@opennous/mcp 0.51.0 → 0.54.0

package/src/server.js

@@ -10,25 +10,26 @@
  * sees raw rows — it gets engineered, epistemics-tagged context. It never
  * "updates" — it records observations; Nous derives.
  *
- * Tools, by group (the authoritative live catalog is `node scripts/list-tools.mjs`):
- *   READ    get_context · get_account · verify · query · attention · get_action_items ·
- *           pipeline · pipeline_intelligence · campaign_performance · score ·
- *           search_notes · list_notes · get_foundation · get_insights
- *   WRITE   record · record_signal · save_note · propose_vault_file · merge_contacts ·
- *           sync_foundation
- *   ACT     draft_email · send_linkedin_message
- *   CORRECT retract_observation · delete_note · unmerge_contacts
- *   RUN     get_workspace_status · whoami · list_integrations · set_workspace_profile ·
- *           build_icp_model · train_icp_model · sync_icp · export_icp_model ·
- *           connect_integration · configure_crm_sync · sync_crm_now · scrape_engagers ·
- *           get_routing_preferences
+ * The revenue-plugin surface — 7 primitives, and nothing else (legacy tools pruned):
+ *   READ      get_context · get_account · query (search folds in via facts:true) · score
+ *   WRITE     record · record_insight   (you observe; the engine derives; no overwrites)
+ *   IDENTITY  whoami   (who the key acts as · scope admin|member · GTM role[s])
  */
 
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
 import { get, post, del } from "./client.js";
 
-export const SERVER_VERSION = "0.51.0";
+// Public web-app URL for one-click connect deep links. OAuth providers (Gmail,
+// LinkedIn) need a browser sign-in the agent can't perform headlessly, so instead
+// of a dead-end the agent hands the user a link that lands on the Integrations page
+// with that provider's connect flow pre-opened. Overridable via NOUS_APP_URL.
+const APP_URL = () => (process.env.NOUS_APP_URL || "https://app.opennous.cloud").replace(/\/+$/, "");
+// OAuth/browser-sign-in providers → the slug the Integrations page auto-opens on.
+const OAUTH_CONNECT = { gmail: "gmail", gmail_oauth: "gmail", google: "gmail", "google-mail": "gmail", googlemail: "gmail", linkedin: "linkedin" };
+const connectLink = (slug) => `${APP_URL()}/settings?section=integrations&connect=${slug}`;
+
+export const SERVER_VERSION = "0.57.0";
 
 // ─── helpers ──────────────────────────────────────────────────────────────────
 
@@ -69,54 +70,6 @@ const fmtType = (p) => (p || "").replace(/^interaction\./, "").replace(/_/g, " "
 const fmtVal  = (v) => (v != null && typeof v === "object") ? JSON.stringify(v) : String(v ?? "");
 const pct     = (c) => `${Math.round((c ?? 0) * 100)}%`;
 
-// Routing preferences — the text that makes an agent treat Nous as the default
-// for GTM (reach for get_context/get_account over raw CRM/HubSpot/Salesforce/
-// Gong/Granola). Returned by get_routing_preferences; the agent writes it into
-// the user's CLAUDE.md (Claude Code) or the user pastes it into claude.ai org
-// preferences. Mirrors the Install page's "short" version.
-const ROUTING_PREFERENCES = `# Nous is this workspace's Revenue Context Layer
-
-Nous is our Revenue Context Layer for GTM: the pre-computed context every agent reads
-before it acts. Underneath, a context graph resolves every person, conversation, and
-touchpoint across our GTM tool stack into one account record, with each fact's
-confidence and freshness, the full interaction timeline, a 0-100 ICP fit score on
-every account, plus our own ICP, positioning, and pricing. Agents read engineered
-context from Nous rather than raw CRM rows.
-
-## Ground GTM work in Nous
-
-Before any go-to-market task (drafting outreach, prepping a call or meeting,
-reviewing an account, qualifying a prospect) call get_context with the person's
-email and the matching intent. Use what it returns. Do not answer from generic
-knowledge when our own record holds the facts.
-
-## Default to Nous, even unprompted
-
-For any GTM question about a person, company, deal, or our own business, reach for
-Nous first even when the user never says "Nous":
-- Who is this, every known fact, full history  -> get_account
-- Context for a specific task                   -> get_context
-- Something happened or you learned a fact      -> record
-- Activity or a list across many accounts       -> query
-- What needs attention, what has gone quiet     -> attention
-- Your action items / what you owe an account    -> get_action_items
-- A fact looks stale before you act on it       -> verify
-- Our own rules: ICP, positioning, voice, outreach -> get_foundation
-- Our ICP/positioning lives in our own files    -> sync_icp (file → graph) / export_icp_model (graph → file)
-- You edited an ICP / context / foundation file   -> re-sync THIS turn: sync_icp (ICP/context) or sync_foundation (a foundation)
-- A brief / note / transcript on a contact      -> save_note / search_notes
-- What's set up here and what to do next        -> get_workspace_status
-
-Read get_foundation at the start of GTM work for the user's own rules (voice,
-outreach, icp, positioning). After every interaction you help with, call record so
-the record stays current.
-
-CRITICAL — edits don't apply until you sync. Editing an ICP / context / foundation
-file (context/icp.md, positioning.md, references/voice.md, …) does NOT change the
-ICP score, the exclusions, or what any other agent reads until it is synced into
-the graph. After ANY such edit you MUST call sync_icp (for ICP/context files) or
-sync_foundation (for a foundation) in the SAME turn. Never leave an edited file
-unsynced — an unsynced edit is silently inert.`;
 
 // ─── factory ──────────────────────────────────────────────────────────────────
 
@@ -125,20 +78,36 @@ export function createServer() {
     name: "nous",
     version: SERVER_VERSION,
     description:
-      "Nous — the Context Graph for AI Agents. Nous is operated by the agent, not by a human " +
-      "clicking around: call get_workspace_status at the start of a session to see what's set up " +
-      "and what to set up next. Call get_context before drafting outreach or preparing for a " +
-      "meeting. Call record after every interaction, or whenever you learn something.",
+      "Nous — the revenue Context Graph for your coding agent. Operated by the agent, not a human " +
+      "clicking around: call whoami to confirm who you act as (workspace, scope, GTM role). Call " +
+      "get_context before drafting outreach or preparing for a meeting. Call record after every " +
+      "interaction, or whenever you learn something — you observe, Nous derives.",
     icons: [
       { src: "https://opennous.cloud/newlogoP.png", mimeType: "image/png", sizes: ["64x64"] },
     ],
   });
 
+  // Nous is fully a revenue plugin: this server exposes EXACTLY the 7 primitives and
+  // nothing else (the ~30 legacy tools were pruned). Writes: record · record_insight.
+  // Reads: get_context · get_account · query (search folds in via facts:true) · score.
+  // Identity: whoami (who the key acts as, scope, GTM role[s]) — the governance
+  // substrate. record_signal folds into record; save_note is out. The `tool()` guard
+  // keeps the surface locked to these seven — a stray non-primitive registration is
+  // dropped, not exposed. See docs/revenue-plugin/README.md §2–3.
+  const PLUGIN_TOOLS = new Set([
+    "record", "record_insight", "get_context", "get_account", "query", "score", "whoami",
+  ]);
+  const _tool = server.tool.bind(server);
+  const tool = (name, ...rest) => {
+    if (!PLUGIN_TOOLS.has(name)) return undefined;
+    return _tool(name, ...rest);
+  };
+
   // ===========================================================================
   // TOOL: get_context  —  POST /v2/context
   // The headline tool. Engineered, intent-shaped context for a specific task.
   // ===========================================================================
-  server.tool(
+  tool(
     "get_context",
     "Get engineered context for a specific task about a person or company. Pass their email (or " +
     "entity id) and the intent. Returns a focused, ranked context block: the facts that matter for " +
@@ -246,7 +215,7 @@ export function createServer() {
   // TOOL: get_account  —  GET /v2/accounts/:id
   // The full account-record projection. For a focused view, prefer get_context.
   // ===========================================================================
-  server.tool(
+  tool(
     "get_account",
     "Get the full account record for a person or company — the durable FACTS we've learned about them " +
     "(their atomic memory: budget, authority, pain, stack, plans), every attribute (claim) with its " +
@@ -370,96 +339,13 @@ export function createServer() {
     }
   );
 
-  // ===========================================================================
-  // TOOL: merge_contacts  —  POST /v2/accounts/merge
-  // Fold a duplicate person into one account record. Agent-only dedup.
-  // ===========================================================================
-  server.tool(
-    "merge_contacts",
-    "Merge two duplicate records for the SAME person into one account. Use when the same human exists " +
-    "twice — e.g. one record from a LinkedIn connection (no email) and one from a Cal.com booking (email, " +
-    "truncated name) that never got linked. Pass `keep` (the survivor) and `drop` (the duplicate to fold in); " +
-    "each may be an email, LinkedIn URL, entity UUID, or name. Lossless — the duplicate's identifiers (a second " +
-    "email, a LinkedIn URL) re-attach to the survivor, so a future match on EITHER resolves to the one account — " +
-    "and reversible. If a name matches several people you'll get candidates: confirm the survivor with the user, " +
-    "then re-call with the chosen entity ids. Prefer passing the keep that already has the most history.",
-    {
-      keep: z.string().describe("The survivor to keep — email, LinkedIn URL, entity UUID, or name."),
-      drop: z.string().describe("The duplicate to fold into keep — email, LinkedIn URL, entity UUID, or name."),
-    },
-    async ({ keep, drop }) => {
-      const r = await post("/v2/accounts/merge", { keep, drop });
-
-      if (r.status === "ambiguous") {
-        const opts = (r.candidates ?? []).map(c =>
-          `  • ${c.name ?? "(unnamed)"}${c.detail ? ` — ${c.detail}` : ""}  [${c.entity_id}]`).join("\n");
-        const term = r.which === "keep" ? keep : drop;
-        return { content: [{ type: "text", text:
-          `"${term}" (the ${r.which}) matches several people. Re-call merge_contacts with one of these entity ids as ${r.which}:\n${opts}` }] };
-      }
-
-      const moved = Object.entries(r.rows_repointed ?? {}).map(([t, n]) => `${n} ${t}`).join(", ");
-      const lines = [
-        `Merged — folded ${r.drop_id} into ${r.keep_id}.`,
-        `  identifiers re-attached: ${r.identifiers_moved}  (a future match on either now resolves to one account)`,
-        `  claims moved: ${r.claims_moved}${r.claims_conflicted ? ` (${r.claims_conflicted} kept on survivor)` : ""}`,
-        `  observations moved: ${r.observations_moved}`,
-        (r.relationships_repointed || r.relationships_removed)
-          ? `  relationships: ${r.relationships_repointed} re-pointed, ${r.relationships_removed} pruned` : null,
-        moved ? `  re-pointed: ${moved}` : null,
-        `Reversible: if this was wrong, unmerge_contacts with drop_id "${r.drop_id}" puts it all back.`,
-      ].filter(Boolean);
-      return { content: [{ type: "text", text: lines.join("\n") }] };
-    }
-  );
 
-  server.tool(
-    "unmerge_contacts",
-    "REVERSE a merge — split a wrongly-merged duplicate back out into its own account. Identify the " +
-    "merge to undo either by `drop_id` (the tombstone's id, exactly as merge_contacts reported it) or by " +
-    "`keep` (an identifier for the survivor — undoes the MOST RECENT merge into it). Every re-pointed " +
-    "identifier, claim, observation, relationship and the record itself go back where they were. " +
-    "Forward-only: it can only reverse merges made after reversible-merge tracking existed — an older " +
-    "merge returns a clear 'not reversible'. Use this when two DIFFERENT people were merged by mistake; " +
-    "it is not for editing a correctly-merged account.",
-    {
-      drop_id: z.string().optional().describe("The merged-away entity's id, from the merge_contacts result. Provide this OR keep."),
-      keep: z.string().optional().describe("The survivor (email, LinkedIn URL, entity UUID, or name) — undoes the most recent un-reversed merge into it."),
-    },
-    async ({ drop_id, keep }) => {
-      if (!drop_id && !keep) {
-        return { content: [{ type: "text", text: "Give me the drop_id from the merge result, or the `keep` survivor whose last merge to undo." }] };
-      }
-      try {
-        const r = await post("/v2/accounts/unmerge", { drop_id, keep });
-        if (r.status === "ambiguous") {
-          const opts = (r.candidates ?? []).map(c => `  • ${c.name ?? "(unnamed)"}  [${c.entity_id}]`).join("\n");
-          return { content: [{ type: "text", text: `"${keep}" matches several people. Re-call unmerge_contacts with one of these entity ids as keep:\n${opts}` }] };
-        }
-        const lines = [
-          `Un-merged — ${r.drop_id} is its own account again.`,
-          `  identifiers restored: ${r.identifiers}, claims: ${r.claims}, observations: ${r.observations}, relationships: ${r.relationships}`,
-          r.contact_restored ? `  the contact record was recreated.` : null,
-        ].filter(Boolean);
-        return { content: [{ type: "text", text: lines.join("\n") }] };
-      } catch (e) {
-        const msg = /not_reversible/.test(e.message)
-          ? "That merge can't be reversed — it predates reversible-merge tracking, or it was already un-merged."
-          : /no_reversible_merge/.test(e.message)
-          ? "No un-reversed merge on that survivor to undo."
-          : /entity_not_found/.test(e.message)
-          ? "Couldn't find that survivor — check the keep identifier."
-          : `Couldn't un-merge: ${e.message}`;
-        return { content: [{ type: "text", text: msg }] };
-      }
-    }
-  );
 
