nexo-brain 7.30.21 → 7.30.22

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "nexo-brain",
-  "version": "7.30.21",
+  "version": "7.30.22",
   "description": "Local cognitive runtime for Claude Code \u2014 persistent memory, overnight learning, doctor diagnostics, personal scripts, recovery-aware jobs, startup preflight, and optional dashboard/power helper.",
   "author": {
     "name": "NEXO Brain",

package/README.md

@@ -18,7 +18,7 @@
 
 [Watch the overview video](https://nexo-brain.com/watch/) · [Watch on YouTube](https://www.youtube.com/watch?v=i2lkGhKyVqI) · [Open the infographic](https://nexo-brain.com/assets/nexo-brain-infographic-v5.png)
 
-Version `7.30.21` is the current packaged-runtime line. Patch release over v7.30.20 - Brain now ships managed default MCP catalog/lock reconciliation and the Operational Closure Plane, with Desktop v0.43.12 consuming the coordinated runtime contract.
+Version `7.30.22` is the current packaged-runtime line. Patch release over v7.30.21 - Brain now ships managed default MCP catalog/lock reconciliation and the Operational Closure Plane, with Desktop v0.43.14 consuming the coordinated runtime contract.
 
 Previously in `7.30.20`: patch release over v7.30.19 - packaged installs now copy the `product_knowledge` package into the installed runtime so `nexo update` can import the new product knowledge tools.
 

package/bin/nexo-brain.js

@@ -1346,7 +1346,7 @@ function getCoreRuntimeFlatFiles(srcDir = path.join(__dirname, "..", "src")) {
 }
 
 function getCoreRuntimePackages() {
-  return ["db", "cognitive", "doctor", "local_context", "product_knowledge"];
+  return ["db", "cognitive", "doctor", "local_context", "managed_mcp", "product_knowledge"];
 }
 
 // Brain contracts — files the NEXO Brain publishes to consumers like
@@ -4306,6 +4306,12 @@ async function runSetup() {
   const runtimeCliPath = path.join(NEXO_HOME, "bin", "nexo");
   fs.writeFileSync(runtimeCliPath, runtimeCli);
   fs.chmodSync(runtimeCliPath, 0o755);
+  const managedMcpSource = path.join(__dirname, "nexo-managed-mcp.js");
+  if (fs.existsSync(managedMcpSource)) {
+    const managedMcpTarget = path.join(NEXO_HOME, "bin", "nexo-managed-mcp");
+    fs.copyFileSync(managedMcpSource, managedMcpTarget);
+    fs.chmodSync(managedMcpTarget, 0o755);
+  }
 
   log("Copying core packages...");
   // Core packages (directories with __init__.py)

package/bin/nexo-managed-mcp.js

@@ -30,6 +30,23 @@ function findEntry(capabilityId) {
   return null;
 }
 
+function disabledList() {
+  return String(process.env.NEXO_MANAGED_MCP_DISABLED_CAPABILITIES || "")
+    .split(",")
+    .map((item) => item.trim())
+    .filter(Boolean);
+}
+
+function isDisabled(capabilityId) {
+  const global = String(process.env.NEXO_MANAGED_MCP_DISABLE || "").trim().toLowerCase();
+  if (["1", "true", "yes", "on"].includes(global)) return true;
+  return disabledList().includes(capabilityId);
+}
+
+function readInstalledState() {
+  return readJson(path.join(nexoHome(), "runtime", "managed-mcp", "installed-state.json")) || {};
+}
+
 function providerEnv() {
   return {
     PATH: process.env.PATH || "",
@@ -38,8 +55,15 @@ function providerEnv() {
   };
 }
 
-function stagedProviderCommand(providerId) {
-  return path.join(nexoHome(), "runtime", "managed-mcp", "artifacts", providerId, "bin", providerId);
+function stagedProviderCommand(providerId, state) {
+  const providers = state && state.providers && typeof state.providers === "object" ? state.providers : {};
+  const provider = providers[providerId] && typeof providers[providerId] === "object" ? providers[providerId] : {};
+  const explicit = process.platform === "win32"
+    ? (provider.executable_win32 || provider.executable)
+    : provider.executable;
+  if (explicit) return String(explicit);
+  const suffix = process.platform === "win32" ? ".cmd" : "";
+  return path.join(nexoHome(), "runtime", "managed-mcp", "artifacts", providerId, "bin", `${providerId}${suffix}`);
 }
 
 function spawnProvider(command, args, env) {
@@ -63,6 +87,11 @@ function main() {
     console.error("usage: nexo-managed-mcp run <capability_id>");
     process.exit(64);
   }
+  if (isDisabled(capabilityId)) {
+    console.error(`NEXO managed MCP capability '${capabilityId}' is disabled by policy.`);
+    process.exit(78);
+  }
+  const state = readInstalledState();
   const entry = findEntry(capabilityId);
   const meta = entry && entry.nexo ? entry.nexo : {};
   const providerId = meta.provider_id || "";
@@ -70,12 +99,21 @@ function main() {
     console.error(`NEXO managed MCP capability '${capabilityId}' is not installed yet.`);
     process.exit(69);
   }
-  const providerCommand = stagedProviderCommand(providerId);
-  const env = providerEnv();
+  const providerCommand = stagedProviderCommand(providerId, state);
+  const env = {
+    ...providerEnv(),
+    NEXO_MANAGED_MCP_CAPABILITY: capabilityId,
+    NEXO_MANAGED_MCP_PROVIDER: providerId,
+    NEXO_MANAGED_MCP_RISK: String(meta.risk || ""),
+  };
   if (!fs.existsSync(providerCommand)) {
     const providerPackage = String(meta.provider_package || "");
     const providerVersion = String(meta.provider_version || "");
     const providerBin = String(meta.provider_bin || providerId);
+    if (String(process.env.NEXO_MANAGED_MCP_ALLOW_NPX_FALLBACK || "").trim() !== "1") {
+      console.error(`NEXO managed MCP provider '${providerId}' is not staged. Run nexo_managed_mcp_status(apply=true) to install managed providers.`);
+      process.exit(69);
+    }
     if (!providerPackage || !providerVersion || providerVersion === "0.0.0-managed") {
       console.error(`NEXO managed MCP provider '${providerId}' is not staged and has no exact locked npm package.`);
       process.exit(69);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nexo-brain",
-  "version": "7.30.21",
+  "version": "7.30.22",
   "mcpName": "io.github.wazionapps/nexo",
   "description": "NEXO Brain — Shared brain for AI agents. Persistent memory, semantic RAG, natural forgetting, metacognitive guard, trust scoring, 150+ MCP tools. Works with Claude Code, Codex, Claude Desktop & any MCP client. 100% local, free.",
   "homepage": "https://nexo-brain.com",

