared = await prepareWorkspaceToolGateway(routeDeps, authorization);
+    const prepared = await prepareAttestedWorkspaceToolGateway(
+      routeDeps,
+      authorization,
+      toolGatewayCatalogAttestations,
+    );
     try {
       c.header("cache-control", "no-store");
       return c.json(workspaceToolGatewayDeclarations(prepared));
@@ -1162,16 +2112,20 @@ export function createAppComposition(deps: AppDependencies): {
     const prefix = `/v1/workspaces/${workspaceId}/codemode/sdk`;
     let forwarded: Request;
     try {
-      forwarded = await codemodeSessionRequest(
-        routeDeps,
-        grant,
-        c.req.raw,
-        url.pathname.slice(prefix.length) + url.search,
-      );
+      const path = url.pathname.slice(prefix.length) + url.search;
+      forwarded = await codemodeSessionRequest(routeDeps, grant, c.req.raw, path, (session) => {
+        assertConfiguredCodemodeSessionProxyPath(session, path, c.req.method);
+        const proxyTools = configuredCodemodeSessionProxyTools(routeDeps.settings, session);
+        return proxyTools === null
+          ? routeDeps.settings
+          : { ...routeDeps.settings, allowedFirstPartyMcpTools: proxyTools };
+      });
     } catch (error) {
       throw codemodeHttpError(error);
     }
-    return app.fetch(forwarded);
+    // The forwarded request drops the caller's Host and names a non-sandbox
+    // path; the request it was built from already passed the local boundary.
+    return app.fetch(markLocalInternalDispatch(forwarded));
   });
 
   app.get("/v1/workspaces/:workspaceId/codemode/catalog", async (c) => {
@@ -1198,7 +2152,12 @@ export function createAppComposition(deps: AppDependencies): {
       throw new HTTPException(400, { message: "Invalid Codemode call" });
     }
     try {
-      const submission = await submitAndDispatchCodemodeCall(routeDeps, grant, parsed.data);
+      const submission = await submitAndDispatchCodemodeCall(
+        routeDeps,
+        grant,
+        parsed.data,
+        c.req.raw.signal,
+      );
       const terminal = ["completed", "failed", "outcome_unknown", "cancelled"].includes(
         submission.operation.state,
       );
@@ -1215,7 +2174,9 @@ export function createAppComposition(deps: AppDependencies): {
       throw new HTTPException(403, { message: "Codemode access denied" });
     }
     try {
-      const operation = await readCodemodeOperation(routeDeps, grant, c.req.param("operationId"));
+      const operation = await readCodemodeOperation(routeDeps, grant, c.req.param("operationId"), {
+        durableApproval: c.req.header("x-opengeni-codemode-capabilities") === "durable-approval-v1",
+      });
       if (!operation)
         throw new HTTPException(404, {
           message: "Codemode operation not found",
@@ -1229,35 +2190,53 @@ export function createAppComposition(deps: AppDependencies): {
 
   registerConnectCallbackReturns(app, routeDeps);
   registerFileRoutes(app, routeDeps);
+  registerSessionArtifactAssociationRoutes(app, routeDeps);
   registerApiKeyRoutes(app, routeDeps);
+  registerOrganizationMcpConnectionRoutes(app, routeDeps);
+  registerPersonalApiKeyRoutes(app, routeDeps);
+  registerOrganizationServiceAccountRoutes(app, routeDeps);
   registerBillingRoutes(app, routeDeps);
   registerBrowserIdentityRoutes(app, routeDeps);
-  registerBrowserSessionRoutes(app, routeDeps);
-  registerComputerSessionRoutes(app, routeDeps);
+  const interactionSecrets = createVaultInteractionSecretsPort({
+    db: routeDeps.db,
+    encryptionKey: environmentsEncryptionKeyBytes(routeDeps.settings) ?? null,
+    providersFor: (workspaceId, subjectId) =>
+      vaultProviderRegistryFor(routeDeps, { workspaceId, subjectId }),
+  });
+  registerBrowserSessionRoutes(app, routeDeps, { interactionSecrets });
+  registerComputerSessionRoutes(app, routeDeps, { interactionSecrets });
   registerDocumentRoutes(app, routeDeps);
   registerKnowledgeRoutes(app, routeDeps);
   registerGitHubRoutes(app, routeDeps);
   registerInstallRoutes(app, routeDeps);
+  registerDesktopDistributionRoutes(app, routeDeps);
   registerInteractionResourceRoutes(app, routeDeps);
   registerWorkspaceRoutes(app, routeDeps);
+  registerUsageAllowanceRoutes(app, routeDeps);
   registerInsightsRoutes(app, routeDeps);
+  registerInsightsUsageRoutes(app, routeDeps);
   registerWorkspaceInstructionPolicyRoutes(app, routeDeps);
   registerWorkspaceLearningRoutes(app, routeDeps);
   registerCompanyProfileRoutes(app, routeDeps);
   registerCompanyBrainRoutes(app, routeDeps);
   registerSlackTaskPolicyRoutes(app, routeDeps);
+  registerSlackBotAccessRoutes(app, routeDeps);
   registerWorkspaceStateRoutes(app, routeDeps);
   registerMemorySlackPublicationRoutes(app, routeDeps);
   registerWorkspaceArtifactRoutes(app, routeDeps);
