@zackbart/connecta 0.31.0 → 0.33.0

package/documentation/integrating.md

@@ -1,16 +1,62 @@
 # Integrating services
 
-Use this guide to add a connector to deployment configuration. To implement a
-new maintained provider in Connecta itself, follow the repository's
-[add-provider skill](https://github.com/zackbart/connecta/blob/main/.claude/skills/add-provider/SKILL.md)
-and [AGENTS.md](https://github.com/zackbart/connecta/blob/main/AGENTS.md).
+Use this guide to change connectors in deployment configuration.
 [All agent routes](./README.md) are in the index.
 
+## Add or remove a connector
+
+Connectors are code-owned. Edit the deployment's `src/connecta.config.ts`;
+there is no install button or runtime registration API.
+
+To add one:
+
+1. Choose a maintained provider, `remoteMcp()`, or `api()` using the sections
+   below. Give it a unique, stable id such as `crm`; renaming an id selects
+   different stored credentials and changes every tool address.
+2. Put the constructed connector in `connectors`. Keep secrets in environment
+   variables or the encrypted vault. Choose shared or personal auth explicitly
+   for the intended audience; agents cannot see personal-auth connectors.
+3. Add the id (all its tools) or exact `id.tool` addresses to the intended
+   pools' `tools`. Maintainers at plain `/mcp` already see the whole catalog.
+   Follow [the agent pool layout](./auth.md#organizing-an-agents-pools) for an
+   agent: shared connectors go in its base constant, per-user connectors only
+   in that user's pool.
+4. Run the deployment's `npm run typecheck` (Worker copies: `tsc --noEmit`),
+   restart Node or redeploy the Worker, and
+   [connect its credential](./auth.md#connect-a-shared-credential) if needed.
+   Run [doctor](./deploying.md#verify-and-diagnose), discover its tools from
+   the intended pool, and perform a bounded read. Check an excluded pool too.
+
+For example, merge this fragment into the existing configuration, retaining
+its storage, executor, auth, and `readOnly` settings:
+
+```ts
+import { remoteMcp } from "@zackbart/connecta";
+
+const crm = remoteMcp("crm", {
+  url: "https://crm.example.com/mcp",
+  authScope: "shared",
+  auth: { type: "credential", credential: { label: "CRM API token" } },
+});
+const assistant = { tools: ["crm", "tickets"], members: ["agent:assistant"] };
+// connectors: [crm, tickets], agents: ["assistant"], pools: { assistant }
+```
+
+To remove `crm`, first disconnect its OAuth grant or delete its saved
+credential while the connector still exists, using a signed-in maintainer
+for shared auth. Each person disconnects their own personal account. Remove
+`crm` and all `crm.*` addresses from every pool (including base constants),
+then remove its entry from `connectors`, unused imports, and unused secret
+configuration. Remove any pools left with no tools (empty `tools` fails
+construction), and update or retire clients pointing at those pools. Typecheck, restart/redeploy, run doctor, and confirm discovery
+and calls no longer find it. Removing configuration alone does not revoke a
+credential at the downstream service; revoke unused credentials there too.
+
 ## Choose a connector
 
 | Need                             | Configuration path                                | Check before using                                                                    |
 | -------------------------------- | ------------------------------------------------- | ------------------------------------------------------------------------------------- |
-| A maintained integration         | Its `@zackbart/connecta/providers/<name>` factory | Provider `SKILL.md`, options, auth ownership, supported tools                         |
+| A maintained integration         | Its `@zackbart/connecta/providers/<name>` factory | Published factory declarations, auth ownership, supported tools                       |
 | Another hosted remote MCP server | `remoteMcp()` from the root package               | Endpoint, authentication, current catalog, and read/write annotations                 |
 | A selected HTTP API capability   | `api()` from the root package                     | Input/output schemas, explicit read/write hints, bounded handler, credential handling |
 
@@ -19,6 +65,14 @@ registry enforcement, caller grants, result bounds, and activity paths. There
 is no runtime installation or registration. Keep connector IDs unique and
 stable because they prefix canonical `<connectorId>.<toolName>` addresses.
 
