@zackbart/connecta 0.34.0 → 0.35.0

package/CHANGELOG.md

@@ -2,6 +2,399 @@
 
 All notable changes to this package are documented here.
 
+## 0.35.0 — 2026-10-26
+
+Connecta 0.35.0 brings the provider kit and standard agent surfaces to all 15 maintained providers. Operation search and details expose reviewed API contracts without reading account data; indexed read and write tools complement the retained named tools. Gmail keeps its reviewed exception: draft writes use named tools and sending remains unavailable. Results use consistent list envelopes, narrowing `fields`, signed continuations and truncation paths. The [provider migration guide](https://github.com/zackbart/connecta/blob/v0.35.0/documentation/provider-migration-0.35.md) maps every renamed or removed tool and argument, including retired `raw`/`select` arguments, list keys, paging inputs and wrappers replaced by indexed operations. Update saved programs, pool grants, classification entries and deployment instructions before upgrading, and restart old continuations where the guide requires it.
+
+Pools can opt into a native tool surface for clients with their own tool search, retaining the same classification, scope and invocation enforcement. Native pools include `execute_code` by default; code-off pools provide `read_result` for bounded result paging. The separate `@zackbart/connecta-eve` helper supplies an Eve connection, endpoint instructions and an optional host write gate. Explicit Vercel workload bindings can admit declared agents without separately provisioned Connecta tokens. Existing agent tokens remain supported. See [native tools and Eve agents](https://github.com/zackbart/connecta/blob/v0.35.0/documentation/meta-tools.md#native-tool-surface) and [Vercel workload credentials](https://github.com/zackbart/connecta/blob/v0.35.0/documentation/auth.md#vercel-workload-credentials). The helper requires Node 24 and Eve 0.83.x. Eve 0.83.0 apps need their own undici 8.12.3 override; the repository's development override does not ship with the helper. Its [package guide](https://github.com/zackbart/connecta/blob/v0.35.0/packages/connecta-eve/README.md#eve-0830-dependency-override) gives the operator steps.
+
+Write outcomes now follow the whole logical call's dispatch evidence (H1). A dispatched write with an uncertain result is non-retryable and requires reading the target before another write; a later refusal or caught program error cannot erase earlier uncertainty. Source or effective write classification prevents automatic replay. Signed continuations also bind the admitted caller and pool owner when downstream identity varies by caller, refusing cross-caller continuation before dispatch. Security fixes strengthen credential withholding, response safety, authentication bounds, OAuth state and cancellation while keeping activity records free of request and response payloads.
+
+The core now composes storage, registry and calls, authentication, executors, remote MCP and upward MCP orchestration through native Effect programs. HTTP routes use cached public Effect HttpRouters, and SQLite/D1 execution uses public Effect SQL services. The published API still returns Promises and retains existing database formats. The pinned modern and legacy MCP SDK adapters remain the protocol implementations; this release does not adopt Effect McpServer or add MCP Apps, Tasks, prompts or subscriptions.
+
+On Node, `listen()` from `@zackbart/connecta/node` installs the owned sender for every maintained-provider request, reads included, remote MCP writes, and downstream OAuth token, registration and revocation POSTs. Install the template's exact optional peer, `undici@6.29.1`. A Node host serving `connecta.fetch` without `listen()` refuses maintained-provider writes, reviewed POST reads, remote MCP writes and those credential POSTs before sending; these paths worked in 0.34.1. The sender connects directly by default or through an explicit HTTP(S) CONNECT `proxy` option on `listen()`. It ignores ambient proxy variables and host dispatchers. Remote MCP reads and OAuth discovery GETs retain native fetch and need their own host proxy policy. An uncertain OAuth refresh requires fresh authorization rather than replaying the spent token. Shutdown closes unused connections and active connections as their responses finish, including SSE. See [Node deployment requirements](https://github.com/zackbart/connecta/blob/v0.35.0/documentation/deploying.md#start-on-node).
+
+Authenticated MCP request bodies now default to a 4 MiB limit on every endpoint. Node's separate pre-auth buffer drops from 10 MiB to 4 MiB; deployments accepting larger bodies must configure both limits. Discovery can find API-only capabilities through bounded operation vocabulary, ranks exact resources across versioned namespaces, and preserves vendor summaries beside a separate reviewed `refusal` field. Planning Center exposes reliable page totals and respects excluded applications in discovery. Vercel connections can opt into a deployment-owned team pin. The operator UI lists OIDC-only agents and bounded last-seen observations. These additions retain existing classification, caller scope and one-attempt write rules.
+
+The maintained Infisical, Notion and Mixpanel API providers and their package subpaths are removed. Replace Notion and Mixpanel with generic `remoteMcp()` connections to their hosted servers, then rediscover live tool names, schemas and permissions. Infisical has no packaged replacement; remove it or supply a deployment-owned connector. Hosted connections do not inherit removed providers' API coverage or value-safety projections. Vercel environment-variable `value` arguments are now `writeOnly`; hosts must treat them as private write inputs, and reads and write replies withhold their values. The [migration guide](https://github.com/zackbart/connecta/blob/v0.35.0/documentation/provider-migration-0.35.md) also covers response-media and numeric-path validation, changed error meanings and each provider's exact upgrade actions.
+
+Deployments using unchanged tools can ignore unrelated provider mappings; deployments without the removed providers need no replacement connections. Existing pools keep the meta-tool surface unless configured otherwise, and deployments without Eve or Vercel-hosted agents need neither new integration. No database conversion or agent-token rotation is required solely for 0.35.0. Workers deployments do not need Node's transport peer or startup changes. Follow [Upgrade an existing deployment](https://github.com/zackbart/connecta/blob/v0.35.0/documentation/deploying.md#upgrade-an-existing-deployment) for the installed-package handoff.
+
+### Added
+
+- Find API-only capabilities through bounded operation vocabulary in catalog search, with owning API-search tools and existing visibility and safety filters (#997).
+- Pin activity insert and retention rollback, schema initialization rollback, and retry recovery with execution-time failure tests on SQLite, proxied D1, and native Workers D1.
+- Add the internal HTTP provider kit with declared vendor operations, typed tool builders, paging, reviewed operation hatches and validated provider construction. All 15 maintained providers use this kit in 0.35.0; their standard agent-surface changes are listed in the provider migration guide.
+- Add characterization goldens for every maintained `api()` provider: catalog, fixture-call requests (exact JSON body bytes included) grouped into causal steps with delivered-answer frontiers under a virtual clock installed before provider imports, with compact prefix frontiers and independently captured canonical/reverse answer orders, and results, failure mapping (including transport timeouts and a vendor error that echoes credentials), token-exchange and consent requests with decoded JWT claims, and sent-secret echo redaction across raw, percent, base64, base64url, `\u`-escaped and HTTP Basic encodings, compared byte for byte on Node and Workers independent of request scheduling, with explicit rejection of unsupported asynchronous sources and ambiguous concurrent reply fixtures, with `pnpm run goldens:update` to regenerate them.
+- `clerkAuth({ organizationId })` lets one Clerk instance serve many deployments, one Organization each. Only that Organization's members are admitted, on MCP OAuth tokens (JWT and opaque) and operator sessions. Membership confirmed with Clerk's Backend API is the only organization rule: organization claims in tokens and sessions are never read. Each answer is cached per Organization and user for 60 seconds from the start of its lookup (30 for a non-member). An answer is cached only if no lookup that started later has already cached one, so an older answer never replaces a newer one, and, assuming no unseen clock rollback within the TTL window, a removed member is refused from 60 seconds after removal even while their access token is still valid. An unseen rollback within that window can extend admission beyond 60 seconds of elapsed time. The cache trusts an answer only while the clock reads between its lookup's start and the end of its TTL, so a step forward ends it early, a step back before the start ends it, and an answer found expired is never revived. Each request runs and owns its own lookup, as Workers require, and a caller that leaves cancels only that lookup. A failed, redirected, oversized, or timed-out lookup refuses admission and is not cached, and every lookup ends its Backend API request and body on every outcome. In organization mode a JWT's issuer and subject, and a session's, must be this instance's and match the looked-up user. Organization roles grant nothing; maintainers and pool members stay in code. Organization mode requires resource-bound tokens, so a nonempty `allowedOAuthClientIds` throws at construction, as does a malformed `organizationId`. The Node template reads `CLERK_ORGANIZATION_ID`.
+
+  Organization-mode Backend API reads (membership and extra opaque verification) are capped at 16 concurrent calls per isolate and two per identity, without sharing request-owned I/O or queuing. Excess calls and Clerk 429 backoff return retryable `503 organization_lookup_busy` with `Retry-After` and are never cached; valid membership cache hits still work. Backoff honors a bounded Retry-After (1–60 seconds, default ten). Operators must rate limit ingress against Clerk's shared per-instance quota. When the eviction floor suppresses a newer answer, it invalidates any older cached answer for that identity.
+- Add `@zackbart/connecta-eve`, a separate Node 24 package for Eve 0.83 agents, with app-owned connections, rotating token sources, optional write approvals and cached endpoint instructions. Validate and release it alongside Connecta without adding Eve to core installs.
+- Add shared Google Discovery compilation, verified source conversions, complete request-schema details, hatch binding, page-token handling and standard errors used by all six Google Workspace providers. The `allSuccessResponses` generator option collects response fields from every JSON 2xx contract when a provider opts in.