+  registerSiteDataRoutes(app, routeDeps);
+  registerSitePublishingRoutes(app, routeDeps);
+  registerSiteRuntimeRoutes(app, routeDeps);
   registerArtifactCatalogRoutes(app, routeDeps);
+  registerSiteSqlRoutes(app, routeDeps);
   registerPreferenceRegistryRoutes(app, routeDeps);
   registerSocialRoutes(app, routeDeps);
   registerPersonalGitHubRoutes(app, routeDeps);
   registerPersonalGitHubGitBrokerRoutes(app, routeDeps);
   registerConnectionRoutes(app, routeDeps);
+  registerVaultProviderRoutes(app, routeDeps);
   registerConnectRoutes(app, routeDeps);
-  registerHostMcpBindingRoutes(app, routeDeps);
-  registerHostMcpResolverRoutes(app, routeDeps);
+
   registerExternalIdentityLinkRoutes(app, routeDeps);
   registerCapabilityRoutes(app, routeDeps);
   registerApiIntegrationRoutes(app, routeDeps);
@@ -1265,22 +2244,38 @@ export function createAppComposition(deps: AppDependencies): {
   registerCatalogAssetRoutes(app, routeDeps);
   registerEnrollmentRoutes(app, routeDeps);
   registerMachineRoutes(app, routeDeps);
-  registerEnvironmentRoutes(app, routeDeps);
+  registerVariableSetsRemovedRoutes(app);
+  registerVaultRoutes(app, routeDeps);
   registerChannelRoutes(app, routeDeps);
   registerRigRoutes(app, routeDeps);
-  registerPackRoutes(app, routeDeps);
   registerAutomationRoutes(app, routeDeps);
   registerPrReviewRoutes(app, routeDeps);
   registerPluginRoutes(app, routeDeps);
   registerSkillRoutes(app, routeDeps);
+  // The inbox's per-session mute routes call the session seam themselves, so
+  // they register before the session module's fail-closed middleware, which
+  // only classifies the session module's own paths.
+  registerInboxRoutes(app, routeDeps);
   registerSessionRoutes(app, routeDeps);
+  registerSessionHistoryImportRoutes(app, routeDeps);
   registerFeedbackRoutes(app, routeDeps);
+  registerWorkspaceIntegrationRoutes(app, routeDeps);
+  registerOrganizationIntegrationRoutes(app, routeDeps);
   registerScheduledTaskRoutes(app, routeDeps);
   registerCodexRoutes(app, routeDeps);
   registerOrganizationModelProviderRoutes(app, routeDeps);
+  registerOrganizationModelDefaultsRoutes(app, routeDeps);
+  registerModelAccountSettingsRoutes(app, routeDeps);
+  registerModelAccountChoiceRoutes(app, routeDeps);
+  registerSessionAdminAccessRoutes(app, routeDeps);
+  registerWorkspaceModelProviderRoutes(app, routeDeps);
+  registerClaudeSubscriptionOAuthRoutes(app, routeDeps);
+  registerOrganizationIntegrationPolicyRoutes(app, routeDeps);
   registerModelConnectionAccessRoutes(app, routeDeps);
   registerSuperGrokRoutes(app, routeDeps);
+  registerClaudeSubscriptionAccountRoutes(app, routeDeps);
   registerTranscriptionRoutes(app, routeDeps);
+  registerChatCompletionRoutes(app, { ...routeDeps, modelCalls });
   registerEditableArtifactRoutes(app, routeDeps);
   registerVideoGenerationRoutes(app, routeDeps);
   registerCanonicalHumanIdentityRoutes(app, routeDeps);
@@ -1288,12 +2283,11 @@ export function createAppComposition(deps: AppDependencies): {
   registerOrganizationSessionRoutes(app, routeDeps);
   registerOrganizationRecoveryRoutes(app, routeDeps);
   registerUserResourceAuthorityRoutes(app, routeDeps);
-  registerConnectionAuthorityRoutes(app, routeDeps);
   registerSlackInteractionRoutes(app, routeDeps);
 
   app.notFound((c) => {
     if (!new URL(c.req.url).pathname.startsWith("/v1/")) return c.text("Not Found", 404);
-    const requestId = correlationIds.get(c.req.raw) ?? crypto.randomUUID();
+    const requestId = correlationIds.get(c) ?? crypto.randomUUID();
     return c.json(
       ErrorEnvelope.parse({
         error: {
@@ -1309,19 +2303,59 @@ export function createAppComposition(deps: AppDependencies): {
   });
 
   app.onError((rawError, c) => {
+    const requestId = correlationIds.get(c) ?? crypto.randomUUID();
+    c.header(OPENGENI_CORRELATION_HEADER, requestId);
+    if (new URL(c.req.url).pathname.startsWith("/v1/")) {
+      c.header(OPENGENI_API_CONTRACT_HEADER, OPENGENI_API_CONTRACT_REVISION);
+    }
+    // Archives remain read-only through the existing Send/Steer/control paths.
+    const importErrorResponse = archivedSessionImportErrorResponse(c, rawError);
+    if (importErrorResponse) return importErrorResponse;
+    const removedResponse = variableSetsRemovedErrorResponse(c, rawError);
+    if (removedResponse) return removedResponse;
     // One central mapping for every Send/Steer/control route: a bounded
     // control-prefix wait that expired is a known, retryable, not-applied 503.
-    const error = workspaceControlBusyHttpError(rawError) ?? rawError;
+    const error =
+      rawError instanceof OrganizationIntegrationDeniedError
+        ? new HTTPException(403, { message: rawError.message })
+        : (sessionUsageLimitHttpError(rawError) ??