+`callAdmission` is optional on `remoteMcp()`, `api()`, custom connectors, and
+provider variants that expose an override. Only omission or `undefined` uses
+the connector's documented default, which may be no admission. Every defined
+value is validated at construction. Malformed policies, including `false`,
+`null`, `0`, and `""`, throw before serving requests; they never disable
+admission or select a default. Custom connector policies are validated when
+the deployment constructs its registry.
+
 ## Maintained integrations
 
 Import a provider individually. For example, Linear requires an explicit
@@ -35,20 +89,30 @@ const tracker = linear("tracker", {
 ```
 
 Linear defaults to OAuth; its read-only endpoint requests only the downstream
-read scope. That is separate from Connecta pool trust. Read the
-[Linear skill](https://github.com/zackbart/connecta/blob/main/src/providers/linear/SKILL.md)
-and [factory options](https://github.com/zackbart/connecta/blob/main/src/providers/linear/index.ts)
-for API-key framing, workspace instructions, and admission choices.
+read scope. That is separate from a Connecta `readOnly` endpoint. Read the installed `dist/providers/linear/index.d.ts` for API-key framing,
+workspace instructions, and admission choices.
 
 The [human README](../README.md#what-you-can-do-with-it) lists available
-integrations. Each [provider folder](https://github.com/zackbart/connecta/tree/main/src/providers)
-contains its scoped guide, options, tests, fixtures, and review data. Prefer
-that guide to general assumptions about a service's API. Google Workspace
+integrations. In the installed package, `dist/providers/<name>/index.d.ts`
+and its imported declarations describe each factory's options. After adding
+a connector, use `search_tools` to discover its current tools and `connecta.skill("connector:<id>")` in `execute_code`
+to read its runtime guide; provider source skills are not installed files.
+Google Workspace
 providers require administrator-managed domain-wide delegation and a deployment
-mapping from admitted identity to the downstream account; a request must not
-choose its own account. Gmail never sends mail, and Drive never permanently
+mapping from admitted identity to the downstream account; an agent acts as its
+pool's `owner` instead ([auth guide](auth.md#pool-owners-for-google-workspace)).
+A request must not choose its own account. Gmail never sends mail, and Drive never permanently
 deletes files.
 
+Wispr Flow uses OAuth only through `wisprFlow()` from
+`@zackbart/connecta/providers/wispr-flow`. It reaches the authorized account's
+Notetaker content, with personal and work accounts holding separate data.
+Its runtime guide, available through `connecta.skill("connector:<id>")` in `execute_code`, describes account access,
+search limits, transcript permissions and paging. The
+reviewed classification includes task writes listed in Claude's directory even
+though Wispr's public help describes read-only access; discover the account's
+actual tools before assuming those writes exist.
+
 Stripe requires `auth`: `{ type: "oauth" }` reaches Stripe's hosted MCP
 server, and `{ type: "apiKey" }` with `mode` reaches Connecta's REST connector
 with an operator-managed key. Notion requires `auth` the same way:
@@ -66,6 +130,58 @@ MCP clients to its hosted server, an operational gate outside Connecta. See the
 To use both implementations of one provider, configure two connector ids with
 independent credentials.
 
+Both Notion auth variants accept optional `callAdmission`. For a token
+connector it replaces the whole per-runtime default of 180 calls per minute
+and 3 concurrent. Notion's [request limits](https://developers.notion.com/reference/request-limits)
+allow 600 requests per minute per connection on Business and Enterprise and
+180 on other plans. A separate workspace-wide limit is shared by all
+connections. Size an override for other runtime traffic and tools that make
+multiple HTTP requests. Only an omitted or `undefined` policy selects the
+default; malformed policies, including `false`, `null`, `0`, and `""`, throw
+at construction on both auth variants.
+
+Planning Center's `excludeApps` removes whole products from a connection, for
+example `planningCenter("pco", { purpose, excludeApps: ["giving"] })` for a
+deployment that keeps agents away from donor and financial data. Excluded
+products lose their named tools, guide text, and version pins, and the
+`pco_api_get` and `pco_api_mutate` hatches refuse their paths before sending.
+The check reads the exact URL the transport would fetch, and while any product
+is excluded a hatch path must be literal: dot segments, empty segments,
+backslashes, whitespace, and percent-encoded `/`, `\`, `?`, `#`, or `%` are
+refused rather than normalized.
+
+Exclusion also closes the routes through which the excluded product's data is
+reachable through another product. While any product is excluded the connection removes
+`list_lists`, `list_list_people`, and `run_list` and refuses every People list,
+list result, rule, and condition, by path or `include`, because a list's
+conditions can draw on any product, such as a donor list built from Giving
+donations, and lists can depend on other lists. Planning Center publishes a
+list's conditions, but a reliable check would have to follow every nested list,
+so the connection does not attempt one. It refuses webhook event and delivery
+payloads, since a payload can carry any product's records, and every change to
+an existing webhook subscription by id, since the id does not name its product.
+A new subscription must name a reachable product's event. People cannot be
+excluded.
+
+What exclusion guarantees is that agents reach none of the excluded product's
+endpoints, no live cross-product query such as a People list, and no webhook
+payload or change to an existing subscription. It does not hide records that the church's own
+automations or staff have copied into a reachable product. A
+[Giving automation](https://help.planningcenter.com/en/144355-automations-in-giving.html)
+can add first-time donors to a People workflow, and those workflow cards stay
+readable, as do donor details recorded in notes, custom fields, or form
+answers. Those are People data once written, so the connection does not refuse
+them by guessing at their origin.
+
+For a hard boundary, give the connection a personal access token belonging to a
+Planning Center user with No Access in the excluded product. Planning Center
+sets permissions per product for each user, does not grant Giving to
+organization administrators automatically, and lets People workflows be shared
+per workflow; a token carries its user's permissions, so Planning Center itself
+refuses what that user cannot see. `excludeApps` is defense in depth on top of
+that boundary: it narrows what Connecta exposes, not what the token can do
+elsewhere.
+
 ## Another remote MCP server
 
 Declare its endpoint and intended auth mode. This fragment uses a server-stored
@@ -79,8 +195,8 @@ const service = remoteMcp("service", {
   description: "Our team's hosted service",
   auth: { type: "credential" },
 });
-// Add service to connectors. Configure the vault and permitted operators
-// before supplying its credential through the operator UI.
+// Add service to connectors. Configure the vault; a signed-in maintainer
+// supplies its credential through the operator UI.
 ```
 
