node-autotask 0.44.0 → 0.45.0

package/N8N_MCP_MANIFEST.md

@@ -1,6 +1,6 @@
 # N8N MCP Manifest — node-autotask (consumer projection)
 
-<!-- GENERATED by scripts/project-n8n-mcp.mjs at 2026-11-01T01:23:14.190Z — do not hand-edit. -->
+<!-- GENERATED by scripts/project-n8n-mcp.mjs at 2026-11-01T10:43:53.479Z — do not hand-edit. -->
 
 The n8n CONSUMER projection of the capability registry: the canonical source for what the
 n8n-side MCP tools must expose. The SDK is canonical — this is a projection of it, never a
@@ -24,19 +24,19 @@ user's n8n instances; PROD is read-only for any verification).
 | tool | mode | entity | readOnlyHint | destructiveHint | idempotentHint | openWorldHint | operations |
 |------|------|--------|--------------|-----------------|----------------|---------------|------------|
 | `autotask_ticket` | read | ticket | true | false | true | true | 17 |
-| `autotask_ticket_write` | write | ticket | false | false | false | true | 4 |
-| `autotask_contact` | read | contact | true | false | true | true | 10 |
-| `autotask_contact_write` | write | contact | false | false | false | true | 4 |
+| `autotask_ticket_write` | write | ticket | false | false | false | true | 3 |
+| `autotask_contact` | read | contact | true | false | true | true | 11 |
+| `autotask_contact_write` | write | contact | false | false | false | true | 3 |
 | `autotask_company` | read | company | true | false | true | true | 14 |
-| `autotask_company_write` | write | company | false | false | false | true | 3 |
+| `autotask_company_write` | write | company | false | false | false | true | 2 |
 | `autotask_companyLocation` | read | companyLocation | true | false | true | true | 8 |
 | `autotask_companyLocation_write` | write | companyLocation | false | false | false | true | 2 |
 | `autotask_ticketNote` | read | ticketNote | true | false | true | true | 7 |
 | `autotask_ticketNote_write` | write | ticketNote | false | false | false | true | 2 |
-| `autotask_resource` | read | resource | true | false | true | true | 9 |
-| `autotask_resource_write` | write | resource | false | false | false | true | 2 |
-| `autotask_timeEntry` | read | timeEntry | true | false | true | true | 23 |
-| `autotask_timeEntry_write` | write | timeEntry | false | false | false | true | 5 |
+| `autotask_resource` | read | resource | true | false | true | true | 10 |
+| `autotask_resource_write` | write | resource | false | false | true | true | 1 |
+| `autotask_timeEntry` | read | timeEntry | true | false | true | true | 8 |
+| `autotask_timeEntry_write` | write | timeEntry | false | false | false | true | 2 |
 
 ### `autotask_ticket` (read — ticket)
 
@@ -64,25 +64,25 @@ user's n8n instances; PROD is read-only for any verification).
 
 ### `autotask_ticket_write` (write — ticket)
 
-> Write ticket records (mode: write — the registry operations with effect=write for tickets: changeStatus, create, openWithNoteAndAssign, update). Writes are dry-run first: dry_run defaults to true — the request is validated against the registry inputSchema and a DryRunResult envelope is returned; the mutating request is never issued unless the caller passes confirm (the n8n-side handler must force dry-run unless confirm is present, mirroring the SDK governor). Destructive operations are refused without the confirm flag — confirm must equal the operation key exactly (the deliberate act is the call). The n8n consumer surface excludes destructive operations by curation default (excludeDestructive); they remain available on the canonical SDK server (autotask_delete / per-op tools). By curation default (excludeDestructive) no destructive operation is included; destructive capability remains on the canonical SDK server surface. Per-operation required arguments: changeStatus [id, targetStatus]; create [data]; openWithNoteAndAssign [params]; update [id, data]. Errors carry the SDK error contract: code, category, retryable, operation, httpStatus, suggestedAction (the nextAction directive — follow the directive), correlationId, vendorError (when the vendor returned a response body — the deep-redacted body, host-sourced text wrapped as untrusted content when untrusted-wrapping is on); credentials never appear in an error message.
+> Write ticket records (mode: write — the registry operations with effect=write for tickets: changeStatus, create, update). Writes are dry-run first: dry_run defaults to true — the request is validated against the registry inputSchema and a DryRunResult envelope is returned; the mutating request is never issued unless the caller passes confirm (the n8n-side handler must force dry-run unless confirm is present, mirroring the SDK governor). Destructive operations are refused without the confirm flag — confirm must equal the operation key exactly (the deliberate act is the call). The n8n consumer surface excludes destructive operations by curation default (excludeDestructive); they remain available on the canonical SDK server (autotask_delete / per-op tools). By curation default (excludeDestructive) no destructive operation is included; destructive capability remains on the canonical SDK server surface. Per-operation required arguments: changeStatus [id, targetStatus]; create [data]; update [id, data]. Errors carry the SDK error contract: code, category, retryable, operation, httpStatus, suggestedAction (the nextAction directive — follow the directive), correlationId, vendorError (when the vendor returned a response body — the deep-redacted body, host-sourced text wrapped as untrusted content when untrusted-wrapping is on); credentials never appear in an error message.
 
-Tool input: {"operation":{"type":"string","enum":["changeStatus","create","openWithNoteAndAssign","update"]},"id":{"type":"number | string (the ticket id — a safe integer, or a canonical integer string for ids above 2^53)"},"targetStatus":{"type":"number (validated pre-request against the tenant's LIVE status picklist from the entity metadata when it is resolvable — a value the live picklist lacks → typed STATUS_UNKNOWN; when the metadata is unavailable the vendor's own validation decides)"},"fields":{"type":"object (optional) — extra ticket fields merged into the same PUT (the caller value wins over the node map defaults; the merge keeps every other current field)"},"data":{"type":"object","ref":"tickets body (see types)"},"params":{"type":"object — { companyID: number | string (the parent company id), title: string, priority?: number (default 3 Low), status?: number (default 1 New), queueID?: number (the node NEVER guesses a queue: omitted + vendor-500 → the typed QUEUE_REQUIRED error with the vendor message + discovery suggestedAction) }"},"note":{"type":"object (optional) — { description: string, title?: string, noteType?: number (default 1), publish?: number (default 1; integer picklist 1/2/4 — a JSON boolean 500s) }"},"assign":{"type":"object (optional) — { resourceID: number | string, roleID: number (required with resourceID) } (prechecked via resources.get BEFORE the create — RESOURCE_INVALID on missing/inactive; the resources table is blind to the API user, get is the authority)"},"dry_run":{"type":"boolean","default":true,"note":"true (the default) = the pinned DryRunResult envelope; the mutating request is never issued. The handler must force dry-run unless confirm is present."},"confirm":{"type":"string","note":"The operation key (e.g. \"tickets.create\") — its presence lifts the dry run. For destructive/approval-gated operations confirm must equal the operation key exactly; the call is refused pre-request without it."}} (required: operation)
+Tool input: {"operation":{"type":"string","enum":["changeStatus","create","update"]},"id":{"type":"number | string (the ticket id — a safe integer, or a canonical integer string for ids above 2^53)"},"targetStatus":{"type":"number (validated pre-request against the tenant's LIVE status picklist from the entity metadata when it is resolvable — a value the live picklist lacks → typed STATUS_UNKNOWN; when the metadata is unavailable the vendor's own validation decides)"},"fields":{"type":"object (optional) — extra ticket fields merged into the same PUT (the caller value wins over the node map defaults; the merge keeps every other current field)"},"data":{"type":"object","ref":"tickets body (see types)"},"dry_run":{"type":"boolean","default":true,"note":"true (the default) = the pinned DryRunResult envelope; the mutating request is never issued. The handler must force dry-run unless confirm is present."},"confirm":{"type":"string","note":"The operation key (e.g. \"tickets.create\") — its presence lifts the dry run. For destructive/approval-gated operations confirm must equal the operation key exactly; the call is refused pre-request without it."}} (required: operation)
 
