@rosthq/cli 0.7.99 → 0.7.101

package/dist/index.js

@@ -44318,6 +44318,14 @@ var syncBriefScopeGetOutputSchema = external_exports.object({
 var syncBriefScopeUpdateInputSchema = external_exports.object({
   sync_brief_scope: syncBriefScopeSchema
 }).strict();
+var memberVisibilityModeSchema = external_exports.enum(["all", "seat_subtree"]);
+var memberVisibilityGetInputSchema = external_exports.object({}).strict();
+var memberVisibilityGetOutputSchema = external_exports.object({
+  member_visibility_mode: memberVisibilityModeSchema
+}).strict();
+var memberVisibilityUpdateInputSchema = external_exports.object({
+  member_visibility_mode: memberVisibilityModeSchema
+}).strict();
 var productLearningModeSchema = external_exports.enum(["enabled", "disabled", "enterprise_contract"]);
 var tenantProductLearningPolicySchema = external_exports.object({
   mode: productLearningModeSchema,
@@ -44399,6 +44407,7 @@ var settingsGetOutputSchema = external_exports.object({
   has_anthropic_key: external_exports.boolean(),
   notifications: notificationSettingsSchema,
   sync_brief_scope: syncBriefScopeSchema,
+  member_visibility_mode: memberVisibilityModeSchema,
   product_learning: tenantProductLearningPolicySchema,
   integrations: external_exports.array(integrationSummarySchema)
 }).strict();
@@ -44767,6 +44776,28 @@ var signalReadingProposalSchema = external_exports.object({
   }
 });
 
+// ../../packages/protocol/src/signal-draft-first-readings.ts
+var uuidSchema17 = external_exports.string().uuid();
+var signalDraftFirstReadingsInputSchema = external_exports.object({
+  measurable_id: uuidSchema17
+}).strict();
+var signalDraftFirstReadingsOutputSchema = external_exports.object({
+  measurable_id: uuidSchema17,
+  // The live pull outcome, surfaced verbatim so the UI can explain a no-datapoint
+  // result honestly ("source polled, nothing came back") rather than silently.
+  outcome: external_exports.enum(["ok", "blocked", "error"]),
+  // 0 or 1: a single-value recipe pull yields at most one current-period reading.
+  // Never fabricates back-dated history the source cannot actually produce.
+  drafted: external_exports.number().int().min(0).max(1),
+  // Present only when drafted === 1.
+  reading_id: uuidSchema17.optional(),
+  value: external_exports.number().finite().optional(),
+  period_start: external_exports.string().regex(/^\d{4}-\d{2}-\d{2}$/, "expected YYYY-MM-DD").optional(),
+  // Present only when drafted === 0: a short, non-secret machine reason
+  // (e.g. "non_numeric", "blocked", "error") the UI maps to guidance.
+  reason: external_exports.string().min(1).max(200).optional()
+}).strict();
+
 // ../../packages/protocol/src/secret-broker.ts
 var uuid10 = external_exports.string().uuid();
 var VAULT_REF_PROVIDER = /^(?:infisical|doppler|local-dev):\/\/\S+$/;
@@ -46321,7 +46352,7 @@ var softwareFactoryBudgetExhaustedEventSchema = external_exports.object({
 }).strict();
 
 // ../../packages/protocol/src/sync-brief.ts
-var uuidSchema17 = external_exports.string().uuid();
+var uuidSchema18 = external_exports.string().uuid();
 var dateSchema = external_exports.string().regex(/^\d{4}-\d{2}-\d{2}$/);
 var syncBriefGapSchema = external_exports.object({
   section: external_exports.enum(["exceptions", "goal_deltas", "task_review", "friction", "agent_activity"]),
@@ -46334,8 +46365,8 @@ var sectionSchema = (itemSchema) => external_exports.object({
   flagged_gaps: external_exports.array(syncBriefGapSchema)
 }).strict();
 var syncBriefExceptionSchema = external_exports.object({
-  measurable_id: uuidSchema17,
-  seat_id: uuidSchema17,
+  measurable_id: uuidSchema18,
+  seat_id: uuidSchema18,
   seat_name: external_exports.string().min(1),
   name: external_exports.string().min(1),
   state: external_exports.enum(["risk", "crit", "pending"]),
@@ -46346,8 +46377,8 @@ var syncBriefExceptionSchema = external_exports.object({
   freshness: external_exports.enum(["fresh", "due", "stale", "awaiting_first_reading", "not_expected"]).optional()
 }).strict();
 var syncBriefGoalDeltaSchema = external_exports.object({
-  goal_id: uuidSchema17,
-  seat_id: uuidSchema17.nullable(),
+  goal_id: uuidSchema18,
+  seat_id: uuidSchema18.nullable(),
   seat_name: external_exports.string().nullable(),
   title: external_exports.string().min(1),
   status: external_exports.enum(["on", "off", "done", "dropped"]),
@@ -46361,22 +46392,22 @@ var syncBriefTaskReviewSchema = external_exports.object({
   previous_done_rate: external_exports.number().min(0).max(1),
   delta: external_exports.number().min(-1).max(1),
   stalled: external_exports.array(external_exports.object({
-    task_id: uuidSchema17,
-    owner_seat_id: uuidSchema17,
+    task_id: uuidSchema18,
+    owner_seat_id: uuidSchema18,
     owner_seat_name: external_exports.string().min(1),
     title: external_exports.string().min(1),
     due_on: dateSchema,
     stalled_at: external_exports.string().nullable()
   }).strict()),
   overdue_by_owner: external_exports.array(external_exports.object({
-    owner_seat_id: uuidSchema17,
+    owner_seat_id: uuidSchema18,
     owner_seat_name: external_exports.string().min(1),
     overdue_count: external_exports.number().int().nonnegative()
   }).strict())
 }).strict();
 var syncBriefIssueSchema = external_exports.object({
-  issue_id: uuidSchema17,
-  raised_by_seat_id: uuidSchema17,
+  issue_id: uuidSchema18,
+  raised_by_seat_id: uuidSchema18,
   raised_by_seat_name: external_exports.string().min(1),
   summary: external_exports.string().min(1),
   severity: external_exports.enum(["low", "med", "high", "critical"]),
@@ -46393,15 +46424,15 @@ var syncBriefActionItemTrendSchema = external_exports.object({
   has_prior: external_exports.boolean()
 }).strict();
 var syncBriefCascadeAtRiskSchema = external_exports.object({
-  goal_id: uuidSchema17,
+  goal_id: uuidSchema18,
   title: external_exports.string().min(1),
-  seat_id: uuidSchema17.nullable(),
+  seat_id: uuidSchema18.nullable(),
   progress_pct: external_exports.number().int().min(0).max(100),
   classification: external_exports.enum(["at_risk", "projected_miss"]),
   behind_days: external_exports.number().nullable()
 }).strict();
 var syncBriefRunHeartbeatStalledSeatSchema = external_exports.object({
-  seat_id: uuidSchema17,
+  seat_id: uuidSchema18,
   current_phase: external_exports.string().nullable(),
   stalled_run_count: external_exports.number().int().nonnegative()
 }).strict();
@@ -46414,8 +46445,8 @@ var syncBriefRunHeartbeatRollupSchema = external_exports.object({
   stalled_seats: external_exports.array(syncBriefRunHeartbeatStalledSeatSchema)
 }).strict();
 var syncBriefAgentActivitySchema = external_exports.object({
-  agent_id: uuidSchema17,
-  seat_id: uuidSchema17,
+  agent_id: uuidSchema18,
+  seat_id: uuidSchema18,
   seat_name: external_exports.string().min(1),
   run_count: external_exports.number().int().nonnegative(),
   failed_run_count: external_exports.number().int().nonnegative(),
@@ -46428,11 +46459,11 @@ var syncBriefAgentActivitySchema = external_exports.object({
 var syncBriefSchema = external_exports.object({
   schema_version: external_exports.literal(1),
   tenant: external_exports.object({
-    id: uuidSchema17,
+    id: uuidSchema18,
     name: external_exports.string().min(1)
   }).strict(),
   cluster: external_exports.object({
-    id: uuidSchema17,
+    id: uuidSchema18,
     name: external_exports.string().min(1)
   }).strict().nullable(),
   period: external_exports.object({
@@ -46549,11 +46580,11 @@ var usageSnapshotOutputSchema = external_exports.object({
 }).strict();
 