package/src/auto_update.py

@@ -4828,6 +4828,7 @@ def _copy_runtime_from_source(src_dir: Path, repo_dir: Path, dest: Path = NEXO_H
         "cognitive",
         "doctor",
         "local_context",
+        "managed_mcp",
         "product_knowledge",
         "dashboard",
         "rules",
@@ -4970,6 +4971,12 @@ def _copy_runtime_from_source(src_dir: Path, repo_dir: Path, dest: Path = NEXO_H
     wrapper = bin_dir / "nexo"
     wrapper.write_text(_runtime_cli_wrapper_text())
     wrapper.chmod(0o755)
+    managed_mcp_src = repo_dir / "bin" / "nexo-managed-mcp.js"
+    if managed_mcp_src.is_file():
+        managed_mcp_target = bin_dir / "nexo-managed-mcp"
+        _remove_runtime_copy_target(managed_mcp_target)
+        shutil.copy2(str(managed_mcp_src), str(managed_mcp_target))
+        managed_mcp_target.chmod(0o755)
 
     return {
         "packages": copied_packages,

package/src/cli.py

@@ -170,6 +170,48 @@ def _mcp_status(args) -> int:
     )
 
 
+def _closure(args) -> int:
+    from closure_plane import closure_next, closure_snapshot, closure_status, refresh_closure_items
+    from db import get_db
+    from db._schema import run_migrations
+
+    conn = get_db()
+    run_migrations(conn)
+    command = str(getattr(args, "closure_command", "") or "status")
+    if command == "status":
+        payload = closure_status(
+            conn,
+            refresh=not bool(getattr(args, "no_refresh", False)),
+            limit=max(1, min(int(getattr(args, "limit", 10) or 10), 100)),
+        )
+    elif command == "next":
+        if bool(getattr(args, "refresh", False)):
+            refresh_closure_items(conn)
+        payload = {
+            "ok": True,
+            "items": closure_next(
+                conn,
+                limit=max(1, min(int(getattr(args, "limit", 10) or 10), 100)),
+                include_waiting=bool(getattr(args, "include_waiting", False)),
+                source=str(getattr(args, "source", "") or ""),
+                kind=str(getattr(args, "kind", "") or ""),
+                state=str(getattr(args, "state", "") or ""),
+                max_risk=getattr(args, "max_risk", 0.0),
+                area=str(getattr(args, "area", "") or ""),
+            ),
+        }
+    elif command == "snapshot":
+        payload = closure_snapshot(
+            conn,
+            refresh=not bool(getattr(args, "no_refresh", False)),
+            snapshot_date=str(getattr(args, "date", "") or ""),
+            limit=max(1, min(int(getattr(args, "limit", 10) or 10), 100)),
+        )
+    else:
+        payload = {"ok": False, "error": "unsupported closure command"}
+    return _print_json_or_text(payload, as_json=bool(getattr(args, "json", False)))
+
+
 def _mcp_write_message(stdin, payload: dict) -> None:
     raw = json.dumps(payload, separators=(",", ":"), ensure_ascii=False).encode("utf-8")
     stdin.write(raw + b"\n")
@@ -4307,6 +4349,29 @@ def main():
         help="Install Codex automatically when the selected runtime needs it and it is missing.",
     )
 
+    # -- closure --
+    closure_parser = sub.add_parser("closure", help="Operational closure queue")
+    closure_sub = closure_parser.add_subparsers(dest="closure_command")
+    closure_status_p = closure_sub.add_parser("status", help="Show closure queue status")
+    closure_status_p.add_argument("--limit", type=int, default=10, help="Top items to include")
+    closure_status_p.add_argument("--no-refresh", action="store_true", help="Do not refresh adapters before reading")
+    closure_status_p.add_argument("--json", action="store_true", help="JSON output")
+    closure_next_p = closure_sub.add_parser("next", help="Show ranked closure items")
+    closure_next_p.add_argument("--limit", type=int, default=10, help="Maximum items")
+    closure_next_p.add_argument("--include-waiting", action="store_true", help="Include waiting_user/blocked items")
+    closure_next_p.add_argument("--refresh", action="store_true", help="Refresh adapters before reading")
+    closure_next_p.add_argument("--source", default="", help="Filter by source")
+    closure_next_p.add_argument("--kind", default="", help="Filter by kind")
+    closure_next_p.add_argument("--state", default="", help="Filter by state, e.g. ready or waiting_user")
+    closure_next_p.add_argument("--area", default="", help="Filter by owner/source/kind/payload area")
+    closure_next_p.add_argument("--max-risk", type=float, default=0.0, help="Filter by maximum risk_score")
+    closure_next_p.add_argument("--json", action="store_true", help="JSON output")
+    closure_snapshot_p = closure_sub.add_parser("snapshot", help="Write and show the daily closure snapshot")
+    closure_snapshot_p.add_argument("--date", default="", help="Snapshot date YYYY-MM-DD")
+    closure_snapshot_p.add_argument("--limit", type=int, default=10, help="Top items to include")
+    closure_snapshot_p.add_argument("--no-refresh", action="store_true", help="Do not refresh adapters before snapshot")
+    closure_snapshot_p.add_argument("--json", action="store_true", help="JSON output")
+
     # -- preferences --
     preferences_parser = sub.add_parser(
         "preferences",
@@ -4848,6 +4913,10 @@ def main():
             return _clients_sync(args)
         clients_parser.print_help()
         return 0
+    elif args.command == "closure":
+        if not args.closure_command:
+            args.closure_command = "status"
+        return _closure(args)
     elif args.command == "mcp":
         if args.mcp_command == "status":
             return _mcp_status(args)

package/src/closure_plane.py

@@ -11,12 +11,34 @@ import datetime as _dt
 import hashlib
 import json
 import os
+import time as _time
 from pathlib import Path
 from typing import Any
 
 
 OPEN_STATES = {"open", "waiting", "verified"}
 FINAL_STATES = {"closed", "rejected", "stale"}
+STATE_ALIASES = {
+    "ready": "open",
+    "waiting_user": "waiting",
+    "blocked": "waiting",
+    "done": "closed",
+}
+READINESS_STATES = {
+    "available",
+    "missing_tool",
+    "missing_credential",
+    "needs_user_permission",
+    "unsafe",
+    "external_blocker",
+    "unknown",
+}
+TRIAGE_STATES = OPEN_STATES | FINAL_STATES
+
+
+def _canonical_state(value: Any) -> str:
+    clean = str(value or "").strip().lower()
+    return STATE_ALIASES.get(clean, clean)
 
 
 def _now_iso() -> str:
@@ -236,7 +258,7 @@ def _upsert_candidate(conn, item: dict[str, Any]) -> bool:
 
 
 def _record_event(conn, item_id: str, event_type: str, from_state: str, to_state: str, note: str, evidence: str = "") -> None:
-    event_id = _hash_id("CIE", f"{item_id}:{event_type}:{from_state}:{to_state}:{_now_iso()}:{note}", 24)
+    event_id = _hash_id("CIE", f"{item_id}:{event_type}:{from_state}:{to_state}:{_time.time_ns()}:{note}", 24)
     conn.execute(
         """
         INSERT INTO closure_item_events (
@@ -247,6 +269,17 @@ def _record_event(conn, item_id: str, event_type: str, from_state: str, to_state
     )
 
