@wowok/agent-mcp 3.1.4 → 3.1.6

package/dist/schemas/onchain_operations_machine.schema.json

@@ -1250,6 +1250,14 @@
           "description": "Phase 1 dry_run: when true, SIMULATE the transaction without signing or submitting. Returns effects + events showing what WOULD happen — no on-chain state is modified, no gas is charged. Use this to verify that an operation will succeed before committing. The returned digest will be 'dry_run:<timestamp>' and objectChanges will be empty (simulation only).",
           "type": "boolean"
         },
+        "response_level": {
+          "description": "Write-success response size. 'compact' (default) trims the structured result to key fields (digest + created object references); 'full' includes the complete raw result. Default: compact.",
+          "type": "string",
+          "enum": [
+            "compact",
+            "full"
+          ]
+        },
         "confirm_mode": {
           "description": "Confirmation frequency for this call. 'full': confirm every matched gate rule. 'streamlined' (client default): skip fail-open 'standard' level prompts — fail-closed levels (irreversible/publish/amount) ALWAYS still confirm. 'quiet': same hard floor as streamlined, for clients that batch/suppress repeat low-risk prompts in their own UI. This field NEVER downgrades fail-closed levels.",
           "type": "string",

package/dist/schemas/onchain_operations_order.schema.json

@@ -108,7 +108,7 @@
           "additionalProperties": false
         },
         "arb_confirm": {
-          "description": "Submit compensation request and apply for arbitration",
+          "description": "CUSTOMER-side confirm on an Arb case (the order owner; the arbitration object's own confirm tool is the arbitrator's and rejects customers). Moves the case from state 0 to state 1. REQUIRED after an arbitrator reset — a reset returns the case to state 0 with the indemnity cleared, and only the customer can advance it again; the fee stays locked until this is called. Not the filing step: filing (dispute) lands the case directly in state 1.",
           "type": "object",
           "properties": {
             "arb": {
@@ -157,7 +157,7 @@
           "additionalProperties": false
         },
         "arb_claim_compensation": {
-          "description": "Specify the adjudicated Arb object to obtain order compensation.",
+          "description": "Specify the adjudicated Arb object to obtain order compensation. Succeeds even when the ruled indemnity is 0 — the claim closes the case (state 5) and lets the arbitrator withdraw the dispute fee immediately.",
           "type": "object",
           "properties": {
             "arb": {
@@ -374,6 +374,14 @@
           "description": "Phase 1 dry_run: when true, SIMULATE the transaction without signing or submitting. Returns effects + events showing what WOULD happen — no on-chain state is modified, no gas is charged. Use this to verify that an operation will succeed before committing. The returned digest will be 'dry_run:<timestamp>' and objectChanges will be empty (simulation only).",
           "type": "boolean"
         },
+        "response_level": {
+          "description": "Write-success response size. 'compact' (default) trims the structured result to key fields (digest + created object references); 'full' includes the complete raw result. Default: compact.",
+          "type": "string",
+          "enum": [
+            "compact",
+            "full"
+          ]
+        },
         "confirm_mode": {
           "description": "Confirmation frequency for this call. 'full': confirm every matched gate rule. 'streamlined' (client default): skip fail-open 'standard' level prompts — fail-closed levels (irreversible/publish/amount) ALWAYS still confirm. 'quiet': same hard floor as streamlined, for clients that batch/suppress repeat low-risk prompts in their own UI. This field NEVER downgrades fail-closed levels.",
           "type": "string",

package/dist/schemas/onchain_operations_payment.schema.json

@@ -264,6 +264,14 @@
           "description": "Phase 1 dry_run: when true, SIMULATE the transaction without signing or submitting. Returns effects + events showing what WOULD happen — no on-chain state is modified, no gas is charged. Use this to verify that an operation will succeed before committing. The returned digest will be 'dry_run:<timestamp>' and objectChanges will be empty (simulation only).",
           "type": "boolean"
         },
+        "response_level": {
+          "description": "Write-success response size. 'compact' (default) trims the structured result to key fields (digest + created object references); 'full' includes the complete raw result. Default: compact.",
+          "type": "string",
+          "enum": [
+            "compact",
+            "full"
+          ]
+        },
         "confirm_mode": {
           "description": "Confirmation frequency for this call. 'full': confirm every matched gate rule. 'streamlined' (client default): skip fail-open 'standard' level prompts — fail-closed levels (irreversible/publish/amount) ALWAYS still confirm. 'quiet': same hard floor as streamlined, for clients that batch/suppress repeat low-risk prompts in their own UI. This field NEVER downgrades fail-closed levels.",
           "type": "string",