 // ../../packages/protocol/src/event-payloads.ts
-var uuidSchema18 = external_exports.string().uuid();
+var uuidSchema19 = external_exports.string().uuid();
 var evidenceSchema = external_exports.array(external_exports.unknown());
 var statusEventPayloadSchema = external_exports.object({
   measurables: external_exports.array(external_exports.object({
-    id: uuidSchema18,
+    id: uuidSchema19,
     value: external_exports.number().finite(),
     // DER-1045: an optional, non-secret citation for an agent-proposed reading
     // (signal.report) — where the number came from + the agent's confidence.
@@ -46582,13 +46613,13 @@ var statusEventPayloadSchema = external_exports.object({
     }).strict().optional()
   }).strict()).optional(),
   goals: external_exports.array(external_exports.object({
-    id: uuidSchema18,
+    id: uuidSchema19,
     state: external_exports.enum(["on", "off"]),
     note: external_exports.string().min(1).optional()
   }).strict()).optional()
 }).strict();
 var escalationCategorySchema = external_exports.enum(["safety_refusal"]);
-var escalationEventPayloadSchema = external_exports.object({
+var escalationRaiseInputSchema = external_exports.object({
   reason: external_exports.string().min(1),
   charter_clause: external_exports.string().min(1),
   evidence: evidenceSchema,
@@ -46598,14 +46629,105 @@ var escalationEventPayloadSchema = external_exports.object({
   // explicitly escalated with a category (today: a safety refusal).
   category: escalationCategorySchema.optional()
 }).strict();
+var escalationEventPayloadSchema = escalationRaiseInputSchema.extend({
+  run_id: external_exports.string().uuid().optional()
+}).strict();
 var issueEventPayloadSchema = external_exports.object({
   summary: external_exports.string().min(1),
-  blocking_goal_id: uuidSchema18.optional(),
-  broken_measurable_id: uuidSchema18.optional(),
+  blocking_goal_id: uuidSchema19.optional(),
+  broken_measurable_id: uuidSchema19.optional(),
   evidence: evidenceSchema,
   severity: external_exports.enum(["low", "med", "high", "critical"])
 }).strict();
 
+// ../../packages/protocol/src/event-internal-payloads.ts
+var uuidSchema20 = external_exports.string().uuid();
+var internalEventObjectSchema = external_exports.record(external_exports.string(), external_exports.unknown()).refine((payload) => !Array.isArray(payload), "Internal event payload must be an object");
+var actionEventPayloadSchema = external_exports.object({ action: external_exports.string().min(1) }).passthrough();
+function authoritativePrefixUnion(branches, authoritative) {
+  return external_exports.union(branches).superRefine((payload, ctx) => {
+    const action = payload.action;
+    if (typeof action !== "string") return;
+    for (const { prefix, strict } of authoritative) {
+      if (!action.startsWith(prefix)) continue;
+      const result = strict.safeParse(payload);
+      if (!result.success) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          message: `Malformed "${action}" payload: an action beginning with "${prefix}" must satisfy the strict ${prefix}* schema and may not fall through to a permissive branch (${result.error.issues.map((issue2) => issue2.message).join("; ")})`
+        });
+      }
+      return;
+    }
+  });
+}
+var inviteCreatedEventPayloadSchema = external_exports.object({
+  action: external_exports.literal("invite.created"),
+  invite_id: uuidSchema20,
+  email: external_exports.string().email(),
+  role: memberRoleSchema,
+  member_type: memberTypeSchema,
+  access_profile: memberAccessProfileSchema,
+  aicos_access_scope: aicosAccessScopeSchema,
+  invited_by: uuidSchema20
+}).strict();
+var inviteRevokedEventPayloadSchema = external_exports.object({
+  action: external_exports.literal("invite.revoked"),
+  invite_id: uuidSchema20,
+  revoked_by: uuidSchema20
+}).strict();
+var inviteAcceptedEventPayloadSchema = external_exports.object({
+  action: external_exports.literal("invite.accepted"),
+  invite_id: uuidSchema20,
+  user_id: uuidSchema20,
+  membership_id: uuidSchema20,
+  linked_seat_ids: external_exports.array(uuidSchema20)
+}).strict();
+var inviteLifecycleEventPayloadSchema = external_exports.union([
+  inviteCreatedEventPayloadSchema,
+  inviteRevokedEventPayloadSchema,
+  inviteAcceptedEventPayloadSchema
+]);
+var internalEventWriterPayloadSchema = authoritativePrefixUnion(
+  [
+    inviteCreatedEventPayloadSchema,
+    inviteRevokedEventPayloadSchema,
+    inviteAcceptedEventPayloadSchema,
+    actionEventPayloadSchema,
+    internalEventObjectSchema
+  ],
+  [{ prefix: "invite.", strict: inviteLifecycleEventPayloadSchema }]
+);
+var provisioningEventPayloadSchema = authoritativePrefixUnion(
+  [
+    inviteCreatedEventPayloadSchema,
+    inviteRevokedEventPayloadSchema,
+    inviteAcceptedEventPayloadSchema,
+    actionEventPayloadSchema,
+    internalEventObjectSchema
+  ],
+  // Only "invite." is authoritative today (the sole prefix with typed branches).
+  // Non-invite provisioning actions (e.g. tenant.created) keep riding the
+  // permissive branches unchanged, preserving parse-compat with stored rows.
+  [{ prefix: "invite.", strict: inviteLifecycleEventPayloadSchema }]
+);
+var decisionEventPayloadSchema = external_exports.union([
+  actionEventPayloadSchema,
+  internalEventObjectSchema
+]);
+var systemEventPayloadSchema = external_exports.union([
+  actionEventPayloadSchema,
+  internalEventObjectSchema
+]);
+var charterEventPayloadSchema = external_exports.union([
+  actionEventPayloadSchema,
+  internalEventObjectSchema
+]);
+var taskEventPayloadSchema = external_exports.union([
+  actionEventPayloadSchema,
+  internalEventObjectSchema
+]);
+
 // ../../packages/protocol/src/held-tool-action.ts
 var heldToolActionReplaySchema = external_exports.object({
   tool_name: external_exports.string().min(1),
@@ -46614,14 +46736,14 @@ var heldToolActionReplaySchema = external_exports.object({
 }).strict();
 
