@rosthq/cli 0.7.62 → 0.7.64

package/dist/generated/command-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"command-manifest.d.ts","sourceRoot":"","sources":["../../src/generated/command-manifest.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAE3E,eAAO,MAAM,gBAAgB,EAAE,SAAS,oBAAoB,EAwO3D,CAAC"}
+{"version":3,"file":"command-manifest.d.ts","sourceRoot":"","sources":["../../src/generated/command-manifest.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAE3E,eAAO,MAAM,gBAAgB,EAAE,SAAS,oBAAoB,EAyO3D,CAAC"}

package/dist/index.js

@@ -37801,6 +37801,240 @@ import { readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 
+// ../../packages/protocol/src/cron.ts
+var uintPattern = /^\d+$/;
+var CRON_FIELD_SPECS = [
+  { name: "minute", min: 0, max: 59 },
+  { name: "hour", min: 0, max: 23 },
+  { name: "day-of-month", min: 1, max: 31 },
+  { name: "month", min: 1, max: 12 },
+  { name: "day-of-week", min: 0, max: 7 }
+];
+var CRON_FIELD_COUNT = CRON_FIELD_SPECS.length;
+function parseCronField(raw, spec) {
+  const parts = raw.split(",");
+  const terms = [];
+  for (const part of parts) {
+    const token = part.trim();
+    if (token.length === 0) {
+      return { ok: false, reason: "empty value in list" };
+    }
+    if (token === "*") {
+      terms.push({ kind: "all" });
+      continue;
+    }
+    if (token.startsWith("*/")) {
+      const stepText = token.slice(2);
+      if (!uintPattern.test(stepText)) {
+        return { ok: false, reason: `"${token}" is not a valid step` };
+      }
+      const step = Number(stepText);
+      if (step < 1 || step > spec.max) {
+        return { ok: false, reason: `step in "${token}" must be between 1 and ${spec.max}` };
+      }
+      terms.push({ kind: "step", step });
+      continue;
+    }
+    if (token.includes("-")) {
+      const segments = token.split("-");
+      if (segments.length !== 2 || !uintPattern.test(segments[0] ?? "") || !uintPattern.test(segments[1] ?? "")) {
+        return { ok: false, reason: `"${token}" is not a valid range` };
+      }
+      const start = Number(segments[0]);
+      const end = Number(segments[1]);
+      if (start < spec.min || end > spec.max || start > end) {
+        return { ok: false, reason: `range "${token}" must be within ${spec.min}-${spec.max} and ascending` };
+      }
+      terms.push({ kind: "range", start, end });
+      continue;
+    }
+    if (uintPattern.test(token)) {
+      const value = Number(token);
+      if (value < spec.min || value > spec.max) {
+        return { ok: false, reason: `"${token}" must be between ${spec.min} and ${spec.max}` };
+      }
+      terms.push({ kind: "value", value });
+      continue;
+    }
+    return { ok: false, reason: `"${token}" is not a supported cron token` };
+  }
+  return { ok: true, field: terms };
+}
+function parseCronExpression(expression) {
+  const trimmed = expression.trim();
+  if (trimmed.length === 0) {
+    return { ok: false, message: "Schedule must not be empty." };
+  }
+  if (/[\r\n\u2028\u2029]/.test(trimmed)) {
+    return { ok: false, message: "Schedule must be a single-line cron expression." };
+  }
+  if (/[^0-9*/,\t\x20-]/.test(trimmed)) {
+    return { ok: false, message: "Schedule may only contain digits, spaces, and the characters * / , -" };
+  }
+  const rawFields = trimmed.split(/\s+/);
+  if (rawFields.length !== CRON_FIELD_COUNT) {
+    return {
+      ok: false,
+      message: `Schedule must have exactly ${CRON_FIELD_COUNT} fields (minute hour day-of-month month day-of-week); got ${rawFields.length}.`
+    };
+  }
+  const fields = [];
+  for (let i = 0; i < CRON_FIELD_COUNT; i += 1) {
+    const spec = CRON_FIELD_SPECS[i];
+    const result = parseCronField(rawFields[i], spec);
+    if (!result.ok) {
+      return { ok: false, message: `Invalid ${spec.name} field: ${result.reason}.` };
+    }
+    fields.push(result.field);
+  }
+  return { ok: true, cron: { fields } };
+}
+var cronExpressionSchema = external_exports.string().trim().min(1).max(120).superRefine((value, ctx) => {
+  if (value.length > 120) {
+    return;
+  }
+  const result = parseCronExpression(value);
+  if (!result.ok) {
+    ctx.addIssue({ code: external_exports.ZodIssueCode.custom, message: result.message });
+  }
+});
+
+// ../../packages/protocol/src/model-pricing-registry.ts
+var providerRouteSchema = external_exports.enum(["direct_anthropic", "gateway_managed", "direct_byok"]);
+var modelPricingEntrySchema = external_exports.object({
+  // The canonical gateway slug: `provider:model` (dotted). For Anthropic entries
+  // this is `anthropic:<model>`, but Anthropic never actually routes through the
+  // gateway — the entry exists so the registry is the complete authoritative table.
+  slug: external_exports.string().trim().min(1).max(160).regex(/^[a-z0-9-]+:[^\n\r]+$/, "Slug must be `provider:model`."),
+  // Actual serving provider (what `llm_calls.provider` must record — AC #6).
+  provider: external_exports.string().trim().min(1).max(60).regex(/^[a-z0-9-]+$/),
+  // Provider-native model id (what `llm_calls.model` records; what the SDK receives).
+  model: external_exports.string().trim().min(1).max(120).regex(/^[^\n\r]+$/),
+  // ISO instant this price takes effect. Resolution picks the latest entry with
+  // `effectiveFrom <= at` for a given (provider, model).
+  effectiveFrom: external_exports.string().datetime(),
+  // Authoritative token rates (USD per 1M tokens) — what ROST's own cost ledger
+  // records for a call served by this model.
+  inputUsdPerMillion: external_exports.number().nonnegative(),
+  outputUsdPerMillion: external_exports.number().nonnegative(),
+  // True when the provider offers a zero-data-retention tier for this model. When
+  // false, the model is disabled-with-reason on the managed gateway unless a tenant
+  // owner has explicitly unlocked non-ZDR models (§8.1 DECIDED).
+  zdrAvailable: external_exports.boolean(),
+  // True when this model is eligible for the MANAGED gateway path at all.