+- Add a native tool surface for clients with their own tool search: a pool with `surface: "native"` lists each downstream tool as `<connector>__<tool>`, annotated read or write from its classification, beside `skills` and `execute_code` (or `read_result` with `executeCode: false`), and runs every call through the existing `call_tool` or `call_destructive_tool` path.
+- Provider tooling now implements decision 0011's S.1. `providers:generate` writes `drift.json` version 2's `generated` block (operations, hosted names, evidence digests) and a guide's generated `## Conventions`, and refuses a provider past step 1 that breaks the `drift.json` rules or one past step 2 that breaks the guide rules. `defineProvider` accepts `blocks: { keys, select }` for a guide's `<!-- when: <key> -->` sections, which `ProviderContext.usageGuide` selects per connection, and `kit` facts for the provider kit to fill; `ProviderGuideBlocks` and `ProviderKitFacts` are exported types. `providers:check` reads version 1 and 2 records, reports a manifest operation no endpoint row records whether or not an endpoint check exists, and reports manual checks last verified more than 180 days ago; `providers:generate` and the standard suite refuse a version 2 record `providers:check` could not read, through the same validator. `providers:spec` reads `evidence/openapi.json` (and vendored `evidence/openapi.document.json`, whose digest the generated index records so `check:providers-generated` catches a changed conversion), writes `evidence/value-safety.json`, and reads value-safety absences from the table's `absent` field in `safety.ts`. Existing providers keep their current files until their step 1; no agent-facing output changes.
+- Add Vercel OIDC workload credentials for declared agents. Bind an immutable team ID,
+  project and allowed environments in deployment code; agent endpoints accept
+  the verified workload identity alongside existing Connecta agent tokens.
+- Record the Effect 4.0.5 HTTP router and MCP compatibility decision. Production
+  HTTP routing uses public Effect HttpRouters; upward MCP retains the pinned
+  modern and legacy SDK protocol adapters. Historical comparison fixtures were
+  retired after the completed migration; focused production regressions remain.
+- Add a reproducible real-Eve catalog contract probe through the 1,000-tool native cap, using the installed helper and a deterministic local model transport without paid calls.
+- Support an explicit HTTP(S) CONNECT proxy in Node `listen` options, with confined proxy credentials and one physical attempt per owned send. Distinguish tunnel failure before destination dispatch from uncertain writes.
+- Add an optional deployment-owned Vercel team pin across named tools, logs,
+  uploads and hatch calls, with charged ownership checks and policy-bound cursors.
+  Connections without a pin retain their teamId, slug and personal-scope routing.
+  Pinned hatch discovery and the guide's refusal count reflect the team boundary
+  without changing dispatch policy.
+
+### Changed
+
+- Consolidate redundant provider and harness test matrices and replace historical Effect migration scaffolding with focused production routing regressions, preserving provider goldens and unconditional invariant/spec enforcement.
+- The Worker example now deploys with Alchemy. `examples/worker/alchemy.run.ts` declares the Worker, its vars and in-stack secrets, the D1 database (retained on `alchemy destroy`), the Worker Loader, the Worker-level Cloudflare Access application with Managed OAuth, and the `/agent/*` bypass application; deploy with `npx alchemy deploy --stage production`. `wrangler.jsonc` remains for `wrangler dev` only. Install `alchemy@2.0.0-beta.83`, `effect@4.0.5`, and `@effect/platform-node@4.0.5` exactly; the Alchemy CLI needs Node 24.11.1 or later. Never commit `.alchemy/` or `.env`: local state records secret values in plaintext. The example ships its ignore rules as `examples/worker/gitignore`, because npm strips `.gitignore` from packages; a copied deployment renames it to `.gitignore` before the first `git add`, which keeps `.alchemy/`, `.env*`, `.dev.vars*`, `.wrangler/`, and `node_modules/` out of git. Custom domains are not yet verified with Alchemy; verify a custom hostname before agents use it. A Worker already deployed with Wrangler moves once by adopting its resources, as the example README describes.
+- Move operation and call state into internal Effect services, with Promise context views and explicit call and request teardown. Revoke nested calls when their parent ends so paused authentication cannot send after the outer call finishes.
+
+  Refuse copied contexts that lack authority within an admitted request scope and auxiliary requests after request closure. Finish every revocation and cleanup step even when a signal facade throws, and detach child listeners on parent closure. Cancel closed calls' use of OAuth renewal while preserving coordinator completion once a refresh claim is submitted.
+
+  Bind shared remote MCP renewal preparation to its initiating call until claim submission. Abort pending operation authentication, fetches and authorization-code exchange when their request scope is explicitly revoked, including operations without an external signal; refuse token writes from a late code response.
+
+  Interrupt pending OAuth grant and catalog-epoch preparation when its owning call or request closes, including legacy migration, cleanup and vault reads. Preserve coordinator completion after refresh claim submission.
+
+  Settle complete Promise views and connector operations at their call or request boundary, including paused credential resolution, cryptography and response cleanup. Keep auxiliary work request-owned and preserve write settlement and submitted renewal ownership.
+
+  Keep concurrent operator probes in separate scopes so a failed row cannot revoke live siblings.
+- Guard the internal Effect HTTP client with an owned Node dispatcher and share bounded transport policy and refresh-once OAuth grant use across both transports. The Node template installs the optional undici peer. Request headers consistently override constant headers regardless of their field-name casing. Write reservations and OAuth replay use the core's positive-read rule: only positively classified GET/HEAD requests without method-override headers can replay; reviewed POST reads and auxiliary labels do not bypass the write guard.
+- Establish the internal HTTP kit's tagged failure mapping, bounded vendor facts and served-answer provenance. Blocked resends preserve the original attempt's verdict; write outcomes remain decided by the core. Maintained providers retain their existing wire behavior.
+- Run the Tithe.ly provider on the internal HTTP provider kit, with its tools, credential probe, failures and hatches unchanged for agents. On Node, its writes now need the owned transport that `listen` from `@zackbart/connecta/node` installs, as every kit write does; a blank `title` is refused at construction like every other provider's.
+- **Breaking:** Standardize Breeze's agent surface for 0.35.0. `breeze_api_get` becomes `breeze_api_read`; `breeze_api_mutate` becomes `breeze_api_write` with `method: "GET"`. Query name/value arrays become objects, `*_json` values must be JSON strings, and `{ result }` becomes `{ status, data, page? }`. Indexed search/details are added; unindexed paths, unreviewed parameters, reads through the write hatch and non-JSON successful hatch replies retire. Remove `raw` and use `fields` or the read hatch. Person-write profile `fields` becomes `values`. `list_calendars`, `list_forms`, `list_form_fields`, `list_form_entries`, `list_volunteers`, `list_volunteer_roles`, and `list_account_log` move to their indexed read operations; `assign_tag`, `unassign_tag`, and `record_check_in` move to their indexed GET write operations. Removed form `archived` becomes query `is_archived`; log `userId`/`includeDetails` become `user_id`/`details` (`limit` stays `limit`). Tag assignment and check-in now require write approval on every hatch call. Trailing-slash paths are refused. People hatch limits must be whole decimal counts from 0 to 1,000 before dispatch. Named list keys (`people`, `fields`, `tags`, `events`, `attendance`, `contributions`, `funds`) become `items` with `page`; contribution `count`/`totalAmount` retire in favor of client reductions. Local list windows gain `limit`/`cursor`; people cursors become opaque and final pages omit `nextCursor`. Event `truncated: true` becomes `truncated: ["items[]"]`. Named person writes return `{ ok: true }` when the vendor acknowledges without a record. Calendar secrets remain removed. See the Breeze section of the 0.35 provider migration for exact replacement paths and arguments.
+- Support non-secret resource headers on generic remote MCP connections and deployment classification overrides of read, write, or hidden. Missing runtime tools leave overrides dormant with one operator warning per catalog change; static typos still fail construction. Preserve source classification from verified provider reviews or server annotations so a write-to-read override cannot permit automatic replay after OAuth renewal, transport or authorization recovery, or program re-runs. Ambiguous dispatched failures remain non-retryable with unknown outcomes, including timeouts and cancellation.
+- Move Breeze onto the provider kit while preserving its characterized tools, guide, requests, and responses. Add reviewed, bounded text-body contracts for vendors that return text.
+- Move Overflow onto the shared HTTP provider kit while preserving its existing tool and guide contracts.
+- Migrate Planning Center onto the provider kit while preserving its tools, requests, results, and usage guide.
+- Move Cloudflare's API-token and Global API Key connectors onto the provider kit while preserving their tool catalog, guide, requests, results, pin confinement and characterization goldens. Record REST and GraphQL envelope contracts in the provider evidence.
+- Move Stripe API calls onto the provider kit while preserving its tools, guide, pinned operation index and reviewed value safety.
+- Move Vercel onto the provider kit while retaining its tools, guide, request bytes and value-safety review. Bounded success reads cancel unread streams and retain the shared redaction and failure boundaries.
+- Move Google Docs onto the provider kit through the shared Google Workspace layer, keeping its tools, schemas, guide, document rendering, requests, revision guards, and create-recovery advice. Each create and optional initial-text write has its own fixed, single-send step. Reviewed public JSON field names remain available to the renderer while private values are redacted before text normalization.
+- Google Drive runs on the shared Google provider kit, preserving its tool catalog, guide, request framing, and bounded content results.
+- Move Gmail onto the shared Google provider kit while retaining its draft-only tools, catalogs, MIME requests, projections, guides and bound cursors. Track auxiliary lookups separately from draft writes when reporting whether a draft write was dispatched. Sanitize decoded Gmail bodies and attachments before truncation while retaining their original byte-size checks.