+          allowanceExhaustedHttpError(rawError) ??
+          subscriptionSettingsLockedHttpError(rawError) ??
+          workspaceControlBusyHttpError(rawError) ??
+          scheduledTaskTargetAccessHttpError(rawError) ??
+          agentConfigHttpError(rawError) ??
+          modelUnavailableHttpError(rawError) ??
+          (rawError instanceof UnsupportedLatencyModeError
+            ? new ApiHttpError(422, {
+                code: "validation_failed",
+                message: rawError.message,
+                retryable: false,
+                outcomeUnknown: false,
+                details: {
+                  code: rawError.code,
+                  modelId: rawError.modelId,
+                  latencyMode: rawError.latencyMode,
+                  allowedLatencyModes: [...rawError.allowedLatencyModes],
+                },
+              })
+            : null) ??
+          requestBodyValidationHttpError(rawError) ??
+          invalidPathIdentifierHttpError(rawError, new URL(c.req.url).pathname) ??
+          databaseUnavailableHttpError(rawError, c.req.method) ??
+          databaseContentionHttpError(rawError, c.req.method) ??
+          rawError);
     const compactionLock = codexCompactionV2ProviderLockedError(error);
     const apiError = error instanceof ApiHttpError ? error : null;
     const status = compactionLock ? 422 : httpStatusForError(error);
     const code: ErrorCode = compactionLock
       ? compactionLock.code
       : (apiError?.code ?? errorCodeForStatus(status));
-    const requestId = correlationIds.get(c.req.raw) ?? crypto.randomUUID();
-    c.header(OPENGENI_CORRELATION_HEADER, requestId);
-    if (new URL(c.req.url).pathname.startsWith("/v1/")) {
-      c.header(OPENGENI_API_CONTRACT_HEADER, OPENGENI_API_CONTRACT_REVISION);
+    if (status >= 500) logHttpFailure(c, status, code, rawError);
+    if (
+      apiError?.details?.code === DATABASE_UNAVAILABLE_ERROR_DETAIL_CODE ||
+      apiError?.details?.code === DATABASE_CONTENTION_ERROR_DETAIL_CODE
+    ) {
+      c.header("retry-after", "1");
     }
     const envelope = ErrorEnvelope.parse({
       error: {
@@ -1346,6 +2380,14 @@ export function createAppComposition(deps: AppDependencies): {
   return { app, routeDeps };
 }
 
+function rejectionLogAttributes(rejection: HttpRejectionFacts) {
+  return {
+    rejectionCode: rejection.code,
+    rejectionReason: rejection.reason,
+    ...(rejection.fingerprint ? { rejectionFingerprint: rejection.fingerprint } : {}),
+  };
+}
+
 function managedAuthOAuthCallbackProvider(pathname: string): "google" | "github" | null {
   const match = pathname.match(/^\/v1\/auth\/callback\/(google|github)$/u);
   return match?.[1] === "google" || match?.[1] === "github" ? match[1] : null;
@@ -1381,6 +2423,36 @@ export function workspaceActorContextExempt(method: string, pathname: string): b
   // Hono's trailing wildcard also matches it, but "external" is not a workspace UUID;
   // the route performs its own organization API-key authorization.
   if (method === "PUT" && pathname === "/v1/workspaces/external") return true;
+  // Import adapters apply their own exact create/control gates and request-local
+  // RLS in core. Tenant mirrors first resolve the organization-local mapping;
+  // "external" itself is not a native workspace id.
+  if (isSessionHistoryImportRequest(method, pathname)) return true;
+  // Organization budget authority is independent of ordinary workspace
+  // membership; these routes apply their own exact account/workspace gate.
+  if (
+    (["GET", "PUT", "DELETE"].includes(method) &&
+      /^\/v1\/workspaces\/[^/]+\/allowance$/.test(pathname)) ||
+    (method === "GET" && /^\/v1\/workspaces\/[^/]+\/allowance\/state$/.test(pathname)) ||
+    (method === "POST" && /^\/v1\/workspaces\/[^/]+\/allowance\/grants$/.test(pathname))
+  )
+    return true;
+  // Allowance tenant mirrors resolve the workspace by exact organization-local
+  // external identity before applying the ordinary workspace authorization.