+  managed: external_exports.boolean(),
+  // DER-1586 billing DATA (carried here, consumed by the money lane): the
+  // customer-facing credit rate (cost-plus-margin) and any per-seat included
+  // allowance override, in USD per 1M tokens / cents. This PR only ships the DATA;
+  // DER-1586 wires the Stripe meter. BYOK is excluded from credits by construction.
+  creditInputUsdPerMillion: external_exports.number().nonnegative(),
+  creditOutputUsdPerMillion: external_exports.number().nonnegative(),
+  includedAllowanceCents: external_exports.number().int().nonnegative().optional(),
+  // Per-model disclosure shown when a non-ZDR model is unlocked (§8.1). Required
+  // exactly when `zdrAvailable` is false.
+  retentionDisclosure: external_exports.string().trim().min(1).max(400).optional()
+}).strict().refine(
+  // A MANAGED (gateway-eligible) non-ZDR model must carry the disclosure surfaced on
+  // owner-unlock. Anthropic entries are non-ZDR-flagged but managed:false (they never
+  // touch the gateway), so the disclosure is inert for them and not required.
+  (e) => e.zdrAvailable || !e.managed || typeof e.retentionDisclosure === "string",
+  { message: "A managed non-ZDR model must carry a retentionDisclosure.", path: ["retentionDisclosure"] }
+);
+var ANTHROPIC_EFFECTIVE_FROM = "2026-01-01T00:00:00.000Z";
+var MODEL_PRICING_REGISTRY = Object.freeze([
+  {
+    slug: "anthropic:claude-haiku-4-5",
+    provider: "anthropic",
+    model: "claude-haiku-4-5",
+    effectiveFrom: ANTHROPIC_EFFECTIVE_FROM,
+    inputUsdPerMillion: 1,
+    outputUsdPerMillion: 5,
+    creditInputUsdPerMillion: 1,
+    creditOutputUsdPerMillion: 5,
+    zdrAvailable: false,
+    managed: false
+  },
+  {
+    slug: "anthropic:claude-sonnet-4-6",
+    provider: "anthropic",
+    model: "claude-sonnet-4-6",
+    effectiveFrom: ANTHROPIC_EFFECTIVE_FROM,
+    inputUsdPerMillion: 3,
+    outputUsdPerMillion: 15,
+    creditInputUsdPerMillion: 3,
+    creditOutputUsdPerMillion: 15,
+    zdrAvailable: false,
+    managed: false
+  },
+  {
+    slug: "anthropic:claude-opus-4-8",
+    provider: "anthropic",
+    model: "claude-opus-4-8",
+    effectiveFrom: ANTHROPIC_EFFECTIVE_FROM,
+    inputUsdPerMillion: 15,
+    outputUsdPerMillion: 75,
+    creditInputUsdPerMillion: 15,
+    creditOutputUsdPerMillion: 75,
+    zdrAvailable: false,
+    managed: false
+  },
+  {
+    slug: "anthropic:claude-fable-5",
+    provider: "anthropic",
+    model: "claude-fable-5",
+    effectiveFrom: ANTHROPIC_EFFECTIVE_FROM,
+    inputUsdPerMillion: 25,
+    outputUsdPerMillion: 125,
+    creditInputUsdPerMillion: 25,
+    creditOutputUsdPerMillion: 125,
+    zdrAvailable: false,
+    managed: false
+  },
+  // Non-Anthropic managed exemplar (ZDR-capable). Proves the ZDR-default gateway
+  // path: served through the gateway with zeroDataRetention:true.
+  {
+    slug: "openai:gpt-5.6",
+    provider: "openai",
+    model: "gpt-5.6",
+    effectiveFrom: "2026-07-11T00:00:00.000Z",
+    inputUsdPerMillion: 5,
+    outputUsdPerMillion: 20,
+    creditInputUsdPerMillion: 6.5,
+    creditOutputUsdPerMillion: 26,
+    zdrAvailable: true,
+    managed: true
+  },
+  // Non-Anthropic managed exemplar WITHOUT a zero-retention tier. Proves the
+  // disabled-with-reason + owner-unlock + disclosure behavior (§8.1 DECIDED): it is
+  // refused on the managed path unless a tenant owner has unlocked non-ZDR models.
+  {
+    slug: "xai:grok-4",
+    provider: "xai",
+    model: "grok-4",
+    effectiveFrom: "2026-07-11T00:00:00.000Z",
+    inputUsdPerMillion: 4,
+    outputUsdPerMillion: 16,
+    creditInputUsdPerMillion: 5.2,
+    creditOutputUsdPerMillion: 21,
+    zdrAvailable: false,
+    managed: true,
+    retentionDisclosure: "This provider retains data up to 30 days for abuse monitoring."
+  }
+]);
+for (const entry of MODEL_PRICING_REGISTRY) {
+  modelPricingEntrySchema.parse(entry);
+}
+function parseModelSlug(model) {
+  const trimmed = model.trim();
+  const idx = trimmed.indexOf(":");
+  if (idx <= 0) {
+    return { provider: "anthropic", model: trimmed, slug: `anthropic:${trimmed}`, dotted: false };
+  }
+  const provider = trimmed.slice(0, idx).toLowerCase();
+  const native = trimmed.slice(idx + 1);
+  return { provider, model: native, slug: `${provider}:${native}`, dotted: true };
+}
+
 // ../../packages/protocol/src/agent-model-config.ts
 var agentModelProviderSchema = external_exports.enum(["anthropic"]);
 var agentModelEffortSchema = external_exports.enum(["low", "medium", "high", "xhigh", "max"]);
@@ -37810,7 +38044,21 @@ var agentModelConfigSchema = external_exports.object({
   model: modelIdSchema,
   // Optional effort hint. Omit to use the runtime default for the model.
   effort: agentModelEffortSchema.optional()
-}).strict();
+}).strict().refine(
+  // DER-1584 (ADR-0019 W2.3, invariant #10): `model` is a free-text id, and the
+  // cloud runtime routes purely off its `provider:model` slug prefix — so a dotted
+  // non-Anthropic slug (e.g. `openai:gpt-5.6`) written here would silently route an
+  // agent onto the managed AI Gateway. Until the brain picker + its owner-gated
+  // enablement ship (DER-1591), NO managed non-Anthropic brain is selectable: reject
+  // any non-Anthropic model id at the config-WRITE boundary. (The runtime keeps its
+  // own fail-closed pricing/ZDR enforcement as defense-in-depth for configs written
+  // out-of-band; DER-1591 relaxes this refine when it adds the vetted enablement path.)
+  (config2) => parseModelSlug(config2.model).provider === "anthropic",
+  {
+    message: "Only Anthropic models can be selected today; managed non-Anthropic brains arrive with the brain picker (DER-1591).",
+    path: ["model"]
+  }
+);
 var AGENT_MODEL_TIERS = ["triage", "balanced", "complex", "hardest"];
 var modelCostBandSchema = external_exports.enum(["lowest", "standard", "high", "highest"]);
 var modelCatalogEntrySchema = external_exports.object({
@@ -37923,7 +38171,7 @@ var dryRunTranscriptSchema = external_exports.object({
 }).strict();
 