package/dist/schemas/onchain_operations_permission.schema.json

@@ -858,6 +858,14 @@
           "description": "Phase 1 dry_run: when true, SIMULATE the transaction without signing or submitting. Returns effects + events showing what WOULD happen — no on-chain state is modified, no gas is charged. Use this to verify that an operation will succeed before committing. The returned digest will be 'dry_run:<timestamp>' and objectChanges will be empty (simulation only).",
           "type": "boolean"
         },
+        "response_level": {
+          "description": "Write-success response size. 'compact' (default) trims the structured result to key fields (digest + created object references); 'full' includes the complete raw result. Default: compact.",
+          "type": "string",
+          "enum": [
+            "compact",
+            "full"
+          ]
+        },
         "confirm_mode": {
           "description": "Confirmation frequency for this call. 'full': confirm every matched gate rule. 'streamlined' (client default): skip fail-open 'standard' level prompts — fail-closed levels (irreversible/publish/amount) ALWAYS still confirm. 'quiet': same hard floor as streamlined, for clients that batch/suppress repeat low-risk prompts in their own UI. This field NEVER downgrades fail-closed levels.",
           "type": "string",

package/dist/schemas/onchain_operations_personal.schema.json

@@ -969,6 +969,14 @@
           "description": "Phase 1 dry_run: when true, SIMULATE the transaction without signing or submitting. Returns effects + events showing what WOULD happen — no on-chain state is modified, no gas is charged. Use this to verify that an operation will succeed before committing. The returned digest will be 'dry_run:<timestamp>' and objectChanges will be empty (simulation only).",
           "type": "boolean"
         },
+        "response_level": {
+          "description": "Write-success response size. 'compact' (default) trims the structured result to key fields (digest + created object references); 'full' includes the complete raw result. Default: compact.",
+          "type": "string",
+          "enum": [
+            "compact",
+            "full"
+          ]
+        },
         "confirm_mode": {
           "description": "Confirmation frequency for this call. 'full': confirm every matched gate rule. 'streamlined' (client default): skip fail-open 'standard' level prompts — fail-closed levels (irreversible/publish/amount) ALWAYS still confirm. 'quiet': same hard floor as streamlined, for clients that batch/suppress repeat low-risk prompts in their own UI. This field NEVER downgrades fail-closed levels.",
           "type": "string",

package/dist/schemas/onchain_operations_progress.schema.json

@@ -390,6 +390,14 @@
           "description": "Phase 1 dry_run: when true, SIMULATE the transaction without signing or submitting. Returns effects + events showing what WOULD happen — no on-chain state is modified, no gas is charged. Use this to verify that an operation will succeed before committing. The returned digest will be 'dry_run:<timestamp>' and objectChanges will be empty (simulation only).",
           "type": "boolean"
         },
+        "response_level": {
+          "description": "Write-success response size. 'compact' (default) trims the structured result to key fields (digest + created object references); 'full' includes the complete raw result. Default: compact.",
+          "type": "string",
+          "enum": [
+            "compact",
+            "full"
+          ]
+        },
         "confirm_mode": {
           "description": "Confirmation frequency for this call. 'full': confirm every matched gate rule. 'streamlined' (client default): skip fail-open 'standard' level prompts — fail-closed levels (irreversible/publish/amount) ALWAYS still confirm. 'quiet': same hard floor as streamlined, for clients that batch/suppress repeat low-risk prompts in their own UI. This field NEVER downgrades fail-closed levels.",
           "type": "string",

package/dist/schemas/onchain_operations_proof.schema.json

@@ -174,6 +174,14 @@
           "description": "Phase 1 dry_run: when true, SIMULATE the transaction without signing or submitting. Returns effects + events showing what WOULD happen — no on-chain state is modified, no gas is charged. Use this to verify that an operation will succeed before committing. The returned digest will be 'dry_run:<timestamp>' and objectChanges will be empty (simulation only).",
           "type": "boolean"
         },
+        "response_level": {
+          "description": "Write-success response size. 'compact' (default) trims the structured result to key fields (digest + created object references); 'full' includes the complete raw result. Default: compact.",
+          "type": "string",
+          "enum": [
+            "compact",
+            "full"
+          ]
+        },
         "confirm_mode": {
           "description": "Confirmation frequency for this call. 'full': confirm every matched gate rule. 'streamlined' (client default): skip fail-open 'standard' level prompts — fail-closed levels (irreversible/publish/amount) ALWAYS still confirm. 'quiet': same hard floor as streamlined, for clients that batch/suppress repeat low-risk prompts in their own UI. This field NEVER downgrades fail-closed levels.",
           "type": "string",

