Mnemom — Trust Ratings for AI Agents

Name: Mnemom — Trust Ratings for AI Agents
Author: mnemom

Server Details

Trust infrastructure for AI agents: read a verifiable Trust Rating, claim an identity, earn a badge.

If you are the author of this connector, you can claim ownership with GitHub, an HTTP challenge, or a DNS record. Claimed connector authors can inspect health checks, view analytics, and manage their listing.

Status: Healthy
Last Tested: 2026-09-06 06:57
Transport: Streamable HTTP
URL
Repository: mnemom/mcp
GitHub Stars: 0
Server Listing: Mnemom

Available Tools

15 tools

claim_agentAInspect

Claim a verifiable identity — bind an agent to your organization so its trust and accountability record is provably yours. No human in the loop.

ParametersJSON Schema

Name	Required	Description
`org_id`	No	Optional. The organization to claim the agent into (e.g. `org-...` or `pers-...`). The caller must be a member of this org (role floor: member). If omitted, the agent is claimed into the caller's personal org.
`agent_id`	Yes	Agent identifier (e.g. smolt-abc123)
`hash_proof`	Yes	Agent possession proof — either the live birth token (`mnbt_…`) whose row pins this agent's hash, or the full 64-hex SHA-256 digest of `${apiKey}\|${agentName}` (or `${apiKey}` for an unnamed singleton agent).

Output Schema

ParametersJSON Schema

Name	Required	Description
`org_id`	Yes	The organization the agent was claimed into (echoes the resolved org — the supplied `org_id`, or the caller's personal org when omitted).
`claimed`	Yes
`agent_id`	Yes
`claimed_at`	Yes

TDQS

A4.2/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate this is not read-only and not idempotent. The description adds valuable context: 'No human in the loop' and 'provably yours' suggest a non-reversible, automatic binding that creates a persistent ownership record. This goes beyond what annotations provide, though it doesn't fully disclose edge cases like conflict resolution.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the core action, and every sentence adds value. There is no redundancy or filler, making it optimally concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the presence of an output schema, 100% parameter coverage, and annotations, the description is fairly complete. It covers the purpose and key behavioral trait ('No human in the loop') but could ideally mention what happens post-claim (e.g., immutability) for full completeness. Still, for the complexity level, it is sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with all three parameters (org_id, agent_id, hash_proof) already clearly documented. The description does not add any additional parameter-level semantics beyond what the schema provides, so the baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Claim a verifiable identity — bind an agent to your organization') with a specific verb and resource, and distinguishes itself from siblings like verify_agent_binding by emphasizing the binding/claiming action rather than verification.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides clear context for use ('bind an agent to your organization') and mentions the automated nature ('No human in the loop'), which implies when this tool is appropriate. However, it does not explicitly mention alternatives or when-not-to-use, so it does not earn a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_agentA

Read-onlyIdempotent

Inspect

Look up an agent's public identity and trust state by ID — the accountable record other agents and humans can rely on.

ParametersJSON Schema

Name	Required	Description	Default
`agent_id`	Yes	Agent identifier (e.g. smolt-abc123)

Output Schema

ParametersJSON Schema

Name	Required	Description
`id`	Yes	Agent identifier (e.g. smolt-abc123).
`name`	No	Agent name (2-32 chars, alphanumeric + hyphens).
`caller`	No	Which projection THIS response is. `org_member` receives the owner field set; `anonymous`/`authenticated` receive the reduced public set (id, name, claimed, created_at, last_seen, status, avatar_url, caller). Read this instead of inferring why a field is absent.
`groups`	No	Active groups this agent belongs to, name-ordered; `[]` when none. Present on org-fleet rows.
`org_id`	No	The agent's organization binding. Required as an input by the org-scoped tools (fleet listing, posture assignment). Identifies an organization, not a person.
`public`	No	Whether the agent's identity record is publicly discoverable. Distinct from Trust Rating visibility, which is always public.
`status`	No	Derived from last_seen (active = seen within the last hour).
`claimed`	No	Whether a human or organization has claimed accountability for this agent. On the owner projection this is derived from the ownership column; the owning user's identifier itself is not returned.
`last_seen`	No
`agent_hash`	No	The canonical public identity hash (first 16 hex chars) used as the gateway lookup key and as the input to verify_agent_binding. Owner projection only. Not a credential and not reversible to one.
`avatar_url`	No
`claimed_at`	No
`created_at`	No
`containment_status`	No	Containment state of the agent.
`aip_enforcement_mode`	No

TDQS

A3.8/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the read-only nature is covered. The description adds that the lookup targets 'public identity and trust state,' providing some scope beyond annotations, but it does not disclose behavior for missing IDs, error cases, or data freshness, so the added transparency is modest.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with no wasted words. It names the action, the resource, and the lookup key, while the final clause adds meaningful context about the tool's reliability as an 'accountable record.'

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter lookup with an output schema and strong annotations, the description is largely complete: it identifies what is looked up and why it matters. The only missing piece is explicit guidance about when to prefer sibling tools, but that is more a usage-guideline concern and does not undermine overall completeness for a simple read-only lookup.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% coverage: agent_id is described with an example ('e.g. smolt-abc123'). The description only repeats 'by ID' without adding new parameter semantics, so baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Look up an agent's public identity and trust state by ID.' This clearly distinguishes it from siblings like list_agents (which lists) and get_reputation (which focuses on reputation), and it explicitly identifies the lookup key (ID).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies use when one needs the accountable agent record, but it provides no explicit when-to-use or when-not-to-use guidance, nor does it mention alternative tools like get_reputation or verify_agent_binding. It relies on context rather than explicit exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_reputationA

Read-onlyIdempotent

Inspect

Look up an AI agent's published Trust Rating — Mnemom's portable reliability signal for autonomous software, computed from the agent's own verified activity record. Returns the rating plus the technical factors behind it. Free, public, read-only: every registered agent's rating is published by standard (the visibility field is the reputation-publication axis, distinct from identity-record visibility).

ParametersJSON Schema

Name	Required	Description	Default
`agent_id`	Yes	Agent identifier (e.g. smolt-abc123)

Output Schema

ParametersJSON Schema

Name	Required	Description
`tier`	No
`grade`	Yes	AAA–D or NR.
`score`	Yes
`claimed`	No
`agent_id`	Yes
`trend_30d`	No
`agent_name`	No
`components`	Yes
`confidence`	Yes
`visibility`	Yes	Reputation-publication axis — whether this agent's Trust Rating is published. Every registered agent's reputation is `public` by accountability standard (the default; that is the whole point of a portable, verifiable rating); `private` is a rare owner opt-out that 403s the read to non-owners. This is DISTINCT from `Agent.public` (the identity-record visibility axis) — they share the word "public" but govern different things.
`computed_at`	No
`is_eligible`	Yes
`next_compute_at`	No	Next scheduled recompute — the 00/06/12/18 UTC cron slot strictly after `computed_at` (`floor(computed_at/6h)*6h + 6h`). Null when `computed_at` is null.
`checkpoint_count`	Yes
`a2a_trust_extension`	No	A2A trust extension for interop. Only present on `GET /reputation/{agent_id}` (not on batch/compare rows).
`checkpoint_accounting`	No	Structured breakdown of how checkpoints were counted toward the score. `analyzed` is the scoring population; `excluded` buckets are mutually exclusive and `analyzed + synthetic + insufficient_thinking + quarantined = total`. Null for legacy rows computed before this field existed.

TDQS

A3.8/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, destructiveHint=false, idempotentHint=true. Description adds that it's 'computed from the agent's own verified activity record' and clarifies the visibility field distinction, providing useful behavioral context beyond annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise, front-loaded sentences with no wasted words. Each sentence adds value: main action, result, and key properties. Perfectly sized for quick comprehension.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Tool has output schema, so return values are covered. Description provides enough context about the rating's nature, visibility, and computation. Minor gap: does not mention if the rating is numeric or categorical, but output schema handles this.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with adequate description for agent_id (example format). Description does not add extra parameter meaning beyond the schema, so baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states 'Look up an AI agent's published Trust Rating' with specific verb and resource. Distinguishes from siblings like get_reputation_badge by mentioning 'returns the rating plus the technical factors', but does not explicitly contrast with other similar siblings like scan_trust.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides context that it's 'Free, public, read-only', implying when to use (simple lookup). No explicit guidance on when not to use or alternatives like search_reputation_directory or verify_reputation, leaving some ambiguity.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_reputation_badgeA

Read-onlyIdempotent

Inspect

Get an embeddable Trust Rating badge for an agent — returns the badge image URL plus ready-to-paste Markdown and HTML snippets for a README or agent card.

ParametersJSON Schema

Name	Required	Description	Default
`agent_id`	Yes	Agent identifier (e.g. smolt-abc123)

Output Schema

ParametersJSON Schema

Name	Required	Description
`agent_id`	Yes	The agent the badge is for (echoed from the request).
`badge_url`	Yes	Canonical SVG Trust Rating badge image URL (always on api.mnemom.ai).
`html_embed`	Yes	Paste-ready HTML badge snippet.
`profile_url`	Yes	Human-readable reputation profile page (on www.mnemom.ai).
`verified_url`	Yes	Public cryptographic verification URL for the rating.
`markdown_embed`	Yes	Paste-ready Markdown badge snippet.

TDQS

A3.9/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already provide readOnlyHint, idempotentHint, destructiveHint. The description adds output format details (URL, snippets) but does not disclose additional behavioral traits like authentication requirements or rate limits beyond what annotations imply.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, front-loaded sentence that conveys all necessary information without extraneous words. Every part contributes to understanding the tool's purpose and output.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one parameter, clear output schema), the description fully covers what the tool does and returns. No additional context is needed for an agent to correctly invoke it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with a clear description for the single parameter 'agent_id'. The tool description does not add meaning beyond the schema, meeting the baseline of 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool returns an embeddable Trust Rating badge, specifying the output includes badge URL and Markdown/HTML snippets. The verb 'Get' and resource 'badge' are specific, and it distinguishes from sibling tools like 'get_reputation' which likely return raw data.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage when an embeddable badge is needed but does not explicitly state when to use this tool versus alternatives (e.g., 'get_reputation' for raw data). No guidance on when not to use it is provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_startedA

Read-onlyIdempotent

Inspect

Zero-auth, no-args orientation: who Mnemom is, the surface map, how to authenticate and what it unlocks, and the value tools to try right now (headlining scan_trust + the reputation reads).

ParametersJSON Schema

Name	Required	Description	Default
`token`	No	Optional Dojo try-me invite token. When supplied and valid, returns the token-gated dojo briefing manifest (the same content as GET /v1/dojo/try-me/resolve); omit for public orientation.

Output Schema

ParametersJSON Schema

Name	Required	Description
`who`	Yes	One-line positioning.
`verify`	Yes	How to verify signed artifacts in-band (verify, don't trust).
`try_now`	Yes	Zero-auth value tools to call right now.
`doctrine`	Yes
`skill_path`	Yes	The two-step on-ramp to declaring and advertising capabilities as A2A skills in a signed, portable AgentCard.
`value_prop`	Yes	What Mnemom does for an agent.
`surface_map`	Yes	Stable links to the canonical read-only surfaces.
`authenticate`	Yes	How to authenticate and what auth unlocks.
`developer_path`	Yes	The developer hero on-ramp: the npx one-liner plus the intent-named MCP prompt-skills (try-me, onboard_an_agent, become_sovereign). Advertisement only — no functional dependency on those prompts existing yet.
`showcase_agent`	Yes	A real Mnemom-owned agent the try_now reputation reads target, so the loop runs verbatim.
`sovereignty_path`	Yes	The five-step on-ramp to becoming a sovereign, accountable agent, composed from existing tools. Walked end to end by the become_sovereign MCP prompt.
`visibility_model`	Yes	Disambiguates the two axes that share the word 'public': reputation-publication visibility (public by standard) vs identity-record visibility (agent.public), plus the caller-context self-description.
`what_we_keep_private_and_why`	Yes

TDQS

A4.4/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, and no destructive action. The description adds key behavioral details: zero authentication required, no required arguments, and the optional token parameter behavior for returning a token-gated manifest.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence, dense with information, but remains clear. It front-loads the key idea ('Zero-auth, no-args orientation') and packs details efficiently.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity and the presence of an output schema, the description covers all necessary context: purpose, authentication needs, optional parameters, and content returned.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%; the description adds essential meaning by explaining the token parameter's purpose and effect, which the schema description only briefly mentions as 'Optional Dojo try-me invite token'.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool provides a zero-auth orientation including system identity, map, authentication, and recommended tools like scan_trust. It distinctly sets itself apart from sibling tools by being a no-args, no-auth entry point.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly mentions 'Zero-auth, no-args' suggesting use for initial orientation with no prerequisites. It implies when to use it but does not explicitly state when not to use or provide direct alternatives among sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_agentsA

Read-onlyIdempotent

Inspect

List your agents — List all agents owned by the authenticated user. Supports pagination.

ParametersJSON Schema

Name	Required	Description	Default
`limit`	No	How many agents to return, 1-100.
`offset`	No	How many agents to skip, for pagination.

Output Schema

ParametersJSON Schema

Name	Required	Description
`scope`	Yes	Echoes the resolved listing scope.
`agents`	Yes	The caller's agents, reduced to the MCP trust-loop field set.

TDQS

A4.1/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is known. The description adds the scope constraint ('owned by the authenticated user') and pagination support, which is helpful. However, it does not disclose ordering, error cases, or rate limits, so it only moderately adds beyond annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the action and resource, then a clarifying detail. Every word earns its place; there is no fluff or redundancy. The dash separator improves readability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With high annotation coverage, a fully described input schema, and an existing output schema, the description is complete for a simple read-only list operation. It correctly mentions pagination and the ownership scoping, which are the only non-obvious aspects beyond the structured data.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with both limit and offset parameters already fully described in the schema. The tool description only says 'Supports pagination,' which adds no additional meaning beyond the schema. Baseline of 3 is appropriate because the schema carries the parameter documentation burden.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description uses a specific verb and resource: 'List your agents — List all agents owned by the authenticated user.' It clearly distinguishes from sibling tools like get_agent (which fetches a single agent) and claim_agent (which assigns ownership). The scope is explicit and unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description states it lists agents owned by the authenticated user and supports pagination, providing clear context for when to use this tool. It does not explicitly name alternatives or exclusions, but the sibling list hints at differentiated use cases. A stronger statement like 'use this instead of get_agent for all agents' would earn a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

preview_compose_alignment_by_agentA

Read-onlyIdempotent

Inspect

Preview composed alignment (dry run) — Composes the cascade against a hypothetical body at the agent layer and returns conflicts + the composed view. No DB writes. Used by the dashboard editor for live conflict markers.

ParametersJSON Schema

Name	Required	Description
`audit`	Yes	How long this agent's own decision log is kept, and whether it can be queried. Required. (This is the agent's audit policy — it is NOT Mnemom's retention policy for the card itself; see the tool's data-handling disclosure for that.)
`values`	Yes	The values this agent declares it is bound by. Required.
`agent_id`	Yes	The agent this card belongs to (e.g. `smolt-abc123`). Identifier only — never place an API key, a secret, an email address, or any other personal data in this field.
`autonomy`	Yes	What the agent may do on its own authority. Required.
`principal`	Yes	Whose authority this agent acts under. Required.
`card_version`	Yes	Card schema version. REQUIRED by the server-side validator. Current canonical value: `unified/2026-04-26`.
`autonomy_mode`	Yes	Master switch for the action-policing pipeline. Required. `off` disables it; `observe` records only; `nudge` warns; `enforce` blocks.
`integrity_mode`	Yes	Master switch for the values pipeline. Required. Same four states as `autonomy_mode`.

Output Schema

ParametersJSON Schema

Name	Required	Description
`ok`	Yes	True when composition succeeded (no blocking conflicts).
`summary`	Yes	One-line human-readable summary of composition status.
`full_report`	No	Optional pointer to the full /v1 conflict report (method + path).
`conflicts_count`	Yes	Total number of conflicts detected (0 = none).
`composition_valid`	Yes	True when the composed card is coherence-valid.

TDQS

A4.2/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/idempotent/non-destructive, and the description reinforces this with 'No DB writes' while adding that it composes against a hypothetical body and returns conflicts and a composed view. This adds useful context beyond annotations, though the meaning of 'cascade' and 'agent layer' could be clearer.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the core purpose and dry-run nature, with no wasted words. It efficiently conveys the primary function, side effects, and intended usage.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (8 nested params, output schema exists), the description provides sufficient orientation: what it does, side effects, and typical use case. It does not elaborate on input semantics, but the schema covers that, and the output schema eliminates the need to describe return structure.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema fully documents all eight parameters. The description does not add parameter-specific meaning, but the rich schema already handles that, so baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool performs a dry-run preview of composed alignment at the agent layer, returning conflicts and the composed view. It differentiates from sibling tools like put_alignment_by_agent (write) and preview_compose_protection_by_agent (protection vs alignment).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description specifies it is a dry run with no DB writes and mentions its use by the dashboard editor for live conflict markers, implying a preview-before-commit context. It does not explicitly contrast against put_alignment_by_agent, but the use case is clear enough.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

preview_compose_protection_by_agentA

Read-onlyIdempotent

Inspect

Preview composed protection (dry run) — Composes the cascade against a hypothetical body at the agent layer and returns conflicts + the composed view. No DB writes. Used by the dashboard editor for live conflict markers.

ParametersJSON Schema

Name	Required	Description
`mode`	Yes	Screening mode for the protection pipeline. Required. `off` disables screening; `observe` records only; `nudge` warns; `enforce` blocks.
`agent_id`	Yes	The agent this card belongs to (e.g. `smolt-abc123`). Identifier only — never place an API key, a secret, an email address, or any other personal data in this field.
`thresholds`	No	Risk-score cutoffs, each in [0, 1] and ordered warn ≤ quarantine ≤ block. All three are required if this object is sent at all — omit the whole object to accept the composed defaults.
`card_version`	Yes	Card schema version. REQUIRED by the server-side validator. Current canonical value: `protection/2026-04-26`.
`screen_surfaces`	No	Which traffic surfaces are screened. Omit to accept the composed defaults.
`trusted_sources`	No	Sources exempt from screening. Enumerate specific hosts — wildcards are rejected, and a server-side deny-list (public LLM/DNS endpoints, 0.0.0.0/0, ::/0, link-local, multicast) is always applied.
`protected_surface`	No	The assets and operations this agent must protect. Omit to accept the composed default (empty surface).

Output Schema

ParametersJSON Schema

Name	Required	Description
`ok`	Yes	True when composition succeeded (no blocking conflicts).
`summary`	Yes	One-line human-readable summary of composition status.
`full_report`	No	Optional pointer to the full /v1 conflict report (method + path).
`conflicts_count`	Yes	Total number of conflicts detected (0 = none).
`composition_valid`	Yes	True when the composed card is valid.

TDQS

A4.4/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds valuable behavioral context beyond these: it explains the tool performs a dry run against a hypothetical body, returns conflicts plus the composed view, and explicitly confirms no database writes. This aligns with annotations and enriches understanding without contradicting them.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the core purpose ('Preview composed protection (dry run)') and immediately conveys key traits ('No DB writes', returns conflicts + composed view, dashboard editor use). Every word earns its place with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (7 params, nested objects, output schema), the description covers the high-level behavior, safety profile, and intended usage. It does not need to explain return values because an output schema exists. It could have elaborated on what a 'hypothetical body' is, but the annotations, schema, and output schema collectively fill the gaps, making it sufficiently complete for an agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description does not add specific parameter-level semantics beyond what the schema provides, and it does mention 'hypothetical body' but does not map that to individual parameters. However, the schema descriptions are already rich, so no significant gap exists.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Preview composed protection (dry run)') and resource ('protection'), and clearly states the tool composes the cascade against a hypothetical body and returns conflicts + composed view. It also distinguishes itself from siblings by emphasizing 'No DB writes' and the dashboard editor use case, differentiating it from preview_compose_alignment_by_agent and put_protection_by_agent.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description specifies a clear use case: 'Used by the dashboard editor for live conflict markers.' It also implies a dry-run/no-persistence context with 'No DB writes,' which suggests when not to use it (i.e., when persistence is needed), though it does not explicitly name put_protection_by_agent as the alternative. This is clear context but lacks explicit exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

put_alignment_by_agentA

DestructiveIdempotent

Inspect

Publish or replace the alignment manifest — Accepts YAML (text/yaml, application/yaml) or JSON. Body is the full UnifiedAlignmentCard; server-side composition merges it across the platform → org → team → agent cascade and writes the canonical composed card. Requires Idempotency-Key. Honor...

ParametersJSON Schema

Name	Required	Description
`audit`	Yes	How long this agent's own decision log is kept, and whether it can be queried. Required. (This is the agent's audit policy — it is NOT Mnemom's retention policy for the card itself; see the tool's data-handling disclosure for that.)
`values`	Yes	The values this agent declares it is bound by. Required.
`agent_id`	Yes	The agent this card belongs to (e.g. `smolt-abc123`). Identifier only — never place an API key, a secret, an email address, or any other personal data in this field.
`autonomy`	Yes	What the agent may do on its own authority. Required.
`principal`	Yes	Whose authority this agent acts under. Required.
`card_version`	Yes	Card schema version. REQUIRED by the server-side validator. Current canonical value: `unified/2026-04-26`.
`autonomy_mode`	Yes	Master switch for the action-policing pipeline. Required. `off` disables it; `observe` records only; `nudge` warns; `enforce` blocks.
`integrity_mode`	Yes	Master switch for the values pipeline. Required. Same four states as `autonomy_mode`.

Output Schema

ParametersJSON Schema

Name	Required	Description
`ok`	Yes	Always true on successful storage (errors return non-200 status).
`card_id`	Yes	Card ID (ac-{uuid}) of the stored alignment card.
`issued_at`	Yes	ISO 8601 timestamp when the card was issued/stored.

TDQS

A4.2/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds meaningful behavioral context beyond annotations: it discloses server-side composition merging across the platform→org→team→agent cascade, writes the canonical composed card, and requires Idempotency-Key. Annotations already signal destructive and idempotent behavior, and the description reinforces and extends this without contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the purpose but becomes a run-on sentence and ends abruptly with "Honor...", which appears truncated. While each segment carries useful information, the structure suffers from the incomplete final clause and the dense single-sentence flow.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (8 params, nested objects) and rich schema plus output schema, the description covers key behavioral aspects: media types, merge cascade, canonical card, and idempotency requirement. It misses explicit return-value discussion (covered by output schema) and the truncated "Honor..." likely indicates more context, but it is still fairly complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema fully explains all parameters. The description adds only a high-level note that the body is the full UnifiedAlignmentCard, but does not enrich individual parameter semantics beyond what the schema provides. Baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb and resource: "Publish or replace the alignment manifest". It distinguishes from siblings like put_protection_by_agent (protection card) and preview_compose_alignment_by_agent (preview), making its specific purpose unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The context is clear: this is the publish/replace operation for an alignment card, accepting YAML or JSON with a full UnifiedAlignmentCard body. However, it does not explicitly mention alternatives like preview_compose_alignment_by_agent or state when not to use it, so it lacks explicit exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

put_protection_by_agentA

DestructiveIdempotent

Inspect

Publish or replace the protection manifest — Accepts YAML (text/yaml, application/yaml) or JSON. Body is the full UnifiedProtectionCard; server-side composition merges it across the platform → org → team → agent cascade and writes the canonical composed card. Requires Idempotency-Key. Hon...

ParametersJSON Schema

Name	Required	Description
`mode`	Yes	Screening mode for the protection pipeline. Required. `off` disables screening; `observe` records only; `nudge` warns; `enforce` blocks.
`agent_id`	Yes	The agent this card belongs to (e.g. `smolt-abc123`). Identifier only — never place an API key, a secret, an email address, or any other personal data in this field.
`thresholds`	No	Risk-score cutoffs, each in [0, 1] and ordered warn ≤ quarantine ≤ block. All three are required if this object is sent at all — omit the whole object to accept the composed defaults.
`card_version`	Yes	Card schema version. REQUIRED by the server-side validator. Current canonical value: `protection/2026-04-26`.
`screen_surfaces`	No	Which traffic surfaces are screened. Omit to accept the composed defaults.
`trusted_sources`	No	Sources exempt from screening. Enumerate specific hosts — wildcards are rejected, and a server-side deny-list (public LLM/DNS endpoints, 0.0.0.0/0, ::/0, link-local, multicast) is always applied.
`protected_surface`	No	The assets and operations this agent must protect. Omit to accept the composed default (empty surface).

Output Schema

ParametersJSON Schema

Name	Required	Description
`ok`	Yes	Always true on successful storage (errors return non-200 status).
`card_id`	Yes	Card ID (pc-{uuid}) of the stored protection card.
`issued_at`	Yes	ISO 8601 timestamp when the card was issued/stored.

TDQS

A3.9/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds meaningful behavioral context beyond annotations: it specifies accepted input formats (YAML/JSON), requires the full UnifiedProtectionCard, explains the server-side merge across platform→org→team→agent cascade, and mentions the Idempotency-Key requirement. This complements the annotations (destructiveHint, idempotentHint) without contradicting them, though the truncated ending leaves some details unstated.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single dense sentence that front-loads the core action ('Publish or replace') and then efficiently packs key details: formats, body requirement, composition behavior, and idempotency requirement. It is appropriately concise for the complexity, though the truncated 'Hon...' leaves an incomplete thought and the sentence is slightly overloaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the high complexity (7 parameters, nested objects, output schema), the description covers essential aspects: purpose, input format, body structure, composition semantics, and idempotency requirement. The output schema handles return-value documentation. Missing details like error cases or permission requirements are not expected at this level, but a bit more explicit guidance on usage vs alternatives would strengthen it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds high-level context (body is the full card, composed server-side), but does not detail individual parameters beyond what the schema already provides. It adequately reinforces the 'full card' notion but does not deeply enhance parameter-level understanding.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb+resource pair ('Publish or replace the protection manifest') and clearly distinguishes itself from sibling tools like preview_compose_protection_by_agent (which previews instead of writing) and put_alignment_by_agent (which handles alignment, not protection). It also explains the composition cascade, making the tool's responsibility unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use it: it is the write path for protection cards, as opposed to preview_* siblings. However, it does not explicitly state 'use this instead of preview' or list any exclusions or alternative conditions. The guidance is inferred from tool names and the description's wording, not explicitly stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

report_recipe_fn_fpAInspect

Submit a false-positive / false-negative correction for one of Mnemom's automated detection rules (a 'recipe') — technical feedback that improves detection accuracy, like filing a bug report against a spam filter.

ParametersJSON Schema

Name	Required	Description
`type`	Yes	`fn` = false negative (the recipe should have fired). `fp` = false positive (it fired on legitimate behaviour).
`summary`	Yes	A short description of what the recipe got wrong — what it flagged, or what it missed, and why that was incorrect. DESCRIBE the misfire; do NOT paste the conversation, the prompt, the raw payload or the log that triggered it. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization.
`agent_id`	No	Optional. The agent the report concerns. Identifier only.
`recipeId`	Yes	The detection recipe the report is filed against (the one that misfired or failed to fire). Identifier only.
`checkpoint_id`	No	Optional. The related integrity checkpoint, so the reviewer can correlate. Identifier only.

