@xopcai/xopc 0.0.312 → 0.0.314

package/dist/src/agent/tools/xopc-use-tool.js

@@ -1,35 +1,34 @@
 import { runWithActivityContext } from "../../activity/context.js";
-import { init_transaction, runSqliteWriteTransaction } from "../../storage/sqlite/transaction.js";
 import { TaskCommandSchema, TaskContextInputSchema } from "../../../packages/gateway-contract/src/tasks.js";
 import { appendProductDeliveryText } from "../../../packages/gateway-contract/src/product-delivery.js";
+import { AutomationCancelOutputSchema, AutomationDeleteOutputSchema, AutomationMutationOutputSchema, AutomationReadAllInputSchema, AutomationReadAllOutputSchema, AutomationReadOutputSchema, AutomationRunMutationOutputSchema, CapabilityCallSchema, CapabilityResourceInputSchema, NoteDeleteOutputSchema, NoteGetOutputSchema, ProjectCreateInputSchema, ProjectDeleteInputSchema, ProjectDeleteOutputSchema, ProjectEditInputSchema, ProjectMilestoneCreateInputSchema, ProjectMilestoneDeleteInputSchema, ProjectMilestoneDeleteOutputSchema, ProjectMilestoneOutputSchema, ProjectMilestoneUpdateInputSchema, ProjectMutationOutputSchema, ProjectResolveWorkspaceInputSchema, ProjectResolveWorkspaceOutputSchema, ProjectSetPinnedInputSchema, ProjectUpdateCreateInputSchema, ProjectUpdateOutputSchema, SceneWriteContracts, TaskRunCancelInputSchema, TaskRunCancelOutputSchema, TaskRunFeedbackInputSchema, TaskRunFeedbackOutputSchema } from "../../../packages/gateway-contract/src/capabilities.js";
 import { init_src } from "../../../packages/gateway-contract/src/index.js";
-import { enqueueTaskChangedEvent } from "../../tasks/task-change-events.js";
+import { TaskRepository } from "../../tasks/task-repository.js";
 import { TaskRunRepository } from "../../tasks/task-run-repository.js";
 import { getSessionMetadata } from "../../storage/sqlite/session-read-repository.js";
 import "../../storage/sqlite/index.js";
-import { ObjectLinkService } from "../../activity/service.js";
 import "../../activity/index.js";
 import { getDefaultAgentId, init_resolve_route } from "../../routing/resolve-route.js";
-import { TaskRepository } from "../../tasks/task-repository.js";
-import { TaskReadModelProjector } from "../../tasks/task-read-model-projector.js";
-import { isValidProjectAgentId, normalizeProjectAgentId, resolveProjectAgentId } from "../../projects/project-agent.js";
+import { CapabilityError } from "../../capabilities/runtime/errors.js";
+import "../../capabilities/runtime/dispatcher.js";
+import { resolveProjectAgentId } from "../../projects/project-agent.js";
 import "../../projects/index.js";
-import { CreateAutomationSchema, UpdateAutomationSchema } from "../../automations/domain/validation.js";
-import "../../automations/index.js";
-import { TaskContextRepository } from "../../tasks/task-context-repository.js";
-import { TaskDependencyError, TaskDependencyService } from "../../tasks/task-dependency-service.js";
-import { TaskApplicationService } from "../../tasks/task-application-service.js";
-import { defineTaskContract } from "../../tasks/task-contract-definition.js";
 import { TaskDeletionService } from "../../tasks/task-deletion-service.js";
+import { TaskDeleteOutputSchema } from "../../tasks/capabilities/management.js";
+import { AutomationCreateCapabilityInputSchema, AutomationUpdatePatchSchema } from "../../automations/capabilities/write.js";
+import { TaskMutationOutputSchema } from "../../tasks/capabilities/write.js";
+import { createProductDispatcher } from "../../capabilities/runtime/product.js";
+import { localAppCapabilities } from "../../local-apps/capabilities/runtime.js";
+import { defineTaskContract } from "../../tasks/task-contract-definition.js";
 import "../../tasks/index.js";
 import { randomUUID } from "node:crypto";
 import { Type } from "@sinclair/typebox";
 //#region src/agent/tools/xopc-use-tool.ts
 init_src();
 init_resolve_route();
-init_transaction();
 const XopcUseToolSchema = Type.Object({
 	mode: Type.Union([
+		Type.Literal("context"),
 		Type.Literal("scene"),
 		Type.Literal("project"),
 		Type.Literal("automation"),
@@ -39,30 +38,10 @@ const XopcUseToolSchema = Type.Object({
 		Type.Literal("local_app"),
 		Type.Literal("settings")
 	]),
-	command: Type.String({ description: "Object command. Scene commands: templates, list, get {id}, mail_accounts, mail_search {accountId, query}, mail_sources, read_notes {id}, preflight/start {templateKey, templateVersion, goal, scope, permissions}, configure {id, expectedRevision, goal, scope, permissions}, transition {id, expectedRevision, status: paused|active|completed|archived}, check {id}, notes {id, expectedRevision, content, validUntil?}, work_item {id, subjectId, accountId, dueAt}, update_work_item {workItemId, expectedRevision, dueAt?, status?}, schedule {id, triggerKey, expectedRevision, schedule}, results {id?}, feedback {presentationId, expectedRevision, rating}, mark_read {presentationId, read}, diagnostics, get_preferences, set_preferences {expectedRevision, ...preferences}. Start and check accept a stable requestId for retries. Scenes prepare read-only suggestions and drafts; never send mail. Only create a scene for work explicitly delegated by the user; inspect existing scenes first. Supports project list/get/create/update/resolve_workspace/list_milestones/create_milestone/update_milestone/list_updates/create_update, automation list/get/create/update/delete/run/pause/resume/history, note list/get/create/append/update/preview_edit/delete, task list/get/create/update_dependencies/add_context/remove_context/command/delete, task_run list/get/cancel, local_app list/get/create/validate, and settings open." }),
+	command: Type.String({ description: "Context resolve takes an explicit AppContextEnvelope; never guess a current page. Automation draft/repair_draft accept prompt/id, agentId?, language?, idempotencyKey?; simulate explains an automation without running it. Local_app record_acceptance records supplied checks and sourceHash, not proof that checks were executed. Project create accepts idempotencyKey; update/pin/unpin/delete accepts {projectId, expectedVersion?, idempotencyKey?}; stable retries require the original expectedVersion. Delete preserves workspace files and does not confirm external execution stopped. Project milestone writes support idempotencyKey; update_milestone/delete_milestone require original expectedRevision for stable retries, and create_update requires original expectedVersion. TaskRun cancel accepts idempotencyKey and expectedVersion, and does not confirm external execution stopped. Automation diagnostics: get_run/run_events {runId}, metrics {}, product_events {eventType, source?, payloadKey?, payloadValue?, limit?}; payload filters require both key and value. Automation also supports cancel/read {runId, idempotencyKey?} and read_all {projectId?, idempotencyKey?}; omitted projectId means all projects. Cancel acceptance is not confirmation of stopping. Object command. Scene commands: templates, list, get {id}, mail_accounts, mail_search {accountId, query}, mail_sources, read_notes {id}, preflight/start {templateKey, templateVersion, goal, scope, permissions}, configure {id, expectedRevision, goal, scope, permissions}, transition {id, expectedRevision, status: paused|active|completed|archived}, check {id}, notes {id, expectedRevision, content, validUntil?}, work_item {id, subjectId, accountId, dueAt}, update_work_item {workItemId, expectedRevision, dueAt?, status?}, schedule {id, triggerKey, expectedRevision, schedule}, results {id?}, feedback {presentationId, expectedRevision, rating}, mark_read {presentationId, read}, diagnostics, get_preferences, set_preferences {expectedRevision, ...preferences}. Start and check accept a stable requestId for retries. Scenes prepare read-only suggestions and drafts; never send mail. Only create a scene for work explicitly delegated by the user; inspect existing scenes first. Supports project list/get/create/update/resolve_workspace/list_milestones/create_milestone/update_milestone/list_updates/create_update, automation list/get/create/update/delete/run/rerun/pause/resume/history (rerun takes runId; run/rerun accept idempotencyKey), note list/get/project_summaries/history {noteId}/snapshot {noteId, timestamp}/create/append/update/preview_edit/delete, task list/get/create/update_dependencies/add_context/remove_context/command/delete, task_run list/get/cancel, local_app list/get/create/validate, and settings open." }),
 	args: Type.Optional(Type.Record(Type.String(), Type.Any())),
 	dryRun: Type.Optional(Type.Boolean({ description: "Validate and preview the action without mutating xopc state." }))
 });
-const PROJECT_STATUSES = new Set([
-	"planned",
-	"active",
-	"paused",
-	"completed",
-	"cancelled",
-	"archived"
-]);
-const PROJECT_HEALTHS = new Set([
-	"unknown",
-	"on_track",
-	"at_risk",
-	"off_track"
-]);
-const MILESTONE_STATUSES = new Set([
-	"planned",
-	"active",
-	"completed",
-	"cancelled"
-]);
 const NOTE_KINDS = new Set([
 	"thought",
 	"todo",
@@ -78,13 +57,6 @@ const NOTE_STATUSES = new Set([
 	"archived",
 	"trashed"
 ]);
-const TASK_PHASES = new Set([
-	"backlog",
-	"ready",
-	"active",
-	"review",
-	"closed"
-]);
 const TASK_PRIORITIES = new Set([
 	"low",
 	"normal",
@@ -133,15 +105,6 @@ function optionalString(value) {
 	if (value === null) return null;
 	if (typeof value === "string") return value;
 }
-function boundedLimit(value, fallback = 20, max = 100) {
-	const raw = typeof value === "number" ? value : typeof value === "string" ? Number(value) : fallback;
-	if (!Number.isFinite(raw)) return fallback;
-	return Math.max(1, Math.min(max, Math.floor(raw)));
-}
-function offset(value) {
-	const raw = typeof value === "number" ? value : typeof value === "string" ? Number(value) : void 0;
-	return raw !== void 0 && Number.isFinite(raw) ? Math.max(0, Math.floor(raw)) : void 0;
-}
 function enumValue(value, allowed) {
 	return typeof value === "string" && allowed.has(value) ? value : void 0;
 }
@@ -156,10 +119,6 @@ function stringArray(value) {
 	if (!Array.isArray(value)) return void 0;
 	return value.filter((item) => typeof item === "string");
 }
-function nullableFiniteNumber(value) {
-	if (value === null) return null;
-	return finiteNumber(value);
-}
 function ensureArgs(input) {
 	return input.args && typeof input.args === "object" && !Array.isArray(input.args) ? input.args : {};
 }
@@ -179,9 +138,65 @@ function deliverySummary(...values) {
 	return value.length > 180 ? `${value.slice(0, 177)}…` : value;
 }
 function deliveryForXopcResult(mode, command, result, dryRun) {
-	if (dryRun || command === "list" || command === "delete") return void 0;
+	if (dryRun || command === "delete") return void 0;
 	const resultRecord = record(result);