 | backingOperation | verb | effect | flags | requiredArgs | purpose |
 |------------------|------|--------|-------|--------------|---------|
 | `tickets.changeStatus` | changeStatus | write | — | id, targetStatus | Move a ticket to a target status in ONE op — the node validates targetStatus against the tenant's LIVE status picklist (entity metadata; vendor rejection is the fallback when the metadata is unavailable) + the live-discovered per-status required-field map and fills the proven-safe defaults itself (the vendor 500s when a target status has unsatisfied field requirements; the MCP LLM has no way to know the map). Dry-run first (dry_run). |
 | `tickets.create` | create | write | — | data | Create a ticket. Dry-run first (dry_run). |
-| `tickets.openWithNoteAndAssign` | openWithNoteAndAssign | write | — | params | Open a ticket with an optional first scoped note and an optional assignment in ONE op — the node absorbs the ww29-proven create contract and the note/assignment wire choreography (6 calls today → 1). Dry-run first (dry_run). |
 | `tickets.update` | update | write | idempotent | id, data | Update a ticket. Dry-run first (dry_run). Idempotent. |
 
 ### `autotask_contact` (read — contact)
 
-> Read contact records (mode: read — effect=read operations only; zero mutating requests, ungated by design). Registry operations for contacts: count: Count contact records matching a JSON filter. (under a company) | findByEmail: Find a contact by email address. | get: Get one Contact by id. | getContext: Get a contact with its primary context records in one call. (under a company) | getEntityInfo: Get the Contact capability metadata (canCreate/canUpdate/hasUserDefinedFields/...). | getFieldInfo: Get the Contact field catalog (types, picklists, required, maxLength) — the full raw field dump (the largest read of the info trio; compact discovery: operations.fieldCatalog). | getUdfInfo: Get the Contact user-defined-field catalog. | query: Query Contact records with a JSON filter. | resolve: Resolve a Contact from a numeric id (the direct fetch, tried first) or an exact value of its primary text field(s) (firstName + lastName — exact match only). Returns the Contact record with the numeric id for get/update/delete. Other identifier forms (e.g. an email address) are NOT tried by resolve — use the resource's dedicated lookup op where one exists (see autotask_catalog). | search: Search contact records by text (contains on the searchable fields). (under a company). Bounds: Sensitive. Bounded: server-side pagination — ordinary limit default 500, max 2500; walk.maxRows independently sets the total cap, with pages at most min(500, limit); 1000-page guard; hasMore/truncated flag remaining rows. Sensitive. Bounded: limit default 25, max 500. Sensitive. Errors carry the SDK error contract: code, category, retryable, operation, httpStatus, suggestedAction (the nextAction directive — follow the directive), correlationId, vendorError (when the vendor returned a response body — the deep-redacted body, host-sourced text wrapped as untrusted content when untrusted-wrapping is on); credentials never appear in an error message.
+> Read contact records (mode: read — effect=read operations only; zero mutating requests, ungated by design). Registry operations for contacts: count: Count contact records matching a JSON filter. (under a company) | findByEmail: Find a contact by email address. | fullProfile: Get a contact with its company and its open tickets in a single call: the contact (the parent-scoped root read, or the stage-1 row when the contact has no company FK), its company, and its open tickets — every part separately reported. | get: Get one Contact by id. | getContext: Get a contact with its primary context records in one call. (under a company) | getEntityInfo: Get the Contact capability metadata (canCreate/canUpdate/hasUserDefinedFields/...). | getFieldInfo: Get the Contact field catalog (types, picklists, required, maxLength) — the full raw field dump (the largest read of the info trio; compact discovery: operations.fieldCatalog). | getUdfInfo: Get the Contact user-defined-field catalog. | query: Query Contact records with a JSON filter. | resolve: Resolve a Contact from a numeric id (the direct fetch, tried first) or an exact value of its primary text field(s) (firstName + lastName — exact match only). Returns the Contact record with the numeric id for get/update/delete. Other identifier forms (e.g. an email address) are NOT tried by resolve — use the resource's dedicated lookup op where one exists (see autotask_catalog). | search: Search contact records by text (contains on the searchable fields). (under a company). Bounds: Sensitive. Bounded: server-side pagination — ordinary limit default 500, max 2500; walk.maxRows independently sets the total cap, with pages at most min(500, limit); 1000-page guard; hasMore/truncated flag remaining rows. Sensitive. Bounded: limit default 25, max 500. Sensitive. Errors carry the SDK error contract: code, category, retryable, operation, httpStatus, suggestedAction (the nextAction directive — follow the directive), correlationId, vendorError (when the vendor returned a response body — the deep-redacted body, host-sourced text wrapped as untrusted content when untrusted-wrapping is on); credentials never appear in an error message.
 
 | backingOperation | verb | effect | flags | requiredArgs | purpose |
 |------------------|------|--------|-------|--------------|---------|
 | `contacts.count` | count | read | sensitive | none | Count contact records matching a JSON filter. (under a company) Sensitive. |
 | `contacts.findByEmail` | findByEmail | read | sensitive | value | Find a contact by email address. Sensitive. |
+| `contacts.fullProfile` | fullProfile | read | — | id | Get a contact with its company and its open tickets in a single call: the contact (the parent-scoped root read, or the stage-1 row when the contact has no company FK), its company, and its open tickets — every part separately reported. |
 | `contacts.get` | get | read | sensitive | parentId, id | Get one Contact by id. Sensitive. |
 | `contacts.getContext` | getContext | read | sensitive | id | Get a contact with its primary context records in one call. (under a company) Sensitive. |
 | `contacts.getEntityInfo` | getEntityInfo | read | sensitive | none | Get the Contact capability metadata (canCreate/canUpdate/hasUserDefinedFields/...). Sensitive. |
@@ -94,16 +94,15 @@ Tool input: {"operation":{"type":"string","enum":["changeStatus","create","openW
 