 Credential auth defaults to an `Authorization: Bearer` header. Choose framing
@@ -137,19 +253,20 @@ which binds the grant to configured API origins and manages authentication.
 [Downstream OAuth on api()](./auth.md#downstream-oauth-on-api) owns a concrete
 HTTP example and the client setup contract.
 
-Mark every side-effecting tool `readOnlyHint: false`. On read-only endpoints
-writes use `call_destructive_tool`; trusted programs may write within their
-grants. Host approval is independent of tool definition. Use declared output
+Mark every side-effecting tool `readOnlyHint: false`. On a writable endpoint
+writes use `call_destructive_tool` or a program, within the caller's grants; a
+`readOnly` endpoint refuses them and omits them from search. Client approval is independent of
+tool definition. Use declared output
 schemas when known; runtime observations cannot replace them.
 
 ## Separate ownership from visibility
 
 `authScope: "shared"` uses deployment-owned downstream auth; `"personal"` uses
 the admitted principal's partition. Visibility is a different decision,
-controlled by identity and pool grants. A personal connector must not close
+controlled by maintainers and pool membership. A personal connector must not close
 over a shared secret or derive its owner from arguments. Remote MCP refuses
 literal header credentials with personal scope. Review
-[principals and grants](./auth.md#principals-visibility-and-operators) and
+[maintainers and members](./auth.md#principals-visibility-and-operators) and
 [management permissions](./auth.md#management-permissions) before exposing a
 new integration or its authentication controls.
 
@@ -158,7 +275,13 @@ perform a bounded read. Add negative checks for target restrictions and writes
 when authoring a handler or provider. Follow repository verification policy
 when changing package code.
 
-## Implementation and evidence
+## Contributor reference
+
+### Implementation and evidence
+
+To implement a maintained provider in Connecta itself, follow the repository's
+[add-provider skill](https://github.com/zackbart/connecta/blob/main/.claude/skills/add-provider/SKILL.md)
+and [AGENTS.md](https://github.com/zackbart/connecta/blob/main/AGENTS.md).
 
 Factory contracts live in [remote MCP](https://github.com/zackbart/connecta/blob/main/src/connectors/remote-mcp.ts),
 [API connector](https://github.com/zackbart/connecta/blob/main/src/connectors/api-connector.ts),

package/documentation/meta-tools.md

@@ -2,7 +2,7 @@
 
 Connecta keeps one small tool surface in model context and resolves downstream
 tools behind it. `search_tools` finds addresses, the call tools enforce the
-stored classification, `execute_code` runs programs under pool trust, and `connecta.result` inside programs
+stored classification, `execute_code` runs programs on a writable or read-only endpoint, and `connecta.result` inside programs
 pages bounded results.
 