 
+def _readiness_counts(conn) -> dict[str, int]:
+    if not _table_exists(conn, "closure_capability_readiness"):
+        return {}
+    return {
+        row["status"]: row["n"]
+        for row in conn.execute(
+            "SELECT status, COUNT(*) AS n FROM closure_capability_readiness GROUP BY status"
+        ).fetchall()
+    }
+
+
 def _protocol_task_candidates(conn, limit: int) -> list[dict[str, Any]]:
     if not _table_exists(conn, "protocol_tasks"):
         return []
@@ -469,6 +502,7 @@ def refresh_closure_items(conn=None, *, limit_per_adapter: int = 250) -> dict[st
         run_migrations(conn)
     candidates: list[dict[str, Any]] = []
     adapter_counts: dict[str, int] = {}
+    adapter_errors: dict[str, str] = {}
     adapters = [
         ("protocol_tasks", lambda: _protocol_task_candidates(conn, limit_per_adapter)),
         ("followups", lambda: _followup_candidates(conn, limit_per_adapter)),
@@ -479,8 +513,9 @@ def refresh_closure_items(conn=None, *, limit_per_adapter: int = 250) -> dict[st
     for name, adapter in adapters:
         try:
             produced = adapter()
-        except Exception:
+        except Exception as exc:
             produced = []
+            adapter_errors[name] = f"{type(exc).__name__}: {exc}"
         adapter_counts[name] = len(produced)
         candidates.extend(produced)
 
@@ -493,17 +528,34 @@ def refresh_closure_items(conn=None, *, limit_per_adapter: int = 250) -> dict[st
     return {
         "ok": True,
         "adapters": adapter_counts,
+        "adapter_errors": adapter_errors,
         "observed": len(candidates),
         "created": created,
     }
 
 
-def closure_next(conn=None, *, limit: int = 10, include_waiting: bool = False, source: str = "", kind: str = "") -> list[dict[str, Any]]:
+def closure_next(
+    conn=None,
+    *,
+    limit: int = 10,
+    include_waiting: bool = False,
+    source: str = "",
+    kind: str = "",
+    state: str = "",
+    max_risk: float | None = None,
+    area: str = "",
+) -> list[dict[str, Any]]:
     if conn is None:
         from db import get_db
 
         conn = get_db()
-    states = ("open", "verified", "waiting") if include_waiting else ("open", "verified")
+    clean_state = _canonical_state(state)
+    if clean_state:
+        if clean_state not in OPEN_STATES | FINAL_STATES:
+            return []
+        states = (clean_state,)
+    else:
+        states = ("open", "verified", "waiting") if include_waiting else ("open", "verified")
     clauses = [f"state IN ({','.join('?' for _ in states)})"]
     params: list[Any] = list(states)
     if source:
@@ -512,6 +564,24 @@ def closure_next(conn=None, *, limit: int = 10, include_waiting: bool = False, s
     if kind:
         clauses.append("kind = ?")
         params.append(kind)
+    if max_risk is not None:
+        try:
+            risk_limit = float(max_risk)
+        except Exception:
+            risk_limit = 0.0
+        if risk_limit > 0:
+            clauses.append("risk_score <= ?")
+            params.append(max(0.0, min(risk_limit, 1.0)))
+    clean_area = str(area or "").strip()
+    if clean_area:
+        like_area = f"%{clean_area}%"
+        clauses.append(
+            "("
+            "source_primary = ? OR kind = ? OR owner = ? OR capability_required = ? "
+            "OR title LIKE ? OR summary LIKE ? OR source_payload_json LIKE ?"
+            ")"
+        )
+        params.extend([clean_area, clean_area, clean_area, clean_area, like_area, like_area, like_area])
     params.append(max(1, min(int(limit or 10), 100)))
     rows = conn.execute(
         f"""
@@ -547,6 +617,7 @@ def closure_status(conn=None, *, refresh: bool = True, limit: int = 10) -> dict[
         "schema": "nexo.closure.status.v1",
         "refreshed": refresh_result,
         "counts": counts,
+        "capability_readiness": _readiness_counts(conn),
         "open_total": sum(int(counts.get(state, 0)) for state in OPEN_STATES),
         "by_kind": by_kind,
         "next": closure_next(conn, limit=limit, include_waiting=True),
@@ -576,8 +647,13 @@ def closure_item_get(item_id: str, conn=None) -> dict[str, Any] | None:
         "SELECT * FROM closure_item_events WHERE closure_item_id = ? ORDER BY created_at DESC LIMIT 50",
         (payload["id"],),
     ).fetchall()
+    links = conn.execute(
+        "SELECT * FROM closure_item_links WHERE closure_item_id = ? ORDER BY created_at DESC, link_type, link_id",
+        (payload["id"],),
+    ).fetchall() if _table_exists(conn, "closure_item_links") else []
     payload["sources"] = [_as_dict(row) for row in sources]
     payload["events"] = [_as_dict(row) for row in events]
+    payload["links"] = [_as_dict(row) for row in links]
     return payload
 
 
@@ -641,12 +717,238 @@ def closure_close_item(item_id: str, *, reason: str = "completed", conn=None) ->
     return {"ok": True, "id": item["id"], "state": final_state}
 