 // ../../packages/protocol/src/scrub.ts
-var SECRET_SHAPED_VALUE = /(sk-ant-|sk-proj-|sk-live-|sk-[A-Za-z0-9_-]{12,}|ghp_[A-Za-z0-9_]{12,}|github_pat_[A-Za-z0-9_]{20,}|xox[baprs]-[A-Za-z0-9-]{10,}|BEGIN [A-Z ]*PRIVATE KEY|api[_-]?key\s*=|secret\s*=|password\s*=|authorization:\s*bearer\s+|x-api-key\s*:|api[-_ ]?key\s*:\s*\S{3,}|secret\s*:\s*\S{3,}|password\s*:\s*\S{3,}|token\s*:\s*\S{3,})/i;
+var SECRET_SHAPED_VALUE = /(rost_mcp_[A-Za-z0-9_-]{20,}|sk-ant-|sk-proj-|sk-live-|sk-[A-Za-z0-9_-]{12,}|gh[opsur]_[A-Za-z0-9_]{12,}|github_pat_[A-Za-z0-9_]{20,}|xox[baoprs]-[A-Za-z0-9-]{10,}|(?:AKIA|ASIA)[0-9A-Z]{16}|BEGIN [A-Z ]*PRIVATE KEY|api[_-]?key\s*=|secret\s*=|password\s*=|authorization:\s*bearer\s+|(?:bearer|basic)\s+[A-Za-z0-9._~+/=-]{20,}|x-api-key\s*:|api[-_ ]?key\s*:\s*\S{3,}|secret\s*:\s*\S{3,}|password\s*:\s*\S{3,}|token\s*:\s*\S{3,})/i;
 var SECRET_KEY = /(api[_-]?key|secret|password|token|authorization|credential|private[_-]?key)/i;
 function hasSecretShapedContent(value) {
   if (typeof value === "string") {
@@ -38677,7 +38925,7 @@ var agentLifecycleSchema = external_exports.enum([
   "paused",
   "decommissioned"
 ]);
-var cronSchema = external_exports.string().trim().min(1).max(120).regex(/^[^\n\r]+$/, "Schedule must be a single-line cron expression.");
+var cronSchema = cronExpressionSchema;
 var agentTemplateListInputSchema = external_exports.object({}).strict();
 var agentTemplateSummarySchema = external_exports.object({
   slug: external_exports.string().min(1),
@@ -38785,6 +39033,11 @@ var agentSetupStateSchema = external_exports.object({
   steward_seat_id: uuidSchema2.nullable(),
   steward_chain_resolves_to_human: external_exports.boolean(),
   has_occupancy: external_exports.boolean(),
+  // DER-1529: the seat agent's run-time skill-discovery toggle. VISIBILITY only —
+  // it never grants tools (invariant #6). Always present (the column is NOT NULL
+  // default false) so agent_setup.get / .update round-trip the current value back
+  // to any client; conservative default false (#10).
+  skill_discovery_enabled: external_exports.boolean(),
   tool_decisions: external_exports.array(agentSetupToolDecisionSchema),
   available_skill_recommendations: external_exports.array(agentSetupSkillRecommendationSchema),
   assigned_skills: external_exports.array(skillAssignmentSummarySchema),
@@ -38816,9 +39069,12 @@ var agentSetupUpdateInputSchema = external_exports.object({
   // DER-787 (H1): set the structured model selection for this agent.
   model_config: agentModelConfigSchema.optional(),
   answers: external_exports.array(external_exports.string().min(1).max(2e3)).max(20).optional(),
-  tool_decisions: external_exports.array(agentSetupToolUpdateSchema).max(50).optional()
+  tool_decisions: external_exports.array(agentSetupToolUpdateSchema).max(50).optional(),
+  // DER-1529: toggle run-time skill discovery (visibility only; never grants
+  // tools). Settable any time, including on a live agent.
+  skill_discovery_enabled: external_exports.boolean().optional()
 }).strict().refine(
-  (value) => value.parent_seat_id !== void 0 || value.steward_seat_id !== void 0 || value.lane !== void 0 || value.schedule_cron !== void 0 || value.model_config !== void 0 || value.answers !== void 0 || value.tool_decisions !== void 0,
+  (value) => value.parent_seat_id !== void 0 || value.steward_seat_id !== void 0 || value.lane !== void 0 || value.schedule_cron !== void 0 || value.model_config !== void 0 || value.answers !== void 0 || value.tool_decisions !== void 0 || value.skill_discovery_enabled !== void 0,
   "Provide at least one field to update."
 );
 var agentUpdateScheduleInputSchema = external_exports.object({
@@ -39219,6 +39475,11 @@ var storedConfirmationPolicySchema = external_exports.object({
   cli_mode: cliConfirmationModeSchema
 }).strict();
 
+// ../../packages/protocol/src/model-gateway-policy.ts
+var storedModelGatewayPolicySchema = external_exports.object({
+  allow_non_zdr_models: external_exports.boolean()
+}).strict();
+
 // ../../packages/protocol/src/aicos.ts
 var uuidSchema5 = external_exports.string().uuid();
 var jsonObjectSchema = external_exports.record(external_exports.string(), external_exports.unknown());
@@ -41208,6 +41469,7 @@ var MCP_ONBOARDING_TOOL_NAMES = {
 };
 var FORGE_TURN_HARD_CEILING_SECONDS = 30 * 60;
 var FORGE_TURN_PHASE_OVERHEAD_SECONDS = 20 * 60;
+var SEAT_MCP_CLAIM_TOKEN_TTL_SECONDS = (FORGE_TURN_HARD_CEILING_SECONDS + FORGE_TURN_PHASE_OVERHEAD_SECONDS) * 2;
 