   // ===========================================================================
   // TOOL: record  —  POST /v2/observations
   // The single write verb. You observe — Nous derives the updated facts.
   // ===========================================================================
-  server.tool(
+  tool(
     "record",
     "Record what happened or what you learned about a person or company. You never overwrite " +
     "anything — you observe, and Nous derives the updated facts. Use kind:'event' for an interaction " +
@@ -467,14 +353,24 @@ export function createServer() {
     "kind:'state' for a fact (property like 'job_title', 'deal.proposal_amount'). Examples — sent an " +
     "email: {kind:'event',property:'interaction.email_sent',value:{description:'intro email'}}; " +
     "learned their title changed: {kind:'state',property:'job_title',value:'VP of Engineering'}; " +
-    "a fact ended (they left): {kind:'state',property:'job_title',value:null}.",
+    "a fact ended (they left): {kind:'state',property:'job_title',value:null}. For a piece of INTEL " +
+    "about the contact — a preference, an objection, a competitor they mentioned, a general note — " +
+    "use property:'intel' with a category: {kind:'state',property:'intel',value:{category:'objection'," +
+    "content:'skeptical about market demand',label:'Market demand skepticism'}} (category ∈ " +
+    "preference | objection | competitor | buying_signal | budget | timing | authority | general). " +
+    "Insights about YOUR OWN business (product/positioning/market/buyer) go to record_insight, not here.",
     {
-      focus: z.string().describe("Email address or entity UUID of the person or company"),
+      focus: z.string().describe("Email address, LinkedIn URL, domain, or entity UUID — a precise identifier, never a bare name"),
       observations: z.array(z.object({
         kind: z.enum(["event", "state"]).describe("event = an interaction; state = a fact"),
         property: z.string().describe("e.g. 'interaction.email_sent' or 'job_title'"),
         value: z.any().optional().describe("the event detail or the fact value; null = the fact ended"),
-        source: z.string().optional().describe("where this came from (default: agent)"),
+        source: z.string().optional().describe("where this came from — provider slug, e.g. 'fireflies', 'gmail' (default: agent)"),
+        method: z.string().optional().describe("api | webhook | extraction | inference | user_input (default: api)"),
+        observed_at: z.string().optional().describe("ISO timestamp of WHEN this happened/was true. REQUIRED when importing history — otherwise it's stamped now."),
+        external_id: z.string().optional().describe("idempotency key, unique per (source). Re-recording the same one is a no-op. One raw item → many observations → give each a distinct id, e.g. '<itemId>:<property>'."),
+        source_ref: z.string().optional().describe("pointer to the raw this came from, e.g. 'git://<repo>/raw/fireflies/2026-03-14-9182.md'. Keeps provenance without storing raw in Nous."),
+        content_hash: z.string().optional().describe("sha256 of the raw file, so a later fetch can be verified untampered. Set when raw lives in git (not sent here)."),
       })).describe("One or more observations to record"),
     },
     async ({ focus, observations }) => {
@@ -488,47 +384,39 @@ export function createServer() {
     }
   );
 
+
   // ===========================================================================
-  // TOOL: record_signal  —  a buying signal, as a structured signal.<class> fact
-  // A validated wrapper over record: one canonical way to write a signal, so it
-  // both shows on the account's Signals tab AND feeds the ICP scorecard as a
-  // feature (signal.* claims flow into the feature map the scorer reads).
+  // TOOL: record_insight  —  POST /v2/insights
+  // The mirror of record. record captures facts ABOUT the contact; this captures
+  // what a call/email taught us about OUR OWN business — product, positioning,
+  // market, buyer. Workspace-level (about us, no focus). Feeds the Insights page
+  // and theme clustering. In the plugin model the extraction runs on the agent's
+  // own tokens, so this is where those insights land.
   // ===========================================================================
-  server.tool(
-    "record_signal",
-    "Record a buying signal on a person or company — a concrete, current reason to reach out, " +
-    "found by research (signal-scan). Stored as a structured signal.<class> fact so it shows on the " +
-    "account's Signals tab AND feeds the ICP scoring model as a feature. One call per signal; one " +
-    "current signal per class (the strongest). class is one of stack | hiring | momentum | friction | " +
-    "intent | domain. score is 0-10 (exclusivity x intent — score honestly, a 4 is useful). Be " +
-    "specific: 'posted 3 SDR roles in 30 days', not 'they're growing'.",
+  tool(
+    "record_insight",
+    "Record what a call or email taught us about OUR OWN business — our product, positioning, " +
+    "market, or buyer. This is the MIRROR of record: record captures facts about the CONTACT; this " +
+    "captures what we learned about US. Workspace-level — there is no focus (it's not about one " +
+    "account). category is one of product | positioning | market | buyer. Include the verbatim quote " +
+    "and who said it whenever you can. These feed the Insights page and its theme clustering. Send " +
+    "all insights from one source in a single call. Do NOT put contact facts here — use record.",
     {
-      focus: z.string().describe("Email address or entity UUID of the person/company"),
-      signal_class: z.enum(["stack", "hiring", "momentum", "friction", "intent", "domain"])
-        .describe("the signal class"),
-      detected: z.string().describe("the specific, factual finding"),
-      implies: z.string().optional().describe("what the prospect is likely experiencing because of it"),
-      score: z.number().min(0).max(10).describe("strength 0-10 (exclusivity x intent)"),
-      approach: z.enum(["pain_led", "value_led", "fallback"]).optional()
-        .describe("recommended outreach approach"),
-      angle: z.string().optional().describe("one-line outreach angle this signal enables"),
+      insights: z.array(z.object({
+        category: z.enum(["product", "positioning", "market", "buyer"]).describe("which lens this is about"),
+        content: z.string().describe("the insight in one clear sentence, stated from OUR perspective"),
+        quote: z.string().optional().describe("the verbatim thing they said that supports it"),
+        speaker: z.string().optional().describe("who said it — a name or a role"),
+      })).describe("one or more insights extracted from the same call/email"),
+      source_label: z.string().optional().describe("where these came from, e.g. 'Acme discovery call'"),
+      occurred_at: z.string().optional().describe("ISO timestamp of the call/email"),
     },
-    async ({ focus, signal_class, detected, implies, score, approach, angle }) => {
-      const result = await post("/v2/observations", {
-        focus,
-        observations: [{
-          kind: "state",
-          property: `signal.${signal_class}`,
-          value: { detected, implies: implies ?? null, score, approach: approach ?? null, angle: angle ?? null },
-          source: "signal-scan",
-        }],
-      });
-      return {
-        content: [{
-          type: "text",
-          text: `Recorded ${signal_class} signal (score ${score}/10) on ${result.entity_id || focus}.`,
-        }],
-      };
+    async ({ insights, source_label, occurred_at }) => {
+      const r = await post("/v2/insights", { insights, source_label, occurred_at });
+      return { content: [{ type: "text", text:
+        `Recorded ${r.written} insight${r.written !== 1 ? "s" : ""}` +
+        (r.submitted && r.written < r.submitted ? ` (${r.submitted - r.written} were duplicates)` : "") +
+        ` into the workspace's product/positioning/market/buyer docs.` }] };
     }
   );
 
@@ -536,7 +424,7 @@ export function createServer() {
   // TOOL: query  —  POST /v2/query
   // Retrieve a corpus of activity across many people. You do the analysis.
   // ===========================================================================
-  server.tool(
+  tool(
     "query",
     "Retrieve and summarise activity across many people. Three powers:\n" +
     "  1. return:'entities' groups results by person/company (one row per entity, ranked by " +
@@ -566,6 +454,8 @@ export function createServer() {
         order: z.enum(["asc", "desc"]).optional().describe("observed_at order (default desc, newest first). Use 'asc' for an upcoming-meeting schedule (soonest first)"),
         limit: z.number().optional().describe("max items (default 50, cap 200)"),
         facts: z.boolean().optional().describe("search the FACTS corpus (durable atomic facts about accounts) instead of activity. Needs `question` — a cross-account semantic fact search, e.g. 'which accounts want off Clay'. return:'entities' = the best matching fact per account."),
+        reporting: z.enum(["company", "role"]).optional().describe("Return the distilled REPORTING for a seat instead of activity: 'role' = the insights routed to a GTM role (deal-blockers/objections with account counts + relevant themes, reframed for that seat); 'company' = the whole-company founder lens. Routed server-side by the caller's role — a member only ever gets their own seat, an admin/founder can ask for 'company' or any role."),
+        role: z.string().optional().describe("With reporting:'role', which seat to report for — account_executive | sdr | sales | customer_success | engineer | marketing | revops | founder. Defaults to the caller's own role(s) from whoami."),
       }).describe("Corpus filter"),
       without: z.object({
         kind: z.enum(["event", "state"]).optional(),
@@ -583,6 +473,28 @@ export function createServer() {
       if (without)    body.without = without;
       if (returnMode) body.return  = returnMode;
       const r = await post("/v2/query", body);
+
+      // Reporting response (scope.reporting) — distilled handlers + themes for a seat.
+      if (r.role_label !== undefined || r.reporting) {
+        const out = [`REPORTING · ${r.role_label || r.role}${r.reporting === "company" ? " (whole-company lens)" : ""}`, ""];
+        if ((r.handlers || []).length) {
+          out.push("DEAL BLOCKERS / OBJECTIONS (by accounts raising them):");
+          for (const h of r.handlers) {
+            out.push(`  • ${h.title}${h.account_count ? `  — ${h.account_count} account${h.account_count !== 1 ? "s" : ""}` : ""}` +
+                     (h.objection_summary ? `\n      ${h.objection_summary}` : ""));
+          }
+          out.push("");
+        }
+        if ((r.themes || []).length) {
+          out.push("SIGNALS / THEMES for this seat:");
+          for (const t of r.themes) out.push(`  • ${t.title}${t.takeaway ? ` — ${t.takeaway}` : ""}`);
+        }
+        if (!(r.handlers || []).length && !(r.themes || []).length) {
+          out.push("Nothing distilled for this seat yet — run some ingest/backfill so the reporting has material.");
+        }
+        return { content: [{ type: "text", text: out.join("\n").trim() }] };
+      }
+
       const head = `${r.matched} match${r.matched !== 1 ? "es" : ""}` +
                    (r.sampled ? ` (showing ${r.returned})` : "") +
                    (r.corpus === "facts" ? " · facts" : r.return === "entities" ? " · grouped by entity" : "");
@@ -626,1192 +538,137 @@ export function createServer() {
         const names = (r.candidates || []).map(c => c.name || c.entity_id).join(", ");
         return `ambiguous — several people match${names ? `: ${names}` : ""}. Score by email or LinkedIn URL instead.`;
       }
-      return "not in the graph yet — enrich this account first (signals/firmographics), then score.";
+      return "not in the graph yet — pass the lead's `attributes` (title, company, keywords) to score it inline, or enrich the account first.";
+    }
+    const layers = r.layered && r.layered.layers ? r.layered.layers : {};
+    const layerLine = Object.keys(layers).length ? `\n    layers: ${Object.entries(layers).map(([k, v]) => `${k} ${v}`).join(" · ")}` : "";
+    const work = (r.layered && r.layered.missing && r.layered.missing.length)
+      ? `\n    unknown: ${r.layered.missing.join(", ")} — ${r.layered.play || "enrich to resolve"}` : "";
+    if (!r.scored) {
+      // 'partial' — Fit/Pain resolved live (not staked). Show what we know + the worklist.
+      if (Object.keys(layers).length) return `partial fit${layerLine}${work}`;
+      return `known, but awaiting enrichment — no scoreable claims yet (${r.entity_id}).`;
     }
-    if (!r.scored) return `known, but awaiting enrichment — no scoreable claims yet (${r.entity_id}).`;
     const tier = (r.icp.tier || "").replace(/_/g, " ") || "untiered";
-    return `ICP ${r.icp.score}/100 (${tier})${r.icp.fit ? " ✓fit" : ""} · intent ${r.intent.score}/100 ${r.intent.band}` +
-           (r.icp.reason ? `\n    ${r.icp.reason}` : "");
+    const inline = r.source === "inline" ? " · scored inline (not in the graph)" : "";
+    return `ICP ${r.icp.score}/100 (${tier})${r.icp.fit ? " ✓fit" : ""} · intent ${r.intent.score}/100 ${r.intent.band}${inline}` +
+           layerLine + work + (r.icp.reason ? `\n    ${r.icp.reason}` : "");
   };
-  server.tool(
+  tool(
     "score",
     "Score a lead against our live ICP model and intent axis, and write the judgment into the graph so " +
     "every other agent reads the same number. This is for scoring a list the user built ELSEWHERE (a " +
     "Google Sheet, a Clay column, a CRM export): the list stays where it is, Nous returns the score. " +
     "Give an email, domain, LinkedIn URL, or entity UUID (or up to 100 at once via `identifiers`). " +
-    "Returns ICP fit 0-100 + tier (tier_1/2/3/not_icp, which drives the play) and decaying intent " +
-    "0-100 + band. It reads the live score (staking one on demand for a known-but-unscored account); " +
-    "the score keeps evolving on its own afterwards. If a row isn't in the graph yet it comes back " +
-    "`unknown_identifier` — enrich that account first (signal-scan / a lead-builder), then score.",
+    "Returns ICP fit 0-100 + tier (tier_1/2/3/not_icp, which drives the play), decaying intent " +
+    "0-100 + band, AND the LAYERED read: layers {fit,pain,intent,ability} with a `missing` worklist " +
+    "(what's still unknown — unknown is never 0) and a suggested `play`. It reads the live score " +
+    "(staking one on demand for a known-but-unscored account); the score keeps evolving afterwards. " +
+    "COLD LEAD not in Nous? Pass `attributes` (title, company, keywords/headline) and it's scored " +
+    "INLINE against the model — Fit/Pain resolve from what you have, nothing is written. For a whole " +
+    "EXTERNAL list, pass `leads` (up to 1000 attribute objects) — all scored inline in one call, model " +
+    "loaded once, nothing written — so you can triage a big list before deciding what to bring in. Only " +
+    "a bare identifier with no attributes and no graph record comes back `unknown_identifier`.",
     {
       identifier: z.string().optional().describe("One lead — an email, domain, LinkedIn URL, or entity UUID."),
-      identifiers: z.array(z.string()).optional().describe("A batch of leads (max 100 per call; loop for a larger list)."),
+      identifiers: z.array(z.string()).optional().describe("A batch of graph leads (max 100 per call; loop for a larger list)."),
+      attributes: z.record(z.any()).optional().describe("For a COLD lead NOT in Nous: its attributes from LinkedIn/a list — { job_title, seniority, company_type, industry, employee_count, keywords or headline, location }. Scored inline against the model; nothing is written. Use when the identifier isn't in the graph yet, or pass on its own with no identifier."),
+      leads: z.array(z.record(z.any())).optional().describe("An EXTERNAL cold list scored inline in one call (up to 1000): each item is an attributes object { job_title, company_type, keywords|headline, ... }, optionally with a `ref` echoed back. Nothing is written to the graph. Use to triage a big list before deciding which accounts to bring in."),
       intent: z.string().optional().describe("Optional hint about why you're scoring (recorded, does not change the score)."),
     },
-    async ({ identifier, identifiers, intent }) => {
+    async ({ identifier, identifiers, intent, attributes, leads }) => {
+      if (Array.isArray(leads) && leads.length) {
+        const r = await post("/v2/score", { leads });
+        const rows = r.results || [];
+        const scored = rows.filter(x => x.scored);
+        const byTier = {};
+        for (const x of scored) { const t = (x.icp?.tier || "untiered").replace(/_/g, " "); byTier[t] = (byTier[t] || 0) + 1; }
+        const dist = Object.entries(byTier).sort((a, b) => b[1] - a[1]).map(([t, n]) => `${t} ${n}`).join(" · ") || "none";
+        return { content: [{ type: "text", text: `Scored ${scored.length}/${rows.length} inline (nothing written). Tiers: ${dist}` }] };
+      }
       if (Array.isArray(identifiers) && identifiers.length) {
         const r = await post("/v2/score", { identifiers, intent });
         const lines = (r.results || []).map(x => `  ${x.identifier} — ${scoreOne(x)}`);
         const scored = (r.results || []).filter(x => x.scored).length;
         return { content: [{ type: "text", text: `Scored ${scored}/${(r.results || []).length}:\n${lines.join("\n")}` }] };
       }
-      const r = await post("/v2/score", { identifier, intent });
-      return { content: [{ type: "text", text: `${identifier} — ${scoreOne(r)}` }] };
+      const r = await post("/v2/score", { identifier, intent, attributes });
+      return { content: [{ type: "text", text: `${identifier || "cold lead"} — ${scoreOne(r)}` }] };
     }
   );
 