 	if (!resultRecord || resultRecord.ok === false) return void 0;
+	if (command === "list") {
+		const rows = resultRecord.items ?? resultRecord.activations ?? resultRecord.apps;
+		if (!Array.isArray(rows) || ![
+			"task",
+			"note",
+			"project",
+			"automation",
+			"scene",
+			"local_app"
+		].includes(mode)) return void 0;
+		const field = mode === "scene" ? "activation" : mode === "local_app" ? "app" : mode;
+		const items = rows.slice(0, 50).flatMap((row) => {
+			const reference = deliveryForXopcResult(mode, "get", { [field]: row }, false)?.primary;
+			return reference ? [{
+				...reference,
+				capabilities: ["open"]
+			}] : [];
+		});
+		return {
+			version: 1,
+			operation: "opened",
+			presentation: {
+				kind: "table",
+				items,
+				truncated: rows.length > 50 || Boolean(resultRecord.nextCursor) || typeof resultRecord.total === "number" && resultRecord.total > items.length
+			}
+		};
+	}
+	if (mode === "note" && command === "preview_edit") {
+		const patch = record(resultRecord.patch);
+		if (!patch || !Array.isArray(patch.operations)) return void 0;
+		let remaining = 16e3;
+		let truncated = patch.operations.length > 20;
+		const edits = patch.operations.slice(0, 20).flatMap((value) => {
+			const edit = record(value);
+			if (!edit || edit.type !== "replaceRange" || !Number.isSafeInteger(edit.from) || !Number.isSafeInteger(edit.to) || edit.from < 0 || edit.to < edit.from || typeof edit.markdown !== "string") return [];
+			const text = edit.markdown.slice(0, remaining);
+			truncated ||= text.length < edit.markdown.length;
+			remaining -= text.length;
+			return [{
+				from: edit.from,
+				to: edit.to,
+				text
+			}];
+		});
+		return {
+			version: 1,
+			operation: "opened",
+			presentation: {
+				kind: "diff",
+				title: String(patch.summary ?? "").slice(0, 2e3),
+				edits,
+				truncated
+			}
+		};
+	}
 	let source;
 	let primary;
 	if (mode === "project") {
@@ -194,7 +209,7 @@ function deliveryForXopcResult(mode, command, result, dryRun) {
 			title: deliveryText(source?.name) ?? "Project",
 			summary: deliverySummary(source?.description, source?.brief),
 			status: deliveryText(source?.status),
-			revision: deliveryRevision(source?.updatedAt),
+			revision: deliveryRevision(source?.version),
 			capabilities: [
 				"open",
 				"edit",
@@ -247,7 +262,7 @@ function deliveryForXopcResult(mode, command, result, dryRun) {
 			title: deliveryText(source?.title) ?? "Untitled note",
 			summary: deliverySummary(source?.markdown),
 			status: deliveryText(source?.status),
-			revision: deliveryRevision(source?.localVersion) ?? deliveryRevision(source?.updatedAt),
+			revision: deliveryRevision(source?.remoteVersion ?? 1),
 			projectId: deliveryText(resultRecord.projectId),
 			capabilities: [
 				"open",
@@ -329,7 +344,7 @@ function deliveryForXopcResult(mode, command, result, dryRun) {
 	if (!primary) return void 0;
 	return {
 		version: 1,
-		operation: mode === "task" && deliveryText(resultRecord.runId) || mode === "automation" && command === "run" || mode === "scene" && command === "check" ? "started" : command === "create" || mode === "scene" && command === "start" ? "created" : command === "get" || command === "resolve_workspace" || mode === "settings" ? "opened" : command === "validate" ? "completed" : "updated",
+		operation: mode === "task" && deliveryText(resultRecord.runId) || mode === "automation" && (command === "run" || command === "rerun") || mode === "scene" && command === "check" ? "started" : command === "create" || mode === "scene" && command === "start" ? "created" : command === "get" || command === "resolve_workspace" || mode === "settings" ? "opened" : command === "validate" ? "completed" : "updated",
 		primary
 	};
 }
@@ -359,70 +374,50 @@ function optionalProjectWorkspaceRootArg(args) {
 	if (args.workspacePath !== void 0) return optionalString(args.workspacePath);
 	if (args.path !== void 0) return optionalString(args.path);
 }
-function validateDefaultAgentId(raw, config) {
-	if (raw === null) return null;
-	const normalized = normalizeProjectAgentId(trimString(raw));
-	if (!normalized) return void 0;
-	if (config && !isValidProjectAgentId(config, normalized)) throw new Error(`Default agent not found: ${normalized}`);
-	return normalized;
-}
-async function handleProject(command, args, deps, dryRun) {
+async function handleProject(command, args, deps, dryRun, capabilities) {
 	const projects = deps.getProjectService?.();
 	if (!projects) return {
 		ok: false,
 		error: "Project service is unavailable"
 	};
-	if (command === "list") return {
-		ok: true,
-		...projects.list({
-			status: enumValue(args.status, PROJECT_STATUSES),
-			search: trimString(args.search),
-			sortBy: enumValue(args.sortBy, new Set([
-				"updatedAt",
-				"createdAt",
-				"name"
-			])),
-			sortOrder: enumValue(args.sortOrder, new Set(["asc", "desc"])),
-			limit: boundedLimit(args.limit),
-			offset: offset(args.offset)
-		})
-	};
-	if (command === "get") {
-		const id = trimString(args.projectId) ?? trimString(args.id);
-		if (!id) return {
-			ok: false,
-			error: "projectId is required"
-		};
-		const project = projects.getWithDetails(id);
-		return project ? {
-			ok: true,
-			project
-		} : {
-			ok: false,
-			error: `Project not found: ${id}`
-		};
-	}
 	if (command === "resolve_workspace") {
-		const workspacePath = projectWorkspaceRootArg(args);
-		if (!workspacePath) return {
+		if (args.idempotencyKey !== void 0 && !trimString(args.idempotencyKey)) return {
 			ok: false,
-			error: "workspacePath is required"
-		};
-		const defaultAgentId = args.defaultAgentId !== void 0 ? validateDefaultAgentId(args.defaultAgentId, deps.getConfig?.()) ?? void 0 : void 0;
-		const input = {
-			workspacePath,
-			agentId: trimString(args.agentId),
-			defaultAgentId,
-			autoCreate: args.autoCreate === true
+			error: "Invalid idempotencyKey"
 		};
+		const input = ProjectResolveWorkspaceInputSchema.parse({
+			...pickDefined(args, [
+				"agentId",
+				"defaultAgentId",
+				"projectKind",
+				"autoCreate",
+				"conversationId"
+			]),
+			workspacePath: projectWorkspaceRootArg(args)
+		});
 		if (dryRun) return {
 			ok: true,
 			dryRun: true,
 			action: "resolve_project_workspace",
 			input
 		};
-		const match = projects.resolveOrCreateForWorkspacePath(input);
-		return match ? {
+		const caller = {
+			principalId: "agent:" + (deps.getCurrentAgentId?.() ?? "main"),
+			surface: "agent",
+			scopes: ["workspace.write"],
+			actor: {
+				kind: "agent",
+				id: deps.getCurrentAgentId?.()
+			},
+			authorize: deps.authorizeCapability ?? (() => true)
+		};
+		const operation = "xopc.projects.resolve_workspace";
+		const result = ProjectResolveWorkspaceOutputSchema.parse(await capabilities.call(operation, input, caller, {
+			...capabilities.describe(operation, caller),
+			idempotencyKey: trimString(args.idempotencyKey) ?? randomUUID()
+		}));
+		const { ok: _ok, ...match } = result;
+		return result.project ? {
 			ok: true,
 			match
 		} : {
@@ -430,335 +425,267 @@ async function handleProject(command, args, deps, dryRun) {
 			error: "No project matched workspace path"
 		};
 	}
-	if (command === "create") {
-		const name = trimString(args.name);
-		const workspaceRoot = projectWorkspaceRootArg(args);
-		if (!name && !workspaceRoot) return {
-			ok: false,
-			error: "name or workspaceRoot is required"
-		};
-		const input = {
-			name,
-			description: trimString(args.description),
-			defaultAgentId: validateDefaultAgentId(args.defaultAgentId, deps.getConfig?.()) ?? void 0,
-			workspaceRoot,
-			createWorkspaceRoot: args.createWorkspaceRoot === true,
-			projectKind: trimString(args.projectKind),
-			brief: trimString(args.brief),
-			instructions: trimString(args.instructions),
-			outcome: trimString(args.outcome),
-			successCriteria: args.successCriteria === void 0 ? void 0 : stringArray(args.successCriteria),
-			scope: args.scope === void 0 ? void 0 : record(args.scope),
-			nonGoals: args.nonGoals === void 0 ? void 0 : stringArray(args.nonGoals),
-			health: args.health === void 0 ? void 0 : enumValue(args.health, PROJECT_HEALTHS),
-			ownerId: trimString(args.ownerId),
-			targetAt: args.targetAt === void 0 ? void 0 : finiteNumber(args.targetAt)
-		};
-		if (args.successCriteria !== void 0 && !input.successCriteria) return {
-			ok: false,
-			error: "Invalid successCriteria"
-		};
-		if (args.scope !== void 0 && !input.scope) return {
-			ok: false,
-			error: "Invalid scope"
-		};
-		if (args.nonGoals !== void 0 && !input.nonGoals) return {
-			ok: false,
-			error: "Invalid nonGoals"
-		};
-		if (args.health !== void 0 && !input.health) return {
-			ok: false,
-			error: "Invalid project health"
-		};
-		if (args.targetAt !== void 0 && input.targetAt === void 0) return {
-			ok: false,
-			error: "Invalid targetAt"
-		};
+	if (command === "create" || command === "update") {
+		const values = pickDefined(args, [
+			"name",
+			"description",
+			"defaultAgentId",
+			"createWorkspaceRoot",
+			"executionMode",
+			"brief",
+			"instructions",
+			"outcome",
+			"successCriteria",
+			"scope",
+			"nonGoals",
+			"health",
+			"ownerId",
+			"targetAt"
+		]);
+		const workspaceRoot = command === "create" ? projectWorkspaceRootArg(args) : optionalProjectWorkspaceRootArg(args);
+		if (workspaceRoot !== void 0) values.workspaceRoot = workspaceRoot;
+		if (args.workspaceRoot !== void 0 && typeof args.workspaceRoot !== "string" && args.workspaceRoot !== null) values.workspaceRoot = args.workspaceRoot;
+		if (args.idempotencyKey !== void 0 && !trimString(args.idempotencyKey)) return {
+			ok: false,
+			error: "Invalid idempotencyKey"
+		};
+		let input;
+		if (command === "create") input = ProjectCreateInputSchema.parse({
+			...values,
+			...pickDefined(args, ["projectKind", "autoUnderstand"])
+		});
+		else {
+			const id = trimString(args.projectId) ?? trimString(args.id);
+			if (!id) return {
+				ok: false,
+				error: "projectId is required"
+			};
+			if (args.idempotencyKey !== void 0 && args.expectedVersion === void 0) return {
+				ok: false,
+				error: "Stable retries require the original expectedVersion"
+			};
+			const project = args.expectedVersion === void 0 ? projects.get(id) : void 0;
+			if (args.expectedVersion === void 0 && !project) return {
+				ok: false,
+				error: "Project not found"
+			};
+			input = ProjectEditInputSchema.parse({
+				id,
+				expectedVersion: args.expectedVersion === void 0 ? project?.version : args.expectedVersion,
+				patch: {
+					...values,
+					...pickDefined(args, ["status"])
+				}
+			});
+		}
 		if (dryRun) return {
 			ok: true,
 			dryRun: true,
-			action: "create_project",
+			action: `${command}_project`,
 			input
 		};
-		return {