 ### `autotask_contact_write` (write — contact)
 
-> Write contact records (mode: write — the registry operations with effect=write for contacts: create, moveToCompany, update, upsertByEmail). Writes are dry-run first: dry_run defaults to true — the request is validated against the registry inputSchema and a DryRunResult envelope is returned; the mutating request is never issued unless the caller passes confirm (the n8n-side handler must force dry-run unless confirm is present, mirroring the SDK governor). Destructive operations are refused without the confirm flag — confirm must equal the operation key exactly (the deliberate act is the call). The n8n consumer surface excludes destructive operations by curation default (excludeDestructive); they remain available on the canonical SDK server (autotask_delete / per-op tools). By curation default (excludeDestructive) no destructive operation is included; destructive capability remains on the canonical SDK server surface. Approval-gated operations (contacts.moveToCompany) additionally require confirm equal to the operation key. Per-operation required arguments: create [parentId, data]; moveToCompany [sourceContactId, destinationCompanyId]; update [parentId, id, data]; upsertByEmail [companyID, email]. Errors carry the SDK error contract: code, category, retryable, operation, httpStatus, suggestedAction (the nextAction directive — follow the directive), correlationId, vendorError (when the vendor returned a response body — the deep-redacted body, host-sourced text wrapped as untrusted content when untrusted-wrapping is on); credentials never appear in an error message.
+> Write contact records (mode: write — the registry operations with effect=write for contacts: create, moveToCompany, update). Writes are dry-run first: dry_run defaults to true — the request is validated against the registry inputSchema and a DryRunResult envelope is returned; the mutating request is never issued unless the caller passes confirm (the n8n-side handler must force dry-run unless confirm is present, mirroring the SDK governor). Destructive operations are refused without the confirm flag — confirm must equal the operation key exactly (the deliberate act is the call). The n8n consumer surface excludes destructive operations by curation default (excludeDestructive); they remain available on the canonical SDK server (autotask_delete / per-op tools). By curation default (excludeDestructive) no destructive operation is included; destructive capability remains on the canonical SDK server surface. Approval-gated operations (contacts.moveToCompany) additionally require confirm equal to the operation key. Per-operation required arguments: create [parentId, data]; moveToCompany [sourceContactId, destinationCompanyId]; update [parentId, id, data]. Errors carry the SDK error contract: code, category, retryable, operation, httpStatus, suggestedAction (the nextAction directive — follow the directive), correlationId, vendorError (when the vendor returned a response body — the deep-redacted body, host-sourced text wrapped as untrusted content when untrusted-wrapping is on); credentials never appear in an error message.
 
-Tool input: {"operation":{"type":"string","enum":["create","moveToCompany","update","upsertByEmail"]},"parentId":{"type":"number | string"},"data":{"type":"object","ref":"contacts body (see types)"},"sourceContactId":{"type":"number | string"},"destinationCompanyId":{"type":"number | string"},"id":{"type":"number | string"},"companyID":{"type":"number | string (the parent — the create MUST be scoped: the global /V1.0/Contacts collection has no POST)"},"email":{"type":"string (the natural dedup key — the vendor field emailAddress, exact match under the parent)"},"extra":{"type":"object (optional) — { firstName?: string (default: the email local-part), lastName?: string (default: empty string), isActive?: boolean | number (BOOLEAN ACCEPTED — mapped to the zone-correct number 1/0; a raw 0/1 number passes through) }"},"dry_run":{"type":"boolean","default":true,"note":"true (the default) = the pinned DryRunResult envelope; the mutating request is never issued. The handler must force dry-run unless confirm is present."},"confirm":{"type":"string","note":"The operation key (e.g. \"tickets.create\") — its presence lifts the dry run. For destructive/approval-gated operations confirm must equal the operation key exactly; the call is refused pre-request without it."}} (required: operation)
+Tool input: {"operation":{"type":"string","enum":["create","moveToCompany","update"]},"parentId":{"type":"number | string"},"data":{"type":"object","ref":"contacts body (see types)"},"sourceContactId":{"type":"number | string"},"destinationCompanyId":{"type":"number | string"},"id":{"type":"number | string"},"dry_run":{"type":"boolean","default":true,"note":"true (the default) = the pinned DryRunResult envelope; the mutating request is never issued. The handler must force dry-run unless confirm is present."},"confirm":{"type":"string","note":"The operation key (e.g. \"tickets.create\") — its presence lifts the dry run. For destructive/approval-gated operations confirm must equal the operation key exactly; the call is refused pre-request without it."}} (required: operation)
 
 | backingOperation | verb | effect | flags | requiredArgs | purpose |
 |------------------|------|--------|-------|--------------|---------|
 | `contacts.create` | create | write | — | parentId, data | Create a contact. (under a company) Dry-run first (dry_run). |
 | `contacts.moveToCompany` | moveToCompany | write | requiresApproval+sensitive | sourceContactId, destinationCompanyId | Move a contact to a different company. Dry-run first (dry_run). Requires confirmation (confirm: contacts.moveToCompany). Sensitive. |
 | `contacts.update` | update | write | idempotent | parentId, id, data | Update a contact. (under a company) Dry-run first (dry_run). Idempotent. |
-| `contacts.upsertByEmail` | upsertByEmail | write | — | companyID, email | Make sure a contact with the given email exists under the given company — find-or-create under the RIGHT parent, with the typed EXISTS/CREATED result (+ the record). Dry-run first (dry_run). |
 
 ### `autotask_company` (read — company)
 
@@ -128,15 +127,14 @@ Tool input: {"operation":{"type":"string","enum":["create","moveToCompany","upda
 