-  // ===========================================================================
-  // TOOL: attention  —  GET /v2/attention
-  // What to look at: accounts gone quiet, key facts decayed.
-  // ===========================================================================
-  server.tool(
-    "attention",
-    "What needs your attention across the workspace right now — upcoming meetings and calls in the " +
-    "next 7 days (each with its date and time, soonest first), accounts that have gone quiet, and key " +
-    "facts that have decayed. Returns ranked items (time-critical meetings lead), each with what's " +
-    "happening and a suggested action. Call this to decide what to work next, or to answer 'what's " +
-    "coming up' / 'what's on my calendar this week'. For a precise single-day list, use query with " +
-    "property:'interaction.meeting_scheduled' and from/to.",
-    {
-      limit: z.number().min(1).max(100).optional().describe("Max items (default 25)"),
-    },
-    async ({ limit }) => {
-      const r = await get("/v2/attention", limit ? { limit } : {});
-      if (!r.items?.length) {
-        return { content: [{ type: "text", text: "Nothing needs attention right now." }] };
-      }
-      // Upcoming meetings carry a `when` — render the absolute local date+time.
-      //
-      // Each item also names where it came from: the calendar holding the call, the
-      // transcript the promise was captured from. An agent that can cite the call
-      // someone made a promise ON is making an argument; one that just asserts the
-      // promise is asking to be trusted.
-      const lines = r.items.map(it => {
-        const when = it.when ? `${fmtWhen(it.when)} — ` : "";
-        const from = it.source ? `  [${it.source}]` : "";
-        return `  ${when}${it.entity_name ?? it.entity_id} — ${it.what}${from}\n      → ${it.suggested_action}`;
-      });
-      return { content: [{ type: "text", text: `Needs attention (${r.items.length}):\n${lines.join("\n")}` }] };
-    }
-  );
 
-  // ===========================================================================
-  // TOOL: campaign_performance  —  GET /v2/campaigns/performance
-  // The aggregate outbound feedback loop: which campaign/variant earns positive
-  // replies, and from good-fit accounts.
-  // ===========================================================================
-  server.tool(
-    "campaign_performance",
-    "Outbound campaign feedback loop: how each cold-email/LinkedIn campaign and sequence step is landing, " +
-    "sliced by reply sentiment and the ICP tier of who replied positively. Use to answer 'which campaign " +
-    "or variant gets the most positive replies?', 'is my best campaign landing on good-fit accounts?', or " +
-    "'which copy should I scale vs cut?'. positive_rate is positive replies / total replies (not / sent).",
-    {},
-    async () => {
-      const r = await get("/v2/campaigns/performance", {});
-      const camps = r.campaigns || [];
-      if (!camps.length) return { content: [{ type: "text", text: "No campaign replies logged yet." }] };
-      const t = r.totals || {};
-      const pct = (n) => n == null ? "—" : `${Math.round(n * 100)}%`;
-      const lines = camps.map(c => {
-        const cap = c.captured || {};
-        const pt = c.provider_totals, pr = c.provider_rates;
-        const tiers = c.tier_of_positive || {};
-        const good = (tiers.tier_1 || 0) + (tiers.tier_2 || 0);
-        const funnel = pt
-          ? `      funnel: ${pt.sent ?? "?"} sent → ${pt.contacted ?? "?"} contacted → ${pt.replies ?? "?"} replies (${pct(pr?.reply_rate)}) → ${pt.opportunities ?? "?"} opportunities (${pct(pr?.opportunity_rate)})`
-          : `      funnel: (no provider analytics yet)`;
-        const conv = `${c.conversions || 0} client${c.conversions === 1 ? "" : "s"}${c.median_days_to_client != null ? ` (avg ${c.median_days_to_client}d)` : ""}${c.in_progress ? `, ${c.in_progress} in evaluation` : ""}`;
-        const steps = (c.steps || []).map(s => {
-          const subj = s.subject ? ` — "${s.subject}"` : "";
-          return `      step ${s.step ?? "—"}${subj}: ${s.positive}/${s.replies} positive (${pct(s.positive_rate)})`;
-        }).join("\n");
-        const obj = (c.top_objections || []).length
-          ? `\n      objections/pains: ${c.top_objections.slice(0, 4).map(o => `“${String(o).slice(0, 90)}”`).join("; ")}`
-          : "";
-        return `  ${c.campaign_name || c.campaign_id}\n` +
-          funnel + "\n" +
-          `      captured sample: ${cap.replies} replies — ${cap.positive} positive (${pct(cap.positive_rate)}), ${cap.neutral} neutral, ${cap.negative} negative\n` +
-          `      converted: ${conv}\n` +
-          `      positive repliers: avg ICP ${c.avg_icp_of_positive ?? "?"}, ${good} tier-1/2 of ${cap.positive}` +
-          (steps ? `\n${steps}` : "") + obj;
-      });
-      const head = `Campaign performance (${t.conversions || 0} clients · ${t.sent || 0} sent · ${t.positive || 0}/${t.replies || 0} captured replies positive):`;
-      return { content: [{ type: "text", text: `${head}\n${lines.join("\n")}` }] };
-    }
-  );
 
-  // ===========================================================================
-  // TOOL: pipeline_intelligence  —  GET /v2/pipeline/intelligence
-  // What converts, and how long it takes: stage distribution, stage-to-stage
-  // conversion %, median time-to-client, median time-in-stage.
-  // ===========================================================================
-  server.tool(
-    "pipeline_intelligence",
-    "How the pipeline actually converts: how many accounts sit at each stage right now, the stage-to-stage " +
-    "conversion rate (of everyone who reached a stage, how many reached the next — where deals leak), the " +
-    "median days to turn a lead into a client, and the median time spent in each stage. Use to answer 'how " +
-    "long does it take us to close?', 'where are deals stalling?', or 'what's my funnel look like?'.",
-    {},
-    async () => {
-      const r = await get("/v2/pipeline/intelligence", {});
-      const pct = (n) => n == null ? "—" : `${Math.round(n * 100)}%`;
-      const cc = r.current_stage_counts || {};
-      // The funnel, lowest → highest, then the terminals. SOURCE OF TRUTH:
-      // PIPELINE_LADDER + TERMINAL_STAGES in packages/core/src/pipeline.ts. This
-      // package publishes standalone and has no @nous/core dependency, so the
-      // list is copied here. Keep it in step with core.
-      const order = [
-        "identified", "connected", "interested", "meeting_booked",
-        "discovery", "demo", "negotiation", "closed_won",
-        "closed_lost", "disqualified", "churned",
-      ];
-      // Ladder order first, then any stage the API sent that this copy doesn't
-      // know about. The old list had no proposal, negotiation or demo in it and
-      // the filter silently dropped everything it missed, so late-funnel accounts
-      // disappeared from the distribution entirely. A stage must never vanish
-      // just because a copy of the list went stale.
-      const byStage = (obj, keep) => [
-        ...order.filter(s => keep(obj[s])),
-        ...Object.keys(obj).filter(s => !order.includes(s) && keep(obj[s])),
-      ];
-      const dist = byStage(cc, v => !!v).map(s => `${s} ${cc[s]}`).join(" · ") || "no staged accounts";
-      const conv = (r.stage_conversion || []).map(c => `      ${c.from} → ${c.to}: ${pct(c.rate)} (${c.reached_to}/${c.reached_from})`).join("\n");
-      const dis = r.median_days_in_stage || {};
-      const inStage = byStage(dis, v => v != null).map(s => `${s} ${dis[s]}d`).join(" · ");
-      const text = `Pipeline (${r.accounts || 0} accounts, ${r.clients || 0} clients):\n` +
-        `  now: ${dist}\n` +
-        `  median days to client: ${r.median_days_to_client ?? "— (no wins yet)"}\n` +
-        `  stage-to-stage conversion:\n${conv || "      (none yet)"}\n` +
-        (inStage ? `  median time in stage: ${inStage}` : "");
-      return { content: [{ type: "text", text }] };
-    }
-  );
 