Output Schema

ParametersJSON Schema

Name	Required	Description
`ok`	Yes
`type`	Yes
`candidate_id`	Yes
`related_recipe_id`	Yes

TDQS

A4/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate this is a write operation (readOnlyHint=false) and not idempotent or destructive. The description adds the intended effect of improving detection accuracy but does not disclose side effects such as persistence on a governance card or visibility to the organization; that detail is deferred to the schema's summary parameter description.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence that states the action, target, and purpose without redundancy. Every phrase earns its place, and it is appropriately sized for the tool's complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description, combined with a fully covered input schema and an output schema, provides enough context for an agent to select and invoke the tool. It lacks an explicit 'when not to use' statement or mention of the governance-card storage detail, but those are not required given the structured schema information.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with parameter descriptions already explaining `type`, `summary` constraints, and identifier formats. The main description adds little beyond the domain context of a 'recipe' being an automated detection rule, so it does not need to compensate significantly.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Submit') and a specific resource ('false-positive / false-negative correction for one of Mnemom's automated detection rules (a 'recipe')'). It clearly distinguishes this tool from the sibling list, which contains no other submission/report tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context: this is for submitting technical feedback that improves detection accuracy, analogous to a bug report against a spam filter. It does not name explicit alternatives or exclusions, but no sibling appears to offer a similar reporting function, so the usage context is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scan_trustA

Read-onlyIdempotent

Inspect

Scan a website's agent-trust-readiness and return a signed scorecard (Trust, plus an Access axis on newer rubrics). Zero-auth. Results are CACHED for up to 24h — check cached and scannedAt on the result; pass fresh: true to force a re-scan (rate-limited). Proxies to the SSRF-locked isittrustready scanner; the Ed25519 signature + permalink are preserved verbatim. Rubric + docs: https://www.isittrustready.ai/rubric and https://docs.mnemom.ai/.

ParametersJSON Schema

Name	Required	Description	Default
`url`	Yes	Domain or URL to scan, e.g. "example.com" or "https://example.com".
`fresh`	No	Force a fresh re-scan instead of the cached result (results are cached up to 24h; the engine rate-limits re-scans). Equivalent to the scanner's rescan flag.

Output Schema

ParametersJSON Schema

Name	Required	Description
`grade`	Yes	Trust letter grade (A+…F).
`score`	Yes	0–100 weighted overall TRUST score.
`access`	No	The independent Access/discoverability axis (never blended with Trust). Present from the two-axis rubric (0.3.0+).
`cached`	No	True when served from the scanner's 24h cache rather than a fresh scan.
`schema`	Yes	iitr-scan schema version string (e.g. "iitr-scan/v0.N").
`target`	Yes	Normalized host that was scanned.
`permalink`	No	Shareable /r/ permalink (only on /r/ responses; transport field).
`scannedAt`	No	When this scorecard was produced. Results are cached up to 24h — pass fresh:true to scan_trust to force a re-scan.
`signature`	Yes	Ed25519 signature over the canonical result (transport field; stripped before verify).
`categories`	No	Trust-axis categories with per-category scores + checks.
`verification`	No	Self-describing in-band verification block {alg, kid, jwks, canonicalization} — how to verify this scorecard's signature. Self-describing, so signed-EXCLUDED (stripped before verify).
`rubricVersion`	No	Rubric version (e.g. "0.4.0").

TDQS

A4.7/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (readOnlyHint, idempotentHint, destructiveHint false), the description adds significant behavioral details: results are cached for 24h, the `fresh` parameter bypasses cache but is rate-limited, it proxies to an SSRF-locked scanner, and preserves Ed25519 signature and permalink. There is no contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise with 4-5 sentences, each serving a distinct purpose: core action, caching behavior, forced re-scan, proxy details, and a link to docs. There is no fluff, and the most critical information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the existence of an output schema (not shown), the description does not need to detail return values. It mentions result fields (cached, scannedAt), signature preservation, permalink, and a link to rubric docs. It also covers caching, rate limiting, and zero-auth. This provides a comprehensive understanding of the tool's behavior and output.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with basic descriptions for `url` and `fresh`. The description adds context: `fresh` is 'equivalent to the scanner's rescan flag' and explains caching implications. This adds value beyond the schema, raising the score above baseline 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool scans a website's agent-trust-readiness and returns a signed scorecard, specifying the verb 'scan' and resource 'website's agent-trust-readiness'. This distinguishes it from sibling tools like claim_agent, get_reputation, etc., which focus on agents and reputation rather than website scanning.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context: zero-auth, caching behavior, and the option to force a fresh scan with the `fresh` parameter. It implicitly tells when to use this tool (when you need a trust-readiness scan) but does not explicitly mention when not to use it or name alternatives. The sibling list contains verify_scan, which might be related, but no exclusion is given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_reputation_directoryA

Read-onlyIdempotent

Inspect

Resolve an agent name or id-prefix to a real agent_id over the PUBLIC reputation directory (only agents whose reputation visibility is public). Zero-auth. The arriving-agent entry point: discover a concrete agent_id, then call get_reputation / verify_reputation on it.

ParametersJSON Schema

Name	Required	Description	Default
`q`	No	Name search (ilike) or agent-id prefix match.
`page`	No	1-based page number for pagination. Default 1.
`sort`	No	Result ordering. Default "score" (highest-rated first); other supported keys order by recency or name.	score
`grade`	No	Filter to one grade (e.g. `AAA`, `B`, `NR`).
`per_page`	No	Number of results per page. 1–100, default 20.
`confidence`	No	Filter to agents at a given reputation-confidence level (driven by how much evidence backs the score).

Output Schema

ParametersJSON Schema

Name	Required	Description
`page`	Yes
`total`	Yes
`agents`	Yes
`per_page`	Yes

TDQS

A4.6/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already provide readOnlyHint, idempotentHint, destructiveHint. The description adds key behavioral info: the tool only searches agents with public reputation visibility, requires zero authentication, and returns agent_ids. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with core action, followed by usage guidance. No redundant words. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers purpose, scope (public directory), auth requirement, and next steps. With an output schema present, the description doesn't need to detail return format. Minor gap: does not explicitly state that results are paginated, but schema covers pagination params. Overall good completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

All 6 parameters have descriptions in the schema (100% coverage), so the description adds no new param-level detail. It provides context for the 'q' parameter ('name or id-prefix') but that is already in the schema. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Resolve an agent name or id-prefix to a real agent_id over the PUBLIC reputation directory', using a specific verb and resource. It distinguishes from siblings like get_agent (requires id) and list_agents (different scope), and positions itself as the entry point for discovering agent IDs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly tells when to use this tool: as the entry point to discover a concrete agent_id, then delegate to get_reputation/verify_reputation. It also notes 'zero-auth', setting expectations. This provides clear guidance on alternatives and preconditions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

verify_reputationA

Read-onlyIdempotent

Inspect

Attest an agent's Trust Rating — returns a Merkle-root + hash-chain attestation (hash_chain_valid) proving the rating derives from an unbroken, append-only checkpoint chain, plus a pointer to the signed integrity certificate. This is a chain-integrity attestation, NOT an in-band Ed25519 signature check (that parity is verify_scan, for website scorecards).

ParametersJSON Schema

Name	Required	Description	Default
`agent_id`	Yes	Agent identifier (e.g. smolt-abc123)

Output Schema

ParametersJSON Schema

Name	Required	Description
`grade`	Yes
`score`	Yes
`agent_id`	Yes
`computed_at`	Yes
`verification`	Yes

TDQS

A4.5/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false. The description adds behavioral details: it returns a Merkle-root + hash-chain attestation and a pointer to the integrity certificate. It also clarifies that it does NOT perform an Ed25519 check. No contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the main action and outputs, and contains no superfluous information. Every sentence adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has an output schema, good annotations, and only one parameter, the description fully addresses the return values and behavioral context. It is complete for an AI agent to understand invocation and interpretation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the lone parameter (agent_id) is already described in the schema. The description does not add additional meaning or constraints beyond what is in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Attest' and the resource 'agent's Trust Rating', and distinguishes itself from 'verify_scan' by specifying the type of attestation (chain-integrity vs. Ed25519 signature check). This provides a specific and unambiguous purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly tells when to use this tool (to verify chain integrity) and when not (for Ed25519 check, use verify_scan). This provides clear guidance on tool selection among siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

verify_scanA

Read-onlyIdempotent

Inspect

Verify a website scan scorecard's Ed25519 signature IN-BAND (verify, don't trust). Pass a scan (a scorecard from scan_trust) or a url to re-scan; returns {verified, key_id, canonicalization} checked against the public key at mnemom://iitr/jwks. Zero-auth. Spec + rubric: https://www.isittrustready.ai/rubric and https://docs.mnemom.ai/.

ParametersJSON Schema

Name	Required	Description	Default
`url`	No	Alternatively, a domain/URL to re-scan and then verify.
`scan`	No	A scan scorecard previously returned by scan_trust (or iitr's /r/ JSON), passed back verbatim to verify. Same shape as scan_trust's result; the signature is checked against mnemom://iitr/jwks.

Output Schema

ParametersJSON Schema

Name	Required	Description
`key_id`	Yes	The signing key id (kid) checked.
`reason`	No	Why verification failed or could not be evaluated (absent when verified).
`verified`	Yes	True iff the signature verifies against the in-band JWKS.
`algorithm`	Yes	Always "Ed25519".
`scorecard`	No	The scorecard verified (present when re-scanned via `url`).
`canonicalization`	Yes	The exact canonicalization used (so the verdict is reproducible).

TDQS

A4.3/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare the operation as read-only, idempotent, and non-destructive. The description adds valuable context beyond annotations: 'Zero-auth', the return shape {verified, key_id, canonicalization}, and that verification uses the public key at mnemom://iitr/jwks. This clarifies auth needs and output without contradicting the safety hints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact (two sentences) yet rich with necessary information: purpose, input modes, return shape, key origin, and spec links. Every element earns its place with no redundancy or fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite the tool's complexity (nested scan object, oneOf constraint, output schema), the description covers the essential workflow: how to pass input, what verification is performed, the return value, and where to find detailed specifications. The output schema handles return details, so the description need not repeat them.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema fully documents the two parameters, including their types and relationships (oneOf). The description adds a slight clarification that `url` triggers a re-scan, but the schema already states this. No significant additional parameter semantics are provided beyond the structured fields.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool verifies a website scan scorecard's Ed25519 signature, distinguishing it from scan_trust (which creates the scorecard) and other verify tools (verify_reputation, verify_agent_binding). The phrase 'IN-BAND (verify, don't trust)' adds specific method and intent.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly says to pass either a `scan` from scan_trust or a `url` to re-scan, providing clear input guidance. It does not name specific sibling alternatives or exclusions, but the reference to scan_trust and 'verify, don't trust' implies when to use this tool over blindly accepting a scorecard.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

1 tool updateAug 7, 2026
- Removedverify_agent_binding

1 tool updateAug 5, 2026

Changedclaim_agent3 fields changed

changedInput schema / properties / hash_proof / description

Previous value: -"Agent possession proof: the full 64-hex SHA-256 digest of `${apiKey}|${agentName}` (or `${apiKey}` for an unnamed singleton agent)."New value: +"Agent possession proof — either the live birth token (`mnbt_…`) whose row pins this agent's hash, or the full 64-hex SHA-256 digest of `${apiKey}|${agentName}` (or `${apiKey}` for an unnamed singleton agent)."

addedInput schema / properties / hash_proof / minLength
```
Added value: +16
```
removedInput schema / properties / hash_proof / pattern
```
Removed value: -"^[0-9a-f]{64}$"
```

1 tool updateAug 5, 2026

Changedverify_scan1 field changed

addedInput schema / oneOf

Added value: +[
+  {
+    "not": {
+      "required": [
+        "url"
+      ]
+    },
+    "required": [
+      "scan"
+    ]
+  },
+  {
+    "not": {
+      "required": [
+        "scan"
+      ]
+    },
+    "required": [
+      "url"
+    ]
+  }
+]

7 tool updatesAug 5, 2026

Changedget_agent24 fields changed

removedOutput schema / $defs

Removed value: -{
-  "Agent": {
-    "additionalProperties": true,
-    "description": "An agent. GET /v1/agents/{id} returns one of TWO projections by authorization: an ORGANIZATION-MEMBER (owner) caller receives the full agent row (all fields below); a NON-OWNER receives a reduced public projection (id, name, claimed, created_at, last_seen, status, avatar_url). additionalProperties is left open because the owner row is the full DB row and grows as agent-settings columns are added (ADR-053 / proof / DDR); over-constraining it would 500 the endpoint on the next migration under /v1 response enforcement.",
-    "properties": {
-      "agent_hash": {
-        "description": "First 16 hex chars of `SHA256(apiKey + '|' + agentName)` for named agents, or `SHA256(apiKey)` for unnamed singleton agents. The gateway computes the same value on each request and uses it as the lookup key. See [Agent Identity](https://docs.mnemom.ai/concepts/agent-identity#agent_hash--the-canonical-identity-hash).",
-        "example": "a1b2c3d4e5f6a7b8",
-        "type": "string"
-      },
-      "agent_proof_captured_at": {
-        "format": "date-time",
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "agent_proof_hash": {
-        "description": "Owner projection: captured hash_proof of the bound key (mig 263).",
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "aip_enforcement_mode": {
-        "enum": [
-          "observe",
-          "enforce",
-          "nudge"
-        ],
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "avatar_url": {
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "billing_account_id": {
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "caller": {
-        "description": "Self-describing caller context for THIS response. `org_member` callers receive the full owner record (all fields here); `anonymous`/`authenticated` (non-member) callers receive the reduced public projection (id, name, claimed, created_at, last_seen, status, avatar_url, caller). The differing field set is GOVERNED by this value — read it instead of inferring why a field is absent.",
-        "enum": [
-          "anonymous",
-          "authenticated",
-          "org_member"
-        ],
-        "type": "string"
-      },
-      "claimed": {
-        "description": "Public projection only: whether the agent has been claimed by a user.",
-        "type": "boolean"
-      },
-      "claimed_at": {
-        "format": "date-time",
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "claimed_by": {
-        "description": "Owner projection: user id that claimed the agent.",
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "containment_status": {
-        "description": "Containment state of the agent (ADR-053).",
-        "enum": [
-          "active",
-          "paused",
-          "killed"
-        ],
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "created_at": {
-        "format": "date-time",
-        "type": "string"
-      },
-      "created_by": {
-        "description": "Owner projection: user id that created the agent (provenance).",
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "deleted_at": {
-        "description": "Owner projection: soft-delete timestamp (null when live).",
-        "format": "date-time",
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "email": {
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "groups": {
-        "description": "Active groups this agent belongs to, name-ordered; `[]` when none. Present on org-fleet rows (GET /v1/orgs/{org_id}/agents). Archived groups are excluded.",
-        "items": {
-          "properties": {
-            "color": {
-              "description": "Group color (hex, e.g. `#0d9488`); `null` when unset.",
-              "type": [
-                "string",
-                "null"
-              ]
-            },
-            "id": {
-              "type": "string"
-            },
-            "name": {
-              "type": "string"
-            }
-          },
-          "required": [
-            "id",
-            "name",
-            "color"
-          ],
-          "type": "object"
-        },
-        "type": "array"
-      },
-      "id": {
-        "type": "string"
-      },
-      "key_prefix": {
-        "description": "First 8 chars of the bound API key hash — useful for key-rotation debugging.",
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "last_seen": {
-        "format": "date-time",
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "name": {
-        "description": "Agent name (2-32 chars, alphanumeric + hyphens). Present on all list and get responses.",
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "org_id": {
-        "description": "Owner projection: the agent's org binding (ADR-062 authz boundary).",
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "public": {
-        "description": "Identity-record visibility axis — whether the agent's IDENTITY RECORD is publicly discoverable. This is DISTINCT from reputation visibility: every registered agent's reputation is public by accountability standard (see `ReputationScore.visibility`). `public` here governs only the identity record, never the Trust Rating.",
-        "type": "boolean"
-      },
-      "status": {
-        "enum": [
-          "active",
-          "offline"
-        ],
-        "type": "string"
-      },
-      "user_id": {
-        "type": [
-          "string",
-          "null"
-        ]
-      }
-    },
-    "type": "object"
-  }
-}

changedOutput schema / additionalProperties
```
Previous value: -trueNew value: +false
```

changedOutput schema / description

Previous value: -"An agent. GET /v1/agents/{id} returns one of TWO projections by authorization: an ORGANIZATION-MEMBER (owner) caller receives the full agent row (all fields below); a NON-OWNER receives a reduced public projection (id, name, claimed, created_at, last_seen, status, avatar_url). additionalProperties is left open because the owner row is the full DB row and grows as agent-settings columns are added (ADR-053 / proof / DDR); over-constraining it would 500 the endpoint on the next migration under /v1 response enforcement."New value: +"An agent's identity and trust state, reduced to the fields the trust loop needs. Personal data (owner email address, user identifiers), internal commercial identifiers (billing account) and key-material-derived values (bound-key proof hash, key prefix) are REMOVED at the MCP boundary and are never returned to an MCP client — see the Mnemom privacy policy at https://www.mnemom.ai/privacy. Which fields are present depends on authorization: read `caller` to know which projection you received."

changedOutput schema / properties / agent_hash / description

Previous value: -"First 16 hex chars of `SHA256(apiKey + '|' + agentName)` for named agents, or `SHA256(apiKey)` for unnamed singleton agents. The gateway computes the same value on each request and uses it as the lookup key. See [Agent Identity](https://docs.mnemom.ai/concepts/agent-identity#agent_hash--the-canonical-identity-hash)."New value: +"The canonical public identity hash (first 16 hex chars) used as the gateway lookup key and as the input to verify_agent_binding. Owner projection only. Not a credential and not reversible to one."

removedOutput schema / properties / agent_hash / example
```
Removed value: -"a1b2c3d4e5f6a7b8"
```

removedOutput schema / properties / agent_proof_captured_at

Removed value: -{
-  "format": "date-time",
-  "type": [
-    "string",
-    "null"
-  ]
-}

removedOutput schema / properties / agent_proof_hash

Removed value: -{
-  "description": "Owner projection: captured hash_proof of the bound key (mig 263).",
-  "type": [
-    "string",
-    "null"
-  ]
-}

removedOutput schema / properties / billing_account_id

Removed value: -{
-  "type": [
-    "string",
-    "null"
-  ]
-}

changedOutput schema / properties / caller / description

Previous value: -"Self-describing caller context for THIS response. `org_member` callers receive the full owner record (all fields here); `anonymous`/`authenticated` (non-member) callers receive the reduced public projection (id, name, claimed, created_at, last_seen, status, avatar_url, caller). The differing field set is GOVERNED by this value — read it instead of inferring why a field is absent."New value: +"Which projection THIS response is. `org_member` receives the owner field set; `anonymous`/`authenticated` receive the reduced public set (id, name, claimed, created_at, last_seen, status, avatar_url, caller). Read this instead of inferring why a field is absent."

changedOutput schema / properties / claimed / description

Previous value: -"Public projection only: whether the agent has been claimed by a user."New value: +"Whether a human or organization has claimed accountability for this agent. On the owner projection this is derived from the ownership column; the owning user's identifier itself is not returned."

removedOutput schema / properties / claimed_by

Removed value: -{
-  "description": "Owner projection: user id that claimed the agent.",
-  "type": [
-    "string",
-    "null"
-  ]
-}

changedOutput schema / properties / containment_status / description

Previous value: -"Containment state of the agent (ADR-053)."New value: +"Containment state of the agent."

removedOutput schema / properties / created_by

Removed value: -{
-  "description": "Owner projection: user id that created the agent (provenance).",
-  "type": [
-    "string",
-    "null"
-  ]
-}

removedOutput schema / properties / deleted_at

Removed value: -{
-  "description": "Owner projection: soft-delete timestamp (null when live).",
-  "format": "date-time",
-  "type": [
-    "string",
-    "null"
-  ]
-}

removedOutput schema / properties / email

Removed value: -{
-  "type": [
-    "string",
-    "null"
-  ]
-}

changedOutput schema / properties / groups / description

Previous value: -"Active groups this agent belongs to, name-ordered; `[]` when none. Present on org-fleet rows (GET /v1/orgs/{org_id}/agents). Archived groups are excluded."New value: +"Active groups this agent belongs to, name-ordered; `[]` when none. Present on org-fleet rows."

addedOutput schema / properties / id / description

Added value: +"Agent identifier (e.g. smolt-abc123)."

removedOutput schema / properties / key_prefix

Removed value: -{
-  "description": "First 8 chars of the bound API key hash — useful for key-rotation debugging.",
-  "type": [
-    "string",
-    "null"
-  ]
-}

changedOutput schema / properties / name / description

Previous value: -"Agent name (2-32 chars, alphanumeric + hyphens). Present on all list and get responses."New value: +"Agent name (2-32 chars, alphanumeric + hyphens)."

changedOutput schema / properties / org_id / description

Previous value: -"Owner projection: the agent's org binding (ADR-062 authz boundary)."New value: +"The agent's organization binding. Required as an input by the org-scoped tools (fleet listing, posture assignment). Identifies an organization, not a person."

changedOutput schema / properties / public / description

Previous value: -"Identity-record visibility axis — whether the agent's IDENTITY RECORD is publicly discoverable. This is DISTINCT from reputation visibility: every registered agent's reputation is public by accountability standard (see `ReputationScore.visibility`). `public` here governs only the identity record, never the Trust Rating."New value: +"Whether the agent's identity record is publicly discoverable. Distinct from Trust Rating visibility, which is always public."

addedOutput schema / properties / status / description

Added value: +"Derived from last_seen (active = seen within the last hour)."

removedOutput schema / properties / user_id

Removed value: -{
-  "type": [
-    "string",
-    "null"
-  ]
-}

addedOutput schema / required
```
Added value: +[
+  "id"
+]
```

Changedlist_agents9 fields changed

changedInput schema / properties / limit / description

Previous value: -"Maximum number of agents to return (max 100)"New value: +"How many agents to return, 1-100."

addedInput schema / properties / limit / minimum
```
Added value: +1
```

changedInput schema / properties / offset / description

Previous value: -"Number of agents to skip for pagination"New value: +"How many agents to skip, for pagination."

addedInput schema / properties / offset / maximum
```
Added value: +100000
```
addedInput schema / properties / offset / minimum
```
Added value: +0
```

removedOutput schema / $defs / Agent

Removed value: -{
-  "additionalProperties": true,
-  "description": "An agent. GET /v1/agents/{id} returns one of TWO projections by authorization: an ORGANIZATION-MEMBER (owner) caller receives the full agent row (all fields below); a NON-OWNER receives a reduced public projection (id, name, claimed, created_at, last_seen, status, avatar_url). additionalProperties is left open because the owner row is the full DB row and grows as agent-settings columns are added (ADR-053 / proof / DDR); over-constraining it would 500 the endpoint on the next migration under /v1 response enforcement.",
-  "properties": {
-    "agent_hash": {
-      "description": "First 16 hex chars of `SHA256(apiKey + '|' + agentName)` for named agents, or `SHA256(apiKey)` for unnamed singleton agents. The gateway computes the same value on each request and uses it as the lookup key. See [Agent Identity](https://docs.mnemom.ai/concepts/agent-identity#agent_hash--the-canonical-identity-hash).",
-      "example": "a1b2c3d4e5f6a7b8",
-      "type": "string"
-    },
-    "agent_proof_captured_at": {
-      "format": "date-time",
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "agent_proof_hash": {
-      "description": "Owner projection: captured hash_proof of the bound key (mig 263).",
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "aip_enforcement_mode": {
-      "enum": [
-        "observe",
-        "enforce",
-        "nudge"
-      ],
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "avatar_url": {
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "billing_account_id": {
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "caller": {
-      "description": "Self-describing caller context for THIS response. `org_member` callers receive the full owner record (all fields here); `anonymous`/`authenticated` (non-member) callers receive the reduced public projection (id, name, claimed, created_at, last_seen, status, avatar_url, caller). The differing field set is GOVERNED by this value — read it instead of inferring why a field is absent.",
-      "enum": [
-        "anonymous",
-        "authenticated",
-        "org_member"
-      ],
-      "type": "string"
-    },
-    "claimed": {
-      "description": "Public projection only: whether the agent has been claimed by a user.",
-      "type": "boolean"
-    },
-    "claimed_at": {
-      "format": "date-time",
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "claimed_by": {
-      "description": "Owner projection: user id that claimed the agent.",
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "containment_status": {
-      "description": "Containment state of the agent (ADR-053).",
-      "enum": [
-        "active",
-        "paused",
-        "killed"
-      ],
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "created_at": {
-      "format": "date-time",
-      "type": "string"
-    },
-    "created_by": {
-      "description": "Owner projection: user id that created the agent (provenance).",
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "deleted_at": {
-      "description": "Owner projection: soft-delete timestamp (null when live).",
-      "format": "date-time",
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "email": {
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "groups": {
-      "description": "Active groups this agent belongs to, name-ordered; `[]` when none. Present on org-fleet rows (GET /v1/orgs/{org_id}/agents). Archived groups are excluded.",
-      "items": {
-        "properties": {
-          "color": {
-            "description": "Group color (hex, e.g. `#0d9488`); `null` when unset.",
-            "type": [
-              "string",
-              "null"
-            ]
-          },
-          "id": {
-            "type": "string"
-          },
-          "name": {
-            "type": "string"
-          }
-        },
-        "required": [
-          "id",
-          "name",
-          "color"
-        ],
-        "type": "object"
-      },
-      "type": "array"
-    },
-    "id": {
-      "type": "string"
-    },
-    "key_prefix": {
-      "description": "First 8 chars of the bound API key hash — useful for key-rotation debugging.",
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "last_seen": {
-      "format": "date-time",
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "name": {
-      "description": "Agent name (2-32 chars, alphanumeric + hyphens). Present on all list and get responses.",
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "org_id": {
-      "description": "Owner projection: the agent's org binding (ADR-062 authz boundary).",
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "public": {
-      "description": "Identity-record visibility axis — whether the agent's IDENTITY RECORD is publicly discoverable. This is DISTINCT from reputation visibility: every registered agent's reputation is public by accountability standard (see `ReputationScore.visibility`). `public` here governs only the identity record, never the Trust Rating.",
-      "type": "boolean"
-    },
-    "status": {
-      "enum": [
-        "active",
-        "offline"
-      ],
-      "type": "string"
-    },
-    "user_id": {
-      "type": [
-        "string",
-        "null"
-      ]
-    }
-  },
-  "type": "object"
-}

addedOutput schema / $defs / AgentMcpRecord

Added value: +{
+  "additionalProperties": false,
+  "description": "An agent's identity and trust state, reduced to the fields the trust loop needs. Personal data (owner email address, user identifiers), internal commercial identifiers (billing account) and key-material-derived values (bound-key proof hash, key prefix) are REMOVED at the MCP boundary and are never returned to an MCP client — see the Mnemom privacy policy at https://www.mnemom.ai/privacy. Which fields are present depends on authorization: read `caller` to know which projection you received.",
+  "properties": {
+    "agent_hash": {
+      "description": "The canonical public identity hash (first 16 hex chars) used as the gateway lookup key and as the input to verify_agent_binding. Owner projection only. Not a credential and not reversible to one.",
+      "type": "string"
+    },
+    "aip_enforcement_mode": {
+      "enum": [
+        "observe",
+        "enforce",
+        "nudge"
+      ],
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "avatar_url": {
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "caller": {
+      "description": "Which projection THIS response is. `org_member` receives the owner field set; `anonymous`/`authenticated` receive the reduced public set (id, name, claimed, created_at, last_seen, status, avatar_url, caller). Read this instead of inferring why a field is absent.",
+      "enum": [
+        "anonymous",
+        "authenticated",
+        "org_member"
+      ],
+      "type": "string"
+    },
+    "claimed": {
+      "description": "Whether a human or organization has claimed accountability for this agent. On the owner projection this is derived from the ownership column; the owning user's identifier itself is not returned.",
+      "type": "boolean"
+    },
+    "claimed_at": {
+      "format": "date-time",
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "containment_status": {
+      "description": "Containment state of the agent.",
+      "enum": [
+        "active",
+        "paused",
+        "killed"
+      ],
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "created_at": {
+      "format": "date-time",
+      "type": "string"
+    },
+    "groups": {
+      "description": "Active groups this agent belongs to, name-ordered; `[]` when none. Present on org-fleet rows.",
+      "items": {
+        "properties": {
+          "color": {
+            "description": "Group color (hex, e.g. `#0d9488`); `null` when unset.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "id": {
+            "type": "string"
+          },
+          "name": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "id",
+          "name",
+          "color"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "id": {
+      "description": "Agent identifier (e.g. smolt-abc123).",
+      "type": "string"
+    },
+    "last_seen": {
+      "format": "date-time",
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "name": {
+      "description": "Agent name (2-32 chars, alphanumeric + hyphens).",
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "org_id": {
+      "description": "The agent's organization binding. Required as an input by the org-scoped tools (fleet listing, posture assignment). Identifies an organization, not a person.",
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "public": {
+      "description": "Whether the agent's identity record is publicly discoverable. Distinct from Trust Rating visibility, which is always public.",
+      "type": "boolean"
+    },
+    "status": {
+      "description": "Derived from last_seen (active = seen within the last hour).",
+      "enum": [
+        "active",
+        "offline"
+      ],
+      "type": "string"
+    }
+  },
+  "required": [
+    "id"
+  ],
+  "type": "object"
+}

addedOutput schema / properties / agents / description

Added value: +"The caller's agents, reduced to the MCP trust-loop field set."