 // ../../packages/protocol/src/mcp-onboarding.ts
 var MCP_TOKEN_ABSOLUTE_MAX_EXPIRY_MS = (MCP_TOKEN_NO_EXPIRY_SENTINEL_DAYS + 1) * 24 * 60 * 60 * 1e3;
@@ -42181,6 +42443,11 @@ var errorLogSupersedeOutputSchema = external_exports.object({
   resolved_at: isoDateTime3
 }).strict();
 
+// ../../packages/protocol/src/run-summary.ts
+var runSummaryOutputSchema = external_exports.object({
+  summary: external_exports.string().min(1).max(140)
+});
+
 // ../../packages/protocol/src/runner-settings.ts
 var uuid8 = external_exports.string().uuid();
 var isoDateTime4 = external_exports.string().datetime({ offset: true });
@@ -42461,6 +42728,16 @@ var confirmationPolicyGetOutputSchema = external_exports.object({
 var confirmationPolicyUpdateInputSchema = external_exports.object({
   cli_mode: cliConfirmationModeSchema
 }).strict();
+var modelGatewayPolicyDtoSchema = external_exports.object({
+  allow_non_zdr_models: external_exports.boolean(),
+  explicit: external_exports.boolean()
+}).strict();
+var modelGatewayPolicyUpdateInputSchema = external_exports.object({
+  allow_non_zdr_models: external_exports.boolean()
+}).strict();
+var modelGatewayPolicyUpdateOutputSchema = external_exports.object({
+  model_gateway_policy: modelGatewayPolicyDtoSchema
+}).strict();
 var tenantSpendStatusSchema = external_exports.object({
   spend_usd: external_exports.string(),
   soft_cap_usd: external_exports.string().nullable(),
@@ -44025,6 +44302,23 @@ var softwareVercelDeployPreviewOutputSchema = external_exports.object({
   status: softwareVercelDeploymentStatusSchema
 });
 
+// ../../packages/protocol/src/software-factory-events.ts
+var uuid11 = external_exports.string().uuid();
+var softwareFactoryPhaseRunCompletedEventSchema = external_exports.object({
+  tenantId: uuid11,
+  phaseRunId: uuid11,
+  buildRequestId: uuid11.nullish(),
+  status: external_exports.enum(["passed", "failed"]),
+  idempotencyKey: external_exports.string().min(1).optional()
+}).strict();
+var softwareFactoryBudgetExhaustedEventSchema = external_exports.object({
+  tenantId: uuid11,
+  phaseRunId: uuid11,
+  buildRequestId: uuid11,
+  reason: external_exports.string().min(1),
+  idempotencyKey: external_exports.string().min(1).optional()
+}).strict();
+
 // ../../packages/protocol/src/sync-brief.ts
 var uuidSchema15 = external_exports.string().uuid();
 var dateSchema = external_exports.string().regex(/^\d{4}-\d{2}-\d{2}$/);
@@ -45022,7 +45316,7 @@ Treat AICOS as a coordinator over the operating system. It can become more usefu
     order: 20,
     title: "Responsibility Graph playbook",
     summary: "How to build a functions-first graph with seats, owners, Stewards, vacancies, and clean authority.",
-    version: "2026-07-10.1",
+    version: "2026-07-10.2",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["graph_design", "staffing"],
@@ -45101,7 +45395,7 @@ The graph also carries a mission-control panel. It pulls the same operational st
 
 A staffed non-AICOS agent's seat page uses one profile shell with eight URL-addressable tabs: **Overview**, **Charter**, **Tools & connections**, **Skills**, **Autonomy**, **Signals**, **Activity**, and **Settings**. The hero shows status, Charter purpose, Steward, seat path, lane, model, and last run. The sidebar keeps access, connection, tool/Skill/Signal/escalation/Charter counters, and schedule facts visible while the tabs organize the existing read models and controls. Legacy links such as \`#agent-ops\`, \`#recent-runs\`, and \`#run-<id>\` select the matching Settings or Activity tab. Human seats and the AICOS foundation seat keep their dedicated pages. Members without sensitive-data access see the same shell with explicit unavailable states for run, tool-call, cost, connection-status, and escalation facts; the page never broadens Trust Card access or turns an unavailable read into a confident empty/disconnected claim.
 
-Agent creation at \`/agents/new\` begins with four doors: **Describe the job** opens the existing in-app builder, **Start from a template** opens the stock-template picker, **Build manually** opens the custom setup path, and **Import** opens an in-app format explainer. Definition-file import is roadmap-only and never opens a bare file picker; operators can instead continue to the existing-agent pairing flow. Existing \`?mode=template|custom|existing\` and \`?seat=\` resume links continue directly to their current flows.
+Agent creation at \`/agents/new\` begins with four doors: **Describe the job** opens the existing in-app builder, **Start from a template** opens the stock-template picker, **Build manually** opens the custom setup path, and **Import** opens an in-app format explainer. Definition-file import is roadmap-only and never opens a bare file picker; operators can instead continue to the existing-agent pairing flow. Setup is the detail page filling in: creating a seat from any door hands off to that agent's detail page in draft mode (\`/seats/{seatId}\`), where numbered setup tabs and a shared go-live gate rail complete the draft \u2014 there is no separate multi-step wizard. Existing \`?mode=template|custom|existing\` links open the matching door, and a \`?seat=\` resume link redirects straight to the draft detail page.
 
 ## Review an agent seat's delivered work
 
@@ -45420,7 +45714,7 @@ For CLI and MCP setup, read agent-skill-setup-guide before adding or assigning S
     order: 42,
     title: "Design a custom agent",
     summary: "How to build a custom agent from operational questions through the Charter Builder, tools, dry run, and go-live without writing prompts.",
-    version: "2026-07-04.1",
+    version: "2026-07-10.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing", "charter_design"],
@@ -45466,7 +45760,7 @@ Then choose one of three named triggers:
 - **Scheduled** \u2014 runs on a recurring cadence you pick (every weekday morning, every morning, weekly, hourly). No cron to write.
 - **Event** \u2014 runs in response to work routed to it, like a sync or a mention, rather than on a clock.
 
-Open **Advanced** for the explicit lane select and a raw cron expression when you need a custom cadence. The same schedule presets appear on the agent's seat page after go-live (Agent operations \u2192 Run schedule).
+Open **Advanced** for the explicit lane select and a raw cron expression when you need a custom cadence. A raw schedule is a five-field UTC cron \u2014 \`minute hour day-of-month month day-of-week\` \u2014 supporting \`*\`, \`*/N\` steps, \`A-B\` ranges, and comma lists (for example \`0 9 * * 1-5\`). Day-of-week is 0\u20137 where both 0 and 7 mean Sunday. It is validated when you save: an unsupported or out-of-range expression is rejected with a field-level error rather than saved as a schedule that never runs, and the builder previews the next run in UTC. When both day-of-month and day-of-week are set, a run fires only when both match. The same schedule presets appear on the agent's seat page after go-live (Agent operations \u2192 Run schedule).
 