-  // ===========================================================================
-  // TOOL: pipeline  —  GET /v2/pipeline/portfolio
-  // The whole account portfolio in one call: health/band, ICP fit, stage,
-  // days-quiet, open flags, open objections, live competitors, engagement trend,
-  // multi-threading. The "reason over my whole book" tool.
-  // ===========================================================================
-  server.tool(
-    "pipeline",
-    "The whole ACCOUNT PORTFOLIO in one call — every in-touch account with its deal health + band, " +
-    "ICP fit, pipeline stage, days-quiet, open re-engagement flags, open-objection count, live competitors, " +
-    "engagement trend (rising/steady/cooling/cold), and multi-threading, plus a stage-count breakdown. Use " +
-    "for any portfolio question: 'which accounts are cooling', 'who should I re-engage', 'where is competitive " +
-    "risk highest', 'what's slipping', 'great-fit deals gone cold', 'analyze my pipeline'. Reason over the list.",
-    { limit: z.number().optional().describe("Cap on accounts returned (default: all, most-actionable first)") },
-    async (input) => {
-      const r = await get("/v2/pipeline/portfolio", input.limit ? { limit: input.limit } : {});
-      const stages = Object.entries(r.stage_counts || {}).map(([s, n]) => `${s} ${n}`).join(" · ");
-      const rows = (r.accounts || []).slice(0, input.limit || 60).map(a => {
-        const bits = [
-          a.name,
-          `health ${a.health ?? "—"} (${a.band})`,
-          a.icp != null ? `ICP ${a.icp}` : null,
-          `stage ${a.stage}`,
-          a.days_quiet != null ? `quiet ${a.days_quiet}d` : null,
-          `engagement ${a.engagement_trend}`,
-          a.single_threaded ? "single-threaded" : `${a.engaged_contacts}/${a.total_contacts} engaged`,
-          a.open_objections ? `${a.open_objections} open objection${a.open_objections === 1 ? "" : "s"}` : null,
-          a.competitors?.length ? `competitors: ${a.competitors.join(", ")}` : null,
-          a.flags?.length ? `flags: ${a.flags.join(", ")}` : null,
-        ].filter(Boolean);
-        return `  • ${bits.join(" — ")}`;
-      }).join("\n");
-      const text = `Portfolio (${r.total || 0} in-touch accounts). By stage: ${stages || "—"}\n${rows || "  (none)"}`;
-      return { content: [{ type: "text", text }] };
-    }
-  );
 
-  // ===========================================================================
-  // TOOL: get_action_items  —  GET /v2/action-items
-  // Commitments extracted from meetings/emails — what you owe each account.
-  // ===========================================================================
-  server.tool(
-    "get_action_items",
-    "Your open action items and commitments, pulled from meeting notes and emails — what you owe " +
-    "which account (and what they owe you), so you don't have to dig through transcripts. Use for " +
-    "'what are my action items', 'what do I owe <account>', 'what's outstanding this week'. Defaults " +
-    "to YOUR open items across all accounts, grouped by account.",
-    {
-      owner:  z.enum(["me", "prospect", "all"]).optional().describe("Whose commitments — me (default), the prospect, or all"),
-      status: z.enum(["open", "done", "all"]).optional().describe("open (default), done, or all"),
-      focus:  z.string().optional().describe("Scope to one account — an email or entity UUID"),
-      due:    z.enum(["today", "week", "all"]).optional().describe("Only items due today / this week (items that carry a due date) — default all"),
-    },
-    async ({ owner, status, focus, due }) => {
-      const params = {};
-      if (owner)  params.owner  = owner;
-      if (status) params.status = status;
-      if (focus)  params.focus  = focus;
-      if (due)    params.due    = due;
-      const r = await get("/v2/action-items", params);
-      const items = r.items ?? [];
-      if (!items.length) return { content: [{ type: "text", text: "No matching action items." }] };
 
-      const byAccount = new Map();
-      for (const it of items) {
-        const key = it.account || it.account_email || it.entity_id || "—";
-        if (!byAccount.has(key)) byAccount.set(key, []);
-        byAccount.get(key).push(it);
-      }
-      const lines = [`${items.length} action item${items.length !== 1 ? "s" : ""}:`];
-      for (const [account, list] of byAccount) {
-        lines.push(`\n${account}:`);
-        for (const it of list) {
-          const who  = it.owner_kind === "prospect" ? "[them]" : "[you]";
-          const when = it.due_at ? `  (due ${fmtWhen(it.due_at)})` : "";
-          lines.push(`  ${who} ${it.title}${when}`);
-        }
-      }
-      return { content: [{ type: "text", text: lines.join("\n") }] };
-    }
-  );
 
-  // ===========================================================================
-  // TOOL: verify  —  POST /v2/verify
-  // Re-check a fact before acting on it — the calibration check.
-  // ===========================================================================
-  server.tool(
-    "verify",
-    "Re-check a specific fact before you act on it — e.g. an email or a deal stage that looks stale " +
-    "in get_context. Pass the person/company and the property name. Returns the fact re-derived from " +
-    "current evidence, and tells you whether it is still unverified.",
-    {
-      focus: z.string().describe("Email, LinkedIn URL, entity UUID, or name"),
-      property: z.string().describe("The fact to re-check — e.g. 'email', 'job_title', 'pipeline_stage'"),
-    },
-    async ({ focus, property }) => {
-      const r = await post("/v2/verify", { focus, property });
-      if (r.status === "ambiguous") {
-        const opts = (r.candidates ?? []).map(c =>
-          `  • ${c.name ?? "(unnamed)"}${c.detail ? ` — ${c.detail}` : ""}  [${c.entity_id}]`).join("\n");
-        return { content: [{ type: "text", text:
-          `"${focus}" matches several people. Call verify again with one of these entity ids:\n${opts}` }] };
-      }
-      const a = r.after ?? {};
-      return { content: [{ type: "text", text:
-        `${property}: ${fmtVal(a.value)}  [${pct(a.confidence)} · ${a.freshness}]\n${r.note ?? ""}` }] };
-    }
-  );
 
-  // ===========================================================================
-  // TOOLS: get_foundation / sync_foundation  —  the POLICY layer (vs. facts).
-  // Foundations are versioned rule-docs that GOVERN agent behavior: voice, outreach,
-  // icp, positioning. Read the relevant one BEFORE acting; push file edits back so
-  // every agent obeys the same rules. GET/POST /v2/foundations.
-  // ===========================================================================
-  const getFoundationSchema = {
-    kind: z.enum(["voice", "outreach", "icp", "positioning"]).optional()
-      .describe("Which policy to read. Omit to list all four."),
-  };
-  const getFoundationHandler = async ({ kind }) => {
-    const r = await get("/v2/foundations", kind ? { kind } : undefined);
-    const pbs = r.foundations || [];
-    if (!pbs.length) return { content: [{ type: "text", text:
-      "No foundations set up yet. The user can set them up on the Foundations page or in their context files." }] };
-    if (kind) {
-      const pb = pbs[0];
-      const src = pb.source === "claude_code" ? `mirrors ${pb.file_path}` : "stored in Nous";
-      return { content: [{ type: "text", text:
-        `# ${pb.title} — ${pb.kind} foundation (v${pb.version}, ${src})\n\n${pb.body_md}` }] };
-    }
-    const lines = pbs.map(p => `  ${p.kind.padEnd(12)} ${p.title}  (${p.source === "claude_code" ? p.file_path : "stored in Nous"})`);
-    return { content: [{ type: "text", text:
-      "The user's foundations (read one with get_foundation(kind)):\n" + lines.join("\n") }] };
-  };
-  server.tool("get_foundation",
-    "Read a FOUNDATION — the user's policy/rules for a kind of action: voice, outreach, icp, or positioning. " +
-    "These are RULES TO OBEY, not facts. Read the relevant foundation BEFORE you act: before writing outreach " +
-    "read 'voice' and 'outreach'; before scoring or qualifying read 'icp'; for messaging read 'positioning'. " +
-    "Omit kind to list all four.",
-    getFoundationSchema, getFoundationHandler);
 
-  const syncFoundationSchema = {
-    kind: z.enum(["voice", "outreach", "icp", "positioning"]).describe("Which foundation to update."),
-    body_md: z.string().describe("The full markdown content of the foundation. Follow the Nous document house style so every foundation reads like a clean text file: a '# Title' line, a '> ' one-paragraph lede, an optional plain 'Key: value' block, a '---' divider, then '## Title-case' sections with plain '- ' bullets. Keep it markdown, no decorative formatting."),
-    file_path: z.string().optional().describe("The repo file this mirrors, e.g. 'context/icp/icp.md'. Pass it when syncing a Claude Code file so the source is recorded as the file."),
-  };
-  const syncFoundationHandler = async ({ kind, body_md, file_path }) => {
-    const r = await post(`/v2/foundations/${kind}`, { body_md, file_path });
-    return { content: [{ type: "text", text:
-      `Synced the ${r.foundation?.kind || kind} foundation into Nous (v${r.foundation?.version}). Other agents now read the same rules.` }] };
-  };
-  server.tool("sync_foundation",
-    "Push a foundation's content into Nous so the graph stays current. You MUST call this in the SAME turn " +
-    "whenever you edit a policy file in the repo (e.g. references/voice.md, outreach rules), passing the " +
-    "file's new content and its path, so Nous mirrors it and every other agent obeys the same rules. An " +
-    "edited foundation file that isn't synced is silently inert — other agents keep reading the old rules. " +
-    "MIRROR, DO NOT REWRITE: when the user already has a foundation file, sync it AS-IS. Their file is the " +
-    "author and Nous is the mirror — always pass file_path so the next sync knows where an in-app edit " +
-    "lands. 'Improving' their wording on the way through means the copy in Nous silently disagrees with " +
-    "the copy in their repo, and they will trust neither. If a file looks wrong, SAY SO; don't fix it in " +
-    "transit. " +
-    "(For the ICP/context files specifically, sync_icp is the sync — use that one.)",
-    syncFoundationSchema, syncFoundationHandler);
+  // (Retired 2026-08-22) propose_vault_file — the agent no longer authors files into a
+  // member's personal vault. The vault surface is now the Sync page only (connect a repo);
+  // Nous auto-pushes account/people EVIDENCE to `nous/` in that repo, and agent-authored
+  // knowledge lives Nous-side (save_note on the account record), not as approval-gated files.
+  // The inbox approval flow was retired with it. See AIOS decisions/log.md 2026-08-22.
 
-  // ===========================================================================
-  // TOOL: get_insights  —  what Nous LEARNED about us from calls (the mirror of
-  // foundations). Insights are auto-extracted from call transcripts into four docs:
-  // product, positioning, market, buyer. READ-ONLY over MCP — the extractor
-  // authors them, not agents. GET /v2/insights[?category=].
-  // ===========================================================================
-  const getInsightsSchema = {
-    category: z.enum(["product", "positioning", "market", "buyer"]).optional()
-      .describe("Which insight doc to read. Omit to list all four."),
-  };
-  const getInsightsHandler = async ({ category }) => {
-    const r = await get("/v2/insights", category ? { category } : undefined);
-    const docs = r.insights || [];
-    if (!docs.length) return { content: [{ type: "text", text:
-      "No insights captured yet. They fill automatically from call transcripts (product, positioning, market, buyer)." }] };
-    if (category) {
-      const d = docs[0];
-      return { content: [{ type: "text", text:
-        `# ${d.title} insights (v${d.version})\n\n${d.body_md || "(empty)"}` }] };
-    }
-    const lines = docs.map(d => `  ${d.category.padEnd(12)} ${d.title}  (v${d.version})`);
-    return { content: [{ type: "text", text:
-      "What Nous learned about us from calls (read one with get_insights(category)):\n" + lines.join("\n") }] };
-  };
-  server.tool("get_insights",
-    "Read INSIGHTS — what Nous learned about US from call transcripts, the mirror of the foundations/foundations " +
-    "the user authors. Four docs: product (what to build), positioning (how to message), market (segments, " +
-    "wedges, channels), buyer (ICP, the pain that drives the purchase). These accumulate automatically after " +
-    "every call. Read them when working on product direction, messaging, GTM strategy, or targeting. Omit " +
-    "category to list all four.",
-    getInsightsSchema, getInsightsHandler);
 
-  // ===========================================================================
-  // TOOL: save_note  —  POST /v2/notes
-  // Attach a long-form artifact to a CONTACT: a meeting brief you wrote, a
-  // transcript, pre-meeting prep, or a plain note. Append-only and dated, so the
-  // contact builds a record across meetings. Distinct from `record` (which logs
-  // that an interaction happened) — this keeps the document itself.
-  // ===========================================================================
-  server.tool(
-    "save_note",
-    "Save a note or document onto a person or company so it is kept on their record — a meeting " +
-    "brief you wrote, a transcript, pre-meeting prep, research, or a plain note. Use this whenever " +
-    "you produce something durable about a specific contact that's worth keeping for next time (e.g. " +
-    "after writing a meeting brief, save it to the contact so future meetings can reference it). " +
-    "Notes are append-only and dated, so a contact builds a record across meetings — later you can " +
-    "read the last few and see what changed. This is NOT for logging that an interaction happened " +
-    "(use `record` with an interaction.* event for that), and NOT for the user's own GTM profile " +
-    "(that lives in their context files — sync it with `sync_icp`). Put the full text in `content` — it's kept for agents to read; the " +
-    "UI shows the title and date, not the whole body.",
-    {
-      focus: z.string().describe("Who to attach it to — an email, LinkedIn URL, domain, or entity UUID (not a bare name)."),
-      content: z.string().describe("The full note or document text (a short note or a complete brief/transcript)."),
-      type: z.enum(["note", "meeting_brief", "transcript", "meeting_notes", "pre_meeting", "research"])
-        .optional().describe("What kind of document this is (default: note)."),
-      title: z.string().optional().describe("A short name, e.g. 'Pre-meeting brief — renewal' or 'Transcript — Jun 1'."),
-      date: z.string().optional().describe("The relevant date (e.g. the meeting date, ISO or plain). Defaults to now."),
-    },
-    async ({ focus, content, type, title, date }) => {
-      const r = await post("/v2/notes", { focus, content, type, title, date });
-      const label = title || (r.doc_type || "note").replace(/_/g, " ");
-      return { content: [{ type: "text", text: `Saved ${label} to ${focus}.` }] };
-    },
-  );
 