package/dist/schemas/onchain_operations_repository.schema.json

@@ -144,7 +144,7 @@
                           "additionalProperties": false,
                           "description": "Guard object that needs verification when writing policy"
                         },
-                        "description": "Guard object list that can be verified when writing data. REQUIRED (non-empty) when id_from is 0/None (chain abort 22); optional when id_from is Clock/Signer."
+                        "description": "Guard object list that can be verified when writing data. REQUIRED (non-empty) when id_from is 0/None (chain abort 22); optional when id_from is Clock/Signer. ⚠️ If EMPTY for a Clock/Signer policy, ANY account can write data to this policy — the Repository's Permission is NOT consulted for data_add/data_remove in that case (an open write log; intended only for deliberately public policies such as sensor logs). Attach guards if writes must be restricted."
                       },
                       "quote_guard": {
                         "description": "Guard object ID that needs verification when referencing this policy data on-chain (e.g., verifying if user has paid subscription). If null, no verification is needed for on-chain references. The Guard must have empty 'relies' field and 'rep' field true.",
@@ -515,7 +515,7 @@
                 "policy"
               ],
               "additionalProperties": false,
-              "description": "Add or set policy rules."
+              "description": "op:'set' REPLACES THE WHOLE policy list (policies not included are deleted, and once the Permission is locked they cannot be restored) — use op:'add' to append or update individual policies without touching the others."
             },
             {
               "type": "object",
@@ -556,7 +556,7 @@
           ]
         },
         "data_add": {
-          "description": "Add data items to an ALREADY-EXISTING Repository. TWO-PHASE: if 'object' creates a NEW Repository in this same call, data_add FAILS ('Repository content not ready') — first create the Repository (one call), then add data in a follow-up call. The data_add.name must match a policy rule name defined in 'policies'.",
+          "description": "Add data items to an ALREADY-EXISTING Repository. TWO-PHASE: if 'object' creates a NEW Repository in this same call, data_add FAILS ('Repository content not ready') — first create the Repository (one call), then add data in a follow-up call. The data_add.name must match a policy rule name defined in 'policies'. SUBMISSION GUARDS: when the matched policy guard sets both id_from_submission and data_from_submission, the id AND value are read from the passport submission table — pass items:[{write_guard, data:[]}] with a 'submission' in the same call; empty items or entries that would write nothing are rejected instead of silently succeeding. See DataAddWithItemsSchema.items for worked examples per id_from mode.",
           "anyOf": [
             {
               "type": "object",
@@ -634,7 +634,7 @@
                           "additionalProperties": false,
                           "description": "Data ID and value."
                         },
-                        "description": "Data item list."
+                        "description": "Data item list. MUST be non-empty unless the matching policy guard sets BOTH id_from_submission AND data_from_submission (then pass data:[] — the id AND value are derived from the passport submission table, and any item-level id/data would be ignored). With only ONE of the two submission settings, 'data' must carry the missing side; with none, 'data' is required."
                       },
                       "write_guard": {
                         "description": "Guard ID or name. REQUIRED for data_add items when the matching policy uses id_from=None(0): it must reference one of that policy's write_guard guards, otherwise the chain aborts with 22 (E_POLICY_WRITE_GUARD_REQUIRED). Optional for Clock/Signer policies.",
@@ -647,7 +647,7 @@
                     "additionalProperties": false,
                     "description": "List of data items to write."
                   },
-                  "description": "List of data items to add. Each data item contains name, ID, and data parts, where name and ID together form the unique key for the data."
+                  "description": "List of data items to add. WORKED EXAMPLES by policy id_from mode — (a) id_from=None(0), policy has NO write guards: items:[{data:[{id:\"0x2::example::0x123...\", data:\"value\"}]}] (no write_guard). (b) id_from=None(0), policy HAS write guards without submission settings: items:[{write_guard:\"<policy guard>\", data:[{id:..., data:...}]}]. (c) id_from=None(0), policy guard sets BOTH id_from_submission AND data_from_submission: items:[{write_guard:\"<policy guard>\", data:[]}] — the id AND value come from the passport submission table (send 'submission' in the same call); item-level id/data are IGNORED for such guards and one record is written per guard. (d) id_from=Clock(1)/Signer(2): use the SignerOrClock form {name, data, write_guard?} instead — the id is derived on-chain from the transaction clock or signer; write_guard is required when the policy declares guards."
                 }
               },
               "required": [
@@ -655,7 +655,7 @@
                 "items"
               ],
               "additionalProperties": false,
-              "description": "Add data by name and data item list. Each data item contains name, ID, and data parts, where name and ID together form the unique key for the data."
+              "description": "Add data by name and data item list. Each data item contains name, ID, and data parts, where name and ID together form the unique key for the data. See 'items' for worked examples per policy id_from mode."
             }
           ]
         },
@@ -1015,6 +1015,14 @@
           "description": "Phase 1 dry_run: when true, SIMULATE the transaction without signing or submitting. Returns effects + events showing what WOULD happen — no on-chain state is modified, no gas is charged. Use this to verify that an operation will succeed before committing. The returned digest will be 'dry_run:<timestamp>' and objectChanges will be empty (simulation only).",
           "type": "boolean"
         },
+        "response_level": {
+          "description": "Write-success response size. 'compact' (default) trims the structured result to key fields (digest + created object references); 'full' includes the complete raw result. Default: compact.",
+          "type": "string",
+          "enum": [
+            "compact",
+            "full"
+          ]
+        },
         "confirm_mode": {
           "description": "Confirmation frequency for this call. 'full': confirm every matched gate rule. 'streamlined' (client default): skip fail-open 'standard' level prompts — fail-closed levels (irreversible/publish/amount) ALWAYS still confirm. 'quiet': same hard floor as streamlined, for clients that batch/suppress repeat low-risk prompts in their own UI. This field NEVER downgrades fail-closed levels.",
           "type": "string",