 ## Configure tools and credentials
 
@@ -45830,7 +46124,7 @@ External connectors are being rolled out provider by provider, conservatively (r
     order: 48,
     title: "CLI and MCP installation guide",
     summary: "Install the public CLI, register remote token-backed MCP clients, and find the full command and tool catalog.",
-    version: "2026-07-10.2",
+    version: "2026-07-11.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -46297,6 +46591,7 @@ The signed-in app exposes the same Skill command surface at **Skills**, linked f
 | \`{{cli}} system health\` | \`system.health\` | Read the scoped system-health snapshot across agent runs, unresolved errors, Signals, Cascade setup, work loop, integrations, runners, notifications, and Sync Brief readiness. | Tenant, member, or seat token | \`{{cli}} system health --json\`; \`{{cli}} system health --seat <id> --json\` |
 | \`{{cli}} command usage.report|usage.snapshot\` | \`usage.report\`, \`usage.snapshot\` | Read the AI-workforce ROI report (per-period agent turns, token/run cost, human-accepted value, exceptions, approvals) from immutable usage snapshots, and freeze a period's totals into a new snapshot (insert-only, idempotent). | Tenant | \`{{cli}} command usage.report --json\`; \`{{cli}} command usage.snapshot --json\` |
 | \`{{cli}} settings get|update|product-learning|agent-policy|confirmation-mode|rename\` | \`settings.get\`, \`settings.update\`, \`settings.product_learning.get\`, \`settings.product_learning.update\`, \`settings.agent_policy.get\`, \`settings.agent_policy.update\`, \`settings.confirmation_policy.get\`, \`settings.confirmation_policy.update\`, \`tenant.rename\` | Read tenant settings, update budget caps, read or update product-learning participation, read or set the company autonomy ceiling, read or set the CLI confirmation mode, and rename the company. Budget, product-learning, and policy updates stop at human confirmation in non-interactive CLI/MCP sessions; company rename is owner-only and human-gated. | Tenant / Tenant-admin for updates | \`{{cli}} settings product-learning get --json\`; \`{{cli}} settings agent-policy get --json\`; \`{{cli}} settings confirmation-mode get --json\`; \`{{cli}} settings rename --company "Acme Operations"\` |
+| \`{{cli}} command tenant.model_gateway_policy.update\` | \`tenant.model_gateway_policy.update\` | Unlock or relock managed models that lack a zero-retention (ZDR) tier (ADR-0019). Locked (default) restricts the AI Gateway to zero-retention-eligible managed models. Owner-only and human-gated; unlocking establishes an ADR-0018 \xA76 standing authorization and surfaces a per-model retention disclosure. | Tenant-admin | \`{{cli}} command tenant.model_gateway_policy.update --json '{"allow_non_zdr_models":true}'\` |
 | \`{{cli}} member invite|update|remove\` | \`member.invite\`, \`member.update\`, \`member.remove\` | Manage tenant members; execution requires an owner or admin membership. | Tenant | \`{{cli}} member invite --email ops@example.com --role member\` |
 | \`{{cli}} agent templates|create|setup|tools|dry-run|go-live|status|run-now|fleet-digest|get-run|show\` | \`agent_template.list\`, \`agent.create_from_template\`, \`agent.create_custom\`, \`agent_setup.get\`, \`agent_setup.update\`, \`agent.configure_tools\`, \`agent.run_dry_run\`, \`agent.go_live\`, \`agent.status\`, \`agent.run_now\`, \`agent.fleet_digest\`, \`agent.get_run\`, \`agent.show_markdown\` | Run the full agent setup and operation flow: list templates, create a draft from a template or guided custom answers (with \`--model\` and \`--effort\`), read or answer setup state, connect or decline tools, dry-run, go live, run on demand, capture the fleet-health digest, read one run's transcript/error diagnostics, and show a markdown readout. Human CLI dry-runs print the rehearsal transcript and, when present, the per-tool preview labels (\`Would run\`, \`Blocked\`, \`Escalated\`) before go-live. Create and go-live stop at human gates; the dry-run is ungated by human approval but requires a signed manifest first. | Tenant and seat | \`{{cli}} agent fleet-digest --json\` |
 | \`{{cli}} tools list\` | \`tool.catalog\` | List the discoverable tool catalog the builder reads (id, scope tiers, credential requirement, access policy, and execution-boundary guidance). | Tenant | \`{{cli}} tools list --json\` |
@@ -46437,7 +46732,7 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_create_agent_from_template\` | \`agent.create_from_template\` | Create a draft stock agent and draft Charter from a template (draft-only; occupancy needs a human steward). | Tenant | Call with \`seat_id\` and \`template_slug\`; expect human confirmation. |
 | \`rost_start_agent_setup\` | \`agent_setup.start\` | Start an agent setup draft for template, custom, or existing mode. | Tenant | Call with \`mode\` and seat placement. |
 | \`rost_get_agent_setup\` | \`agent_setup.get\` | Read agent setup state, blockers, and next action. | Seat or tenant-admin | Call with \`{"setup_id":"<id>"}\`. |
-| \`rost_update_agent_setup\` | \`agent_setup.update\` | Update parent, steward, lane, schedule, or answers on a setup draft. | Tenant | Call with \`setup_id\` and the fields to change. |
+| \`rost_update_agent_setup\` | \`agent_setup.update\` | Update parent, steward, lane, schedule, answers, or skill discovery on a setup draft. | Tenant | Call with \`setup_id\` and the fields to change. |
 | \`rost_update_agent_schedule\` | \`agent.update_schedule\` | Update a draft or live agent's scheduled execution. | Tenant | Call with \`agent_id\` and \`schedule_cron\`; expect human confirmation. |
 | \`rost_decommission_agent\` | \`agent.decommission\` | Retire an agent occupancy safely (no-orphan guarded). | Tenant | Call with \`agent_id\`; expect human confirmation. |
 | \`rost_pause_agent\` | \`agent.pause\` | Pause a live agent so it stops scheduled and on-demand runs; reversible. | Tenant | Call with \`seat_id\`; expect human confirmation. |
@@ -46481,6 +46776,7 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_set_company_autonomy_ceiling\` | \`settings.agent_policy.update\` | Set the company autonomy ceiling. | Tenant-admin | Owner-only, human-gated; call with \`{"profile":"locked_down"}\` (or \`balanced\`/\`high_autonomy\`, or \`{"profile":"custom","max_autonomous_risk":"high"}\`). Enforced by default. |
 | \`rost_get_cli_confirmation_mode\` | \`settings.confirmation_policy.get\` | Read the CLI confirmation mode: \`careful\` (the strict default \u2014 the CLI cannot silently auto-approve a pending confirmation) or \`trusted_operator\` (an owner opt-in). | Tenant | Call with \`{}\`; metadata only. |
 | \`rost_set_cli_confirmation_mode\` | \`settings.confirmation_policy.update\` | Set the CLI confirmation mode. | Tenant-admin | Owner-only, human-gated; call with \`{"cli_mode":"trusted_operator"}\` (or \`{"cli_mode":"careful"}\`). Choosing \`trusted_operator\` establishes an ADR-0018 \xA76 standing authorization; a \`dangerous\`-risk confirmation always requires interactive human review in either mode. |
+| \`rost_update_model_gateway_policy\` | \`tenant.model_gateway_policy.update\` | Unlock or relock managed models that lack a zero-retention (ZDR) tier. | Tenant-admin | Owner-only, human-gated; call with \`{"allow_non_zdr_models":true}\` (or \`false\` to relock). Unlocking establishes an ADR-0018 \xA76 standing authorization and surfaces a per-model retention disclosure. |
 | \`rost_get_aicos_brain_settings\` | \`aicos.brain_settings.get\` | Read AICOS lane and brain labels for cloud managed/BYOK, runner Claude/Codex, and MCP client. | Tenant | Call with \`{}\`; returns enum labels only, never keys, vault refs, or runner secrets. |
 | \`rost_update_aicos_brain_settings\` | \`aicos.brain_settings.update\` | Update AICOS lane and cloud/runner brain preferences. | Tenant-admin | Owner-only and human-gated; call with \`{"lane":"runner","runner_brain":"claude-cli"}\` or \`{"cloud_brain":"byok"}\`. BYOK requires an active tenant Anthropic key. For AICOS, selecting \`codex-cli\` is currently rejected until the governed interactive runner path is verified. |
 | \`rost_list_signals\` | \`signal.list\` | List measurables with their latest reading and on/off-track state. | Seat or tenant-admin | Call with \`{}\` to find measurable ids. |
@@ -47443,7 +47739,7 @@ Keep agent scope tight at first. Approve more autonomy only after evidence. Use
     order: 71,
     title: "Confirmations and human gates guide",
     summary: "How {{brand}} routes authority-changing work through human confirmation, and why agents never approve their own requests.",
-    version: "2026-07-03.1",
+    version: "2026-07-11.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["graph_design", "charter_design", "staffing", "operating_rhythm"],
@@ -47470,7 +47766,7 @@ Keep agent scope tight at first. Approve more autonomy only after evidence. Use
 - \`none\`: no confirmation gate \u2014 the command never returns a pending confirmation. Most are reads or reversible drafts an agent can run directly, including over MCP (graph reads, \`charter.draft\`, \`status.record\`, \`sync.brief.compile\`, \`sync.run.start\`, \`task.complete\`). A few \`none\` commands still require a human actor or an interactive channel \u2014 \`confirmation.approve\` is \`none\` (approving a gate cannot itself be gated) yet runs only as a human in the UI or CLI \u2014 so \`none\` means "no confirmation gate", not always "agent-callable".
 - \`human_required\`: a human must approve. Structural, staffing, resolution, tenant profile, and go-live commands (\`seat.reparent\`, \`charter.approve\`, \`goal.reparent\`, \`friction.resolve\`, \`agent.go_live\`, \`mcp_token.create\`, \`tenant.rename\`).
 - \`credential_flow\`: routes through the vault-backed credential path so a secret is captured as a vault reference, never stored or logged in the clear (\`credential.ingress\`, \`tenant.anthropic_key.save\`; \`agent.configure_tools\` is \`credential_flow\` too \u2014 it stages credential-ingress requests through the same path without ever taking raw secret material).
-- \`dangerous\`: the highest-risk human gate. Only two commands carry it \u2014 \`settings.update\` and \`agent.decommission\`.
+- \`dangerous\`: the highest-risk human gate. Only three commands carry it \u2014 \`settings.update\`, \`agent.decommission\`, and \`tenant.model_gateway_policy.update\` (unlocking managed models without a zero-retention tier \u2014 a reviewed act even under \`trusted_operator\`).
 