+
+  Keep multi-request Gmail reads working when served as writes, validate large encoded bodies without overflowing the regex stack, and refuse draft replacement when redaction hides an attachment's disposition or a header name.
+- Move Google Forms onto the provider kit through a shared Google Workspace layer: the delegated service-account token is a machine grant, Google's failures map through one vendor table, and Forms keeps its tools, guide, requests, cursors, results and characterization goldens. A read refused with HTTP 401 is still replayed once with a fresh token, and a write is still never resent.
+- Move Google Sheets onto the provider kit through the shared Google Workspace layer, preserving its tools, guide, A1 requests, paging, results, and write recovery advice.
+- Move Google Slides onto the shared Google Workspace provider kit, preserving its tool catalog, revision-checked edits, digest-bound paging, and create recovery advice.
+- Move GitHub's six REST tools onto the provider kit while preserving GitHub App scopes, lazy installation-token renewal, tool annotations and result envelopes.
+- **Breaking:** Standardize Church Community Builder's v2 JSON/OAuth tools. Rename `ccb_api_get`
+  to `ccb_api_read`, `ccb_api_mutate` to `ccb_api_write`, and the old data-search
+  `ccb_api_search` to `search_records`; `ccb_api_search` now searches an offline
+  operation index and `ccb_api_details` exposes its contracts. Replace named-list
+  `page`/`perPage` with enum `limit` (25/50/75/100, default 25) and signed `cursor`,
+  return `items` and standard page metadata with optional exact vendor `total`, remove `raw`, add validated `fields`
+  and standard `truncated` envelopes. Remove `list_forms`, `list_form_responses`,
+  `list_processes`, `list_queues`, `list_queue_individuals`,
+  `list_scheduling_categories`, `list_schedules`, `list_individual_assignments` and
+  `list_individual_pledges`; their indexed replacements and every filter/path
+  change are listed in the [0.35 migration guide](../documentation/provider-migration-0.35.md#church-community-builder).
+  Preserve write approval and read-only scope boundaries. Require canonical API
+  paths and documented JSON bodies, withhold private file/payment/calendar
+  links and OAuth credentials permanently, and classify unproven HTTP 409 meanings
+  as `connector_call_failed`. Legacy v1 XML remains outside the provider.
+- Run browser and dependency-audit jobs for relevant pull requests and every main/nightly run. Visual comparisons do not retry; failed attempts upload the Playwright report with diffs and traces. Weekly provider drift scans remain advisory and separate changed contracts from standing manual reviews.
+- Select conditional browser, audit and Eve jobs with one inline changed-files step; missing or invalid selection outputs fail the required check gate.
+- **Breaking:** Standardize Cloudflare's nine existing tools. Rename hatch `select` to `fields`;
+  hatch reads/writes/uploads retain the safe vendor envelope (`data.id` →
+  `data.result.id`, arrays under `data.result`; select `result.id`/`result[].id`).
+  `cloudflare_api_upload` data likewise becomes the envelope: `data.id` → `data.result.id`.
+  Named reads keep projected shapes and gain `fields`; account/zone lists replace
+  `perPage`/`page` with `limit`/opaque `cursor`, and `accounts`/`zones` with `items`.
+  Replace hatch `page.next` and raw continuation values with signed
+  `page.nextCursor` at `page.param`/`page.in` where the pin establishes an
+  unambiguous adapter; other envelopes retain their vendor query protocol. Operation search defaults to six hits
+  and caps at eight, with bounded search/details continuation. Numeric paging
+  constraints fail before I/O; HTTP 409 becomes generic `connector_call_failed`.
+  No tool names or approval classifications change. Pins, configured path defaults,
+  R2 headers, uploads, text/NDJSON framing and in-band refusal semantics remain.
+- Record decision 0012: hosted MCP servers are generic `remoteMcp()` configuration, discovered at runtime and classified from their annotations, with no vendored MCP providers, catalogs, classification maps, hosted drift or per-tool guides. Amend decision 0011 to govern only vendored APIs, and add C.0a–C.0d to decision 0009's Phase C. Nothing a deployment or agent sees changes yet.
+- Record decision 0014: standardize vendored API step-2 tool shapes on an indexed coverage hatch, evidence-backed curated tools and optional generated per-operation catalogs, with discovery budgets.
+- Pin `effect` to exactly 4.0.5 (from `^4.0.0`). A deployment that also depends on Effect, such as an Alchemy resource stack, must pin the same 4.0.5 to resolve one copy. Bundle caps stay on the deployed shapes; per-provider entries are now reported against their baseline instead of capped, because every deployment already pays for the Effect core through the root. `ProviderDefinition`'s `bundle.maxGzip` stays accepted but deprecated and ignored.
+- Record the Effect-native rewrite and Clerk organization mode as decision 0009.
+- Record decision 0010's provider kit design and implement request-ledger integration, fixed write capacity, atomic step/item reservation and call-owned cancellation. Every maintained provider now uses the kit; writes preserve the core's whole-call outcome and structured recovery rules.
+- Preserve recorded HTTP status in operator failure records for bare write-401 fallbacks, Google writes with unknown outcomes, and oversized responses. Agent error codes, messages, retryability, and write outcomes stay unchanged.
+- **Breaking:** Standardize GitHub's agent surface for 0.35: add `github_api_search`,
+  `github_api_details`, `github_api_read` and destructive `github_api_write`
+  over an immutable operation pin with a reviewed repository-read and release-write
+  allowlist. Replace `create_release` with POST `/repos/{owner}/{repo}/releases`,
+  `update_release` with PATCH `/repos/{owner}/{repo}/releases/{release_id}`, and
+  `delete_release` with DELETE on that release path through `github_api_write`.
+  Move repository and release identifiers into the path and write values into body.
+  Release creation now uses the destructive hatch; the host may request confirmation.
+
+  Keep `list_scopes`, `search_scoped` and guarded `merge_pull_request`. Replace
+  named `page`/`pages` with signed `cursor`, `per_page` with `limit`, and legacy
+  scope/repository/partition results with `{items,page}`; search rows carry
+  `scope`, `repository` and `item`. Search visits one partition page per call,
+  retains `incomplete_results`, and omits inexact aggregate totals. The default
+  scope-list size changes from 100 to 30; both named lists cap limit at 100.
+  Named continuations bind the original effective limit. Omission uses 30 and is
+  accepted for a cursor issued with limit 30; mismatches name the expected limit.
+
+  Add `fields` to named reads and both call hatches; hatch continuation uses a
+  separate signed cursor. Release hatch replies use `{status,data}`, including
+  `data:null` on an empty delete. Reject noncanonical target/file paths before
+  credentials. Preserve permanent secret withholding and refuse raw search/merge,
+  secret/admin, archive/log downloads and raw diff media routes. Inline UTF-8 file
+  content and patches are redacted before 32,768-character cuts reported through
+  `truncated`. A failed auxiliary merge lookup claims no unknown write outcome;
+  `merged:false` is an in-band failure. Kit fallback errors classify 400/422 as
+  invalid arguments, retain documented rate-limit facts, and distinguish failed
+  body reads from malformed JSON. See the GitHub migration section for exact paths,
+  field selections, paging and authentication setup.
+
+  Support canonical nested contents paths and the repository root listing. Encode
+  branch-name slashes as `%2F` in commit and compare paths; unmatched raw-slash
+  refs include this repair hint. Refuse owner-prefixed object refs and
+  cross-repository comparisons before authentication. PR-list head filters require
+  `login:branch`; bare branches are refused because GitHub silently ignores them. Withhold
+  configured App private keys when echoed in repository data.
+- Run provider characterization goldens in forward/reverse order on Node and canonical order on workerd. Normal runs capture once; nightly Node checks add identical repeats, jitter seeds and the full source-probe matrix. Reuse fixed public RSA fixture keys without caching evaluated module graphs or changing golden bytes.
+- **Breaking:** Standardize Google Docs with four indexed `docs_api_*` hatches over all three pinned API methods, retaining all six named tools. Additive create, append and insert retain their explicit `destructiveHint:false` annotation and remain writes. Hatch batch writes require a revision, 1–100 requests and exactly one supported GA kind each; preview comment and suggestion kinds remain refused. Generic create sets only a title; the named create retains separate create/initial-text steps and partial-create recovery.
+
+  Remove `get_document.raw`; use `docs_api_read` with `/documents/{id}` and `query.includeTabsContent:true`, reading the vendor document from the hatch value's `data`. Add `get_document.fields`. Replace unsigned `e:` cursors with signed content/revision-bound cursors; start without a cursor and keep read arguments fixed. Terminal pages omit `nextCursor` instead of returning null. Replace `tabs[].textTruncated` and `repliesTruncated` with top-level `truncated` paths; remove `replyCount` and use `replies.length`. Ambiguous document 404s report `connector_call_failed`, while standard read 5xx failures report `unavailable`. Temporary image `contentUri` access capabilities are permanently withheld; ordinary authored links remain. See the Google Docs section in the 0.35 provider migration guide for concrete calls.