-  // ===========================================================================
-  // TOOL: propose_vault_file  —  POST /v2/personal/propose
-  // Propose a markdown file into the member's PERSONAL vault. It lands in their
-  // inbox as a proposal — the member approves it before it is filed into a folder
-  // or synced to their Git. This is how an agent contributes to a member's own
-  // notes (thoughts, decisions, briefs, content) without writing anything without
-  // consent. Distinct from `save_note` (which attaches a document to a CONTACT's
-  // record) — this is the member's private vault, not an account.
-  // ===========================================================================
-  server.tool(
-    "propose_vault_file",
-    "Propose a markdown file into the member's personal vault (their private notes, not an " +
-    "account). It lands in their INBOX as a proposal — the member approves it before it's filed " +
-    "into a folder and synced to their Git; nothing is written without their approval. Use this to " +
-    "draft a thought, a decision record, a brief, or content for the member to review and keep. " +
-    "Pick the destination folder. This is NOT for notes on a contact (use save_note) and NOT for the " +
-    "GTM profile (use sync_icp).",
-    {
-      folder: z.enum(["inbox", "thoughts", "decisions", "projects", "briefs", "content", "company"])
-        .describe("Where it files once approved. ROUTING: briefs = a one-off account or meeting brief, filed FLAT (no subfolder). projects = ongoing recurring analysis by area (with a subfolder): pipeline/funnel review -> projects, subfolder 'pipeline'; campaign analysis -> projects, subfolder 'campaigns'; an initiative -> projects, subfolder = its name. content = anything to publish/send (post, newsletter, outbound copy, market/research write-up). decisions = a decision. thoughts = a loose idea. company = the company's own context. Don't pick 'inbox' — that's where it lands to await approval."),
-      name: z.string().describe("The file name, ending in .md, for what it is plus the date, e.g. 'Pipeline Review — 2026-08-12.md'."),
-      content: z.string().describe("The full markdown content of the file."),
-      subfolder: z.string().optional().describe("REQUIRED for 'projects' — the area: 'pipeline', 'campaigns', or the initiative name. Leave empty for 'briefs' (flat) and other folders."),
-    },
-    async ({ folder, name, content, subfolder }) => {
-      await post("/v2/personal/propose", { folder, name, content, subfolder });
-      return { content: [{ type: "text", text: `Proposed "${name}" into ${folder}. It's waiting in the member's inbox for approval.` }] };
-    },
-  );
 
-  // ===========================================================================
-  // TOOL: search_notes  —  POST /v2/notes/search
-  // Semantic search over saved notes & documents (briefs, transcripts, notes).
-  // The retrieval counterpart to save_note — pull relevant document content
-  // instead of dumping whole documents into context.
-  // ===========================================================================
-  server.tool(
-    "search_notes",
-    "Semantically search the saved notes & documents (meeting briefs, transcripts, meeting notes) " +
-    "kept on contacts. Use this to pull relevant content from the record — e.g. 'what did we discuss " +
-    "about pricing', 'objections raised in past meetings', or to compare across a contact's meetings. " +
-    "Pass `focus` to restrict to one person/company, or omit it to search across everyone. Returns the " +
-    "matching documents (type, title, date, similarity, snippet); get the full body with get_account.",
-    {
-      question: z.string().describe("Natural-language query to match against document content."),
-      focus: z.string().optional().describe("Optional — restrict to one person/company (email, LinkedIn URL, domain, or entity UUID)."),
-      limit: z.number().optional().describe("Max documents to return (default 8)."),
-    },
-    async ({ question, focus, limit }) => {
-      const r = await post("/v2/notes/search", { question, focus, limit });
-      if (!r.documents?.length) {
-        return { content: [{ type: "text", text: `No saved documents matched "${question}".` }] };
-      }
-      const lines = [`Documents matching "${question}":`, ""];
-      for (const d of r.documents) {
-        const when = d.date ? `  [${relAge(d.date)}]` : "";
-        // similarity is null for recency-matched hits (a note too fresh to be
-        // embedded yet) — label those "recent" instead of a bogus 0%.
-        const match = d.similarity == null ? "recent" : pct(d.similarity);
-        lines.push(`  ${d.type.replace(/_/g, " ")}${d.title ? ` · ${d.title}` : ""}  (${match})${when}`);
-        if (d.snippet) lines.push(`    ${d.snippet}`);
-        lines.push(`    (entity_id: ${d.entity_id})`);
-      }
-      return { content: [{ type: "text", text: lines.join("\n").trim() }] };
-    },
-  );
 
   // ===========================================================================
-  // TOOL: get_workspace_status  —  GET /v2/workspace/status
-  // The "one main call." Nous is operated by the agent, so the agent needs to
-  // know the state of the workspace: is it onboarded, is the GTM foundation built,
-  // which integrations are connected, is CRM sync configured, are events live —
-  // and what to set up next. Call this at the start of a session.
-  // ===========================================================================
-  server.tool(
-    "get_workspace_status",
-    "See the whole setup state of this workspace in one call, plus a ranked NEXT STEPS list (each step " +
-    "carries its own why/how). Nous is operated by you, the agent — call this at the START of a session " +
-    "and walk the user top-down through the steps it returns; the server sequences them by current " +
-    "state, so trust that order. Two constraints when acting on them: (1) Gmail (Google OAuth) and " +
-    "LinkedIn (no public API — Nous uses Unipile) CANNOT be connected by you — point the user to the " +
-    "Integrations page; key-based tools (Prospeo, Apollo, Instantly, HubSpot token) you CAN connect via " +
-    "connect_integration, and CSV import is a user action in the app. (2) Respect the plan — never push " +
-    "a feature it doesn't include (e.g. CRM sync on free). Recommend the next 1-2 steps, don't dump the " +
-    "whole list.",
-    {},
-    async () => {
-      const s = await get("/v2/workspace/status");
-      const setup = s.setup ?? {};
-      const lines = [];
+  // A closed deal as the agent may supply it. A bare domain is the original shape and still
+  // works; the object form carries the money and the date, which the forecast needs. Widened
+  // rather than replaced so nothing that already calls this breaks.
+  const CLOSED_DEAL = z.union([
+    z.string(),
+    z.object({
+      domain: z.string().describe("Company domain, e.g. 'acme.com' — no scheme."),
+      amount: z.number().optional().describe("Deal value in major units (48000, not 4800000)."),
+      currency: z.string().optional().describe("ISO code or symbol. Defaults to the workspace currency."),
+      closed_at: z.string().optional().describe("When it actually closed, ISO date. Drives every cycle-time measurement, so pass the real date rather than today's."),
+    }),
+  ]);
 
-      const ws = s.workspace ?? {};
-      lines.push(`WORKSPACE: ${ws.name || "(unnamed)"}${ws.website ? ` · ${ws.website}` : ""}${ws.business_type ? ` · ${ws.business_type}` : ""}`);
-      const pl = s.plan ?? {};
-      lines.push(`PLAN: ${pl.name || pl.id || "free"}${pl.crm_sync === false ? "  (CRM sync not included — do not offer it)" : ""}`);
-      if (s.self_hosted) {
-        const e = s.env_integrations ?? {};
-        const mk = (b) => (b ? "✓ set" : "✗ NOT set");
-        lines.push("SELF-HOSTED — these channels are wired via nous.env (you can't set env vars; tell the operator to set + restart):");
-        lines.push(`  LinkedIn/Unipile: ${mk(e.linkedin_unipile)}   Email/Resend: ${mk(e.email_resend)}   Gmail OAuth: ${mk(e.gmail_oauth)}`);
-      }
-      lines.push("");
 
-      const mark = (b) => (b ? "✓" : "✗");
-      lines.push("SETUP:");
-      // The ICP first, because it IS the gate — a workspace without one is not set up, no
-      // matter how many integrations are green. If it's mirrored from a file in their repo,
-      // say so and say where: that file is the author, and editing anything else is a way of
-      // losing their work on the next sync.
-      const icp = setup.icp ?? {};
-      lines.push(
-        `  ${mark(icp.done)} ICP${icp.done
-          ? (icp.source === "claude_code" && icp.file_path
-              ? ` — mirrored from ${icp.file_path} (their repo is the author; edit the FILE, then sync)`
-              : " — authored in Nous")
-          : " — MISSING. The workspace is not set up until this exists. Scan their repo before you ask them anything."}`
-      );
-      lines.push(`  ${mark(setup.onboarding?.done)} Profile${setup.onboarding?.done ? "" : ` — missing ${(setup.onboarding?.missing ?? []).join(", ") || "details"}`}`);
-      lines.push(`  ${mark(setup.gtm_playbook?.done)} GTM foundation${setup.gtm_playbook?.model ? " (scoring model live)" : ""}${setup.gtm_playbook?.stale_facts ? ` · ${setup.gtm_playbook.stale_facts} stale fact(s)` : ""}`);
-      if (setup.icp_sync) {
-        const sy = setup.icp_sync;
-        lines.push(`  ⟳ ICP synced from ${sy.synced_from} (${relAge(sy.synced_at)})${sy.model_changed ? " · model has CHANGED since — run export_icp_model to refresh the file" : ""}`);
-      }
-      const ints = setup.integrations?.connected ?? [];
-      lines.push(`  ${mark((setup.integrations?.count ?? 0) > 0)} Integrations (${setup.integrations?.count ?? 0})${ints.length ? `: ${ints.map((i) => i.name).join(", ")}` : ""}`);
-      const crm = setup.crm_sync ?? {};
-      if (crm.available === false) {
-        lines.push(`  – CRM sync (not on the ${pl.name || pl.id || "current"} plan)`);
-      } else {
-        lines.push(`  ${mark(crm.configured)} CRM sync${crm.configured ? `: ${(crm.providers ?? []).map((p) => p.provider).join(", ")}` : ""}${crm.pending_hygiene_proposals ? ` · ${crm.pending_hygiene_proposals} hygiene proposal(s) to review` : ""}`);
-      }
-      lines.push(`  ${mark(setup.enrichment?.connected)} Enrichment${setup.enrichment?.provider ? `: ${setup.enrichment.provider}` : ""}`);
-      lines.push(`  ${mark((setup.webhooks?.count ?? 0) > 0 || (setup.triggers?.count ?? 0) > 0)} Events — ${setup.webhooks?.count ?? 0} webhook(s), ${setup.triggers?.count ?? 0} trigger(s)`);
-      const rec = setup.recommended ?? {};
-      lines.push("");
-      lines.push("RECOMMENDED CHANNELS (connect these first):");
-      lines.push(`  ${mark(rec.email)} Email / Gmail   ${mark(rec.linkedin)} LinkedIn   ${mark(rec.meeting_notetaker)} Meeting note-taker`);
-      lines.push(`  Records imported: ${setup.records?.count ?? 0}`);
 
-      if (s.next_steps?.length) {
-        lines.push("");
-        lines.push("NEXT STEPS:");
-        for (const step of s.next_steps) {
-          lines.push(`  • ${step.title}`);
-          if (step.why) lines.push(`      why: ${step.why}`);
-          if (step.how) lines.push(`      how: ${step.how}`);
-        }
-      } else {
-        lines.push("");
-        lines.push("Everything's set up. Nothing pending.");
-      }
 
-      return { content: [{ type: "text", text: lines.join("\n").trim() }] };
-    }
-  );
 
-  // ===========================================================================
-  // TOOL: set_workspace_profile  —  POST /v2/workspace/onboarding
-  // Agent-driven onboarding. Instead of a human clicking through a wizard in the
-  // app, you collect the basics from the user in conversation and write them
-  // here. This is the first thing get_workspace_status asks for when a workspace
-  // is new.
-  // ===========================================================================
-  server.tool(
-    "set_workspace_profile",
-    "Onboard the workspace, or update its basic profile. Nous is set up by you, the agent, in " +
-    "conversation — not by the user clicking through a wizard. Ask the user for their company name, " +
-    "their website, whether they sell a SERVICE or SOFTWARE, and a sentence describing their ideal " +
-    "customer, then write them here. This seeds the GTM context and the ICP scoring model. Call " +
-    "get_workspace_status first to see what's already set; send only the fields you're setting or " +
-    "changing. " +
-    "IMPORTANT for the ICP: before asking the user to describe their ICP from scratch, if you're in " +
-    "Claude Code, look for an ICP they ALREADY wrote — folders like context/, .claude/, gtm/ and files " +
-    "named icp*, positioning*, pricing*, competitors*. If you find them, read them and call sync_icp to " +
-    "sync them (don't retype the ICP here); if none exists, scaffold a context/ folder (icp.md, " +
-    "positioning.md, pricing.md, market.md, competitors.md, gtm-motion.md) from the conversation + your " +
-    "site research, then sync_icp it — so their ICP lives in their repo. (Not in Claude Code? Capture a " +
-    "first cut in the `icp` field here instead.) " +
-    "After this, the next step is the context files: call sync_icp to sync them into the graph.",
-    {
-      name: z.string().optional().describe("The user's company / workspace name."),
-      website: z.string().optional().describe("The company website (used to seed the GTM context)."),
-      business_type: z.enum(["service", "software"]).optional()
-        .describe("Whether they sell a service or software — sets the CRM's buyer terminology and default signup stage."),
-      plan_model: z.enum(["free_plan", "free_trial", "both", "paid_only"]).optional()
-        .describe("For software only: how they package (free plan, free trial, both, or paid only)."),
-      default_signup_stage: z.string().optional()
-        .describe("The pipeline stage a brand-new signup lands in (e.g. 'Lead', 'Free User'). Defaults sensibly from business_type."),
-      icp: z.string().optional()
-        .describe("A sentence or two describing their ideal customer — seeds the ICP scoring model."),
-    },
-    async ({ name, website, business_type, plan_model, default_signup_stage, icp }) => {
-      const r = await post("/v2/workspace/onboarding", { name, website, business_type, plan_model, default_signup_stage, icp });
-      const w = r.workspace ?? {};
-      const set = [
-        w.name && `name=${w.name}`,
-        w.website && `site=${w.website}`,
-        w.business_type && `type=${w.business_type}`,
-        icp && "ICP recorded",
-      ].filter(Boolean);
-      return { content: [{ type: "text", text:
-        `Workspace profile saved.${set.length ? ` ${set.join(" · ")}.` : ""}\n` +
-        `Next: call get_workspace_status to see what to set up next (usually syncing the ICP/context files with sync_icp).` }] };
-    }
-  );
 