package/dist/schemas/onchain_operations_reward.schema.json

@@ -592,6 +592,14 @@
           "description": "Phase 1 dry_run: when true, SIMULATE the transaction without signing or submitting. Returns effects + events showing what WOULD happen — no on-chain state is modified, no gas is charged. Use this to verify that an operation will succeed before committing. The returned digest will be 'dry_run:<timestamp>' and objectChanges will be empty (simulation only).",
           "type": "boolean"
         },
+        "response_level": {
+          "description": "Write-success response size. 'compact' (default) trims the structured result to key fields (digest + created object references); 'full' includes the complete raw result. Default: compact.",
+          "type": "string",
+          "enum": [
+            "compact",
+            "full"
+          ]
+        },
         "confirm_mode": {
           "description": "Confirmation frequency for this call. 'full': confirm every matched gate rule. 'streamlined' (client default): skip fail-open 'standard' level prompts — fail-closed levels (irreversible/publish/amount) ALWAYS still confirm. 'quiet': same hard floor as streamlined, for clients that batch/suppress repeat low-risk prompts in their own UI. This field NEVER downgrades fail-closed levels.",
           "type": "string",

package/dist/schemas/onchain_operations_service.schema.json

@@ -377,7 +377,7 @@
                             "type": "string"
                           }
                         ],
-                        "description": "Stock of the product or service"
+                        "description": "Current REMAINING stock of the product or service. Each order DECREMENTS it by the ordered quantity (a buy aborts when the remaining stock is lower than the ordered quantity). Writing this field SETS the remaining stock to the given value — it is NOT added to it. To top up one product's stock without resending the whole list, there is no per-item op in this tool; re-issue sales with op:\"set\" carrying the full list and the updated stock for that product."
                       },
                       "suspension": {
                         "type": "boolean",
@@ -389,7 +389,7 @@
                       },
                       "wip_hash": {
                         "type": "string",
-                        "description": "SHA-256 hash (hex string) of the sale's WIP file, committed on-chain by the merchant. BUY RULE: if this is NON-EMPTY, the buyer MUST pass this exact value as wip_hash when creating an order (ServiceBuyItem.wip_hash) — NEVER use \"\". Pinning the on-chain hash prevents the merchant from replacing the WIP file (a legitimate update) between the buyer's view and order placement, ensuring 'what you see is what you get'. EMPTY means no hash was committed (TESTING ONLY, no delivery-integrity guarantee)."
+                        "description": "The 'meta.hash' field INSIDE the sale's WIP file (a content hash of the file's JSON payload), committed on-chain by the merchant. NOT the SHA-256 of the .wip file bytes — hashing the downloaded file (shasum -a 256) yields a DIFFERENT value and fails verification; use the hash embedded in the file's meta section (wip_file verify reports it). BUY RULE: if this is NON-EMPTY, the buyer MUST pass this exact value as wip_hash when creating an order (ServiceBuyItem.wip_hash) — NEVER use \"\". Pinning the on-chain hash prevents the merchant from replacing the WIP file (a legitimate update) between the buyer's view and order placement, ensuring 'what you see is what you get'. EMPTY means no hash was committed (TESTING ONLY, no delivery-integrity guarantee)."
                       }
                     },
                     "required": [
@@ -448,7 +448,7 @@
                             "type": "string"
                           }
                         ],
-                        "description": "Stock of the product or service"
+                        "description": "Current REMAINING stock of the product or service. Each order DECREMENTS it by the ordered quantity (a buy aborts when the remaining stock is lower than the ordered quantity). Writing this field SETS the remaining stock to the given value — it is NOT added to it. To top up one product's stock without resending the whole list, there is no per-item op in this tool; re-issue sales with op:\"set\" carrying the full list and the updated stock for that product."
                       },
                       "suspension": {
                         "type": "boolean",
@@ -460,7 +460,7 @@
                       },
                       "wip_hash": {
                         "type": "string",
-                        "description": "SHA-256 hash (hex string) of the sale's WIP file, committed on-chain by the merchant. BUY RULE: if this is NON-EMPTY, the buyer MUST pass this exact value as wip_hash when creating an order (ServiceBuyItem.wip_hash) — NEVER use \"\". Pinning the on-chain hash prevents the merchant from replacing the WIP file (a legitimate update) between the buyer's view and order placement, ensuring 'what you see is what you get'. EMPTY means no hash was committed (TESTING ONLY, no delivery-integrity guarantee)."