+- **Breaking:** Standardize Google Drive's agent surface while retaining its 17 named tools and adding four indexed `drive_api_*` tools. Named lists return `items` instead of `files`, `permissions` or `drives`; terminal cursors are omitted, old cursors must be discarded, and all named reads accept narrowing `fields`. Replace `truncatedFields` and `contentTruncated` with `truncated` paths. The hatch executes 13 reviewed JSON metadata operations from a pinned 64-method inventory; all grants remain in `share_file`, and media, ownership transfer, permanent deletion, watches and credential minting stay refused. Use standard error/outcome mapping, treat move lookups as auxiliary, refuse altered decision metadata before follow-up dispatch, and permanently withhold private access keys and download destinations. Dispatched write timeouts now use `write_outcome_unknown` instead of `connector_call_failed`, with `uncertainCall` evidence. `create_folder` and `restore_file` retain their explicit `destructiveHint:false` catalog annotation and remain writes. Named-list `fields` and `maxBytes` may change between pages without invalidating a cursor. Existing names are unchanged; Drive had no raw argument to remove. See the Drive section of the 0.35 provider migration guide for request and result examples.
+- **Breaking:** Standardize Google Forms with four indexed `forms_api_*` hatches while keeping
+  all six named tools. Replace `get_form.raw` with `forms_api_read` at
+  `/forms/{formId}` and read the vendor Form from `data`. `list_responses.responses`
+  becomes `items`, and its redundant `formId` is removed. Named reads accept
+  `fields` (per item for response lists); terminal pages omit `nextCursor`.
+  Discard old cursors after upgrade. Size cuts use `truncated` paths instead of
+  batch booleans or `moreOptions`/`moreQuestions`; recovery question ids remain.
+  Temporary image access destinations are permanently withheld. Publish settings
+  and all watches stay refused. Named-write classifications and scopes stay the
+  same; the new write hatch is destructive. See the Google Forms section of the
+  0.35 migration guide for concrete path, body, cursor and result mappings.
+- **Breaking:** Standardize Gmail's read surface with three indexed hatches and retain all nine named tools. Gmail is the documented decision 0014 exception: no `gmail_api_write`; only `create_draft`/`update_draft` write drafts, and sending is never available. Replace `get_message.raw` with `gmail_api_read` (`path: "/messages/{id}"`, `query: { format: "full" }`, resource in `data`). Named list `threads`/`drafts`/`labels` become `items`; remove the named search estimate. Named reads gain `fields` and preserve thread continuations; labels use one bounded unpaged read, size booleans/omission counts become top-level `truncated` paths, terminal cursors are omitted and old private cursors expire. Use top-level `cursor` for signed hatch continuation instead of raw `query.pageToken`. Copied threading headers now refuse malformed/control/non-ASCII tokens before saving. Standard error meanings replace legacy wording. Draft approval classification, MIME/attachment safeguards and scopes remain unchanged. See the Gmail section of `documentation/provider-migration-0.35.md` for every mapping.
+- **Breaking:** Standardize Google Sheets with four indexed API hatches and all nine named
+  workflows retained. Replace `get_spreadsheet.raw` with `sheets_api_read` full
+  vendor JSON; add result `fields` to named reads. Terminal cursors are absent.
+  Replace named-range omission counts, value-cell/per-range cut flags and batch
+  reply summary/omission counts with standard `truncated` paths. Keep cell content
+  as requested data, scalar/null value semantics, whole-row paging and named
+  append's INSERT_ROWS pin. Explicitly admit seven reads (including three read
+  POSTs) and ten writes, with bounded values and batches; refuse preview comment
+  and external data-source batch mutations. Use standard kit errors and preserve
+  ambiguous unknown-id and once-only write outcomes. See the 0.35 provider
+  migration guide for argument, envelope and path mappings.
+
+  Sign named cell-content continuations and bind them to the admitted delegated
+  caller for mapped subjects; restart existing unsigned `get_values` cursors after upgrading. Preserve
+  `truncated` on every named read after field selection and preserve value-read
+  continuation metadata. Keep operation action words and conditional refusal
+  reasons in the first summary sentence used by discovery.
+- **Breaking:** Standardize Google Slides with four indexed `slides_api_*` hatches while keeping all 15 named tools. Generic thumbnails remain refused; `get_slide_thumbnail` keeps its private temporary-link workflow. Batch writes retain the 49 reviewed request kinds, revision preconditions and separate comment-save outcomes. Remove `raw` from `get_presentation`, `get_page` and `list_comments`; use `slides_api_read` for structural JSON. Rename list `layouts`/`threads` to `items`, move exact `total` into `page.total`, omit terminal `page.nextCursor`, and restart old content cursors once for signed continuation. Replace boolean `truncated`, reply `cut`, `elementsNotShown`, `layoutsNotShown`, `repliesNotShown` and `revisionIdNotShown` size reports with `truncated` paths. Rename projected `get_presentation.pageSize` to `canvasSize` (slide dimensions); full hatch JSON keeps vendor `data.pageSize`. Named reads gain narrowing `fields` that retain `page` and `truncated` metadata; hatch responses use `{status,data}`. Presentations.get details retain the legacy `presentationsId` parameter spelling. The new write hatch is destructive; the additive named tools `create_presentation`, `create_slide`, `create_comment` and `create_comment_reply` retain their explicit `destructiveHint:false` catalog annotation and remain writes. Replacement hatch reads redact temporary Image, SheetsChart and StretchedPictureFill `contentUrl` links to `"[redacted]"`, keeping `sourceUrl` and the named thumbnail workflow. Hatch comment-save state and advice remain in envelope-level `warnings` after `fields` selection, without fabricating vendor data. See the Google Slides section of `documentation/provider-migration-0.35.md` for concrete path, query and body mappings.
+- Across maintained API providers, kit writes now refuse whole withheld scalar values and withheld links before running, including named Gmail, document, sheet, and other write tools. Longer prose may mention `[redacted]`; paths and queries refuse any containment. Authenticate bound cursors with a persistent deployment key, connection/personal-owner binding and index content hash; pre-upgrade cursors stop working and require a fresh first page. Report key-storage failures as retryable `unavailable`, and reject unknown declared error codes at construction.
+- Rewrite the product overview and add explanatory guides for connections, agent access, and safety.
+- **Breaking:** Require Node deployments to serve with `listen()` from `@zackbart/connecta/node` and install `undici@6.29.1`. Without its owned sender, every maintained-provider write, every reviewed POST read and every remote MCP write is refused before sending, although each worked in 0.34.1. With `listen()`, every maintained-provider request, reads included, remote MCP writes and downstream OAuth credential POSTs use the owned sender. It connects directly by default or through an explicit HTTP(S) CONNECT `proxy` option, ignoring `NODE_USE_ENV_PROXY`, `HTTP_PROXY`, `HTTPS_PROXY` and host proxy dispatchers. Remote MCP reads and OAuth discovery GETs retain native fetch and need their own host proxy policy.
+- **Breaking:** Standardize Overflow's agent surface for 0.35.0. `overflow_api_get` becomes `overflow_api_read`, `overflow_api_mutate` becomes destructive `overflow_api_write`, and new `overflow_api_search`/`overflow_api_details` discover the 38 reviewed operations. `list_tap_events`, `list_webhooks` and `list_webhook_event_logs` move to indexed reads of `/tap/events`, `/webhooks` and `/webhooks/{webhookId}/event-logs`; flattened rows become vendor records under hatch `data.data`. Hatch query pairs become an object, with repeated arrays under bracketed names; `{ result }` becomes `{ status, data, page? }`. Paths remain relative to `/api/v3`, unindexed calls retire, and subscription creation uses `/subscriptions/{donorId}` rather than undocumented `/subscriptions` plus a body `donorId`. Remove `raw` from all named reads. Named `page` becomes opaque `cursor`, list noun keys become `items`, numbered `page`/`limit`/`totalCount` metadata becomes `hasMore`/optional `nextCursor`/vendor-stated `total`, payment methods gain paging, and delivery tokens move into hatch `page.nextCursor` with the vendor parameter named explicitly. All named reads and both call hatches gain narrowing `fields`. Preserve text `/health`, JSON-string or plain-text refund acknowledgements and empty write acknowledgements; refuse other unexpected non-JSON successes. Permanently strip webhook keys matching `secret|signing|hmac` case-insensitively, including nested delivery payloads. HTTP 422 becomes `invalid_args`; 409 stays generic. The sensitive set remains empty, writes still need host approval and have no idempotency key, and the maintained provider setup and 0.35 migration describe the exact replacements.
+- **Breaking:** Standardize Planning Center's agent surface for 0.35.0 (#703). `pco_api_get` becomes `pco_api_read`, `pco_api_mutate` becomes the destructive `pco_api_write`, and new `pco_api_search`/`pco_api_details` discover the ten pinned products' operations. Hatch query pairs become an object, `{ result }` becomes `{ status, data, page? }`, arbitrary unindexed paths and per-call `version` are removed, and `fields` narrows declared results. Every named `raw` is removed; named-list `perPage`/`offset` become `limit`/opaque `cursor`, noun keys become `items`, `page.nextOffset` becomes `nextCursor`, terminal cursors are omitted, and named `totalCount` is replaced by optional reliable `page.total` (paged hatch reads also expose `page.total`). `get_plan.plan` moves to the top level; `itemsTruncated`/`teamMembersTruncated` become `truncated` paths. Acknowledged workflow-card actions return `{ ok: true }`. People's documented duplicate 409 now means `conflict`; incomplete body reads and malformed JSON have distinct messages. The source's empty-path verification artifact is omitted from the index. Publishing's signed-download generation and Webhooks signing-key rotation are refused before transport. Hatch per_page preserves and validates the vendor's integer range 1–100. Private calendar codes, private file destinations and opaque webhook payload/body/header values stay withheld alongside permanent credentials, without a widening argument or option.