changedOutput schema / properties / agents / items / $ref

Previous value: -"#/$defs/Agent"New value: +"#/$defs/AgentMcpRecord"

Changedpreview_compose_alignment_by_agent34 fields changed

removedInput schema / $defs

Removed value: -{
-  "CompositionMetadata": {
-    "description": "System-managed block describing which scope sources merged into the canonical card. Only returned when `?include_composition=true`.",
-    "properties": {
-      "canonical_id": {
-        "type": "string"
-      },
-      "composed_at": {
-        "format": "date-time",
-        "type": "string"
-      },
-      "exemptions_applied": {
-        "items": {
-          "type": "string"
-        },
-        "type": "array"
-      },
-      "scopes_applied": {
-        "items": {
-          "properties": {
-            "card_id": {
-              "type": "string"
-            },
-            "scope": {
-              "description": "`platform`, `org:<id>`, or `agent:<id>`.",
-              "type": "string"
-            },
-            "template_version": {
-              "type": "integer"
-            },
-            "version": {
-              "type": "integer"
-            }
-          },
-          "type": "object"
-        },
-        "type": "array"
-      },
-      "source_card_id": {
-        "type": "string"
-      },
-      "source_policy_id": {
-        "type": "string"
-      }
-    },
-    "type": "object"
-  },
-  "UnifiedAlignmentCard": {
-    "description": "Unified alignment card (ADR-008/ADR-039). Authored in YAML or JSON; composed server-side with platform defaults, org template, and active exemptions before storage. This schema matches the runtime validator at src/composition/validate.ts EXACTLY — a card authored strictly to it passes `PUT /v1/agents/{id}/alignment-card` and the preview-compose endpoint. Output-only fields (card_id, issued_at, expires_at, _composition, content_hash, version) are server-assigned and must NOT be sent on a PUT.",
-    "properties": {
-      "_composition": {
-        "$ref": "#/$defs/CompositionMetadata"
-      },
-      "agent_id": {
-        "description": "Target agent id. On PUT, server overwrites to match the URL path.",
-        "type": "string"
-      },
-      "audit": {
-        "allOf": [
-          {
-            "if": {
-              "properties": {
-                "queryable": {
-                  "const": true
-                }
-              },
-              "required": [
-                "queryable"
-              ]
-            },
-            "then": {
-              "required": [
-                "query_endpoint"
-              ]
-            }
-          }
-        ],
-        "properties": {
-          "query_endpoint": {
-            "description": "Required when audit.queryable is true.",
-            "type": "string"
-          },
-          "queryable": {
-            "type": "boolean"
-          },
-          "retention_days": {
-            "minimum": 0,
-            "type": "integer"
-          },
-          "storage": {
-            "properties": {
-              "location": {
-                "type": "string"
-              },
-              "type": {
-                "enum": [
-                  "local",
-                  "remote",
-                  "distributed"
-                ],
-                "type": "string"
-              }
-            },
-            "type": "object"
-          },
-          "tamper_evidence": {
-            "enum": [
-              "append_only",
-              "signed",
-              "merkle",
-              null
-            ],
-            "type": [
-              "string",
-              "null"
-            ]
-          },
-          "trace_format": {
-            "type": "string"
-          }
-        },
-        "required": [
-          "retention_days",
-          "queryable"
-        ],
-        "type": "object"
-      },
-      "autonomy": {
-        "properties": {
-          "bounded_actions": {
-            "items": {
-              "type": "string"
-            },
-            "minItems": 1,
-            "type": "array"
-          },
-          "escalation_triggers": {
-            "items": {
-              "properties": {
-                "action": {
-                  "enum": [
-                    "escalate",
-                    "deny",
-                    "log"
-                  ],
-                  "type": "string"
-                },
-                "condition": {
-                  "type": "string"
-                },
-                "reason": {
-                  "type": "string"
-                }
-              },
-              "required": [
-                "condition",
-                "action",
-                "reason"
-              ],
-              "type": "object"
-            },
-            "type": "array"
-          },
-          "forbidden_actions": {
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "max_autonomous_value": {
-            "properties": {
-              "amount": {
-                "type": "number"
-              },
-              "currency": {
-                "type": "string"
-              }
-            },
-            "type": "object"
-          }
-        },
-        "required": [
-          "bounded_actions"
-        ],
-        "type": "object"
-      },
-      "autonomy_mode": {
-        "description": "ADR-039 master switch for the action-policing pipeline (autonomy constraints). Required at the top level post-cutover; the legacy `enforcement.mode` location is rejected.",
-        "enum": [
-          "off",
-          "observe",
-          "nudge",
-          "enforce"
-        ],
-        "type": "string"
-      },
-      "capabilities": {
-        "additionalProperties": {
-          "properties": {
-            "description": {
-              "type": "string"
-            },
-            "required_actions": {
-              "items": {
-                "type": "string"
-              },
-              "type": "array"
-            },
-            "tools": {
-              "items": {
-                "type": "string"
-              },
-              "type": "array"
-            }
-          },
-          "type": "object"
-        },
-        "type": "object"
-      },
-      "card_id": {
-        "description": "Card row id. Server-assigned on PUT (`ac-{uuid}`).",
-        "type": "string"
-      },
-      "card_version": {
-        "description": "Card schema version (required, non-empty). Current canonical value: `unified/2026-04-26`.",
-        "minLength": 1,
-        "type": "string"
-      },
-      "conscience": {
-        "properties": {
-          "mode": {
-            "enum": [
-              "augment",
-              "replace"
-            ],
-            "type": "string"
-          },
-          "values": {
-            "items": {
-              "properties": {
-                "content": {
-                  "type": "string"
-                },
-                "id": {
-                  "type": "string"
-                },
-                "severity": {
-                  "enum": [
-                    "advisory",
-                    "mandatory"
-                  ],
-                  "type": "string"
-                },
-                "type": {
-                  "enum": [
-                    "BOUNDARY",
-                    "FEAR",
-                    "COMMITMENT",
-                    "BELIEF",
-                    "HOPE"
-                  ],
-                  "type": "string"
-                }
-              },
-              "required": [
-                "type",
-                "content"
-              ],
-              "type": "object"
-            },
-            "type": "array"
-          }
-        },
-        "required": [
-          "mode",
-          "values"
-        ],
-        "type": "object"
-      },
-      "content_hash": {
-        "description": "Response-only: content hash of the composed card (`sha256:<hex>`), injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-        "type": "string"
-      },
-      "enforcement": {
-        "description": "Optional ADR-039 Decision-3 user-facing knobs for unmapped-tool handling. The legacy `mode`, `unmapped_tool_action` and `fail_open` keys are REJECTED by the validator (mode → top-level autonomy_mode; fail_open → gateway env config).",
-        "properties": {
-          "allow_unmapped_tools": {
-            "description": "When true, tools not mapped to a capability are allowed by default.",
-            "type": "boolean"
-          },
-          "default_unmapped_severity": {
-            "description": "Severity assigned to an unmapped tool when allow_unmapped_tools is false.",
-            "enum": [
-              "low",
-              "medium",
-              "high",
-              "critical"
-            ],
-            "type": "string"
-          },
-          "forbidden_tools": {
-            "items": {
-              "properties": {
-                "pattern": {
-                  "type": "string"
-                },
-                "reason": {
-                  "type": "string"
-                },
-                "severity": {
-                  "enum": [
-                    "critical",
-                    "high",
-                    "medium",
-                    "low"
-                  ],
-                  "type": "string"
-                }
-              },
-              "required": [
-                "pattern",
-                "reason",
-                "severity"
-              ],
-              "type": "object"
-            },
-            "type": "array"
-          },
-          "grace_period_hours": {
-            "type": "integer"
-          }
-        },
-        "type": "object"
-      },
-      "expires_at": {
-        "format": "date-time",
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "extensions": {
-        "additionalProperties": true,
-        "type": "object"
-      },
-      "integrity_mode": {
-        "description": "ADR-039 master switch for the values/conscience pipeline (integrity constraints). Required at the top level post-cutover; the legacy `integrity.enforcement_mode` location is rejected.",
-        "enum": [
-          "off",
-          "observe",
-          "nudge",
-          "enforce"
-        ],
-        "type": "string"
-      },
-      "issued_at": {
-        "format": "date-time",
-        "type": "string"
-      },
-      "principal": {
-        "allOf": [
-          {
-            "if": {
-              "properties": {
-                "type": {
-                  "not": {
-                    "const": "unspecified"
-                  }
-                }
-              }
-            },
-            "then": {
-              "required": [
-                "identifier"
-              ]
-            }
-          }
-        ],
-        "description": "Required object describing whose authority the agent acts under (ADR-039 Decision 10).",
-        "properties": {
-          "escalation_contact": {
-            "type": "string"
-          },
-          "identifier": {
-            "description": "Required (non-empty) when principal.type is not `unspecified`; identifies the human / organization / agent.",
-            "minLength": 1,
-            "type": "string"
-          },
-          "relationship": {
-            "enum": [
-              "delegated_authority",
-              "advisory",
-              "autonomous"
-            ],
-            "type": "string"
-          },
-          "type": {
-            "enum": [
-              "human",
-              "organization",
-              "agent",
-              "unspecified"
-            ],
-            "type": "string"
-          }
-        },
-        "required": [
-          "type",
-          "relationship"
-        ],
-        "type": "object"
-      },
-      "values": {
-        "properties": {
-          "conflicts_with": {
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "declared": {
-            "description": "Ordered list of declared values. Phase 1 cards-as-primitive: each entry is either a catalog-v1 ID string (e.g. `'accuracy'`) or a parameterized map carrying optional `intensity` / `domain` / `severity_on_violation` / `scope` (e.g. `{id: 'accuracy', domain: 'financial', severity_on_violation: 'critical'}`).",
-            "items": {
-              "oneOf": [
-                {
-                  "minLength": 1,
-                  "type": "string"
-                },
-                {
-                  "additionalProperties": {
-                    "type": "string"
-                  },
-                  "properties": {
-                    "id": {
-                      "minLength": 1,
-                      "type": "string"
-                    }
-                  },
-                  "required": [
-                    "id"
-                  ],
-                  "type": "object"
-                }
-              ]
-            },
-            "minItems": 1,
-            "type": "array"
-          },
-          "definitions": {
-            "additionalProperties": {
-              "properties": {
-                "description": {
-                  "type": "string"
-                },
-                "priority": {
-                  "type": "integer"
-                }
-              },
-              "type": "object"
-            },
-            "type": "object"
-          },
-          "hierarchy": {
-            "enum": [
-              "lexicographic",
-              "weighted",
-              "contextual"
-            ],
-            "type": "string"
-          }
-        },
-        "required": [
-          "declared"
-        ],
-        "type": "object"
-      },
-      "version": {
-        "description": "Response-only: monotonic card version, injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-        "type": "integer"
-      }
-    },
-    "required": [
-      "card_version",
-      "agent_id",
-      "autonomy_mode",
-      "integrity_mode",
-      "principal",
-      "values",
-      "autonomy",
-      "audit"
-    ],
-    "type": "object"
-  }
-}

changedInput schema / properties / agent_id / description

Previous value: -"Agent identifier (e.g. smolt-abc123)"New value: +"The agent this card belongs to (e.g. `smolt-abc123`). Identifier only — never place an API key, a secret, an email address, or any other personal data in this field."

addedInput schema / properties / agent_id / maxLength
```
Added value: +64
```
addedInput schema / properties / agent_id / minLength
```
Added value: +3
```

addedInput schema / properties / agent_id / pattern

Added value: +"^[A-Za-z0-9][A-Za-z0-9_-]{1,62}[A-Za-z0-9]$"

addedInput schema / properties / audit

Added value: +{
+  "additionalProperties": false,
+  "description": "How long this agent's own decision log is kept, and whether it can be queried. Required. (This is the agent's audit policy — it is NOT Mnemom's retention policy for the card itself; see the tool's data-handling disclosure for that.)",
+  "properties": {
+    "query_endpoint": {
+      "description": "HTTPS endpoint the records can be queried from. REQUIRED when `queryable` is true, and ignored when it is false.",
+      "maxLength": 300,
+      "type": "string"
+    },
+    "queryable": {
+      "default": false,
+      "description": "Whether those retained records can be queried. Leave false unless you also supply `query_endpoint` — the server rejects a queryable audit policy with no endpoint.",
+      "type": "boolean"
+    },
+    "retention_days": {
+      "description": "How many days the agent's decision records are retained. 0 means do not retain. 3650 (10 years) maximum.",
+      "maximum": 3650,
+      "minimum": 0,
+      "type": "integer"
+    },
+    "tamper_evidence": {
+      "description": "Tamper-evidence scheme applied to the retained records.",
+      "enum": [
+        "append_only",
+        "signed",
+        "merkle"
+      ],
+      "type": "string"
+    }
+  },
+  "required": [
+    "retention_days",
+    "queryable"
+  ],
+  "type": "object"
+}

addedInput schema / properties / autonomy

Added value: +{
+  "additionalProperties": false,
+  "description": "What the agent may do on its own authority. Required.",
+  "properties": {
+    "bounded_actions": {
+      "description": "Action names the agent may take within its bounds — e.g. [\"send_email\", \"create_ticket\"]. At least one required. Action identifiers only, not descriptions.",
+      "items": {
+        "maxLength": 128,
+        "minLength": 1,
+        "type": "string"
+      },
+      "maxItems": 64,
+      "minItems": 1,
+      "type": "array"
+    },
+    "escalation_triggers": {
+      "description": "Conditions that route to a human instead of acting.",
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "action": {
+            "description": "What to do when the condition holds.",
+            "enum": [
+              "escalate",
+              "deny",
+              "log"
+            ],
+            "type": "string"
+          },
+          "condition": {
+            "description": "The condition, as a short expression or slug (e.g. \"amount > 1000\"). Short condition only — never paste a conversation, a log excerpt, or a record about a person. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization.",
+            "maxLength": 200,
+            "minLength": 1,
+            "type": "string"
+          },
+          "reason": {
+            "description": "Why this trigger exists, in one short sentence. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization.",
+            "maxLength": 200,
+            "minLength": 1,
+            "type": "string"
+          }
+        },
+        "required": [
+          "condition",
+          "action",
+          "reason"
+        ],
+        "type": "object"
+      },
+      "maxItems": 32,
+      "type": "array"
+    },
+    "forbidden_actions": {
+      "description": "Action names the agent must never take. Must be disjoint from `bounded_actions`.",
+      "items": {
+        "maxLength": 128,
+        "minLength": 1,
+        "type": "string"
+      },
+      "maxItems": 64,
+      "type": "array"
+    }
+  },
+  "required": [
+    "bounded_actions"
+  ],
+  "type": "object"
+}

addedInput schema / properties / autonomy_mode

Added value: +{
+  "description": "Master switch for the action-policing pipeline. Required. `off` disables it; `observe` records only; `nudge` warns; `enforce` blocks.",
+  "enum": [
+    "off",
+    "observe",
+    "nudge",
+    "enforce"
+  ],
+  "type": "string"
+}

removedInput schema / properties / body

Removed value: -{
-  "description": "Unified alignment card (ADR-008/ADR-039). Authored in YAML or JSON; composed server-side with platform defaults, org template, and active exemptions before storage. This schema matches the runtime validator at src/composition/validate.ts EXACTLY — a card authored strictly to it passes `PUT /v1/agents/{id}/alignment-card` and the preview-compose endpoint. Output-only fields (card_id, issued_at, expires_at, _composition, content_hash, version) are server-assigned and must NOT be sent on a PUT.",
-  "properties": {
-    "_composition": {
-      "$ref": "#/$defs/CompositionMetadata"
-    },
-    "agent_id": {
-      "description": "Target agent id. On PUT, server overwrites to match the URL path.",
-      "type": "string"
-    },
-    "audit": {
-      "allOf": [
-        {
-          "if": {
-            "properties": {
-              "queryable": {
-                "const": true
-              }
-            },
-            "required": [
-              "queryable"
-            ]
-          },
-          "then": {
-            "required": [
-              "query_endpoint"
-            ]
-          }
-        }
-      ],
-      "properties": {
-        "query_endpoint": {
-          "description": "Required when audit.queryable is true.",
-          "type": "string"
-        },
-        "queryable": {
-          "type": "boolean"
-        },
-        "retention_days": {
-          "minimum": 0,
-          "type": "integer"
-        },
-        "storage": {
-          "properties": {
-            "location": {
-              "type": "string"
-            },
-            "type": {
-              "enum": [
-                "local",
-                "remote",
-                "distributed"
-              ],
-              "type": "string"
-            }
-          },
-          "type": "object"
-        },
-        "tamper_evidence": {
-          "enum": [
-            "append_only",
-            "signed",
-            "merkle",
-            null
-          ],
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "trace_format": {
-          "type": "string"
-        }
-      },
-      "required": [
-        "retention_days",
-        "queryable"
-      ],
-      "type": "object"
-    },
-    "autonomy": {
-      "properties": {
-        "bounded_actions": {
-          "items": {
-            "type": "string"
-          },
-          "minItems": 1,
-          "type": "array"
-        },
-        "escalation_triggers": {
-          "items": {
-            "properties": {
-              "action": {
-                "enum": [
-                  "escalate",
-                  "deny",
-                  "log"
-                ],
-                "type": "string"
-              },
-              "condition": {
-                "type": "string"
-              },
-              "reason": {
-                "type": "string"
-              }
-            },
-            "required": [
-              "condition",
-              "action",
-              "reason"
-            ],
-            "type": "object"
-          },
-          "type": "array"
-        },
-        "forbidden_actions": {
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "max_autonomous_value": {
-          "properties": {
-            "amount": {
-              "type": "number"
-            },
-            "currency": {
-              "type": "string"
-            }
-          },
-          "type": "object"
-        }
-      },
-      "required": [
-        "bounded_actions"
-      ],
-      "type": "object"
-    },
-    "autonomy_mode": {
-      "description": "ADR-039 master switch for the action-policing pipeline (autonomy constraints). Required at the top level post-cutover; the legacy `enforcement.mode` location is rejected.",
-      "enum": [
-        "off",
-        "observe",
-        "nudge",
-        "enforce"
-      ],
-      "type": "string"
-    },
-    "capabilities": {
-      "additionalProperties": {
-        "properties": {
-          "description": {
-            "type": "string"
-          },
-          "required_actions": {
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "tools": {
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          }
-        },
-        "type": "object"
-      },
-      "type": "object"
-    },
-    "card_id": {
-      "description": "Card row id. Server-assigned on PUT (`ac-{uuid}`).",
-      "type": "string"
-    },
-    "card_version": {
-      "description": "Card schema version (required, non-empty). Current canonical value: `unified/2026-04-26`.",
-      "minLength": 1,
-      "type": "string"
-    },
-    "conscience": {
-      "properties": {
-        "mode": {
-          "enum": [
-            "augment",
-            "replace"
-          ],
-          "type": "string"
-        },
-        "values": {
-          "items": {
-            "properties": {
-              "content": {
-                "type": "string"
-              },
-              "id": {
-                "type": "string"
-              },
-              "severity": {
-                "enum": [
-                  "advisory",
-                  "mandatory"
-                ],
-                "type": "string"
-              },
-              "type": {
-                "enum": [
-                  "BOUNDARY",
-                  "FEAR",
-                  "COMMITMENT",
-                  "BELIEF",
-                  "HOPE"
-                ],
-                "type": "string"
-              }
-            },
-            "required": [
-              "type",
-              "content"
-            ],
-            "type": "object"
-          },
-          "type": "array"
-        }
-      },
-      "required": [
-        "mode",
-        "values"
-      ],
-      "type": "object"
-    },
-    "content_hash": {
-      "description": "Response-only: content hash of the composed card (`sha256:<hex>`), injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-      "type": "string"
-    },
-    "enforcement": {
-      "description": "Optional ADR-039 Decision-3 user-facing knobs for unmapped-tool handling. The legacy `mode`, `unmapped_tool_action` and `fail_open` keys are REJECTED by the validator (mode → top-level autonomy_mode; fail_open → gateway env config).",
-      "properties": {
-        "allow_unmapped_tools": {
-          "description": "When true, tools not mapped to a capability are allowed by default.",
-          "type": "boolean"
-        },
-        "default_unmapped_severity": {
-          "description": "Severity assigned to an unmapped tool when allow_unmapped_tools is false.",
-          "enum": [
-            "low",
-            "medium",
-            "high",
-            "critical"
-          ],
-          "type": "string"
-        },
-        "forbidden_tools": {
-          "items": {
-            "properties": {
-              "pattern": {
-                "type": "string"
-              },
-              "reason": {
-                "type": "string"
-              },
-              "severity": {
-                "enum": [
-                  "critical",
-                  "high",
-                  "medium",
-                  "low"
-                ],
-                "type": "string"
-              }
-            },
-            "required": [
-              "pattern",
-              "reason",
-              "severity"
-            ],
-            "type": "object"
-          },
-          "type": "array"
-        },
-        "grace_period_hours": {
-          "type": "integer"
-        }
-      },
-      "type": "object"
-    },
-    "expires_at": {
-      "format": "date-time",
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "extensions": {
-      "additionalProperties": true,
-      "type": "object"
-    },
-    "integrity_mode": {
-      "description": "ADR-039 master switch for the values/conscience pipeline (integrity constraints). Required at the top level post-cutover; the legacy `integrity.enforcement_mode` location is rejected.",
-      "enum": [
-        "off",
-        "observe",
-        "nudge",
-        "enforce"
-      ],
-      "type": "string"
-    },
-    "issued_at": {
-      "format": "date-time",
-      "type": "string"
-    },
-    "principal": {
-      "allOf": [
-        {
-          "if": {
-            "properties": {
-              "type": {
-                "not": {
-                  "const": "unspecified"
-                }
-              }
-            }
-          },
-          "then": {
-            "required": [
-              "identifier"
-            ]
-          }
-        }
-      ],
-      "description": "Required object describing whose authority the agent acts under (ADR-039 Decision 10).",
-      "properties": {
-        "escalation_contact": {
-          "type": "string"
-        },
-        "identifier": {
-          "description": "Required (non-empty) when principal.type is not `unspecified`; identifies the human / organization / agent.",
-          "minLength": 1,
-          "type": "string"
-        },
-        "relationship": {
-          "enum": [
-            "delegated_authority",
-            "advisory",
-            "autonomous"
-          ],
-          "type": "string"
-        },
-        "type": {
-          "enum": [
-            "human",
-            "organization",
-            "agent",
-            "unspecified"
-          ],
-          "type": "string"
-        }
-      },
-      "required": [
-        "type",
-        "relationship"
-      ],
-      "type": "object"
-    },
-    "values": {
-      "properties": {
-        "conflicts_with": {
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "declared": {
-          "description": "Ordered list of declared values. Phase 1 cards-as-primitive: each entry is either a catalog-v1 ID string (e.g. `'accuracy'`) or a parameterized map carrying optional `intensity` / `domain` / `severity_on_violation` / `scope` (e.g. `{id: 'accuracy', domain: 'financial', severity_on_violation: 'critical'}`).",
-          "items": {
-            "oneOf": [
-              {
-                "minLength": 1,
-                "type": "string"
-              },
-              {
-                "additionalProperties": {
-                  "type": "string"
-                },
-                "properties": {
-                  "id": {
-                    "minLength": 1,
-                    "type": "string"
-                  }
-                },
-                "required": [
-                  "id"
-                ],
-                "type": "object"
-              }
-            ]
-          },
-          "minItems": 1,
-          "type": "array"
-        },
-        "definitions": {
-          "additionalProperties": {
-            "properties": {
-              "description": {
-                "type": "string"
-              },
-              "priority": {
-                "type": "integer"
-              }
-            },
-            "type": "object"
-          },
-          "type": "object"
-        },
-        "hierarchy": {
-          "enum": [
-            "lexicographic",
-            "weighted",
-            "contextual"
-          ],
-          "type": "string"
-        }
-      },
-      "required": [
-        "declared"
-      ],
-      "type": "object"
-    },
-    "version": {
-      "description": "Response-only: monotonic card version, injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-      "type": "integer"
-    }
-  },
-  "required": [
-    "card_version",
-    "agent_id",
-    "autonomy_mode",
-    "integrity_mode",
-    "principal",
-    "values",
-    "autonomy",
-    "audit"
-  ],
-  "type": "object"
-}

addedInput schema / properties / card_version

Added value: +{
+  "description": "Card schema version. REQUIRED by the server-side validator. Current canonical value: `unified/2026-04-26`.",
+  "maxLength": 40,
+  "minLength": 3,
+  "pattern": "^[A-Za-z0-9][A-Za-z0-9._/-]{1,38}[A-Za-z0-9]$",
+  "type": "string"
+}

addedInput schema / properties / integrity_mode

Added value: +{
+  "description": "Master switch for the values pipeline. Required. Same four states as `autonomy_mode`.",
+  "enum": [
+    "off",
+    "observe",
+    "nudge",
+    "enforce"
+  ],
+  "type": "string"
+}