 // ../../packages/protocol/src/operating.ts
-var uuidSchema19 = external_exports.string().uuid();
+var uuidSchema21 = external_exports.string().uuid();
 var taskListInputSchema = external_exports.object({}).strict();
 var operatingTaskSchema = external_exports.object({
-  id: uuidSchema19,
+  id: uuidSchema21,
   title: external_exports.string(),
   description: external_exports.string().nullable(),
-  from_seat_id: uuidSchema19.nullable(),
-  goal_id: uuidSchema19.nullable(),
+  from_seat_id: uuidSchema21.nullable(),
+  goal_id: uuidSchema21.nullable(),
   acceptance_criteria: external_exports.unknown(),
   due_on: external_exports.string().nullable(),
   status: external_exports.string()
@@ -46630,54 +46752,54 @@ var taskListOutputSchema = external_exports.object({
   tasks: external_exports.array(operatingTaskSchema)
 }).strict();
 var taskAcceptInputSchema = external_exports.object({
-  id: uuidSchema19
+  id: uuidSchema21
 }).strict();
 var taskConfirmProposalInputSchema = external_exports.object({
-  id: uuidSchema19
+  id: uuidSchema21
 }).strict();
 var taskMutationOutputSchema = external_exports.object({
   task: external_exports.object({
-    id: uuidSchema19,
+    id: uuidSchema21,
     status: external_exports.string()
   }).strict()
 }).strict();
 var taskDeclineInputSchema = external_exports.object({
-  id: uuidSchema19,
+  id: uuidSchema21,
   reason: external_exports.string().min(1)
 }).strict();
 var taskDeclineOutputSchema = external_exports.object({
   task: external_exports.object({
-    id: uuidSchema19,
+    id: uuidSchema21,
     status: external_exports.string(),
     decline_reason: external_exports.string()
   }).strict()
 }).strict();
 var taskCompleteInputSchema = external_exports.object({
-  id: uuidSchema19,
+  id: uuidSchema21,
   summary: external_exports.string().min(1),
   artifacts: external_exports.unknown().optional()
 }).strict();
 var taskCompleteOutputSchema = external_exports.object({
-  task_id: uuidSchema19,
-  event_id: uuidSchema19,
+  task_id: uuidSchema21,
+  event_id: uuidSchema21,
   type: external_exports.literal("handoff")
 }).strict();
 var statusRecordOutputSchema = external_exports.object({
-  event_id: uuidSchema19,
+  event_id: uuidSchema21,
   type: external_exports.literal("status")
 }).strict();
 var frictionFileIssueInputSchema = issueEventPayloadSchema.extend({
   source_key: external_exports.string().trim().min(1).max(200).optional()
 }).strict();
 var duplicateFrictionCandidateSchema = external_exports.object({
-  issue_id: uuidSchema19,
+  issue_id: uuidSchema21,
   summary: external_exports.string().min(1),
   // pg_trgm similarity in [0, 1]; higher is more similar.
   similarity: external_exports.number().min(0).max(1)
 }).strict();
 var frictionFileIssueOutputSchema = external_exports.object({
-  event_id: uuidSchema19,
-  issue_id: uuidSchema19,
+  event_id: uuidSchema21,
+  issue_id: uuidSchema21,
   type: external_exports.literal("issue"),
   // DER-1522: likely-duplicate candidates detected before creation. Recommend,
   // never block — filing always proceeds; empty when nothing crossed the
@@ -46691,12 +46813,12 @@ var workLogInputSchema = external_exports.object({
   note: external_exports.string().min(1)
 }).strict();
 var workLogOutputSchema = external_exports.object({
-  event_id: uuidSchema19,
+  event_id: uuidSchema21,
   type: external_exports.literal("task")
 }).strict();
 var escalationRaiseOutputSchema = external_exports.object({
-  event_id: uuidSchema19,
-  escalation_id: uuidSchema19,
+  event_id: uuidSchema21,
+  escalation_id: uuidSchema21,
   type: external_exports.literal("escalation")
 }).strict();
 var deliverableKindSchema2 = external_exports.enum(["brief", "work_evidence", "artifact", "report", "other"]);
@@ -46755,7 +46877,7 @@ var deliverableRejectOutputSchema = external_exports.object({
 }).strict();
 