 ### `autotask_company_write` (write — company)
 
-> Write company records (mode: write — the registry operations with effect=write for companies: create, update, upsertByName). Writes are dry-run first: dry_run defaults to true — the request is validated against the registry inputSchema and a DryRunResult envelope is returned; the mutating request is never issued unless the caller passes confirm (the n8n-side handler must force dry-run unless confirm is present, mirroring the SDK governor). Destructive operations are refused without the confirm flag — confirm must equal the operation key exactly (the deliberate act is the call). The n8n consumer surface excludes destructive operations by curation default (excludeDestructive); they remain available on the canonical SDK server (autotask_delete / per-op tools). By curation default (excludeDestructive) no destructive operation is included; destructive capability remains on the canonical SDK server surface. Per-operation required arguments: create [data]; update [id, data]; upsertByName [companyName, params]. Errors carry the SDK error contract: code, category, retryable, operation, httpStatus, suggestedAction (the nextAction directive — follow the directive), correlationId, vendorError (when the vendor returned a response body — the deep-redacted body, host-sourced text wrapped as untrusted content when untrusted-wrapping is on); credentials never appear in an error message.
+> Write company records (mode: write — the registry operations with effect=write for companies: create, update). Writes are dry-run first: dry_run defaults to true — the request is validated against the registry inputSchema and a DryRunResult envelope is returned; the mutating request is never issued unless the caller passes confirm (the n8n-side handler must force dry-run unless confirm is present, mirroring the SDK governor). Destructive operations are refused without the confirm flag — confirm must equal the operation key exactly (the deliberate act is the call). The n8n consumer surface excludes destructive operations by curation default (excludeDestructive); they remain available on the canonical SDK server (autotask_delete / per-op tools). By curation default (excludeDestructive) no destructive operation is included; destructive capability remains on the canonical SDK server surface. Per-operation required arguments: create [data]; update [id, data]. Errors carry the SDK error contract: code, category, retryable, operation, httpStatus, suggestedAction (the nextAction directive — follow the directive), correlationId, vendorError (when the vendor returned a response body — the deep-redacted body, host-sourced text wrapped as untrusted content when untrusted-wrapping is on); credentials never appear in an error message.
 
-Tool input: {"operation":{"type":"string","enum":["create","update","upsertByName"]},"data":{"type":"object","ref":"companies body (see types)"},"id":{"type":"number | string"},"companyName":{"type":"string (the natural dedup key — exact match on the vendor field companyName; the dedup covers only companies this API user can enumerate — the unowned surface is blind)"},"params":{"type":"object — { phone: string, ownerResourceID?: number (REQUIRED on the create path — an active non-API-only resource; the node cannot enumerate candidates: the resources table is blind to the API user; absent + a dedup miss → the typed OWNER_RESOURCE_REQUIRED, zero wire), companyType?: number (default 1 — the ww29-proven value) }"},"dry_run":{"type":"boolean","default":true,"note":"true (the default) = the pinned DryRunResult envelope; the mutating request is never issued. The handler must force dry-run unless confirm is present."},"confirm":{"type":"string","note":"The operation key (e.g. \"tickets.create\") — its presence lifts the dry run. For destructive/approval-gated operations confirm must equal the operation key exactly; the call is refused pre-request without it."}} (required: operation)
+Tool input: {"operation":{"type":"string","enum":["create","update"]},"data":{"type":"object","ref":"companies body (see types)"},"id":{"type":"number | string"},"dry_run":{"type":"boolean","default":true,"note":"true (the default) = the pinned DryRunResult envelope; the mutating request is never issued. The handler must force dry-run unless confirm is present."},"confirm":{"type":"string","note":"The operation key (e.g. \"tickets.create\") — its presence lifts the dry run. For destructive/approval-gated operations confirm must equal the operation key exactly; the call is refused pre-request without it."}} (required: operation)
 
 | backingOperation | verb | effect | flags | requiredArgs | purpose |
 |------------------|------|--------|-------|--------------|---------|
 | `companies.create` | create | write | — | data | Create a company. Dry-run first (dry_run). |
 | `companies.update` | update | write | idempotent | id, data | Update a company. Dry-run first (dry_run). Idempotent. |
-| `companies.upsertByName` | upsertByName | write | — | companyName, params | Make sure a company with the given name exists — find-or-create that carries the blind-surface boundary IN THE RESULT instead of pretending total visibility. Dry-run first (dry_run). |
 
 ### `autotask_companyLocation` (read — companyLocation)
 
@@ -191,7 +189,7 @@ Tool input: {"operation":{"type":"string","enum":["create","update"]},"parentId"
 
 ### `autotask_resource` (read — resource)
 
-> Read resource records (mode: read — effect=read operations only; zero mutating requests, ungated by design). Registry operations for resources: count: Count resource records matching a JSON filter. | get: Get one Resource by id. | getEntityInfo: Get the Resource capability metadata (canCreate/canUpdate/hasUserDefinedFields/...). | getFieldInfo: Get the Resource field catalog (types, picklists, required, maxLength) — the full raw field dump (the largest read of the info trio; compact discovery: operations.fieldCatalog). | getUdfInfo: Get the Resource user-defined-field catalog. | query: Query Resource records with a JSON filter. | resolve: Resolve a resource from a numeric id (the direct fetch, tried first) or an exact value of its primary text field(s) (firstName + lastName — exact match only). Returns the Resource record with the numeric id for get/update/delete. Other identifier forms (e.g. an email address) are NOT tried by resolve — use the resource's dedicated lookup op where one exists (see autotask_catalog). | search: Search resource records by text (contains on the searchable fields). | whoAmI: Identify the resource the current credentials act as.. Bounds: Sensitive. Bounded: server-side pagination — ordinary limit default 500, max 2500; walk.maxRows independently sets the total cap, with pages at most min(500, limit); 1000-page guard; hasMore/truncated flag remaining rows. Sensitive. Bounded: limit default 25, max 500. Sensitive. Errors carry the SDK error contract: code, category, retryable, operation, httpStatus, suggestedAction (the nextAction directive — follow the directive), correlationId, vendorError (when the vendor returned a response body — the deep-redacted body, host-sourced text wrapped as untrusted content when untrusted-wrapping is on); credentials never appear in an error message.
+> Read resource records (mode: read — effect=read operations only; zero mutating requests, ungated by design). Registry operations for resources: count: Count resource records matching a JSON filter. | get: Get one Resource by id. | getEntityInfo: Get the Resource capability metadata (canCreate/canUpdate/hasUserDefinedFields/...). | getFieldInfo: Get the Resource field catalog (types, picklists, required, maxLength) — the full raw field dump (the largest read of the info trio; compact discovery: operations.fieldCatalog). | getUdfInfo: Get the Resource user-defined-field catalog. | query: Query Resource records with a JSON filter. | resolve: Resolve a resource from a numeric id (the direct fetch, tried first) or an exact value of its primary text field(s) (firstName + lastName — exact match only). Returns the Resource record with the numeric id for get/update/delete. Other identifier forms (e.g. an email address) are NOT tried by resolve — use the resource's dedicated lookup op where one exists (see autotask_catalog). | search: Search resource records by text (contains on the searchable fields). | whoAmI: Identify the resource the current credentials act as. | workload: Get a resource's workload in a single call: its open tickets (rows + the exact open totals), its task assignments and the tasks behind them, its time-off balances and requests.. Bounds: Sensitive. Bounded: server-side pagination — ordinary limit default 500, max 2500; walk.maxRows independently sets the total cap, with pages at most min(500, limit); 1000-page guard; hasMore/truncated flag remaining rows. Sensitive. Bounded: limit default 25, max 500. Sensitive. Errors carry the SDK error contract: code, category, retryable, operation, httpStatus, suggestedAction (the nextAction directive — follow the directive), correlationId, vendorError (when the vendor returned a response body — the deep-redacted body, host-sourced text wrapped as untrusted content when untrusted-wrapping is on); credentials never appear in an error message.
 