-			ok: true,
-			project: projects.create(input)
+		const caller = {
+			principalId: "agent:" + (deps.getCurrentAgentId?.() ?? "main"),
+			surface: "agent",
+			scopes: ["workspace.write"],
+			actor: {
+				kind: "agent",
+				id: deps.getCurrentAgentId?.()
+			},
+			authorize: deps.authorizeCapability ?? (() => true)
 		};
+		const operation = "xopc.projects." + command;
+		return ProjectMutationOutputSchema.parse(await capabilities.call(operation, input, caller, {
+			...capabilities.describe(operation, caller),
+			idempotencyKey: trimString(args.idempotencyKey) ?? randomUUID()
+		}));
 	}
-	if (command === "update") {
+	if (command === "pin" || command === "unpin" || command === "delete") {
 		const id = trimString(args.projectId) ?? trimString(args.id);
 		if (!id) return {
 			ok: false,
 			error: "projectId is required"
 		};
-		const workspaceRoot = optionalProjectWorkspaceRootArg(args);
-		const patch = {
-			...args.name !== void 0 ? { name: trimString(args.name) ?? "" } : {},
-			...args.description !== void 0 ? { description: optionalString(args.description) } : {},
-			...args.status !== void 0 ? { status: enumValue(args.status, PROJECT_STATUSES) } : {},
-			...args.defaultAgentId !== void 0 ? { defaultAgentId: validateDefaultAgentId(args.defaultAgentId, deps.getConfig?.()) } : {},
-			...workspaceRoot !== void 0 ? { workspaceRoot } : {},
-			...args.createWorkspaceRoot === true ? { createWorkspaceRoot: true } : {},
-			...args.brief !== void 0 ? { brief: optionalString(args.brief) } : {},
-			...args.instructions !== void 0 ? { instructions: optionalString(args.instructions) } : {},
-			...args.outcome !== void 0 ? { outcome: optionalString(args.outcome) } : {},
-			...args.successCriteria !== void 0 ? { successCriteria: stringArray(args.successCriteria) } : {},
-			...args.scope !== void 0 ? { scope: record(args.scope) } : {},
-			...args.nonGoals !== void 0 ? { nonGoals: stringArray(args.nonGoals) } : {},
-			...args.health !== void 0 ? { health: enumValue(args.health, PROJECT_HEALTHS) } : {},
-			...args.ownerId !== void 0 ? { ownerId: optionalString(args.ownerId) } : {},
-			...args.targetAt !== void 0 ? { targetAt: nullableFiniteNumber(args.targetAt) } : {}
-		};
-		if (args.status !== void 0 && patch.status === void 0) return {
-			ok: false,
-			error: "Invalid project status"
-		};
-		if (args.successCriteria !== void 0 && patch.successCriteria === void 0) return {
-			ok: false,
-			error: "Invalid successCriteria"
-		};
-		if (args.scope !== void 0 && patch.scope === void 0) return {
+		if (args.idempotencyKey !== void 0 && !trimString(args.idempotencyKey)) return {
 			ok: false,
-			error: "Invalid scope"
+			error: "Invalid idempotencyKey"
 		};
-		if (args.nonGoals !== void 0 && patch.nonGoals === void 0) return {
+		if (args.idempotencyKey !== void 0 && args.expectedVersion === void 0) return {
 			ok: false,
-			error: "Invalid nonGoals"
+			error: "Stable retries require the original expectedVersion"
 		};
-		if (args.health !== void 0 && patch.health === void 0) return {
+		const project = args.expectedVersion === void 0 ? projects.get(id) : void 0;
+		if (args.expectedVersion === void 0 && !project) return {
 			ok: false,
-			error: "Invalid project health"
+			error: "Project not found"
 		};
-		if (args.targetAt !== void 0 && patch.targetAt === void 0) return {
-			ok: false,
-			error: "Invalid targetAt"
+		const common = {
+			id,
+			expectedVersion: args.expectedVersion === void 0 ? project?.version : args.expectedVersion
 		};
+		const input = command === "delete" ? ProjectDeleteInputSchema.parse(common) : ProjectSetPinnedInputSchema.parse({
+			...common,
+			pinned: command === "pin"
+		});
 		if (dryRun) return {
 			ok: true,
 			dryRun: true,
-			action: "update_project",
-			projectId: id,
-			patch
+			action: `${command}_project`,
+			input
 		};
-		return {
-			ok: true,
-			project: projects.update(id, patch)
+		const caller = {
+			principalId: `agent:${deps.getCurrentAgentId?.() ?? "main"}`,
+			surface: "agent",
+			scopes: ["workspace.write"],
+			actor: {
+				kind: "agent",
+				id: deps.getCurrentAgentId?.()
+			},
+			authorize: deps.authorizeCapability ?? (() => true)
 		};
+		const operation = command === "delete" ? "xopc.projects.delete" : "xopc.projects.set_pinned";
+		const result = await capabilities.call(operation, input, caller, {
+			...capabilities.describe(operation, caller),
+			idempotencyKey: trimString(args.idempotencyKey) ?? randomUUID()
+		});
+		return (command === "delete" ? ProjectDeleteOutputSchema : ProjectMutationOutputSchema).parse(result);
 	}
-	const projectId = trimString(args.projectId) ?? trimString(args.id);
-	if (command === "list_milestones") {
+	if ([
+		"create_milestone",
+		"update_milestone",
+		"delete_milestone",
+		"create_update"
+	].includes(command)) {
+		const projectId = trimString(args.projectId) ?? trimString(args.id);
 		if (!projectId) return {
 			ok: false,
 			error: "projectId is required"
 		};
-		return {
-			ok: true,
+		const operation = "xopc.projects." + command;
+		let input;
+		if (command === "create_milestone") input = ProjectMilestoneCreateInputSchema.parse({
 			projectId,
-			items: projects.listMilestones(projectId)
-		};
-	}
-	if (command === "create_milestone") {
-		if (!projectId) return {
-			ok: false,
-			error: "projectId is required"
-		};
-		const title = trimString(args.title);
-		const status = args.status === void 0 ? void 0 : enumValue(args.status, MILESTONE_STATUSES);
-		const targetAt = args.targetAt === void 0 ? void 0 : finiteNumber(args.targetAt);
-		const sortOrder = args.sortOrder === void 0 ? void 0 : finiteNumber(args.sortOrder);
-		if (!title) return {
-			ok: false,
-			error: "title is required"
-		};
-		if (args.status !== void 0 && !status) return {
-			ok: false,
-			error: "Invalid milestone status"
-		};
-		if (args.targetAt !== void 0 && targetAt === void 0) return {
-			ok: false,
-			error: "Invalid targetAt"
-		};
-		if (args.sortOrder !== void 0 && sortOrder === void 0) return {
-			ok: false,
-			error: "Invalid sortOrder"
-		};
-		const input = {
-			title,
-			description: trimString(args.description),
-			status,
-			targetAt,
-			sortOrder
-		};
+			...pickDefined(args, [
+				"title",
+				"description",
+				"status",
+				"targetAt",
+				"sortOrder"
+			])
+		});
+		else if (command === "create_update") {
+			if (args.idempotencyKey !== void 0 && args.expectedVersion === void 0) return {
+				ok: false,
+				error: "Stable retries require the original expectedVersion"
+			};
+			input = ProjectUpdateCreateInputSchema.parse({
+				projectId,
+				...pickDefined(args, [
+					"health",
+					"summary",
+					"progress",
+					"risks",
+					"nextSteps"
+				]),
+				expectedVersion: args.expectedVersion === void 0 ? projects.get(projectId)?.version : args.expectedVersion
+			});
+		} else {
+			const id = trimString(args.milestoneId);
+			if (args.idempotencyKey !== void 0 && args.expectedRevision === void 0) return {
+				ok: false,
+				error: "Stable retries require the original expectedRevision"
+			};
+			const common = {
+				projectId,
+				id,
+				expectedRevision: args.expectedRevision === void 0 ? projects.listMilestones(projectId).find((item) => item.id === id)?.updatedAt : args.expectedRevision
+			};
+			input = command === "delete_milestone" ? ProjectMilestoneDeleteInputSchema.parse(common) : ProjectMilestoneUpdateInputSchema.parse({
+				...common,
+				patch: pickDefined(args, [
+					"title",
+					"description",
+					"status",
+					"targetAt",
+					"sortOrder"
+				])
+			});
+		}
 		if (dryRun) return {
 			ok: true,
 			dryRun: true,
-			action: "create_project_milestone",
-			projectId,
+			action: command,
 			input
 		};
-		return {
-			ok: true,
-			milestone: projects.createMilestone(projectId, input),
-			project: projects.get(projectId)
-		};
-	}
-	if (command === "update_milestone") {
-		if (!projectId) return {
-			ok: false,
-			error: "projectId is required"
-		};
-		const milestoneId = trimString(args.milestoneId);
-		if (!milestoneId) return {
-			ok: false,
-			error: "milestoneId is required"
-		};
-		const patch = {
-			...args.title !== void 0 ? { title: trimString(args.title) ?? "" } : {},
-			...args.description !== void 0 ? { description: optionalString(args.description) } : {},
-			...args.status !== void 0 ? { status: enumValue(args.status, MILESTONE_STATUSES) } : {},
-			...args.targetAt !== void 0 ? { targetAt: nullableFiniteNumber(args.targetAt) } : {},
-			...args.sortOrder !== void 0 ? { sortOrder: finiteNumber(args.sortOrder) } : {}
-		};
-		if (args.status !== void 0 && patch.status === void 0) return {
-			ok: false,
-			error: "Invalid milestone status"
-		};
-		if (args.targetAt !== void 0 && patch.targetAt === void 0) return {
-			ok: false,
-			error: "Invalid targetAt"
-		};
-		if (args.sortOrder !== void 0 && patch.sortOrder === void 0) return {
-			ok: false,
-			error: "Invalid sortOrder"
-		};
-		if (dryRun) return {
-			ok: true,
-			dryRun: true,
-			action: "update_project_milestone",
-			projectId,
-			milestoneId,
-			patch
-		};
-		return {
-			ok: true,
-			milestone: projects.updateMilestone(projectId, milestoneId, patch),
-			project: projects.get(projectId)
-		};
-	}
-	if (command === "list_updates") {
-		if (!projectId) return {
-			ok: false,
-			error: "projectId is required"
-		};
-		return {
-			ok: true,
-			projectId,
-			items: projects.listUpdates(projectId, boundedLimit(args.limit))
-		};
-	}
-	if (command === "create_update") {
-		if (!projectId) return {
-			ok: false,
-			error: "projectId is required"
-		};
-		const health = enumValue(args.health, PROJECT_HEALTHS);
-		const summary = trimString(args.summary);
-		const progress = args.progress === void 0 ? void 0 : stringArray(args.progress);
-		const risks = args.risks === void 0 ? void 0 : stringArray(args.risks);
-		const nextSteps = args.nextSteps === void 0 ? void 0 : stringArray(args.nextSteps);
-		if (!health) return {
-			ok: false,
-			error: "health is required"
-		};
-		if (!summary) return {
-			ok: false,
-			error: "summary is required"
-		};
-		if (args.progress !== void 0 && !progress) return {
-			ok: false,
-			error: "Invalid progress"
-		};
-		if (args.risks !== void 0 && !risks) return {
-			ok: false,
-			error: "Invalid risks"
-		};
-		if (args.nextSteps !== void 0 && !nextSteps) return {
-			ok: false,
-			error: "Invalid nextSteps"
-		};
-		const input = {
-			health,
-			summary,
-			progress,
-			risks,
-			nextSteps,
+		const caller = {
+			principalId: "agent:" + (deps.getCurrentAgentId?.() ?? "main"),
+			surface: "agent",
+			scopes: ["workspace.write"],
 			actor: {
 				kind: "agent",
-				agentId: deps.getCurrentAgentId?.(),