 // ../../packages/protocol/src/steward.ts
-var uuidSchema20 = external_exports.string().uuid();
+var uuidSchema22 = external_exports.string().uuid();
 var escalationStatusSchema = external_exports.enum([
   "open",
   "approved",
@@ -46764,18 +46886,18 @@ var escalationStatusSchema = external_exports.enum([
 ]);
 var stewardReplayActionSummarySchema = external_exports.object({
   tool_name: external_exports.string(),
-  run_id: uuidSchema20
+  run_id: uuidSchema22
 }).strict();
 var stewardProposedToolCallSchema = external_exports.object({
   tool_name: external_exports.string(),
   args_summary: external_exports.unknown()
 }).strict();
 var stewardEscalationSchema = external_exports.object({
-  id: uuidSchema20,
-  seat_id: uuidSchema20,
+  id: uuidSchema22,
+  seat_id: uuidSchema22,
   seat_name: external_exports.string(),
   seat_type: external_exports.enum(["human", "agent", "hybrid"]),
-  steward_seat_id: uuidSchema20,
+  steward_seat_id: uuidSchema22,
   steward_seat_name: external_exports.string(),
   reason: external_exports.string(),
   charter_clause: external_exports.string(),
@@ -46794,11 +46916,11 @@ var stewardEscalationSchema = external_exports.object({
   proposed_tool_call: stewardProposedToolCallSchema.optional(),
   recommended_action: external_exports.string().nullable(),
   status: escalationStatusSchema,
-  decided_by: uuidSchema20.nullable(),
+  decided_by: uuidSchema22.nullable(),
   decided_by_name: external_exports.string().nullable(),
   decided_at: external_exports.string().nullable(),
   decision_note: external_exports.string().nullable(),
-  issue_id: uuidSchema20.nullable(),
+  issue_id: uuidSchema22.nullable(),
   created_at: external_exports.string(),
   updated_at: external_exports.string()
 }).strict();
@@ -46809,27 +46931,27 @@ var escalationListOutputSchema = external_exports.object({
   escalations: external_exports.array(stewardEscalationSchema)
 }).strict();
 var escalationGetInputSchema = external_exports.object({
-  id: uuidSchema20
+  id: uuidSchema22
 }).strict();
 var escalationGetOutputSchema = external_exports.object({
   escalation: stewardEscalationSchema
 }).strict();
 var escalationResolveActionSchema = external_exports.enum(["approve", "convert_to_issue"]);
 var escalationResolveInputSchema = external_exports.object({
-  id: uuidSchema20,
+  id: uuidSchema22,
   action: escalationResolveActionSchema.optional(),
   rationale: external_exports.string().trim().min(1).optional()
 }).strict();
 var escalationRejectInputSchema = external_exports.object({
-  id: uuidSchema20,
+  id: uuidSchema22,
   rationale: external_exports.string().trim().min(1).optional()
 }).strict();
 var escalationDecisionOutputSchema = external_exports.object({
-  escalation_id: uuidSchema20,
+  escalation_id: uuidSchema22,
   status: escalationStatusSchema,
-  decision_id: uuidSchema20,
-  decided_by: uuidSchema20,
-  issue_id: uuidSchema20.nullable(),
+  decision_id: uuidSchema22,
+  decided_by: uuidSchema22,
+  issue_id: uuidSchema22.nullable(),
   // DER-1478: true when the resolved escalation carries a durable replay_action
   // (an approval-gated connector write) that the approvals path should actuate
   // after this decision is recorded. Omitted (not false) for non-connector
@@ -47010,7 +47132,7 @@ var workDetailsSchemas = {
 };
 
 // ../../packages/protocol/src/agent-grant-intervention.ts
-var uuidSchema21 = external_exports.string().uuid();
+var uuidSchema23 = external_exports.string().uuid();
 var agentGrantBlockerKindSchema = external_exports.enum([
   "rost_capability",
   "os_permission",
@@ -47027,16 +47149,16 @@ var agentGrantInterventionStatusSchema = external_exports.enum([
 ]);
 var agentGrantKindSchema = external_exports.enum(["allow_once", "permanent"]);
 var agentGrantInterventionSchema = external_exports.object({
-  id: uuidSchema21,
-  seat_id: uuidSchema21,
+  id: uuidSchema23,
+  seat_id: uuidSchema23,
   seat_name: external_exports.string().nullable(),
-  agent_id: uuidSchema21.nullable(),
+  agent_id: uuidSchema23.nullable(),
   // The source blocked attempt (audit link); null once the run is retention-purged.
-  run_id: uuidSchema21.nullable(),
+  run_id: uuidSchema23.nullable(),
   // The runner the blocker lives on, for os_permission repairs ("Open on Runner").
-  runner_id: uuidSchema21.nullable(),
+  runner_id: uuidSchema23.nullable(),
   // The linked continuation attempt, populated when a continuation is enqueued.
-  continuation_run_id: uuidSchema21.nullable(),
+  continuation_run_id: uuidSchema23.nullable(),
   blocker_kind: agentGrantBlockerKindSchema,
   status: agentGrantInterventionStatusSchema,
   // The specific capability/scope requested (e.g. "gmail.send"), when applicable.
@@ -47051,7 +47173,7 @@ var agentGrantInterventionSchema = external_exports.object({
   // True once the blocked attempt released its lease/compute (AC #2 clean termination).
   compute_released: external_exports.boolean(),
   grant_kind: agentGrantKindSchema.nullable(),
-  decided_by: uuidSchema21.nullable(),
+  decided_by: uuidSchema23.nullable(),
   decided_by_name: external_exports.string().nullable(),
   decided_at: external_exports.string().nullable(),
   expires_at: external_exports.string().nullable(),
@@ -47060,7 +47182,7 @@ var agentGrantInterventionSchema = external_exports.object({
 }).strict();
 var agentGrantInterventionListInputSchema = external_exports.object({
   // Optional seat filter (a seat-scoped caller is additionally clamped to its own seat).
-  seat_id: uuidSchema21.optional(),
+  seat_id: uuidSchema23.optional(),
   // When true, include decided/terminal records (declined/resumed/expired) too;
   // by default only the actionable open blocked/granted records are returned.
   include_decided: external_exports.boolean().optional()
@@ -47069,14 +47191,14 @@ var agentGrantInterventionListOutputSchema = external_exports.object({
   interventions: external_exports.array(agentGrantInterventionSchema)
 }).strict();
 var agentGrantInterventionGetInputSchema = external_exports.object({
-  id: uuidSchema21
+  id: uuidSchema23
 }).strict();
 var agentGrantInterventionGetOutputSchema = external_exports.object({
   intervention: agentGrantInterventionSchema
 }).strict();
 var agentGrantInterventionDecideActionSchema = external_exports.enum(["grant", "decline"]);
 var agentGrantInterventionDecideInputSchema = external_exports.object({
-  intervention_id: uuidSchema21,
+  intervention_id: uuidSchema23,
   action: agentGrantInterventionDecideActionSchema,
   // Defaults to allow_once. `permanent` never auto-widens — it returns
   // requires_charter_resign so the surface routes the human to a Charter re-sign.
@@ -47088,12 +47210,12 @@ var agentGrantInterventionDecideInputSchema = external_exports.object({
   rationale: external_exports.string().trim().min(1).max(2e3).optional()
 }).strict();
 var agentGrantInterventionDecideOutputSchema = external_exports.object({
-  intervention_id: uuidSchema21,
+  intervention_id: uuidSchema23,
   status: agentGrantInterventionStatusSchema,
-  continuation_run_id: uuidSchema21.nullable(),
+  continuation_run_id: uuidSchema23.nullable(),
   // The human decision row written for a grant/decline (invariant #7). Null only
   // when a permanent grant deferred to a Charter re-sign (no one-time decision made).
-  decision_id: uuidSchema21.nullable(),
+  decision_id: uuidSchema23.nullable(),
   // True when the human chose the permanent option — the surface must route to a
   // Charter re-sign; no authority was widened by this call (invariant #10).
   requires_charter_resign: external_exports.boolean(),
@@ -47107,12 +47229,12 @@ var agentGrantInterventionDecideOutputSchema = external_exports.object({
   enqueue_failed: external_exports.boolean()
 }).strict();
 var agentGrantInterventionResumeInputSchema = external_exports.object({
-  intervention_id: uuidSchema21
+  intervention_id: uuidSchema23
 }).strict();
 var agentGrantInterventionResumeOutputSchema = external_exports.object({
-  intervention_id: uuidSchema21,
+  intervention_id: uuidSchema23,
   status: agentGrantInterventionStatusSchema,
-  continuation_run_id: uuidSchema21.nullable(),
+  continuation_run_id: uuidSchema23.nullable(),
   enqueue_failed: external_exports.boolean()
 }).strict();
 