addedInput schema / properties / principal

Added value: +{
+  "additionalProperties": false,
+  "description": "Whose authority this agent acts under. Required.",
+  "properties": {
+    "escalation_contact": {
+      "description": "Where an escalation is routed. Use a ROLE ALIAS or SHARED INBOX (\"oncall-sre\", \"security@example.com\"), never an individual's personal contact details. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization.",
+      "maxLength": 128,
+      "minLength": 1,
+      "type": "string"
+    },
+    "identifier": {
+      "description": "Who the principal is. Use a ROLE or ORGANIZATION name (\"support-team\", \"Acme Corp Finance\"), NOT an individual's name, email address or phone number. Pass \"unspecified\" if there is no named principal. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization.",
+      "maxLength": 128,
+      "minLength": 1,
+      "type": "string"
+    },
+    "relationship": {
+      "description": "How the agent relates to that principal.",
+      "enum": [
+        "delegated_authority",
+        "advisory",
+        "autonomous"
+      ],
+      "type": "string"
+    },
+    "type": {
+      "description": "The kind of principal the agent answers to.",
+      "enum": [
+        "human",
+        "organization",
+        "agent",
+        "unspecified"
+      ],
+      "type": "string"
+    }
+  },
+  "required": [
+    "type",
+    "relationship",
+    "identifier"
+  ],
+  "type": "object"
+}

addedInput schema / properties / values

Added value: +{
+  "additionalProperties": false,
+  "description": "The values this agent declares it is bound by. Required.",
+  "properties": {
+    "declared": {
+      "description": "Value catalog IDs — e.g. [\"honesty\", \"no_harm\", \"privacy\"]. At least one required, 32 maximum. Short catalog slugs ONLY, never prose and never personal data. (Parameterized value references and long-form value definitions are available on the /v1 REST + CLI path; they are deliberately not exposed here.)",
+      "items": {
+        "maxLength": 64,
+        "minLength": 1,
+        "type": "string"
+      },
+      "maxItems": 32,
+      "minItems": 1,
+      "type": "array"
+    }
+  },
+  "required": [
+    "declared"
+  ],
+  "type": "object"
+}

changedInput schema / required

Previous value: -[
-  "agent_id"
-]New value: +[
+  "agent_id",
+  "card_version",
+  "autonomy_mode",
+  "integrity_mode",
+  "principal",
+  "values",
+  "autonomy",
+  "audit"
+]

removedOutput schema / properties / coherence_violations

Removed value: -{
-  "additionalProperties": false,
-  "properties": {
-    "by_severity": {
-      "additionalProperties": {
-        "type": "integer"
-      },
-      "type": "object"
-    },
-    "items": {
-      "items": {
-        "additionalProperties": false,
-        "properties": {
-          "field": {},
-          "message": {},
-          "rule": {},
-          "severity": {}
-        },
-        "type": "object"
-      },
-      "type": "array"
-    },
-    "not_shown": {
-      "type": "integer"
-    },
-    "total": {
-      "type": "integer"
-    }
-  },
-  "required": [
-    "total",
-    "by_severity",
-    "items"
-  ],
-  "type": "object"
-}

addedOutput schema / properties / composition_valid

Added value: +{
+  "description": "True when the composed card is coherence-valid.",
+  "type": "boolean"
+}

removedOutput schema / properties / conflicts

Removed value: -{
-  "additionalProperties": false,
-  "properties": {
-    "by_reason": {
-      "additionalProperties": {
-        "type": "integer"
-      },
-      "type": "object"
-    },
-    "not_shown": {
-      "description": "Conflicts beyond the inline top-N (present only when > top-N).",
-      "type": "integer"
-    },
-    "overrides": {
-      "items": {
-        "additionalProperties": false,
-        "properties": {
-          "field": {},
-          "from": {},
-          "reason": {},
-          "to": {},
-          "won_by": {}
-        },
-        "type": "object"
-      },
-      "type": "array"
-    },
-    "total": {
-      "type": "integer"
-    }
-  },
-  "required": [
-    "total",
-    "by_reason",
-    "overrides"
-  ],
-  "type": "object"
-}

addedOutput schema / properties / conflicts_count

Added value: +{
+  "description": "Total number of conflicts detected (0 = none).",
+  "type": "integer"
+}

removedOutput schema / properties / effective

Removed value: -{
-  "additionalProperties": false,
-  "properties": {
-    "autonomy_mode": {
-      "type": "string"
-    },
-    "capabilities_count": {
-      "type": "integer"
-    },
-    "conscience_value_count": {
-      "type": "integer"
-    },
-    "forbidden_actions_count": {
-      "type": "integer"
-    },
-    "integrity_mode": {
-      "type": "string"
-    },
-    "principal_type": {
-      "type": "string"
-    },
-    "values_declared_count": {
-      "type": "integer"
-    }
-  },
-  "required": [
-    "values_declared_count",
-    "conscience_value_count",
-    "forbidden_actions_count",
-    "capabilities_count"
-  ],
-  "type": "object"
-}

removedOutput schema / properties / full_report / additionalProperties
```
Removed value: -false
```

addedOutput schema / properties / full_report / description

Added value: +"Optional pointer to the full /v1 conflict report (method + path)."

addedOutput schema / properties / full_report / oneOf

Added value: +[
+  {
+    "type": "null"
+  },
+  {
+    "additionalProperties": false,
+    "properties": {
+      "method": {
+        "type": "string"
+      },
+      "note": {
+        "type": "string"
+      },
+      "path": {
+        "type": "string"
+      }
+    },
+    "required": [
+      "method",
+      "path",
+      "note"
+    ],
+    "type": "object"
+  }
+]

removedOutput schema / properties / full_report / properties

Removed value: -{
-  "method": {
-    "type": "string"
-  },
-  "note": {
-    "type": "string"
-  },
-  "path": {
-    "type": "string"
-  }
-}

removedOutput schema / properties / full_report / required
```
Removed value: -[
-  "method",
-  "path",
-  "note"
-]
```
removedOutput schema / properties / full_report / type
```
Removed value: -"object"
```

addedOutput schema / properties / ok / description

Added value: +"True when composition succeeded (no blocking conflicts)."

addedOutput schema / properties / summary / description

Added value: +"One-line human-readable summary of composition status."

removedOutput schema / properties / summary / enum
```
Removed value: -[
-  true
-]
```

changedOutput schema / properties / summary / type

Previous value: -"boolean"New value: +"string"

removedOutput schema / properties / tool

Removed value: -{
-  "enum": [
-    "preview_compose_alignment_by_agent"
-  ],
-  "type": "string"
-}

removedOutput schema / properties / what_changed
```
Removed value: -{
-  "type": "string"
-}
```
removedOutput schema / properties / what_to_do_next
```
Removed value: -{
-  "type": "string"
-}
```
removedOutput schema / properties / what_would_break
```
Removed value: -{
-  "type": "string"
-}
```

changedOutput schema / required

Previous value: -[
-  "summary",
-  "tool",
-  "ok",
-  "effective",
-  "conflicts",
-  "coherence_violations",
-  "what_changed",
-  "what_would_break",
-  "what_to_do_next",
-  "full_report"
-]New value: +[
+  "ok",
+  "composition_valid",
+  "conflicts_count",
+  "summary"
+]

Changedpreview_compose_protection_by_agent32 fields changed

removedInput schema / $defs

Removed value: -{
-  "CompositionMetadata": {
-    "description": "System-managed block describing which scope sources merged into the canonical card. Only returned when `?include_composition=true`.",
-    "properties": {
-      "canonical_id": {
-        "type": "string"
-      },
-      "composed_at": {
-        "format": "date-time",
-        "type": "string"
-      },
-      "exemptions_applied": {
-        "items": {
-          "type": "string"
-        },
-        "type": "array"
-      },
-      "scopes_applied": {
-        "items": {
-          "properties": {
-            "card_id": {
-              "type": "string"
-            },
-            "scope": {
-              "description": "`platform`, `org:<id>`, or `agent:<id>`.",
-              "type": "string"
-            },
-            "template_version": {
-              "type": "integer"
-            },
-            "version": {
-              "type": "integer"
-            }
-          },
-          "type": "object"
-        },
-        "type": "array"
-      },
-      "source_card_id": {
-        "type": "string"
-      },
-      "source_policy_id": {
-        "type": "string"
-      }
-    },
-    "type": "object"
-  },
-  "UnifiedProtectionCard": {
-    "description": "Unified protection card (ADR-037). Safe House thresholds + trusted-source policy for a single agent. Shape matches src/composition/types.ts::UnifiedProtectionCard (canonical) and what the runtime validator at src/composition/validate.ts accepts. The customer-facing docs at /concepts/protection-card and /specifications/protection-card-schema document this same shape.",
-    "properties": {
-      "_composition": {
-        "$ref": "#/$defs/CompositionMetadata"
-      },
-      "agent_id": {
-        "type": "string"
-      },
-      "card_id": {
-        "type": "string"
-      },
-      "card_version": {
-        "type": "string"
-      },
-      "content_hash": {
-        "description": "Response-only: content hash of the composed card (`sha256:<hex>`), injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-        "type": "string"
-      },
-      "expires_at": {
-        "format": "date-time",
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "extensions": {
-        "additionalProperties": true,
-        "description": "Free-form extension slot for non-canonical fields. Ignored by the composer; preserved on read for tooling that needs an audit-tail metadata bag.",
-        "type": "object"
-      },
-      "issued_at": {
-        "format": "date-time",
-        "type": "string"
-      },
-      "mode": {
-        "description": "Strictest-wins composition: enforce > nudge > observe > off.",
-        "enum": [
-          "off",
-          "observe",
-          "nudge",
-          "enforce"
-        ],
-        "type": "string"
-      },
-      "protected_surface": {
-        "description": "Org-declared protected surface policy (MNE-830). Strengthen-only UNION across platform → org → team → agent: each scope may add entries; none may remove. The composer always emits this block; callers omit it to inherit the composed floor. See ADR-037 §protected_surface.",
-        "properties": {
-          "assets": {
-            "description": "Protected assets. Intrinsic identity = `${kind}:${selector}` (normalized). Composer merges by identity, keeping the strictest entry per scope.",
-            "items": {
-              "properties": {
-                "kind": {
-                  "description": "Asset kind (e.g. `row`, `field`, `resource`, `table`).",
-                  "type": "string"
-                },
-                "label": {
-                  "description": "Human-facing display label (optional).",
-                  "type": "string"
-                },
-                "reason": {
-                  "description": "Why this asset is protected (optional).",
-                  "type": "string"
-                },
-                "selector": {
-                  "description": "Asset selector (e.g. `customer:critical-0000`, `replica_dsn`).",
-                  "type": "string"
-                },
-                "source_scope": {
-                  "description": "Composer-assigned provenance (`platform`, `org:<id>`, `team:<id>`, `agent:<id>`). Server-assigned — do not send on a PUT.",
-                  "type": "string"
-                }
-              },
-              "required": [
-                "kind",
-                "selector"
-              ],
-              "type": "object"
-            },
-            "type": "array"
-          },
-          "escalation_required": {
-            "description": "Operations that require escalation before proceeding. Same intrinsic-identity + union rules as forbidden_operations (minus severity).",
-            "items": {
-              "properties": {
-                "applies_to": {
-                  "description": "Asset identities this escalation applies to. Empty/absent = GLOBAL.",
-                  "items": {
-                    "type": "string"
-                  },
-                  "type": "array"
-                },
-                "pattern": {
-                  "description": "Operation pattern requiring escalation.",
-                  "type": "string"
-                },
-                "reason": {
-                  "description": "Why escalation is required (optional).",
-                  "type": "string"
-                },
-                "source_scope": {
-                  "description": "Composer-assigned provenance. Server-assigned — do not send on a PUT.",
-                  "type": "string"
-                }
-              },
-              "required": [
-                "pattern"
-              ],
-              "type": "object"
-            },
-            "type": "array"
-          },
-          "forbidden_operations": {
-            "description": "Operations that are unconditionally forbidden. Intrinsic identity = normalized `pattern`. Composer unions across scopes; on identity collision, severity → max.",
-            "items": {
-              "properties": {
-                "applies_to": {
-                  "description": "Asset identities (`${kind}:${selector}`) this operation applies to. Empty/absent means GLOBAL.",
-                  "items": {
-                    "type": "string"
-                  },
-                  "type": "array"
-                },
-                "pattern": {
-                  "description": "Operation pattern (e.g. `TRUNCATE`, `unscoped UPDATE/DELETE`, `exfiltrate:pii`).",
-                  "type": "string"
-                },
-                "reason": {
-                  "description": "Why this operation is forbidden (optional).",
-                  "type": "string"
-                },
-                "severity": {
-                  "description": "Severity level. Composer merges to strictest across scopes.",
-                  "enum": [
-                    "low",
-                    "medium",
-                    "high",
-                    "critical"
-                  ],
-                  "type": "string"
-                },
-                "source_scope": {
-                  "description": "Composer-assigned provenance. Server-assigned — do not send on a PUT.",
-                  "type": "string"
-                }
-              },
-              "required": [
-                "pattern"
-              ],
-              "type": "object"
-            },
-            "type": "array"
-          }
-        },
-        "type": "object"
-      },
-      "review": {
-        "description": "Review-hold policy (Safe House Review, Slice 2a — MNE-920 design). gate_on is the minimum verdict band per surface that escalates to a review-hold. Composition is strictest-wins; on_timeout defaults to 'reject' (fail-closed). reviewer.kind 'endpoint' is designed for MNE-1650 and not consumed yet.",
-        "properties": {
-          "enabled": {
-            "type": "boolean"
-          },
-          "gate_on": {
-            "properties": {
-              "incoming": {
-                "enum": [
-                  "off",
-                  "warn",
-                  "quarantine",
-                  "block"
-                ],
-                "type": "string"
-              },
-              "integrity": {
-                "enum": [
-                  "off",
-                  "review_needed",
-                  "boundary_violation"
-                ],
-                "type": "string"
-              },
-              "outgoing": {
-                "enum": [
-                  "off",
-                  "warn",
-                  "quarantine",
-                  "block"
-                ],
-                "type": "string"
-              },
-              "tool_calls": {
-                "enum": [
-                  "off",
-                  "warn",
-                  "quarantine",
-                  "block"
-                ],
-                "type": "string"
-              },
-              "tool_responses": {
-                "enum": [
-                  "off",
-                  "warn",
-                  "quarantine",
-                  "block"
-                ],
-                "type": "string"
-              }
-            },
-            "type": "object"
-          },
-          "notify": {
-            "properties": {
-              "sse": {
-                "type": "boolean"
-              },
-              "webhooks": {
-                "type": "boolean"
-              }
-            },
-            "type": "object"
-          },
-          "on_timeout": {
-            "enum": [
-              "reject",
-              "release"
-            ],
-            "type": "string"
-          },
-          "quarantine_notice": {
-            "maxLength": 2000,
-            "type": "string"
-          },
-          "reviewer": {
-            "properties": {
-              "endpoint_url": {
-                "format": "uri",
-                "type": "string"
-              },
-              "kind": {
-                "enum": [
-                  "builtin_opus",
-                  "endpoint"
-                ],
-                "type": "string"
-              }
-            },
-            "required": [
-              "kind"
-            ],
-            "type": "object"
-          },
-          "sla_seconds": {
-            "minimum": 1,
-            "type": "number"
-          }
-        },
-        "required": [
-          "enabled"
-        ],
-        "type": "object"
-      },
-      "screen_surfaces": {
-        "description": "Which request surfaces Safe House inspects. Composed across scopes by OR-per-field (any scope requiring inspection wins).",
-        "properties": {
-          "incoming": {
-            "description": "The user/principal prompt entering the agent.",
-            "type": "boolean"
-          },
-          "outgoing": {
-            "description": "The agent's response leaving the agent.",
-            "type": "boolean"
-          },
-          "tool_calls": {
-            "description": "Tool-use invocations the agent makes.",
-            "type": "boolean"
-          },
-          "tool_responses": {
-            "description": "Responses to tool calls returning to the agent.",
-            "type": "boolean"
-          }
-        },
-        "required": [
-          "incoming",
-          "outgoing",
-          "tool_calls",
-          "tool_responses"
-        ],
-        "type": "object"
-      },
-      "thresholds": {
-        "description": "Score bands. Must satisfy warn <= quarantine <= block; each value in [0, 1].",
-        "properties": {
-          "block": {
-            "maximum": 1,
-            "minimum": 0,
-            "type": "number"
-          },
-          "quarantine": {
-            "maximum": 1,
-            "minimum": 0,
-            "type": "number"
-          },
-          "warn": {
-            "maximum": 1,
-            "minimum": 0,
-            "type": "number"
-          }
-        },
-        "required": [
-          "warn",
-          "quarantine",
-          "block"
-        ],
-        "type": "object"
-      },
-      "trusted_sources": {
-        "description": "Sources for which detectors short-circuit (each match logged in the trace). Composed as platform->agent intersection (compliance ceiling) with org+agent union inside that ceiling — an agent cannot widen trust beyond what the platform allows.",
-        "properties": {
-          "agent_ids": {
-            "description": "Mnemom agent IDs (mnm-* / smolt-* prefixed).",
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "domains": {
-            "description": "DNS names or host:port entries.",
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "ip_ranges": {
-            "description": "IPv4 or IPv6 CIDR ranges.",
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          }
-        },
-        "required": [
-          "domains",
-          "agent_ids",
-          "ip_ranges"
-        ],
-        "type": "object"
-      },
-      "version": {
-        "description": "Response-only: monotonic card version, injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-        "type": "integer"
-      }
-    },
-    "required": [
-      "card_version",
-      "agent_id",
-      "mode",
-      "thresholds",
-      "screen_surfaces",
-      "trusted_sources"
-    ],
-    "type": "object"
-  }
-}

changedInput schema / properties / agent_id / description

Previous value: -"Agent identifier (e.g. smolt-abc123)"New value: +"The agent this card belongs to (e.g. `smolt-abc123`). Identifier only — never place an API key, a secret, an email address, or any other personal data in this field."

addedInput schema / properties / agent_id / maxLength
```
Added value: +64
```
addedInput schema / properties / agent_id / minLength
```
Added value: +3
```

addedInput schema / properties / agent_id / pattern

Added value: +"^[A-Za-z0-9][A-Za-z0-9_-]{1,62}[A-Za-z0-9]$"

removedInput schema / properties / body

Removed value: -{
-  "description": "Unified protection card (ADR-037). Safe House thresholds + trusted-source policy for a single agent. Shape matches src/composition/types.ts::UnifiedProtectionCard (canonical) and what the runtime validator at src/composition/validate.ts accepts. The customer-facing docs at /concepts/protection-card and /specifications/protection-card-schema document this same shape.",
-  "properties": {
-    "_composition": {
-      "$ref": "#/$defs/CompositionMetadata"
-    },
-    "agent_id": {
-      "type": "string"
-    },
-    "card_id": {
-      "type": "string"
-    },
-    "card_version": {
-      "type": "string"
-    },
-    "content_hash": {
-      "description": "Response-only: content hash of the composed card (`sha256:<hex>`), injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-      "type": "string"
-    },
-    "expires_at": {
-      "format": "date-time",
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "extensions": {
-      "additionalProperties": true,
-      "description": "Free-form extension slot for non-canonical fields. Ignored by the composer; preserved on read for tooling that needs an audit-tail metadata bag.",
-      "type": "object"
-    },
-    "issued_at": {
-      "format": "date-time",
-      "type": "string"
-    },
-    "mode": {
-      "description": "Strictest-wins composition: enforce > nudge > observe > off.",
-      "enum": [
-        "off",
-        "observe",
-        "nudge",
-        "enforce"
-      ],
-      "type": "string"
-    },
-    "protected_surface": {
-      "description": "Org-declared protected surface policy (MNE-830). Strengthen-only UNION across platform → org → team → agent: each scope may add entries; none may remove. The composer always emits this block; callers omit it to inherit the composed floor. See ADR-037 §protected_surface.",
-      "properties": {
-        "assets": {
-          "description": "Protected assets. Intrinsic identity = `${kind}:${selector}` (normalized). Composer merges by identity, keeping the strictest entry per scope.",
-          "items": {
-            "properties": {
-              "kind": {
-                "description": "Asset kind (e.g. `row`, `field`, `resource`, `table`).",
-                "type": "string"
-              },
-              "label": {
-                "description": "Human-facing display label (optional).",
-                "type": "string"
-              },
-              "reason": {
-                "description": "Why this asset is protected (optional).",
-                "type": "string"
-              },
-              "selector": {
-                "description": "Asset selector (e.g. `customer:critical-0000`, `replica_dsn`).",
-                "type": "string"
-              },
-              "source_scope": {
-                "description": "Composer-assigned provenance (`platform`, `org:<id>`, `team:<id>`, `agent:<id>`). Server-assigned — do not send on a PUT.",
-                "type": "string"
-              }
-            },
-            "required": [
-              "kind",
-              "selector"
-            ],
-            "type": "object"
-          },
-          "type": "array"
-        },
-        "escalation_required": {
-          "description": "Operations that require escalation before proceeding. Same intrinsic-identity + union rules as forbidden_operations (minus severity).",
-          "items": {
-            "properties": {
-              "applies_to": {
-                "description": "Asset identities this escalation applies to. Empty/absent = GLOBAL.",
-                "items": {
-                  "type": "string"
-                },
-                "type": "array"
-              },
-              "pattern": {
-                "description": "Operation pattern requiring escalation.",
-                "type": "string"
-              },
-              "reason": {
-                "description": "Why escalation is required (optional).",
-                "type": "string"
-              },
-              "source_scope": {
-                "description": "Composer-assigned provenance. Server-assigned — do not send on a PUT.",
-                "type": "string"
-              }
-            },
-            "required": [
-              "pattern"
-            ],
-            "type": "object"
-          },
-          "type": "array"
-        },
-        "forbidden_operations": {
-          "description": "Operations that are unconditionally forbidden. Intrinsic identity = normalized `pattern`. Composer unions across scopes; on identity collision, severity → max.",
-          "items": {
-            "properties": {
-              "applies_to": {
-                "description": "Asset identities (`${kind}:${selector}`) this operation applies to. Empty/absent means GLOBAL.",
-                "items": {
-                  "type": "string"
-                },
-                "type": "array"
-              },
-              "pattern": {
-                "description": "Operation pattern (e.g. `TRUNCATE`, `unscoped UPDATE/DELETE`, `exfiltrate:pii`).",
-                "type": "string"
-              },
-              "reason": {
-                "description": "Why this operation is forbidden (optional).",
-                "type": "string"
-              },
-              "severity": {
-                "description": "Severity level. Composer merges to strictest across scopes.",
-                "enum": [
-                  "low",
-                  "medium",
-                  "high",
-                  "critical"
-                ],
-                "type": "string"
-              },
-              "source_scope": {
-                "description": "Composer-assigned provenance. Server-assigned — do not send on a PUT.",
-                "type": "string"
-              }
-            },
-            "required": [
-              "pattern"
-            ],
-            "type": "object"
-          },
-          "type": "array"
-        }
-      },
-      "type": "object"
-    },
-    "review": {
-      "description": "Review-hold policy (Safe House Review, Slice 2a — MNE-920 design). gate_on is the minimum verdict band per surface that escalates to a review-hold. Composition is strictest-wins; on_timeout defaults to 'reject' (fail-closed). reviewer.kind 'endpoint' is designed for MNE-1650 and not consumed yet.",
-      "properties": {
-        "enabled": {
-          "type": "boolean"
-        },
-        "gate_on": {
-          "properties": {
-            "incoming": {
-              "enum": [
-                "off",
-                "warn",
-                "quarantine",
-                "block"
-              ],
-              "type": "string"
-            },
-            "integrity": {
-              "enum": [
-                "off",
-                "review_needed",
-                "boundary_violation"
-              ],
-              "type": "string"
-            },
-            "outgoing": {
-              "enum": [
-                "off",
-                "warn",
-                "quarantine",
-                "block"
-              ],
-              "type": "string"
-            },
-            "tool_calls": {
-              "enum": [
-                "off",
-                "warn",
-                "quarantine",
-                "block"
-              ],
-              "type": "string"
-            },
-            "tool_responses": {
-              "enum": [
-                "off",
-                "warn",
-                "quarantine",
-                "block"
-              ],
-              "type": "string"
-            }
-          },
-          "type": "object"
-        },
-        "notify": {
-          "properties": {
-            "sse": {
-              "type": "boolean"
-            },
-            "webhooks": {
-              "type": "boolean"
-            }
-          },
-          "type": "object"
-        },
-        "on_timeout": {
-          "enum": [
-            "reject",
-            "release"
-          ],
-          "type": "string"
-        },
-        "quarantine_notice": {
-          "maxLength": 2000,
-          "type": "string"
-        },
-        "reviewer": {
-          "properties": {
-            "endpoint_url": {
-              "format": "uri",
-              "type": "string"
-            },
-            "kind": {
-              "enum": [
-                "builtin_opus",
-                "endpoint"
-              ],
-              "type": "string"
-            }
-          },
-          "required": [
-            "kind"
-          ],
-          "type": "object"
-        },
-        "sla_seconds": {
-          "minimum": 1,
-          "type": "number"
-        }
-      },
-      "required": [
-        "enabled"
-      ],
-      "type": "object"
-    },
-    "screen_surfaces": {
-      "description": "Which request surfaces Safe House inspects. Composed across scopes by OR-per-field (any scope requiring inspection wins).",
-      "properties": {
-        "incoming": {
-          "description": "The user/principal prompt entering the agent.",
-          "type": "boolean"
-        },
-        "outgoing": {
-          "description": "The agent's response leaving the agent.",
-          "type": "boolean"
-        },
-        "tool_calls": {
-          "description": "Tool-use invocations the agent makes.",
-          "type": "boolean"
-        },
-        "tool_responses": {
-          "description": "Responses to tool calls returning to the agent.",
-          "type": "boolean"
-        }
-      },
-      "required": [
-        "incoming",
-        "outgoing",
-        "tool_calls",
-        "tool_responses"
-      ],
-      "type": "object"
-    },
-    "thresholds": {
-      "description": "Score bands. Must satisfy warn <= quarantine <= block; each value in [0, 1].",
-      "properties": {
-        "block": {
-          "maximum": 1,
-          "minimum": 0,
-          "type": "number"
-        },
-        "quarantine": {
-          "maximum": 1,
-          "minimum": 0,
-          "type": "number"
-        },
-        "warn": {
-          "maximum": 1,
-          "minimum": 0,
-          "type": "number"
-        }
-      },
-      "required": [
-        "warn",
-        "quarantine",
-        "block"
-      ],
-      "type": "object"
-    },
-    "trusted_sources": {
-      "description": "Sources for which detectors short-circuit (each match logged in the trace). Composed as platform->agent intersection (compliance ceiling) with org+agent union inside that ceiling — an agent cannot widen trust beyond what the platform allows.",
-      "properties": {
-        "agent_ids": {
-          "description": "Mnemom agent IDs (mnm-* / smolt-* prefixed).",
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "domains": {
-          "description": "DNS names or host:port entries.",
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "ip_ranges": {
-          "description": "IPv4 or IPv6 CIDR ranges.",
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        }
-      },
-      "required": [
-        "domains",
-        "agent_ids",
-        "ip_ranges"
-      ],
-      "type": "object"
-    },
-    "version": {
-      "description": "Response-only: monotonic card version, injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-      "type": "integer"
-    }
-  },
-  "required": [
-    "card_version",
-    "agent_id",
-    "mode",
-    "thresholds",
-    "screen_surfaces",
-    "trusted_sources"
-  ],
-  "type": "object"
-}