-				conversationId: deps.getCurrentConversationId?.()
-			}
-		};
-		if (dryRun) return {
-			ok: true,
-			dryRun: true,
-			action: "create_project_update",
-			projectId,
-			input
-		};
-		return {
-			ok: true,
-			update: projects.createUpdate(projectId, input),
-			project: projects.get(projectId)
+				id: deps.getCurrentAgentId?.()
+			},
+			authorize: deps.authorizeCapability ?? (() => true)
 		};
+		const result = await capabilities.call(operation, input, caller, {
+			...capabilities.describe(operation, caller),
+			idempotencyKey: trimString(args.idempotencyKey) ?? randomUUID()
+		});
+		return (command === "create_update" ? ProjectUpdateOutputSchema : command === "delete_milestone" ? ProjectMilestoneDeleteOutputSchema : ProjectMilestoneOutputSchema).parse(result);
 	}
 	return {
 		ok: false,
 		error: `Unsupported project command: ${command}`
 	};
 }
-async function handleAutomation(command, args, deps, dryRun) {
+async function handleAutomation(command, args, deps, dryRun, capabilities) {
 	const automations = deps.getAutomationService?.();
 	if (!automations) return {
 		ok: false,
 		error: "Automation service is unavailable"
 	};
-	if (command === "list") {
-		const projectId = currentProjectId(args, deps);
-		const projectError = automationProjectError(projectId, deps);
-		if (projectError) return {
-			ok: false,
-			error: projectError
-		};
-		return {
-			ok: true,
-			items: await automations.list({ projectId }),
-			...projectId ? { projectId } : {}
-		};
-	}
-	if (command === "get") {
-		const id = trimString(args.automationId) ?? trimString(args.id);
-		if (!id) return {
-			ok: false,
-			error: "automationId is required"
+	const invoke = async (operation, input) => {
+		const caller = {
+			principalId: `agent:${deps.getCurrentAgentId?.() ?? "main"}`,
+			surface: "agent",
+			scopes: ["automations.write"],
+			authorize: deps.authorizeCapability ?? (() => true)
 		};
-		const automation = await automations.get(id);
-		return automation ? {
+		try {
+			return (operation === "xopc.automations.delete" ? AutomationDeleteOutputSchema : operation === "xopc.automations.cancel" ? AutomationCancelOutputSchema : operation === "xopc.automations.read" ? AutomationReadOutputSchema : operation === "xopc.automations.read_all" ? AutomationReadAllOutputSchema : operation === "xopc.automations.run" || operation === "xopc.automations.rerun" ? AutomationRunMutationOutputSchema : AutomationMutationOutputSchema).parse(await capabilities.call(operation, input, caller, {
+				...capabilities.describe(operation, caller),
+				idempotencyKey: trimString(args.idempotencyKey) ?? randomUUID()
+			}));
+		} catch (error) {
+			if (error instanceof CapabilityError) return {
+				ok: false,
+				error: error.message,
+				code: error.code
+			};
+			throw error;
+		}
+	};
+	if (command === "cancel" || command === "read" || command === "read_all") {
+		const input = command === "read_all" ? AutomationReadAllInputSchema.parse({ projectId: trimString(args.projectId) }) : CapabilityResourceInputSchema.parse({ id: trimString(args.runId) ?? trimString(args.id) });
+		if (dryRun) return {
 			ok: true,
-			automation
-		} : {
-			ok: false,
-			error: `Automation not found: ${id}`
+			dryRun: true,
+			action: command,
+			input
 		};
+		return invoke(`xopc.automations.${command}`, input);
 	}
 	if (command === "create") {
 		const source = automationPayload(args, "automation");
 		const projectId = trimString(args.projectId) ?? trimString(source.projectId) ?? currentProjectId({}, deps);
-		const projectError = automationProjectError(projectId, deps);
-		if (projectError) return {
-			ok: false,
-			error: projectError
-		};
-		const input = CreateAutomationSchema.parse({
+		if (dryRun) {
+			const projectError = automationProjectError(projectId, deps);
+			if (projectError) return {
+				ok: false,
+				error: projectError
+			};
+		}
+		const input = AutomationCreateCapabilityInputSchema.parse({
 			...pickDefined(source, [
 				"id",
 				"name",
@@ -782,10 +709,10 @@ async function handleAutomation(command, args, deps, dryRun) {
 			input,
 			projectId
 		};
+		const result = await invoke("xopc.automations.create", input);
 		return {
-			ok: true,
-			automation: await automations.create(input),
-			...projectId ? { projectId } : {}
+			...result,
+			...result.ok && projectId ? { projectId } : {}
 		};
 	}
 	if (command === "update") {
@@ -795,7 +722,7 @@ async function handleAutomation(command, args, deps, dryRun) {
 			error: "automationId is required"
 		};
 		const source = automationPayload(args, "patch");
-		const patch = UpdateAutomationSchema.parse(pickDefined(source, [
+		const patch = AutomationUpdatePatchSchema.parse(pickDefined(source, [
 			"name",
 			"description",
 			"projectId",
@@ -809,11 +736,13 @@ async function handleAutomation(command, args, deps, dryRun) {
 			"reliability",
 			"state"
 		]));
-		const projectError = automationProjectError(patch.projectId, deps);
-		if (projectError) return {
-			ok: false,
-			error: projectError
-		};
+		if (dryRun) {
+			const projectError = automationProjectError(patch.projectId, deps);
+			if (projectError) return {
+				ok: false,
+				error: projectError
+			};
+		}
 		if (dryRun) return {
 			ok: true,
 			dryRun: true,
@@ -821,32 +750,34 @@ async function handleAutomation(command, args, deps, dryRun) {
 			automationId: id,
 			patch
 		};
-		const automation = await automations.update(id, patch);
-		return automation ? {
-			ok: true,
-			automation
-		} : {
+		if (args.idempotencyKey !== void 0 && args.expectedRevision === void 0) return {
+			ok: false,
+			error: "Idempotent automation changes require expectedRevision from the original read"
+		};
+		const expectedRevision = args.expectedRevision !== void 0 ? args.expectedRevision : (await automations.get(id))?.updatedAtMs;
+		if (expectedRevision === void 0) return {
 			ok: false,
 			error: `Automation not found: ${id}`
 		};
+		return invoke("xopc.automations.update", {
+			id,
+			patch,
+			expectedRevision
+		});
 	}
-	if (command === "history") {
-		const automationId = trimString(args.automationId) ?? trimString(args.id);
-		const projectId = automationId ? void 0 : currentProjectId(args, deps);
-		const projectError = automationProjectError(projectId, deps);
-		if (projectError) return {
+	if (command === "rerun") {
+		const runId = trimString(args.runId) ?? trimString(args.id);
+		if (!runId) return {
 			ok: false,
-			error: projectError
+			error: "runId is required"
 		};
-		return {
+		if (dryRun) return {
 			ok: true,
-			items: await automations.listRuns({
-				automationId,
-				projectId,
-				limit: boundedLimit(args.limit, 20, 50)
-			}),
-			...projectId ? { projectId } : {}
+			dryRun: true,
+			action: "rerun_automation",
+			runId
 		};
+		return invoke("xopc.automations.rerun", { id: runId });
 	}
 	if (![
 		"delete",
@@ -862,10 +793,37 @@ async function handleAutomation(command, args, deps, dryRun) {
 		ok: false,
 		error: "automationId is required"
 	};
-	const current = await automations.get(id);
-	if (!current) return {
-		ok: false,
-		error: `Automation not found: ${id}`
+	if (!dryRun && command === "run") return invoke("xopc.automations.run", { id });
+	if (!dryRun && command === "delete") {
+		if (args.idempotencyKey !== void 0 && args.expectedRevision === void 0) return {
+			ok: false,
+			error: "Idempotent deletion requires the original expectedRevision"
+		};
+		return invoke("xopc.automations.delete", {
+			id,
+			expectedRevision: args.expectedRevision !== void 0 ? args.expectedRevision : (await automations.get(id))?.updatedAtMs ?? null
+		});
+	}
+	if (!dryRun && (command === "pause" || command === "resume")) {
+		if (args.idempotencyKey !== void 0 && args.expectedRevision === void 0) return {
+			ok: false,
+			error: "Idempotent automation changes require expectedRevision from the original read"
+		};
+		const expectedRevision = args.expectedRevision !== void 0 ? args.expectedRevision : (await automations.get(id))?.updatedAtMs;
+		if (expectedRevision === void 0) return {
+			ok: false,
+			error: `Automation not found: ${id}`
+		};
+		return invoke("xopc.automations.set_enabled", {
+			id,
+			enabled: command === "resume",
+			expectedRevision
+		});
+	}
+	const current = await automations.get(id);
+	if (!current) return {
+		ok: false,
+		error: `Automation not found: ${id}`
 	};
 	if (dryRun) return {
 		ok: true,
@@ -874,75 +832,33 @@ async function handleAutomation(command, args, deps, dryRun) {
 		automationId: id,
 		automation: current
 	};
-	if (command === "delete") return {
-		ok: true,
-		removed: await automations.remove(id),
-		automation: current
-	};
-	if (command === "run") return {
-		ok: true,
-		automation: current,
-		run: await automations.runNow(id)
-	};
-	if (command === "pause" || command === "resume") {
-		const automation = command === "pause" ? await automations.pause(id) : await automations.resume(id);
-		return automation ? {
-			ok: true,
-			automation
-		} : {
-			ok: false,
-			error: `Automation not found: ${id}`
-		};
-	}
 	return {
 		ok: false,
 		error: `Automation command failed: ${command}`
 	};
 }
-async function handleNote(command, args, deps, dryRun) {
+async function handleNote(command, args, deps, dryRun, capabilities) {
 	const notes = deps.getNotesService?.();
 	if (!notes) return {
 		ok: false,
 		error: "Notes service is unavailable"
 	};
-	if (command === "list") {
-		const projectId = currentProjectId(args, deps);
-		return {
-			ok: true,
-			...await notes.listNotes({
-				status: enumValue(args.status, NOTE_STATUSES),
-				kind: enumValue(args.kind, NOTE_KINDS),
-				tag: trimString(args.tag),
-				projectId,
-				search: trimString(args.search),
-				pinned: typeof args.pinned === "boolean" ? args.pinned : void 0,
-				limit: boundedLimit(args.limit),
-				offset: offset(args.offset),
-				sortBy: enumValue(args.sortBy, new Set([
-					"createdAt",
-					"updatedAt",
-					"lastOpenedAt"
-				])),
-				sortOrder: enumValue(args.sortOrder, new Set(["asc", "desc"]))
-			}),
-			...projectId ? { projectId } : {}
-		};
-	}
-	if (command === "get") {
-		const id = trimString(args.noteId) ?? trimString(args.id);
-		if (!id) return {
-			ok: false,
-			error: "noteId is required"
-		};
-		const note = await notes.getNote(id);
-		return note ? {
-			ok: true,
-			note
-		} : {
-			ok: false,
-			error: `Note not found: ${id}`
+	const invoke = async (operation, input) => {
+		const context = {
+			principalId: `agent:${deps.getCurrentAgentId?.() ?? "main"}`,
+			surface: "agent",
+			scopes: ["workspace.write"],
+			authorize: deps.authorizeCapability ?? (() => true),
+			actor: {
+				kind: "agent",
+				id: deps.getCurrentAgentId?.() ?? "main"