 The \`dangerous\` confirmation **level** is rare and is not the same as the **risk badge** a pending confirmation can display. The badge shows "dangerous" whenever a command's confirmation level is \`dangerous\` **or** the command redacts secrets (its audit redaction is \`secret_strict\`), so a \`credential_flow\` command such as \`credential.ingress\` shows the dangerous badge while still gating through the credential path \u2014 not the \`dangerous\` level. Read the badge as "handle with care" and the confirmation level as "who must approve". \`confirmation.approve\` and \`confirmation.reject\` are themselves \`none\` \u2014 approving a gate cannot itself require approval.
 
@@ -47607,11 +47903,11 @@ Do not claim that a live charge happened unless Stripe test/live evidence proves
     order: 72,
     title: "Settings guide",
     summary: "How to use Settings as the control plane for company access, channels, providers, tokens, and operating defaults.",
-    version: "2026-07-09.2",
+    version: "2026-07-11.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
-    relatedCommandIds: ["onboarding.create_invite", "mcp_token.create", "mcp_token.revoke", "mcp_token.list", "integration.list", "integration.readiness", "integration.status", "integration.test", "settings.get", "settings.update", "tenant.rename", "settings.sync_brief_scope.get", "settings.sync_brief_scope.update", "settings.product_learning.get", "settings.product_learning.update", "settings.agent_policy.get", "settings.agent_policy.update", "settings.confirmation_policy.get", "settings.confirmation_policy.update", "aicos.brain_settings.get", "aicos.brain_settings.update"],
+    relatedCommandIds: ["onboarding.create_invite", "mcp_token.create", "mcp_token.revoke", "mcp_token.list", "integration.list", "integration.readiness", "integration.status", "integration.test", "settings.get", "settings.update", "tenant.rename", "settings.sync_brief_scope.get", "settings.sync_brief_scope.update", "settings.product_learning.get", "settings.product_learning.update", "settings.agent_policy.get", "settings.agent_policy.update", "settings.confirmation_policy.get", "settings.confirmation_policy.update", "tenant.model_gateway_policy.update", "aicos.brain_settings.get", "aicos.brain_settings.update"],
     legal: { publicRisk: "low", notes: ["{{brand}}-native settings guidance."] },
     sources: [
       {
@@ -47646,6 +47942,7 @@ Section state is fully server-side: every in-app link, redirect, and save uses \
 - Stored credentials (vault references only) and tool access approvals.
 - Operating defaults, including Sync Brief scope.
 - Product-learning participation for bounded product analytics.
+- Model gateway policy: whether managed runs may use a non-zero-retention model.
 
