@vellumai/assistant 0.8.6 → 0.8.7

package/src/runtime/routes/integrations/vercel.ts

@@ -70,10 +70,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "integrations_vercel_config_get",
     endpoint: "integrations/vercel/config",
     method: "GET",
+    policy: null,
     summary: "Get Vercel config",
     description: "Check if a Vercel API token is stored.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     responseBody: vercelConfigResponseSchema,
     handler: () => handleGetVercelConfig(),
   },
@@ -81,11 +81,11 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "integrations_vercel_config_post",
     endpoint: "integrations/vercel/config",
     method: "POST",
+    policy: null,
     summary: "Set or delete Vercel config",
     description:
       "Set or delete the Vercel API token. Action is determined by the body action field.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     requestBody: z.object({
       action: z.enum(["get", "set", "delete"]).optional(),
       apiToken: z.string().optional(),
@@ -97,10 +97,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "integrations_vercel_config_delete",
     endpoint: "integrations/vercel/config",
     method: "DELETE",
+    policy: null,
     summary: "Delete Vercel config",
     description: "Delete the stored Vercel API token.",
     tags: ["integrations"],
-    requirePolicyEnforcement: true,
     responseBody: vercelConfigResponseSchema,
     handler: () => handleDeleteVercelConfig(),
   },

package/src/runtime/routes/internal-oauth-routes.ts

@@ -10,6 +10,7 @@ import {
   consumeCallback,
   consumeCallbackError,
 } from "../../security/oauth-callback-registry.js";
+import { GATEWAY_PRINCIPALS } from "../auth/route-policy.js";
 import { BadRequestError, NotFoundError } from "./errors.js";
 import type { RouteDefinition } from "./types.js";
 
@@ -18,6 +19,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "internal_oauth_callback",
     endpoint: "internal/oauth/callback",
     method: "POST",
+    policy: {
+      requiredScopes: ["internal.write"],
+      allowedPrincipalTypes: GATEWAY_PRINCIPALS,
+    },
     summary: "Internal OAuth callback",
     description:
       "Receives forwarded OAuth callback results (code or error) from the gateway and resolves the pending callback in the runtime.",

package/src/runtime/routes/internal-twilio-routes.ts

@@ -10,6 +10,7 @@ import {
   handleInternalStatusCallback,
   handleInternalVoiceWebhook,
 } from "../../calls/twilio-routes.js";
+import { GATEWAY_PRINCIPALS } from "../auth/route-policy.js";
 import type { RouteDefinition } from "./types.js";
 
 export const ROUTES: RouteDefinition[] = [
@@ -17,6 +18,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "internal_twilio_voice_webhook",
     endpoint: "internal/twilio/voice-webhook",
     method: "POST",
+    policy: {
+      requiredScopes: ["internal.write"],
+      allowedPrincipalTypes: GATEWAY_PRINCIPALS,
+    },
     summary: "Internal Twilio voice webhook",
     description:
       "Gateway-to-runtime forwarding for Twilio voice webhook. Accepts pre-parsed form params as JSON.",
@@ -27,6 +32,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "internal_twilio_status",
     endpoint: "internal/twilio/status",
     method: "POST",
+    policy: {
+      requiredScopes: ["internal.write"],
+      allowedPrincipalTypes: GATEWAY_PRINCIPALS,
+    },
     summary: "Internal Twilio status callback",
     description:
       "Gateway-to-runtime forwarding for Twilio call status updates. Accepts pre-parsed form params as JSON.",
@@ -37,6 +46,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "internal_twilio_connect_action",
     endpoint: "internal/twilio/connect-action",
     method: "POST",
+    policy: {
+      requiredScopes: ["internal.write"],
+      allowedPrincipalTypes: GATEWAY_PRINCIPALS,
+    },
     summary: "Internal Twilio connect-action",
     description:
       "Gateway-to-runtime forwarding for ConversationRelay connect-action callback.",

package/src/runtime/routes/llm-call-sites-routes.ts

@@ -1,3 +1,5 @@
+import { z } from "zod";
+
 import { resolveDefaultProfileKey } from "../../config/llm-resolver.js";
 import { loadConfig } from "../../config/loader.js";
 import {
@@ -5,8 +7,27 @@ import {
   CALL_SITE_DOMAINS,
 } from "../../config/schemas/call-site-catalog.js";
 import type { LLMCallSite } from "../../config/schemas/llm.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import type { RouteDefinition } from "./types.js";
 