+  if (
+    (["GET", "PUT", "DELETE"].includes(method) &&
+      /^\/v1\/workspaces\/external\/[^/]+\/[^/]+\/allowance$/.test(pathname)) ||
+    (method === "GET" &&
+      /^\/v1\/workspaces\/external\/[^/]+\/[^/]+\/allowance\/state$/.test(pathname)) ||
+    (method === "POST" &&
+      /^\/v1\/workspaces\/external\/[^/]+\/[^/]+\/allowance\/grants$/.test(pathname)) ||
+    (method === "GET" &&
+      /^\/v1\/workspaces\/external\/[^/]+\/[^/]+\/usage(?:\/me)?$/.test(pathname)) ||
+    (method === "PUT" &&
+      /^\/v1\/workspaces\/external\/[^/]+\/[^/]+\/members\/(?:[^/]+|external\/[^/]+\/[^/]+)\/allowance$/.test(
+        pathname,
+      ))
+  )
+    return true;
   if (/^\/v1\/workspaces\/[^/]+\/mcp(?:\/(?:docs|files))?$/.test(pathname)) return true;
   if (
     method === "GET" &&
@@ -1434,12 +2506,13 @@ async function requireMcpAccessGrantAuthorization(
   return authorization;
 }
 
-function clientAuthConfig(settings: AppDependencies["settings"]) {
+function clientAuthConfig(settings: AppDependencies["settings"], newSignupsEnabled: boolean) {
   if (settings.productAccessMode === "managed") {
     return {
       mode: "managedSession" as const,
       session: "cookie" as const,
       emailVerificationRequired: settings.environment !== "local",
+      newSignupsEnabled,
       socialProviders: [
         ...(settings.managedAuthGoogleClientId && settings.managedAuthGoogleClientSecret
           ? (["google"] as const)
@@ -1466,11 +2539,151 @@ function clientAuthConfig(settings: AppDependencies["settings"]) {
   return { mode: "none" as const };
 }
 
+/** Configured SDK credentials cannot regain tools from widened legacy columns. */
+export function configuredCodemodeSessionProxyTools(
+  settings: FirstPartyMcpToolPolicySettings,
+  session: Pick<Session, "agent">,
+): FirstPartyMcpToolName[] | null {
+  if (!session.agent) return null;
+  const families = resolveAgentToolFamilies(session.agent);
+  return resolveFirstPartyMcpToolPolicy(settings).allowed.filter((tool) =>
+    families.allowsFirstPartyTool(tool),
+  );
+}
+
+/**
+ * Permissions span capabilities: project_create grants sessions:create,
+ * and runtime titling grants sessions:control. Fence the endpoint family
+ * too, without changing null-config routing or ordinary REST authorization.
+ */
+export function assertConfiguredCodemodeSessionProxyPath(
+  session: Pick<Session, "id" | "agent">,
+  path: string,
+  method: string,
+): void {
+  if (!session.agent) return;
+  const families = resolveAgentToolFamilies(session.agent);
+  const pathname = new URL(path, "http://codemode.invalid").pathname;
+  const segments = pathname.split("/").filter(Boolean);
+  const verb = method.toUpperCase();
+  const read = verb === "GET" || verb === "HEAD";
+  const allows = (tool: FirstPartyMcpToolName) => families.allowsFirstPartyTool(tool);
+  let allowed = false;
+  if (pathname === "/v1/config/client") {
+    allowed = read;
+  } else if (segments[0] === "v1" && segments[1] === "workspaces" && segments[2] === "site-host") {
+    const [surface, targetSessionId, operation] = segments.slice(3);
+    if (!surface) {
+      allowed = read;
+    } else if (surface === "sessions") {
+      const ownSession = targetSessionId === session.id;
+      const targetAllowed = ownSession || families.subagents;
+      if (!targetSessionId) {
+        allowed = families.subagents;
+      } else if (ownSession && !operation && read) {
+        allowed = true;
+      } else if (ownSession && !operation && verb === "PATCH") {
+        allowed = allows("set_session_title");
+      } else if (ownSession && operation === "background-commands") {
+        allowed = read && allows("command_read");
+      } else if (operation === "goal") {
+        allowed = allows("goal_set") && targetAllowed;
+      } else if (operation === "browser" || operation === "computer") {
+        allowed = allows("browser_open") && targetAllowed;
+      } else if (operation === "human-input-requests") {
+        allowed = families.humanInput && targetAllowed;
+      } else if (operation === "artifacts") {
+        allowed = allows("artifacts_list") && targetAllowed;
+      } else if (ownSession && ["fs", "git", "terminal", "workspace"].includes(operation ?? "")) {
+        // Resource-derived sandbox mechanics are not platform capabilities.
+        allowed = true;
+      } else if (
+        [
+          "agent",
+          "tool-policy",
+          "mcp-servers",
+          "mcp-credentials",
+          "variable-sets",
+          "project",
+        ].includes(operation ?? "")
+      ) {
+        allowed = allows("project_get") && targetAllowed;
+      } else {
+        allowed = families.subagents;
+      }
+    } else if (surface === "connect") {
+      allowed = allows("custom_mcp_setup_request") && isPreparedMcpConnectPath(pathname, verb);
+    } else if (surface === "files") {
+      allowed = families.allowsMcpServer("files");
+    } else if (surface === "skills") {
+      allowed = families.skills === "manage" || (families.skills === "read" && read);
+    } else if (surface === "human-input-requests") {
+      allowed = families.humanInput;
+    } else {
+      const owners: Record<string, FirstPartyMcpToolName> = {
+        "model-catalog": "sessions_list",
+        "realtime-model-catalog": "sessions_list",
+        "model-policy": "sessions_list",
+        "gateway-custom-models": "sessions_list",
+        "openrouter-custom-models": "sessions_list",
+        "opper-custom-models": "sessions_list",
+        "new-session-draft": "session_create",
+        "session-tenancy": "session_create",
+        "session-message-search": "session_events",
+        "agent-topology": "sessions_list",
+        projects: "project_get",
+        sandboxes: "sandboxes_list",
+        machines: "sandboxes_list",
+        rigs: "rig_list",
+        environments: "environment_list",
+        "variable-sets": "variable_set_list",
+        capabilities: "capability_catalog_search",
+        catalog: "capability_catalog_search",
+        members: "project_get",
+        "member-candidates": "project_get",
+        "control-events": "project_get",
+        "browser-identities": "browser_identity",
+        "browser-sessions": "browser_open",
+        "computer-sessions": "computer_open",
+        "attached-browsers": "browser_open",
+        documents: "knowledge_search",
+        knowledge: "knowledge_search",
+        memory: "knowledge_search",
+        "instruction-policy": "instruction_policy_get",
+        preferences: "preference_registry_get",
+        "company-profile": "company_profile_propose",
+        artifacts: "artifacts_list",
+        "scheduled-tasks": "scheduled_tasks_list",
+        automations: "scheduled_tasks_list",
+        connections: "github_connect_link",
+        integrations: "github_connect_link",
+        github: "github_connect_link",
+        social: "social_connections_list",
+        mcp: "github_connect_link",
+      };
+      const tool = owners[surface];
+      allowed = tool !== undefined && allows(tool);
+    }
+  }
+  if (!allowed) {
+    throw new HTTPException(403, {
+      message: "Agent configuration does not allow this Codemode SDK operation",
+    });
+  }
+}
+
 function codemodeHttpError(error: unknown): HTTPException {
-  if (error instanceof SiteSessionPathError) {
-    // The proxied Site/SDK surface is an explicit allowlist; a route outside
-    // it (tool policy, visibility, forks, Steer, control, ...) does not exist
-    // for this caller rather than being a server fault.