addedInput schema / properties / card_version

Added value: +{
+  "description": "Card schema version. REQUIRED by the server-side validator. Current canonical value: `protection/2026-04-26`.",
+  "maxLength": 40,
+  "minLength": 3,
+  "pattern": "^[A-Za-z0-9][A-Za-z0-9._/-]{1,38}[A-Za-z0-9]$",
+  "type": "string"
+}

addedInput schema / properties / mode

Added value: +{
+  "description": "Screening mode for the protection pipeline. Required. `off` disables screening; `observe` records only; `nudge` warns; `enforce` blocks.",
+  "enum": [
+    "off",
+    "observe",
+    "nudge",
+    "enforce"
+  ],
+  "type": "string"
+}

addedInput schema / properties / protected_surface

Added value: +{
+  "additionalProperties": false,
+  "description": "The assets and operations this agent must protect. Omit to accept the composed default (empty surface).",
+  "properties": {
+    "assets": {
+      "description": "The assets under protection.",
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "kind": {
+            "description": "Asset class — e.g. \"repo\", \"database\", \"bucket\".",
+            "maxLength": 64,
+            "minLength": 1,
+            "type": "string"
+          },
+          "label": {
+            "description": "Short human-readable name for the asset.",
+            "maxLength": 120,
+            "minLength": 1,
+            "type": "string"
+          },
+          "reason": {
+            "description": "Why it is protected, in one short sentence. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization.",
+            "maxLength": 200,
+            "minLength": 1,
+            "type": "string"
+          },
+          "selector": {
+            "description": "Which instance — e.g. \"mnemom/mnemom-api\". A resource identifier only: no credentials, no connection strings, no personal data.",
+            "maxLength": 256,
+            "minLength": 1,
+            "type": "string"
+          }
+        },
+        "required": [
+          "kind",
+          "selector"
+        ],
+        "type": "object"
+      },
+      "maxItems": 64,
+      "type": "array"
+    },
+    "escalation_required": {
+      "description": "Operations that require human approval before the agent may proceed.",
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "applies_to": {
+            "description": "Asset identities this entry applies to. Omit to apply to every protected asset.",
+            "items": {
+              "maxLength": 256,
+              "minLength": 1,
+              "type": "string"
+            },
+            "maxItems": 64,
+            "type": "array"
+          },
+          "pattern": {
+            "description": "Operation matcher — e.g. \"force_push\", \"drop_table*\". A short pattern, not a description.",
+            "maxLength": 200,
+            "minLength": 1,
+            "type": "string"
+          },
+          "reason": {
+            "description": "Why this entry exists, in one short sentence. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization.",
+            "maxLength": 200,
+            "minLength": 1,
+            "type": "string"
+          }
+        },
+        "required": [
+          "pattern"
+        ],
+        "type": "object"
+      },
+      "maxItems": 64,
+      "type": "array"
+    },
+    "forbidden_operations": {
+      "description": "Operations the agent must never perform on the protected assets.",
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "applies_to": {
+            "description": "Asset identities this entry applies to. Omit to apply to every protected asset.",
+            "items": {
+              "maxLength": 256,
+              "minLength": 1,
+              "type": "string"
+            },
+            "maxItems": 64,
+            "type": "array"
+          },
+          "pattern": {
+            "description": "Operation matcher — e.g. \"force_push\", \"drop_table*\". A short pattern, not a description.",
+            "maxLength": 200,
+            "minLength": 1,
+            "type": "string"
+          },
+          "reason": {
+            "description": "Why this entry exists, in one short sentence. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization.",
+            "maxLength": 200,
+            "minLength": 1,
+            "type": "string"
+          },
+          "severity": {
+            "description": "How serious a violation of this entry is.",
+            "enum": [
+              "low",
+              "medium",
+              "high",
+              "critical"
+            ],
+            "type": "string"
+          }
+        },
+        "required": [
+          "pattern"
+        ],
+        "type": "object"
+      },
+      "maxItems": 64,
+      "type": "array"
+    }
+  },
+  "type": "object"
+}

addedInput schema / properties / screen_surfaces

Added value: +{
+  "additionalProperties": false,
+  "description": "Which traffic surfaces are screened. Omit to accept the composed defaults.",
+  "properties": {
+    "incoming": {
+      "description": "Screen prompts arriving at the agent.",
+      "type": "boolean"
+    },
+    "outgoing": {
+      "description": "Screen the agent's outbound messages.",
+      "type": "boolean"
+    },
+    "tool_calls": {
+      "description": "Screen the tool calls the agent makes.",
+      "type": "boolean"
+    },
+    "tool_responses": {
+      "description": "Screen tool responses returned to the agent.",
+      "type": "boolean"
+    }
+  },
+  "type": "object"
+}

addedInput schema / properties / thresholds

Added value: +{
+  "additionalProperties": false,
+  "description": "Risk-score cutoffs, each in [0, 1] and ordered warn ≤ quarantine ≤ block. All three are required if this object is sent at all — omit the whole object to accept the composed defaults.",
+  "properties": {
+    "block": {
+      "description": "Score at or above which the request is refused.",
+      "maximum": 1,
+      "minimum": 0,
+      "type": "number"
+    },
+    "quarantine": {
+      "description": "Score at or above which the request is held for review.",
+      "maximum": 1,
+      "minimum": 0,
+      "type": "number"
+    },
+    "warn": {
+      "description": "Score at or above which the request is flagged.",
+      "maximum": 1,
+      "minimum": 0,
+      "type": "number"
+    }
+  },
+  "required": [
+    "warn",
+    "quarantine",
+    "block"
+  ],
+  "type": "object"
+}

addedInput schema / properties / trusted_sources

Added value: +{
+  "additionalProperties": false,
+  "description": "Sources exempt from screening. Enumerate specific hosts — wildcards are rejected, and a server-side deny-list (public LLM/DNS endpoints, 0.0.0.0/0, ::/0, link-local, multicast) is always applied.",
+  "properties": {
+    "agent_ids": {
+      "description": "Trusted Mnemom agent IDs. Must be in canonical `mnm-*` form.",
+      "items": {
+        "maxLength": 64,
+        "minLength": 8,
+        "pattern": "^mnm-[A-Za-z0-9-]{4,}$",
+        "type": "string"
+      },
+      "maxItems": 64,
+      "type": "array"
+    },
+    "domains": {
+      "description": "Trusted DNS names, optionally with `:port`. No wildcards.",
+      "items": {
+        "maxLength": 253,
+        "minLength": 3,
+        "type": "string"
+      },
+      "maxItems": 64,
+      "type": "array"
+    },
+    "ip_ranges": {
+      "description": "Trusted CIDR ranges (e.g. `10.0.0.0/8`).",
+      "items": {
+        "maxLength": 43,
+        "minLength": 4,
+        "type": "string"
+      },
+      "maxItems": 64,
+      "type": "array"
+    }
+  },
+  "type": "object"
+}

changedInput schema / required

Previous value: -[
-  "agent_id"
-]New value: +[
+  "agent_id",
+  "card_version",
+  "mode"
+]

addedOutput schema / properties / composition_valid

Added value: +{
+  "description": "True when the composed card is valid.",
+  "type": "boolean"
+}

removedOutput schema / properties / conflicts

Removed value: -{
-  "additionalProperties": false,
-  "properties": {
-    "by_reason": {
-      "additionalProperties": {
-        "type": "integer"
-      },
-      "type": "object"
-    },
-    "not_shown": {
-      "description": "Conflicts beyond the inline top-N (present only when > top-N).",
-      "type": "integer"
-    },
-    "overrides": {
-      "items": {
-        "additionalProperties": false,
-        "properties": {
-          "field": {},
-          "from": {},
-          "reason": {},
-          "to": {},
-          "won_by": {}
-        },
-        "type": "object"
-      },
-      "type": "array"
-    },
-    "total": {
-      "type": "integer"
-    }
-  },
-  "required": [
-    "total",
-    "by_reason",
-    "overrides"
-  ],
-  "type": "object"
-}

addedOutput schema / properties / conflicts_count

Added value: +{
+  "description": "Total number of conflicts detected (0 = none).",
+  "type": "integer"
+}

removedOutput schema / properties / effective

Removed value: -{
-  "additionalProperties": false,
-  "properties": {
-    "mode": {
-      "type": "string"
-    },
-    "screen_surfaces": {},
-    "thresholds": {},
-    "trusted_sources_counts": {
-      "additionalProperties": false,
-      "properties": {
-        "agent_ids": {
-          "type": "integer"
-        },
-        "domains": {
-          "type": "integer"
-        },
-        "ip_ranges": {
-          "type": "integer"
-        }
-      },
-      "required": [
-        "domains",
-        "agent_ids",
-        "ip_ranges"
-      ],
-      "type": "object"
-    }
-  },
-  "required": [
-    "trusted_sources_counts"
-  ],
-  "type": "object"
-}

removedOutput schema / properties / full_report / additionalProperties
```
Removed value: -false
```

addedOutput schema / properties / full_report / description

Added value: +"Optional pointer to the full /v1 conflict report (method + path)."

addedOutput schema / properties / full_report / oneOf

Added value: +[
+  {
+    "type": "null"
+  },
+  {
+    "additionalProperties": false,
+    "properties": {
+      "method": {
+        "type": "string"
+      },
+      "note": {
+        "type": "string"
+      },
+      "path": {
+        "type": "string"
+      }
+    },
+    "required": [
+      "method",
+      "path",
+      "note"
+    ],
+    "type": "object"
+  }
+]

removedOutput schema / properties / full_report / properties

Removed value: -{
-  "method": {
-    "type": "string"
-  },
-  "note": {
-    "type": "string"
-  },
-  "path": {
-    "type": "string"
-  }
-}

removedOutput schema / properties / full_report / required
```
Removed value: -[
-  "method",
-  "path",
-  "note"
-]
```
removedOutput schema / properties / full_report / type
```
Removed value: -"object"
```

addedOutput schema / properties / ok / description

Added value: +"True when composition succeeded (no blocking conflicts)."

addedOutput schema / properties / summary / description

Added value: +"One-line human-readable summary of composition status."

removedOutput schema / properties / summary / enum
```
Removed value: -[
-  true
-]
```

changedOutput schema / properties / summary / type

Previous value: -"boolean"New value: +"string"

removedOutput schema / properties / tool

Removed value: -{
-  "enum": [
-    "preview_compose_protection_by_agent"
-  ],
-  "type": "string"
-}

removedOutput schema / properties / what_changed
```
Removed value: -{
-  "type": "string"
-}
```
removedOutput schema / properties / what_to_do_next
```
Removed value: -{
-  "type": "string"
-}
```
removedOutput schema / properties / what_would_break
```
Removed value: -{
-  "type": "string"
-}
```

changedOutput schema / required

Previous value: -[
-  "summary",
-  "tool",
-  "ok",
-  "effective",
-  "conflicts",
-  "what_changed",
-  "what_would_break",
-  "what_to_do_next",
-  "full_report"
-]New value: +[
+  "ok",
+  "composition_valid",
+  "conflicts_count",
+  "summary"
+]

Changedput_alignment_by_agent38 fields changed

removedInput schema / $defs

Removed value: -{
-  "CompositionMetadata": {
-    "description": "System-managed block describing which scope sources merged into the canonical card. Only returned when `?include_composition=true`.",
-    "properties": {
-      "canonical_id": {
-        "type": "string"
-      },
-      "composed_at": {
-        "format": "date-time",
-        "type": "string"
-      },
-      "exemptions_applied": {
-        "items": {
-          "type": "string"
-        },
-        "type": "array"
-      },
-      "scopes_applied": {
-        "items": {
-          "properties": {
-            "card_id": {
-              "type": "string"
-            },
-            "scope": {
-              "description": "`platform`, `org:<id>`, or `agent:<id>`.",
-              "type": "string"
-            },
-            "template_version": {
-              "type": "integer"
-            },
-            "version": {
-              "type": "integer"
-            }
-          },
-          "type": "object"
-        },
-        "type": "array"
-      },
-      "source_card_id": {
-        "type": "string"
-      },
-      "source_policy_id": {
-        "type": "string"
-      }
-    },
-    "type": "object"
-  },
-  "UnifiedAlignmentCard": {
-    "description": "Unified alignment card (ADR-008/ADR-039). Authored in YAML or JSON; composed server-side with platform defaults, org template, and active exemptions before storage. This schema matches the runtime validator at src/composition/validate.ts EXACTLY — a card authored strictly to it passes `PUT /v1/agents/{id}/alignment-card` and the preview-compose endpoint. Output-only fields (card_id, issued_at, expires_at, _composition, content_hash, version) are server-assigned and must NOT be sent on a PUT.",
-    "properties": {
-      "_composition": {
-        "$ref": "#/$defs/CompositionMetadata"
-      },
-      "agent_id": {
-        "description": "Target agent id. On PUT, server overwrites to match the URL path.",
-        "type": "string"
-      },
-      "audit": {
-        "allOf": [
-          {
-            "if": {
-              "properties": {
-                "queryable": {
-                  "const": true
-                }
-              },
-              "required": [
-                "queryable"
-              ]
-            },
-            "then": {
-              "required": [
-                "query_endpoint"
-              ]
-            }
-          }
-        ],
-        "properties": {
-          "query_endpoint": {
-            "description": "Required when audit.queryable is true.",
-            "type": "string"
-          },
-          "queryable": {
-            "type": "boolean"
-          },
-          "retention_days": {
-            "minimum": 0,
-            "type": "integer"
-          },
-          "storage": {
-            "properties": {
-              "location": {
-                "type": "string"
-              },
-              "type": {
-                "enum": [
-                  "local",
-                  "remote",
-                  "distributed"
-                ],
-                "type": "string"
-              }
-            },
-            "type": "object"
-          },
-          "tamper_evidence": {
-            "enum": [
-              "append_only",
-              "signed",
-              "merkle",
-              null
-            ],
-            "type": [
-              "string",
-              "null"
-            ]
-          },
-          "trace_format": {
-            "type": "string"
-          }
-        },
-        "required": [
-          "retention_days",
-          "queryable"
-        ],
-        "type": "object"
-      },
-      "autonomy": {
-        "properties": {
-          "bounded_actions": {
-            "items": {
-              "type": "string"
-            },
-            "minItems": 1,
-            "type": "array"
-          },
-          "escalation_triggers": {
-            "items": {
-              "properties": {
-                "action": {
-                  "enum": [
-                    "escalate",
-                    "deny",
-                    "log"
-                  ],
-                  "type": "string"
-                },
-                "condition": {
-                  "type": "string"
-                },
-                "reason": {
-                  "type": "string"
-                }
-              },
-              "required": [
-                "condition",
-                "action",
-                "reason"
-              ],
-              "type": "object"
-            },
-            "type": "array"
-          },
-          "forbidden_actions": {
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "max_autonomous_value": {
-            "properties": {
-              "amount": {
-                "type": "number"
-              },
-              "currency": {
-                "type": "string"
-              }
-            },
-            "type": "object"
-          }
-        },
-        "required": [
-          "bounded_actions"
-        ],
-        "type": "object"
-      },
-      "autonomy_mode": {
-        "description": "ADR-039 master switch for the action-policing pipeline (autonomy constraints). Required at the top level post-cutover; the legacy `enforcement.mode` location is rejected.",
-        "enum": [
-          "off",
-          "observe",
-          "nudge",
-          "enforce"
-        ],
-        "type": "string"
-      },
-      "capabilities": {
-        "additionalProperties": {
-          "properties": {
-            "description": {
-              "type": "string"
-            },
-            "required_actions": {
-              "items": {
-                "type": "string"
-              },
-              "type": "array"
-            },
-            "tools": {
-              "items": {
-                "type": "string"
-              },
-              "type": "array"
-            }
-          },
-          "type": "object"
-        },
-        "type": "object"
-      },
-      "card_id": {
-        "description": "Card row id. Server-assigned on PUT (`ac-{uuid}`).",
-        "type": "string"
-      },
-      "card_version": {
-        "description": "Card schema version (required, non-empty). Current canonical value: `unified/2026-04-26`.",
-        "minLength": 1,
-        "type": "string"
-      },
-      "conscience": {
-        "properties": {
-          "mode": {
-            "enum": [
-              "augment",
-              "replace"
-            ],
-            "type": "string"
-          },
-          "values": {
-            "items": {
-              "properties": {
-                "content": {
-                  "type": "string"
-                },
-                "id": {
-                  "type": "string"
-                },
-                "severity": {
-                  "enum": [
-                    "advisory",
-                    "mandatory"
-                  ],
-                  "type": "string"
-                },
-                "type": {
-                  "enum": [
-                    "BOUNDARY",
-                    "FEAR",
-                    "COMMITMENT",
-                    "BELIEF",
-                    "HOPE"
-                  ],
-                  "type": "string"
-                }
-              },
-              "required": [
-                "type",
-                "content"
-              ],
-              "type": "object"
-            },
-            "type": "array"
-          }
-        },
-        "required": [
-          "mode",
-          "values"
-        ],
-        "type": "object"
-      },
-      "content_hash": {
-        "description": "Response-only: content hash of the composed card (`sha256:<hex>`), injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-        "type": "string"
-      },
-      "enforcement": {
-        "description": "Optional ADR-039 Decision-3 user-facing knobs for unmapped-tool handling. The legacy `mode`, `unmapped_tool_action` and `fail_open` keys are REJECTED by the validator (mode → top-level autonomy_mode; fail_open → gateway env config).",
-        "properties": {
-          "allow_unmapped_tools": {
-            "description": "When true, tools not mapped to a capability are allowed by default.",
-            "type": "boolean"
-          },
-          "default_unmapped_severity": {
-            "description": "Severity assigned to an unmapped tool when allow_unmapped_tools is false.",
-            "enum": [
-              "low",
-              "medium",
-              "high",
-              "critical"
-            ],
-            "type": "string"
-          },
-          "forbidden_tools": {
-            "items": {
-              "properties": {
-                "pattern": {
-                  "type": "string"
-                },
-                "reason": {
-                  "type": "string"
-                },
-                "severity": {
-                  "enum": [
-                    "critical",
-                    "high",
-                    "medium",
-                    "low"
-                  ],
-                  "type": "string"
-                }
-              },
-              "required": [
-                "pattern",
-                "reason",
-                "severity"
-              ],
-              "type": "object"
-            },
-            "type": "array"
-          },
-          "grace_period_hours": {
-            "type": "integer"
-          }
-        },
-        "type": "object"
-      },
-      "expires_at": {
-        "format": "date-time",
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "extensions": {
-        "additionalProperties": true,
-        "type": "object"
-      },
-      "integrity_mode": {
-        "description": "ADR-039 master switch for the values/conscience pipeline (integrity constraints). Required at the top level post-cutover; the legacy `integrity.enforcement_mode` location is rejected.",
-        "enum": [
-          "off",
-          "observe",
-          "nudge",
-          "enforce"
-        ],
-        "type": "string"
-      },
-      "issued_at": {
-        "format": "date-time",
-        "type": "string"
-      },
-      "principal": {
-        "allOf": [
-          {
-            "if": {
-              "properties": {
-                "type": {
-                  "not": {
-                    "const": "unspecified"
-                  }
-                }
-              }
-            },
-            "then": {
-              "required": [
-                "identifier"
-              ]
-            }
-          }
-        ],
-        "description": "Required object describing whose authority the agent acts under (ADR-039 Decision 10).",
-        "properties": {
-          "escalation_contact": {
-            "type": "string"
-          },
-          "identifier": {
-            "description": "Required (non-empty) when principal.type is not `unspecified`; identifies the human / organization / agent.",
-            "minLength": 1,
-            "type": "string"
-          },
-          "relationship": {
-            "enum": [
-              "delegated_authority",
-              "advisory",
-              "autonomous"
-            ],
-            "type": "string"
-          },
-          "type": {
-            "enum": [
-              "human",
-              "organization",
-              "agent",
-              "unspecified"
-            ],
-            "type": "string"
-          }
-        },
-        "required": [
-          "type",
-          "relationship"
-        ],
-        "type": "object"
-      },
-      "values": {
-        "properties": {
-          "conflicts_with": {
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "declared": {
-            "description": "Ordered list of declared values. Phase 1 cards-as-primitive: each entry is either a catalog-v1 ID string (e.g. `'accuracy'`) or a parameterized map carrying optional `intensity` / `domain` / `severity_on_violation` / `scope` (e.g. `{id: 'accuracy', domain: 'financial', severity_on_violation: 'critical'}`).",
-            "items": {
-              "oneOf": [
-                {
-                  "minLength": 1,
-                  "type": "string"
-                },
-                {
-                  "additionalProperties": {
-                    "type": "string"
-                  },
-                  "properties": {
-                    "id": {
-                      "minLength": 1,
-                      "type": "string"
-                    }
-                  },
-                  "required": [
-                    "id"
-                  ],
-                  "type": "object"
-                }
-              ]
-            },
-            "minItems": 1,
-            "type": "array"
-          },
-          "definitions": {
-            "additionalProperties": {
-              "properties": {
-                "description": {
-                  "type": "string"
-                },
-                "priority": {
-                  "type": "integer"
-                }
-              },
-              "type": "object"
-            },
-            "type": "object"
-          },
-          "hierarchy": {
-            "enum": [
-              "lexicographic",
-              "weighted",
-              "contextual"
-            ],
-            "type": "string"
-          }
-        },
-        "required": [
-          "declared"
-        ],
-        "type": "object"
-      },
-      "version": {
-        "description": "Response-only: monotonic card version, injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-        "type": "integer"
-      }
-    },
-    "required": [
-      "card_version",
-      "agent_id",
-      "autonomy_mode",
-      "integrity_mode",
-      "principal",
-      "values",
-      "autonomy",
-      "audit"
-    ],
-    "type": "object"
-  }
-}

changedInput schema / properties / agent_id / description

Previous value: -"Agent identifier (e.g. smolt-abc123)"New value: +"The agent this card belongs to (e.g. `smolt-abc123`). Identifier only — never place an API key, a secret, an email address, or any other personal data in this field."

addedInput schema / properties / agent_id / maxLength
```
Added value: +64
```
addedInput schema / properties / agent_id / minLength
```
Added value: +3
```

addedInput schema / properties / agent_id / pattern

Added value: +"^[A-Za-z0-9][A-Za-z0-9_-]{1,62}[A-Za-z0-9]$"

addedInput schema / properties / audit

Added value: +{
+  "additionalProperties": false,
+  "description": "How long this agent's own decision log is kept, and whether it can be queried. Required. (This is the agent's audit policy — it is NOT Mnemom's retention policy for the card itself; see the tool's data-handling disclosure for that.)",
+  "properties": {
+    "query_endpoint": {
+      "description": "HTTPS endpoint the records can be queried from. REQUIRED when `queryable` is true, and ignored when it is false.",
+      "maxLength": 300,
+      "type": "string"
+    },
+    "queryable": {
+      "default": false,
+      "description": "Whether those retained records can be queried. Leave false unless you also supply `query_endpoint` — the server rejects a queryable audit policy with no endpoint.",
+      "type": "boolean"
+    },
+    "retention_days": {
+      "description": "How many days the agent's decision records are retained. 0 means do not retain. 3650 (10 years) maximum.",
+      "maximum": 3650,
+      "minimum": 0,
+      "type": "integer"
+    },
+    "tamper_evidence": {
+      "description": "Tamper-evidence scheme applied to the retained records.",
+      "enum": [
+        "append_only",
+        "signed",
+        "merkle"
+      ],
+      "type": "string"
+    }
+  },
+  "required": [
+    "retention_days",
+    "queryable"
+  ],
+  "type": "object"
+}

addedInput schema / properties / autonomy

Added value: +{
+  "additionalProperties": false,
+  "description": "What the agent may do on its own authority. Required.",
+  "properties": {
+    "bounded_actions": {
+      "description": "Action names the agent may take within its bounds — e.g. [\"send_email\", \"create_ticket\"]. At least one required. Action identifiers only, not descriptions.",
+      "items": {
+        "maxLength": 128,
+        "minLength": 1,
+        "type": "string"
+      },
+      "maxItems": 64,
+      "minItems": 1,
+      "type": "array"
+    },
+    "escalation_triggers": {
+      "description": "Conditions that route to a human instead of acting.",
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "action": {
+            "description": "What to do when the condition holds.",
+            "enum": [
+              "escalate",
+              "deny",
+              "log"
+            ],
+            "type": "string"
+          },
+          "condition": {
+            "description": "The condition, as a short expression or slug (e.g. \"amount > 1000\"). Short condition only — never paste a conversation, a log excerpt, or a record about a person. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization.",
+            "maxLength": 200,
+            "minLength": 1,
+            "type": "string"
+          },
+          "reason": {
+            "description": "Why this trigger exists, in one short sentence. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization.",
+            "maxLength": 200,
+            "minLength": 1,
+            "type": "string"
+          }
+        },
+        "required": [
+          "condition",
+          "action",
+          "reason"
+        ],
+        "type": "object"
+      },
+      "maxItems": 32,
+      "type": "array"
+    },
+    "forbidden_actions": {
+      "description": "Action names the agent must never take. Must be disjoint from `bounded_actions`.",
+      "items": {
+        "maxLength": 128,
+        "minLength": 1,
+        "type": "string"
+      },
+      "maxItems": 64,
+      "type": "array"
+    }
+  },
+  "required": [
+    "bounded_actions"
+  ],
+  "type": "object"
+}

addedInput schema / properties / autonomy_mode

Added value: +{
+  "description": "Master switch for the action-policing pipeline. Required. `off` disables it; `observe` records only; `nudge` warns; `enforce` blocks.",
+  "enum": [
+    "off",
+    "observe",
+    "nudge",
+    "enforce"
+  ],
+  "type": "string"
+}