@@ -47130,7 +47252,7 @@ var eventTypes = [
   "task"
 ];
 var publicMessageTypes = ["status", "handoff", "escalation", "issue"];
-var uuidSchema22 = external_exports.string().uuid();
+var uuidSchema24 = external_exports.string().uuid();
 var evidenceSchema2 = external_exports.array(external_exports.unknown());
 var internalEventPayloadSchema = external_exports.record(external_exports.string(), external_exports.unknown()).refine((payload) => !Array.isArray(payload), "Internal event payload must be an object");
 var handoffEventPayloadSchema = external_exports.object({
@@ -47140,24 +47262,24 @@ var handoffEventPayloadSchema = external_exports.object({
     acceptance_criteria: external_exports.array(external_exports.string().min(1)),
     due: external_exports.string().datetime({ offset: true })
   }).strict(),
-  to_seat_id: uuidSchema22
+  to_seat_id: uuidSchema24
 }).strict();
 var intakeEventPayloadSchema = external_exports.discriminatedUnion("action", [
   external_exports.object({
     action: external_exports.literal("uploaded"),
-    document_id: uuidSchema22,
+    document_id: uuidSchema24,
     storage_ref: external_exports.string().min(1)
   }).strict(),
   external_exports.object({
     action: external_exports.literal("parsed"),
-    document_id: uuidSchema22,
+    document_id: uuidSchema24,
     mode: external_exports.enum(["source_tree", "function_first"]),
     seat_count: external_exports.number().int().nonnegative(),
     edge_count: external_exports.number().int().nonnegative()
   }).strict(),
   external_exports.object({
     action: external_exports.literal("failed"),
-    document_id: uuidSchema22,
+    document_id: uuidSchema24,
     reason: external_exports.string().min(1)
   }).strict(),
   external_exports.object({
@@ -47263,9 +47385,9 @@ var publicMessageTypeSchema = external_exports.enum(publicMessageTypes);
 var eventEnvelopeBaseSchema = external_exports.object({
   protocol: external_exports.literal(EVENT_PROTOCOL),
   type: eventTypeSchema,
-  seat_id: uuidSchema22.nullable(),
+  seat_id: uuidSchema24.nullable(),
   occurred_at: external_exports.string().datetime({ offset: true }),
-  goal_ancestry: external_exports.array(uuidSchema22)
+  goal_ancestry: external_exports.array(uuidSchema24)
 }).strict();
 var statusEventEnvelopeSchema = eventEnvelopeBaseSchema.extend({
   type: external_exports.literal("status"),
@@ -47289,7 +47411,7 @@ var intakeEventEnvelopeSchema = eventEnvelopeBaseSchema.extend({
 }).strict();
 var internalEventEnvelopeSchema = eventEnvelopeBaseSchema.extend({
   type: external_exports.enum(["decision", "provisioning", "system", "charter", "task"]),
-  payload: internalEventPayloadSchema
+  payload: internalEventWriterPayloadSchema
 }).strict();
 var eventEnvelopeSchema = external_exports.discriminatedUnion("type", [
   statusEventEnvelopeSchema,
@@ -47695,7 +47817,7 @@ Treat AICOS as a coordinator over the operating system. It can become more usefu
     order: 20,
     title: "Responsibility Graph playbook",
     summary: "How to build a functions-first graph with seats, owners, Stewards, vacancies, and clean authority.",
-    version: "2026-07-14.2",
+    version: "2026-07-18.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["graph_design", "staffing"],
@@ -47784,7 +47906,7 @@ Agent creation at \`/agents/new\` begins with four doors: **Describe the job** o
 
 ## Review an agent seat's delivered work
 
-Agent seat pages show the operator-facing output trail, not just low-level run telemetry. The completed work area combines explicit \`agent_deliverables\`, successful \`work.log\` evidence, and recent successful run summaries into one readable list. Each item shows what was delivered, when it happened, what kind of work it was, and safe evidence links labelled as internal, Linear, GitHub, or external. Secret-shaped values are redacted before display, and run or task context is shown only when it belongs to the same seat. Forge artifact batches can also carry a metadata-only integrity verdict so duplicate hashes, zero-byte files, size outliers, and manifest count mismatches are visible without exposing file contents.
+Agent seat pages show the operator-facing output trail, not just low-level run telemetry. The completed work area combines explicit \`agent_deliverables\`, successful \`work.log\` evidence, and recent successful run summaries into one readable list. Each item shows what was delivered, when it happened, what kind of work it was, and safe evidence links labelled as internal, Linear, GitHub, or external. Secret-shaped values are redacted before display, and run or task context is shown only when it belongs to the same seat. Forge artifact batches can also carry a metadata-only integrity verdict so duplicate hashes, zero-byte files, size outliers, and manifest count mismatches are visible without exposing file contents. Each recorded deliverable also carries a status badge \u2014 awaiting decision, accepted, or rejected \u2014 and its accepted USD value once one is recorded; a still-undecided deliverable links through to \`/approvals\` to accept or reject it there, since this tab is read-only status, not the decision surface. Run-derived (not yet explicitly recorded) items always read as awaiting decision and never link to \`/approvals\`, since there is no deliverable there yet to decide on.
 