+			}
 		};
-	}
+		return NoteGetOutputSchema.parse(await capabilities.call(operation, input, context, {
+			...capabilities.describe(operation, context),
+			idempotencyKey: trimString(args.idempotencyKey) ?? randomUUID()
+		}));
+	};
 	if (command === "create") {
 		const projectId = currentProjectId(args, deps);
 		const projectService = projectId ? deps.getProjectService?.() : void 0;
@@ -971,21 +887,9 @@ async function handleNote(command, args, deps, dryRun) {
 			input,
 			projectId
 		};
-		const note = await notes.createNote(input);
-		if (project) new ObjectLinkService().create({
-			id: `note:${note.id}:project:${project.id}`,
-			from: {
-				kind: "note",
-				id: note.id,
-				title: note.title
-			},
-			to: {
-				kind: "project",
-				id: project.id,
-				title: project.name
-			},
-			relation: "belongs_to",
-			source: "user"
+		const { note } = await invoke("xopc.notes.create", {
+			...input,
+			projectId
 		});
 		return {
 			ok: true,
@@ -1013,34 +917,15 @@ async function handleNote(command, args, deps, dryRun) {
 			heading,
 			content
 		};
-		const note = await notes.appendTextToNote(id, content, heading);
-		return note ? {
+		const { note } = await invoke("xopc.notes.append", {
+			id,
+			content,
+			heading,
+			expectedRevision: args.expectedRevision
+		});
+		return {
 			ok: true,
 			note
-		} : {
-			ok: false,
-			error: `Note not found: ${id}`
-		};
-	}
-	if (command === "preview_edit") {
-		const id = trimString(args.noteId) ?? trimString(args.id);
-		const instruction = trimString(args.instruction);
-		if (!id) return {
-			ok: false,
-			error: "noteId is required"
-		};
-		if (!instruction) return {
-			ok: false,
-			error: "instruction is required"
-		};
-		const markdown = typeof args.markdown === "string" ? args.markdown : void 0;
-		const result = await notes.createAiEditPatch(id, instruction, markdown);
-		return result ? {
-			ok: true,
-			...result
-		} : {
-			ok: false,
-			error: `Note not found: ${id}`
 		};
 	}
 	if (command === "update") {
@@ -1079,6 +964,10 @@ async function handleNote(command, args, deps, dryRun) {
 			ok: false,
 			error: "Invalid note status"
 		};
+		if (args.idempotencyKey !== void 0 && args.expectedRevision === void 0) return {
+			ok: false,
+			error: "Idempotent note updates require expectedRevision from the original read"
+		};
 		if (dryRun) return {
 			ok: true,
 			dryRun: true,
@@ -1086,14 +975,20 @@ async function handleNote(command, args, deps, dryRun) {
 			noteId: id,
 			patch
 		};
-		const note = await notes.updateNote(id, patch, "ai_edit");
-		return note ? {
-			ok: true,
-			note
-		} : {
+		const current = await notes.getNote(id);
+		if (!current) return {
 			ok: false,
 			error: `Note not found: ${id}`
 		};
+		const { note } = await invoke("xopc.notes.update", {
+			id,
+			patch,
+			expectedRevision: args.expectedRevision ?? current.remoteVersion ?? 1
+		});
+		return {
+			ok: true,
+			note
+		};
 	}
 	if (command === "delete") {
 		const id = trimString(args.noteId) ?? trimString(args.id);
@@ -1114,13 +1009,39 @@ async function handleNote(command, args, deps, dryRun) {
 				error: `Note not found: ${id}`
 			};
 		}
-		return await notes.deleteNote(id) ? {
-			ok: true,
-			removed: true,
-			noteId: id
-		} : {
+		if (args.idempotencyKey !== void 0 && args.expectedRevision === void 0) return {
 			ok: false,
-			error: `Note not found: ${id}`
+			error: "Stable retries require the original expectedRevision"
+		};
+		let expectedRevision = args.expectedRevision;
+		if (expectedRevision === void 0) {
+			const note = await notes.getNote(id);
+			if (!note) return {
+				ok: false,
+				error: `Note not found: ${id}`
+			};
+			expectedRevision = note.remoteVersion ?? 1;
+		}
+		const caller = {
+			principalId: `agent:${deps.getCurrentAgentId?.() ?? "main"}`,
+			surface: "agent",
+			scopes: ["workspace.write"],
+			authorize: deps.authorizeCapability ?? (() => true)
+		};
+		const operation = "xopc.notes.delete";
+		const result = NoteDeleteOutputSchema.parse(await capabilities.call(operation, {
+			id,
+			expectedRevision,
+			revokeShares: args.revokeShares
+		}, caller, {
+			...capabilities.describe(operation, caller),
+			idempotencyKey: trimString(args.idempotencyKey) ?? randomUUID()
+		}));
+		return {
+			ok: true,
+			removed: result.deleted,
+			noteId: id,
+			revokedShares: result.revokedShares
 		};
 	}
 	return {
@@ -1128,77 +1049,46 @@ async function handleNote(command, args, deps, dryRun) {
 		error: `Unsupported note command: ${command}`
 	};
 }
-async function handleTask(command, args, deps, dryRun) {
+async function handleTask(command, args, deps, dryRun, capabilities) {
 	const tasks = new TaskRepository();
-	const dependencies = new TaskDependencyService();
-	const context = new TaskContextRepository();
-	const runs = new TaskRunRepository();
-	const projector = new TaskReadModelProjector();
-	const deletion = new TaskDeletionService(tasks, runs);
-	if (command === "list") {
-		const projectId = currentProjectId(args, deps);
-		const phase = enumValue(args.phase, TASK_PHASES);
-		const priority = enumValue(args.priority, TASK_PRIORITIES);
-		const search = trimString(args.search)?.toLocaleLowerCase();
-		const start = offset(args.offset) ?? 0;
-		const limit = boundedLimit(args.limit);
-		const matching = (projectId ? tasks.listByProject(projectId, 200) : tasks.list({ limit: 200 })).filter((task) => (!phase || task.phase === phase) && (!priority || task.priority === priority) && (!search || `${task.title}\n${task.contract?.objective ?? ""}`.toLocaleLowerCase().includes(search)));
-		return {
-			ok: true,
-			items: matching.slice(start, start + limit),
-			total: matching.length,
-			...projectId ? { projectId } : {}
+	const deletion = new TaskDeletionService(tasks, new TaskRunRepository());
+	const invokeRelation = (operation, input) => {
+		const caller = {
+			principalId: `agent:${deps.getCurrentAgentId?.() ?? "main"}`,
+			surface: "agent",
+			scopes: ["tasks.write"],
+			actor: {
+				kind: "agent",
+				id: deps.getCurrentAgentId?.() ?? "main"
+			},
+			authorize: deps.authorizeCapability ?? (() => true)
 		};
-	}
-	if (command === "get") {
+		return capabilities.call(operation, input, caller, {
+			...capabilities.describe(operation, caller),
+			idempotencyKey: trimString(args.idempotencyKey) ?? randomUUID()
+		});
+	};
+	if (command === "delete") {
 		const id = trimString(args.taskId) ?? trimString(args.id);
 		if (!id) return {
 			ok: false,
 			error: "taskId is required"
 		};
-		const task = tasks.get(id);
-		if (!task) return {
-			ok: false,
-			error: `Task not found: ${id}`
-		};
-		const model = projector.project(task);
-		return {
+		const result = dryRun ? deletion.inspect(id) : TaskDeleteOutputSchema.parse(await invokeRelation("xopc.tasks.delete", {
+			taskId: id,
+			expectedVersion: args.expectedVersion
+		}));
+		if (result.ok === true) return dryRun ? {
 			ok: true,
-			task,
-			model,
-			operationalState: model.operationalState,
-			attention: model.attention,
-			allowedCommands: model.allowedCommands,
-			dependencies: dependencies.listDependencies(id),
-			dependents: dependencies.listDependents(id),
-			context: context.list(id),
-			authorityGrants: context.listActiveGrants(id),
-			runs: runs.listByTask(id),
-			receipts: runs.listReceipts(id),
-			waits: runs.listActiveWaits(id)
-		};
-	}
-	if (command === "delete") {
-		const id = trimString(args.taskId) ?? trimString(args.id);
-		if (!id) return {
-			ok: false,
-			error: "taskId is required"
+			dryRun: true,
+			action: "delete_task",
+			taskId: id,
+			task: result.task
+		} : {
+			ok: true,
+			removed: true,
+			taskId: id
 		};
-		const result = dryRun ? deletion.inspect(id) : deletion.delete(id);
-		if (result.ok === true) {
-			if (!dryRun) deps.dispatchTaskEvents?.();
-			return dryRun ? {
-				ok: true,
-				dryRun: true,
-				action: "delete_task",
-				taskId: id,
-				task: result.task
-			} : {
-				ok: true,
-				removed: true,
-				taskId: id
-			};
-		}
 		return result.reason === "active_run" ? {
 			ok: false,
 			error: "Cancel the active TaskRun before deleting the Task",
@@ -1326,17 +1216,26 @@ async function handleTask(command, args, deps, dryRun) {
 			input,
 			dependsOnTaskIds
 		};
-		const created = new TaskApplicationService().create(input, {
-			kind: "agent",
-			id: agentId
-		});
+		const capabilityContext = {
+			principalId: `agent:${deps.getCurrentAgentId?.() ?? "main"}`,
+			surface: "agent",
+			scopes: ["tasks.write"],
+			actor: {
+				kind: "agent",
+				id: deps.getCurrentAgentId?.() ?? "main"
+			},
+			authorize: deps.authorizeCapability ?? (() => true)
+		};
+		const { idempotencyKey, ...capabilityInput } = input;
+		const created = TaskMutationOutputSchema.parse(await capabilities.call("xopc.tasks.create", capabilityInput, capabilityContext, {
+			...capabilities.describe("xopc.tasks.create", capabilityContext),
+			idempotencyKey
+		}));
 		if (created.ok === false) return {
 			ok: false,
 			error: created.reason,
 			...created
 		};
-		if (created.runId) deps.dispatchTaskRuns?.();
-		else deps.dispatchTaskEvents?.();
 		return {
 			ok: true,
 			task: created.model.task,
@@ -1369,40 +1268,11 @@ async function handleTask(command, args, deps, dryRun) {
 			expectedVersion,
 			dependsOnTaskIds
 		};
-		try {
-			const task = runSqliteWriteTransaction((db) => {
-				const changed = dependencies.replace({
-					taskId: id,
-					dependsOnTaskIds,
-					expectedVersion
-				});
-				enqueueTaskChangedEvent(db, {
-					taskId: changed.id,
-					projectId: changed.projectId,
-					version: changed.version,
-					changedFields: ["dependencies"],
-					actor: {
-						kind: "agent",
-						id: deps.getCurrentAgentId?.()
-					}
-				});
-				return changed;
-			});
-			deps.dispatchTaskEvents?.();
-			return {
-				ok: true,
-				task,
-				dependencies: dependencies.listDependencies(id),
-				dependents: dependencies.listDependents(id)
-			};
-		} catch (error) {
-			if (!(error instanceof TaskDependencyError)) throw error;
-			return {
-				ok: false,
-				error: error.message,
-				reason: error.code
-			};
-		}
+		return invokeRelation("xopc.tasks.update_dependencies", {
+			taskId: id,
+			dependsOnTaskIds,
+			expectedVersion
+		});
 	}
 	if (command === "add_context") {
 		const id = trimString(args.taskId) ?? trimString(args.id);
@@ -1441,24 +1311,11 @@ async function handleTask(command, args, deps, dryRun) {
 			action: "add_task_context",
 			input
 		};
-		const task = tasks.require(id);
-		const edge = runSqliteWriteTransaction((db) => {
-			const created = context.add(input);
-			enqueueTaskChangedEvent(db, {
-				taskId: task.id,
-				projectId: task.projectId,