 
-def _write_daily_snapshot(conn) -> None:
+def closure_link_item(
+    item_id: str,
+    *,
+    link_type: str,
+    link_id: str,
+    relation: str = "related",
+    conn=None,
+) -> dict[str, Any]:
+    if conn is None:
+        from db import get_db
+
+        conn = get_db()
+    item = closure_item_get(item_id, conn)
+    if not item:
+        return {"ok": False, "error": "closure item not found"}
+    clean_type = str(link_type or "").strip()
+    clean_id = str(link_id or "").strip()
+    clean_relation = str(relation or "related").strip() or "related"
+    if not clean_type or not clean_id:
+        return {"ok": False, "error": "link_type and link_id are required"}
+    now = _now_iso()
+    link_pk = _hash_id("CIL", f"{item['id']}:{clean_type}:{clean_id}:{clean_relation}", 24)
+    conn.execute(
+        """
+        INSERT INTO closure_item_links (
+            id, closure_item_id, link_type, link_id, relation, created_at
+        ) VALUES (?, ?, ?, ?, ?, ?)
+        ON CONFLICT(closure_item_id, link_type, link_id, relation) DO UPDATE SET
+            created_at = excluded.created_at
+        """,
+        (link_pk, item["id"], clean_type, clean_id, clean_relation, now),
+    )
+    _record_event(
+        conn,
+        item["id"],
+        "linked",
+        item["state"],
+        item["state"],
+        f"Linked {clean_type}:{clean_id} as {clean_relation}.",
+    )
+    conn.commit()
+    return {
+        "ok": True,
+        "id": link_pk,
+        "closure_item_id": item["id"],
+        "link_type": clean_type,
+        "link_id": clean_id,
+        "relation": clean_relation,
+    }
+
+
+def closure_set_capability_readiness(
+    capability: str,
+    *,
+    status: str = "unknown",
+    reason: str = "",
+    evidence: str = "",
+    expires_at: str = "",
+    conn=None,
+) -> dict[str, Any]:
+    if conn is None:
+        from db import get_db
+
+        conn = get_db()
+    clean_capability = str(capability or "").strip()
+    clean_status = str(status or "unknown").strip()
+    if not clean_capability:
+        return {"ok": False, "error": "capability is required"}
+    if clean_status not in READINESS_STATES:
+        return {"ok": False, "error": f"invalid readiness status: {clean_status}"}
+    now = _now_iso()
+    row_id = _hash_id("CCR", clean_capability, 20)
+    conn.execute(
+        """
+        INSERT INTO closure_capability_readiness (
+            id, capability, status, reason, verified_at, verification_evidence, expires_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?)
+        ON CONFLICT(capability) DO UPDATE SET
+            status = excluded.status,
+            reason = excluded.reason,
+            verified_at = excluded.verified_at,
+            verification_evidence = excluded.verification_evidence,
+            expires_at = excluded.expires_at
+        """,
+        (row_id, clean_capability, clean_status, str(reason or ""), now, str(evidence or ""), str(expires_at or "")),
+    )
+    conn.commit()
+    return {"ok": True, "id": row_id, "capability": clean_capability, "status": clean_status}
+
+
+def closure_triage_item(
+    item_id: str,
+    *,
+    state: str = "",
+    kind: str = "",
+    blocker_reason: str = "",
+    next_action: str = "",
+    evidence_required: str = "",
+    owner: str = "",
+    capability_required: str = "",
+    capability_status: str = "",
+    duplicate_of: str = "",
+    conn=None,
+) -> dict[str, Any]:
+    if conn is None:
+        from db import get_db
+
+        conn = get_db()
+    item = closure_item_get(item_id, conn)
+    if not item:
+        return {"ok": False, "error": "closure item not found"}
+    updates: dict[str, Any] = {}
+    requested_state = str(state or "").strip()
+    clean_state = _canonical_state(requested_state)
+    if clean_state:
+        if clean_state not in TRIAGE_STATES:
+            return {"ok": False, "error": f"invalid state: {requested_state}"}
+        updates["state"] = clean_state
+    for column, value in (
+        ("kind", kind),
+        ("blocker_reason", blocker_reason),
+        ("next_action", next_action),
+        ("evidence_required", evidence_required),
+        ("owner", owner),
+        ("capability_required", capability_required),
+        ("capability_status", capability_status),
+    ):
+        clean_value = str(value or "").strip()
+        if clean_value:
+            updates[column] = clean_value
+    clean_duplicate = str(duplicate_of or "").strip()
+    if clean_duplicate:
+        target = closure_item_get(clean_duplicate, conn)
+        if not target:
+            return {"ok": False, "error": "duplicate target not found"}
+        closure_link_item(item["id"], link_type="closure_item", link_id=target["id"], relation="duplicate_of", conn=conn)
+        updates["state"] = "stale"
+        updates["close_reason"] = f"duplicate_of:{target['id']}"
+        updates["closed_at"] = _now_iso()
+    if not updates:
+        return {"ok": False, "error": "no triage changes supplied"}
+    now = _now_iso()
+    updates["updated_at"] = now
+    if set(updates) - {"updated_at"}:
+        updates["last_progress_at"] = now
+    assignments = ", ".join(f"{column} = ?" for column in updates)
+    params = list(updates.values()) + [item["id"]]
+    conn.execute(f"UPDATE closure_items SET {assignments} WHERE id = ?", params)
+    to_state = updates.get("state", item["state"])
+    _record_event(
+        conn,
+        item["id"],
+        "triaged",
+        item["state"],
+        to_state,
+        "Closure item triaged: " + ", ".join(sorted(column for column in updates if column != "updated_at")),
+    )
+    conn.commit()
+    result = {"ok": True, "id": item["id"], "state": to_state, "updated": sorted(updates)}
+    if requested_state and requested_state != clean_state:
+        result["requested_state"] = requested_state
+    return result
+
+
+def closure_snapshot(conn=None, *, refresh: bool = True, snapshot_date: str = "", limit: int = 10) -> dict[str, Any]:
+    if conn is None:
+        from db import get_db
+        from db._schema import run_migrations
+
+        conn = get_db()
+        run_migrations(conn)
+    if refresh:
+        refresh_closure_items(conn)
+    date_key = str(snapshot_date or _today()).strip()[:10]
+    if date_key != _today():
+        _write_daily_snapshot_for_date(conn, snapshot_date=date_key, limit=limit)
+    else:
+        _write_daily_snapshot(conn, limit=limit)
+    row = conn.execute(
+        "SELECT * FROM closure_daily_snapshots WHERE snapshot_date = ?",
+        (date_key,),
+    ).fetchone()
+    payload = _as_dict(row) if row else {}
+    if payload.get("top_items_json"):
+        try:
+            payload["top_items"] = json.loads(payload["top_items_json"])
+        except Exception:
+            payload["top_items"] = []
+    payload["capability_readiness"] = _readiness_counts(conn)
+    return {"ok": bool(payload), "snapshot": payload}
+
+
+def _write_daily_snapshot_for_date(conn, *, snapshot_date: str, limit: int = 10) -> None:
+    counts = {
+        row["state"]: row["n"]
+        for row in conn.execute("SELECT state, COUNT(*) AS n FROM closure_items GROUP BY state").fetchall()
+    }
+    top = closure_next(conn, limit=limit, include_waiting=True)
+    conn.execute(
+        """
+        INSERT OR REPLACE INTO closure_daily_snapshots (
+            snapshot_date, total_open, total_verified, total_waiting, total_closed,
+            top_items_json, created_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?)
+        """,
+        (
+            snapshot_date,
+            int(counts.get("open", 0)),
+            int(counts.get("verified", 0)),
+            int(counts.get("waiting", 0)),
+            int(counts.get("closed", 0)),
+            _safe_json([
+                {
+                    "id": item.get("id"),
+                    "title": item.get("title"),
+                    "priority_score": item.get("priority_score"),
+                    "state": item.get("state"),
+                }
+                for item in top
+            ]),
+            _now_iso(),
+        ),
+    )
+    conn.commit()
+
+
+def _write_daily_snapshot(conn, *, limit: int = 10) -> None:
     counts = {
         row["state"]: row["n"]
         for row in conn.execute("SELECT state, COUNT(*) AS n FROM closure_items GROUP BY state").fetchall()
     }
-    top = closure_next(conn, limit=10, include_waiting=True)
+    top = closure_next(conn, limit=limit, include_waiting=True)
     conn.execute(
         """
         INSERT OR REPLACE INTO closure_daily_snapshots (
@@ -679,7 +981,15 @@ def handle_closure_status(refresh: bool = True, limit: int = 10) -> str:
     return json.dumps(closure_status(refresh=refresh, limit=limit), indent=2, ensure_ascii=False)
 