+                        "description": "The 'meta.hash' field INSIDE the sale's WIP file (a content hash of the file's JSON payload), committed on-chain by the merchant. NOT the SHA-256 of the .wip file bytes — hashing the downloaded file (shasum -a 256) yields a DIFFERENT value and fails verification; use the hash embedded in the file's meta section (wip_file verify reports it). BUY RULE: if this is NON-EMPTY, the buyer MUST pass this exact value as wip_hash when creating an order (ServiceBuyItem.wip_hash) — NEVER use \"\". Pinning the on-chain hash prevents the merchant from replacing the WIP file (a legitimate update) between the buyer's view and order placement, ensuring 'what you see is what you get'. EMPTY means no hash was committed (TESTING ONLY, no delivery-integrity guarantee)."
                       }
                     },
                     "required": [
@@ -481,7 +481,7 @@
                 "sales"
               ],
               "additionalProperties": false,
-              "description": "Set sales products or services."
+              "description": "Replaces the ENTIRE sales list: every product NOT included is REMOVED from the Service (its stock and wip binding go with it — there is no per-item update via this op). To change one product (e.g. its price or stock), resend the FULL list including all unchanged products. Removal is immediate and cannot be undone."
             },
             {
               "type": "object",
@@ -760,7 +760,7 @@
                 },
                 {}
               ],
-              "description": "Discount type"
+              "description": "Discount type — 0=RATES (proportional off, per-10000: e.g. 1000 means 10% off), 1=FIXED (fixed deduction of the product amount, base units: e.g. 100 means 100 deducted). Accepts the number (0/1) or the string ('RATES'/'FIXED'); the value is always stored as the number on-chain."
             },
             "discount_value": {
               "anyOf": [
@@ -771,10 +771,10 @@
                   "type": "string"
                 }
               ],
-              "description": "Discount value"
+              "description": "Discount magnitude, meaning depends on discount_type. RATES (0): per-10000 off rate — 10 = 0.1% off, 1000 = 10% off, 10000 = 100% off; values above 10000 are rejected. FIXED (1): fixed deduction from the order total in the Service token's smallest units (e.g. 1000000000 = 1 WOW at 9 decimals)."
             },
             "benchmark": {
-              "description": "Discount benchmark value. Discount is only applied if the amount exceeds this value",
+              "description": "Minimum order total (in the Service token's smallest units) for the discount to apply — the discount is applied only when the order total is GREATER THAN OR EQUAL TO this value. ⚠️ OMITTING this field means the discount NEVER applies: the coupon object is still consumed (destroyed) when used, but the order total is unchanged. To make a discount that always applies, pass 0. If the order total is below the discounted price the payment aborts — pay the list price; the excess is returned as a new Coin.",
               "anyOf": [
                 {
                   "type": "number"
@@ -794,7 +794,7 @@
             },
             "count": {
               "type": "number",
-              "description": "Discount usage count"
+              "description": "Number of SEPARATE Discount (coupon) objects minted — total delivered = count × number of recipients. Each coupon object is SINGLE-USE (consumed on first use). This is NOT a per-coupon reuse count: count:2 creates 2 independent one-time coupons, not 1 coupon usable twice."
             },
             "recipient": {
               "type": "object",
@@ -863,7 +863,7 @@
           }
         },
         "order_allocators": {
-          "description": "Order fund allocator. Max 100 allocators (MAX_ALLOCATOR_COUNT). Each allocator has a guard (first matching guard wins) and a sharing list. Set to null to clear. ⚠️ PERMANENTLY IMMUTABLE after publish: order_allocators can ONLY be set BEFORE publish=true (on-chain check rejects after publish — E_ALREADY_PUBLISHED). After publish, the ONLY way to change allocation rules is to create a NEW Service object. There is NO pause+lock exception for order_allocators (unlike arbitrations/rewards which have time-lock removal). PRE-PUBLISH CHECKLIST: verify all guard names resolve, all sharing amounts are correct, threshold is set, and recipient types (Entity/Signer/GuardIdentifier) are intended before calling publish=true. GuardIdentifier sharing mode: {who: {GuardIdentifier: <u8>}, sharing: <rate>, mode: 'Rate'} — resolves recipient from the Guard table submission at allocation time. Canonical order pattern: the recipient slot is the single submitted Order (constrained by the Guard — service binding, qualifying node, signer==order.owner); funds land at that order object and are receivable only by its owner (object receipt = owner receipt). Safety is determined by constraint sufficiency — run the recipient constraint audit before publish. Fixed recipients should use {who:{Entity:...}}; unbound Signer recipients are a CRITICAL theft risk. MULTI-CALL ALLOCATION: an allocation can be executed MULTIPLE times (no consumed flag in contract). Use Amount mode (not Surplus) for recurring allocations — Surplus calls balance::withdraw_all which drains the balance. For monthly payment scenarios, create multiple Allocators with time-based Guards + Amount mode sharing items.",