-				version: task.version,
-				changedFields: ["context"],
-				actor: input.createdBy
-			});
-			return created;
+		return invokeRelation("xopc.tasks.add_context", {
+			taskId: id,
+			edge: parsed.data,
+			expectedVersion: args.expectedVersion
 		});
-		deps.dispatchTaskEvents?.();
-		return {
-			ok: true,
-			edge,
-			context: context.list(id)
-		};
 	}
 	if (command === "remove_context") {
 		const id = trimString(args.taskId) ?? trimString(args.id);
@@ -1478,32 +1335,11 @@ async function handleTask(command, args, deps, dryRun) {
 			taskId: id,
 			edgeId
 		};
-		const task = tasks.get(id);
-		const actor = {
-			kind: "agent",
-			id: deps.getCurrentAgentId?.()
-		};
-		const removed = task ? runSqliteWriteTransaction((db) => {
-			const didRemove = context.remove(id, edgeId);
-			if (didRemove) enqueueTaskChangedEvent(db, {
-				taskId: task.id,
-				projectId: task.projectId,
-				version: task.version,
-				changedFields: ["context"],
-				actor
-			});
-			return didRemove;
-		}) : false;
-		if (removed) deps.dispatchTaskEvents?.();
-		return removed ? {
-			ok: true,
+		return invokeRelation("xopc.tasks.remove_context", {
 			taskId: id,
 			edgeId,
-			context: context.list(id)
-		} : {
-			ok: false,
-			error: `Task context edge not found: ${edgeId}`
-		};
+			expectedVersion: args.expectedVersion
+		});
 	}
 	if (command === "command") {
 		const id = trimString(args.taskId) ?? trimString(args.id);
@@ -1542,24 +1378,30 @@ async function handleTask(command, args, deps, dryRun) {
 			command: parsedCommand.data,
 			expectedVersion
 		};
-		const result = new TaskApplicationService().execute({
-			taskId: id,
-			idempotencyKey: trimString(args.idempotencyKey) ?? randomUUID(),
-			expectedVersion,
-			command: parsedCommand.data,
+		const capabilityContext = {
+			principalId: `agent:${deps.getCurrentAgentId?.() ?? "main"}`,
+			surface: "agent",
+			scopes: ["tasks.write"],
 			actor: {
 				kind: "agent",
-				id: deps.getCurrentAgentId?.()
-			}
-		});
+				id: deps.getCurrentAgentId?.() ?? "main"
+			},
+			authorize: deps.authorizeCapability ?? (() => true)
+		};
+		const result = TaskMutationOutputSchema.parse(await capabilities.call("xopc.tasks.command", {
+			taskId: id,
+			expectedVersion,
+			command: parsedCommand.data
+		}, capabilityContext, {
+			...capabilities.describe("xopc.tasks.command", capabilityContext),
+			idempotencyKey: trimString(args.idempotencyKey) ?? randomUUID()
+		}));
 		if (result.ok === false) return {
 			ok: false,
 			error: result.reason,
 			command: parsedCommand.data,
 			...result
 		};
-		if (result.runId) deps.dispatchTaskRuns?.();
-		else deps.dispatchTaskEvents?.();
 		return {
 			ok: true,
 			task: result.model.task,
@@ -1573,109 +1415,77 @@ async function handleTask(command, args, deps, dryRun) {
 		error: `Unsupported task command: ${command}`
 	};
 }
-async function handleTaskRun(command, args, dryRun, deps) {
-	const runs = new TaskRunRepository();
-	if (command === "list") {
-		const taskId = trimString(args.taskId);
-		if (!taskId) return {
-			ok: false,
-			error: "taskId is required"
-		};
-		const limit = boundedLimit(args.limit);
-		return {
-			ok: true,
-			taskId,
-			items: runs.listByTask(taskId).slice(0, limit),
-			receipts: runs.listReceipts(taskId, limit),
-			activeWaits: runs.listActiveWaits(taskId)
-		};
-	}
-	if (command === "get") {
-		const runId = trimString(args.runId) ?? trimString(args.id);
-		if (!runId) return {
-			ok: false,
-			error: "runId is required"
-		};
-		const run = runs.get(runId);
-		if (!run) return {
-			ok: false,
-			error: `TaskRun not found: ${runId}`
-		};
-		return {
-			ok: true,
-			run,
-			receipt: runs.getReceipt(runId),
-			events: runs.listEvents(runId),
-			activeWaits: runs.listActiveWaits(run.taskId)
-		};
-	}
-	if (command === "cancel") {
-		const runId = trimString(args.runId) ?? trimString(args.id);
-		const expectedVersion = finiteNumber(args.expectedVersion);
-		if (!runId) return {
-			ok: false,
-			error: "runId is required"
-		};
-		if (expectedVersion === void 0 || !Number.isInteger(expectedVersion) || expectedVersion < 1) return {
-			ok: false,
-			error: "expectedVersion is required"
-		};
-		const run = runs.get(runId);
-		if (!run) return {
-			ok: false,
-			error: `TaskRun not found: ${runId}`
-		};
-		if (run.version !== expectedVersion) return {
-			ok: false,
-			error: "TaskRun changed",
-			reason: "conflict",
-			run
-		};
-		const task = new TaskRepository().require(run.taskId);
-		const reason = trimString(args.reason) ?? "TaskRun cancelled by agent";
+async function handleTaskRun(command, args, dryRun, deps, capabilities) {
+	if (command === "feedback") {
+		const input = TaskRunFeedbackInputSchema.parse({
+			id: args.runId ?? args.id,
+			rating: args.rating,
+			reason: args.reason
+		});
 		if (dryRun) return {
 			ok: true,
 			dryRun: true,
-			action: "cancel_task_run",
-			runId,
-			expectedVersion,
-			reason
+			action: "task_run_feedback",
+			input
 		};
-		const result = new TaskApplicationService().completeRun({
-			runId,
-			expectedRunVersion: expectedVersion,
+		const caller = {
+			principalId: `agent:${deps.getCurrentAgentId?.() ?? "main"}`,
+			surface: "agent",
+			scopes: ["tasks.write"],
 			actor: {
 				kind: "agent",
 				id: deps.getCurrentAgentId?.()
 			},
-			terminalCode: "cancelled_by_agent",
-			terminalMessage: reason,
-			receipt: {
-				status: "cancelled",
-				summary: reason,
-				changes: [],
-				evidence: [],
-				verification: {
-					status: "unverified",
-					checks: []
-				},
-				remainingWork: [task.contract?.objective ?? task.title],
-				needsUser: false,
-				completionVerdict: "not_achieved"
-			}
-		});
-		if (result.ok === false) return {
-			ok: false,
-			error: result.reason,
-			...result
+			authorize: deps.authorizeCapability ?? (() => true)
 		};
-		deps.dispatchTaskEvents?.();
-		return {
-			ok: true,
-			run: runs.get(runId),
-			receipt: runs.getReceipt(runId),
-			model: result.model
+		const operation = "xopc.task_runs.feedback";
+		return TaskRunFeedbackOutputSchema.parse(await capabilities.call(operation, input, caller, {
+			...capabilities.describe(operation, caller),
+			idempotencyKey: trimString(args.idempotencyKey) ?? randomUUID()
+		}));
+	}
+	if (command === "cancel") {
+		const input = TaskRunCancelInputSchema.parse({
+			id: args.runId ?? args.id,
+			expectedVersion: args.expectedVersion,
+			reason: args.reason
+		});
+		if (dryRun) {
+			const run = new TaskRunRepository().get(input.id);
+			if (!run) return {
+				ok: false,
+				error: "TaskRun not found"
+			};
+			if (run.version !== input.expectedVersion) return {
+				ok: false,
+				error: "TaskRun changed",
+				reason: "conflict",
+				run
+			};
+			return {
+				ok: true,
+				dryRun: true,
+				action: "cancel_task_run",
+				runId: input.id,
+				expectedVersion: input.expectedVersion,
+				reason: input.reason
+			};
+		}
+		const caller = {
+			principalId: `agent:${deps.getCurrentAgentId?.() ?? "main"}`,
+			surface: "agent",
+			scopes: ["tasks.write"],
+			actor: {
+				kind: "agent",
+				id: deps.getCurrentAgentId?.()
+			},
+			authorize: deps.authorizeCapability ?? (() => true)
 		};
+		const operation = "xopc.task_runs.cancel";
+		return TaskRunCancelOutputSchema.parse(await capabilities.call(operation, input, caller, {
+			...capabilities.describe(operation, caller),
+			idempotencyKey: trimString(args.idempotencyKey) ?? randomUUID()
+		}));
 	}
 	return {
 		ok: false,
@@ -1688,25 +1498,6 @@ async function handleLocalApp(command, args, deps, dryRun) {
 		ok: false,
 		error: "Local app service is unavailable"
 	};
-	if (command === "list") return {
-		ok: true,
-		apps: localApps.list()
-	};
-	const id = trimString(args.localAppId) ?? trimString(args.id);
-	if (command === "get") {
-		if (!id) return {
-			ok: false,
-			error: "localAppId is required"
-		};
-		const app = localApps.get(id);
-		return app ? {
-			ok: true,
-			app
-		} : {
-			ok: false,
-			error: `Local app not found: ${id}`
-		};
-	}
 	if (command === "create") {
 		const name = trimString(args.name);
 		const idea = trimString(args.idea);
@@ -1734,57 +1525,31 @@ async function handleLocalApp(command, args, deps, dryRun) {
 			app: localApps.create(input)
 		};
 	}
-	if (command === "validate") {
-		if (!id) return {
-			ok: false,
-			error: "localAppId is required"
-		};
-		const app = localApps.get(id);
-		if (!app) return {
-			ok: false,
-			error: `Local app not found: ${id}`
-		};
-		return {
-			ok: true,
-			app,
-			validation: localApps.validate(id)
-		};
-	}
 	return {
 		ok: false,
 		error: `Unsupported local_app command: ${command}`
 	};
 }
-function handleSettings(command, args) {
-	if (command !== "open") return {
-		ok: false,
-		error: `Unsupported settings command: ${command}`
-	};
-	const section = trimString(args.section) ?? "overview";
-	if (!/^[a-z0-9][a-z0-9/_-]*$/i.test(section) || section.includes("..")) return {
-		ok: false,
-		error: "Invalid settings section"
-	};
-	return {
-		ok: true,
-		settings: {
-			section,
-			title: trimString(args.title) ?? "Settings",
-			summary: trimString(args.summary)
-		}
-	};
-}
 function createXopcUseTool(deps) {
+	const capabilities = createProductDispatcher(deps.getNotesService, {
+		getConfig: deps.getConfig,
+		getProjects: deps.getProjectService,
+		getWorkDiscovery: deps.getWorkDiscovery,
+		getLocalApps: deps.getLocalAppService,
+		getSceneAccess: deps.getSceneAccess,
+		getAutomations: deps.getAutomationService,
+		wake: deps.dispatchTaskRuns || deps.dispatchTaskEvents ? (runId) => runId ? deps.dispatchTaskRuns?.() : deps.dispatchTaskEvents?.() : void 0
+	});
 	return {
 		name: "xopc_use",
 		label: "XOPC Use",
-		description: "Operate first-class xopc objects through one safe entry point. Use for scenes, projects, automations, notes, tasks, TaskRuns, local apps, and exact settings jump targets instead of editing storage files directly. For non-trivial object changes, load the built-in manual first with tool_manual({ tool: \"xopc_use\" }).",
+		description: "Operate first-class xopc objects through one safe entry point. Local App capabilities takes extensionId and discovers already granted bindings. Local App invoke requires extensionId, the discovered manifestDigest, capabilityId and a pinned call {majorVersion, descriptorDigest, input, idempotencyKey for writes}. Never manufacture grants or change a retry key after an uncertain write. Use for scenes, projects, automations, notes, tasks, TaskRuns, local apps, and exact settings jump targets instead of editing storage files directly. For non-trivial object changes, load the built-in manual first with tool_manual({ tool: \"xopc_use\" }).",