+
+  Removed wrappers move to the indexed method/path: `add_person_email` → POST `/people/v2/people/{personId}/emails`; `add_person_phone_number` → POST `/people/v2/people/{personId}/phone_numbers`; `list_lists` → GET `/people/v2/lists`; `list_list_people` → GET `/people/v2/lists/{listId}/people`; `run_list` → POST `/people/v2/lists/{listId}/run`; `add_workflow_card_note` → POST `/people/v2/people/{personId}/workflow_cards/{cardId}/notes`; `list_forms` → GET `/people/v2/forms`; `list_form_submissions` → GET `/people/v2/forms/{formId}/form_submissions`; `add_plan_item` → POST `/services/v2/service_types/{serviceTypeId}/plans/{planId}/items`; `list_songs` → GET `/services/v2/songs`; `list_song_arrangements` → GET `/services/v2/songs/{songId}/arrangements`; `list_group_events` → GET `/groups/v2/events` or `/groups/v2/groups/{groupId}/events`; `list_check_in_events` → GET `/check-ins/v2/events`; `list_check_in_event_periods` → GET `/check-ins/v2/events/{eventId}/event_periods`; `list_check_ins` → GET `/check-ins/v2/check_ins` or `/check-ins/v2/events/{eventId}/check_ins`; `list_calendar_event_instances` → GET `/calendar/v2/event_instances`; `list_signups` → GET `/registrations/v2/signups`; `list_signup_attendees` → GET `/registrations/v2/signups/{signupId}/attendees`; `list_batches` → GET `/giving/v2/batches`; `list_pledge_campaigns` → GET `/giving/v2/pledge_campaigns`; `list_pledges` → GET `/giving/v2/pledge_campaigns/{pledgeCampaignId}/pledges`; `list_recurring_donations` → GET `/giving/v2/recurring_donations`; `list_webhook_subscriptions` → GET `/webhooks/v2/webhook_subscriptions`. Their old id arguments fill path slots; paged-read `perPage` becomes query `per_page` and continuation uses signed query `offset`, while attribute/filter/include argument mappings are listed completely in the Planning Center section of `documentation/provider-migration-0.35.md`. Additive writes moved to the hatch now require approval for a destructive tool. Operator setup moves to `documentation/providers.md` and agent conventions are generated.
+
+  Removed additive writes now accept empty 2xx replies as success and return the vendor envelope. Custom-field writes use POST `/people/v2/people/{person_id}/field_data` or PATCH `/people/v2/field_data/{field_datum_id}`. Reviewed provider-local discovery summaries cover volunteer rosters, church group leaders, custom fields, order of service and People profile roots.
+- Record the provider standard as decision 0011, and enforce it for contributors. The standard covers one folder layout per kind, fixed evidence names, `drift.json` version 2, `SKILL.md` limited to agent guidance, and one agent-facing shape for hatches, paging, results, errors, `fields` and privacy, with `composed` folded into `dual`. A new provider folder must meet it. The 23 existing providers are listed as pending, and each leaves the list in two migration PRs. Nothing a deployment or agent sees changes yet.
+
+  Keep all three characterization goldens byte-identical in step 1 after safety back-ports, and require fresh affected evals for every step-2 PR. Guard pending exemptions against additions and reinsertions using the pre-push commit in main CI, the PR base in PR CI, and the merge base locally (with a first-parent fallback when the base equals HEAD); missing history fails closed. Require offline authored-tool fixtures independently of convention metadata, and validate standard schema types, required fields and hatch envelopes on both runtimes. Preserve observation-only hosted catalog names and annotations separately from served classification.
+- Reduce required PR CI to static/build, complete Node coverage with INV/spec enforcement, selected native workerd boundaries, and a fail-closed `check` gate. Browser and dependency audit block relevant PRs through one inline changed-files step with NUL-delimited paths; main and nightly always run both. Compare forward/reverse golden bytes on Node and canonical bytes on workerd, with repeats and jitter nightly. Run package/Docker smoke on main and nightly and advisory provider drift weekly. Remove custom selection machinery, retain a small no-new-provider-exemptions check, and keep additional release checks in `release:check`.
+- Remove low-value tests from the inbound auth, admission, Clerk, downstream OAuth, remote MCP, storage, operator store, and server suites: duplicates, implementation-detail and wording pins, and cosmetic matrices. The strongest guards for each security property, every spec coverage reference, and the shared storage contract that runs against both drivers stay. Runtime behavior is unchanged.
+- Prune redundant operator UI checks and the browser state/viewport matrix, retaining real operator flows, browser security checks, and four representative visual baselines.
+- Prune redundant core tests and repeated executor matrices while retaining security, guest contract, and package surface coverage.
+- Prune provider tests duplicated by characterization goldens, shared safety checks, and broader contract suites, and remove obsolete provider contract fixtures.
+- Remove redundant core test matrices and narrow D1 proxy checks while retaining wire, security, and native runtime contracts.
+- Prune redundant core test cases and reduce QuickJS log-limit fixture costs while retaining sandbox limits, request cleanup, privacy, and wire-contract coverage.
+- Prune redundant provider tests while retaining characterization goldens, provider-standard evidence, value-safety reviews, and provider-specific security regressions.
+- Release core and the Eve helper together at 0.35.0, finalize upgrade guidance and release status, and document the Eve app's required undici override. Extend the generated-container smoke to verify non-root SQLite token adoption, rotation and restart, credential-free loopback health, active QuickJS shutdown, and physical remote MCP write attempts through the installed transport.
+- **Breaking:** Send remote MCP writes through the owned Node transport so HTTP 421 responses
+  and host retry dispatchers cannot silently repeat them. Node deployments must
+  serve with `listen` from `@zackbart/connecta/node` to send remote writes. Node
+  hosts serving `connecta.fetch` without `listen` lose remote writes that worked
+  in 0.34; those writes are now refused before dispatch. The owned transport
+  connects directly by default or through an explicit HTTP(S) CONNECT proxy,
+  ignoring ambient outbound proxy settings and host dispatchers.
+  Unconfirmed dispatched writes retain an unknown, non-retryable outcome.
+- Documentation now names 0.35.0 as the consolidated rework release. The GitHub personal-auth refusal no longer promises per-user OAuth attribution in a specific release.
+- Run QuickJS executor coverage in parallel across execution, limits, and lifecycle suites, reusing warm children for ordinary result and host-error cases while retaining fresh executors for interruption and shutdown coverage.
+- Pin SQL batch rollback with failure-injection tests for SQLite and real local D1, including multi-key copies and expiry sweeps.
+- **Breaking:** Standardize Stripe's six-tool API surface for 0.35. Tool names stay the same.
+  Replace `select` with `fields` on `stripe_api_read` and `stripe_api_write`;
+  both named reads also accept `fields`. Invalid roots fail before dispatch.
+  Replace `page.next` with `page.nextCursor` and pass it as the top-level
+  `cursor`, retaining the original path, filters and selected fields. Raw
+  `query.starting_after`/`query.ending_before` record-id anchors remain supported
+  on a first request without cursor; a cursor with a raw anchor or both directions
+  is refused. Raw vendor continuation tokens cannot be used as cursor. Search
+  defaults to 6 hits and caps at 8 instead of 10/50; it and large details results
+  have explicit continuation, bounded discovery and `truncated` paths. Search
+  drops `tag`, omits `tool` for refused operations, and adds `named`/`matched`.
+  HTTP 409 now fails as `conflict`; oversized 424 replies preserve dependency
+  failure and unknown-write semantics, and failed body reads receive truthful
+  wording. Writes refuse whole withheld placeholders and links before dispatch.
+  The guide uses generated conventions. See the Stripe section of
+  `documentation/provider-migration-0.35.md` for the complete mapping.
+  The guide identifies the configured account and its confirmation read. V2
+  pages retain fetched data without a continuation when the next URL adds
+  omitted parameters; a signed cursor in a raw record anchor is refused with
+  guidance to use `cursor`.
+- **Breaking:** Standardize Tithe.ly's agent surface for 0.35.0 (decision 0011 step 2). `tithely_api_get` becomes `tithely_api_read` and `tithely_api_mutate` becomes `tithely_api_write`: `query` and `form` name/value lists become `query` and `body` objects, the reply `{ result }` becomes `{ status, data }`, and each call is checked against Tithe.ly's documented operations before it is sent. New `tithely_api_search` and `tithely_api_details` find operations and their parameters without reading account data. `get_organization` and `get_account` are removed: use `list_organizations`/`list_accounts` rows or `tithely_api_read`. `raw` is removed from every named read, and `sensitiveFields: "return"` now widens only the hatch. Lists return `{ items, page }` (the `organizations`, `accounts`, `charges`, `recurringCharges` and `paymentMethods` keys are gone), `page.nextCursor` is omitted on the last page, `list_payment_methods` pages with `limit` and `cursor`, every named read takes `fields`, and organization rows now include `widgetId`. 429 and 5xx answers use the kit's standard wording. The guide's paging, hatch, write and error conventions are generated, and operator setup moves to the maintained provider setup page.
+- **Breaking:** Standardize Vercel's API tools for 0.35.0. Replace `delete_project_env_var`
+  with `vercel_api_write` using DELETE `/v9/projects/{projectId}/env/{envVarId}`;
+  both are destructive and use the host's write route. Other tool names remain.