 Settings lifecycle timestamps are display metadata for tokens, connected machines, integrations, and stored credentials. They may be emitted by the database as either timestamp values or strings, but Settings renders them as safe labels rather than treating timestamp formatting failures as page-level failures.
 
@@ -47710,6 +48007,15 @@ The CLI confirmation mode is a separate tenant-wide dial. It does not change wha
 - Read it with \`settings.confirmation_policy.get\` (CLI: \`{{cli}} settings confirmation-mode get\`). Set it with \`settings.confirmation_policy.update\` (CLI: \`{{cli}} settings confirmation-mode set --mode trusted_operator\`). Owner-only and human-gated.
 - Stored at \`tenants.settings.confirmation_policy\`; enforced server-side in \`confirmation.approve\`, so a stale or modified local CLI cannot bypass it.
 
+## Model gateway policy
+
+The model gateway policy is a separate tenant-wide dial (ADR-0019) that controls whether the AI Gateway may route a managed run to a provider model that lacks a zero-retention (ZDR) tier.
+
+- \`allow_non_zdr_models: false\` is the conservative default for every company. The gateway restricts managed runs to zero-retention-eligible models.
+- Unlocking is a deliberate tenant_admin opt-in (an ADR-0018 \xA76 standing authorization): it lets managed brains without a zero-retention tier run, disclosed up front \u2014 the provider retains data up to 30 days for abuse monitoring.
+- Set it with \`tenant.model_gateway_policy.update\` (call with \`{"allow_non_zdr_models":true}\` or \`{"allow_non_zdr_models":false}\`). Owner-only and human-gated.
+- Stored at \`tenants.settings.model_gateway_policy\`; enforced server-side in the AI Gateway inference-policy resolver, so a stale or modified local client cannot bypass it. The model-picker UI that surfaces this choice inline ships separately.
+
 ## Agent guidance
 