 		parameters: XopcUseToolSchema,
 		mutatesWorkspace: true,
 		mutationScope: "external",
 		requiresExclusiveWorkspaceLock: true,
 		finalGuardRelevant: true,
-		async execute(toolCallId, input) {
+		async execute(toolCallId, input, signal) {
 			const mode = input.mode;
 			const command = input.command.trim();
 			const dryRun = input.dryRun === true;
@@ -1795,6 +1560,405 @@ function createXopcUseTool(deps) {
 				dryRun
 			};
 			if (!command) return errorText("command is required", details);
+			if (mode === "local_app" && (command === "capabilities" || command === "invoke")) {
+				const apps = deps.getLocalAppService?.();
+				if (!apps) return errorText("Local app service is unavailable", details);
+				if (typeof args.extensionId !== "string") return errorText("extensionId is required", details);
+				const manifestDigest = command === "capabilities" ? apps.getUiGrant(args.extensionId).manifestDigest : args.manifestDigest;
+				if (typeof manifestDigest !== "string") return errorText("A discovered manifestDigest is required", details);
+				const caller = {
+					principalId: `agent:${deps.getCurrentAgentId?.() ?? "main"}`,
+					surface: "agent",
+					scopes: ["gateway.admin"],
+					authorize: deps.authorizeCapability ?? (() => true),
+					signal
+				};
+				const runtime = localAppCapabilities(apps, capabilities, args.extensionId, manifestDigest, caller);
+				if (command === "capabilities") return okText({
+					...details,
+					result: runtime.list()
+				});
+				if (dryRun) return errorText("Use capabilities to inspect the pinned contract; invoke does not execute in dryRun", details);
+				if (typeof args.capabilityId !== "string") return errorText("capabilityId is required", details);
+				const call = CapabilityCallSchema.parse(args.call);
+				return okText({
+					...details,
+					result: await runtime.call(args.capabilityId, call)
+				});
+			}
+			if (mode === "context" && command === "resolve") {
+				const caller = {
+					principalId: `agent:${deps.getCurrentAgentId?.() ?? "main"}`,
+					surface: "agent",
+					scopes: ["gateway.admin"],
+					authorize: deps.authorizeCapability ?? (() => true),
+					signal
+				};
+				return okText({
+					...details,
+					result: await capabilities.call("xopc.context.resolve", args, caller)
+				});
+			}
+			if (mode === "scene" && ([
+				"configure",
+				"check",
+				"notes",
+				"work_item",
+				"update_work_item",
+				"schedule",
+				"set_preferences",
+				"feedback",
+				"mark_read",
+				"transition"
+			].includes(command) || command === "start" && !dryRun)) {
+				const operation = `xopc.scenes.${command}`;
+				const { requestId, idempotencyKey, workItemId, presentationId, ...fields } = args;
+				if (requestId !== void 0 && typeof requestId !== "string" || idempotencyKey !== void 0 && typeof idempotencyKey !== "string") return errorText("Request identity must be a string", details);
+				const projectedInput = command === "update_work_item" ? {
+					...fields,
+					id: workItemId ?? fields.id
+				} : command === "feedback" || command === "mark_read" ? {
+					...fields,
+					id: presentationId ?? fields.id
+				} : fields;
+				const parsed = SceneWriteContracts[operation].input.safeParse(projectedInput);
+				if (!parsed.success) {
+					const issue = parsed.error.issues[0];
+					const field = issue?.path.join(".") || "input";
+					const expected = issue?.code === "invalid_type" ? issue.expected : void 0;
+					return errorText(expected ? `${field} must be ${/^[aeiou]/.test(expected) ? "an" : "a"} ${expected}` : issue?.message ?? "Invalid input", details);
+				}
+				if (dryRun) return okText({
+					...details,
+					result: {
+						preview: true,
+						command,
+						input: parsed.data
+					}
+				});
+				const caller = {
+					principalId: `agent:${deps.getCurrentAgentId?.() ?? "main"}`,
+					surface: "agent",
+					scopes: ["gateway.admin"],
+					authorize: deps.authorizeCapability ?? (() => true),
+					signal
+				};
+				try {
+					const result = await capabilities.call(operation, parsed.data, caller, {
+						...capabilities.describe(operation, caller),
+						idempotencyKey: typeof idempotencyKey === "string" ? idempotencyKey : typeof requestId === "string" ? requestId : toolCallId
+					});
+					return okText({
+						...details,
+						result,
+						delivery: deliveryForXopcResult(mode, command, result, dryRun)
+					});
+				} catch (error) {
+					if (error instanceof CapabilityError) return errorText(error.message, details);
+					throw error;
+				}
+			}
+			if (mode === "scene" && ([
+				"templates",
+				"get_template",
+				"list",
+				"get",
+				"read_notes",
+				"list_runs",
+				"list_schedules",
+				"list_work_items",
+				"get_preferences",
+				"preflight",
+				"mail_accounts",
+				"mail_sources",
+				"results",
+				"get_presentation",
+				"get_feedback",
+				"digest_results",
+				"metrics",
+				"diagnostics"
+			].includes(command) || command === "start" && dryRun)) {
+				const caller = {
+					principalId: `agent:${deps.getCurrentAgentId?.() ?? "main"}`,
+					surface: "agent",
+					scopes: ["gateway.admin"],
+					authorize: deps.authorizeCapability ?? (() => true),
+					signal
+				};
+				const { id: _id, requestId: _requestId, triggerKey: _triggerKey, ...preflightInput } = args;
+				const result = await capabilities.call(`xopc.scenes.${command === "start" ? "preflight" : command}`, command === "start" || command === "preflight" ? preflightInput : command === "results" ? {
+					...preflightInput,
+					activationId: args.activationId ?? args.id
+				} : args, caller);
+				return okText({
+					...details,
+					result,
+					delivery: deliveryForXopcResult(mode, command, result, dryRun)
+				});
+			}
+			if (mode === "settings" && command === "open") {
+				const caller = {
+					principalId: `agent:${deps.getCurrentAgentId?.() ?? "main"}`,
+					surface: "agent",
+					scopes: ["gateway.status"],
+					authorize: deps.authorizeCapability ?? (() => true),
+					signal
+				};
+				const result = await capabilities.call("xopc.settings.open", args, caller);
+				return okText({
+					...details,
+					result,
+					delivery: deliveryForXopcResult(mode, command, result, dryRun)
+				});
+			}
+			if (mode === "local_app" && (command === "get" || command === "list" || command === "validate")) {
+				const caller = {
+					principalId: `agent:${deps.getCurrentAgentId?.() ?? "main"}`,
+					surface: "agent",
+					scopes: ["gateway.admin"],
+					authorize: deps.authorizeCapability ?? (() => true),
+					signal
+				};
+				const result = await capabilities.call(`xopc.local_apps.${command}`, command === "list" ? {} : { id: args.localAppId ?? args.id }, caller);
+				if (command === "validate") Object.assign(result, await capabilities.call("xopc.local_apps.get", { id: args.localAppId ?? args.id }, caller));
+				return okText({
+					...details,
+					result: {
+						ok: true,
+						...result
+					},
+					delivery: deliveryForXopcResult(mode, command, result, dryRun)
+				});
+			}
+			if (mode === "task" && command === "metrics") {
+				const caller = {
+					principalId: `agent:${deps.getCurrentAgentId?.() ?? "main"}`,
+					surface: "agent",
+					scopes: ["tasks.read"],
+					authorize: deps.authorizeCapability ?? (() => true),
+					signal
+				};
+				return okText({
+					...details,
+					result: await capabilities.call("xopc.tasks.metrics", {}, caller)
+				});
+			}
+			if (mode === "local_app" && command === "record_acceptance") {
+				const { idempotencyKey, localAppId, ...input } = args;
+				if (idempotencyKey !== void 0 && typeof idempotencyKey !== "string") return errorText("idempotencyKey must be a string", details);
+				const caller = {
+					principalId: `agent:${deps.getCurrentAgentId?.() ?? "main"}`,
+					surface: "agent",
+					scopes: ["gateway.admin"],
+					authorize: deps.authorizeCapability ?? (() => true),
+					signal
+				};
+				if (dryRun) return okText({
+					...details,
+					result: {
+						ok: true,
+						dryRun: true,
+						input
+					}
+				});
+				const operation = "xopc.local_apps.record_acceptance";
+				return okText({
+					...details,
+					result: await capabilities.call(operation, {
+						...input,
+						id: localAppId ?? input.id
+					}, caller, {
+						...capabilities.describe(operation, caller),
+						idempotencyKey: typeof idempotencyKey === "string" ? idempotencyKey : toolCallId
+					})
+				});
+			}
+			if (mode === "note" && [
+				"project_summaries",
+				"history",
+				"snapshot",
+				"preview_edit"
+			].includes(command)) {
+				const projectedInput = command === "project_summaries" ? {} : {
+					id: args.noteId ?? args.id,
+					...command === "snapshot" ? { timestamp: args.timestamp } : {},
+					...command === "preview_edit" ? {
+						instruction: args.instruction,
+						markdown: args.markdown
+					} : {}
+				};
+				const caller = {
+					principalId: `agent:${deps.getCurrentAgentId?.() ?? "main"}`,
+					surface: "agent",
+					scopes: ["workspace.read"],
+					authorize: deps.authorizeCapability ?? (() => true),
+					signal
+				};
+				const result = await capabilities.call(`xopc.notes.${command}`, projectedInput, caller);
+				return okText({
+					...details,
+					result: command === "preview_edit" ? {
+						ok: true,
+						...result
+					} : result,
+					delivery: deliveryForXopcResult(mode, command, result, dryRun)
+				});
+			}
+			if (mode === "automation" && [
+				"get_run",
+				"run_events",
+				"metrics",
+				"product_events"
+			].includes(command)) {
+				const projectedInput = command === "metrics" ? {} : command === "product_events" ? {
+					eventType: args.eventType,
+					source: args.source,
+					payloadKey: args.payloadKey,
+					payloadValue: args.payloadValue,
+					limit: args.limit
+				} : { id: args.runId ?? args.id };
+				const caller = {
+					principalId: `agent:${deps.getCurrentAgentId?.() ?? "main"}`,
+					surface: "agent",
+					scopes: ["automations.read"],
+					authorize: deps.authorizeCapability ?? (() => true),
+					signal
+				};
+				const result = await capabilities.call(`xopc.automations.${command}`, projectedInput, caller);
+				return okText({
+					...details,
+					result
+				});
+			}
+			if (mode === "automation" && [
+				"draft",
+				"repair_draft",
+				"simulate"
+			].includes(command)) {
+				const operation = `xopc.automations.${command}`;
+				const { idempotencyKey, ...input } = args;
+				if (idempotencyKey !== void 0 && typeof idempotencyKey !== "string") return errorText("idempotencyKey must be a string", details);
+				const caller = {
+					principalId: `agent:${deps.getCurrentAgentId?.() ?? "main"}`,
+					surface: "agent",