+  Replace hatch `select` with `fields`, `list_teams.until` with `cursor`, and runtime
+  log `maxRows` with `limit`. Named lists return `items` and `page`; `defaultTeamId`
+  is connection context. Hatch `page.next` becomes signed `page.nextCursor`, passed
+  unchanged in `query[page.param]` (`page.in` is `query`). Search defaults to six
+  hits, allows eight, and pages within 16 KiB; details page within 32 KiB.
+
+  Named reads accept narrowing `fields`. Log truncation uses dot-path arrays,
+  replacing boolean `truncated` and row `textTruncated`; runtime `stopped` remains
+  the collection reason. Unexpected HTML/text/binary acknowledgements for JSON-only
+  operations now fail; dispatched writes report an unknown outcome without replay.
+  Undocumented upload text acknowledgements (`data.contentType`/`data.bytes`) retire.
+  HTTP 409 uses generic `connector_call_failed`, absent a reviewed conflict meaning.
+
+  The Vercel pin is updated to reviewed bytes `4a06e85c2848`: four nondeprecated
+  operations added, no removals, eight changed request contracts. API-key quota
+  responses withhold the entire API-key subtree. Configured `teamId` remains a
+  routing default with intentional teamId/slug/null overrides, enforced consistently
+  across named tools, hatches and uploads; token permissions remain the access boundary.
+
+  Raw environment upserts with only `failed[]` now raise `invalid_args` instead of
+  returning successful hatch data; upsert/update-by-id guidance remains. Partial
+  hatch batches retain both `created` and `failed`. Partial named upserts report
+  created ids and failed variables; missing acknowledgements report unknown outcome
+  without replay. Documented billing JSONL, sandbox command NDJSON and log stream
+  media still parse into rows. Artifact downloads are explicitly refused because
+  they serve binary bytes despite the JSON contract. Audit-event `drainUrl` is
+  withheld entirely, including secret path components and query tokens. URL-shaped
+  continuations retain page data while refusing continuation.
+- A write the downstream answered with HTTP 401 now has an unknown outcome by default in maintained providers and `api()` connectors, since a server may act on a request before it rejects the credential. It keeps its `auth_required` (or `downstream_oauth_required`) code, `reconciliationRequired: true`, and the `authorize_connector` handoff, whose instructions say to authorize and then re-read the target before any fresh call; it gains `writeOutcome: "unknown"`, a message saying the write was sent before the vendor rejected its credential, and no retry advice, key-reuse advice or wait. That holds whatever the call met after the 401 (a body past the response ceiling, a later failure in the same call, a 401 on a composite write's later request, a custom `api()` handler, a 401 answered inside another `api()` or `remoteMcp()` connector the call reached, directly, through a custom connector or from a program, or the call's deadline or the caller's cancellation, which no longer report `write_outcome_unknown` with key-reuse advice) and whatever idempotency key the write carried. Such a call never succeeds: a handler that caught the 401 and returned, or a result that could not be processed, still ends in that verdict, and programs count the write in `writes.unknown`. Before this, Breeze, Cloudflare, GitHub, Mixpanel, Notion, Overflow, Planning Center, Tithe.ly and Vercel reported such a write as a known refusal. A provider keeps that refusal only with reviewed vendor documentation that the vendor authenticates a request before acting on it: Stripe's API-key connector does, for an API v1 answer carrying Stripe's `Request-Id`, since Stripe documents an invalid API key as an error that occurs before execution begins, so its write 401s are unchanged. A write whose credential renewal fails after a 401, for any reason, keeps the 401's authorization code and handoff with an unknown outcome; before, a renewal that failed without an authorization verdict (an operator disconnect racing an `api()` OAuth refresh, an Infisical login outage, a direct `remoteMcp()` write whose caller left during the refresh) became `connector_call_failed`. A renewal that succeeds still leaves a non-retryable `connector_call_failed` with an unknown outcome, even if the handler catches the failure and returns, and no write is ever sent again after a 401. A renewal succeeds only when it yields a different credential than the one the write sent: a refresh or login that hands back the rejected token (remote MCP's OAuth refresh included), or an Infisical recovery already spent earlier in the same request, renews nothing, and the write keeps its handoff. A call whose renewed write shares it with another write stays unknown, never retryable, with no wait or key-reuse advice. A direct guarded transport settles successful mapper returns too. A caught read 401 (positive operation/tool classification plus a recorded GET or HEAD is required; method-override headers always count as writes), or a declared refusal followed by a successful write, does not block success. Reads answered 401 are unchanged.
+
+  A guarded transport that delegates through `ctx.fetch` or `ctx.oauth.fetch` keeps a separate record of each physical send, so a later response cannot erase an earlier write 401 or lend it the wrapper's read evidence. Dispatch and method fields are locked once sent, each response status is recorded once, and renewal only adds that request's own mark. Read replays through static OAuth and remote MCP also keep separate records. The built-in OAuth transport can hand its unsent entry to the recording grant once; every further send gets a new entry, and a response names only its own record. Custom delegated entries do not inherit the wrapper's declared refusal or explicit read classification; this can conservatively leave a successful composite unknown, including when the request init is copied.
+- Compose registry, catalog, invocation, and maintained API calls through native Effect programs while preserving the Promise API, request revocation, secret redaction, and write outcome contracts.
+  Preserve delegating registry wrappers, recoverable native validation failures, graceful stash refusal on corrupt storage, and cleanup error structure. Release completed catalog-read finalizers from long-lived request scopes.
+- Dispatch HTTP routes through two public Effect HttpRouters built once per handler, preserving raw paths, route ordering, method refusals and response-body lifetimes.
+- Compose inbound authentication and downstream OAuth as native Effect programs while preserving Promise adapters, credential ownership, one-use grants and cancellation behavior.
+- Compose upward MCP registration, tool and Skills dispatch, continuation policy, and result redaction with native Effect programs while preserving the modern and fresh stateless legacy SDK protocol adapters and Promise APIs.
+- Compose SQLite and D1 storage, activity history, and KV copy operations with native Effect SQL execution while preserving Promise APIs, atomic claims and batches, existing database formats, and payload-free diagnostics.
+
+  Native storage and activity validation and decoding failures retain the original thrown value in the typed failure channel, matching custom Promise adapters.
+- Finalize the joint Connecta and Eve 0.35.0 release notes with the completed Effect core, explicit Node proxy support, credential transport requirements and authenticated request-body limits.
+- **Breaking:** Bound authenticated MCP request bodies with `admission.requests.maxBodyBytes`, defaulting to 4 MiB on every endpoint. Oversized streams stop with the existing 413 refusal and release admission. The Node adapter's separate pre-auth buffer drops from 10 MiB to 4 MiB.
+- Run Worker Loader and QuickJS host acquisition, execution, cancellation, and cleanup as native Effect programs while preserving the Promise executor contract and synchronous lease release.
+- Compose remote MCP connection, catalog, call, resource, Skills and auth workflows as native Effect programs around the pinned SDK, preserving Promise APIs, request lifetimes, complete caches and one-attempt writes. Honor decorated or replaced storage and activity methods through native dispatch, including nested storage namespaces.
+- Preserve original API-operation summaries and expose reviewed policy in a separate `refusal` field. Search retains bounded actionable reasons; details returns complete reasons, including methods intentionally absent from call schemas. Gmail remains draft-only with no write hatch (#1033).
+- Reduce generated provider index storage by sharing complete parameter rows and decoding operation details lazily, preserving schemas, refusals, search results and cursor identity.
+
+### Fixed
+
+- Maintain defensive redaction boundaries while preserving ordinary text and link spelling.
+- Settle write failures from the complete logical call's dispatch ledger (H1). Only positive pre-dispatch or served-refusal evidence can establish a known failure. A dispatched write with an uncertain result is non-retryable, including when later calls fail, guest code catches an error or a recovery wrapper supplies authorization guidance. Programs retain `writes.unknown` and require reconciliation before a fresh write. Direct keyed Stripe requests retain only the retry guidance supported by the vendor's actual idempotency contract. See [write outcomes and recovery](https://github.com/zackbart/connecta/blob/main/documentation/code-mode.md#writes).
+- Bound result-paging authentication to once per access-validation pass and reuse connector catalogs within each pass, so large search handles page within their deadline even with slow token storage. Keep both live access checks, including revocation during paging, and distinguish access-validation timeouts from result-storage timeouts.
+- Make CI Chromium setup resilient to slow Ubuntu mirrors with cached browser downloads, HTTPS package sources, bounded apt operations and one install retry.
+- `clerkAuth`'s extra Backend API verification of an opaque OAuth access token works on Workers. It asked for `redirect: "error"`, which workerd rejects, so every opaque token was refused there; it now asks for `manual` and refuses a redirect without following it. The verification also ends its request and response body on every outcome, including an error status, an oversized body, a caller that leaves, and the ten-second deadline. It previously left the request open and the body unread after an error status, and read a body of any size; the response is now read as bytes and refused past 64 KiB.
+- Infer write outcomes and reconciliation advice from call-owned dispatches. A failed maintained-provider call whose complete tracking records an auxiliary resource read and no call-owned dispatch keeps its retry or authorization recovery advice, including when it reports a timeout. Explicit unknown-outcome markers always take precedence. Empty ledgers, missing or incomplete evidence, authentication POSTs alone, kit requests falsely declared as auxiliary reads, custom `api()` and `remoteMcp()` connectors, invocation deadlines, cancellation, and dispatched call-owned writes remain conservative. Auxiliary effect labels do not change core write reservation or replay rules.