+          "description": "Order fund allocator. Max 100 allocators (MAX_ALLOCATOR_COUNT). Each allocator has a guard (first matching guard wins) and a sharing list. Set to null to clear. ⚠️ PERMANENTLY IMMUTABLE after publish: order_allocators can ONLY be set BEFORE publish=true (on-chain check rejects after publish — E_ALREADY_PUBLISHED). After publish, the ONLY way to change allocation rules is to create a NEW Service object. There is NO pause+lock exception for order_allocators (unlike arbitrations/rewards which have time-lock removal). PRE-PUBLISH CHECKLIST: verify all guard names resolve, all sharing amounts are correct, threshold is set, and recipient types (Entity/Signer/GuardIdentifier) are intended before calling publish=true. GuardIdentifier sharing mode: {who: {GuardIdentifier: <u8>}, sharing: <rate>, mode: 'Rate'} — resolves recipient from the Guard table submission at allocation time. BINDING SEMANTICS (contract-enforced, abort code 15): in a Service-created Allocation EVERY GuardIdentifier submission must equal the PAYING order — it is always 'the order', never a third party whose address is supplied at trigger time; use {who:{Entity:...}} for named parties. Canonical order pattern: the recipient slot is the single submitted Order (constrained by the Guard — service binding, qualifying node, signer==order.owner); funds land at that order object and are receivable only by its owner (object receipt = owner receipt). Safety is determined by constraint sufficiency — run the recipient constraint audit before publish. Fixed recipients should use {who:{Entity:...}}; unbound Signer recipients are a CRITICAL theft risk. MULTI-CALL ALLOCATION: an allocation can be executed MULTIPLE times (no consumed flag in contract). Use Amount mode (not Surplus) for recurring allocations — Surplus calls balance::withdraw_all which drains the balance. For monthly payment scenarios, create multiple Allocators with time-based Guards + Amount mode sharing items.",
           "anyOf": [
             {
               "type": "object",
@@ -1390,6 +1390,31 @@
             }
           ]
         },
+        "arb_statement": {
+          "description": "Service (defendant-side) statement on an arbitration case — permission index 321. Lets the Service permission holder put a bounded text on the record for any case against an order of this service WITHOUT holding the order. Callable in ANY case status. The Arb's coin type is derived automatically from the arb object on-chain.",
+          "type": "object",
+          "properties": {
+            "arb": {
+              "type": "string",
+              "description": "Arb object (case) to attach the statement to."
+            },
+            "order": {
+              "type": "string",
+              "description": "The order the case was opened against — must belong to this Service."
+            },
+            "statement": {
+              "type": "string",
+              "maxLength": 4000,
+              "description": "Seller's text statement appended to the case record (ArbStatementEvent). Event-only: nothing on the Arb object is mutated; the record cannot be rewritten or deleted. Use to declare facts or report the customer's behavior (e.g. absence, non-cooperation). PRIMARY evidence channel is Messenger (encrypted WTS records with the customer); this is the SECONDARY on-chain declare/report channel."
+            }
+          },
+          "required": [
+            "arb",
+            "order",
+            "statement"
+          ],
+          "additionalProperties": false
+        },
         "pause": {
           "description": "Whether to pause accepting new orders.",
           "type": "boolean"
@@ -1469,6 +1494,14 @@
           "description": "Phase 1 dry_run: when true, SIMULATE the transaction without signing or submitting. Returns effects + events showing what WOULD happen — no on-chain state is modified, no gas is charged. Use this to verify that an operation will succeed before committing. The returned digest will be 'dry_run:<timestamp>' and objectChanges will be empty (simulation only).",
           "type": "boolean"
         },
+        "response_level": {
+          "description": "Write-success response size. 'compact' (default) trims the structured result to key fields (digest + created object references); 'full' includes the complete raw result. Default: compact.",
+          "type": "string",
+          "enum": [
+            "compact",
+            "full"
+          ]
+        },
         "confirm_mode": {
           "description": "Confirmation frequency for this call. 'full': confirm every matched gate rule. 'streamlined' (client default): skip fail-open 'standard' level prompts — fail-closed levels (irreversible/publish/amount) ALWAYS still confirm. 'quiet': same hard floor as streamlined, for clients that batch/suppress repeat low-risk prompts in their own UI. This field NEVER downgrades fail-closed levels.",
           "type": "string",