+  // The journal admission is one idempotent transaction keyed by the
+  // caller-owned operation id and is already retried in-process; every other
+  // step is a read. An exhausted 40P01/40001 victim therefore committed
+  // nothing and the client may resubmit the same operation id.
+  const contention = databaseContentionHttpError(error, "POST", { outcomeUnknown: false });
+  if (contention) return contention;
+  if (error instanceof SiteSessionPathError || error instanceof SiteDataUnsupportedError) {
+    // Site frame requests are held to the SITE_OPERATIONS allowlist and the
+    // agent's own SDK requests to its workspace; a route outside them (or Site
+    // Data on a host without a published Site) does not exist for this
+    // caller rather than being a server fault.
     return new HTTPException(404, { message: error.message, cause: error });
   }
   if (error instanceof SessionAuthorizationDeniedError) {
@@ -1527,6 +2740,9 @@ function codemodeHttpError(error: unknown): HTTPException {
   if (error instanceof CodemodePayloadTooLargeError) {
     return new HTTPException(413, { message: error.message, cause: error });
   }
+  if (error instanceof CodemodeOperationLimitError) {
+    return new HTTPException(429, { message: error.message, cause: error });
+  }
   return error instanceof HTTPException
     ? error
     : new HTTPException(500, {
@@ -1560,6 +2776,15 @@ function clientAnalyticsConfig(settings: AppDependencies["settings"]) {
   };
 }
 
+function clientLegalConfig(settings: AppDependencies["settings"]) {
+  return {
+    ...(settings.legalPrivacyPolicyUrl ? { privacyPolicyUrl: settings.legalPrivacyPolicyUrl } : {}),
+    ...(settings.legalTermsOfServiceUrl
+      ? { termsOfServiceUrl: settings.legalTermsOfServiceUrl }
+      : {}),
+  };
+}
+
 function structuredServicesHint(backend: string): {
   fileSystem: boolean;
   git: boolean;
@@ -1591,6 +2816,9 @@ export function httpStatusForError(error: unknown): number {
   if (workspaceControlBusyHttpError(error)) {
     return 503;
   }
+  if (isRequestBodyValidationError(error)) {
+    return 400;
+  }
   if (error instanceof HTTPException) {
     return error.status;
   }
@@ -1604,7 +2832,7 @@ export function errorCodeForStatus(status: number): ErrorCode {
   if (status === 401) return "unauthenticated";
   if (status === 402) return "payment_required";
   if (status === 403) return "forbidden";
-  if (status === 404) return "not_found";
+  if (status === 404 || status === 405) return "not_found";
   if (status === 409) return "conflict";
   if (status === 413 || status === 422 || status === 400) return "validation_failed";
   if (status === 429) return "limit_exceeded";
@@ -1621,10 +2849,10 @@ function publicErrorMessage(error: unknown, status: number): string {
     return "Connection setup changed or is still in progress. Reload its current status before retrying.";
   if (error instanceof ConnectAttemptNotFoundError) return "Connection setup not found.";
   if (status === 502 || status === 503 || status === 504) {
-    return "OpenGeni is temporarily unavailable — retry.";
+    return "Opengeni is temporarily unavailable — retry.";
   }
   if (status >= 500) {
-    return "OpenGeni could not complete the request.";
+    return "Opengeni could not complete the request.";
   }
   if (error instanceof HTTPException) {
     return boundedPublicMessage(error.message) ?? "Request failed.";
@@ -1739,7 +2967,7 @@ const routeLabelPatterns: Array<{
   label: string | ((match: RegExpMatchArray) => string);
 }> = [
   {
-    pattern: /^\/\.well-known\/oauth-authorization-server$/,
+    pattern: /^\/\.well-known\/oauth-authorization-server(?:\/.*)?$/,
     label: "/.well-known/oauth-authorization-server",
   },
   {
@@ -1754,6 +2982,21 @@ const routeLabelPatterns: Array<{
   },
   { pattern: /^\/healthz$/, label: "/healthz" },
   { pattern: /^\/readyz$/, label: "/readyz" },
+  // Better Auth answers these behind one `/v1/auth/*` registration, so the
+  // provider endpoints need an explicit closed set to stay distinguishable.