+- Stabilize the shared-deadline tests for direct and guest calls: they now expire each short deadline only after the downstream call has started, so catalog resolution or hashing on a slow host can no longer end the call in the `catalog` stage before the stage under test.
+- Make the OAuth Restart expiry-ambiguity test wait for refresh receipt explicitly, preserving delayed storage and late-response assertions without a wall-clock polling deadline.
+- Clarify that hosts own write confirmation, retain connector identity guidance alongside bounded API-search pointers without duplicate filter-recovery text, and suppress write pointers on read-only endpoints. Unreadable successful write responses report an unknown outcome and say to check before repeating; auxiliary read failures keep their read wording. Configured credentials return conditional guidance with their operator handoff, including after an authentication failure in an earlier request.
+- Clarify that Node deployments need `listen()` and the template's `undici` dependency for guarded provider writes and requests using non-GET/HEAD methods, including reviewed read-only POSTs. Correct the Vercel value-safety source reference. Record the already-shipped shared provider-kit behavior that attaches a bounded `httpStatus` fact to operator failure records, including GitHub failures.
+- Preserve reviewed vendor failure classifications when private request values overlap public error reasons or codes, while keeping diagnostic text redacted.
+- Preserve failure classification and bounded retry delays when sent private values match declared numeric response headers or body fields. Delays are read as whole seconds or an HTTP-date and capped at 24 hours; off-spec values such as `"1.5"` no longer give a retry hint. Failure messages and operator records continue to use redacted data.
+- Keep golden captures bounded while allowing delayed native Web Crypto to settle before resuming the driver. Producer-fed reads retain bounded rejection and full capture cleanup, preserving existing golden observations and allowing the next capture to run after unsupported producer dependencies. Reject late work from closed capture epochs so exhausted native cleanup cannot contaminate later observations.
+- Regenerate Planning Center drift output after the hosted-half removal dropped `generated.hosted`.
+- Make activity-label deadline tests wait for resolver entry and check URL scanner work with deterministic character/search-work budgets and a generous time backstop for native regex scans.
+- Grade Google eval tasks from returned resource facts and final state across equivalent reads. Tighten shared Google index, field-mask, and Discovery evidence guards before product migrations. Accept referenced Discovery evidence and projected named-read page schemas in the provider-standard checker.
+- Stabilize the executor-shared write-deadline and Infisical recovery tests: they now expire each short deadline only after the write has been dispatched, so catalog resolution or the login exchange on a slow host can no longer end the call before the stage under test. The Workers test project now reports only rejections still unhandled after the microtask checkpoint, as Node does, so a cancelled response body or a deadline that ends a catalog listing no longer reports a spurious unhandled rejection.
+- Improve API operation discovery for noun phrases, create and update phrases after conversational framing, cell references, and explicit refusals with the same reviewed reason in search, details, and calls. Generated provider guidance names tools that can continue, explains the cursor location, preserves continuation before a program exceeds its call limit, and summarizes nonzero refused operations with a count and details lookup.
+- Rank API operations by intent and the requested action before root-collection ties. Keep explicit write verbs when their objects contain read words, accept modifiers before resources with bounded noun coverage, recognize common plurals and conversational queries without admitting verb-only matches for an unrelated resource, and keep Planning Center person operations reachable beyond the leading profile results.
+- Preserve vendor error wording when a read answered HTTP 421 becomes retryable, and withhold provider hook defect text during credential probes.
+- Withhold vendor text from provider-kit result-hook defects, require canonical path resolution for reviewed tables even with a global review, and preserve accepted-write retry diagnostics with the original HTTP status.
+- Replace the former narrow-matrix retry policy with four representative light/dark Overview and connector Connection baselines. Visual comparisons never retry; failed attempts retain diffs and traces.
+- Close accepted Node connections that have not sent their first HTTP request during graceful shutdown. Spare client sockets left after canceled authentication probes no longer hold token adoption, rotation, and doctor deployments open until the shutdown deadline; active requests and sandbox children still receive cleanup.
+- Stabilize the operator-sink output tests: their sentinel check now matches only planted markers, so a random activity id whose hex digits happen to contain the marker suffix no longer fails the run.
+- **Breaking:** Constrain Stripe and Cloudflare non-JSON success responses to reviewed operation/media pairs, preserving downloads, streams, raw Worker content and R2/KV object reads. Unexpected HTML/text on JSON writes reports an unknown outcome without replay. Withhold Vercel partial environment-write failure prose, identify the sent key, and retain safe created ids/keys and failed keys/codes after redaction. Validate pinned path parameter types, enums and numeric bounds before dispatch, including canonical ASCII decimal safe-integer ids.
+
+  Overflow refund initiation accepts the documented application/json string, the narrow NestJS-compatible text/plain acknowledgement, or an empty 2xx acknowledgement. Nonempty HTML, binary, other media and JSON-object replies produce an unknown write outcome; check the target before repeating the single dispatched write. Vercel env value inputs are marked writeOnly and echoes are withheld on named and raw env writes.
+- Stabilize the bounded skill-cancellation test: it now expires its deadlines only after the downstream skills scope opens, and a new test covers cancellation that lands while local skill manifests are still being hashed, before any downstream scope opens.
+- Consolidate generated provider drift key and digest validation in the shared drift validator. Cancel activity display-label lookups and their Clerk transport when the reader leaves or the lookup budget expires. Clarify Worker test enrollment and fixture watch restarts.
+- Withhold every provider hook defect on HTTP kit operations that withhold vendor text, including reviewed redaction and error facts. Report a read's HTTP 421 as retryable `unavailable` advice without resending; physical writes keep their existing refusal.
+- Defer unhandled-rejection reporting until the microtask checkpoint finishes in the Worker example's Alchemy stack and local Wrangler configuration, avoiding false reports for rejections handled within that checkpoint. Existing deployments receive the behavior on their next deploy after adding the flag.
+- Restore explicit additive-write annotations across Breeze and Google named tools, including Gmail draft creation. Kit writes can also declare reviewed idempotency hints independently of transport keys. Correct the affected migration notes, generated Google Conventions punctuation, and sentence boundaries in Google failure messages. Partial Docs creates and oversized successful write replies carry one unknown-outcome sentence with recovery advice.
+
+  Align auth recovery advice with program write accounting for proven resource refusals. Auth failures after entering a write with no call-owned dispatch, including credential refusals, static-OAuth refresh failures, and remote MCP connect/initialize 401s, report unknown outcomes and require reconciliation. Count kit auxiliary requests without physical read proof as call-owned when settling failures, including 503 and unavailable responses.
+
+  Treat undefined plain-object properties as absent during input validation, without mutating caller arguments or copying dates, byte arrays and class instances. A throwing input getter is a validation refusal. An evaluation failure no longer disables a cached validator for later calls. Omitted destructive hints keep the conservative default.
+- Accept equivalent Sheets append ranges and numeric or lexical Gmail id ordering in offline evaluation graders. Add negative controls and disclose all saved-trial regrades alongside unchanged original results.
+- Close active Node response connections promptly after shutdown drain, including completed SSE streams, without a keepalive tail or a false shutdown deadline failure. Preserve normal keepalive and the configured shutdown deadline.
+- **Breaking:** Send downstream OAuth token, registration and revocation POSTs through the owned one-attempt transport on Node, including an explicitly configured proxy. Refuse unsupported Node hosts before code/refresh claims, retain native discovery GETs and Workers fetch, and withhold credential transport diagnostics.
+- Keep scoped OAuth polls from discarding unrelated full-refresh results or their bounded recovery, while retaining the newer polled connector row.
+- List every declared agent and its pools with supported credential types, distinguish an absent token module from an unissued token, and show payload-free last-seen observations sampled within a minute from successful OIDC or agent-token endpoint admission, with best-effort recording bounded to 500 ms or the shorter probe deadline.
+- Expose reliable Planning Center collection totals as page.total on named and
+  paged hatch reads, while preserving opaque continuations and omitting invalid
+  optional totals. Stop suggesting excluded applications' unavailable tools in
+  generated guides and hatch discovery.
+- Prefer exact API resources across versioned namespaces while retaining authored tools, compound resource names and existing action-query relevance (#1030).
+- Strengthen Vercel response value withholding while preserving useful metadata and one-attempt write handling.
+
+### Removed
+
+- **Breaking:** Remove the `@zackbart/connecta/providers/basecamp`, `/providers/intercom`, `/providers/linear`, `/providers/revenuecat`, and `/providers/wispr-flow` subpath imports. Replace these presets with generic `remoteMcp()` entries using the [hosted MCP migration guide](https://github.com/zackbart/connecta/blob/main/documentation/hosted-mcp-migration.md), preserving connector ids, credential ownership, scopes, regional URLs, and read-only restrictions.
+- **Breaking:** Remove the hosted halves of Stripe, Vercel, Cloudflare, Notion, Mixpanel, and GitHub, hosted drift checks, reviewed classification and UI drift reports. Old hosted selectors require generic `remoteMcp()` entries; `classify` requires `ConnectaConfig.classification`. GitHub now exposes seven REST tools after its standard-surface migration; its 26 former hosted tools are removed. Remote source classification now uses fail-closed annotations only. The hosted MCP migration guide maps each former URL, auth mode, headers and scope to a separate generic connection beside its API connector.
+- **Breaking:** Remove the Infisical, Notion, and Mixpanel providers and their package exports.