-  // ===========================================================================
-  // TOOL: build_icp_model  —  POST /v2/workspace/scoring-model
-  // The second half of building the GTM foundation. The agent syncs the GTM context
-  // from the user's files with sync_icp, then calls this to turn it into a weighted
-  // ICP scoring model. After this, accounts get scored for fit and
-  // get_workspace_status shows the foundation as done.
-  // ===========================================================================
-  server.tool(
-    "build_icp_model",
-    "Build (or rebuild) the user's ICP scoring model from their synced GTM context. This is " +
-    "the second half of setting up the GTM foundation: first sync the user's ICP/positioning/pricing " +
-    "files with sync_icp, then call this to translate that context into a weighted set of scoring " +
-    "signals so accounts get scored for fit. (sync_icp usually builds the model on first sync, so you " +
-    "often won't need this directly.) If a model already exists it is left alone unless you " +
-    "pass force:true (use that when the context files have changed and the model should be rebuilt). If " +
-    "it reports no GTM context yet, sync the user's context files with sync_icp first, then call this again. " +
-    "STRONGER than this tool: if the user can name a few closed-WON and closed-LOST customer domains, " +
-    "call train_icp_model instead (or as well) — it trains the model on real outcomes via " +
-    "contrastive lift, which beats a model inferred from a description.",
-    {
-      force: z.boolean().optional()
-        .describe("Rebuild the model even if one already exists — use when the GTM context has changed."),
-    },
-    async ({ force }) => {
-      try {
-        const r = await post("/v2/workspace/scoring-model", { force: force === true });
-        const signals = r.signals ?? [];
-        const lines = [`Built the ICP scoring model — ${signals.length} signal${signals.length === 1 ? "" : "s"}:`];
-        for (const s of signals) lines.push(`  • ${s.label ?? s.key} (weight ${s.weight})`);
-        lines.push("", "Accounts will now be scored for fit. Check it on the GTM Context page.");
-        return { content: [{ type: "text", text: lines.join("\n").trim() }] };
-      } catch (e) {
-        // Surface the actionable cases (no context yet / model already exists) as
-        // guidance rather than a raw error, so the agent knows what to do next.
-        const msg = String(e?.message ?? e);
-        if (msg.includes("no_gtm_context")) {
-          return { content: [{ type: "text", text:
-            "No GTM context yet. Sync the user's ICP/context files with sync_icp first (or scaffold context/icp.md, then sync_icp), then build the model." }] };
-        }
-        if (msg.includes("model_exists")) {
-          return { content: [{ type: "text", text:
-            "A scoring model already exists. Call build_icp_model again with force:true to rebuild it from the current GTM context." }] };
-        }
-        throw e;
-      }
-    }
-  );
 
-  // ===========================================================================
-  // TOOL: train_icp_model  —  POST /v2/workspace/closed-deals
-  // Build the ICP model from REAL outcomes via contrastive lift (won vs lost).
-  // ===========================================================================
-  server.tool(
-    "train_icp_model",
-    "Build (or sharpen) the ICP scoring model from the user's REAL closed deals. Pass closed-WON " +
-    "customer domains and closed-LOST domains; Nous enriches each, links the contacts you already " +
-    "have there, and runs contrastive lift (what's true of winners but not losers) to discover the " +
-    "signals that actually predict revenue — then re-scores open accounts. This is the strongest way " +
-    "to build the foundation: a model trained on who actually bought beats one inferred from a " +
-    "description. Ask the user for a handful of each (even 3-5 won + 3-5 lost helps). Domains only " +
-    "(e.g. 'acme.com'), no scheme.",
-    {
-      won: z.array(z.string()).optional().describe("Closed-won customer domains, e.g. ['acme.com','globex.com']."),
-      lost: z.array(z.string()).optional().describe("Closed-lost domains, e.g. ['tinyco.io']."),
-    },
-    async ({ won, lost }) => {
-      try {
-        const r = await post("/v2/workspace/closed-deals", { won: won ?? [], lost: lost ?? [] });
-        const disc = r.discovered ?? [];
-        const lines = [
-          `Learned from ${r.won ?? 0} won + ${r.lost ?? 0} lost deal${(r.won ?? 0) + (r.lost ?? 0) === 1 ? "" : "s"} ` +
-          `(${r.enriched ?? 0} enriched, ${r.mode === "winners" ? "winner-signal" : "contrastive-lift"} mode).`,
-        ];
-        if (disc.length) {
-          lines.push("", "Signals discovered:");
-          for (const d of disc) lines.push(`  • ${d.label} (weight ${d.weight})${d.note ? ` — ${d.note}` : ""}`);
-        }
-        lines.push("", "The model updated and open accounts were re-scored. See the GTM Context page.");
-        return { content: [{ type: "text", text: lines.join("\n").trim() }] };
-      } catch (e) {
-        const msg = String(e?.message ?? e);
-        if (msg.includes("need_more_deals")) {
-          return { content: [{ type: "text", text: "Give me at least one closed-won or closed-lost domain to learn from." }] };
-        }
-        throw e;
-      }
-    }
-  );
 
-  // ===========================================================================
-  // TOOL: sync_icp  —  POST /v2/workspace/icp/import
-  // The file→Nous half of the ICP symbiosis. In Claude Code the user often
-  // already keeps their ICP/positioning as markdown (context/icp.md, etc.). Don't
-  // make them re-author it in Nous — READ those files and sync them here. Nous
-  // mirrors each section and remembers the file path so export_icp_model can write
-  // the learned model back into the same file. Their file stays the source of
-  // truth for the prose; Nous owns the learned scoring half.
-  // ===========================================================================
-  server.tool(
-    "sync_icp",
-    "Sync the user's EXISTING ICP/positioning files into Nous, instead of making them re-author their " +
-    "ICP in a second place. CLAUDE CODE flow: when onboarding (or whenever their ICP files change), look " +
-    "in the project for an existing GTM setup — folders like context/, .claude/, gtm/, and files named " +
-    "icp*, positioning*, pricing*, competitors*, messaging*, market*. READ the ones you find with your " +
-    "own file tools, then call this with each file's content mapped to a section, AND its path in " +
-    "`source_path`. MAP GRANULARLY: map each FILE to the single section it best fits (icp.md -> ICP, " +
-    "positioning.md -> Positioning, pricing.md -> Pricing, competitors.md -> Competitors, market.md -> " +
-    "Market, messaging.md -> Notes) — one entry per file, do NOT dump several files' content into ICP. " +
-    "If one file holds several sections under headers, split it by header into multiple entries. " +
-    "Nous keeps a served copy of the prose and rebuilds the ICP scoring model from it; " +
-    "the recorded source_path is what export_icp_model writes the learned model back into. " +
-    "INCLUDE EXCLUSIONS: if the ICP names who they will NOT work with (e.g. 'not cold-calling " +
-    "agencies', 'no pure branding/messaging shops'), keep that text IN the ICP section — Nous turns " +
-    "each stated exclusion into a hard disqualifier that caps those accounts below Not-ICP, even when " +
-    "they also match the firmographics. So a 'Not a fit' list in icp.md actively lowers their score. " +
-    "IF NO ICP FILES EXIST: don't invent context in Nous. Offer to SCAFFOLD a context/ folder in their " +
-    "repo — context/icp.md, positioning.md, pricing.md, market.md, competitors.md, gtm-motion.md — " +
-    "filled from what the user tells you plus your own research of their website (write them with your " +
-    "file tools), then call this on those files — so their GTM context lives in their repo where they'll " +
-    "keep editing it. At minimum create context/icp.md if that's all they'll give you. " +
-    "MANDATORY RE-SYNC: whenever you (or the user) edit the ICP/context file — add or change an exclusion, " +
-    "reword the ICP, retarget — you MUST call sync_icp again in the SAME turn. The edit does NOT change the " +
-    "ICP score, the exclusions, or the scoring model until you do; an unsynced file edit is silently inert. " +
-    "The ICP section's source_path matters most (it's the write-back target for export_icp_model).",
-    {
-      sections: z.array(z.object({
-        section: z.enum(["ICP", "Market", "Product", "Pricing", "Competitors", "Positioning", "GTM Motion", "Notes"])
-          .describe("Which GTM context section this file/content maps to."),
-        content: z.string().describe("The section's content, read from the file (trimmed prose, not the whole repo)."),
-        source_path: z.string().optional()
-          .describe("The file this came from, relative to the project root, e.g. 'context/icp.md'. Required on the ICP section so the learned model can be written back."),
-      })).describe("One entry per ICP/positioning file (or section) you read."),
-    },
-    async ({ sections }) => {
-      try {
-        const r = await post("/v2/workspace/icp/import", { sections });
-        const imp = r.imported ?? [];
-        const lines = [
-          `Synced ${imp.length} section${imp.length === 1 ? "" : "s"} from the user's files:`,
-          ...imp.map((s) => `  • ${s.section}${s.source_path ? `  ← ${s.source_path}` : ""}`),
-        ];
-        if (r.skipped?.length) lines.push("", `Skipped (unknown/empty): ${r.skipped.join(", ")}`);
-        // Section-check nudges from the server — the ICP file synced but is missing
-        // canonical sections (buyer, fit, triggers, …). Surface them so the agent
-        // rounds the file out and re-syncs, instead of the gaps passing silently.
-        for (const w of (r.warnings ?? [])) {
-          lines.push("", `⚠ ${w.message}`);
-        }
-        const sig = r.signals ?? [];
-        if (r.model_status === "created" && sig.length) {
-          lines.push("", `Built the ICP scoring model — ${sig.length} signal${sig.length === 1 ? "" : "s"}.`);
-          lines.push("Next: if the user can name a few closed-won + closed-lost domains, call train_icp_model to sharpen it on real outcomes, then call export_icp_model to write the learned model back into their ICP file.");
-        } else if (r.model_status === "no_icp_memory") {
-          lines.push("", "Synced, but there wasn't enough ICP content to build a scoring model — make sure the ICP section has real content.");
-        } else {
-          lines.push("", "Context synced. Call export_icp_model when you want to write the learned model back into their ICP file.");
-        }
-        return { content: [{ type: "text", text: lines.join("\n").trim() }] };
-      } catch (e) {
-        const msg = String(e?.message ?? e);
-        if (msg.includes("no_sections") || msg.includes("no_valid_sections")) {
-          return { content: [{ type: "text", text:
-            "Nothing to sync. Read the user's ICP/positioning file(s) first and pass each as a section " +
-            "(ICP, Positioning, Pricing, …) with its source_path. If they have no such file, offer to create context/icp.md." }] };
-        }
-        throw e;
-      }
-    }
-  );
 