+  {
+    pattern:
+      /^\/v1\/auth\/(sign-up\/email|sign-in\/email|sign-in\/social|sign-out|send-verification-email|verify-email|request-password-reset|reset-password|error|ok)$/,
+    label: (match) => `/v1/auth/${match[1]}`,
+  },
+  { pattern: /^\/v1\/auth\/reset-password\/[^/]+$/, label: "/v1/auth/reset-password/:token" },
+  {
+    pattern: /^\/v1\/auth\/callback\/([^/]+)$/,
+    label: (match) =>
+      match[1] === "google" || match[1] === "github"
+        ? `/v1/auth/callback/${match[1]}`
+        : "/v1/auth/callback/:providerId",
+  },
   { pattern: /^\/traffic-readyz$/, label: "/traffic-readyz" },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/codex\/connect\/start$/,
@@ -1780,7 +3023,8 @@ const routeLabelPatterns: Array<{
     label: (match) => `/v1/organizations/:organizationId/codex/connect/${match[1]}`,
   },
   {
-    pattern: /^\/v1\/organizations\/[^/]+\/codex\/accounts\/[^/]+(?:\/activate)?$/,
+    pattern:
+      /^\/v1\/organizations\/[^/]+\/codex\/accounts\/[^/]+(?:\/(activate|allocator|extra-credits))?$/,
     label: "/v1/organizations/:organizationId/codex/accounts/:accountId",
   },
   {
@@ -1809,6 +3053,8 @@ const routeLabelPatterns: Array<{
   },
   { pattern: /^\/metrics$/, label: "/metrics" },
   { pattern: /^\/v1\/config\/client$/, label: "/v1/config/client" },
+  { pattern: /^\/v1\/client-errors$/, label: "/v1/client-errors" },
+  { pattern: /^\/v1\/analytics-consent$/, label: "/v1/analytics-consent" },
   { pattern: /^\/v1\/billing$/, label: "/v1/billing" },
   { pattern: /^\/v1\/billing\/checkout$/, label: "/v1/billing/checkout" },
   { pattern: /^\/v1\/billing\/usage$/, label: "/v1/billing/usage" },
@@ -1816,6 +3062,22 @@ const routeLabelPatterns: Array<{
     pattern: /^\/v1\/workspaces\/[^/]+\/insights$/,
     label: "/v1/workspaces/:workspaceId/insights",
   },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/insights\/usage$/,
+    label: "/v1/workspaces/:workspaceId/insights/usage",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/insights\/calls$/,
+    label: "/v1/workspaces/:workspaceId/insights/calls",
+  },
+  {
+    pattern: /^\/v1\/organizations\/[^/]+\/insights\/usage$/,
+    label: "/v1/organizations/:accountId/insights/usage",
+  },
+  {
+    pattern: /^\/v1\/organizations\/[^/]+\/insights\/calls$/,
+    label: "/v1/organizations/:accountId/insights/calls",
+  },
   {
     pattern: /^\/v1\/billing\/entitlements$/,
     label: "/v1/billing/entitlements",
@@ -1841,6 +3103,10 @@ const routeLabelPatterns: Array<{
     pattern: /^\/v1\/workspaces\/[^/]+\/tools\/catalog$/,
     label: "/v1/workspaces/:workspaceId/tools/catalog",
   },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/tools\/(resolve|invoke|target-approvals|manifest)$/,
+    label: (match) => `/v1/workspaces/:workspaceId/tools/${match[1]}`,
+  },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/tools\/calls$/,
     label: "/v1/workspaces/:workspaceId/tools/calls",
@@ -1861,6 +3127,18 @@ const routeLabelPatterns: Array<{
     pattern: /^\/v1\/workspaces\/[^/]+\/sessions$/,
     label: "/v1/workspaces/:workspaceId/sessions",
   },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/session-imports$/,
+    label: "/v1/workspaces/:workspaceId/session-imports",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/session-imports\/[^/]+\/events$/,
+    label: "/v1/workspaces/:workspaceId/session-imports/:importId/events",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/session-message-search$/,
+    label: "/v1/workspaces/:workspaceId/session-message-search",
+  },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/control-events\/stream$/,
     label: "/v1/workspaces/:workspaceId/control-events/stream",
@@ -1914,7 +3192,7 @@ const routeLabelPatterns: Array<{
   },
   {
     pattern:
-      /^\/v1\/workspaces\/[^/]+\/browser-sessions\/[^/]+\/auth-runs\/[^/]+\/(external-auth|protected-fill|report|verify)$/,
+      /^\/v1\/workspaces\/[^/]+\/browser-sessions\/[^/]+\/auth-runs\/[^/]+\/(external-auth|report|verify)$/,
     label: (match) =>
       `/v1/workspaces/:workspaceId/browser-sessions/:browserSessionId/auth-runs/:authRunId/${match[1]}`,
   },
@@ -1970,7 +3248,7 @@ const routeLabelPatterns: Array<{
   },
   {
     pattern:
-      /^\/v1\/workspaces\/[^/]+\/computer-sessions\/[^/]+\/(actions|attachments|clipboard|end|heartbeat|targets)$/,
+      /^\/v1\/workspaces\/[^/]+\/computer-sessions\/[^/]+\/(actions|native-calls|attachments|clipboard|end|heartbeat|targets)$/,
     label: (match) =>
       `/v1/workspaces/:workspaceId/computer-sessions/:computerSessionId/${match[1]}`,
   },
@@ -2155,6 +3433,72 @@ const routeLabelPatterns: Array<{
     pattern: /^\/v1\/workspaces\/external$/,
     label: "/v1/workspaces/external",
   },
+  {
+    pattern: /^\/v1\/workspaces\/external\/[^/]+\/[^/]+\/session-imports$/,
+    label: "/v1/workspaces/external/:source/:externalId/session-imports",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/external\/[^/]+\/[^/]+\/session-imports\/[^/]+\/events$/,