 | backingOperation | verb | effect | flags | requiredArgs | purpose |
 |------------------|------|--------|-------|--------------|---------|
@@ -204,60 +202,42 @@ Tool input: {"operation":{"type":"string","enum":["create","update"]},"parentId"
 | `resources.resolve` | resolve | read | sensitive | identifier | Resolve a resource from a numeric id (the direct fetch, tried first) or an exact value of its primary text field(s) (firstName + lastName — exact match only). Returns the Resource record with the numeric id for get/update/delete. Other identifier forms (e.g. an email address) are NOT tried by resolve — use the resource's dedicated lookup op where one exists (see autotask_catalog). Sensitive. |
 | `resources.search` | search | read | sensitive | query | Search resource records by text (contains on the searchable fields). Bounded: limit default 25, max 500. Sensitive. |
 | `resources.whoAmI` | whoAmI | read | sensitive | none | Identify the resource the current credentials act as. Sensitive. |
+| `resources.workload` | workload | read | — | id | Get a resource's workload in a single call: its open tickets (rows + the exact open totals), its task assignments and the tasks behind them, its time-off balances and requests. |
 
 ### `autotask_resource_write` (write — resource)
 
-> Write resource records (mode: write — the registry operations with effect=write for resources: transferOwnership, update). Writes are dry-run first: dry_run defaults to true — the request is validated against the registry inputSchema and a DryRunResult envelope is returned; the mutating request is never issued unless the caller passes confirm (the n8n-side handler must force dry-run unless confirm is present, mirroring the SDK governor). Destructive operations are refused without the confirm flag — confirm must equal the operation key exactly (the deliberate act is the call). The n8n consumer surface excludes destructive operations by curation default (excludeDestructive); they remain available on the canonical SDK server (autotask_delete / per-op tools). By curation default (excludeDestructive) no destructive operation is included; destructive capability remains on the canonical SDK server surface. Approval-gated operations (resources.transferOwnership) additionally require confirm equal to the operation key. Per-operation required arguments: transferOwnership [sourceResourceIds, destinationResourceId]; update [id, data]. Errors carry the SDK error contract: code, category, retryable, operation, httpStatus, suggestedAction (the nextAction directive — follow the directive), correlationId, vendorError (when the vendor returned a response body — the deep-redacted body, host-sourced text wrapped as untrusted content when untrusted-wrapping is on); credentials never appear in an error message.
+> Write resource records (mode: write — the registry operations with effect=write for resources: update). Writes are dry-run first: dry_run defaults to true — the request is validated against the registry inputSchema and a DryRunResult envelope is returned; the mutating request is never issued unless the caller passes confirm (the n8n-side handler must force dry-run unless confirm is present, mirroring the SDK governor). Destructive operations are refused without the confirm flag — confirm must equal the operation key exactly (the deliberate act is the call). The n8n consumer surface excludes destructive operations by curation default (excludeDestructive); they remain available on the canonical SDK server (autotask_delete / per-op tools). By curation default (excludeDestructive) no destructive operation is included; destructive capability remains on the canonical SDK server surface. Per-operation required arguments: update [id, data]. Errors carry the SDK error contract: code, category, retryable, operation, httpStatus, suggestedAction (the nextAction directive — follow the directive), correlationId, vendorError (when the vendor returned a response body — the deep-redacted body, host-sourced text wrapped as untrusted content when untrusted-wrapping is on); credentials never appear in an error message.
 
-Tool input: {"operation":{"type":"string","enum":["transferOwnership","update"]},"sourceResourceIds":{"type":"(number | string)[] (max 500)"},"destinationResourceId":{"type":"number | string"},"id":{"type":"number | string"},"data":{"type":"object","ref":"resources body (see types)"},"dry_run":{"type":"boolean","default":true,"note":"true (the default) = the pinned DryRunResult envelope; the mutating request is never issued. The handler must force dry-run unless confirm is present."},"confirm":{"type":"string","note":"The operation key (e.g. \"tickets.create\") — its presence lifts the dry run. For destructive/approval-gated operations confirm must equal the operation key exactly; the call is refused pre-request without it."}} (required: operation)
+Tool input: {"operation":{"type":"string","enum":["update"]},"id":{"type":"number | string"},"data":{"type":"object","ref":"resources body (see types)"},"dry_run":{"type":"boolean","default":true,"note":"true (the default) = the pinned DryRunResult envelope; the mutating request is never issued. The handler must force dry-run unless confirm is present."},"confirm":{"type":"string","note":"The operation key (e.g. \"tickets.create\") — its presence lifts the dry run. For destructive/approval-gated operations confirm must equal the operation key exactly; the call is refused pre-request without it."}} (required: operation)
 
 | backingOperation | verb | effect | flags | requiredArgs | purpose |
 |------------------|------|--------|-------|--------------|---------|
-| `resources.transferOwnership` | transferOwnership | write | requiresApproval+sensitive | sourceResourceIds, destinationResourceId | Transfer ownership of named resources to another resource. Dry-run first (dry_run). Requires confirmation (confirm: resources.transferOwnership). Sensitive. |
 | `resources.update` | update | write | idempotent+sensitive | id, data | Update a resource. Dry-run first (dry_run). Idempotent. Sensitive. |
 