 
-def handle_closure_next(limit: int = 10, include_waiting: bool = False, source: str = "", kind: str = "") -> str:
+def handle_closure_next(
+    limit: int = 10,
+    include_waiting: bool = False,
+    source: str = "",
+    kind: str = "",
+    state: str = "",
+    max_risk: float | None = None,
+    area: str = "",
+) -> str:
     from db import get_db
     from db._schema import run_migrations
 
@@ -688,7 +998,16 @@ def handle_closure_next(limit: int = 10, include_waiting: bool = False, source:
     refresh_closure_items(conn)
     return json.dumps({
         "ok": True,
-        "items": closure_next(conn, limit=limit, include_waiting=include_waiting, source=source, kind=kind),
+        "items": closure_next(
+            conn,
+            limit=limit,
+            include_waiting=include_waiting,
+            source=source,
+            kind=kind,
+            state=state,
+            max_risk=max_risk,
+            area=area,
+        ),
     }, indent=2, ensure_ascii=False)
 
 
@@ -702,6 +1021,68 @@ def handle_closure_item_get(item_id: str) -> str:
     return json.dumps({"ok": bool(item), "item": item}, indent=2, ensure_ascii=False)
 
 
+def handle_closure_triage(
+    item_id: str,
+    state: str = "",
+    kind: str = "",
+    blocker_reason: str = "",
+    next_action: str = "",
+    evidence_required: str = "",
+    owner: str = "",
+    capability_required: str = "",
+    capability_status: str = "",
+    duplicate_of: str = "",
+) -> str:
+    from db import get_db
+    from db._schema import run_migrations
+
+    conn = get_db()
+    run_migrations(conn)
+    return json.dumps(
+        closure_triage_item(
+            item_id,
+            state=state,
+            kind=kind,
+            blocker_reason=blocker_reason,
+            next_action=next_action,
+            evidence_required=evidence_required,
+            owner=owner,
+            capability_required=capability_required,
+            capability_status=capability_status,
+            duplicate_of=duplicate_of,
+            conn=conn,
+        ),
+        indent=2,
+        ensure_ascii=False,
+    )
+
+
+def handle_closure_link(item_id: str, link_type: str, link_id: str, relation: str = "related") -> str:
+    from db import get_db
+    from db._schema import run_migrations
+
+    conn = get_db()
+    run_migrations(conn)
+    return json.dumps(
+        closure_link_item(item_id, link_type=link_type, link_id=link_id, relation=relation, conn=conn),
+        indent=2,
+        ensure_ascii=False,
+    )
+
+
+def handle_closure_snapshot(refresh: bool = True, snapshot_date: str = "", limit: int = 10) -> str:
+    from db import get_db
+    from db._schema import run_migrations
+
+    conn = get_db()
+    run_migrations(conn)
+    return json.dumps(
+        closure_snapshot(conn, refresh=refresh, snapshot_date=snapshot_date, limit=limit),
+        indent=2,
+        ensure_ascii=False,
+    )
+
+
 def handle_closure_verify(item_id: str, evidence: str) -> str:
     from db import get_db
     from db._schema import run_migrations

package/src/db/_schema.py

@@ -2867,6 +2867,42 @@ def _m78_operational_closure_plane(conn):
     _migrate_add_index(conn, "idx_closure_events_item", "closure_item_events", "closure_item_id, created_at")
 
 
+def _m79_operational_closure_links_readiness(conn):
+    """Upgrade Closure Plane with links and capability readiness tables."""
+    _m78_operational_closure_plane(conn)
+    conn.execute(
+        """
+        CREATE TABLE IF NOT EXISTS closure_item_links (
+            id TEXT PRIMARY KEY,
+            closure_item_id TEXT NOT NULL,
+            link_type TEXT NOT NULL,
+            link_id TEXT NOT NULL,
+            relation TEXT NOT NULL DEFAULT 'related',
+            created_at TEXT NOT NULL DEFAULT (datetime('now')),
+            FOREIGN KEY(closure_item_id) REFERENCES closure_items(id) ON DELETE CASCADE,
+            UNIQUE(closure_item_id, link_type, link_id, relation)
+        )
+        """
+    )
+    conn.execute(
+        """
+        CREATE TABLE IF NOT EXISTS closure_capability_readiness (
+            id TEXT PRIMARY KEY,
+            capability TEXT NOT NULL,
+            status TEXT NOT NULL DEFAULT 'unknown',
+            reason TEXT NOT NULL DEFAULT '',
+            verified_at TEXT NOT NULL,
+            verification_evidence TEXT NOT NULL DEFAULT '',
+            expires_at TEXT NOT NULL DEFAULT '',
+            UNIQUE(capability)
+        )
+        """
+    )
+    _migrate_add_index(conn, "idx_closure_links_item", "closure_item_links", "closure_item_id")
+    _migrate_add_index(conn, "idx_closure_links_target", "closure_item_links", "link_type, link_id")
+    _migrate_add_index(conn, "idx_closure_readiness_capability", "closure_capability_readiness", "capability, status")
+
+
 MIGRATIONS = [
     (1, "learnings_columns", _m1_learnings_columns),
     (2, "followups_reasoning", _m2_followups_reasoning),
@@ -2946,6 +2982,7 @@ MIGRATIONS = [
     (76, "semantic_layers", _m76_semantic_layers),
     (77, "morning_briefing_presentation", _m77_morning_briefing_presentation),
     (78, "operational_closure_plane", _m78_operational_closure_plane),
+    (79, "operational_closure_links_readiness", _m79_operational_closure_links_readiness),
 ]
 
 
@@ -2967,7 +3004,11 @@ def run_migrations(conn=None):
     """)
     conn.commit()
 