+    label: "/v1/workspaces/external/:source/:externalId/session-imports/:importId/events",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/external\/[^/]+\/[^/]+\/allowance\/grants$/,
+    label: "/v1/workspaces/external/:source/:externalId/allowance/grants",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/external\/[^/]+\/[^/]+\/allowance$/,
+    label: "/v1/workspaces/external/:source/:externalId/allowance",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/external\/[^/]+\/[^/]+\/allowance\/state$/,
+    label: "/v1/workspaces/external/:source/:externalId/allowance/state",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/external\/[^/]+\/[^/]+\/usage\/me$/,
+    label: "/v1/workspaces/external/:source/:externalId/usage/me",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/external\/[^/]+\/[^/]+\/usage$/,
+    label: "/v1/workspaces/external/:source/:externalId/usage",
+  },
+  {
+    pattern:
+      /^\/v1\/workspaces\/external\/[^/]+\/[^/]+\/members\/external\/[^/]+\/[^/]+\/allowance$/,
+    label:
+      "/v1/workspaces/external/:source/:externalId/members/external/:memberSource/:memberExternalId/allowance",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/external\/[^/]+\/[^/]+\/members\/[^/]+\/allowance$/,
+    label: "/v1/workspaces/external/:source/:externalId/members/:subjectId/allowance",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/allowance\/grants$/,
+    label: "/v1/workspaces/:workspaceId/allowance/grants",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/allowance$/,
+    label: "/v1/workspaces/:workspaceId/allowance",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/allowance\/state$/,
+    label: "/v1/workspaces/:workspaceId/allowance/state",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/usage\/me$/,
+    label: "/v1/workspaces/:workspaceId/usage/me",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/usage$/,
+    label: "/v1/workspaces/:workspaceId/usage",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/members\/external\/[^/]+\/[^/]+\/allowance$/,
+    label: "/v1/workspaces/:workspaceId/members/external/:source/:externalId/allowance",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/members\/[^/]+\/allowance$/,
+    label: "/v1/workspaces/:workspaceId/members/:subjectId/allowance",
+  },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/scheduled-tasks$/,
     label: "/v1/workspaces/:workspaceId/scheduled-tasks",
@@ -2373,26 +3717,7 @@ const routeLabelPatterns: Array<{
     pattern: /^\/v1\/workspaces\/[^/]+\/environments\/[^/]+$/,
     label: "/v1/workspaces/:workspaceId/environments/:id",
   },
-  {
-    pattern: /^\/v1\/workspaces\/[^/]+\/packs$/,
-    label: "/v1/workspaces/:workspaceId/packs",
-  },
-  {
-    pattern: /^\/v1\/workspaces\/[^/]+\/packs\/installations$/,
-    label: "/v1/workspaces/:workspaceId/packs/installations",
-  },
-  {
-    pattern: /^\/v1\/workspaces\/[^/]+\/packs\/marketing-social-daily-analysis\/scheduled-tasks$/,
-    label: "/v1/workspaces/:workspaceId/packs/marketing-social-daily-analysis/scheduled-tasks",
-  },
-  {
-    pattern: /^\/v1\/workspaces\/[^/]+\/packs\/[^/]+\/enable$/,
-    label: "/v1/workspaces/:workspaceId/packs/:id/enable",
-  },
-  {
-    pattern: /^\/v1\/workspaces\/[^/]+\/packs\/[^/]+$/,
-    label: "/v1/workspaces/:workspaceId/packs/:id",
-  },
+
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/plugins\/preview$/,
     label: "/v1/workspaces/:workspaceId/plugins/preview",
@@ -2546,6 +3871,22 @@ const routeLabelPatterns: Array<{
     pattern: /^\/v1\/workspaces\/[^/]+\/machines\/[^/]+\/update$/,
     label: "/v1/workspaces/:workspaceId/machines/:enrollmentId/update",
   },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/machines\/[^/]+\/screen-control$/,
+    label: "/v1/workspaces/:workspaceId/machines/:enrollmentId/screen-control",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/machines\/[^/]+\/privacy-settings$/,
+    label: "/v1/workspaces/:workspaceId/machines/:enrollmentId/privacy-settings",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/machines\/[^/]+\/audience\/preview$/,
+    label: "/v1/workspaces/:workspaceId/machines/:enrollmentId/audience/preview",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/machines\/[^/]+\/audience$/,
+    label: "/v1/workspaces/:workspaceId/machines/:enrollmentId/audience",
+  },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/machines$/,
     label: "/v1/workspaces/:workspaceId/machines",
@@ -2582,7 +3923,13 @@ const routeLabelPatterns: Array<{
   },
 ];
 
-export function routeLabel(pathname: string): string {
+/**
+ * Bounded route label for metrics, spans, and request logs. Explicit patterns
+ * keep established label spellings stable; any other request answered by a
+ * registered handler uses that handler's code-owned path template (see
+ * `registeredHandlerRoutePath`). Only unregistered paths fall into `unknown`.