+const callSiteDomainSchema = z.object({
+  id: z.string(),
+  displayName: z.string(),
+});
+
+const callSiteEntrySchema = z.object({
+  id: z.string(),
+  displayName: z.string(),
+  description: z.string(),
+  domain: z.string(),
+  defaultProfile: z.string().optional(),
+});
+
+const callSiteCatalogResponseSchema = z.object({
+  domains: z.array(callSiteDomainSchema),
+  callSites: z.array(callSiteEntrySchema),
+});
+
 async function handleGetCallSites() {
   const { llm } = loadConfig();
   return {
@@ -18,12 +39,16 @@ async function handleGetCallSites() {
   };
 }
 
-export interface LlmProfilesListResult {
+const llmProfilesListResponseSchema = z.object({
   /** Sorted list of profile names defined in `llm.profiles`. */
-  profiles: string[];
+  profiles: z.array(z.string()),
   /** The workspace-wide active profile name, if one is set. */
-  activeProfile: string | null;
-}
+  activeProfile: z.string().nullable(),
+});
+
+export type LlmProfilesListResult = z.infer<
+  typeof llmProfilesListResponseSchema
+>;
 
 async function handleListProfiles(): Promise<LlmProfilesListResult> {
   const { llm } = loadConfig();
@@ -39,21 +64,31 @@ export const ROUTES: RouteDefinition[] = [
   {
     operationId: "llm_call_sites_list",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     endpoint: "config/llm/call-sites",
     handler: handleGetCallSites,
     summary: "List LLM call sites",
     description:
       "Returns the full catalog of LLM call sites with display names, descriptions, and domain groupings. Used by clients to render the per-call-site override settings UI.",
     tags: ["config"],
+    responseBody: callSiteCatalogResponseSchema,
   },
   {
     operationId: "llm_profiles_list",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     endpoint: "config/llm/profiles",
     handler: handleListProfiles,
     summary: "List defined LLM profiles",
     description:
       "Returns the sorted list of profile names defined in `llm.profiles` plus the workspace-wide active profile. Used to populate per-call profile dropdowns (e.g. memory router playground) without requiring the caller to type profile names.",
     tags: ["config"],
+    responseBody: llmProfilesListResponseSchema,
   },
 ];

package/src/runtime/routes/log-export-routes.ts

@@ -37,6 +37,7 @@ import {
 } from "../../util/platform.js";
 import { APP_VERSION, COMMIT_SHA } from "../../version.js";
 import { assistantEventHub } from "../assistant-event-hub.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import { createTarGz } from "./archive-utils.js";
 import { InternalError } from "./errors.js";
 import { collectWorkspaceData } from "./log-export/workspace-allowlist.js";
@@ -221,7 +222,9 @@ async function handleExport({
       }
     }
 
-    // --- Daemon log grep for conversationId ---
+    // --- Conversation-scoped daemon log slice ---
+    // Write a `conversation-filtered.jsonl` slice of the lines that mention the
+    // conversationId as a quick index into the full daily logs.
     if (conversationId && collectedLogFiles.length > 0) {
       const matchingLines: string[] = [];
       for (const logFile of collectedLogFiles) {
@@ -244,13 +247,22 @@ async function handleExport({
         );
       }
 