-  // ===========================================================================
-  // TOOL: export_icp_model  —  GET /v2/workspace/icp/model
-  // The Nous→file half of the ICP symbiosis. Nous learns which signals actually
-  // predict a win (lift + calibration) from real outcomes; this returns that
-  // learned model as a ready-to-write fenced block, which the agent writes back
-  // into the user's own ICP file with its native editor. Server renders the
-  // block so the format is controlled centrally — the agent just persists it.
-  // ===========================================================================
-  server.tool(
-    "export_icp_model",
-    "Get the LEARNED ICP scoring model (which signals predict a win, their weight, lift, and the " +
-    "calibration gap) as a ready-to-write markdown block, and write it back into the user's own ICP " +
-    "file. This is the payoff of the symbiosis: their file keeps the words, Nous keeps the model, and " +
-    "this writes the model under their words. CLAUDE CODE flow: call this after sync_icp or after " +
-    "train_icp_model, then with your file tools open `target_path`, and if the file already has a " +
-    "block between '<!-- nous:icp start -->' and '<!-- nous:icp end -->' REPLACE that whole block with " +
-    "the returned `block`; if not, append the returned `block` (e.g. replacing a '## [To refine]' " +
-    "placeholder). Never edit inside the markers by hand — this tool regenerates them. Everything " +
-    "OUTSIDE the markers is the user's; never touch it.",
-    {},
-    async () => {
-      const r = await get("/v2/workspace/icp/model");
-      if (!r.has_model) {
-        return { content: [{ type: "text", text:
-          "No ICP scoring model yet. Sync the user's ICP file with sync_icp first (or build one with " +
-          "build_icp_model / train_icp_model), then call this to write it back." }] };
-      }
-      // Lift can only be learned from WINS, so a win-less cohort (losses only) is
-      // still seed estimates — don't claim it's "trained on real closed deals".
-      const wonCount = r.calibration?.won ?? 0;
-      const lostCount = r.calibration?.lost ?? 0;
-      const note = wonCount > 0
-        ? "This model is trained on real closed deals (lift + calibration shown)."
-        : lostCount > 0
-          ? `Still seed estimates — ${lostCount} closed-lost recorded but no closed-won yet to learn lift from. Add closed-won with train_icp_model to sharpen it.`
-          : "This model is seeded from the ICP only — add closed deals with train_icp_model to sharpen it.";
-      return { content: [{ type: "text", text:
-        `Write the block below into ${r.target_path} with your file editor — replace any existing block ` +
-        `between the nous:icp markers, or append it if there's none (create the file/section if absent). ` +
-        `Leave everything outside the markers untouched. ${note}\n\n${r.block}` }] };
-    }
-  );
 
-  // ===========================================================================
-  // TOOL: connect_integration  —  POST /v2/workspace/integrations
-  // The agent connects a KEY-BASED integration for the user (no clicking through
-  // the Integrations page). OAuth providers still need a browser, so this is
-  // limited to providers that authenticate with an API key/token.
-  // ===========================================================================
-  server.tool(
-    "connect_integration",
-    "Connect a key-based integration for the user — an enrichment, CRM, or sequencer provider that " +
-    "authenticates with an API key or token (e.g. Apollo, Prospeo, Instantly, HubSpot private-app " +
-    "token, Pipedrive, Attio, Smartlead, HeyReach). Ask the user for the provider's API key, then " +
-    "call this; it verifies the credentials before saving. Providers that use a browser sign-in " +
-    "(OAuth, e.g. Gmail) can't be connected this way — for those, point the user to the Integrations " +
-    "page. After connecting an enrichment provider, the account record starts filling in.",
-    {
-      provider: z.string().describe("Provider name, lowercase — e.g. 'apollo', 'prospeo', 'instantly', 'hubspot', 'pipedrive', 'attio'."),
-      credentials: z.record(z.string()).describe("The provider's credentials as key/value, e.g. { api_key: '...' } or { access_token: '...' }."),
-      name: z.string().optional().describe("Optional label for the connection."),
-    },
-    async ({ provider, credentials, name }) => {
-      try {
-        const r = await post("/v2/workspace/integrations", { provider, credentials, name });
-        return { content: [{ type: "text", text: `Connected ${r.connection?.provider ?? provider}.${r.message ? ` ${r.message}` : ""}` }] };
-      } catch (e) {
-        const msg = String(e?.message ?? e);
-        if (msg.includes("oauth_provider")) {
-          return { content: [{ type: "text", text: `${provider} uses a browser sign-in, so it can't be connected with a key. Tell the user to connect it on the Integrations page.` }] };
-        }
-        if (msg.includes("invalid_credentials")) {
-          return { content: [{ type: "text", text: `Those credentials didn't verify for ${provider}. Ask the user to double-check the key and try again.` }] };
-        }
-        if (msg.includes("unknown_provider")) {
-          return { content: [{ type: "text", text: `No provider named "${provider}". Ask the user which tool they mean.` }] };
-        }
-        throw e;
-      }
-    }
-  );
 
-  // ===========================================================================
-  // TOOL: configure_crm_sync  —  POST /v2/workspace/crm-sync
-  // The agent sets the CRM sync rules — the same options as the CRM Sync page.
-  // The CRM must already be connected (OAuth connect stays a human step).
-  // ===========================================================================
-  server.tool(
-    "configure_crm_sync",
-    "(Nous Cloud only) Configure how Nous keeps a connected CRM in sync — the same settings as the CRM Sync page. The " +
-    "CRM must already be connected (HubSpot/Pipedrive/Attio). Set any of: auto-sync (daily pull), " +
-    "push of touchpoints, the create policy (when a new record is auto-created and the ICP-fit " +
-    "threshold), and the hygiene cadence. Only send the fields you want to change. If it reports the " +
-    "CRM isn't connected, tell the user to connect it on the Integrations page first.",
-    {
-      provider: z.enum(["hubspot", "pipedrive", "attio"]).describe("Which connected CRM to configure."),
-      autoSync: z.boolean().optional().describe("Pull contacts/companies/deals daily."),
-      pushActivities: z.boolean().optional().describe("Push touchpoints (meetings, replies, proposals) back to the CRM."),
-      createInCrm: z.boolean().optional().describe("Auto-create new records in the CRM when they earn it."),
-      createTrigger: z.enum(["any_reply_or_meeting", "positive_reply_or_meeting", "meeting_only", "interested_stage"]).optional()
-        .describe("What earns a new record."),
-      createRequireIcpFit: z.boolean().optional().describe("Require an ICP-fit score before creating a record."),
-      createIcpThreshold: z.number().optional().describe("Minimum ICP-fit score to create (0-100)."),
-      hygieneEnabled: z.boolean().optional().describe("Run scheduled hygiene reconciliation."),
-      hygieneCadence: z.enum(["weekly", "monthly"]).optional().describe("How often hygiene runs."),
-    },
-    async (args) => {
-      try {
-        const r = await post("/v2/workspace/crm-sync", args);
-        const c = r.config ?? {};
-        return { content: [{ type: "text", text:
-          `CRM sync configured for ${args.provider}. auto-sync ${c.auto_sync ? "on" : "off"}, ` +
-          `create ${c.create_in_crm ? `on (${c.create_trigger}${c.create_require_icp_fit ? `, ICP ≥ ${c.create_icp_threshold}` : ""})` : "off"}, ` +
-          `hygiene ${c.hygiene_enabled ? c.hygiene_cadence : "off"}.` }] };
-      } catch (e) {
-        const msg = String(e?.message ?? e);
-        if (msg.includes("crm_not_connected")) {
-          return { content: [{ type: "text", text: `${args.provider} isn't connected yet. Tell the user to connect it on the Integrations page, then configure sync.` }] };
-        }
-        throw e;
-      }
-    }
-  );
 