 The **Activity** tab layers a curated business-activity narrative above the Trust Card's forensic execution trace: period-scoped counter tiles (today, this week, or 30 days) summarise the seat's \`work.record\` activity by kind \u2014 a "held for your approval" tile is always shown, and an operator can pick which other kinds appear via a per-seat, browser-local tile picker. Below the tiles, a run-grouped activity feed lists each \`work.list\` record \u2014 verb, object, outcome, evidence link, and time \u2014 with a drill-down for entity refs, the \`template_ref\` used for external comms when one was recorded, and the raw structured details. A sessions browser lists the seat's runs and, for the selected one, its persisted transcript (\`session_transcripts\`) and artifacts rail: binary artifacts (Supabase Storage) get a freshly minted 60-second signed download link at render time, pointer artifacts (Gmail draft, Drive doc, PR, or an internal reference) link out when an external URL is known. The task queue and Trust Card below are unchanged. All of this sits behind the same sensitive-data access gate as the Trust Card; a restricted viewer sees an explicit unavailable state, never a guessed empty feed. The \`/agents\` fleet page mirrors the same row grammar in a tenant-wide **Work** view \u2014 every seat's activity in one filterable stream, each row linking back to that seat's Activity tab with the originating session focused.
 
@@ -48521,7 +48643,7 @@ External connectors are being rolled out provider by provider, conservatively (r
     order: 48,
     title: "CLI and MCP installation guide",
     summary: "Install the public CLI, register remote token-backed MCP clients, and find the full command and tool catalog.",
-    version: "2026-07-18.1",
+    version: "2026-07-18.3",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -49184,6 +49306,8 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_rename_company\` | \`tenant.rename\` | Rename the current company. | Tenant-admin | Call with \`company_name\`; expect human confirmation. |
 | \`rost_get_sync_brief_scope\` | \`settings.sync_brief_scope.get\` | Read the tenant's Sync Brief scope (company_wide or per_cluster). | Tenant | Call with \`{}\`. |
 | \`rost_update_sync_brief_scope\` | \`settings.sync_brief_scope.update\` | Set the tenant's Sync Brief scope (company_wide or per_cluster). | Tenant-admin | Owner-only; call with \`{"sync_brief_scope":"company_wide"}\` or \`{"sync_brief_scope":"per_cluster"}\`. |
+| \`rost_get_member_visibility_mode\` | \`settings.member_visibility.get\` | Read the tenant's member visibility mode (all or seat_subtree). | Tenant | Call with \`{}\`. |
+| \`rost_update_member_visibility_mode\` | \`settings.member_visibility.update\` | Set the tenant's member visibility mode (all or seat_subtree). | Tenant-admin | Owner-only; call with \`{"member_visibility_mode":"all"}\` or \`{"member_visibility_mode":"seat_subtree"}\`. |
 | \`rost_get_product_learning_policy\` | \`settings.product_learning.get\` | Read whether product/page/recommendation analytics are allowed. | Tenant | Call with \`{}\`; audit/security logs are always enabled. |
 | \`rost_update_product_learning_policy\` | \`settings.product_learning.update\` | Set product-learning mode. | Tenant-admin | Human-gated; call with \`{"mode":"enabled"}\`, \`{"mode":"disabled"}\`, or \`{"mode":"enterprise_contract"}\`. |
 | \`rost_get_company_autonomy_ceiling\` | \`settings.agent_policy.get\` | Read the company autonomy ceiling (Company Guardrails): profile, enforcement, and max_autonomous_risk. | Tenant | Call with \`{}\`; metadata only. |
@@ -49357,6 +49481,7 @@ Seat-scoped MCP tokens expose the operating protocol below. The server still che
 | \`rost_file_issue\` | \`friction.file_issue\` | File a Friction issue. | Seat | Call with title, severity, and impact. Agent/scheduled producers may pass an optional \`source_key\` for deterministic idempotency \u2014 a repeat filing with the same key returns the existing open issue with \`already_filed:true\` and creates nothing new. |
 | \`rost_log_work\` | \`work.log\` | Record a lightweight free-text work breadcrumb for the seat. For structured, per-entity, queryable business activity (a client might ask "which ones?"), use \`rost_record_work\` instead. | Seat | Call with summary and evidence. |
 | \`rost_report_a_signal_reading\` | \`signal.report\` | Propose one draft reading for this seat's own agent-sourced measurable. The reading lands unconfirmed for human review. | Seat | Call with \`{"measurable_id":"<id>","value":42,"note":"read off the source","confidence":"high"}\`. |
+| \`rost_draft_first_readings_from_a_connected_source\` | \`signal.draft_first_readings\` | Pull this seat's measurable's connected source ONCE (read-only, SSRF-guarded) and land the value as a DRAFT reading for the current period, for a human to confirm. For a measurable that has a source but no confirmed reading yet. Never publishes and never fabricates a value \u2014 a non-numeric or blocked pull drafts nothing. | Seat | Call with \`{"measurable_id":"<id>"}\`. |
 | \`rost_create_agent_deliverable\` | \`deliverable.create\` | Create a scrubbed durable work output for the acting seat. | Seat | Call with title, kind, summary/content, and optional safe links. |
 | \`rost_attach_agent_deliverable\` | \`deliverable.attach\` | Attach a scrubbed deliverable to a source run, task, or work order after server-side seat validation. | Seat | Call with title, kind, and the source ids that belong to the acting seat. |
 | \`rost_record_work\` | \`work.record\` | Append structured business-activity records to the seat's append-only work ledger, in a batch, right after each action succeeds. Prefer this over \`rost_log_work\` for durable, per-entity, queryable activity (verb + entity ref + outcome + evidence). Secret-redacted; idempotent on \`dedup_key\`; corrections are superseding records. | Seat | Call with \`{"records":[{"verb":"contacted","object":{"kind":"supplier","external_id":"sup_42","label":"Acme Foods"},"summary":"Emailed Acme for a monk fruit quote.","dedup_key":"gmail:msg-abc"}]}\`. |
@@ -49931,7 +50056,7 @@ Agents can suggest commitments and report progress. They should not create a new
     order: 61,
     title: "Signal guide",
     summary: "How to define and read measurables so the company runs on evidence instead of status theater.",
-    version: "2026-07-12.1",
+    version: "2026-07-18.3",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["operating_rhythm"],
@@ -49944,6 +50069,7 @@ Agents can suggest commitments and report progress. They should not create a new
       "signal.confirm_reading",
       "signal.correct_reading",
       "signal.report",
+      "signal.draft_first_readings",
       "measurable.create",
       "signal.import",
       "measurable_template.list",
@@ -49989,6 +50115,7 @@ Avoid vanity numbers, manual-only status fields, and metrics nobody can act on.
 - Add a measurable: \`measurable.create\` (scope: seat) defines a measurable a seat owns \u2014 name, unit, direction, target, cadence. The seat owns it; readings attach to it afterward.
 - Record a reading: \`{{cli}} status record --measurable-id <id> --value <n>\` (\`status.record\`, scope: seat) writes a status event with the reading. This is not gated. An agent's \`status.record\` never downgrades a human-confirmed reading: a routine agent read that lands on a period a human already confirmed leaves the confirmed value and its confirmation intact (invariants #7/#8 \u2014 agents recommend; humans decide).
 - Confirm a reading: \`{{cli}} signal confirm\` / \`signal.confirm_reading\` / \`rost_confirm_signal_reading\` marks a reading human-verified. \`signal.correct_reading\` / \`rost_correct_signal_reading\` overwrites a reading with a human-confirmed value.
+- Draft first readings from a connected source: \`signal.draft_first_readings\` pulls a measurable's bound source once (read-only, SSRF-guarded \u2014 the same pull path as \`signal.preview\`) and lands the value as a DRAFT reading for the current period, for a human to confirm. It is for a measurable that has a connected source but no confirmed reading yet: the Signal page shows a "Draft first readings" button on those rows so the row stops being a permanent blank. Nothing is published \u2014 a human clears the draft with \`signal.confirm_reading\` (invariant #7) \u2014 and it never fabricates a value: a non-numeric or blocked pull drafts nothing and says so.
 