package/dist/schemas/onchain_operations_treasury.schema.json

@@ -948,6 +948,14 @@
           "description": "Phase 1 dry_run: when true, SIMULATE the transaction without signing or submitting. Returns effects + events showing what WOULD happen — no on-chain state is modified, no gas is charged. Use this to verify that an operation will succeed before committing. The returned digest will be 'dry_run:<timestamp>' and objectChanges will be empty (simulation only).",
           "type": "boolean"
         },
+        "response_level": {
+          "description": "Write-success response size. 'compact' (default) trims the structured result to key fields (digest + created object references); 'full' includes the complete raw result. Default: compact.",
+          "type": "string",
+          "enum": [
+            "compact",
+            "full"
+          ]
+        },
         "confirm_mode": {
           "description": "Confirmation frequency for this call. 'full': confirm every matched gate rule. 'streamlined' (client default): skip fail-open 'standard' level prompts — fail-closed levels (irreversible/publish/amount) ALWAYS still confirm. 'quiet': same hard floor as streamlined, for clients that batch/suppress repeat low-risk prompts in their own UI. This field NEVER downgrades fail-closed levels.",
           "type": "string",

package/dist/schemas/onchain_table_data.output.json

@@ -9053,7 +9053,7 @@
                 "mainnet",
                 "localnet"
               ],
-              "description": "Network for the query. Defaults to the user's CURRENT network (client UI selection / authority config) when omitted. 'localnet' is for internal test use against a local fullnode."
+              "description": "Network for the query — equivalent to the `network` parameter (prefer `network`). Defaults to the user's CURRENT network (client UI selection / authority config) when omitted. 'localnet' is for internal test use against a local fullnode."
             }
           },
           "required": [
@@ -9080,7 +9080,7 @@
                 "mainnet",
                 "localnet"
               ],
-              "description": "Network for the query. Defaults to the user's CURRENT network (client UI selection / authority config) when omitted. 'localnet' is for internal test use against a local fullnode."
+              "description": "Network for the query — equivalent to the `network` parameter (prefer `network`). Defaults to the user's CURRENT network (client UI selection / authority config) when omitted. 'localnet' is for internal test use against a local fullnode."
             }
           },
           "required": [
@@ -9111,7 +9111,7 @@
                 "mainnet",
                 "localnet"
               ],
-              "description": "Network for the query. Defaults to the user's CURRENT network (client UI selection / authority config) when omitted. 'localnet' is for internal test use against a local fullnode."
+              "description": "Network for the query — equivalent to the `network` parameter (prefer `network`). Defaults to the user's CURRENT network (client UI selection / authority config) when omitted. 'localnet' is for internal test use against a local fullnode."
             }
           },
           "required": [
@@ -9138,7 +9138,7 @@
                 "mainnet",
                 "localnet"
               ],
-              "description": "Network for the query. Defaults to the user's CURRENT network (client UI selection / authority config) when omitted. 'localnet' is for internal test use against a local fullnode."
+              "description": "Network for the query — equivalent to the `network` parameter (prefer `network`). Defaults to the user's CURRENT network (client UI selection / authority config) when omitted. 'localnet' is for internal test use against a local fullnode."
             }
           },
           "required": [
@@ -9172,7 +9172,7 @@
                 "mainnet",
                 "localnet"
               ],
-              "description": "Network for the query. Defaults to the user's CURRENT network (client UI selection / authority config) when omitted. 'localnet' is for internal test use against a local fullnode."
+              "description": "Network for the query — equivalent to the `network` parameter (prefer `network`). Defaults to the user's CURRENT network (client UI selection / authority config) when omitted. 'localnet' is for internal test use against a local fullnode."
             },
             "context_depth": {
               "description": "BFS recursion depth for dependency expansion in assemble_context (default 0 = no expansion). When >0, the assembly recursively queries objects referenced by the center objects (permission, guard, machine, service, repositories, etc.) up to the given depth, using the same address-field extraction rules as extractAddressFields. Each level issues one batched query_objects call (≤50 IDs per batch). Cycles are detected and skipped via a visited set. Discovered dependencies are returned in `dependencies` (edge metadata) and `dependency_objects` (full object states). Recommended: 1–2 for most use cases; 3+ may pull large subgraphs (use context_include to constrain).",
@@ -9215,7 +9215,7 @@
                 "mainnet",
                 "localnet"
               ],
-              "description": "Network for the query. Defaults to the user's CURRENT network (client UI selection / authority config) when omitted. 'localnet' is for internal test use against a local fullnode."
+              "description": "Network for the query — equivalent to the `network` parameter (prefer `network`). Defaults to the user's CURRENT network (client UI selection / authority config) when omitted. 'localnet' is for internal test use against a local fullnode."
             },
             "reverse_order_amount": {