-      for (const logFile of collectedLogFiles) {
-        try {
-          rmSync(logFile, { force: true });
-        } catch {
-          // Best-effort removal
-        }
-      }
+      // We intentionally retain the full daily `assistant-*.log` and
+      // `daemon-stderr.log` files rather than removing them here. Agent-loop
+      // failures — stream aborts, stack traces, provider errors — are routinely
+      // logged without the conversationId, so the grep above drops exactly the
+      // lines needed to debug a failed turn. We cannot currently guarantee that
+      // every log line emitted while handling a conversation carries its
+      // conversationId; until we can, the full daily log must stay in the
+      // bundle. Re-enable the removal below only once that guarantee holds.
+      //
+      // for (const logFile of collectedLogFiles) {
+      //   try {
+      //     rmSync(logFile, { force: true });
+      //   } catch {
+      //     // Best-effort removal
+      //   }
+      // }
     }
 
     // --- Workspace allowlist ---
@@ -486,7 +498,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "export_logs",
     endpoint: "export",
     method: "POST",
-    policyKey: "export",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleExport,
     summary: "Export logs and audit data",
     description:
@@ -507,7 +522,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "export_logs_alias",
     endpoint: "logs/export",
     method: "POST",
-    policyKey: "export",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleExport,
     summary: "Export logs and audit data (alias)",
     description:

package/src/runtime/routes/mcp-auth-routes.ts

@@ -20,6 +20,7 @@ import { orchestrateMcpOAuthConnect } from "../../mcp/mcp-auth-orchestrator.js";
 import { getMcpAuthState } from "../../mcp/mcp-auth-state.js";
 import { deleteMcpOAuthCredentials } from "../../mcp/mcp-oauth-provider.js";
 import { getLogger } from "../../util/logger.js";
+import { GATEWAY_PRINCIPALS } from "../auth/route-policy.js";
 import { BadRequestError, InternalError, NotFoundError } from "./errors.js";
 import type { RouteDefinition } from "./types.js";
 
@@ -332,6 +333,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "internal_mcp_auth_start",
     endpoint: "internal/mcp/auth/start",
     method: "POST",
+    policy: {
+      requiredScopes: ["internal.write"],
+      allowedPrincipalTypes: GATEWAY_PRINCIPALS,
+    },
     summary: "Start MCP OAuth flow",
     description:
       "Starts a daemon-owned MCP OAuth flow and returns the authorization URL for the CLI to open in the browser.",
@@ -343,6 +348,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "internal_mcp_auth_status",
     endpoint: "internal/mcp/auth/status/:serverId",
     method: "GET",
+    policy: {
+      requiredScopes: ["internal.write"],
+      allowedPrincipalTypes: GATEWAY_PRINCIPALS,
+    },
     summary: "Poll MCP OAuth flow status",
     description:
       "Returns the current status of an in-flight MCP OAuth flow (pending/complete/error).",
@@ -357,6 +366,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "internal_mcp_reload",
     endpoint: "internal/mcp/reload",
     method: "POST",
+    policy: {
+      requiredScopes: ["internal.write"],
+      allowedPrincipalTypes: GATEWAY_PRINCIPALS,
+    },
     summary: "Trigger MCP server reload",
     description:
       "Kicks off reloadMcpServers() async on the daemon. Returns immediately.",
@@ -367,6 +380,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "internal_mcp_list",
     endpoint: "internal/mcp/list",
     method: "GET",
+    policy: {
+      requiredScopes: ["internal.write"],
+      allowedPrincipalTypes: GATEWAY_PRINCIPALS,
+    },
     summary: "List MCP servers with health status",
     description:
       "Returns configured MCP servers with live health-check results (connected, needs auth, error, disabled).",
@@ -377,6 +394,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "internal_mcp_add",
     endpoint: "internal/mcp/add",
     method: "POST",
+    policy: {
+      requiredScopes: ["internal.write"],
+      allowedPrincipalTypes: GATEWAY_PRINCIPALS,
+    },
     summary: "Add an MCP server configuration",
     description:
       "Writes a new MCP server entry to config.json and triggers a reload.",
@@ -396,6 +417,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "internal_mcp_remove",
     endpoint: "internal/mcp/remove",
     method: "POST",
+    policy: {
+      requiredScopes: ["internal.write"],
+      allowedPrincipalTypes: GATEWAY_PRINCIPALS,
+    },
     summary: "Remove an MCP server configuration",
     description:
       "Removes an MCP server from config.json, cleans up OAuth credentials, and triggers a reload.",