 Agents may explain which setting is needed and why. They should not ask users to paste secrets into chat or tool arguments. When credentials are required, route the user to the vault-backed setup flow.`
@@ -49676,7 +49982,7 @@ var COMMAND_MANIFEST = [
   { "id": "agent_setup.get", "namespace": "agent_setup", "action": "get", "title": "Get agent setup", "description": "Read the resumable agent-setup state: mode, parent, steward, template, lane, schedule, tool decisions, dry run, and next action.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": false }, { "name": "setup_id", "flag": "setup-id", "type": "string", "required": false }], "hasComplexInput": false, "help": "Read the resumable setup state: mode, parent, steward, lane, schedule, tool decisions, dry-run blockers, and the next action." },
   { "id": "agent_setup.relane", "namespace": "agent_setup", "action": "relane", "title": "Re-lane a live agent", "description": "Governed re-lane of a live agent: pause, move to the new lane, force a fresh dry-run rehearsal on that lane, then go live. Owner-only and human-gated; records a rationale.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "lane", "flag": "lane", "type": "enum", "required": true, "enumValues": ["cloud", "mcp_session", "runner"] }, { "name": "reason", "flag": "reason", "type": "string", "required": true }], "hasComplexInput": false, "help": "Re-lane a live agent (cloud / runner / mcp_session): it pauses, moves to the new lane, forces a fresh dry-run rehearsal on that lane, then goes live \u2014 owner-only, human-gated, with a required rationale. A runner target needs a paired runner; a failed rehearsal leaves the agent paused on the new lane." },
   { "id": "agent_setup.start", "namespace": "agent_setup", "action": "start", "title": "Start agent setup", "description": "Start (or resume) a draft agent setup for a seat in template, custom, or existing mode.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "mode", "flag": "mode", "type": "enum", "required": true, "enumValues": ["template", "custom", "existing"] }, { "name": "template_slug", "flag": "template-slug", "type": "string", "required": false }], "hasComplexInput": false, "help": "Start a draft agent setup from a template, custom, or existing mode; the setup resumes from the draft agent and Charter, not a fresh start." },
-  { "id": "agent_setup.update", "namespace": "agent_setup", "action": "update", "title": "Update agent setup", "description": "Update the draft agent's parent, steward, lane, schedule, operational answers, and tool decisions.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "parent_seat_id", "flag": "parent-seat-id", "type": "string", "required": false }, { "name": "steward_seat_id", "flag": "steward-seat-id", "type": "string", "required": false }, { "name": "lane", "flag": "lane", "type": "enum", "required": false, "enumValues": ["cloud", "mcp_session", "runner"] }, { "name": "schedule_cron", "flag": "schedule-cron", "type": "string", "required": false }, { "name": "answers", "flag": "answers", "type": "array", "required": false, "itemType": "string" }], "hasComplexInput": true, "help": "Update parent, steward, lane, schedule, answers, or tool decisions on the draft; steward and parent changes keep the no-orphan chain explicit." },
+  { "id": "agent_setup.update", "namespace": "agent_setup", "action": "update", "title": "Update agent setup", "description": "Update the draft agent's parent, steward, lane, schedule, operational answers, and tool decisions.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "parent_seat_id", "flag": "parent-seat-id", "type": "string", "required": false }, { "name": "steward_seat_id", "flag": "steward-seat-id", "type": "string", "required": false }, { "name": "lane", "flag": "lane", "type": "enum", "required": false, "enumValues": ["cloud", "mcp_session", "runner"] }, { "name": "schedule_cron", "flag": "schedule-cron", "type": "string", "required": false }, { "name": "answers", "flag": "answers", "type": "array", "required": false, "itemType": "string" }, { "name": "skill_discovery_enabled", "flag": "skill-discovery-enabled", "type": "boolean", "required": false }], "hasComplexInput": true, "help": "Update parent, steward, lane, schedule, answers, or tool decisions on the draft; steward and parent changes keep the no-orphan chain explicit." },
   { "id": "agent_template.list", "namespace": "agent_template", "action": "list", "title": "List agent templates", "description": "List stock agent templates and their responsibilities, default tools, and dry-run rehearsal.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "List stock agent templates and their default tools and safety boundaries before starting a template setup." },
   { "id": "agent.configure_tools", "namespace": "agent", "action": "configure_tools", "title": "Configure agent tools", "description": "Save tool proposals, declines, and credential-ingress requests for a draft agent. Never stores or echoes secret material; vault refs only.", "requiredScope": "seat", "confirmation": "credential_flow", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }], "hasComplexInput": true, "help": "Connect or decline proposed tools and stage credential-ingress requests; never place raw secrets here \u2014 secrets flow through vault-backed credential.ingress as vault refs only.", "example": { "seat_id": "0190aaaa-aaaa-7aaa-8aaa-aaaaaaaaaaaa", "tool_decisions": [{ "tool": "ap.invoices.read", "decision": "connect" }, { "tool": "email.draft", "decision": "connect" }] } },
   { "id": "agent.create_custom", "namespace": "agent", "action": "create_custom", "title": "Create custom agent", "description": "Create a draft custom agent shell and a draft Charter seed from operational answers (what it owns, success, never-do-alone, steward).", "requiredScope": "tenant", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "steward_seat_id", "flag": "steward-seat-id", "type": "string", "required": false }, { "name": "lane", "flag": "lane", "type": "enum", "required": false, "enumValues": ["cloud", "mcp_session", "runner"] }, { "name": "what_it_owns", "flag": "what-it-owns", "type": "string", "required": false }, { "name": "what_success_looks_like", "flag": "what-success-looks-like", "type": "string", "required": false }, { "name": "what_it_must_never_do_alone", "flag": "what-it-must-never-do-alone", "type": "string", "required": false }], "hasComplexInput": true, "help": "Create a draft custom agent from operational answers (what it owns, success, never-do-alone, steward); the Charter Builder owns the contract and go-live stays human-gated.", "example": { "seat_id": "0190aaaa-aaaa-7aaa-8aaa-aaaaaaaaaaaa", "steward_seat_id": "0190bbbb-bbbb-7bbb-8bbb-bbbbbbbbbbbb", "lane": "cloud", "what_it_owns": "Drafting AP invoice entries from inbound vendor emails for human review.", "what_success_looks_like": "Every inbound invoice is drafted within one business day with the correct GL coding.", "what_it_must_never_do_alone": "Never send payment or approve an invoice without a human sign-off." } },
@@ -49893,6 +50199,7 @@ var COMMAND_MANIFEST = [
   { "id": "team.health_score", "namespace": "team", "action": "health_score", "title": "Team health score", "description": "Return the single rolled-up 0\u2013100 team-health score (latest month) with its band (green/yellow/red) and label. Honest insufficient-data state when no metrics exist yet.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "Read the single rolled-up 0-100 team-health score (latest month) with its band and label." },
   { "id": "tenant.anthropic_key.save", "namespace": "tenant", "action": "anthropic_key.save", "title": "Save tenant Anthropic key", "description": "Store a tenant-scoped Anthropic key in the configured vault.", "requiredScope": "tenant", "confirmation": "credential_flow", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "secretBlocked": true, "help": "Save model-provider credentials only through vault-backed flows and keep raw keys out of prompts, logs, and command metadata." },
   { "id": "tenant.create", "namespace": "tenant", "action": "create", "title": "Create additional company", "description": "Create a new clean company for an already-provisioned account after checking tenant.create.additional entitlement.", "requiredScope": "tenant_admin", "confirmation": "none", "exposeOverMcp": false, "fields": [{ "name": "company_name", "flag": "company-name", "type": "string", "required": true }], "hasComplexInput": false, "help": "Create an additional clean company from an existing company session. Requires tenant.create.additional entitlement; first-company bootstrap stays signup.provision_tenant." },
+  { "id": "tenant.model_gateway_policy.update", "namespace": "tenant", "action": "model_gateway_policy.update", "title": "Update model gateway policy", "description": "Unlock or relock managed models that do not offer a zero-retention (ZDR) tier (ADR-0019). Locked (the conservative default) restricts the AI Gateway to zero-retention-eligible managed models. Owner-only and human-gated: unlocking is a deliberate ADR-0018 \xA76 standing authorization that lets managed brains without a zero-retention tier run. This provider retains data up to 30 days for abuse monitoring.", "requiredScope": "tenant_admin", "confirmation": "dangerous", "exposeOverMcp": true, "fields": [{ "name": "allow_non_zdr_models", "flag": "allow-non-zdr-models", "type": "boolean", "required": true }], "hasComplexInput": false, "help": "Unlock or relock managed models that do not offer a zero-retention (ZDR) tier (ADR-0019). Locked (default) restricts the AI Gateway to zero-retention-eligible managed models. Owner-only and human-gated; unlocking establishes an ADR-0018 \xA76 standing authorization and surfaces the per-model retention disclosure." },
   { "id": "tenant.rename", "namespace": "tenant", "action": "rename", "title": "Rename company", "description": "Rename the current tenant/company. The rename is human-gated and writes an audit event.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "company_name", "flag": "company-name", "type": "string", "required": true }], "hasComplexInput": false, "help": "Rename the current company; owner-only, human-gated, and audited as an event." },
   { "id": "tool.catalog", "namespace": "tool", "action": "catalog", "title": "List tool catalog", "description": "List the discoverable tool catalog the agent builder reads \u2014 tool id, title, provider, prescriptive description, default scope tiers, credential requirement, access policy, and execution-boundary guidance.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "provider", "flag": "provider", "type": "string", "required": false }], "hasComplexInput": false, "help": "List the tool catalog the builder reads \u2014 id, prescriptive description, scope tiers, credential requirement, access policy, and execution-boundary guidance." },
   { "id": "usage.report", "namespace": "usage", "action": "report", "title": "AI-workforce ROI report", "description": "Return the tenant's immutable per-period usage snapshots \u2014 agents ran, outputs, token/run cost, human-accepted value, exceptions, and approvals \u2014 for the AI-workforce ROI report.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "limit", "flag": "limit", "type": "integer", "required": false }], "hasComplexInput": false, "help": "Read the AI-workforce ROI report \u2014 per-period agents/outputs/token+run cost, human-accepted value, exceptions, and approvals \u2014 from immutable usage snapshots." },