-    applied = {r[0] for r in conn.execute("SELECT version FROM schema_migrations").fetchall()}
+    applied = {
+        int(r[0])
+        for r in conn.execute("SELECT version FROM schema_migrations").fetchall()
+        if str(r[0]).strip().isdigit()
+    }
 
     failed = []
     for version, name, fn in MIGRATIONS:
@@ -2975,9 +3016,10 @@ def run_migrations(conn=None):
             try:
                 fn(conn)
                 conn.execute(
-                    "INSERT INTO schema_migrations (version, name) VALUES (?, ?)",
+                    "INSERT OR IGNORE INTO schema_migrations (version, name) VALUES (?, ?)",
                     (version, name)
                 )
+                applied.add(version)
                 conn.commit()
             except Exception as e:
                 conn.rollback()

package/src/managed_mcp/catalog.py

@@ -189,6 +189,12 @@ def provider_for_capability(
 
 
 def _runner_path(nexo_home: Path, runtime_root: Path | None = None) -> Path:
+    runtime_bin = nexo_home / "bin" / "nexo-managed-mcp"
+    if runtime_bin.exists():
+        return runtime_bin
+    runtime_js = nexo_home / "bin" / "nexo-managed-mcp.js"
+    if runtime_js.exists():
+        return runtime_js
     runtime_bin = nexo_home / "runtime" / "bin" / "nexo-managed-mcp"
     if runtime_bin.exists():
         return runtime_bin

package/src/managed_mcp/reconcile.py

@@ -2,6 +2,8 @@ from __future__ import annotations
 
 import json
 import os
+import shutil
+import subprocess
 import time
 from pathlib import Path
 from typing import Any
@@ -17,6 +19,23 @@ def _state_path(nexo_home: Path) -> Path:
     return _state_dir(nexo_home) / "installed-state.json"
 
 
+def _artifacts_dir(nexo_home: Path) -> Path:
+    return _state_dir(nexo_home) / "artifacts"
+
+
+def _provider_root(nexo_home: Path, provider_id: str) -> Path:
+    return _artifacts_dir(nexo_home) / provider_id
+
+
+def _provider_stage_dir(nexo_home: Path, provider_id: str, version: str) -> Path:
+    return _provider_root(nexo_home, provider_id) / version
+
+
+def _provider_wrapper_path(nexo_home: Path, provider_id: str, *, platform: str | None = None) -> Path:
+    suffix = ".cmd" if str(platform or os.name).lower().startswith(("win", "nt")) else ""
+    return _provider_root(nexo_home, provider_id) / "bin" / f"{provider_id}{suffix}"
+
+
 def _read_state(nexo_home: Path) -> dict[str, Any]:
     path = _state_path(nexo_home)
     if not path.is_file():
@@ -37,6 +56,160 @@ def _write_state(nexo_home: Path, state: dict[str, Any]) -> None:
     tmp.replace(path)
 
 
+def _provider_ids_from_desired(desired: dict[str, Any]) -> set[str]:
+    provider_ids: set[str] = set()
+    for client_entries in desired.values():
+        if not isinstance(client_entries, dict):
+            continue
+        for entry in client_entries.values():
+            meta = entry.get("nexo") if isinstance(entry, dict) else {}
+            if isinstance(meta, dict) and meta.get("provider_id"):
+                provider_ids.add(str(meta["provider_id"]))
+    return provider_ids
+
+
+def _locked_providers(lock: dict[str, Any]) -> dict[str, dict[str, Any]]:
+    providers = lock.get("providers") if isinstance(lock.get("providers"), dict) else {}
+    return {str(key): value for key, value in providers.items() if isinstance(value, dict)}
+
+
+def _run_npm_install(stage_dir: Path, package: str, version: str) -> subprocess.CompletedProcess:
+    npm = "npm.cmd" if os.name == "nt" else "npm"
+    return subprocess.run(
+        [
+            npm,
+            "install",
+            "--prefix",
+            str(stage_dir),
+            "--omit=dev",
+            "--no-audit",
+            "--no-fund",
+            "--package-lock=false",
+            f"{package}@{version}",
+        ],
+        text=True,
+        capture_output=True,
+        timeout=180,
+    )
+
+
+def _write_provider_wrappers(
+    *,
+    nexo_home: Path,
+    provider_id: str,
+    version: str,
+    provider_bin: str,
+) -> dict[str, str]:
+    root = _provider_root(nexo_home, provider_id)
+    bin_dir = root / "bin"
+    bin_dir.mkdir(parents=True, exist_ok=True)
+    stage_dir = _provider_stage_dir(nexo_home, provider_id, version)
+    unix_target = stage_dir / "node_modules" / ".bin" / provider_bin
+    win_target = stage_dir / "node_modules" / ".bin" / f"{provider_bin}.cmd"
+    unix_wrapper = bin_dir / provider_id
+    unix_wrapper.write_text(f"#!/bin/sh\nexec {json.dumps(str(unix_target))} \"$@\"\n")
+    unix_wrapper.chmod(0o755)
+    win_wrapper = bin_dir / f"{provider_id}.cmd"
+    win_wrapper.write_text(f"@echo off\r\ncall \"{win_target}\" %*\r\n")
+    return {
+        "unix": str(unix_wrapper),
+        "win32": str(win_wrapper),
+        "target": str(unix_target),
+        "target_win32": str(win_target),
+    }
+
+
+def _stage_provider(
+    *,
+    nexo_home: Path,
+    provider_id: str,
+    locked: dict[str, Any],
+    npm_runner=_run_npm_install,
+) -> dict[str, Any]:
+    package = str(locked.get("package") or "").strip()
+    version = str(locked.get("version") or "").strip()
+    provider_bin = str(locked.get("bin") or "").strip()
+    if not package or not version or not provider_bin:
+        return {"status": "failed", "error": "provider lock is incomplete"}
+    stage_dir = _provider_stage_dir(nexo_home, provider_id, version)
+    root = _provider_root(nexo_home, provider_id)
+    tmp_dir = root / f".stage-{version}-{int(time.time() * 1000)}"
+    root.mkdir(parents=True, exist_ok=True)
+    if stage_dir.is_dir():
+        wrappers = _write_provider_wrappers(
+            nexo_home=nexo_home,
+            provider_id=provider_id,
+            version=version,
+            provider_bin=provider_bin,
+        )
+        return {
+            "status": "healthy",
+            "version": version,
+            "package": package,
+            "staged_path": str(stage_dir),
+            "executable": wrappers["unix"],
+            "executable_win32": wrappers["win32"],
+            "reused": True,
+        }
+    try:
+        tmp_dir.mkdir(parents=True, exist_ok=True)
+        result = npm_runner(tmp_dir, package, version)
+        if getattr(result, "returncode", 1) != 0:
+            return {
+                "status": "failed",
+                "version": version,
+                "package": package,
+                "error": (getattr(result, "stderr", "") or getattr(result, "stdout", "") or "npm install failed")[-1200:],
+            }
+        if stage_dir.exists():
+            shutil.rmtree(stage_dir)
+        tmp_dir.replace(stage_dir)
+        wrappers = _write_provider_wrappers(
+            nexo_home=nexo_home,
+            provider_id=provider_id,
+            version=version,
+            provider_bin=provider_bin,
+        )
+        return {
+            "status": "healthy",
+            "version": version,
+            "package": package,
+            "staged_path": str(stage_dir),
+            "executable": wrappers["unix"],
+            "executable_win32": wrappers["win32"],
+            "integrity": str(locked.get("integrity") or ""),
+        }
+    except Exception as exc:
+        return {"status": "failed", "version": version, "package": package, "error": str(exc)}
+    finally:
+        if tmp_dir.exists():
+            shutil.rmtree(tmp_dir, ignore_errors=True)
+
+
+def _provider_health(
+    *,
+    nexo_home: Path,
+    provider_id: str,
+    locked: dict[str, Any],
+    platform: str | None = None,
+) -> dict[str, Any]:
+    version = str(locked.get("version") or "").strip()
+    executable = _provider_wrapper_path(nexo_home, provider_id, platform=platform)
+    stage_dir = _provider_stage_dir(nexo_home, provider_id, version) if version else _provider_root(nexo_home, provider_id)
+    if not version:
+        return {"status": "failed", "reason": "missing_version"}
+    if not stage_dir.is_dir():
+        return {"status": "unstaged", "version": version, "staged_path": str(stage_dir)}
+    if not executable.exists():
+        return {"status": "failed", "version": version, "reason": "wrapper_missing", "executable": str(executable)}
+    return {
+        "status": "healthy",
+        "version": version,
+        "staged_path": str(stage_dir),
+        "executable": str(executable),
+    }
+
+
 def reconcile_managed_mcp(
     *,
     nexo_home: str | os.PathLike[str] | Path,
@@ -44,6 +217,7 @@ def reconcile_managed_mcp(
     clients: list[str] | tuple[str, ...] | None = None,
     apply: bool = False,
     platform: str | None = None,
+    npm_runner=_run_npm_install,
 ) -> dict[str, Any]:
     nexo_home_path = Path(nexo_home).expanduser()
     catalog = load_catalog()
@@ -76,6 +250,27 @@ def reconcile_managed_mcp(
             actions.append({"client": client, "server": name, "action": action})
         for name in set(old_entries) - set(entries):
             actions.append({"client": client, "server": name, "action": "disable"})
+    locked_by_provider = _locked_providers(lock)
+    provider_ids = _provider_ids_from_desired(desired)
+    provider_state: dict[str, Any] = {}
+    if apply:
+        for provider_id in sorted(provider_ids):
+            provider_state[provider_id] = _stage_provider(
+                nexo_home=nexo_home_path,
+                provider_id=provider_id,
+                locked=locked_by_provider.get(provider_id) or {},
+                npm_runner=npm_runner,
+            )
+    else:
+        for provider_id in sorted(provider_ids):
+            provider_state[provider_id] = _provider_health(
+                nexo_home=nexo_home_path,
+                provider_id=provider_id,
+                locked=locked_by_provider.get(provider_id) or {},
+                platform=platform,
+            )
+    if any((state.get("status") if isinstance(state, dict) else "") not in {"healthy"} for state in provider_state.values()):
+        actions.append({"client": "runtime", "server": "managed_mcp", "action": "healthcheck"})
 