package/src/runtime/routes/memory-item-routes.ts

@@ -52,6 +52,7 @@ import { withQdrantBreaker } from "../../memory/qdrant-circuit-breaker.js";
 import { getQdrantClient } from "../../memory/qdrant-client.js";
 import { memoryGraphNodes } from "../../memory/schema.js";
 import { getLogger } from "../../util/logger.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import { BadRequestError, ConflictError, NotFoundError } from "./errors.js";
 import type { RouteDefinition } from "./types.js";
 
@@ -658,8 +659,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "listMemoryItems",
     endpoint: "memory-items",
     method: "GET",
-    policyKey: "memory-items",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "List memory items",
     description:
       "Return memory items with filtering, search, sorting, and pagination.",
@@ -712,8 +715,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "getMemoryItem",
     endpoint: "memory-items/:id",
     method: "GET",
-    policyKey: "memory-items",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Get a memory item",
     description: "Return a single memory item by ID with graph metadata.",
     tags: ["memory"],
@@ -730,8 +735,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "createMemoryItem",
     endpoint: "memory-items",
     method: "POST",
-    policyKey: "memory-items",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     responseStatus: "201",
     summary: "Create a memory item",
     description: "Create a new memory graph node and enqueue embedding.",
@@ -765,8 +772,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "updateMemoryItem",
     endpoint: "memory-items/:id",
     method: "PATCH",
-    policyKey: "memory-items",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Update a memory item",
     description: "Partially update fields on an existing memory graph node.",
     tags: ["memory"],
@@ -793,8 +802,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "deleteMemoryItem",
     endpoint: "memory-items/:id",
     method: "DELETE",
-    policyKey: "memory-items",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     responseStatus: "204",
     summary: "Delete a memory item",
     description: "Delete a memory graph node and its embeddings.",

package/src/runtime/routes/memory-v2-routes.ts

@@ -39,9 +39,9 @@ import {
 import { ROUTER_PROMPT } from "../../memory/v2/prompts/router.js";
 import { type RouterSource, runRouter } from "../../memory/v2/router.js";
 import { seedV2SkillEntries } from "../../memory/v2/skill-store.js";
-import { createV3Retriever } from "../../memory/v3/retriever.js";
 import { getLogger } from "../../util/logger.js";
 import { getWorkspaceDir } from "../../util/platform.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import { RouteError } from "./errors.js";
 import type { RouteDefinition } from "./types.js";
 import type { RouteHandlerArgs } from "./types.js";
@@ -397,37 +397,43 @@ const MemoryV2SimulateRouterParams = z
   })
   .strict();
 