+					scopes: [command === "simulate" ? "automations.read" : "automations.write"],
+					authorize: deps.authorizeCapability ?? (() => true),
+					signal
+				};
+				if (dryRun && command !== "simulate") return okText({
+					...details,
+					result: {
+						ok: true,
+						dryRun: true,
+						input
+					}
+				});
+				return okText({
+					...details,
+					result: await capabilities.call(operation, input, caller, {
+						...capabilities.describe(operation, caller),
+						idempotencyKey: typeof idempotencyKey === "string" ? idempotencyKey : toolCallId
+					})
+				});
+			}
+			if (mode === "automation" && [
+				"get",
+				"list",
+				"history"
+			].includes(command)) {
+				const id = trimString(args.automationId) ?? trimString(args.id);
+				const projectId = command === "get" || command === "history" && id ? void 0 : currentProjectId(args, deps);
+				const projectedInput = command === "get" ? { id } : command === "list" ? { projectId } : {
+					automationId: id,
+					projectId,
+					limit: args.limit ?? 20
+				};
+				const caller = {
+					principalId: `agent:${deps.getCurrentAgentId?.() ?? "main"}`,
+					surface: "agent",
+					scopes: ["automations.read"],
+					authorize: deps.authorizeCapability ?? (() => true),
+					signal
+				};
+				const result = await capabilities.call(`xopc.automations.${command}`, projectedInput, caller);
+				return okText({
+					...details,
+					result,
+					delivery: deliveryForXopcResult(mode, command, result, dryRun)
+				});
+			}
+			if (mode === "project" && [
+				"get",
+				"list",
+				"list_milestones",
+				"list_updates"
+			].includes(command)) {
+				const id = args.projectId ?? args.id;
+				const projectedInput = command === "list" ? Object.fromEntries(Object.entries(args).filter(([key]) => key !== "conversationId")) : {
+					id,
+					...command === "list_updates" && args.limit !== void 0 ? { limit: args.limit } : {}
+				};
+				const context = {
+					principalId: `agent:${deps.getCurrentAgentId?.() ?? "main"}`,
+					surface: "agent",
+					scopes: ["workspace.read"],
+					authorize: deps.authorizeCapability ?? (() => true),
+					signal
+				};
+				const result = await capabilities.call(`xopc.projects.${command}`, projectedInput, context);
+				return okText({
+					...details,
+					result,
+					delivery: deliveryForXopcResult(mode, command, result, dryRun)
+				});
+			}
+			if ((mode === "note" || mode === "task" || mode === "task_run") && (command === "get" || command === "list")) {
+				const id = mode === "note" ? args.noteId ?? args.id : mode === "task_run" ? args.runId ?? args.id : args.taskId ?? args.id;
+				const projectId = mode === "task_run" ? void 0 : currentProjectId(args, deps);
+				const capabilityId = `xopc.${mode === "note" ? "notes" : mode === "task_run" ? "task_runs" : "tasks"}.${command}`;
+				const context = {
+					principalId: `agent:${deps.getCurrentAgentId?.() ?? "main"}`,
+					surface: "agent",
+					scopes: ["workspace.read", "tasks.read"],
+					allowedCapabilities: [
+						"xopc.notes.get",
+						"xopc.notes.list",
+						"xopc.tasks.get",
+						"xopc.tasks.list",
+						"xopc.task_runs.get",
+						"xopc.task_runs.list"
+					],
+					authorize: deps.authorizeCapability ?? (() => true),
+					signal
+				};
+				const input = command === "get" ? { id } : {
+					...Object.fromEntries(Object.entries(args).filter(([key]) => key !== "conversationId")),
+					...projectId ? { projectId } : {},
+					limit: args.limit ?? 20
+				};
+				const result = await capabilities.call(capabilityId, input, context);
+				const projected = mode === "task" && command === "list" ? {
+					...result,
+					items: result.items.map((item) => item.task)
+				} : mode === "task" && command === "get" ? {
+					...result,
+					model: {
+						task: result.task,
+						operationalState: result.operationalState,
+						attention: result.attention,
+						allowedCommands: result.allowedCommands
+					}
+				} : result;
+				return okText({
+					...details,
+					result: {
+						ok: true,
+						...projected,
+						...command === "list" && projectId ? { projectId } : {}
+					},
+					delivery: deliveryForXopcResult(mode, command, projected, dryRun)
+				});
+			}
 			try {
 				const conversationId = deps.getCurrentConversationId?.();
 				const agentId = deps.getCurrentAgentId?.();
@@ -1812,7 +1976,7 @@ function createXopcUseTool(deps) {
 						kind: "xopc_use",
 						toolCallId
 					}
-				}, async () => mode === "scene" ? await handleScene(command, args, deps, dryRun, toolCallId) : mode === "project" ? await handleProject(command, args, deps, dryRun) : mode === "automation" ? await handleAutomation(command, args, deps, dryRun) : mode === "note" ? await handleNote(command, args, deps, dryRun) : mode === "task" ? await handleTask(command, args, deps, dryRun) : mode === "task_run" ? await handleTaskRun(command, args, dryRun, deps) : mode === "local_app" ? await handleLocalApp(command, args, deps, dryRun) : mode === "settings" ? handleSettings(command, args) : {
+				}, async () => mode === "scene" ? await handleScene(command, args, deps, dryRun) : mode === "project" ? await handleProject(command, args, deps, dryRun, capabilities) : mode === "automation" ? await handleAutomation(command, args, deps, dryRun, capabilities) : mode === "note" ? await handleNote(command, args, deps, dryRun, capabilities) : mode === "task" ? await handleTask(command, args, deps, dryRun, capabilities) : mode === "task_run" ? await handleTaskRun(command, args, dryRun, deps, capabilities) : mode === "local_app" ? await handleLocalApp(command, args, deps, dryRun) : {
 					ok: false,
 					error: `Unsupported mode: ${String(mode)}`
 				});
@@ -1827,93 +1991,18 @@ function createXopcUseTool(deps) {
 		}
 	};
 }
-async function handleScene(command, args, deps, dryRun, toolCallId) {
+async function handleScene(command, args, deps, dryRun) {
+	if (command !== "mail_search") throw new Error("Unsupported scene command");
 	const access = deps.getSceneAccess?.();
 	if (!access) throw new Error("Scene service is unavailable");
 	const { services, principal } = access;
-	const { id, requestId, triggerKey, ...input } = args;
-	const activationId = typeof id === "string" ? id : "";
-	const request = typeof requestId === "string" && requestId.trim() ? requestId : toolCallId;
-	if (command === "templates") return { templates: services.repository.listTemplates() };
-	if (command === "list") return { activations: services.repository.listActivations(principal) };
-	if (command === "get") return {
-		activation: services.repository.getActivation(principal, activationId),
-		runs: services.repository.listRuns(principal, activationId),
-		schedules: services.repository.listSchedules(principal, activationId)
+	if (!services.mailDiscovery) throw new Error("Mail search is unavailable");
+	if (dryRun) return {
+		preview: true,
+		command,
+		input: args
 	};
-	if (command === "mail_accounts") return { accounts: services.mailDiscovery?.listAccounts(principal) ?? [] };
-	if (command === "mail_search") {
-		if (!services.mailDiscovery) throw new Error("Mail search is unavailable");
-		if (dryRun) return {
-			preview: true,
-			command,
-			input
-		};
-		return { sources: await services.mailDiscovery.searchSources(principal, input, AbortSignal.timeout(15e3)) };
-	}
-	if (command === "read_notes") return { notes: services.repository.readNotes(principal, activationId) };
-	if (command === "mail_sources") return { sources: services.mail.listSources(principal) };
-	if (command === "results") return { outcomes: services.repository.listInbox(principal, 50, "", activationId || null) };
-	if (command === "diagnostics") return services.metrics.diagnostics(principal);
-	if (command === "get_preferences") return services.preferences.get(principal);
-	if (command === "preflight" || command === "start" && dryRun) return services.application.preflight(principal, input);
-	if (dryRun) {
-		if (command === "set_preferences") return {
-			preview: true,
-			command,
-			input: args
-		};
-		if (command === "update_work_item") return {
-			preview: true,
-			command,
-			workItemId: args.workItemId ?? id,
-			input
-		};
-		if (command === "feedback" || command === "mark_read") return {
-			preview: true,
-			command,
-			presentationId: args.presentationId ?? id,
-			input
-		};
-		services.repository.getActivation(principal, activationId);
-		return {
-			preview: true,
-			command,
-			activationId,
-			input
-		};
-	}
-	if (command === "start") return { activation: await services.application.start(principal, input, request) };
-	if (command === "configure") return { activation: services.application.configure(principal, activationId, input) };
-	if (command === "transition") return { activation: await services.application.transition(principal, activationId, input) };
-	if (command === "check") return { intentId: services.application.check(principal, activationId, request) };
-	if (command === "notes") return { revision: services.application.writeNotes(principal, activationId, input) };
-	if (command === "work_item") return { workItem: services.application.createWorkItem(principal, activationId, input) };
-	if (command === "update_work_item") {
-		const workItemId = typeof args.workItemId === "string" ? args.workItemId : activationId;
-		const { workItemId: _workItemId, ...workItemInput } = args;
-		return { workItem: services.application.updateWorkItem(principal, workItemId, workItemInput) };
-	}
-	if (command === "schedule") return { revision: services.application.setSchedule(principal, activationId, String(triggerKey ?? ""), input) };
-	if (command === "set_preferences") return services.preferences.update(principal, args);
-	if (command === "feedback") {
-		const presentationId = typeof args.presentationId === "string" ? args.presentationId : activationId;
-		if (!presentationId.trim()) throw new Error("presentationId is required");
-		const { presentationId: _presentationId, ...feedbackInput } = args;
-		return { revision: services.inbox.feedback(principal, presentationId, feedbackInput) };
-	}
-	if (command === "mark_read") {
-		const presentationId = typeof args.presentationId === "string" ? args.presentationId : activationId;
-		if (!presentationId.trim()) throw new Error("presentationId is required");
-		if (typeof args.read !== "boolean") throw new Error("read must be a boolean");
-		services.inbox.setRead(principal, presentationId, args.read);
-		return {
-			ok: true,
-			presentationId,
-			read: args.read
-		};
-	}
-	throw new Error("Unsupported scene command");
+	return { sources: await services.mailDiscovery.searchSources(principal, args, AbortSignal.timeout(15e3)) };
 }
 //#endregion
 export { createXopcUseTool };