+ */
+export function routeLabel(pathname: string, registeredRoutePath?: string | null): string {
   if (/^\/v1\/workspaces\/[^/]+\/transcriptions$/.test(pathname))
     return "/v1/workspaces/:workspaceId/transcriptions";
   const transcription = pathname.match(
@@ -2603,11 +3950,61 @@ export function routeLabel(pathname: string): string {
       return typeof candidate.label === "string" ? candidate.label : candidate.label(match);
     }
   }
+  const registered = boundedRegisteredRouteLabel(registeredRoutePath);
+  if (registered) return registered;
   return pathname.startsWith("/v1/") ? "/v1/unknown" : "/unknown";
 }
 
 /**
- * State-changing OpenGeni HTTP calls must never cross an incompatible rollout
+ * API contract revisions no longer admitted from ANY caller, including bearer
+ * integrations that would otherwise be accepted across revisions. Add a
+ * revision here only for a truly breaking wire change (which also requires a
+ * major release-train change); ordinary revision bumps stay additive.
+ */
+export const REFUSED_API_CONTRACT_REVISIONS: ReadonlySet<string> = new Set<string>([]);
+
+const BEARER_AUTHORIZATION = /^bearer\s+\S/i;
+
+/**
+ * The rollout fence for state-changing product calls.
+ *
+ * The exact-revision check exists to stop a stale first-party browser tab
+ * (cookie session, or unauthenticated local mode) from writing with an old
+ * request shape after a deployment; it answers 409 so the page reloads onto
+ * the matching bundle. That tab never sends `Authorization`, so this is not a
+ * header a stale bundle can choose to bypass it with.
+ *
+ * Bearer-authenticated callers (organization/workspace API keys, delegated
+ * tokens, the deployment key sent as a bearer) are integrations pinned to an
+ * SDK version: reloading cannot upgrade them, and the API is additive within a
+ * major release train. They are admitted with an older revision or with no
+ * revision claim at all. Only a revision listed in
+ * `REFUSED_API_CONTRACT_REVISIONS` is refused for them.
+ *
+ * This is a compatibility fence, not an authorization boundary: every route
+ * still authenticates and authorizes the request independently.
+ */
+export function apiContractAdmission(
+  input: {
+    method: string;
+    pathname: string;
+    authorization: string | undefined;
+    claimedRevision: string | undefined;
+  },
+  refusedRevisions: ReadonlySet<string> = REFUSED_API_CONTRACT_REVISIONS,
+): "admit" | "reject" {
+  if (!isApiContractProtectedMutation(input.method, input.pathname)) return "admit";
+  if (input.claimedRevision === OPENGENI_API_CONTRACT_REVISION) return "admit";
+  if (input.claimedRevision !== undefined && refusedRevisions.has(input.claimedRevision)) {
+    return "reject";
+  }
+  return input.authorization !== undefined && BEARER_AUTHORIZATION.test(input.authorization)
+    ? "admit"
+    : "reject";
+}
+
+/**
+ * State-changing Opengeni HTTP calls must never cross an incompatible rollout
  * boundary. Standard third-party protocols and externally initiated callbacks
  * are intentionally outside this product API contract.
  */
@@ -2633,12 +4030,47 @@ export function isApiContractProtectedMutation(method: string, pathname: string)
     pathname === "/v1/integrations/slack/commands" ||
     pathname === "/v1/integrations/slack/interactions" ||
     pathname.startsWith("/v1/github/") ||
+    // A stale tab must still report the error that follows a rollout.
+    pathname === CLIENT_ERRORS_PATH ||
+    pathname === ANALYTICS_CONSENT_PATH ||
     pathname === "/v1/enrollments/device/start" ||
     pathname === "/v1/enrollments/device/poll" ||
-    pathname === "/v1/enrollments/token/exchange"
+    pathname === "/v1/enrollments/token/exchange" ||
+    // The runner authenticates this protocol with its install-key proof, not
+    // a browser cookie or the product-client revision header.
+    pathname === "/v1/enrollments/renew" ||
+    // The Site gateway's signed protocol carries its own signature version (v1).
+    pathname.startsWith("/v1/site-runtime/")
   ) {
     return false;
   }
   const segments = pathname.split("/");
   return !segments.includes("mcp") && !segments.includes("codemode");
 }
+
+/** Published Sites deployment facts for the console; null while publishing is off. */
+function clientSitesConfig(settings: Settings): ClientSitesConfig | null {
+  const domain = configuredSitesDomain(settings);
+  if (!domain) return null;
+  return {
+    domain,
+    publicEnabled: settings.sitesPublicEnabled,
+    publicAgentsEnabled: settings.sitesPublicAgentsEnabled,
+    loginOnly: settings.sitesLoginOnly,
+    forceNoindex: settings.sitesForceNoindex,
+  };
+}
+
+/** Client-safe agent-configuration projection. */
+function clientAgentConfig(settings: Settings): ClientAgentConfig {
+  const policy = agentConfigDeploymentPolicy(settings);
+  return {
+    // Deprecated: agent configuration is always on. Kept for client compatibility.
+    enabled: true,
+    defaultForNewSessions: true,
+    capabilities: AGENT_CAPABILITY_IDS.map((id) => {
+      const reason = policy.unavailable[id];
+      return reason === undefined ? { id, available: true } : { id, available: false, reason };
+    }),
+  };
+}