-export interface MemoryV2SimulateRouterEffectiveConfig {
-  tier1_size: number | null;
-  tier2_size: number | null;
-  batch_size: number | null;
-  max_page_ids: number;
-}
-
-export interface MemoryV2SimulateRouterResult {
+export const MemoryV2SimulateRouterResultSchema = z.object({
   /** Slugs the router would select, in model-returned order. */
-  selectedSlugs: string[];
-  /** Per-slug provenance: `"tier1"`, `"tier2"`, or `"tier3:<bucket>"`. */
-  sourceBySlug: Record<string, RouterSource>;
+  selectedSlugs: z.array(z.string()),
+  /**
+   * Per-slug provenance keyed by slug. Each value is `"tier1"`, `"tier2"`,
+   * or `"tier3:<bucket>"` (see `RouterSource`); the wire shape is a plain
+   * string map so callers parse the tier prefix at the boundary.
+   */
+  sourceBySlug: z.record(z.string(), z.string()),
   /** EMA scores for the selected slugs (0 when the slug has no events). */
-  scores: Record<string, number>;
+  scores: z.record(z.string(), z.number()),
   /** `null` on success; otherwise one of the router failure reasons. */
-  failureReason: string | null;
+  failureReason: z.string().nullable(),
   /** The router config that actually ran (live merged with overrides). */
-  effectiveConfig: MemoryV2SimulateRouterEffectiveConfig;
+  effectiveConfig: z.object({
+    tier1_size: z.number().nullable(),
+    tier2_size: z.number().nullable(),
+    batch_size: z.number().nullable(),
+    max_page_ids: z.number(),
+  }),
   /** The overrides the caller submitted, for display. */
-  overrides: {
-    tier1_size?: number | null;
-    tier2_size?: number | null;
-    batch_size?: number | null;
-  };
+  overrides: z.object({
+    tier1_size: z.number().nullish(),
+    tier2_size: z.number().nullish(),
+    batch_size: z.number().nullish(),
+  }),
   /** Page index size the router was given (post-tier-carve, all batches). */
-  totalCandidatePages: number;
+  totalCandidatePages: z.number(),
   /** The profile name passed as a per-call override, if any. */
-  profileOverride: string | null;
+  profileOverride: z.string().nullable(),
   /** `true` when an inline `routerPromptOverride` was applied this call. */
-  routerPromptOverridden: boolean;
-}
+  routerPromptOverridden: z.boolean(),
+});
+
+export type MemoryV2SimulateRouterResult = z.infer<
+  typeof MemoryV2SimulateRouterResultSchema
+>;
 
 /**
  * Build the config the router will see by overlaying override values on top
@@ -583,10 +589,14 @@ export async function handleSimulateRouter({
 
 // ── Router prompt template (bundled default for the playground editor) ──
 
-export interface MemoryV2RouterPromptTemplateResult {
+export const MemoryV2RouterPromptTemplateResultSchema = z.object({
   /** The bundled router prompt body, placeholders intact. */
-  template: string;
-}
+  template: z.string(),
+});
+
+export type MemoryV2RouterPromptTemplateResult = z.infer<
+  typeof MemoryV2RouterPromptTemplateResultSchema
+>;
 
 async function handleGetRouterPromptTemplate(): Promise<MemoryV2RouterPromptTemplateResult> {
   requireMemoryV2Enabled();
@@ -595,10 +605,12 @@ async function handleGetRouterPromptTemplate(): Promise<MemoryV2RouterPromptTemp
 
 // ── Current `<now>` body (default value for the playground editor) ──────
 
-export interface MemoryV2NowTextResult {
+export const MemoryV2NowTextResultSchema = z.object({
   /** The current rendered NOW.md body (autoloaded essentials/threads/recent). */
-  nowText: string;
-}
+  nowText: z.string(),
+});
+
+export type MemoryV2NowTextResult = z.infer<typeof MemoryV2NowTextResultSchema>;
 
 async function handleGetNowText(): Promise<MemoryV2NowTextResult> {
   requireMemoryV2Enabled();
@@ -640,13 +652,8 @@ export async function handleCompareRetrievers({
   const db = getDb();
 
   // The router is always comparand #1 (the harness self-test against its own
-  // logged ground truth). v3 joins as comparand #2 only when explicitly
-  // enabled, so the default compare surface is unchanged until v3 is switched
-  // on. v3 is offline-only here — the loop reads `db` but mutates nothing.
+  // logged ground truth).
   const retrievers: Retriever[] = [createRouterRetriever(db)];
-  if (config.memory.v3.enabled) {
-    retrievers.push(createV3Retriever(db));
-  }
 