 ### `autotask_timeEntry` (read — timeEntry)
 
-> Read timeEntry records (mode: read — effect=read operations only; zero mutating requests, ungated by design). Registry operations for time_entries: count: Count time entry records matching a JSON filter. | customRange: Get time entries for an explicit dateWorked range. | dateWorkedWindow: The unambiguous-named alias for time_entries.postedWithin (issue #66): the dateWorked window read with the posted/unposted split derived from the billing_items.timeEntryID join — same wire, same result (incl. truncated). The window is ON dateWorked (entries worked within [from, to]); "postedWithin" keeps its historical name (its "posted" is the posted/unposted split, never a posted-date window or a postedDate read). | get: Get one TimeEntry by id. | getEntityInfo: Get the TimeEntry capability metadata (canCreate/canUpdate/hasUserDefinedFields/...). | getFieldInfo: Get the TimeEntry field catalog (types, picklists, required, maxLength) — the full raw field dump (the largest read of the info trio; compact discovery: operations.fieldCatalog). | getPosted: Get posted time entries (an entry that a billing item references), optionally for one ticket and/or a dateWorked window — posted state derives from the billing_items.timeEntryID join, never a postedDate read or approval. | getUdfInfo: Get the TimeEntry user-defined-field catalog. | getUnposted: Get unposted time entries (entries no billing item references), optionally for one ticket and/or a dateWorked window — posted state derives from the billing_items.timeEntryID join, never a postedDate read or approval. | last14: Get time entries for the last 14 days (rolling, dateWorked). | last24h: Get time entries for the last 24 hours (rolling, dateWorked). | last30: Get time entries for the last 30 days (rolling, dateWorked). | last7: Get time entries for the last 7 days (rolling, dateWorked). | last90: Get time entries for the last 90 days (rolling, dateWorked). | lastFullFortnight: Get time entries for the last complete fortnight. | lastFullMonth: Get time entries for the last complete calendar month. | lastFullQuarter: Get time entries for the last complete calendar quarter. | lastFullWeek: Get time entries for the last complete calendar week. | postedWithin: Get time entries WORKED within an inclusive dateWorked window with the posted/unposted split. The window is ON the dateWorked field — the name's "posted" is the posted/unposted SPLIT derived from the billing_items.timeEntryID join (an entry a billing item references is posted, approval is not consulted), never a posted-date window or a postedDate read. The counts cover the returned rows only; truncated flags a capped read. time_entries.dateWorkedWindow is the unambiguous name. | query: Query TimeEntry records with a JSON filter. | resolve: Resolve a time entry from a numeric id (the direct fetch) only — this resource has no searchable text field, so a non-numeric identifier throws a config error. | today: Get time entries for today (dateWorked = now, server date). | yesterday: Get time entries for yesterday (dateWorked = yesterday, server date).. Bounds: Bounded: server-side pagination — ordinary limit default 500, max 2500; walk.maxRows independently sets the total cap, with pages at most min(500, limit); 1000-page guard; hasMore/truncated flag remaining rows. Errors carry the SDK error contract: code, category, retryable, operation, httpStatus, suggestedAction (the nextAction directive — follow the directive), correlationId, vendorError (when the vendor returned a response body — the deep-redacted body, host-sourced text wrapped as untrusted content when untrusted-wrapping is on); credentials never appear in an error message.
+> Read timeEntry records (mode: read — effect=read operations only; zero mutating requests, ungated by design). Registry operations for time_entries: count: Count time entry records matching a JSON filter. | dateWorkedWindow: The ONE posted-state read (issue #290): a bounded read over the inclusive dateWorked window [from, to] (UTC 'YYYY-MM-DD' days) with the posted/unposted split derived from the billing_items.timeEntryID join — never a postedDate read (W-D3: this zone's TimeEntry entity has no postedDate; postedDate exist|notExist 500s, live ww29 2026-10-27). Approval is NOT consulted (ww29 never populates billingApprovalDateTime yet bills those entries). The no-window form is gone: read with no dateWorked filter goes through time_entries.query. | get: Get one TimeEntry by id. | getEntityInfo: Get the TimeEntry capability metadata (canCreate/canUpdate/hasUserDefinedFields/...). | getFieldInfo: Get the TimeEntry field catalog (types, picklists, required, maxLength) — the full raw field dump (the largest read of the info trio; compact discovery: operations.fieldCatalog). | getUdfInfo: Get the TimeEntry user-defined-field catalog. | query: Query TimeEntry records with a JSON filter. | resolve: Resolve a time entry from a numeric id (the direct fetch) only — this resource has no searchable text field, so a non-numeric identifier throws a config error.. Bounds: Bounded: server-side pagination — ordinary limit default 500, max 2500; walk.maxRows independently sets the total cap, with pages at most min(500, limit); 1000-page guard; hasMore/truncated flag remaining rows. Errors carry the SDK error contract: code, category, retryable, operation, httpStatus, suggestedAction (the nextAction directive — follow the directive), correlationId, vendorError (when the vendor returned a response body — the deep-redacted body, host-sourced text wrapped as untrusted content when untrusted-wrapping is on); credentials never appear in an error message.
 
 | backingOperation | verb | effect | flags | requiredArgs | purpose |
 |------------------|------|--------|-------|--------------|---------|
 | `time_entries.count` | count | read | — | none | Count time entry records matching a JSON filter. |
-| `time_entries.customRange` | customRange | read | — | from, to | Get time entries for an explicit dateWorked range. |
-| `time_entries.dateWorkedWindow` | dateWorkedWindow | read | — | from, to | The unambiguous-named alias for time_entries.postedWithin (issue #66): the dateWorked window read with the posted/unposted split derived from the billing_items.timeEntryID join — same wire, same result (incl. truncated). The window is ON dateWorked (entries worked within [from, to]); "postedWithin" keeps its historical name (its "posted" is the posted/unposted split, never a posted-date window or a postedDate read). |
+| `time_entries.dateWorkedWindow` | dateWorkedWindow | read | — | from, to | The ONE posted-state read (issue #290): a bounded read over the inclusive dateWorked window [from, to] (UTC 'YYYY-MM-DD' days) with the posted/unposted split derived from the billing_items.timeEntryID join — never a postedDate read (W-D3: this zone's TimeEntry entity has no postedDate; postedDate exist|notExist 500s, live ww29 2026-10-27). Approval is NOT consulted (ww29 never populates billingApprovalDateTime yet bills those entries). The no-window form is gone: read with no dateWorked filter goes through time_entries.query. |
 | `time_entries.get` | get | read | — | id | Get one TimeEntry by id. |
 | `time_entries.getEntityInfo` | getEntityInfo | read | — | none | Get the TimeEntry capability metadata (canCreate/canUpdate/hasUserDefinedFields/...). |
 | `time_entries.getFieldInfo` | getFieldInfo | read | — | none | Get the TimeEntry field catalog (types, picklists, required, maxLength) — the full raw field dump (the largest read of the info trio; compact discovery: operations.fieldCatalog). |
-| `time_entries.getPosted` | getPosted | read | — | none | Get posted time entries (an entry that a billing item references), optionally for one ticket and/or a dateWorked window — posted state derives from the billing_items.timeEntryID join, never a postedDate read or approval. |
 | `time_entries.getUdfInfo` | getUdfInfo | read | — | none | Get the TimeEntry user-defined-field catalog. |
-| `time_entries.getUnposted` | getUnposted | read | — | none | Get unposted time entries (entries no billing item references), optionally for one ticket and/or a dateWorked window — posted state derives from the billing_items.timeEntryID join, never a postedDate read or approval. |
-| `time_entries.last14` | last14 | read | — | none | Get time entries for the last 14 days (rolling, dateWorked). |
-| `time_entries.last24h` | last24h | read | — | none | Get time entries for the last 24 hours (rolling, dateWorked). |
-| `time_entries.last30` | last30 | read | — | none | Get time entries for the last 30 days (rolling, dateWorked). |
-| `time_entries.last7` | last7 | read | — | none | Get time entries for the last 7 days (rolling, dateWorked). |
-| `time_entries.last90` | last90 | read | — | none | Get time entries for the last 90 days (rolling, dateWorked). |
-| `time_entries.lastFullFortnight` | lastFullFortnight | read | — | none | Get time entries for the last complete fortnight. |
-| `time_entries.lastFullMonth` | lastFullMonth | read | — | none | Get time entries for the last complete calendar month. |
-| `time_entries.lastFullQuarter` | lastFullQuarter | read | — | none | Get time entries for the last complete calendar quarter. |
-| `time_entries.lastFullWeek` | lastFullWeek | read | — | none | Get time entries for the last complete calendar week. |
-| `time_entries.postedWithin` | postedWithin | read | — | from, to | Get time entries WORKED within an inclusive dateWorked window with the posted/unposted split. The window is ON the dateWorked field — the name's "posted" is the posted/unposted SPLIT derived from the billing_items.timeEntryID join (an entry a billing item references is posted, approval is not consulted), never a posted-date window or a postedDate read. The counts cover the returned rows only; truncated flags a capped read. time_entries.dateWorkedWindow is the unambiguous name. |
 | `time_entries.query` | query | read | — | none | Query TimeEntry records with a JSON filter. Bounded: server-side pagination — ordinary limit default 500, max 2500; walk.maxRows independently sets the total cap, with pages at most min(500, limit); 1000-page guard; hasMore/truncated flag remaining rows. |
 | `time_entries.resolve` | resolve | read | — | identifier | Resolve a time entry from a numeric id (the direct fetch) only — this resource has no searchable text field, so a non-numeric identifier throws a config error. |
-| `time_entries.today` | today | read | — | none | Get time entries for today (dateWorked = now, server date). |
-| `time_entries.yesterday` | yesterday | read | — | none | Get time entries for yesterday (dateWorked = yesterday, server date). |
 