     state = {
         "schema": "nexo.managed_mcp.state.v1",
@@ -83,6 +278,7 @@ def reconcile_managed_mcp(
         "updated_at": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
         "validation": validation,
         "desired": desired,
+        "providers": provider_state,
         "last_plan": actions,
     }
     if apply:
@@ -94,6 +290,7 @@ def reconcile_managed_mcp(
         "validation": validation,
         "actions": actions,
         "desired_clients": sorted(desired),
+        "providers": provider_state,
     }
 
 
@@ -119,4 +316,5 @@ def managed_mcp_status(
         "validation": plan["validation"],
         "last_applied_at": state.get("updated_at", ""),
         "actions": plan["actions"],
+        "providers": plan.get("providers", {}),
     }

package/src/product_knowledge/catalog.json

@@ -1,6 +1,6 @@
 {
   "schema_version": 1,
-  "updated_at": "2026-06-06",
+  "updated_at": "2026-06-07",
   "source_policy": "Brain owns stable product semantics. Desktop manifests describe installed UI surfaces. Backend endpoints own live state, prices, balances, tickets and provisioning.",
   "capabilities": [
     {
@@ -210,6 +210,7 @@
         "nexo/src/server.py:nexo_support_ticket_list",
         "nexo/src/server.py:nexo_support_ticket_create",
         "nexo-desktop/renderer/react/panels/Settings/tabs/SupportTab.jsx",
+        "nexo-desktop-web SupportTicketController",
         "nexo-desktop-web routes/web.php"
       ],
       "surfaces": ["Desktop Support settings", "Brain support-ticket tools", "Backend support API"],
@@ -249,12 +250,19 @@
         "nexo/src/system_catalog.py:nexo_provider_proxy",
         "nexo/src/system_catalog.py:nexo_provider_models",
         "nexo-desktop/renderer/react/panels/Settings/tabs/SubscriptionsTab.jsx",
+        "nexo-desktop-web CreditsController",
+        "nexo-desktop-web NexoCreditsController",
         "nexo-desktop-web ProviderProxyController",
         "nexo-desktop-web ProviderCatalogService"
       ],
-      "surfaces": ["Desktop Subscriptions/Credits", "Backend provider-proxy API"],
+      "surfaces": [
+        "Desktop Subscriptions/Credits",
+        "Backend credits API",
+        "Backend provider-proxy API",
+        "Admin NEXO Credits credential/readiness panel"
+      ],
       "live_state": {
-        "source": "backend provider-proxy platforms/models/estimate endpoints",
+        "source": "backend credits and provider-proxy platforms/models/estimate endpoints",
         "max_age": "per backend call",
         "fallback": "Mark provider/model support as unknown or planned if not returned by backend."
       },
@@ -277,6 +285,47 @@
         "must_not_say": ["Do not infer provider availability from marketing copy."]
       }
     },
+    {
+      "id": "nexo_managed_communications_providers",
+      "title": "Managed Communications Providers",
+      "category": "credits",
+      "layer": "backend+desktop",
+      "status": "live",
+      "summary": "NEXO can use managed voice, SMS, WhatsApp, mass-email and voice-runtime provider surfaces when backend readiness, credits and spend controls allow it.",
+      "aliases": ["managed voice", "managed sms", "managed whatsapp", "mass email", "email mass", "voice", "sms", "whatsapp", "provider communications"],
+      "source_refs": [
+        "nexo-desktop-web NexoVapiController",
+        "nexo-desktop-web NexoTwilioController",
+        "nexo-desktop-web NexoWazionWhatsappController",
+        "nexo-desktop-web NexoEmailMassController",
+        "nexo-desktop-web VoiceController",
+        "nexo-desktop-web ProviderCostResolverService"
+      ],
+      "surfaces": ["Backend managed communications APIs", "NEXO Credits managed provider flows", "Desktop provider request flows"],
+      "live_state": {
+        "source": "backend managed communications provider APIs + credits ledger",
+        "max_age": "per backend call",
+        "fallback": "Treat provider availability as unknown or not configured if backend route, readiness or cost checks are unavailable."
+      },
+      "actions": {
+        "read": ["List managed resources", "Estimate cost", "Read job or request status"],
+        "write": ["Provision phone/assistant/session/domain after approval", "Send message/email or start call after explicit authorization"]
+      },
+      "safety": {
+        "data_touched": ["phone numbers", "email recipients", "message bodies", "call metadata", "provider job payloads", "credits balance"],
+        "data_origin": "user-approved communication payloads and backend provider APIs",
+        "consent_required": "yes before sending communications, starting calls or provisioning managed provider resources",
+        "confirmation_required": "yes before billable provider operations or external communications",
+        "credential_policy": "Provider credentials live in backend credential storage; never reveal them.",
+        "retention": "Provider request records, suppression lists, message logs and ledger retention follow backend policy.",
+        "audit": "Provider job IDs, request IDs and ledger entries are required evidence.",
+        "forbidden_actions": ["Expose vendor/provider names as the product promise", "Start calls or send messages/emails without explicit authorization", "Bypass credit estimation or spend limits"]
+      },
+      "answer_guidance": {
+        "must_say": ["Describe user-facing outcomes, not vendor internals, unless the operator asks for implementation detail.", "Spend, readiness and job state are live backend facts."],
+        "must_not_say": ["Do not promise a call, SMS, WhatsApp message or email campaign without backend readiness and authorization evidence."]
+      }
+    },
     {
       "id": "nexo_managed_cloud_edge",
       "title": "Managed Cloud And Edge",
@@ -326,6 +375,7 @@
       "aliases": ["cards", "protocol cards", "workflow cards", "procedures"],
       "source_refs": [
         "nexo/src/server.py:nexo_card_match",
+        "nexo-desktop-web CardController",
         "nexo-desktop-web CardCatalogService",
         "nexo-desktop/prompts/system/conversation-bootstrap.md"
       ],