removedInput schema / properties / body

Removed value: -{
-  "description": "Unified alignment card (ADR-008/ADR-039). Authored in YAML or JSON; composed server-side with platform defaults, org template, and active exemptions before storage. This schema matches the runtime validator at src/composition/validate.ts EXACTLY — a card authored strictly to it passes `PUT /v1/agents/{id}/alignment-card` and the preview-compose endpoint. Output-only fields (card_id, issued_at, expires_at, _composition, content_hash, version) are server-assigned and must NOT be sent on a PUT.",
-  "properties": {
-    "_composition": {
-      "$ref": "#/$defs/CompositionMetadata"
-    },
-    "agent_id": {
-      "description": "Target agent id. On PUT, server overwrites to match the URL path.",
-      "type": "string"
-    },
-    "audit": {
-      "allOf": [
-        {
-          "if": {
-            "properties": {
-              "queryable": {
-                "const": true
-              }
-            },
-            "required": [
-              "queryable"
-            ]
-          },
-          "then": {
-            "required": [
-              "query_endpoint"
-            ]
-          }
-        }
-      ],
-      "properties": {
-        "query_endpoint": {
-          "description": "Required when audit.queryable is true.",
-          "type": "string"
-        },
-        "queryable": {
-          "type": "boolean"
-        },
-        "retention_days": {
-          "minimum": 0,
-          "type": "integer"
-        },
-        "storage": {
-          "properties": {
-            "location": {
-              "type": "string"
-            },
-            "type": {
-              "enum": [
-                "local",
-                "remote",
-                "distributed"
-              ],
-              "type": "string"
-            }
-          },
-          "type": "object"
-        },
-        "tamper_evidence": {
-          "enum": [
-            "append_only",
-            "signed",
-            "merkle",
-            null
-          ],
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "trace_format": {
-          "type": "string"
-        }
-      },
-      "required": [
-        "retention_days",
-        "queryable"
-      ],
-      "type": "object"
-    },
-    "autonomy": {
-      "properties": {
-        "bounded_actions": {
-          "items": {
-            "type": "string"
-          },
-          "minItems": 1,
-          "type": "array"
-        },
-        "escalation_triggers": {
-          "items": {
-            "properties": {
-              "action": {
-                "enum": [
-                  "escalate",
-                  "deny",
-                  "log"
-                ],
-                "type": "string"
-              },
-              "condition": {
-                "type": "string"
-              },
-              "reason": {
-                "type": "string"
-              }
-            },
-            "required": [
-              "condition",
-              "action",
-              "reason"
-            ],
-            "type": "object"
-          },
-          "type": "array"
-        },
-        "forbidden_actions": {
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "max_autonomous_value": {
-          "properties": {
-            "amount": {
-              "type": "number"
-            },
-            "currency": {
-              "type": "string"
-            }
-          },
-          "type": "object"
-        }
-      },
-      "required": [
-        "bounded_actions"
-      ],
-      "type": "object"
-    },
-    "autonomy_mode": {
-      "description": "ADR-039 master switch for the action-policing pipeline (autonomy constraints). Required at the top level post-cutover; the legacy `enforcement.mode` location is rejected.",
-      "enum": [
-        "off",
-        "observe",
-        "nudge",
-        "enforce"
-      ],
-      "type": "string"
-    },
-    "capabilities": {
-      "additionalProperties": {
-        "properties": {
-          "description": {
-            "type": "string"
-          },
-          "required_actions": {
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "tools": {
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          }
-        },
-        "type": "object"
-      },
-      "type": "object"
-    },
-    "card_id": {
-      "description": "Card row id. Server-assigned on PUT (`ac-{uuid}`).",
-      "type": "string"
-    },
-    "card_version": {
-      "description": "Card schema version (required, non-empty). Current canonical value: `unified/2026-04-26`.",
-      "minLength": 1,
-      "type": "string"
-    },
-    "conscience": {
-      "properties": {
-        "mode": {
-          "enum": [
-            "augment",
-            "replace"
-          ],
-          "type": "string"
-        },
-        "values": {
-          "items": {
-            "properties": {
-              "content": {
-                "type": "string"
-              },
-              "id": {
-                "type": "string"
-              },
-              "severity": {
-                "enum": [
-                  "advisory",
-                  "mandatory"
-                ],
-                "type": "string"
-              },
-              "type": {
-                "enum": [
-                  "BOUNDARY",
-                  "FEAR",
-                  "COMMITMENT",
-                  "BELIEF",
-                  "HOPE"
-                ],
-                "type": "string"
-              }
-            },
-            "required": [
-              "type",
-              "content"
-            ],
-            "type": "object"
-          },
-          "type": "array"
-        }
-      },
-      "required": [
-        "mode",
-        "values"
-      ],
-      "type": "object"
-    },
-    "content_hash": {
-      "description": "Response-only: content hash of the composed card (`sha256:<hex>`), injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-      "type": "string"
-    },
-    "enforcement": {
-      "description": "Optional ADR-039 Decision-3 user-facing knobs for unmapped-tool handling. The legacy `mode`, `unmapped_tool_action` and `fail_open` keys are REJECTED by the validator (mode → top-level autonomy_mode; fail_open → gateway env config).",
-      "properties": {
-        "allow_unmapped_tools": {
-          "description": "When true, tools not mapped to a capability are allowed by default.",
-          "type": "boolean"
-        },
-        "default_unmapped_severity": {
-          "description": "Severity assigned to an unmapped tool when allow_unmapped_tools is false.",
-          "enum": [
-            "low",
-            "medium",
-            "high",
-            "critical"
-          ],
-          "type": "string"
-        },
-        "forbidden_tools": {
-          "items": {
-            "properties": {
-              "pattern": {
-                "type": "string"
-              },
-              "reason": {
-                "type": "string"
-              },
-              "severity": {
-                "enum": [
-                  "critical",
-                  "high",
-                  "medium",
-                  "low"
-                ],
-                "type": "string"
-              }
-            },
-            "required": [
-              "pattern",
-              "reason",
-              "severity"
-            ],
-            "type": "object"
-          },
-          "type": "array"
-        },
-        "grace_period_hours": {
-          "type": "integer"
-        }
-      },
-      "type": "object"
-    },
-    "expires_at": {
-      "format": "date-time",
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "extensions": {
-      "additionalProperties": true,
-      "type": "object"
-    },
-    "integrity_mode": {
-      "description": "ADR-039 master switch for the values/conscience pipeline (integrity constraints). Required at the top level post-cutover; the legacy `integrity.enforcement_mode` location is rejected.",
-      "enum": [
-        "off",
-        "observe",
-        "nudge",
-        "enforce"
-      ],
-      "type": "string"
-    },
-    "issued_at": {
-      "format": "date-time",
-      "type": "string"
-    },
-    "principal": {
-      "allOf": [
-        {
-          "if": {
-            "properties": {
-              "type": {
-                "not": {
-                  "const": "unspecified"
-                }
-              }
-            }
-          },
-          "then": {
-            "required": [
-              "identifier"
-            ]
-          }
-        }
-      ],
-      "description": "Required object describing whose authority the agent acts under (ADR-039 Decision 10).",
-      "properties": {
-        "escalation_contact": {
-          "type": "string"
-        },
-        "identifier": {
-          "description": "Required (non-empty) when principal.type is not `unspecified`; identifies the human / organization / agent.",
-          "minLength": 1,
-          "type": "string"
-        },
-        "relationship": {
-          "enum": [
-            "delegated_authority",
-            "advisory",
-            "autonomous"
-          ],
-          "type": "string"
-        },
-        "type": {
-          "enum": [
-            "human",
-            "organization",
-            "agent",
-            "unspecified"
-          ],
-          "type": "string"
-        }
-      },
-      "required": [
-        "type",
-        "relationship"
-      ],
-      "type": "object"
-    },
-    "values": {
-      "properties": {
-        "conflicts_with": {
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "declared": {
-          "description": "Ordered list of declared values. Phase 1 cards-as-primitive: each entry is either a catalog-v1 ID string (e.g. `'accuracy'`) or a parameterized map carrying optional `intensity` / `domain` / `severity_on_violation` / `scope` (e.g. `{id: 'accuracy', domain: 'financial', severity_on_violation: 'critical'}`).",
-          "items": {
-            "oneOf": [
-              {
-                "minLength": 1,
-                "type": "string"
-              },
-              {
-                "additionalProperties": {
-                  "type": "string"
-                },
-                "properties": {
-                  "id": {
-                    "minLength": 1,
-                    "type": "string"
-                  }
-                },
-                "required": [
-                  "id"
-                ],
-                "type": "object"
-              }
-            ]
-          },
-          "minItems": 1,
-          "type": "array"
-        },
-        "definitions": {
-          "additionalProperties": {
-            "properties": {
-              "description": {
-                "type": "string"
-              },
-              "priority": {
-                "type": "integer"
-              }
-            },
-            "type": "object"
-          },
-          "type": "object"
-        },
-        "hierarchy": {
-          "enum": [
-            "lexicographic",
-            "weighted",
-            "contextual"
-          ],
-          "type": "string"
-        }
-      },
-      "required": [
-        "declared"
-      ],
-      "type": "object"
-    },
-    "version": {
-      "description": "Response-only: monotonic card version, injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-      "type": "integer"
-    }
-  },
-  "required": [
-    "card_version",
-    "agent_id",
-    "autonomy_mode",
-    "integrity_mode",
-    "principal",
-    "values",
-    "autonomy",
-    "audit"
-  ],
-  "type": "object"
-}

addedInput schema / properties / card_version

Added value: +{
+  "description": "Card schema version. REQUIRED by the server-side validator. Current canonical value: `unified/2026-04-26`.",
+  "maxLength": 40,
+  "minLength": 3,
+  "pattern": "^[A-Za-z0-9][A-Za-z0-9._/-]{1,38}[A-Za-z0-9]$",
+  "type": "string"
+}

addedInput schema / properties / integrity_mode

Added value: +{
+  "description": "Master switch for the values pipeline. Required. Same four states as `autonomy_mode`.",
+  "enum": [
+    "off",
+    "observe",
+    "nudge",
+    "enforce"
+  ],
+  "type": "string"
+}

addedInput schema / properties / principal

Added value: +{
+  "additionalProperties": false,
+  "description": "Whose authority this agent acts under. Required.",
+  "properties": {
+    "escalation_contact": {
+      "description": "Where an escalation is routed. Use a ROLE ALIAS or SHARED INBOX (\"oncall-sre\", \"security@example.com\"), never an individual's personal contact details. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization.",
+      "maxLength": 128,
+      "minLength": 1,
+      "type": "string"
+    },
+    "identifier": {
+      "description": "Who the principal is. Use a ROLE or ORGANIZATION name (\"support-team\", \"Acme Corp Finance\"), NOT an individual's name, email address or phone number. Pass \"unspecified\" if there is no named principal. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization.",
+      "maxLength": 128,
+      "minLength": 1,
+      "type": "string"
+    },
+    "relationship": {
+      "description": "How the agent relates to that principal.",
+      "enum": [
+        "delegated_authority",
+        "advisory",
+        "autonomous"
+      ],
+      "type": "string"
+    },
+    "type": {
+      "description": "The kind of principal the agent answers to.",
+      "enum": [
+        "human",
+        "organization",
+        "agent",
+        "unspecified"
+      ],
+      "type": "string"
+    }
+  },
+  "required": [
+    "type",
+    "relationship",
+    "identifier"
+  ],
+  "type": "object"
+}

addedInput schema / properties / values

Added value: +{
+  "additionalProperties": false,
+  "description": "The values this agent declares it is bound by. Required.",
+  "properties": {
+    "declared": {
+      "description": "Value catalog IDs — e.g. [\"honesty\", \"no_harm\", \"privacy\"]. At least one required, 32 maximum. Short catalog slugs ONLY, never prose and never personal data. (Parameterized value references and long-form value definitions are available on the /v1 REST + CLI path; they are deliberately not exposed here.)",
+      "items": {
+        "maxLength": 64,
+        "minLength": 1,
+        "type": "string"
+      },
+      "maxItems": 32,
+      "minItems": 1,
+      "type": "array"
+    }
+  },
+  "required": [
+    "declared"
+  ],
+  "type": "object"
+}

changedInput schema / required

Previous value: -[
-  "agent_id"
-]New value: +[
+  "agent_id",
+  "card_version",
+  "autonomy_mode",
+  "integrity_mode",
+  "principal",
+  "values",
+  "autonomy",
+  "audit"
+]

removedOutput schema / $defs

Removed value: -{
-  "ComposedAlignmentCard": {
-    "description": "OUTPUT-only variant of `UnifiedAlignmentCard` for the COMPOSED card the server emits on GET `/v1/alignment/{scope}/{id}`, `/effective`, and the `composed` field of preview-compose. Identical to `UnifiedAlignmentCard` except `principal` is optional (a default / org-scope composed card has no agent principal) and `values.declared` / `autonomy.bounded_actions` may be empty (a fresh card declares nothing yet). The strict `UnifiedAlignmentCard` remains the authoring/request contract.",
-    "properties": {
-      "_composition": {
-        "$ref": "#/$defs/CompositionMetadata"
-      },
-      "agent_id": {
-        "description": "Target agent id. On PUT, server overwrites to match the URL path.",
-        "type": "string"
-      },
-      "audit": {
-        "allOf": [
-          {
-            "if": {
-              "properties": {
-                "queryable": {
-                  "const": true
-                }
-              },
-              "required": [
-                "queryable"
-              ]
-            },
-            "then": {
-              "required": [
-                "query_endpoint"
-              ]
-            }
-          }
-        ],
-        "properties": {
-          "query_endpoint": {
-            "description": "Required when audit.queryable is true.",
-            "type": "string"
-          },
-          "queryable": {
-            "type": "boolean"
-          },
-          "retention_days": {
-            "minimum": 0,
-            "type": "integer"
-          },
-          "storage": {
-            "properties": {
-              "location": {
-                "type": "string"
-              },
-              "type": {
-                "enum": [
-                  "local",
-                  "remote",
-                  "distributed"
-                ],
-                "type": "string"
-              }
-            },
-            "type": "object"
-          },
-          "tamper_evidence": {
-            "enum": [
-              "append_only",
-              "signed",
-              "merkle",
-              null
-            ],
-            "type": [
-              "string",
-              "null"
-            ]
-          },
-          "trace_format": {
-            "type": "string"
-          }
-        },
-        "required": [
-          "retention_days",
-          "queryable"
-        ],
-        "type": "object"
-      },
-      "autonomy": {
-        "properties": {
-          "bounded_actions": {
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "escalation_triggers": {
-            "items": {
-              "properties": {
-                "action": {
-                  "enum": [
-                    "escalate",
-                    "deny",
-                    "log"
-                  ],
-                  "type": "string"
-                },
-                "condition": {
-                  "type": "string"
-                },
-                "reason": {
-                  "type": "string"
-                }
-              },
-              "required": [
-                "condition",
-                "action",
-                "reason"
-              ],
-              "type": "object"
-            },
-            "type": "array"
-          },
-          "forbidden_actions": {
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "max_autonomous_value": {
-            "properties": {
-              "amount": {
-                "type": "number"
-              },
-              "currency": {
-                "type": "string"
-              }
-            },
-            "type": "object"
-          }
-        },
-        "required": [
-          "bounded_actions"
-        ],
-        "type": "object"
-      },
-      "autonomy_mode": {
-        "description": "ADR-039 master switch for the action-policing pipeline (autonomy constraints). Required at the top level post-cutover; the legacy `enforcement.mode` location is rejected.",
-        "enum": [
-          "off",
-          "observe",
-          "nudge",
-          "enforce"
-        ],
-        "type": "string"
-      },
-      "capabilities": {
-        "additionalProperties": {
-          "properties": {
-            "description": {
-              "type": "string"
-            },
-            "required_actions": {
-              "items": {
-                "type": "string"
-              },
-              "type": "array"
-            },
-            "tools": {
-              "items": {
-                "type": "string"
-              },
-              "type": "array"
-            }
-          },
-          "type": "object"
-        },
-        "type": "object"
-      },
-      "card_id": {
-        "description": "Card row id. Server-assigned on PUT (`ac-{uuid}`).",
-        "type": "string"
-      },
-      "card_version": {
-        "description": "Card schema version (required, non-empty). Current canonical value: `unified/2026-04-26`.",
-        "minLength": 1,
-        "type": "string"
-      },
-      "conscience": {
-        "properties": {
-          "mode": {
-            "enum": [
-              "augment",
-              "replace"
-            ],
-            "type": "string"
-          },
-          "values": {
-            "items": {
-              "properties": {
-                "content": {
-                  "type": "string"
-                },
-                "id": {
-                  "type": "string"
-                },
-                "severity": {
-                  "enum": [
-                    "advisory",
-                    "mandatory"
-                  ],
-                  "type": "string"
-                },
-                "type": {
-                  "enum": [
-                    "BOUNDARY",
-                    "FEAR",
-                    "COMMITMENT",
-                    "BELIEF",
-                    "HOPE"
-                  ],
-                  "type": "string"
-                }
-              },
-              "required": [
-                "type",
-                "content"
-              ],
-              "type": "object"
-            },
-            "type": "array"
-          }
-        },
-        "required": [
-          "mode",
-          "values"
-        ],
-        "type": "object"
-      },
-      "content_hash": {
-        "description": "Response-only: content hash of the composed card (`sha256:<hex>`), injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-        "type": "string"
-      },
-      "enforcement": {
-        "description": "Optional ADR-039 Decision-3 user-facing knobs for unmapped-tool handling. The legacy `mode`, `unmapped_tool_action` and `fail_open` keys are REJECTED by the validator (mode → top-level autonomy_mode; fail_open → gateway env config).",
-        "properties": {
-          "allow_unmapped_tools": {
-            "description": "When true, tools not mapped to a capability are allowed by default.",
-            "type": "boolean"
-          },
-          "default_unmapped_severity": {
-            "description": "Severity assigned to an unmapped tool when allow_unmapped_tools is false.",
-            "enum": [
-              "low",
-              "medium",
-              "high",
-              "critical"
-            ],
-            "type": "string"
-          },
-          "forbidden_tools": {
-            "items": {
-              "properties": {
-                "pattern": {
-                  "type": "string"
-                },
-                "reason": {
-                  "type": "string"
-                },
-                "severity": {
-                  "enum": [
-                    "critical",
-                    "high",
-                    "medium",
-                    "low"
-                  ],
-                  "type": "string"
-                }
-              },
-              "required": [
-                "pattern",
-                "reason",
-                "severity"
-              ],
-              "type": "object"
-            },
-            "type": "array"
-          },
-          "grace_period_hours": {
-            "type": "integer"
-          }
-        },
-        "type": "object"
-      },
-      "expires_at": {
-        "format": "date-time",
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "extensions": {
-        "additionalProperties": true,
-        "type": "object"
-      },
-      "integrity_mode": {
-        "description": "ADR-039 master switch for the values/conscience pipeline (integrity constraints). Required at the top level post-cutover; the legacy `integrity.enforcement_mode` location is rejected.",
-        "enum": [
-          "off",
-          "observe",
-          "nudge",
-          "enforce"
-        ],
-        "type": "string"
-      },
-      "issued_at": {
-        "format": "date-time",
-        "type": "string"
-      },
-      "principal": {
-        "allOf": [
-          {
-            "if": {
-              "properties": {
-                "type": {
-                  "not": {
-                    "const": "unspecified"
-                  }
-                }
-              }
-            },
-            "then": {
-              "required": [
-                "identifier"
-              ]
-            }
-          }
-        ],
-        "description": "Required object describing whose authority the agent acts under (ADR-039 Decision 10).",
-        "properties": {
-          "escalation_contact": {
-            "type": "string"
-          },
-          "identifier": {
-            "description": "Required (non-empty) when principal.type is not `unspecified`; identifies the human / organization / agent.",
-            "minLength": 1,
-            "type": "string"
-          },
-          "relationship": {
-            "enum": [
-              "delegated_authority",
-              "advisory",
-              "autonomous"
-            ],
-            "type": "string"
-          },
-          "type": {
-            "enum": [
-              "human",
-              "organization",
-              "agent",
-              "unspecified"
-            ],
-            "type": "string"
-          }
-        },
-        "required": [
-          "type",
-          "relationship"
-        ],
-        "type": "object"
-      },
-      "values": {
-        "properties": {
-          "conflicts_with": {
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "declared": {
-            "description": "Ordered list of declared values. Phase 1 cards-as-primitive: each entry is either a catalog-v1 ID string (e.g. `'accuracy'`) or a parameterized map carrying optional `intensity` / `domain` / `severity_on_violation` / `scope` (e.g. `{id: 'accuracy', domain: 'financial', severity_on_violation: 'critical'}`).",
-            "items": {
-              "oneOf": [
-                {
-                  "minLength": 1,
-                  "type": "string"
-                },
-                {
-                  "additionalProperties": {
-                    "type": "string"
-                  },
-                  "properties": {
-                    "id": {
-                      "minLength": 1,
-                      "type": "string"
-                    }
-                  },
-                  "required": [
-                    "id"
-                  ],
-                  "type": "object"
-                }
-              ]
-            },
-            "type": "array"
-          },
-          "definitions": {
-            "additionalProperties": {
-              "properties": {
-                "description": {
-                  "type": "string"
-                },
-                "priority": {
-                  "type": "integer"
-                }
-              },
-              "type": "object"
-            },
-            "type": "object"
-          },
-          "hierarchy": {
-            "enum": [
-              "lexicographic",
-              "weighted",
-              "contextual"
-            ],
-            "type": "string"
-          }
-        },
-        "required": [
-          "declared"
-        ],
-        "type": "object"
-      },
-      "version": {
-        "description": "Response-only: monotonic card version, injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-        "type": "integer"
-      }
-    },
-    "required": [
-      "card_version",
-      "agent_id",
-      "autonomy_mode",
-      "integrity_mode",
-      "values",
-      "autonomy",
-      "audit"
-    ],
-    "type": "object"
-  },
-  "CompositionMetadata": {
-    "description": "System-managed block describing which scope sources merged into the canonical card. Only returned when `?include_composition=true`.",
-    "properties": {
-      "canonical_id": {
-        "type": "string"
-      },
-      "composed_at": {
-        "format": "date-time",
-        "type": "string"
-      },
-      "exemptions_applied": {
-        "items": {
-          "type": "string"
-        },
-        "type": "array"
-      },
-      "scopes_applied": {
-        "items": {
-          "properties": {
-            "card_id": {
-              "type": "string"
-            },
-            "scope": {
-              "description": "`platform`, `org:<id>`, or `agent:<id>`.",
-              "type": "string"
-            },
-            "template_version": {
-              "type": "integer"
-            },
-            "version": {
-              "type": "integer"
-            }
-          },
-          "type": "object"
-        },
-        "type": "array"
-      },
-      "source_card_id": {
-        "type": "string"
-      },
-      "source_policy_id": {
-        "type": "string"
-      }
-    },
-    "type": "object"
-  }
-}

addedOutput schema / additionalProperties
```
Added value: +false
```

removedOutput schema / description

Removed value: -"OUTPUT-only variant of `UnifiedAlignmentCard` for the COMPOSED card the server emits on GET `/v1/alignment/{scope}/{id}`, `/effective`, and the `composed` field of preview-compose. Identical to `UnifiedAlignmentCard` except `principal` is optional (a default / org-scope composed card has no agent principal) and `values.declared` / `autonomy.bounded_actions` may be empty (a fresh card declares nothing yet). The strict `UnifiedAlignmentCard` remains the authoring/request contract."

removedOutput schema / properties / _composition

Removed value: -{
-  "$ref": "#/$defs/CompositionMetadata"
-}

removedOutput schema / properties / agent_id

Removed value: -{
-  "description": "Target agent id. On PUT, server overwrites to match the URL path.",
-  "type": "string"
-}

removedOutput schema / properties / audit

Removed value: -{
-  "allOf": [
-    {
-      "if": {
-        "properties": {
-          "queryable": {
-            "const": true
-          }
-        },
-        "required": [
-          "queryable"
-        ]
-      },
-      "then": {
-        "required": [
-          "query_endpoint"
-        ]
-      }
-    }
-  ],
-  "properties": {
-    "query_endpoint": {
-      "description": "Required when audit.queryable is true.",
-      "type": "string"
-    },
-    "queryable": {
-      "type": "boolean"
-    },
-    "retention_days": {
-      "minimum": 0,
-      "type": "integer"
-    },
-    "storage": {
-      "properties": {
-        "location": {
-          "type": "string"
-        },
-        "type": {
-          "enum": [
-            "local",
-            "remote",
-            "distributed"
-          ],
-          "type": "string"
-        }
-      },
-      "type": "object"
-    },
-    "tamper_evidence": {
-      "enum": [
-        "append_only",
-        "signed",
-        "merkle",
-        null
-      ],
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "trace_format": {
-      "type": "string"
-    }
-  },
-  "required": [
-    "retention_days",
-    "queryable"
-  ],
-  "type": "object"
-}

removedOutput schema / properties / autonomy

Removed value: -{
-  "properties": {
-    "bounded_actions": {
-      "items": {
-        "type": "string"
-      },
-      "type": "array"
-    },
-    "escalation_triggers": {
-      "items": {
-        "properties": {
-          "action": {
-            "enum": [
-              "escalate",
-              "deny",
-              "log"
-            ],
-            "type": "string"
-          },
-          "condition": {
-            "type": "string"
-          },
-          "reason": {
-            "type": "string"
-          }
-        },
-        "required": [
-          "condition",
-          "action",
-          "reason"
-        ],
-        "type": "object"
-      },
-      "type": "array"
-    },
-    "forbidden_actions": {
-      "items": {
-        "type": "string"
-      },
-      "type": "array"
-    },
-    "max_autonomous_value": {
-      "properties": {
-        "amount": {
-          "type": "number"
-        },
-        "currency": {
-          "type": "string"
-        }
-      },
-      "type": "object"
-    }
-  },
-  "required": [
-    "bounded_actions"
-  ],
-  "type": "object"
-}

removedOutput schema / properties / autonomy_mode

Removed value: -{
-  "description": "ADR-039 master switch for the action-policing pipeline (autonomy constraints). Required at the top level post-cutover; the legacy `enforcement.mode` location is rejected.",
-  "enum": [
-    "off",
-    "observe",
-    "nudge",
-    "enforce"
-  ],
-  "type": "string"
-}

removedOutput schema / properties / capabilities

Removed value: -{
-  "additionalProperties": {
-    "properties": {
-      "description": {
-        "type": "string"
-      },
-      "required_actions": {
-        "items": {
-          "type": "string"
-        },
-        "type": "array"
-      },
-      "tools": {
-        "items": {
-          "type": "string"
-        },
-        "type": "array"
-      }
-    },
-    "type": "object"
-  },
-  "type": "object"
-}

changedOutput schema / properties / card_id / description

Previous value: -"Card row id. Server-assigned on PUT (`ac-{uuid}`)."New value: +"Card ID (ac-{uuid}) of the stored alignment card."