 ## Run Signal without an agent
 
@@ -50394,7 +50521,7 @@ Do not claim that a live charge happened unless Stripe test/live evidence proves
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
-    relatedCommandIds: ["onboarding.create_invite", "mcp_token.create", "mcp_token.revoke", "mcp_token.list", "integration.list", "integration.readiness", "integration.status", "integration.test", "settings.get", "settings.update", "tenant.rename", "settings.sync_brief_scope.get", "settings.sync_brief_scope.update", "settings.product_learning.get", "settings.product_learning.update", "settings.agent_policy.get", "settings.agent_policy.update", "settings.confirmation_policy.get", "settings.confirmation_policy.update", "tenant.model_gateway_policy.update", "aicos.brain_settings.get", "aicos.brain_settings.update"],
+    relatedCommandIds: ["onboarding.create_invite", "mcp_token.create", "mcp_token.revoke", "mcp_token.list", "integration.list", "integration.readiness", "integration.status", "integration.test", "settings.get", "settings.update", "tenant.rename", "settings.sync_brief_scope.get", "settings.sync_brief_scope.update", "settings.member_visibility.get", "settings.member_visibility.update", "settings.product_learning.get", "settings.product_learning.update", "settings.agent_policy.get", "settings.agent_policy.update", "settings.confirmation_policy.get", "settings.confirmation_policy.update", "tenant.model_gateway_policy.update", "aicos.brain_settings.get", "aicos.brain_settings.update"],
     legal: { publicRisk: "low", notes: ["{{brand}}-native settings guidance."] },
     sources: [
       {
@@ -50512,7 +50639,7 @@ Agents may explain which setting is needed and why. They should not ask users to
     order: 73,
     title: "Members and invites guide",
     summary: "How to invite humans into the company without confusing user access with seat accountability.",
-    version: "2026-07-03.2",
+    version: "2026-07-18.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -50537,7 +50664,7 @@ Invite the person as a tenant member. Then assign them to one or more seats only
 
 Tenant roles control app access. Seats control operating accountability. Do not attach goals, tasks, or measurables directly to a user when the work belongs to a seat.
 
-Owners and admins can invite people and manage member roles. Use \`external_implementer\` plus setup-limited access for a temporary implementation partner helping configure onboarding, Responsibility Graph, Compass, Charters, and agent setup. Setup-limited access is intentionally not enough for sensitive operating surfaces: Settings member/invite/token/runner/credential metadata, run and tool-call history, runner diagnostics, integration metadata and tests, system health, Signal operating data, and owner/operating pages require owner/admin or full setup access. Do not grant external implementers sensitive run history, hidden tool arguments, credentials, Memory, or company-operating data unless an owner explicitly expands their profile.
+Owners and admins can invite people and manage member roles. Use \`external_implementer\` plus setup-limited access for a temporary implementation partner helping configure onboarding, Responsibility Graph, Compass, Charters, and agent setup. Setup-limited access is intentionally not enough for sensitive operating surfaces: Settings member/invite/token/runner/credential metadata, run and tool-call history, runner diagnostics, integration metadata and tests, system health, and owner/operating pages require owner/admin or full setup access. Scorecard (Signal) and Issues (Friction) reads are the exception: every active member can open them, scoped by the tenant member-visibility mode \u2014 either every member sees all Signals and Frictions, or each member sees only the seats they occupy plus everything downstream. Write actions on those pages stay role-gated. Do not grant external implementers sensitive run history, hidden tool arguments, credentials, Memory, or company-operating data unless an owner explicitly expands their profile.
 