   return runComparisonOverHistory({
     db,
@@ -669,6 +676,10 @@ export const ROUTES: RouteDefinition[] = [
   {
     operationId: "memory_v2_backfill",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     endpoint: "memory/v2/backfill",
     handler: handleBackfill,
     summary: "Enqueue a memory v2 backfill job",
@@ -680,6 +691,10 @@ export const ROUTES: RouteDefinition[] = [
   {
     operationId: "memory_v2_validate",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     endpoint: "memory/v2/validate",
     handler: handleValidate,
     summary: "Validate memory v2 workspace state",
@@ -691,6 +706,10 @@ export const ROUTES: RouteDefinition[] = [
   {
     operationId: "memory_v2_get_concept_page",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     endpoint: "memory/v2/concept-page",
     handler: handleGetConceptPage,
     summary: "Read a single memory v2 concept page",
@@ -702,6 +721,10 @@ export const ROUTES: RouteDefinition[] = [
   {
     operationId: "memory_v2_list_concept_pages",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     endpoint: "memory/v2/list-concept-pages",
     handler: handleListConceptPages,
     summary: "List all memory v2 concept pages with metadata",
@@ -713,6 +736,10 @@ export const ROUTES: RouteDefinition[] = [
   {
     operationId: "memory_v2_reembed_skills",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     endpoint: "memory/v2/reembed-skills",
     handler: handleReembedSkills,
     summary: "Re-seed v2 skill entries from the current skill catalog",
@@ -724,6 +751,10 @@ export const ROUTES: RouteDefinition[] = [
   {
     operationId: "memory_v2_concept_frequency",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     endpoint: "memory/v2/concept-frequency",
     handler: handleConceptFrequency,
     summary: "Aggregate per-concept injection frequency from activation logs",
@@ -735,6 +766,10 @@ export const ROUTES: RouteDefinition[] = [
   {
     operationId: "memory_v2_ema_scores",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     endpoint: "memory/v2/ema-scores",
     handler: handleEmaScores,
     summary: "List every concept page with its injection-frequency EMA score",
@@ -746,6 +781,10 @@ export const ROUTES: RouteDefinition[] = [
   {
     operationId: "memory_v2_simulate_router",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     endpoint: "memory/v2/simulate-router",
     handler: handleSimulateRouter,
     summary: "Dry-run the v4 router with config overrides (read-only)",
@@ -753,10 +792,15 @@ export const ROUTES: RouteDefinition[] = [
       "Runs the memory router against the live page index + EMA scores with optional tier_size / batch_size overrides, without recording an injection event or writing an activation log. Returns the slugs that would have been selected, per-slug tier provenance, EMA scores, and the effective router config so operators can validate knob changes before flipping them in workspace config.",
     tags: ["memory"],
     requestBody: MemoryV2SimulateRouterParams,
+    responseBody: MemoryV2SimulateRouterResultSchema,
   },
   {
     operationId: "memory_v2_compare_retrievers",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     endpoint: "memory/v2/compare-retrievers",
     handler: handleCompareRetrievers,
     summary:
@@ -769,21 +813,31 @@ export const ROUTES: RouteDefinition[] = [
   {
     operationId: "memory_v2_router_prompt_template",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     endpoint: "memory/v2/router-prompt-template",
     handler: handleGetRouterPromptTemplate,
     summary: "Return the bundled router system-prompt template",
     description:
       "Returns the bundled `ROUTER_PROMPT` body with placeholders intact (`{{ASSISTANT_NAME}}`, `{{USER_NAME}}`, `{{PAGE_INDEX}}`). Used by the memory router playground's 'Load default' affordance so users have a known-good starting point when authoring an inline prompt override.",
     tags: ["memory"],
+    responseBody: MemoryV2RouterPromptTemplateResultSchema,
   },
   {
     operationId: "memory_v2_now_text",
     method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     endpoint: "memory/v2/now-text",
     handler: handleGetNowText,
     summary: "Return the current rendered `<now>` body",
     description:
       "Returns the current NOW.md (autoloaded essentials/threads/recent). Used by the memory router playground to seed its `<now>` text area with a production-like default so callers can edit from a realistic baseline.",
     tags: ["memory"],
+    responseBody: MemoryV2NowTextResultSchema,
   },
 ];