addedOutput schema / properties / card_id / pattern

Added value: +"^ac-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"

removedOutput schema / properties / card_version

Removed value: -{
-  "description": "Card schema version (required, non-empty). Current canonical value: `unified/2026-04-26`.",
-  "minLength": 1,
-  "type": "string"
-}

removedOutput schema / properties / conscience

Removed value: -{
-  "properties": {
-    "mode": {
-      "enum": [
-        "augment",
-        "replace"
-      ],
-      "type": "string"
-    },
-    "values": {
-      "items": {
-        "properties": {
-          "content": {
-            "type": "string"
-          },
-          "id": {
-            "type": "string"
-          },
-          "severity": {
-            "enum": [
-              "advisory",
-              "mandatory"
-            ],
-            "type": "string"
-          },
-          "type": {
-            "enum": [
-              "BOUNDARY",
-              "FEAR",
-              "COMMITMENT",
-              "BELIEF",
-              "HOPE"
-            ],
-            "type": "string"
-          }
-        },
-        "required": [
-          "type",
-          "content"
-        ],
-        "type": "object"
-      },
-      "type": "array"
-    }
-  },
-  "required": [
-    "mode",
-    "values"
-  ],
-  "type": "object"
-}

removedOutput schema / properties / content_hash

Removed value: -{
-  "description": "Response-only: content hash of the composed card (`sha256:<hex>`), injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-  "type": "string"
-}

removedOutput schema / properties / enforcement

Removed value: -{
-  "description": "Optional ADR-039 Decision-3 user-facing knobs for unmapped-tool handling. The legacy `mode`, `unmapped_tool_action` and `fail_open` keys are REJECTED by the validator (mode → top-level autonomy_mode; fail_open → gateway env config).",
-  "properties": {
-    "allow_unmapped_tools": {
-      "description": "When true, tools not mapped to a capability are allowed by default.",
-      "type": "boolean"
-    },
-    "default_unmapped_severity": {
-      "description": "Severity assigned to an unmapped tool when allow_unmapped_tools is false.",
-      "enum": [
-        "low",
-        "medium",
-        "high",
-        "critical"
-      ],
-      "type": "string"
-    },
-    "forbidden_tools": {
-      "items": {
-        "properties": {
-          "pattern": {
-            "type": "string"
-          },
-          "reason": {
-            "type": "string"
-          },
-          "severity": {
-            "enum": [
-              "critical",
-              "high",
-              "medium",
-              "low"
-            ],
-            "type": "string"
-          }
-        },
-        "required": [
-          "pattern",
-          "reason",
-          "severity"
-        ],
-        "type": "object"
-      },
-      "type": "array"
-    },
-    "grace_period_hours": {
-      "type": "integer"
-    }
-  },
-  "type": "object"
-}

removedOutput schema / properties / expires_at

Removed value: -{
-  "format": "date-time",
-  "type": [
-    "string",
-    "null"
-  ]
-}

removedOutput schema / properties / extensions

Removed value: -{
-  "additionalProperties": true,
-  "type": "object"
-}

removedOutput schema / properties / integrity_mode

Removed value: -{
-  "description": "ADR-039 master switch for the values/conscience pipeline (integrity constraints). Required at the top level post-cutover; the legacy `integrity.enforcement_mode` location is rejected.",
-  "enum": [
-    "off",
-    "observe",
-    "nudge",
-    "enforce"
-  ],
-  "type": "string"
-}

addedOutput schema / properties / issued_at / description

Added value: +"ISO 8601 timestamp when the card was issued/stored."

addedOutput schema / properties / ok

Added value: +{
+  "const": true,
+  "description": "Always true on successful storage (errors return non-200 status).",
+  "type": "boolean"
+}

removedOutput schema / properties / principal

Removed value: -{
-  "allOf": [
-    {
-      "if": {
-        "properties": {
-          "type": {
-            "not": {
-              "const": "unspecified"
-            }
-          }
-        }
-      },
-      "then": {
-        "required": [
-          "identifier"
-        ]
-      }
-    }
-  ],
-  "description": "Required object describing whose authority the agent acts under (ADR-039 Decision 10).",
-  "properties": {
-    "escalation_contact": {
-      "type": "string"
-    },
-    "identifier": {
-      "description": "Required (non-empty) when principal.type is not `unspecified`; identifies the human / organization / agent.",
-      "minLength": 1,
-      "type": "string"
-    },
-    "relationship": {
-      "enum": [
-        "delegated_authority",
-        "advisory",
-        "autonomous"
-      ],
-      "type": "string"
-    },
-    "type": {
-      "enum": [
-        "human",
-        "organization",
-        "agent",
-        "unspecified"
-      ],
-      "type": "string"
-    }
-  },
-  "required": [
-    "type",
-    "relationship"
-  ],
-  "type": "object"
-}

removedOutput schema / properties / values

Removed value: -{
-  "properties": {
-    "conflicts_with": {
-      "items": {
-        "type": "string"
-      },
-      "type": "array"
-    },
-    "declared": {
-      "description": "Ordered list of declared values. Phase 1 cards-as-primitive: each entry is either a catalog-v1 ID string (e.g. `'accuracy'`) or a parameterized map carrying optional `intensity` / `domain` / `severity_on_violation` / `scope` (e.g. `{id: 'accuracy', domain: 'financial', severity_on_violation: 'critical'}`).",
-      "items": {
-        "oneOf": [
-          {
-            "minLength": 1,
-            "type": "string"
-          },
-          {
-            "additionalProperties": {
-              "type": "string"
-            },
-            "properties": {
-              "id": {
-                "minLength": 1,
-                "type": "string"
-              }
-            },
-            "required": [
-              "id"
-            ],
-            "type": "object"
-          }
-        ]
-      },
-      "type": "array"
-    },
-    "definitions": {
-      "additionalProperties": {
-        "properties": {
-          "description": {
-            "type": "string"
-          },
-          "priority": {
-            "type": "integer"
-          }
-        },
-        "type": "object"
-      },
-      "type": "object"
-    },
-    "hierarchy": {
-      "enum": [
-        "lexicographic",
-        "weighted",
-        "contextual"
-      ],
-      "type": "string"
-    }
-  },
-  "required": [
-    "declared"
-  ],
-  "type": "object"
-}

removedOutput schema / properties / version

Removed value: -{
-  "description": "Response-only: monotonic card version, injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-  "type": "integer"
-}

changedOutput schema / required

Previous value: -[
-  "card_version",
-  "agent_id",
-  "autonomy_mode",
-  "integrity_mode",
-  "values",
-  "autonomy",
-  "audit"
-]New value: +[
+  "card_id",
+  "issued_at",
+  "ok"
+]

Changedput_protection_by_agent34 fields changed

removedInput schema / $defs

Removed value: -{
-  "CompositionMetadata": {
-    "description": "System-managed block describing which scope sources merged into the canonical card. Only returned when `?include_composition=true`.",
-    "properties": {
-      "canonical_id": {
-        "type": "string"
-      },
-      "composed_at": {
-        "format": "date-time",
-        "type": "string"
-      },
-      "exemptions_applied": {
-        "items": {
-          "type": "string"
-        },
-        "type": "array"
-      },
-      "scopes_applied": {
-        "items": {
-          "properties": {
-            "card_id": {
-              "type": "string"
-            },
-            "scope": {
-              "description": "`platform`, `org:<id>`, or `agent:<id>`.",
-              "type": "string"
-            },
-            "template_version": {
-              "type": "integer"
-            },
-            "version": {
-              "type": "integer"
-            }
-          },
-          "type": "object"
-        },
-        "type": "array"
-      },
-      "source_card_id": {
-        "type": "string"
-      },
-      "source_policy_id": {
-        "type": "string"
-      }
-    },
-    "type": "object"
-  },
-  "UnifiedProtectionCard": {
-    "description": "Unified protection card (ADR-037). Safe House thresholds + trusted-source policy for a single agent. Shape matches src/composition/types.ts::UnifiedProtectionCard (canonical) and what the runtime validator at src/composition/validate.ts accepts. The customer-facing docs at /concepts/protection-card and /specifications/protection-card-schema document this same shape.",
-    "properties": {
-      "_composition": {
-        "$ref": "#/$defs/CompositionMetadata"
-      },
-      "agent_id": {
-        "type": "string"
-      },
-      "card_id": {
-        "type": "string"
-      },
-      "card_version": {
-        "type": "string"
-      },
-      "content_hash": {
-        "description": "Response-only: content hash of the composed card (`sha256:<hex>`), injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-        "type": "string"
-      },
-      "expires_at": {
-        "format": "date-time",
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "extensions": {
-        "additionalProperties": true,
-        "description": "Free-form extension slot for non-canonical fields. Ignored by the composer; preserved on read for tooling that needs an audit-tail metadata bag.",
-        "type": "object"
-      },
-      "issued_at": {
-        "format": "date-time",
-        "type": "string"
-      },
-      "mode": {
-        "description": "Strictest-wins composition: enforce > nudge > observe > off.",
-        "enum": [
-          "off",
-          "observe",
-          "nudge",
-          "enforce"
-        ],
-        "type": "string"
-      },
-      "protected_surface": {
-        "description": "Org-declared protected surface policy (MNE-830). Strengthen-only UNION across platform → org → team → agent: each scope may add entries; none may remove. The composer always emits this block; callers omit it to inherit the composed floor. See ADR-037 §protected_surface.",
-        "properties": {
-          "assets": {
-            "description": "Protected assets. Intrinsic identity = `${kind}:${selector}` (normalized). Composer merges by identity, keeping the strictest entry per scope.",
-            "items": {
-              "properties": {
-                "kind": {
-                  "description": "Asset kind (e.g. `row`, `field`, `resource`, `table`).",
-                  "type": "string"
-                },
-                "label": {
-                  "description": "Human-facing display label (optional).",
-                  "type": "string"
-                },
-                "reason": {
-                  "description": "Why this asset is protected (optional).",
-                  "type": "string"
-                },
-                "selector": {
-                  "description": "Asset selector (e.g. `customer:critical-0000`, `replica_dsn`).",
-                  "type": "string"
-                },
-                "source_scope": {
-                  "description": "Composer-assigned provenance (`platform`, `org:<id>`, `team:<id>`, `agent:<id>`). Server-assigned — do not send on a PUT.",
-                  "type": "string"
-                }
-              },
-              "required": [
-                "kind",
-                "selector"
-              ],
-              "type": "object"
-            },
-            "type": "array"
-          },
-          "escalation_required": {
-            "description": "Operations that require escalation before proceeding. Same intrinsic-identity + union rules as forbidden_operations (minus severity).",
-            "items": {
-              "properties": {
-                "applies_to": {
-                  "description": "Asset identities this escalation applies to. Empty/absent = GLOBAL.",
-                  "items": {
-                    "type": "string"
-                  },
-                  "type": "array"
-                },
-                "pattern": {
-                  "description": "Operation pattern requiring escalation.",
-                  "type": "string"
-                },
-                "reason": {
-                  "description": "Why escalation is required (optional).",
-                  "type": "string"
-                },
-                "source_scope": {
-                  "description": "Composer-assigned provenance. Server-assigned — do not send on a PUT.",
-                  "type": "string"
-                }
-              },
-              "required": [
-                "pattern"
-              ],
-              "type": "object"
-            },
-            "type": "array"
-          },
-          "forbidden_operations": {
-            "description": "Operations that are unconditionally forbidden. Intrinsic identity = normalized `pattern`. Composer unions across scopes; on identity collision, severity → max.",
-            "items": {
-              "properties": {
-                "applies_to": {
-                  "description": "Asset identities (`${kind}:${selector}`) this operation applies to. Empty/absent means GLOBAL.",
-                  "items": {
-                    "type": "string"
-                  },
-                  "type": "array"
-                },
-                "pattern": {
-                  "description": "Operation pattern (e.g. `TRUNCATE`, `unscoped UPDATE/DELETE`, `exfiltrate:pii`).",
-                  "type": "string"
-                },
-                "reason": {
-                  "description": "Why this operation is forbidden (optional).",
-                  "type": "string"
-                },
-                "severity": {
-                  "description": "Severity level. Composer merges to strictest across scopes.",
-                  "enum": [
-                    "low",
-                    "medium",
-                    "high",
-                    "critical"
-                  ],
-                  "type": "string"
-                },
-                "source_scope": {
-                  "description": "Composer-assigned provenance. Server-assigned — do not send on a PUT.",
-                  "type": "string"
-                }
-              },
-              "required": [
-                "pattern"
-              ],
-              "type": "object"
-            },
-            "type": "array"
-          }
-        },
-        "type": "object"
-      },
-      "review": {
-        "description": "Review-hold policy (Safe House Review, Slice 2a — MNE-920 design). gate_on is the minimum verdict band per surface that escalates to a review-hold. Composition is strictest-wins; on_timeout defaults to 'reject' (fail-closed). reviewer.kind 'endpoint' is designed for MNE-1650 and not consumed yet.",
-        "properties": {
-          "enabled": {
-            "type": "boolean"
-          },
-          "gate_on": {
-            "properties": {
-              "incoming": {
-                "enum": [
-                  "off",
-                  "warn",
-                  "quarantine",
-                  "block"
-                ],
-                "type": "string"
-              },
-              "integrity": {
-                "enum": [
-                  "off",
-                  "review_needed",
-                  "boundary_violation"
-                ],
-                "type": "string"
-              },
-              "outgoing": {
-                "enum": [
-                  "off",
-                  "warn",
-                  "quarantine",
-                  "block"
-                ],
-                "type": "string"
-              },
-              "tool_calls": {
-                "enum": [
-                  "off",
-                  "warn",
-                  "quarantine",
-                  "block"
-                ],
-                "type": "string"
-              },
-              "tool_responses": {
-                "enum": [
-                  "off",
-                  "warn",
-                  "quarantine",
-                  "block"
-                ],
-                "type": "string"
-              }
-            },
-            "type": "object"
-          },
-          "notify": {
-            "properties": {
-              "sse": {
-                "type": "boolean"
-              },
-              "webhooks": {
-                "type": "boolean"
-              }
-            },
-            "type": "object"
-          },
-          "on_timeout": {
-            "enum": [
-              "reject",
-              "release"
-            ],
-            "type": "string"
-          },
-          "quarantine_notice": {
-            "maxLength": 2000,
-            "type": "string"
-          },
-          "reviewer": {
-            "properties": {
-              "endpoint_url": {
-                "format": "uri",
-                "type": "string"
-              },
-              "kind": {
-                "enum": [
-                  "builtin_opus",
-                  "endpoint"
-                ],
-                "type": "string"
-              }
-            },
-            "required": [
-              "kind"
-            ],
-            "type": "object"
-          },
-          "sla_seconds": {
-            "minimum": 1,
-            "type": "number"
-          }
-        },
-        "required": [
-          "enabled"
-        ],
-        "type": "object"
-      },
-      "screen_surfaces": {
-        "description": "Which request surfaces Safe House inspects. Composed across scopes by OR-per-field (any scope requiring inspection wins).",
-        "properties": {
-          "incoming": {
-            "description": "The user/principal prompt entering the agent.",
-            "type": "boolean"
-          },
-          "outgoing": {
-            "description": "The agent's response leaving the agent.",
-            "type": "boolean"
-          },
-          "tool_calls": {
-            "description": "Tool-use invocations the agent makes.",
-            "type": "boolean"
-          },
-          "tool_responses": {
-            "description": "Responses to tool calls returning to the agent.",
-            "type": "boolean"
-          }
-        },
-        "required": [
-          "incoming",
-          "outgoing",
-          "tool_calls",
-          "tool_responses"
-        ],
-        "type": "object"
-      },
-      "thresholds": {
-        "description": "Score bands. Must satisfy warn <= quarantine <= block; each value in [0, 1].",
-        "properties": {
-          "block": {
-            "maximum": 1,
-            "minimum": 0,
-            "type": "number"
-          },
-          "quarantine": {
-            "maximum": 1,
-            "minimum": 0,
-            "type": "number"
-          },
-          "warn": {
-            "maximum": 1,
-            "minimum": 0,
-            "type": "number"
-          }
-        },
-        "required": [
-          "warn",
-          "quarantine",
-          "block"
-        ],
-        "type": "object"
-      },
-      "trusted_sources": {
-        "description": "Sources for which detectors short-circuit (each match logged in the trace). Composed as platform->agent intersection (compliance ceiling) with org+agent union inside that ceiling — an agent cannot widen trust beyond what the platform allows.",
-        "properties": {
-          "agent_ids": {
-            "description": "Mnemom agent IDs (mnm-* / smolt-* prefixed).",
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "domains": {
-            "description": "DNS names or host:port entries.",
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "ip_ranges": {
-            "description": "IPv4 or IPv6 CIDR ranges.",
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          }
-        },
-        "required": [
-          "domains",
-          "agent_ids",
-          "ip_ranges"
-        ],
-        "type": "object"
-      },
-      "version": {
-        "description": "Response-only: monotonic card version, injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-        "type": "integer"
-      }
-    },
-    "required": [
-      "card_version",
-      "agent_id",
-      "mode",
-      "thresholds",
-      "screen_surfaces",
-      "trusted_sources"
-    ],
-    "type": "object"
-  }
-}

changedInput schema / properties / agent_id / description

Previous value: -"Agent identifier (e.g. smolt-abc123)"New value: +"The agent this card belongs to (e.g. `smolt-abc123`). Identifier only — never place an API key, a secret, an email address, or any other personal data in this field."

addedInput schema / properties / agent_id / maxLength
```
Added value: +64
```
addedInput schema / properties / agent_id / minLength
```
Added value: +3
```

addedInput schema / properties / agent_id / pattern

Added value: +"^[A-Za-z0-9][A-Za-z0-9_-]{1,62}[A-Za-z0-9]$"

removedInput schema / properties / body

Removed value: -{
-  "description": "Unified protection card (ADR-037). Safe House thresholds + trusted-source policy for a single agent. Shape matches src/composition/types.ts::UnifiedProtectionCard (canonical) and what the runtime validator at src/composition/validate.ts accepts. The customer-facing docs at /concepts/protection-card and /specifications/protection-card-schema document this same shape.",
-  "properties": {
-    "_composition": {
-      "$ref": "#/$defs/CompositionMetadata"
-    },
-    "agent_id": {
-      "type": "string"
-    },
-    "card_id": {
-      "type": "string"
-    },
-    "card_version": {
-      "type": "string"
-    },
-    "content_hash": {
-      "description": "Response-only: content hash of the composed card (`sha256:<hex>`), injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-      "type": "string"
-    },
-    "expires_at": {
-      "format": "date-time",
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "extensions": {
-      "additionalProperties": true,
-      "description": "Free-form extension slot for non-canonical fields. Ignored by the composer; preserved on read for tooling that needs an audit-tail metadata bag.",
-      "type": "object"
-    },
-    "issued_at": {
-      "format": "date-time",
-      "type": "string"
-    },
-    "mode": {
-      "description": "Strictest-wins composition: enforce > nudge > observe > off.",
-      "enum": [
-        "off",
-        "observe",
-        "nudge",
-        "enforce"
-      ],
-      "type": "string"
-    },
-    "protected_surface": {
-      "description": "Org-declared protected surface policy (MNE-830). Strengthen-only UNION across platform → org → team → agent: each scope may add entries; none may remove. The composer always emits this block; callers omit it to inherit the composed floor. See ADR-037 §protected_surface.",
-      "properties": {
-        "assets": {
-          "description": "Protected assets. Intrinsic identity = `${kind}:${selector}` (normalized). Composer merges by identity, keeping the strictest entry per scope.",
-          "items": {
-            "properties": {
-              "kind": {
-                "description": "Asset kind (e.g. `row`, `field`, `resource`, `table`).",
-                "type": "string"
-              },
-              "label": {
-                "description": "Human-facing display label (optional).",
-                "type": "string"
-              },
-              "reason": {
-                "description": "Why this asset is protected (optional).",
-                "type": "string"
-              },
-              "selector": {
-                "description": "Asset selector (e.g. `customer:critical-0000`, `replica_dsn`).",
-                "type": "string"
-              },
-              "source_scope": {
-                "description": "Composer-assigned provenance (`platform`, `org:<id>`, `team:<id>`, `agent:<id>`). Server-assigned — do not send on a PUT.",
-                "type": "string"
-              }
-            },
-            "required": [
-              "kind",
-              "selector"
-            ],
-            "type": "object"
-          },
-          "type": "array"
-        },
-        "escalation_required": {
-          "description": "Operations that require escalation before proceeding. Same intrinsic-identity + union rules as forbidden_operations (minus severity).",
-          "items": {
-            "properties": {
-              "applies_to": {
-                "description": "Asset identities this escalation applies to. Empty/absent = GLOBAL.",
-                "items": {
-                  "type": "string"
-                },
-                "type": "array"
-              },
-              "pattern": {
-                "description": "Operation pattern requiring escalation.",
-                "type": "string"
-              },
-              "reason": {
-                "description": "Why escalation is required (optional).",
-                "type": "string"
-              },
-              "source_scope": {
-                "description": "Composer-assigned provenance. Server-assigned — do not send on a PUT.",
-                "type": "string"
-              }
-            },
-            "required": [
-              "pattern"
-            ],
-            "type": "object"
-          },
-          "type": "array"
-        },
-        "forbidden_operations": {
-          "description": "Operations that are unconditionally forbidden. Intrinsic identity = normalized `pattern`. Composer unions across scopes; on identity collision, severity → max.",
-          "items": {
-            "properties": {
-              "applies_to": {
-                "description": "Asset identities (`${kind}:${selector}`) this operation applies to. Empty/absent means GLOBAL.",
-                "items": {
-                  "type": "string"
-                },
-                "type": "array"
-              },
-              "pattern": {
-                "description": "Operation pattern (e.g. `TRUNCATE`, `unscoped UPDATE/DELETE`, `exfiltrate:pii`).",
-                "type": "string"
-              },
-              "reason": {
-                "description": "Why this operation is forbidden (optional).",
-                "type": "string"
-              },
-              "severity": {
-                "description": "Severity level. Composer merges to strictest across scopes.",
-                "enum": [
-                  "low",
-                  "medium",
-                  "high",
-                  "critical"
-                ],
-                "type": "string"
-              },
-              "source_scope": {
-                "description": "Composer-assigned provenance. Server-assigned — do not send on a PUT.",
-                "type": "string"
-              }
-            },
-            "required": [
-              "pattern"
-            ],
-            "type": "object"
-          },
-          "type": "array"
-        }
-      },
-      "type": "object"
-    },
-    "review": {
-      "description": "Review-hold policy (Safe House Review, Slice 2a — MNE-920 design). gate_on is the minimum verdict band per surface that escalates to a review-hold. Composition is strictest-wins; on_timeout defaults to 'reject' (fail-closed). reviewer.kind 'endpoint' is designed for MNE-1650 and not consumed yet.",
-      "properties": {
-        "enabled": {
-          "type": "boolean"
-        },
-        "gate_on": {
-          "properties": {
-            "incoming": {
-              "enum": [
-                "off",
-                "warn",
-                "quarantine",
-                "block"
-              ],
-              "type": "string"
-            },
-            "integrity": {
-              "enum": [
-                "off",
-                "review_needed",
-                "boundary_violation"
-              ],
-              "type": "string"
-            },
-            "outgoing": {
-              "enum": [
-                "off",
-                "warn",
-                "quarantine",
-                "block"
-              ],
-              "type": "string"
-            },
-            "tool_calls": {
-              "enum": [
-                "off",
-                "warn",
-                "quarantine",
-                "block"
-              ],
-              "type": "string"
-            },
-            "tool_responses": {
-              "enum": [
-                "off",
-                "warn",
-                "quarantine",
-                "block"
-              ],
-              "type": "string"
-            }
-          },
-          "type": "object"
-        },
-        "notify": {
-          "properties": {
-            "sse": {
-              "type": "boolean"
-            },
-            "webhooks": {
-              "type": "boolean"
-            }
-          },
-          "type": "object"
-        },
-        "on_timeout": {
-          "enum": [
-            "reject",
-            "release"
-          ],
-          "type": "string"
-        },
-        "quarantine_notice": {
-          "maxLength": 2000,
-          "type": "string"
-        },
-        "reviewer": {
-          "properties": {
-            "endpoint_url": {
-              "format": "uri",
-              "type": "string"
-            },
-            "kind": {
-              "enum": [
-                "builtin_opus",
-                "endpoint"
-              ],
-              "type": "string"
-            }
-          },
-          "required": [
-            "kind"
-          ],
-          "type": "object"
-        },
-        "sla_seconds": {
-          "minimum": 1,
-          "type": "number"
-        }
-      },
-      "required": [
-        "enabled"
-      ],
-      "type": "object"
-    },
-    "screen_surfaces": {
-      "description": "Which request surfaces Safe House inspects. Composed across scopes by OR-per-field (any scope requiring inspection wins).",
-      "properties": {
-        "incoming": {
-          "description": "The user/principal prompt entering the agent.",
-          "type": "boolean"
-        },
-        "outgoing": {
-          "description": "The agent's response leaving the agent.",
-          "type": "boolean"
-        },
-        "tool_calls": {
-          "description": "Tool-use invocations the agent makes.",
-          "type": "boolean"
-        },
-        "tool_responses": {
-          "description": "Responses to tool calls returning to the agent.",
-          "type": "boolean"
-        }
-      },
-      "required": [
-        "incoming",
-        "outgoing",
-        "tool_calls",
-        "tool_responses"
-      ],
-      "type": "object"
-    },
-    "thresholds": {
-      "description": "Score bands. Must satisfy warn <= quarantine <= block; each value in [0, 1].",
-      "properties": {
-        "block": {
-          "maximum": 1,
-          "minimum": 0,
-          "type": "number"
-        },
-        "quarantine": {
-          "maximum": 1,
-          "minimum": 0,
-          "type": "number"
-        },
-        "warn": {
-          "maximum": 1,
-          "minimum": 0,
-          "type": "number"
-        }
-      },
-      "required": [
-        "warn",
-        "quarantine",
-        "block"
-      ],
-      "type": "object"
-    },
-    "trusted_sources": {
-      "description": "Sources for which detectors short-circuit (each match logged in the trace). Composed as platform->agent intersection (compliance ceiling) with org+agent union inside that ceiling — an agent cannot widen trust beyond what the platform allows.",
-      "properties": {
-        "agent_ids": {
-          "description": "Mnemom agent IDs (mnm-* / smolt-* prefixed).",
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "domains": {
-          "description": "DNS names or host:port entries.",
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "ip_ranges": {
-          "description": "IPv4 or IPv6 CIDR ranges.",
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        }
-      },
-      "required": [
-        "domains",
-        "agent_ids",
-        "ip_ranges"
-      ],
-      "type": "object"
-    },
-    "version": {
-      "description": "Response-only: monotonic card version, injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-      "type": "integer"
-    }
-  },
-  "required": [
-    "card_version",
-    "agent_id",
-    "mode",
-    "thresholds",
-    "screen_surfaces",
-    "trusted_sources"
-  ],
-  "type": "object"
-}

addedInput schema / properties / card_version

Added value: +{
+  "description": "Card schema version. REQUIRED by the server-side validator. Current canonical value: `protection/2026-04-26`.",
+  "maxLength": 40,
+  "minLength": 3,
+  "pattern": "^[A-Za-z0-9][A-Za-z0-9._/-]{1,38}[A-Za-z0-9]$",
+  "type": "string"
+}

addedInput schema / properties / mode

Added value: +{
+  "description": "Screening mode for the protection pipeline. Required. `off` disables screening; `observe` records only; `nudge` warns; `enforce` blocks.",
+  "enum": [
+    "off",
+    "observe",
+    "nudge",
+    "enforce"
+  ],
+  "type": "string"
+}