+  Use generic `remoteMcp()` entries for Notion and Mixpanel hosted servers;
+  Infisical has no maintained replacement. See the provider migration for 0.35.
+
+### Security
+
+- **Breaking:** Preserve one-attempt write behavior and conservative unknown outcomes across HTTP providers, custom connectors and remote MCP. Credential renewal, redirects and recovery handoffs cannot replay a dispatched write or erase its uncertainty. Reads retain their supported recovery paths. Apply the configured sensitive-field policy before returning provider results and retain caller, admission and redaction context across provider boundaries. See the [0.35 provider migration](https://github.com/zackbart/connecta/blob/main/documentation/provider-migration-0.35.md) for provider-specific behavior changes.
+- Bound inbound adapter authorizations to 16 per loaded core in a process or Worker isolate across MCP, agent, operator, and browser OAuth routes. Saturation fast-refuses with retryable 503 `authentication_busy` and `Retry-After: 1`, before adapter or SDK work. Preserve prompt subscription-listen refusal under a full MCP execution pool and account for authentication I/O through actual settlement.
+
+  Keep admission charged until authentication I/O and cancellation settle. After the hard deadline plus one second of grace, move stalled work into a separate allowance of 16 abandoned operations; refuse new work while it is full, log `authentication_abandoned_saturated`, expose both counters in `/health`, and bound outstanding authorizations to 32. Release a charge exactly once: when its work settles, or when a `FinalizationRegistry` finalizer shows that nothing can ever settle it, as after Cloudflare cancels an invocation's I/O. That release is eventual, never timed, never happens while a caller, middleware, or other handler can still settle the work, and logs `authentication_unreachable`; `/health` reports `admission.authentication.unreachableRelease`. The Worker example sets `enable_weak_ref`, which exposes `FinalizationRegistry` before the 2025-05-05 compatibility date; without it, only settlement releases a charge. Return Access and agent-token deadline refusals promptly without losing native-operation accounting. Cache Clerk domain/gate verdicts only after completed, uncancelled checks. Bind all Clerk SDK fetches to the owning request and authentication deadline, close response bodies before returning buffered data to the SDK, and preserve Worker disconnect cleanup through the invocation context.
+- Move CCB v2 onto the shared provider kit, preserving its tools, requests, OAuth diagnostics and characterized results. Apply the deployment's sensitive-field policy before every projection, closing nested-value gaps in custom fields, event guest counts and scheduling metrics.
+- Bind signed continuations to the admitted caller and pool owner when a connection's downstream identity varies per caller. Refuse a continuation from another identity before sending a downstream request.
+- Override undici to 8.12.3 in the Eve helper's development and test install, for GHSA-xjj6-f33q-929c, GHSA-4qv8-2p9j-2685, and GHSA-f72v-6w45-q472. The published helper's dependencies are unchanged. Eve 0.83.0 requires undici 8.10.2, so a deployment that installs Eve receives that version unless it overrides undici itself.
+- Withhold complete signing values written with character references in provider text and reviewed links.
+- Harden credential and private-argument withholding across provider results, errors, continuations and program outputs.
+- Value safety now takes its most protective choice when sent-secret redaction changed a value it decides on: a resource type, a record's label or type, an environment entry, a URL's scheme or parameter name, a streamed row's field name, a response's Content-Type, or the public prefix of a credential (such as `sk_live_`, `whsec_` or a signing parameter's name) whose remainder follows. Echoed sensitive header lines are read before an echoed value in them is replaced, so their whole value is withheld. Such a response may withhold more than before; other responses are unchanged.
+- Sent-secret redaction no longer renames vendor field names before result safety runs. Provider kit responses keep their field names and have every value redacted, so value safety and projections find each field by the name the vendor gave it; response header names are kept the same way, with their values redacted. Field names are still checked for sent secrets before results, failures and program values reach the agent. The reviewed field-name exemption that Docs, Slides, Sheets and Drive declared is no longer needed and is removed.
+- Update zod to 4.6.6 to pick up an upstream fix for memory use when validating oversized collections.
+
+## 0.34.1 — 2026-10-19
+
+Connecta 0.34.1 is a patch release with a security fix. The Cloudflare provider passed stored AI Search crawler headers through unredacted, including on the routes 0.34.0 already served, so any caller allowed to read those resources could see header values that may carry credentials. 0.34.1 withholds them, along with conditional firewall match credentials, Vercel daemon probe headers, setup-form defaults and payment client secrets, and refuses Cloudforce One match responses that have no published schema before any request is sent. Deployments that use the Cloudflare or Vercel providers should upgrade.
+
+Connectors can now set `readOnly: true` (#895). A read-only connector serves only reviewed reads on every endpoint, maintainers' plain `/mcp` included; write and unclassified tools are hidden from discovery and refused on every call path. It combines with endpoint and pool `readOnly`, and the default is unchanged. The Stripe guide now shows both setups side by side: OAuth to Stripe's hosted MCP, or a secret or restricted key through the REST connector, with or without `readOnly`. A new maintained Intercom provider supports personal OAuth or a shared bearer token in the US or EU region; its schemas are not pinned yet because Intercom's catalog requires authentication to list.
+
+Catalog drift no longer counts as connector health (#867): a drifted connector reads Connected and stays out of Needs attention, while drift details remain on the connector page and in Activity. Connector cards, counts and the attention list keep their last verdict and position while details reload, and the top bar is more compact. Drift detection itself is corrected (#884): reordered schema arrays no longer report false changes for schemas pinned in the new format (existing pins keep their original hashing until re-reviewed), plan-gated tools can be marked optional, schema coverage is reported honestly, failed fingerprints mark verification unavailable instead of keeping a clean report, and per-person connectors keep separate observations. The Linear, Mixpanel, RevenueCat and Stripe reviews are reconciled with their live hosted catalogs and pin schemas; Mixpanel's Get-Events, Get-Dashboard, List-Cohorts and Get-Metric serve as reads again without deployment overrides, so a `classification: { mixpanel: { "Get-Events": "read" } }` override can be removed. Upgrading from 0.34.0 needs no configuration, storage migration or token rotation.
+
+### Added
+
+- Add a maintained Intercom hosted MCP provider with explicit US/EU region selection, personal OAuth or shared bearer-token auth, reviewed tool classifications, and guidance for sensitive support data and optional Fin Operator actions. Permission-gated Fin tools are optional for missing-tool drift while present tools retain classification checks. Schema coverage reports present reviewed tools as unpinned. Schema digests remain unpinned because anonymous catalog discovery requires authentication.
+- Add optional connector-level `readOnly` to every connector and maintained provider, enforcing read-only discovery and calls on every endpoint. Show the policy in the operator UI and clarify Stripe OAuth and API-key setup.
+
+### Fixed
+
+- Correct catalog drift reporting with schema coverage and verification states,
+  identity-partitioned observations, optional gated tools, and versioned schema
+  set canonicalization that preserves existing pins. Detect documented tool
+  access changes and stale unclassified acknowledgements in provider checks.
+  Operator refresh responses include the catalog comparison from that refresh,
+  so hashing failures and changed schemas cannot return an earlier clean report.
+  Provider pin assertions select the stored digest format, and a generated-roster
+  guard verifies every pin against captured schemas and rejects input/output drift.
+- Reconcile the maintained Linear catalog with hosted label lifecycle, inbox, saved view, triage, and diff tools. Preserve plan-gated customer requests, review the documented customer-needs read, and pin the observed hosted schemas so later changes fail closed.
+- Refresh reviewed hosted Mixpanel schemas so Get-Events, Get-Dashboard, List-Cohorts, and Get-Metric remain available to read-only endpoints without deployment overrides. Review the limited-beta Get-Audit-Log as a read, retain Fill-Event-Metadata as a write, and classify Get-Experiment as destructive because its optional computations can persist results and auto-conclude experiments.
+- Keep catalog drift informational, keep each connector's last verdict on every operator view while its details are read again so cards, counts and the attention list stop bouncing, keep attention rows in configuration order as their verdicts settle, safely hold prototype-named connector IDs, keep card and detail headers and Overview attention text on single lines with accessible ellipsis, including long connector ids, auth scopes and Read-only badges, reserve the card action footer and empty tool bar row, and compact the top bar for long deployment names and all page tabs.
+- Refresh Vercel and Cloudflare REST contracts and value-safety reviews, withhold conditional firewall match credentials, stored AI Search crawler headers and daemon probe headers, setup-form defaults, and payment client secrets, refuse schemaless Cloudforce match responses before dispatch, admit two stateless Cloudflare POST reads, classify hosted Cloudflare documentation search as read-only, and reconcile Vercel's complete hosted tool inventory.
+- Review RevenueCat subscription-group listing, audience preview, and paywall screenshot rendering as reads, pin four live schemas, and clarify permission-gated catalogs and conservative credential-validation routing.
+- Refresh Stripe hosted MCP tool reviews for money movement, recipient setup, Atlas formation, and renamed feedback; remove retired reviews, pin captured schemas for drift detection, and document account, mode, and human-confirmation requirements.
+
 ## 0.34.0 — 2026-10-16
 
 Connecta 0.34.0 rebuilds the operator UI around an Overview with connector health, endpoints, people and agents, a Needs attention list with fix prompts, and a connection map (#867). Maintainers now land on Overview at `/`; Endpoints moves to `/endpoints`, and `/access` redirects there. Update bookmarks, links and browser automation that expected Endpoints at `/`. Members still get their member page on every operator page path. The upgrade steps are in `documentation/migration-0.34.md`.