 This guide is the contract an MCP client sees. The in-program `connecta.*` API
@@ -31,10 +31,13 @@ configuration adds a seventh or removes one, so a client's cached tool list
 never depends on the storage behind the deployment. There was an eighth,
 `resume_execution`, while programs paused at writes; it left with pausing
 ([#672](https://github.com/zackbart/connecta/issues/672)). `execute_code`
-is annotated `readOnlyHint: true, destructiveHint: false` on a `read-only`
-endpoint, and `readOnlyHint: false, destructiveHint: true` on a `trusted`
-endpoint. Approval belongs to the host. Pool trust never changes connector
-visibility or tool grants. The four tools with structured-only success results
+is annotated `readOnlyHint: true, destructiveHint: false` on a read-only
+endpoint, and `readOnlyHint: false, destructiveHint: true` on a writable one.
+Approval belongs to the client. A read-only endpoint keeps all six tools, omits
+write tools from `search_tools` results and describe, and refuses every write
+call; `readOnly` never changes connector visibility or read grants. Guides
+(`queryAnalysis.guideSummary`, `skills`, `connecta.skill`, skill
+`resources/read`) are documentation and may name tools the endpoint refuses. The four tools with structured-only success results
 advertise `outputSchema`. The two direct-call tools omit it because their default
 mode returns native `content`. Default-mode successes declare
 `_meta["dev.connecta/format"]: "json" | "text"`; value mode places the value in
@@ -70,9 +73,11 @@ credentials, logs, or raw error text.
 
 Connecta's discovery tools carry read-only hints. `authorize_connector`
 requests interactive authentication changes; `call_destructive_tool` sends
-writes and is annotated destructive. `execute_code` reports the selected pool's
-trust in its description and annotations. Its host may approve the whole
-program on a trusted endpoint. `call_destructive_tool.reason` is dropped before
+writes and is annotated destructive. `execute_code` states whether the endpoint
+is read-only or writable in its description and annotations. On a writable
+endpoint the client may approve the whole program as a write. On a read-only
+endpoint, the `call_tool`, `call_destructive_tool`, and `search_tools`
+descriptions say so too; `call_destructive_tool` still runs reads there. `call_destructive_tool.reason` is dropped before
 anything runs.
 
 ## Routing between the call surfaces
@@ -93,12 +98,16 @@ page the completed direct-call result or oversized program return with
 `connecta.result` after the write runs once. Sampling or slicing a write's output
 inside the program can still discard the answer.
 
-A `trusted` pool lets the same program discover and dispatch writes.
-A `read-only` pool refuses writes before validation or dispatch with
-`destructive_tool_requires_approval` and a `nextAction` naming
-`call_destructive_tool` and the canonical address. Each write then uses its
-own top-level call. Connecta never pauses, replays, or approves a program.
-Top-level discovery remains available for catalog inspection and write routing.
+On a writable endpoint the same program discovers and dispatches writes, capped
+by `execute.maxWrites`, and `call_destructive_tool` sends one known write. On a
+read-only endpoint nothing writes: `search_tools`, `connecta.search`, and
+`connecta.describe` omit write tools as if the connector lacked them, and
+every write call through `call_tool`, `call_destructive_tool`, or a program is
+refused before validation or dispatch with `read_only_endpoint`,
+`retryable: false`, and no `nextAction`. Connector guides are not filtered and
+may still name such a write. No route on that endpoint writes; the agent
+reports it. Connecta
+never pauses, replays, or approves a program.
 
 Both search routes return the flat page specified under
 [lexical discovery](#lexical-discovery), using the catalog's shared output schema.
@@ -129,14 +138,14 @@ Read-only lookup belongs in `connecta.search` inside the program; top-level
 `search_tools` stays for explicit catalog inspection and approval-required
 discovery. Both take the same arguments.
 