 ## Working across several client companies
 
@@ -52727,6 +52854,8 @@ var COMMAND_MANIFEST = [
   { "id": "settings.confirmation_policy.get", "namespace": "settings", "action": "confirmation_policy.get", "title": "Get CLI confirmation mode", "description": "Read this company's CLI confirmation mode (DER-1490): careful (the strict default \u2014 the CLI cannot silently auto-approve a confirmation) or trusted_operator (an owner opt-in permitting silent auto-approval of non-dangerous confirmations). Returns metadata only.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "Read this company's CLI confirmation mode: careful (the strict default \u2014 the CLI cannot silently auto-approve a confirmation) or trusted_operator (an owner opt-in permitting silent auto-approval of non-dangerous confirmations)." },
   { "id": "settings.confirmation_policy.update", "namespace": "settings", "action": "confirmation_policy.update", "title": "Set CLI confirmation mode", "description": "Set this company's CLI confirmation mode (DER-1490): careful (strict \u2014 no silent CLI auto-approval) or trusted_operator (owner opt-in permitting silent auto-approval of non-dangerous confirmations; dangerous confirmations always require an interactive review). Owner-only and human-gated: choosing trusted_operator establishes an ADR-0018 \xA76 standing authorization.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "cli_mode", "flag": "cli-mode", "type": "enum", "required": true, "enumValues": ["trusted_operator", "careful"] }], "hasComplexInput": false, "help": "Set the CLI confirmation mode to careful or trusted_operator. Owner-only and human-gated; trusted_operator establishes a standing authorization and dangerous confirmations still require an interactive review." },
   { "id": "settings.get", "namespace": "settings", "action": "get", "title": "Get tenant settings", "description": "Read tenant operating settings: plan, status, spend/budgets, integration status, and notification preferences. Returns metadata only.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "Read tenant operating settings: plan, spend, budgets, integration status, and notification preferences. No secrets." },
+  { "id": "settings.member_visibility.get", "namespace": "settings", "action": "member_visibility.get", "title": "Get member visibility mode", "description": "Read the tenant's member visibility mode: all (every member sees all Signals/Frictions) or seat_subtree (a member sees only their occupied seats plus downstream seats).", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "Read whether members see all Signals/Frictions tenant-wide (all) or only their occupied seats plus downstream seats (seat_subtree)." },
+  { "id": "settings.member_visibility.update", "namespace": "settings", "action": "member_visibility.update", "title": "Update member visibility mode", "description": "Set the tenant's member visibility mode (all or seat_subtree). Governs how non-owner members see Signals (Scorecard) and Frictions (Issues); write actions stay role-gated.", "requiredScope": "tenant_admin", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "member_visibility_mode", "flag": "member-visibility-mode", "type": "enum", "required": true, "enumValues": ["all", "seat_subtree"] }], "hasComplexInput": false, "help": "Set member visibility to all or seat_subtree; owner-only. Governs how non-owner members see the Scorecard and Issues; write actions stay role-gated." },
   { "id": "settings.product_learning.get", "namespace": "settings", "action": "product_learning.get", "title": "Get product-learning policy", "description": "Read whether product/page/recommendation analytics may be recorded for this tenant. Security and audit logs remain enabled in every mode.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "Read whether product/page/recommendation analytics are allowed for the tenant; security and audit logs always stay enabled." },
   { "id": "settings.product_learning.update", "namespace": "settings", "action": "product_learning.update", "title": "Update product-learning policy", "description": "Set tenant product-learning participation. Disabled and enterprise-contract modes block generic product analytics writes, but not security/audit logs.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "mode", "flag": "mode", "type": "enum", "required": true, "enumValues": ["enabled", "disabled", "enterprise_contract"] }], "hasComplexInput": false, "help": "Set tenant product-learning mode to enabled, disabled, or enterprise_contract; the change is human-gated." },
   { "id": "settings.sync_brief_scope.get", "namespace": "settings", "action": "sync_brief_scope.get", "title": "Get Sync Brief scope", "description": "Read the tenant's Sync Brief scope: company_wide (one weekly brief) or per_cluster (one brief per cluster).", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "Read whether weekly Sync Briefs compile company-wide (one brief) or per cluster (one brief per cluster)." },
@@ -52738,6 +52867,7 @@ var COMMAND_MANIFEST = [
   { "id": "signal.bind_confirm", "namespace": "signal", "action": "bind_confirm", "title": "Confirm and activate a signal binding", "description": "Human-only activation of a draft signal binding (draft \u2192 active). Agents can never self-activate \u2014 an agent caller produces a pending confirmation. A drives_status binding requires a second-anchor confirmation. Once active, the scheduled pull auto-fills the measurable.", "requiredScope": "tenant", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "binding_id", "flag": "binding-id", "type": "string", "required": true }], "hasComplexInput": true, "help": "Human-only: activate a draft signal binding (draft -> active) so scheduled pulls begin; an agent that calls it produces a pending confirmation." },
   { "id": "signal.confirm_reading", "namespace": "signal", "action": "confirm_reading", "title": "Confirm Signal reading", "description": "Confirm an unconfirmed reading as human-verified. Humans confirm; agents cannot. Idempotent on an already-confirmed reading.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "reading_id", "flag": "reading-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Confirm an unconfirmed reading as human-verified; confirmation is a human act, not an agent one." },
   { "id": "signal.correct_reading", "namespace": "signal", "action": "correct_reading", "title": "Correct Signal reading", "description": "Overwrite a reading for a period with a human-confirmed value. A manual correction is a human decision and is gated behind confirmation.", "requiredScope": "seat", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "measurable_id", "flag": "measurable-id", "type": "string", "required": true }, { "name": "period_start", "flag": "period-start", "type": "string", "required": true }, { "name": "value", "flag": "value", "type": "number", "required": true }], "hasComplexInput": false, "help": "Correct a reading only as a human; manual corrections that change confirmed data require confirmation." },
+  { "id": "signal.draft_first_readings", "namespace": "signal", "action": "draft_first_readings", "title": "Draft first readings from a connected source", "description": "Pull a measurable's connected source ONCE (read-only, SSRF-guarded) and land the value as a DRAFT reading for the current period, for a human to confirm. For a measurable that has a source but no confirmed reading yet. Never publishes a reading and never fabricates a value \u2014 a non-numeric or blocked pull drafts nothing.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "measurable_id", "flag": "measurable-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Pull a measurable's connected source once (read-only, SSRF-guarded) and land the value as a DRAFT reading for the current period, for a human to confirm with signal.confirm_reading. For a measurable that has a source but no confirmed reading yet. Never publishes and never fabricates a value \u2014 a non-numeric or blocked pull drafts nothing.", "example": { "measurable_id": "01900001-0001-7001-8001-000000000001" } },
   { "id": "signal.get", "namespace": "signal", "action": "get", "title": "Get Signal", "description": "Return a measurable definition with its full reading history (confirmed and unconfirmed).", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "measurable_id", "flag": "measurable-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Read a measurable's full reading history before confirming or correcting a value." },
   { "id": "signal.import", "namespace": "signal", "action": "import", "title": "Import Signals from CSV", "description": "Bulk-import measurable definitions and their historical readings from a parsed scorecard export (e.g. a ninety CSV). Owners are seat names resolved to seats; readings are human-confirmed. Idempotent \u2014 re-import upserts by (measurable, period, cadence). Re-importing a measurable at a different cadence is rejected, not overwritten.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "dry_run", "flag": "dry-run", "type": "boolean", "required": false }], "hasComplexInput": true, "help": "Bulk-import measurables + historical readings from a parsed scorecard export (owners resolve to seats); idempotent, human-confirmed, re-import upserts by period." },
   { "id": "signal.list", "namespace": "signal", "action": "list", "title": "List Signals", "description": "List measurable definitions with their latest reading and on/off-track state. Seat-scoped callers see only their own seat.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": false }], "hasComplexInput": false, "help": "List Signals to find measurable ids and current on/off-track state before recording or correcting readings." },