               "description": "Escrowed order amount (smallest-unit string) for reverse_map — included in the report summary as the concrete escrow mention.",
@@ -9312,7 +9312,7 @@
                 "mainnet",
                 "localnet"
               ],
-              "description": "Network for the query. Defaults to the user's CURRENT network (client UI selection / authority config) when omitted. 'localnet' is for internal test use against a local fullnode."
+              "description": "Network for the query — equivalent to the `network` parameter (prefer `network`). Defaults to the user's CURRENT network (client UI selection / authority config) when omitted. 'localnet' is for internal test use against a local fullnode."
             }
           },
           "required": [
@@ -9357,7 +9357,7 @@
                 "mainnet",
                 "localnet"
               ],
-              "description": "Network for the query. Defaults to the user's CURRENT network (client UI selection / authority config) when omitted. 'localnet' is for internal test use against a local fullnode."
+              "description": "Network for the query — equivalent to the `network` parameter (prefer `network`). Defaults to the user's CURRENT network (client UI selection / authority config) when omitted. 'localnet' is for internal test use against a local fullnode."
             }
           },
           "required": [
@@ -9402,7 +9402,7 @@
                 "mainnet",
                 "localnet"
               ],
-              "description": "Network for the query. Defaults to the user's CURRENT network (client UI selection / authority config) when omitted. 'localnet' is for internal test use against a local fullnode."
+              "description": "Network for the query — equivalent to the `network` parameter (prefer `network`). Defaults to the user's CURRENT network (client UI selection / authority config) when omitted. 'localnet' is for internal test use against a local fullnode."
             },
             "account": {
               "description": "Scope the aggregation to ONE account address (the client's current account). Omit to aggregate across ALL local accounts.",
@@ -9437,7 +9437,7 @@
                 "mainnet",
                 "localnet"
               ],
-              "description": "Network for the query. Defaults to the user's CURRENT network (client UI selection / authority config) when omitted. 'localnet' is for internal test use against a local fullnode."
+              "description": "Network for the query — equivalent to the `network` parameter (prefer `network`). Defaults to the user's CURRENT network (client UI selection / authority config) when omitted. 'localnet' is for internal test use against a local fullnode."
             },
             "account": {
               "description": "Scope to ONE account address (the client's current account). Omit to merge across ALL local accounts.",
@@ -9513,7 +9513,7 @@
                 "mainnet",
                 "localnet"
               ],
-              "description": "Network for the query. Defaults to the user's CURRENT network (client UI selection / authority config) when omitted. 'localnet' is for internal test use against a local fullnode."
+              "description": "Network for the query — equivalent to the `network` parameter (prefer `network`). Defaults to the user's CURRENT network (client UI selection / authority config) when omitted. 'localnet' is for internal test use against a local fullnode."
             },
             "intent": {
               "description": "SEMANTIC exploration strategy (G3) — what this topology call is trying to establish. Deterministically shapes the edge whitelist, per-family depth caps and budget: full_map=complete structural map; order_health=order lifecycle+completion+disputes; fund_flow=payments+allocation waterfall+guard-gated splits; workflow=Machine node graphs+transitions+progress; counterparty=who is on the other side (buyer/seller/agents/operators); reputation=votes+arbitration record+contacts; permission=permission groups+bindings+entity tables; supply_chain=multi-leg allocation/sub-order settlement; arbitration=dispute cases+voters; demand_match=demand presenters+guards+rewards. When omitted, defaults come from the persona system (role default intents < account persona preference), then industry templates; every applied layer is reported in result.strategy.trace.",
@@ -10449,7 +10449,7 @@
               "type": "string"
             },
             "test_result": {
-              "description": "gen_passport static test result. Must pass before CREATE.",
+              "description": "gen_passport static test result. status is read from the created Passport's on-chain result field; tx success alone never means the Guard passed.",
               "type": "object",
               "properties": {
                 "status": {
@@ -10467,6 +10467,29 @@
                 "passport_id": {
                   "description": "Generated Passport ID (if pass)",
                   "type": "string"
+                },
+                "guard_results": {
+                  "description": "Per-Guard evaluation result read from the Passport (docs#40: the pass/fail status comes from Passport.result, not transaction success)",
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "guard": {
+                        "type": "string"
+                      },
+                      "result": {
+                        "type": "boolean"
+                      },
+                      "impack": {
+                        "type": "boolean"
+                      }
+                    },
+                    "required": [
+                      "guard",
+                      "result"
+                    ],
+                    "additionalProperties": false
+                  }
                 }
               },
               "required": [