-| Argument           | What it does                                                                                                                                                                                                                                                            |
-| ------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `query`            | two to four action/object terms; empty or whitespace-only browses                                                                                                                                                                                                       |
-| `connector`        | scopes to one id, loading that catalog alone instead of fanning out across every configured connector. Set it when the integration is obvious, omit it when the right one is genuinely ambiguous                                                                        |
-| `safety`           | `"readOnly"` selects stored `read` verdicts; `"approvalRequired"` selects stored `write` verdicts; omitted or `"all"` selects both. Each row carries `classification: "read" \| "write"`. These legacy filter names do not describe host approval policy or pool trust. |
-| `limit` / `offset` | page the ranked results; omit `limit` initially so the default eight-result page stays small                                                                                                                                                                            |
-| `includeSchemas`   | `"compact"` for the rendered routing view, `"json"` for the exact schema, `"typescript"` for a function signature ([below](#typescript-signatures))                                                                                                                     |
-| `fullDescriptions` | unabridged tool purposes, at the obvious cost                                                                                                                                                                                                                           |
+| Argument           | What it does                                                                                                                                                                                                                                                                                        |
+| ------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `query`            | two to four action/object terms; empty or whitespace-only browses                                                                                                                                                                                                                                   |
+| `connector`        | scopes to one id, loading that catalog alone instead of fanning out across every configured connector. Set it when the integration is obvious, omit it when the right one is genuinely ambiguous                                                                                                    |
+| `safety`           | `"readOnly"` selects stored `read` verdicts; `"approvalRequired"` selects stored `write` verdicts; omitted or `"all"` selects both. Each row carries `classification: "read" \| "write"`. These legacy filter names do not describe client approval policy; a read-only endpoint has no write rows. |
+| `limit` / `offset` | page the ranked results; omit `limit` initially so the default eight-result page stays small                                                                                                                                                                                                        |
+| `includeSchemas`   | `"compact"` for the rendered routing view, `"json"` for the exact schema, `"typescript"` for a function signature ([below](#typescript-signatures))                                                                                                                                                 |
+| `fullDescriptions` | unabridged tool purposes, at the obvious cost                                                                                                                                                                                                                                                       |
 