-  // ===========================================================================
-  // TOOL: sync_crm_now  —  POST /v2/workspace/crm-sync-now
-  // Run an immediate incremental CRM pull right now, instead of waiting for the
-  // daily auto-sync cron — e.g. straight after configure_crm_sync, or whenever
-  // the user wants the latest. Same engine the scheduled sync uses.
-  // ===========================================================================
-  server.tool(
-    "sync_crm_now",
-    "(Nous Cloud only) Pull the latest from a connected CRM (HubSpot/Pipedrive/Attio) RIGHT NOW, instead of waiting for " +
-    "the daily auto-sync. Use it just after configure_crm_sync to seed the data, or whenever the user " +
-    "wants an immediate refresh. Incremental by default (only what changed since the last pull); pass " +
-    "full:true to re-fetch everything. The CRM must already be connected and sync configured — if not, " +
-    "it'll tell you to connect/configure first.",
-    {
-      provider: z.enum(["hubspot", "pipedrive", "attio"]).optional().describe("Which connected CRM to pull from (default hubspot)."),
-      full: z.boolean().optional().describe("true = re-fetch everything; default = incremental since the last sync."),
-    },
-    async ({ provider, full }) => {
-      try {
-        const r = await post("/v2/workspace/crm-sync-now", { provider: provider || "hubspot", full: full === true });
-        const errs = (r.errors && r.errors.length) ? ` · ${r.errors.length} error(s)` : "";
-        return { content: [{ type: "text", text:
-          `Pulled from ${r.provider}: ${r.fetched ?? 0} records — ${r.created ?? 0} new, ${r.updated ?? 0} updated${errs}.` }] };
-      } catch (e) {
-        const msg = String(e?.message ?? e);
-        if (/sync_not_configured/.test(msg)) return { content: [{ type: "text", text: `Sync isn't configured for that CRM yet — call configure_crm_sync first.` }] };
-        if (/crm_not_connected/.test(msg)) return { content: [{ type: "text", text: `That CRM isn't connected. Tell the user to connect it on the Integrations page, then try again.` }] };
-        if (/salesforce_not_yet_supported/.test(msg)) return { content: [{ type: "text", text: `Salesforce pull isn't supported yet — only HubSpot, Pipedrive, and Attio.` }] };
-        return { content: [{ type: "text", text: `Couldn't sync: ${msg}` }] };
-      }
-    }
-  );
-
-  // ===========================================================================
-  // TOOL: scrape_engagers
-  // On-demand LinkedIn engager scrape — mine who commented/reacted on the
-  // workspace's own recent posts into the native "LinkedIn Engagers" list, NOW,
-  // instead of waiting for the weekly cron. Backfill a wider window with `days`.
-  // ===========================================================================
-  server.tool(
-    "scrape_engagers",
-    "Scrape the people who commented or reacted on YOUR OWN recent LinkedIn posts into the native " +
-    "\"LinkedIn Engagers\" lead list — right now, instead of waiting for the weekly auto-run. Each " +
-    "engager is saved with the engagement captured (the actual comment text for comments, the " +
-    "reaction for likes) on their timeline. Use when the user says \"scrape engagers\", \"who " +
-    "engaged with my last post\", or \"backfill my engagers for the last N months\". `days` sets the " +
-    "look-back window (default 7, since the weekly run already covers the recent past; pass a larger " +
-    "value like 60 to backfill). Runs on the workspace's OWN Apify key (bring-your-own-key) — if none " +
-    "is connected it says so; tell the user to add an Apify key in Integrations. The scrape runs in " +
-    "the background (within a minute); the new engagers then appear in the list.",
-    {
-      days: z.number().int().min(1).max(120).optional().describe("Look-back window in days. Default 7. Use a larger value (e.g. 60) to backfill a gap since the last scrape."),
-    },
-    async ({ days }) => {
-      try {
-        const r = await post("/api/linkedin/engagement/scrape", { days });
-        const lastLine = r.last_scraped_at
-          ? `Last scraped ${relAge(r.last_scraped_at)}.`
-          : "First scrape for this workspace.";
-        return { content: [{ type: "text", text:
-          `Engager scrape queued — mining the last ${r.days} day(s) across ${r.accounts} connected ` +
-          `LinkedIn account${r.accounts === 1 ? "" : "s"}. ${lastLine} It runs in the background; ` +
-          `new engagers land in the "LinkedIn Engagers" list within a minute or two.` }] };
-      } catch (e) {
-        const msg = /apify_not_connected/.test(e.message)
-          ? "Engager scraping is bring-your-own-key. Tell the user to add their own Apify key in Integrations, then try again."
-          : /linkedin_not_connected/.test(e.message)
-          ? "No LinkedIn account is connected. Tell the user to connect LinkedIn in Integrations first."
-          : /needs_plan/.test(e.message)
-          ? "LinkedIn engager scraping is on the Pro plan and up. Tell the user to upgrade to use it."
-          : `Couldn't start the scrape: ${e.message}`;
-        return { content: [{ type: "text", text: msg }] };
-      }
-    }
-  );
-
-  // ===========================================================================
-  // TOOL: send_linkedin_message — the ACT layer. An OUTWARD ACTION: it goes out
-  // through Unipile immediately, it is not a draft. The agent should read the
-  // 'voice'/'outreach' foundations first and `record` the touch after. Derives the
-  // workspace from the API key and runs on the workspace's connected LinkedIn
-  // account. POST /api/linkedin/send-message (verifyAuthEither).
-  // ===========================================================================
-  server.tool(
-    "send_linkedin_message",
-    "SEND a LinkedIn direct message for real, right now, from the workspace's connected LinkedIn " +
-    "account. This is an OUTWARD ACTION, not a draft — it reaches the person the moment you call it, so " +
-    "only send a message the user has approved. Address it one of three ways: `linkedin_url` (their " +
-    "profile URL) or `linkedin_member_id` to start a new conversation, or `chat_id` to REPLY inside an " +
-    "existing thread. It returns the thread's `chat_id` — keep it so the next reply stays in the same " +
-    "thread. Best practice: read the 'voice' and 'outreach' foundations first so the message obeys the " +
-    "user's rules, and `record` the touch afterward so the graph stays current. Requires a connected " +
-    "LinkedIn account (Integrations); it says so if none is connected.",
-    {
-      text: z.string().min(1).describe("The message body to send."),
-      linkedin_url: z.string().optional().describe("The recipient's LinkedIn profile URL. Provide this OR linkedin_member_id (to start a new chat), OR chat_id (to reply in an existing thread)."),
-      linkedin_member_id: z.string().optional().describe("The recipient's LinkedIn member id, if you have it instead of a profile URL."),
-      chat_id: z.string().optional().describe("An existing conversation's chat_id — pass it to reply in-thread instead of opening a new chat."),
-    },
-    async ({ text, linkedin_url, linkedin_member_id, chat_id }) => {
-      if (!linkedin_url && !linkedin_member_id && !chat_id) {
-        return { content: [{ type: "text", text:
-          "Tell me who to message: pass linkedin_url or linkedin_member_id to start a new chat, or chat_id to reply in an existing thread." }] };
-      }
-      try {
-        const r = await post("/api/linkedin/send-message", { text, linkedin_url, linkedin_member_id, chat_id });
-        return { content: [{ type: "text", text:
-          `Message sent over LinkedIn.${r.chat_id ? ` Thread chat_id: ${r.chat_id} (reuse it to reply in-thread).` : ""}` }] };
-      } catch (e) {
-        const msg =
-          /linkedin_not_connected/.test(e.message)
-            ? "No LinkedIn account is connected. Tell the user to connect LinkedIn in Integrations first."
-          : /auth_required/.test(e.message)
-            ? "This API key isn't scoped to a workspace, or LinkedIn isn't connected."
-          : /missing_params/.test(e.message)
-            ? "Couldn't tell who to message — provide linkedin_url, linkedin_member_id, or chat_id."
-            : `Couldn't send the message: ${e.message}`;
-        return { content: [{ type: "text", text: msg }] };
-      }
-    }
-  );
-
-  server.tool(
-    "draft_email",
-    "DRAFT a follow-up email for the operator to review and SEND themselves — you draft, they send. " +
-    "This does NOT send: it puts a card in front of the operator with To / Subject / Body and a Send " +
-    "button; the email goes out from THEIR OWN Gmail, in their name, only when they click send. Use it " +
-    "whenever the ask is to email, follow up by email, send a recap, or reply by email. Identify the " +
-    "recipient with `focus` (their email, LinkedIn URL, entity id, or name); the recipient address is " +
-    "read off the record unless you pass `to`. Write a real `subject` and `body` in the operator's " +
-    "voice — real paragraphs, no placeholders or [brackets] — and give the `rationale`, the one line " +
-    "they judge the draft against. For a LinkedIn-only contact with no email, use send_linkedin_message.",
-    {
-      focus: z.string().describe("The recipient — email, LinkedIn URL, entity UUID, or name."),
-      subject: z.string().describe("The email subject line."),
-      body: z.string().min(1).describe("The email body, in the operator's voice. Real paragraphs, no placeholders."),
-      to: z.string().optional().describe("Override the recipient email address (else the entity's best email on record is used)."),
-      rationale: z.string().optional().describe("One line on what the draft is based on — shown to the operator on the card."),
-    },
-    async ({ focus, subject, body, to, rationale }) => {
-      try {
-        const r = await post("/v2/drafts/email", { focus, subject, body, to, rationale });
-        if (r.status === "ambiguous") {
-          const opts = (r.candidates ?? []).map(c => `  • ${c.name ?? "(unnamed)"}  [${c.entity_id}]`).join("\n");
-          return { content: [{ type: "text", text: `"${focus}" matches several people. Re-call draft_email with one of these entity ids as focus:\n${opts}` }] };
-        }
-        return { content: [{ type: "text", text:
-          `Email draft ready for ${r.recipient} <${r.to}> — it's in front of the operator to review and send from their own Gmail. You have not sent it.` }] };
-      } catch (e) {
-        const msg = /no_email/.test(e.message)
-          ? "No email on file for that person. Ask the operator for the address (pass it as `to`), or draft a LinkedIn message instead."
-          : /entity_not_found/.test(e.message)
-          ? "Couldn't find that recipient on the record — check the focus identifier."
-          : `Couldn't create the draft: ${e.message}`;
-        return { content: [{ type: "text", text: msg }] };
-      }
-    }
-  );
-
-  // ===========================================================================
-  // TOOLS: the CORRECTION layer — unsay something recorded by mistake. `record` and
-  // `save_note` are how you write; these are how you take it back. Both heal the
-  // derived layer: retracting an observation re-derives the claim from what remains,
-  // deleting a note drops it from search/context. DELETE /v2/observations|notes/:id.
-  // ===========================================================================
-  server.tool(
-    "retract_observation",
-    "RETRACT an observation you recorded by mistake, and heal the record. Pass the observation's " +
-    "`id` (returned by `record`). Nous deletes it and re-derives the affected fact from the " +
-    "observations that remain — so a wrong value you observed is un-observed and the claim reverts as " +
-    "if it had never happened; if it was the only observation for that fact, the fact is invalidated. " +
-    "Use this when you recorded the wrong thing (wrong value, wrong person, a test), NOT to represent a " +
-    "real change over time — a genuine change is a NEW `record`, which supersedes by recency.",
-    {
-      id: z.string().describe("The observation id to retract (from a prior `record` result)."),
-    },
-    async ({ id }) => {
-      try {
-        const r = await del(`/v2/observations/${encodeURIComponent(id)}`);
-        return { content: [{ type: "text", text:
-          `Observation retracted. The claim for ${r.property} was ${r.claim === "invalidated" ? "invalidated (no observations left)" : "re-derived from the remaining observations"}.` }] };
-      } catch (e) {
-        const msg = /observation_not_found/.test(e.message)
-          ? "No observation with that id in this workspace — check the id from the record result."
-          : `Couldn't retract the observation: ${e.message}`;
-        return { content: [{ type: "text", text: msg }] };
-      }
-    }
-  );
-
-  server.tool(
-    "delete_note",
-    "DELETE a note saved by mistake. Pass the note's `id` (returned by `save_note`). It's removed from " +
-    "search and context immediately; the timeline stays reconstructable. Only touches notes — it will " +
-    "refuse an id that isn't a note. Use this for a note saved in error; to CHANGE a note, save a new " +
-    "one instead.",
-    {
-      id: z.string().describe("The note id to delete (from a prior `save_note` result)."),
-    },
-    async ({ id }) => {
-      try {
-        const r = await del(`/v2/notes/${encodeURIComponent(id)}`);
-        return { content: [{ type: "text", text:
-          r.status === "already_deleted" ? "That note was already deleted." : "Note deleted — it's out of search and context now." }] };
-      } catch (e) {
-        const msg = /note_not_found/.test(e.message)
-          ? "No note with that id in this workspace — check the id from the save_note result."
-          : /not_a_note/.test(e.message)
-          ? "That id isn't a note, so it can't be deleted here. Only save_note notes can be deleted this way."
-          : `Couldn't delete the note: ${e.message}`;
-        return { content: [{ type: "text", text: msg }] };
-      }
-    }
-  );
 
   // ===========================================================================
-  // TOOLS: list + introspect — enumerate what's on the workspace, and who you are.
-  // GET /v2/notes · /v2/workspace/integrations · /v2/workspace/members.
+  // TOOL: whoami  —  GET /v2/workspace/whoami
+  // The identity primitive: who this key acts AS, their scope, and their GTM
+  // role(s). Every governance/permission decision hangs off knowing the actor.
   // ===========================================================================
-  server.tool(
-    "list_notes",
-    "List saved notes newest-first (chronological), optionally scoped to one person/company with " +
-    "`focus`. This is the LIST companion to search_notes (which is semantic): use it for \"show me the " +
-    "notes on X\", or to enumerate notes and get their ids — e.g. to pick one to delete_note. Returns " +
-    "id, type, title, date and a snippet for each.",
-    {
-      focus: z.string().optional().describe("Restrict to one person/company (email, LinkedIn URL, entity UUID, or domain). Omit for the whole workspace."),
-      limit: z.number().int().min(1).max(100).optional().describe("Max notes to return (default 20)."),
-    },
-    async ({ focus, limit }) => {
-      const r = await get("/v2/notes", { ...(focus ? { focus } : {}), ...(limit ? { limit } : {}) });
-      if (r.status === "ambiguous") {
-        const opts = (r.candidates ?? []).map(c => `  • ${c.name ?? "(unnamed)"}  [${c.entity_id}]`).join("\n");
-        return { content: [{ type: "text", text: `"${focus}" matches several — re-call list_notes with one of these entity ids as focus:\n${opts}` }] };
-      }
-      if (!r.notes?.length) return { content: [{ type: "text", text: focus ? "No notes on that account." : "No notes saved yet." }] };
-      const lines = r.notes.map(n => `  • ${n.title || n.type}${n.date ? ` (${n.date})` : ""}  [${n.id}]\n    ${n.snippet}`).join("\n");
-      return { content: [{ type: "text", text: `${r.notes.length} note(s)${r.has_more ? " (more available — raise limit)" : ""}:\n${lines}` }] };
-    }
-  );
-
-  server.tool(
-    "list_integrations",
-    "List the integrations connected to this workspace (Gmail, HubSpot, Apollo, Instantly, LinkedIn, …) " +
-    "— what's wired in and whether it's verified. Use before telling the user to connect something, or " +
-    "to answer \"what's connected here?\".",
-    {},
-    async () => {
-      const r = await get("/v2/workspace/integrations");
-      if (!r.integrations?.length) return { content: [{ type: "text", text: "No integrations connected yet." }] };
-      const lines = r.integrations.map(i => `  • ${i.display_name}${i.category ? ` (${i.category})` : ""}${i.verified ? "" : " — not verified"}`).join("\n");
-      return { content: [{ type: "text", text: `Connected integrations:\n${lines}` }] };
-    }
-  );
-
-  server.tool(
+  tool(
     "whoami",
-    "Report who this API key acts AS and who else is on the workspace — the agent's own identity in " +
-    "Nous. Returns your scope (a MEMBER key sees only that member's private content plus the shared " +
-    "graph; an ADMIN key sees all raw content) and the team roster with names and roles. Use it to " +
-    "understand whose view you have and to reference teammates. Emails show only for an admin key.",
-    {},
-    async () => {
-      const r = await get("/v2/workspace/members");
-      const scope = r.you?.scope === "admin"
-        ? "an ADMIN key — you see all raw content on this workspace"
-        : "a MEMBER key — you see only your own private content plus the shared graph";
-      const roster = (r.members || [])
-        .map(m => `  • ${m.name || "(unnamed)"} — ${m.role}${m.you ? " (you)" : ""}${m.email ? ` · ${m.email}` : ""}`)
-        .join("\n");
-      return { content: [{ type: "text", text: `You are ${scope}.\n\nWorkspace members (${r.count ?? 0}):\n${roster || "  (none)"}` }] };
-    }
-  );
-
-  // ===========================================================================
-  // TOOL: get_routing_preferences
-  // The routing preferences that make THIS agent default to Nous for GTM. The
-  // agent applies them itself in Claude Code (write to CLAUDE.md); for claude.ai
-  // the user pastes them into Org preferences. Not applicable to Codex/others.
-  // ===========================================================================
-  server.tool(
-    "get_routing_preferences",
-    "Get the routing preferences that make this agent treat Nous as the DEFAULT for GTM — so it " +
-    "reaches for get_context / get_account instead of raw CRM or HubSpot / Salesforce / Gong / " +
-    "Granola when someone forgets to say \"Nous\". This is an OPTIONAL onboarding step, and " +
-    "CLAUDE CODE-specific. If you are running in Claude Code, set it up for the user: ask whether to " +
-    "apply it to this project (write the returned text to ./CLAUDE.md) or to all projects " +
-    "(~/.claude/CLAUDE.md), then write it there. The user can also paste it into claude.ai → Settings " +
-    "→ Organization preferences (Team/Enterprise) or Personal preferences (Pro). If you are NOT Claude " +
-    "Code (Codex, Cursor, n8n, …), this does not apply — skip it.",
+    "Report who this API key acts AS: the workspace, the person, their SCOPE (admin sees the whole " +
+    "workspace; member sees only their own book plus the shared graph), their GTM ROLE(S) (e.g. AE, " +
+    "SDR, founder — a person can hold several), and the key's capability (read/write vs read-only). " +
+    "Call it to confirm the plugin is wired to the right workspace and identity, and to scope " +
+    "role-specific work to the right person — a member gets their own view, an admin the whole team's.",
     {},
     async () => {
+      const r = await get("/v2/workspace/whoami");
+      const w = r.workspace || {};
+      const y = r.you || {};
+      const who = y.name || (y.user_id ? "(unnamed member)" : "a shared workspace key (no person)");
+      const scope = y.scope === "admin"
+        ? "ADMIN — you see the whole workspace"
+        : "MEMBER — you see only your own book plus the shared graph";
+      const roles = Array.isArray(y.roles) && y.roles.length ? y.roles.join(", ") : "none set";
+      const cap = y.capability === "read_only" ? "read-only" : "read/write";
       return { content: [{ type: "text", text:
-        `Routing preferences (write to the user's CLAUDE.md in Claude Code, or have them paste into ` +
-        `claude.ai → Settings → Organization/Personal preferences):\n\n${ROUTING_PREFERENCES}` }] };
+        `You are acting as ${who} on ${w.name || "this workspace"}.\n` +
+        `Scope: ${scope}.\n` +
+        `Role(s): ${roles}.\n` +
+        `Capability: ${cap}.` }] };
     }
   );