 ### `autotask_timeEntry_write` (write — timeEntry)
 
-> Write timeEntry records (mode: write — the registry operations with effect=write for time_entries: approve, create, createForResource, createIfNotExists, update). Writes are dry-run first: dry_run defaults to true — the request is validated against the registry inputSchema and a DryRunResult envelope is returned; the mutating request is never issued unless the caller passes confirm (the n8n-side handler must force dry-run unless confirm is present, mirroring the SDK governor). Destructive operations are refused without the confirm flag — confirm must equal the operation key exactly (the deliberate act is the call). The n8n consumer surface excludes destructive operations by curation default (excludeDestructive); they remain available on the canonical SDK server (autotask_delete / per-op tools). By curation default (excludeDestructive) no destructive operation is included; destructive capability remains on the canonical SDK server surface. Per-operation required arguments: approve [id]; create [data]; createForResource [resourceID, params]; createIfNotExists [data]; update [id, data]. Errors carry the SDK error contract: code, category, retryable, operation, httpStatus, suggestedAction (the nextAction directive — follow the directive), correlationId, vendorError (when the vendor returned a response body — the deep-redacted body, host-sourced text wrapped as untrusted content when untrusted-wrapping is on); credentials never appear in an error message.
+> Write timeEntry records (mode: write — the registry operations with effect=write for time_entries: create, update). Writes are dry-run first: dry_run defaults to true — the request is validated against the registry inputSchema and a DryRunResult envelope is returned; the mutating request is never issued unless the caller passes confirm (the n8n-side handler must force dry-run unless confirm is present, mirroring the SDK governor). Destructive operations are refused without the confirm flag — confirm must equal the operation key exactly (the deliberate act is the call). The n8n consumer surface excludes destructive operations by curation default (excludeDestructive); they remain available on the canonical SDK server (autotask_delete / per-op tools). By curation default (excludeDestructive) no destructive operation is included; destructive capability remains on the canonical SDK server surface. Per-operation required arguments: create [data]; update [id, data]. Errors carry the SDK error contract: code, category, retryable, operation, httpStatus, suggestedAction (the nextAction directive — follow the directive), correlationId, vendorError (when the vendor returned a response body — the deep-redacted body, host-sourced text wrapped as untrusted content when untrusted-wrapping is on); credentials never appear in an error message.
 
-Tool input: {"operation":{"type":"string","enum":["approve","create","createForResource","createIfNotExists","update"]},"id":{"type":"number | string"},"data":{"type":"object","ref":"time_entries body (see types)"},"resourceID":{"type":"number | string"},"params":{"type":"object — the smart-create params: { internallAllocationCodeID?: number (pin the internal linkage code), ticketID?: number, taskID?: number, roleID?: number (pin the task/ticket roleID — vendor-validated as an allocation code), dateWorked?: UTC YYYY-MM-DD, startDateTime?: UTC ISO, endDateTime?: UTC ISO, hoursWorked?: number, + any other vendor TimeEntry field } (exactly one linkage pin; none → the default internal linkage with the node-resolved code)"},"dry_run":{"type":"boolean","default":true,"note":"true (the default) = the pinned DryRunResult envelope; the mutating request is never issued. The handler must force dry-run unless confirm is present."},"confirm":{"type":"string","note":"The operation key (e.g. \"tickets.create\") — its presence lifts the dry run. For destructive/approval-gated operations confirm must equal the operation key exactly; the call is refused pre-request without it."}} (required: operation)
+Tool input: {"operation":{"type":"string","enum":["create","update"]},"data":{"type":"object","ref":"time_entries body (see types)"},"id":{"type":"number | string"},"dry_run":{"type":"boolean","default":true,"note":"true (the default) = the pinned DryRunResult envelope; the mutating request is never issued. The handler must force dry-run unless confirm is present."},"confirm":{"type":"string","note":"The operation key (e.g. \"tickets.create\") — its presence lifts the dry run. For destructive/approval-gated operations confirm must equal the operation key exactly; the call is refused pre-request without it."}} (required: operation)
 
 | backingOperation | verb | effect | flags | requiredArgs | purpose |
 |------------------|------|--------|-------|--------------|---------|
-| `time_entries.approve` | approve | write | — | id | Approve a time entry (the REST-only approval path): create the BillingItemApprovalLevels record, apply the vendor-documented follow-up update of BillingApprovalDateTime + BillingApprovalResourceID, then read the entry back and report whether the vendor accepted it. Dry-run first (dry_run). |
 | `time_entries.create` | create | write | — | data | Create a time entry. Dry-run first (dry_run). |
-| `time_entries.createForResource` | createForResource | write | — | resourceID, params | Create a time entry for a resource with the allocation-code dependency resolved by the node: it verifies the resource is active, honours the caller's linkage pin (else the default internal linkage), resolves an EXISTING active allocation code applicable to the resource (never creates one — the API user cannot), and posts the vendor-valid body. Dry-run first (dry_run). |
-| `time_entries.createIfNotExists` | createIfNotExists | write | — | data | Create a TimeEntry. Dry-run first (dry_run). |
 | `time_entries.update` | update | write | idempotent | id, data | Update a time entry. Dry-run first (dry_run). Idempotent. |
 
 ## Destructive operations — excluded by default, available via the SDK server (P2 honesty)
@@ -275,19 +255,19 @@ only via a recorded change to `n8n-mcp.curation.json`.
 