 Neither `connector` nor `safety` grants authority or changes invocation
 admission; they select what discovery shows and nothing else.
@@ -185,8 +194,7 @@ discovery made the same bet).
 ```
 
 It is something to read, not something that runs: programs stay JavaScript,
-and `execute_code` accepts no erasable TypeScript
-([decision history](https://github.com/zackbart/connecta/blob/main/decisions/0001-ethos-verdict-table.md)). The output half is the provider's declared
+and `execute_code` accepts no erasable TypeScript. The output half is the provider's declared
 schema, else an `S9` observation that opens with the
 `/* observed, not declared */` marker and keeps the `outputSchemaSource`
 field, else `unknown` — runtime evidence never reads as a contract, even when
@@ -273,7 +281,7 @@ is its slug; other IDs use `connector-` followed by a stable SHA-256 prefix.
 The suffix makes each
 document a valid Agent Skills file; the roots `skill://connecta/usage` and
 `skill://connecta/connectors/<connector-id>` also resolve. Provider guides are
-built from the generated `src/providers/*/SKILL.md` content with the existing
+built from maintained provider guides with the existing
 connection context and deployment instructions. Local manifests contain a
 SHA-256 digest and UTF-8 byte size of the complete document. `usage` and
 `investigate` remain compatibility names; `connector:<id>` remains a
@@ -381,7 +389,7 @@ caught catalog-load errors, unknown-tool failures, and recovery messages that
 list visible connectors or local guides. Returns with no downstream calls still
 require matching identity, origin and endpoint, current auth, and pool membership. A page must
 match those bindings and pass current auth, connector/tool grants, pool membership,
-and trust checks. Old entries lacking bindings fail closed. A random UUID is a
+and read-only checks. Old entries lacking bindings fail closed. A random UUID is a
 handle, never an access grant.
 
 New entries store UTF-8 bytes in a base64 envelope split across storage keys,
@@ -512,13 +520,10 @@ format: "text", text }`. The page size is clamped to the original call's inline
 cap and a 32 KiB program bridge ceiling, with UTF-8 alignment and forward progress. Reassemble inside the sandbox;
 returning pages unchanged can hit the program result cap. The admitted subject
 and principal, endpoint/pool, request origin, connector, and tool bindings must
-match. The host rechecks current access and trust before returning each page; a
-read-only endpoint cannot read a write stash. Caller arguments select no partition.
-
-A write on a read-only endpoint returns an inline truncation notice and any
-usable bounded preview. It says paging is unavailable and the write already
-ran; it carries no result handle or recovery action and stores no unreachable
-stash. Write paging remains available on trusted endpoints.
+match. The host rechecks current access and whether the endpoint is read-only
+before returning each page; a read-only endpoint cannot read a write stash.
+Caller arguments select no partition. A read-only endpoint never runs a write,
+so every write result it could page came from a writable endpoint.
 
 A refused stash write cannot undo a downstream success. Direct calls and program returns produce
 a paging-unavailable notice, without a handle or recovery action. A write's
@@ -592,8 +597,8 @@ same when no visible connector ID or title names that service. This service-name
 vocabulary is query interpretation, not an inventory of configured providers.
 For other service names, use the explicit `connector` scope. An unavailable
 catalog is a catalog failure, never an absence. Absence records and catalog
-errors use only the endpoint/pool and grant intersection; a connector hidden by
-that intersection is indistinguishable from an unconfigured one.
+errors use only the endpoint's tools; a connector the endpoint does not serve
+is indistinguishable from an unconfigured one.
 
 If no tool covers every search term, wider any-term fallback remains available
 for ordinary action/object searches and the page carries `matchMode: "partial"`.
@@ -820,10 +825,11 @@ attempted tool name; an unknown tool scopes the same query to the connector that
 answered. The suggested route follows the route the caller took:
 `tool: "search_tools"` for a top-level call, `function: "connecta.search"` with
 the same arguments when the miss happened inside `execute_code`, which has no
-way to call a tool. `call_tool` reaching an unannotated, write-capable, or
-destructive tool returns `nextAction` for `call_destructive_tool` with the
-canonical address, and so does the same call inside a program, unless config
-marks that pool trusted. Nothing is executed by these records.
+way to call a tool. On a writable endpoint, `call_tool` reaching an unannotated,
+write-capable, or destructive tool returns `destructive_tool_requires_approval`
+with `nextAction` for `call_destructive_tool` and the canonical address. On a
+read-only endpoint every write path returns `read_only_endpoint` with no
+`nextAction`. Nothing is executed by these records.
 
 `connecta.describe` keeps its failures inline instead, so one miss cannot
 discard the other schemas; each failed entry carries a human `error`, typed
@@ -926,18 +932,22 @@ list connectors from another pool or identity's grants.
 A write that times out after dispatch returns `write_outcome_unknown` with
 `retryable: false` and an agent-only `uncertainCall: { address, args?, argsOmitted?, argsRedacted?, recovery? }`.
 No write is automatically replayed. `recovery` carries facts the connector
-recorded before dispatch (`src/call-recovery.ts`), such as the `idempotencyKey`
-a REST connector generated; a deliberate retry that reuses it with the exact
-original arguments cannot repeat the write while the vendor retains the key
+recorded before dispatch, such as a REST connector's
+generated or caller-supplied `idempotencyKey`. Recovery accepts keys up to 255
+characters, matching the REST write schema. Other recovery values remain capped
+at 128 characters, with at most four facts per call and camelCase names of at
+most 32 characters. Values outside these bounds are dropped whole. A deliberate
+retry that reuses the key with the exact original arguments cannot repeat the
+write while the vendor retains the key
 (Stripe may prune v1 keys after 24 hours). After that, look the object up before
 retrying. When a connector recorded such facts, any other dispatched write whose
 outcome is unknown (a lost response body, a 5xx) also carries `uncertainCall`
-with them under its own code, and trusted-program write accounting keeps it. `args` may be partial reconciliation context
+with them under its own code, and program write accounting keeps it. `args` may be partial reconciliation context
 with `argsRedacted: true`. A withheld echo or arguments over the 512-byte budget
 carry `argsOmitted: true`; sensitive or unresolved schemas also carry
 `argsRedacted: true`. When `args` is absent or redacted, use the original
-arguments if reconciliation requires another call. A timeout before dispatch remains `timeout`. Trusted
-program write accounting keeps this detail even if the guest catches the
+arguments if reconciliation requires another call. A timeout before dispatch remains `timeout`.
+Program write accounting keeps this detail even if the guest catches the
 failure or returns early. Multiple uncertain writes use `uncertainCalls`,
 bounded to ten calls with `uncertainCallsTruncated` when more exist.
 
@@ -947,7 +957,9 @@ SDK timeout classes, and runtime network codes. Untyped prose is non-retryable:
 name, or URL never changes the verdict. JSON-RPC `ProtocolError.data` is dropped
 at the downstream boundary, even when the agent may see the error's message.
 
-## Source and tests
+## Contributor reference
+
+### Source and tests
 
 Handlers and schemas live in [meta-tools.ts](https://github.com/zackbart/connecta/blob/main/src/meta-tools.ts).
 [Catalog service](https://github.com/zackbart/connecta/blob/main/src/catalog-service.ts)