package/src/server.py

@@ -1044,7 +1044,15 @@ def nexo_closure_status(refresh: bool = True, limit: int = 10) -> str:
 
 
 @mcp.tool
-def nexo_closure_next(limit: int = 10, include_waiting: bool = False, source: str = "", kind: str = "") -> str:
+def nexo_closure_next(
+    limit: int = 10,
+    include_waiting: bool = False,
+    source: str = "",
+    kind: str = "",
+    state: str = "",
+    max_risk: float = 0.0,
+    area: str = "",
+) -> str:
     """Return the next ranked closure items without executing source actions."""
     from closure_plane import handle_closure_next
 
@@ -1052,7 +1060,11 @@ def nexo_closure_next(limit: int = 10, include_waiting: bool = False, source: st
         clean_limit = max(1, min(int(limit or 10), 100))
     except Exception:
         clean_limit = 10
-    return handle_closure_next(clean_limit, bool(include_waiting), source, kind)
+    try:
+        clean_max_risk = float(max_risk or 0.0)
+    except Exception:
+        clean_max_risk = 0.0
+    return handle_closure_next(clean_limit, bool(include_waiting), source, kind, state, clean_max_risk, area)
 
 
 @mcp.tool
@@ -1063,6 +1075,56 @@ def nexo_closure_item_get(item_id: str) -> str:
     return handle_closure_item_get(item_id)
 
 
+@mcp.tool
+def nexo_closure_triage(
+    item_id: str,
+    state: str = "",
+    kind: str = "",
+    blocker_reason: str = "",
+    next_action: str = "",
+    evidence_required: str = "",
+    owner: str = "",
+    capability_required: str = "",
+    capability_status: str = "",
+    duplicate_of: str = "",
+) -> str:
+    """Triage a closure item without executing its source action."""
+    from closure_plane import handle_closure_triage
+
+    return handle_closure_triage(
+        item_id,
+        state,
+        kind,
+        blocker_reason,
+        next_action,
+        evidence_required,
+        owner,
+        capability_required,
+        capability_status,
+        duplicate_of,
+    )
+
+
+@mcp.tool
+def nexo_closure_link(item_id: str, link_type: str, link_id: str, relation: str = "related") -> str:
+    """Link a closure item to a task, workflow, followup, outcome, or learning."""
+    from closure_plane import handle_closure_link
+
+    return handle_closure_link(item_id, link_type, link_id, relation)
+
+
+@mcp.tool
+def nexo_closure_snapshot(refresh: bool = True, snapshot_date: str = "", limit: int = 10) -> str:
+    """Write and return an Operational Closure Plane daily snapshot."""
+    from closure_plane import handle_closure_snapshot
+
+    try:
+        clean_limit = max(1, min(int(limit or 10), 100))
+    except Exception:
+        clean_limit = 10
+    return handle_closure_snapshot(bool(refresh), snapshot_date, clean_limit)
+
+
 @mcp.tool
 def nexo_closure_verify(item_id: str, evidence: str) -> str:
     """Record verification evidence for a closure item."""

package/tool-enforcement-map.json

@@ -2924,6 +2924,51 @@
       },
       "triggers_after": []
     },
+    "nexo_closure_triage": {
+      "description": "Triage a closure item without executing its source action",
+      "category": "closure",
+      "source": "server",
+      "requires": [],
+      "provides": [
+        "closure_triage_result"
+      ],
+      "internal_calls": [],
+      "enforcement": {
+        "level": "none",
+        "rules": []
+      },
+      "triggers_after": []
+    },
+    "nexo_closure_link": {
+      "description": "Link a closure item to a task, workflow, followup, outcome, or learning",
+      "category": "closure",
+      "source": "server",
+      "requires": [],
+      "provides": [
+        "closure_item_link"
+      ],
+      "internal_calls": [],
+      "enforcement": {
+        "level": "none",
+        "rules": []
+      },
+      "triggers_after": []
+    },
+    "nexo_closure_snapshot": {
+      "description": "Write and return an Operational Closure Plane daily snapshot",
+      "category": "closure",
+      "source": "server",
+      "requires": [],
+      "provides": [
+        "closure_snapshot"
+      ],
+      "internal_calls": [],
+      "enforcement": {
+        "level": "none",
+        "rules": []
+      },
+      "triggers_after": []
+    },
     "nexo_closure_verify": {
       "description": "Record verification evidence for a closure item",
       "category": "closure",