 ## Stats
 
-- registryRecords: 1282
+- registryRecords: 1224
 - curatedEntities: 7
 - includedEntities: 7
 - readTools: 7
 - writeTools: 7
 - totalTools: 14
-- readOperations: 88
-- writeOperations: 22
-- approvalGatedWrites: 2
+- readOperations: 75
+- writeOperations: 15
+- approvalGatedWrites: 1
 - destructiveExcluded: 4
 
 ## Meta
 
-- generatedAt: 2026-11-01T01:23:14.190Z
-- capabilitiesHash: 7cf0032e0744a559430781aeafbd3984b708e71f04b850011e08fbf113eaadcc
-- curationHash: e19117ce73e38d9aded3be7e7f077a4e185d2e10294622b76c17d67f63cf9e3b
+- generatedAt: 2026-11-01T10:43:53.479Z
+- capabilitiesHash: 729ea0d47099fd45e1dde837510a92bd566a793368d0a4882e2613cbe05f7594
+- curationHash: 623fbca25fa416f983dde22c8b736ce813a2db1bd8c188f7124abba710f52452

package/README.md

@@ -343,9 +343,8 @@ The SDK ships the mechanical substrate, not a server (no MCP imports, no zod):
    governor place: `src/operations/invoke.ts`).
 
    <!-- BEGIN GENERATED:approval-policy -->
-   **Harness approval policy (recommended).** Require approval on every tool whose MCP annotation is `readOnlyHint !== true` — today exactly **267 tools**: the 265 dedicated write/delete tools (209 `effect=write` + 56 `effect=destructive`, every one of them has a dedicated tool) + `autotask_write` + `autotask_delete`. The remaining **636 tools** (the 623 dedicated read tools + the 10 core read tools + `autotask_read` + `autotask_catalog` + `autotask_describe`) all carry `readOnlyHint: true` and are safe ungated: every op they can route is `effect=read` (zero mutating requests). Refined class for the highest-risk ops: the **57 tools with `destructiveHint: true`** (56 dedicated delete tools + `autotask_delete`) additionally require `confirm === <operation key>` even inside `autotask_delete`. The approval-gated writes (`configuration_items.moveConfigurationItem`, `contacts.moveToCompany`, `resources.transferOwnership`) require the same confirm inside `autotask_write`. Migration: `autotask_invoke` is REPLACED by `autotask_read`/`autotask_write`/`autotask_delete` — update harness config and remove any `autotask_invoke` entry. The rule is derivable from the registry `effect` column and the mode tools’ fixed annotations; it never needs a hand-maintained name list.
+   **Harness approval policy (recommended).** Require approval on every tool whose MCP annotation is `readOnlyHint !== true` — today exactly **246 tools**: the 244 dedicated write/delete tools (188 `effect=write` + 56 `effect=destructive`, every one of them has a dedicated tool) + `autotask_write` + `autotask_delete`. The remaining **599 tools** (the 586 dedicated read tools + the 10 core read tools + `autotask_read` + `autotask_catalog` + `autotask_describe`) all carry `readOnlyHint: true` and are safe ungated: every op they can route is `effect=read` (zero mutating requests). Refined class for the highest-risk ops: the **57 tools with `destructiveHint: true`** (56 dedicated delete tools + `autotask_delete`) additionally require `confirm === <operation key>` even inside `autotask_delete`. The approval-gated writes (`configuration_items.moveConfigurationItem`, `contacts.moveToCompany`) require the same confirm inside `autotask_write`. Migration: `autotask_invoke` is REPLACED by `autotask_read`/`autotask_write`/`autotask_delete` — update harness config and remove any `autotask_invoke` entry. The rule is derivable from the registry `effect` column and the mode tools’ fixed annotations; it never needs a hand-maintained name list.
    <!-- END GENERATED:approval-policy -->
-
    **Provider tool-search interop.** Hosts with provider-native tool search
    (OpenAI `type: "tool_search"` / `defer_loading`; Anthropic's tool search
    tool) defer-load tool arrays host-side. Two coexistences, both already
@@ -404,12 +403,8 @@ The SDK ships the mechanical substrate, not a server (no MCP imports, no zod):
    source.
 
 7. **Agent QoL surface (the stage-12 issue wave, live-verified on ww29)** —
-   the zero-wire planning reads `operations.blindSurfaces` (the 124-surface
-   blind/data inventory) and `operations.createGuidance` (per-child zone
-   facts with verbatim vendor evidence), the bounded live
-   `operations.probeReachability` sweep (confirm-gated, over-cap refuses),
-   `operations.recovery` (find the records a marker-tagged write created;
-   delete is dry-run-first under `confirm`), `time_entries.postedWithin`
+   the zero-wire planning read `operations.createGuidance` (per-child zone
+   facts with verbatim vendor evidence), `time_entries.postedWithin`
    (the inclusive UTC window read over `dateWorked` — posted/ticket/resource
    narrowing), the issue #13 create-path recovery (a drifted 2xx answers
    `idFrom: 'marker-recovery'` from ONE bounded marker read, or the typed
@@ -570,8 +565,8 @@ suites are the release gate, the live scripts are the ground-truth check.
   the 14-issue wave (agent profile + ClientPool/gateway mode, untrusted-content
   markers, the doctor preflight CLI, closed MCP input, wire-level surface probes
   + `npm run verify`, the Node-24 floor, the per-tenant 429 cooldown, delete
-  boundaries + `operations.recovery`, the blind-surface inventory + bounded
-  probe, the zone-fact create-guidance catalog, the posted/unposted rework
+  boundaries, the blind-surface inventory (the plan data the served artifacts
+  stamp from), the zone-fact create-guidance catalog, the posted/unposted rework
   (first the spec `postedDate` wire, replaced in 0.32.0 by the
   billing-item join because ww29 has no `postedDate`; W-D3 +
   `postedWithin`), the create-path marker recovery, the typed `emptyReason`,