addedInput schema / properties / protected_surface

Added value: +{
+  "additionalProperties": false,
+  "description": "The assets and operations this agent must protect. Omit to accept the composed default (empty surface).",
+  "properties": {
+    "assets": {
+      "description": "The assets under protection.",
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "kind": {
+            "description": "Asset class — e.g. \"repo\", \"database\", \"bucket\".",
+            "maxLength": 64,
+            "minLength": 1,
+            "type": "string"
+          },
+          "label": {
+            "description": "Short human-readable name for the asset.",
+            "maxLength": 120,
+            "minLength": 1,
+            "type": "string"
+          },
+          "reason": {
+            "description": "Why it is protected, in one short sentence. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization.",
+            "maxLength": 200,
+            "minLength": 1,
+            "type": "string"
+          },
+          "selector": {
+            "description": "Which instance — e.g. \"mnemom/mnemom-api\". A resource identifier only: no credentials, no connection strings, no personal data.",
+            "maxLength": 256,
+            "minLength": 1,
+            "type": "string"
+          }
+        },
+        "required": [
+          "kind",
+          "selector"
+        ],
+        "type": "object"
+      },
+      "maxItems": 64,
+      "type": "array"
+    },
+    "escalation_required": {
+      "description": "Operations that require human approval before the agent may proceed.",
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "applies_to": {
+            "description": "Asset identities this entry applies to. Omit to apply to every protected asset.",
+            "items": {
+              "maxLength": 256,
+              "minLength": 1,
+              "type": "string"
+            },
+            "maxItems": 64,
+            "type": "array"
+          },
+          "pattern": {
+            "description": "Operation matcher — e.g. \"force_push\", \"drop_table*\". A short pattern, not a description.",
+            "maxLength": 200,
+            "minLength": 1,
+            "type": "string"
+          },
+          "reason": {
+            "description": "Why this entry exists, in one short sentence. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization.",
+            "maxLength": 200,
+            "minLength": 1,
+            "type": "string"
+          }
+        },
+        "required": [
+          "pattern"
+        ],
+        "type": "object"
+      },
+      "maxItems": 64,
+      "type": "array"
+    },
+    "forbidden_operations": {
+      "description": "Operations the agent must never perform on the protected assets.",
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "applies_to": {
+            "description": "Asset identities this entry applies to. Omit to apply to every protected asset.",
+            "items": {
+              "maxLength": 256,
+              "minLength": 1,
+              "type": "string"
+            },
+            "maxItems": 64,
+            "type": "array"
+          },
+          "pattern": {
+            "description": "Operation matcher — e.g. \"force_push\", \"drop_table*\". A short pattern, not a description.",
+            "maxLength": 200,
+            "minLength": 1,
+            "type": "string"
+          },
+          "reason": {
+            "description": "Why this entry exists, in one short sentence. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization.",
+            "maxLength": 200,
+            "minLength": 1,
+            "type": "string"
+          },
+          "severity": {
+            "description": "How serious a violation of this entry is.",
+            "enum": [
+              "low",
+              "medium",
+              "high",
+              "critical"
+            ],
+            "type": "string"
+          }
+        },
+        "required": [
+          "pattern"
+        ],
+        "type": "object"
+      },
+      "maxItems": 64,
+      "type": "array"
+    }
+  },
+  "type": "object"
+}

addedInput schema / properties / screen_surfaces

Added value: +{
+  "additionalProperties": false,
+  "description": "Which traffic surfaces are screened. Omit to accept the composed defaults.",
+  "properties": {
+    "incoming": {
+      "description": "Screen prompts arriving at the agent.",
+      "type": "boolean"
+    },
+    "outgoing": {
+      "description": "Screen the agent's outbound messages.",
+      "type": "boolean"
+    },
+    "tool_calls": {
+      "description": "Screen the tool calls the agent makes.",
+      "type": "boolean"
+    },
+    "tool_responses": {
+      "description": "Screen tool responses returned to the agent.",
+      "type": "boolean"
+    }
+  },
+  "type": "object"
+}

addedInput schema / properties / thresholds

Added value: +{
+  "additionalProperties": false,
+  "description": "Risk-score cutoffs, each in [0, 1] and ordered warn ≤ quarantine ≤ block. All three are required if this object is sent at all — omit the whole object to accept the composed defaults.",
+  "properties": {
+    "block": {
+      "description": "Score at or above which the request is refused.",
+      "maximum": 1,
+      "minimum": 0,
+      "type": "number"
+    },
+    "quarantine": {
+      "description": "Score at or above which the request is held for review.",
+      "maximum": 1,
+      "minimum": 0,
+      "type": "number"
+    },
+    "warn": {
+      "description": "Score at or above which the request is flagged.",
+      "maximum": 1,
+      "minimum": 0,
+      "type": "number"
+    }
+  },
+  "required": [
+    "warn",
+    "quarantine",
+    "block"
+  ],
+  "type": "object"
+}

addedInput schema / properties / trusted_sources

Added value: +{
+  "additionalProperties": false,
+  "description": "Sources exempt from screening. Enumerate specific hosts — wildcards are rejected, and a server-side deny-list (public LLM/DNS endpoints, 0.0.0.0/0, ::/0, link-local, multicast) is always applied.",
+  "properties": {
+    "agent_ids": {
+      "description": "Trusted Mnemom agent IDs. Must be in canonical `mnm-*` form.",
+      "items": {
+        "maxLength": 64,
+        "minLength": 8,
+        "pattern": "^mnm-[A-Za-z0-9-]{4,}$",
+        "type": "string"
+      },
+      "maxItems": 64,
+      "type": "array"
+    },
+    "domains": {
+      "description": "Trusted DNS names, optionally with `:port`. No wildcards.",
+      "items": {
+        "maxLength": 253,
+        "minLength": 3,
+        "type": "string"
+      },
+      "maxItems": 64,
+      "type": "array"
+    },
+    "ip_ranges": {
+      "description": "Trusted CIDR ranges (e.g. `10.0.0.0/8`).",
+      "items": {
+        "maxLength": 43,
+        "minLength": 4,
+        "type": "string"
+      },
+      "maxItems": 64,
+      "type": "array"
+    }
+  },
+  "type": "object"
+}

changedInput schema / required

Previous value: -[
-  "agent_id"
-]New value: +[
+  "agent_id",
+  "card_version",
+  "mode"
+]

removedOutput schema / $defs

Removed value: -{
-  "CompositionMetadata": {
-    "description": "System-managed block describing which scope sources merged into the canonical card. Only returned when `?include_composition=true`.",
-    "properties": {
-      "canonical_id": {
-        "type": "string"
-      },
-      "composed_at": {
-        "format": "date-time",
-        "type": "string"
-      },
-      "exemptions_applied": {
-        "items": {
-          "type": "string"
-        },
-        "type": "array"
-      },
-      "scopes_applied": {
-        "items": {
-          "properties": {
-            "card_id": {
-              "type": "string"
-            },
-            "scope": {
-              "description": "`platform`, `org:<id>`, or `agent:<id>`.",
-              "type": "string"
-            },
-            "template_version": {
-              "type": "integer"
-            },
-            "version": {
-              "type": "integer"
-            }
-          },
-          "type": "object"
-        },
-        "type": "array"
-      },
-      "source_card_id": {
-        "type": "string"
-      },
-      "source_policy_id": {
-        "type": "string"
-      }
-    },
-    "type": "object"
-  },
-  "UnifiedProtectionCard": {
-    "description": "Unified protection card (ADR-037). Safe House thresholds + trusted-source policy for a single agent. Shape matches src/composition/types.ts::UnifiedProtectionCard (canonical) and what the runtime validator at src/composition/validate.ts accepts. The customer-facing docs at /concepts/protection-card and /specifications/protection-card-schema document this same shape.",
-    "properties": {
-      "_composition": {
-        "$ref": "#/$defs/CompositionMetadata"
-      },
-      "agent_id": {
-        "type": "string"
-      },
-      "card_id": {
-        "type": "string"
-      },
-      "card_version": {
-        "type": "string"
-      },
-      "content_hash": {
-        "description": "Response-only: content hash of the composed card (`sha256:<hex>`), injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-        "type": "string"
-      },
-      "expires_at": {
-        "format": "date-time",
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "extensions": {
-        "additionalProperties": true,
-        "description": "Free-form extension slot for non-canonical fields. Ignored by the composer; preserved on read for tooling that needs an audit-tail metadata bag.",
-        "type": "object"
-      },
-      "issued_at": {
-        "format": "date-time",
-        "type": "string"
-      },
-      "mode": {
-        "description": "Strictest-wins composition: enforce > nudge > observe > off.",
-        "enum": [
-          "off",
-          "observe",
-          "nudge",
-          "enforce"
-        ],
-        "type": "string"
-      },
-      "protected_surface": {
-        "description": "Org-declared protected surface policy (MNE-830). Strengthen-only UNION across platform → org → team → agent: each scope may add entries; none may remove. The composer always emits this block; callers omit it to inherit the composed floor. See ADR-037 §protected_surface.",
-        "properties": {
-          "assets": {
-            "description": "Protected assets. Intrinsic identity = `${kind}:${selector}` (normalized). Composer merges by identity, keeping the strictest entry per scope.",
-            "items": {
-              "properties": {
-                "kind": {
-                  "description": "Asset kind (e.g. `row`, `field`, `resource`, `table`).",
-                  "type": "string"
-                },
-                "label": {
-                  "description": "Human-facing display label (optional).",
-                  "type": "string"
-                },
-                "reason": {
-                  "description": "Why this asset is protected (optional).",
-                  "type": "string"
-                },
-                "selector": {
-                  "description": "Asset selector (e.g. `customer:critical-0000`, `replica_dsn`).",
-                  "type": "string"
-                },
-                "source_scope": {
-                  "description": "Composer-assigned provenance (`platform`, `org:<id>`, `team:<id>`, `agent:<id>`). Server-assigned — do not send on a PUT.",
-                  "type": "string"
-                }
-              },
-              "required": [
-                "kind",
-                "selector"
-              ],
-              "type": "object"
-            },
-            "type": "array"
-          },
-          "escalation_required": {
-            "description": "Operations that require escalation before proceeding. Same intrinsic-identity + union rules as forbidden_operations (minus severity).",
-            "items": {
-              "properties": {
-                "applies_to": {
-                  "description": "Asset identities this escalation applies to. Empty/absent = GLOBAL.",
-                  "items": {
-                    "type": "string"
-                  },
-                  "type": "array"
-                },
-                "pattern": {
-                  "description": "Operation pattern requiring escalation.",
-                  "type": "string"
-                },
-                "reason": {
-                  "description": "Why escalation is required (optional).",
-                  "type": "string"
-                },
-                "source_scope": {
-                  "description": "Composer-assigned provenance. Server-assigned — do not send on a PUT.",
-                  "type": "string"
-                }
-              },
-              "required": [
-                "pattern"
-              ],
-              "type": "object"
-            },
-            "type": "array"
-          },
-          "forbidden_operations": {
-            "description": "Operations that are unconditionally forbidden. Intrinsic identity = normalized `pattern`. Composer unions across scopes; on identity collision, severity → max.",
-            "items": {
-              "properties": {
-                "applies_to": {
-                  "description": "Asset identities (`${kind}:${selector}`) this operation applies to. Empty/absent means GLOBAL.",
-                  "items": {
-                    "type": "string"
-                  },
-                  "type": "array"
-                },
-                "pattern": {
-                  "description": "Operation pattern (e.g. `TRUNCATE`, `unscoped UPDATE/DELETE`, `exfiltrate:pii`).",
-                  "type": "string"
-                },
-                "reason": {
-                  "description": "Why this operation is forbidden (optional).",
-                  "type": "string"
-                },
-                "severity": {
-                  "description": "Severity level. Composer merges to strictest across scopes.",
-                  "enum": [
-                    "low",
-                    "medium",
-                    "high",
-                    "critical"
-                  ],
-                  "type": "string"
-                },
-                "source_scope": {
-                  "description": "Composer-assigned provenance. Server-assigned — do not send on a PUT.",
-                  "type": "string"
-                }
-              },
-              "required": [
-                "pattern"
-              ],
-              "type": "object"
-            },
-            "type": "array"
-          }
-        },
-        "type": "object"
-      },
-      "review": {
-        "description": "Review-hold policy (Safe House Review, Slice 2a — MNE-920 design). gate_on is the minimum verdict band per surface that escalates to a review-hold. Composition is strictest-wins; on_timeout defaults to 'reject' (fail-closed). reviewer.kind 'endpoint' is designed for MNE-1650 and not consumed yet.",
-        "properties": {
-          "enabled": {
-            "type": "boolean"
-          },
-          "gate_on": {
-            "properties": {
-              "incoming": {
-                "enum": [
-                  "off",
-                  "warn",
-                  "quarantine",
-                  "block"
-                ],
-                "type": "string"
-              },
-              "integrity": {
-                "enum": [
-                  "off",
-                  "review_needed",
-                  "boundary_violation"
-                ],
-                "type": "string"
-              },
-              "outgoing": {
-                "enum": [
-                  "off",
-                  "warn",
-                  "quarantine",
-                  "block"
-                ],
-                "type": "string"
-              },
-              "tool_calls": {
-                "enum": [
-                  "off",
-                  "warn",
-                  "quarantine",
-                  "block"
-                ],
-                "type": "string"
-              },
-              "tool_responses": {
-                "enum": [
-                  "off",
-                  "warn",
-                  "quarantine",
-                  "block"
-                ],
-                "type": "string"
-              }
-            },
-            "type": "object"
-          },
-          "notify": {
-            "properties": {
-              "sse": {
-                "type": "boolean"
-              },
-              "webhooks": {
-                "type": "boolean"
-              }
-            },
-            "type": "object"
-          },
-          "on_timeout": {
-            "enum": [
-              "reject",
-              "release"
-            ],
-            "type": "string"
-          },
-          "quarantine_notice": {
-            "maxLength": 2000,
-            "type": "string"
-          },
-          "reviewer": {
-            "properties": {
-              "endpoint_url": {
-                "format": "uri",
-                "type": "string"
-              },
-              "kind": {
-                "enum": [
-                  "builtin_opus",
-                  "endpoint"
-                ],
-                "type": "string"
-              }
-            },
-            "required": [
-              "kind"
-            ],
-            "type": "object"
-          },
-          "sla_seconds": {
-            "minimum": 1,
-            "type": "number"
-          }
-        },
-        "required": [
-          "enabled"
-        ],
-        "type": "object"
-      },
-      "screen_surfaces": {
-        "description": "Which request surfaces Safe House inspects. Composed across scopes by OR-per-field (any scope requiring inspection wins).",
-        "properties": {
-          "incoming": {
-            "description": "The user/principal prompt entering the agent.",
-            "type": "boolean"
-          },
-          "outgoing": {
-            "description": "The agent's response leaving the agent.",
-            "type": "boolean"
-          },
-          "tool_calls": {
-            "description": "Tool-use invocations the agent makes.",
-            "type": "boolean"
-          },
-          "tool_responses": {
-            "description": "Responses to tool calls returning to the agent.",
-            "type": "boolean"
-          }
-        },
-        "required": [
-          "incoming",
-          "outgoing",
-          "tool_calls",
-          "tool_responses"
-        ],
-        "type": "object"
-      },
-      "thresholds": {
-        "description": "Score bands. Must satisfy warn <= quarantine <= block; each value in [0, 1].",
-        "properties": {
-          "block": {
-            "maximum": 1,
-            "minimum": 0,
-            "type": "number"
-          },
-          "quarantine": {
-            "maximum": 1,
-            "minimum": 0,
-            "type": "number"
-          },
-          "warn": {
-            "maximum": 1,
-            "minimum": 0,
-            "type": "number"
-          }
-        },
-        "required": [
-          "warn",
-          "quarantine",
-          "block"
-        ],
-        "type": "object"
-      },
-      "trusted_sources": {
-        "description": "Sources for which detectors short-circuit (each match logged in the trace). Composed as platform->agent intersection (compliance ceiling) with org+agent union inside that ceiling — an agent cannot widen trust beyond what the platform allows.",
-        "properties": {
-          "agent_ids": {
-            "description": "Mnemom agent IDs (mnm-* / smolt-* prefixed).",
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "domains": {
-            "description": "DNS names or host:port entries.",
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "ip_ranges": {
-            "description": "IPv4 or IPv6 CIDR ranges.",
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          }
-        },
-        "required": [
-          "domains",
-          "agent_ids",
-          "ip_ranges"
-        ],
-        "type": "object"
-      },
-      "version": {
-        "description": "Response-only: monotonic card version, injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-        "type": "integer"
-      }
-    },
-    "required": [
-      "card_version",
-      "agent_id",
-      "mode",
-      "thresholds",
-      "screen_surfaces",
-      "trusted_sources"
-    ],
-    "type": "object"
-  }
-}

addedOutput schema / additionalProperties
```
Added value: +false
```

removedOutput schema / description

Removed value: -"Unified protection card (ADR-037). Safe House thresholds + trusted-source policy for a single agent. Shape matches src/composition/types.ts::UnifiedProtectionCard (canonical) and what the runtime validator at src/composition/validate.ts accepts. The customer-facing docs at /concepts/protection-card and /specifications/protection-card-schema document this same shape."

removedOutput schema / properties / _composition

Removed value: -{
-  "$ref": "#/$defs/CompositionMetadata"
-}

removedOutput schema / properties / agent_id
```
Removed value: -{
-  "type": "string"
-}
```

addedOutput schema / properties / card_id / description

Added value: +"Card ID (pc-{uuid}) of the stored protection card."

addedOutput schema / properties / card_id / pattern

Added value: +"^pc-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"

removedOutput schema / properties / card_version
```
Removed value: -{
-  "type": "string"
-}
```

removedOutput schema / properties / content_hash

Removed value: -{
-  "description": "Response-only: content hash of the composed card (`sha256:<hex>`), injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-  "type": "string"
-}

removedOutput schema / properties / expires_at

Removed value: -{
-  "format": "date-time",
-  "type": [
-    "string",
-    "null"
-  ]
-}

removedOutput schema / properties / extensions

Removed value: -{
-  "additionalProperties": true,
-  "description": "Free-form extension slot for non-canonical fields. Ignored by the composer; preserved on read for tooling that needs an audit-tail metadata bag.",
-  "type": "object"
-}

addedOutput schema / properties / issued_at / description

Added value: +"ISO 8601 timestamp when the card was issued/stored."

removedOutput schema / properties / mode

Removed value: -{
-  "description": "Strictest-wins composition: enforce > nudge > observe > off.",
-  "enum": [
-    "off",
-    "observe",
-    "nudge",
-    "enforce"
-  ],
-  "type": "string"
-}

addedOutput schema / properties / ok

Added value: +{
+  "const": true,
+  "description": "Always true on successful storage (errors return non-200 status).",
+  "type": "boolean"
+}

removedOutput schema / properties / protected_surface

Removed value: -{
-  "description": "Org-declared protected surface policy (MNE-830). Strengthen-only UNION across platform → org → team → agent: each scope may add entries; none may remove. The composer always emits this block; callers omit it to inherit the composed floor. See ADR-037 §protected_surface.",
-  "properties": {
-    "assets": {
-      "description": "Protected assets. Intrinsic identity = `${kind}:${selector}` (normalized). Composer merges by identity, keeping the strictest entry per scope.",
-      "items": {
-        "properties": {
-          "kind": {
-            "description": "Asset kind (e.g. `row`, `field`, `resource`, `table`).",
-            "type": "string"
-          },
-          "label": {
-            "description": "Human-facing display label (optional).",
-            "type": "string"
-          },
-          "reason": {
-            "description": "Why this asset is protected (optional).",
-            "type": "string"
-          },
-          "selector": {
-            "description": "Asset selector (e.g. `customer:critical-0000`, `replica_dsn`).",
-            "type": "string"
-          },
-          "source_scope": {
-            "description": "Composer-assigned provenance (`platform`, `org:<id>`, `team:<id>`, `agent:<id>`). Server-assigned — do not send on a PUT.",
-            "type": "string"
-          }
-        },
-        "required": [
-          "kind",
-          "selector"
-        ],
-        "type": "object"
-      },
-      "type": "array"
-    },
-    "escalation_required": {
-      "description": "Operations that require escalation before proceeding. Same intrinsic-identity + union rules as forbidden_operations (minus severity).",
-      "items": {
-        "properties": {
-          "applies_to": {
-            "description": "Asset identities this escalation applies to. Empty/absent = GLOBAL.",
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "pattern": {
-            "description": "Operation pattern requiring escalation.",
-            "type": "string"
-          },
-          "reason": {
-            "description": "Why escalation is required (optional).",
-            "type": "string"
-          },
-          "source_scope": {
-            "description": "Composer-assigned provenance. Server-assigned — do not send on a PUT.",
-            "type": "string"
-          }
-        },
-        "required": [
-          "pattern"
-        ],
-        "type": "object"
-      },
-      "type": "array"
-    },
-    "forbidden_operations": {
-      "description": "Operations that are unconditionally forbidden. Intrinsic identity = normalized `pattern`. Composer unions across scopes; on identity collision, severity → max.",
-      "items": {
-        "properties": {
-          "applies_to": {
-            "description": "Asset identities (`${kind}:${selector}`) this operation applies to. Empty/absent means GLOBAL.",
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "pattern": {
-            "description": "Operation pattern (e.g. `TRUNCATE`, `unscoped UPDATE/DELETE`, `exfiltrate:pii`).",
-            "type": "string"
-          },
-          "reason": {
-            "description": "Why this operation is forbidden (optional).",
-            "type": "string"
-          },
-          "severity": {
-            "description": "Severity level. Composer merges to strictest across scopes.",
-            "enum": [
-              "low",
-              "medium",
-              "high",
-              "critical"
-            ],
-            "type": "string"
-          },
-          "source_scope": {
-            "description": "Composer-assigned provenance. Server-assigned — do not send on a PUT.",
-            "type": "string"
-          }
-        },
-        "required": [
-          "pattern"
-        ],
-        "type": "object"
-      },
-      "type": "array"
-    }
-  },
-  "type": "object"
-}

removedOutput schema / properties / review

Removed value: -{
-  "description": "Review-hold policy (Safe House Review, Slice 2a — MNE-920 design). gate_on is the minimum verdict band per surface that escalates to a review-hold. Composition is strictest-wins; on_timeout defaults to 'reject' (fail-closed). reviewer.kind 'endpoint' is designed for MNE-1650 and not consumed yet.",
-  "properties": {
-    "enabled": {
-      "type": "boolean"
-    },
-    "gate_on": {
-      "properties": {
-        "incoming": {
-          "enum": [
-            "off",
-            "warn",
-            "quarantine",
-            "block"
-          ],
-          "type": "string"
-        },
-        "integrity": {
-          "enum": [
-            "off",
-            "review_needed",
-            "boundary_violation"
-          ],
-          "type": "string"
-        },
-        "outgoing": {
-          "enum": [
-            "off",
-            "warn",
-            "quarantine",
-            "block"
-          ],
-          "type": "string"
-        },
-        "tool_calls": {
-          "enum": [
-            "off",
-            "warn",
-            "quarantine",
-            "block"
-          ],
-          "type": "string"
-        },
-        "tool_responses": {
-          "enum": [
-            "off",
-            "warn",
-            "quarantine",
-            "block"
-          ],
-          "type": "string"
-        }
-      },
-      "type": "object"
-    },
-    "notify": {
-      "properties": {
-        "sse": {
-          "type": "boolean"
-        },
-        "webhooks": {
-          "type": "boolean"
-        }
-      },
-      "type": "object"
-    },
-    "on_timeout": {
-      "enum": [
-        "reject",
-        "release"
-      ],
-      "type": "string"
-    },
-    "quarantine_notice": {
-      "maxLength": 2000,
-      "type": "string"
-    },
-    "reviewer": {
-      "properties": {
-        "endpoint_url": {
-          "format": "uri",
-          "type": "string"
-        },
-        "kind": {
-          "enum": [
-            "builtin_opus",
-            "endpoint"
-          ],
-          "type": "string"
-        }
-      },
-      "required": [
-        "kind"
-      ],
-      "type": "object"
-    },
-    "sla_seconds": {
-      "minimum": 1,
-      "type": "number"
-    }
-  },
-  "required": [
-    "enabled"
-  ],
-  "type": "object"
-}

removedOutput schema / properties / screen_surfaces

Removed value: -{
-  "description": "Which request surfaces Safe House inspects. Composed across scopes by OR-per-field (any scope requiring inspection wins).",
-  "properties": {
-    "incoming": {
-      "description": "The user/principal prompt entering the agent.",
-      "type": "boolean"
-    },
-    "outgoing": {
-      "description": "The agent's response leaving the agent.",
-      "type": "boolean"
-    },
-    "tool_calls": {
-      "description": "Tool-use invocations the agent makes.",
-      "type": "boolean"
-    },
-    "tool_responses": {
-      "description": "Responses to tool calls returning to the agent.",
-      "type": "boolean"
-    }
-  },
-  "required": [
-    "incoming",
-    "outgoing",
-    "tool_calls",
-    "tool_responses"
-  ],
-  "type": "object"
-}

removedOutput schema / properties / thresholds

Removed value: -{
-  "description": "Score bands. Must satisfy warn <= quarantine <= block; each value in [0, 1].",
-  "properties": {
-    "block": {
-      "maximum": 1,
-      "minimum": 0,
-      "type": "number"
-    },
-    "quarantine": {
-      "maximum": 1,
-      "minimum": 0,
-      "type": "number"
-    },
-    "warn": {
-      "maximum": 1,
-      "minimum": 0,
-      "type": "number"
-    }
-  },
-  "required": [
-    "warn",
-    "quarantine",
-    "block"
-  ],
-  "type": "object"
-}

removedOutput schema / properties / trusted_sources

Removed value: -{
-  "description": "Sources for which detectors short-circuit (each match logged in the trace). Composed as platform->agent intersection (compliance ceiling) with org+agent union inside that ceiling — an agent cannot widen trust beyond what the platform allows.",
-  "properties": {
-    "agent_ids": {
-      "description": "Mnemom agent IDs (mnm-* / smolt-* prefixed).",
-      "items": {
-        "type": "string"
-      },
-      "type": "array"
-    },
-    "domains": {
-      "description": "DNS names or host:port entries.",
-      "items": {
-        "type": "string"
-      },
-      "type": "array"
-    },
-    "ip_ranges": {
-      "description": "IPv4 or IPv6 CIDR ranges.",
-      "items": {
-        "type": "string"
-      },
-      "type": "array"
-    }
-  },
-  "required": [
-    "domains",
-    "agent_ids",
-    "ip_ranges"
-  ],
-  "type": "object"
-}

removedOutput schema / properties / version

Removed value: -{
-  "description": "Response-only: monotonic card version, injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-  "type": "integer"
-}

changedOutput schema / required

Previous value: -[
-  "card_version",
-  "agent_id",
-  "mode",
-  "thresholds",
-  "screen_surfaces",
-  "trusted_sources"
-]New value: +[
+  "card_id",
+  "issued_at",
+  "ok"
+]

Changedreport_recipe_fn_fp17 fields changed

changedInput schema / properties / agent_id / description

Previous value: -"Optional. Customer's agent id, when the report concerns a specific agent."New value: +"Optional. The agent the report concerns. Identifier only."

addedInput schema / properties / agent_id / maxLength
```
Added value: +64
```
addedInput schema / properties / agent_id / minLength
```
Added value: +3
```

addedInput schema / properties / agent_id / pattern

Added value: +"^[A-Za-z0-9][A-Za-z0-9_-]{1,62}[A-Za-z0-9]$"

changedInput schema / properties / checkpoint_id / description

Previous value: -"Optional. Related integrity_checkpoints id (helps the reviewer correlate)."New value: +"Optional. The related integrity checkpoint, so the reviewer can correlate. Identifier only."

addedInput schema / properties / checkpoint_id / maxLength
```
Added value: +64
```
addedInput schema / properties / checkpoint_id / minLength
```
Added value: +3
```

addedInput schema / properties / checkpoint_id / pattern

Added value: +"^[A-Za-z0-9][A-Za-z0-9_-]{1,62}[A-Za-z0-9]$"

removedInput schema / properties / evidence

Removed value: -{
-  "description": "Optional raw payload / log excerpt the admin reviewer can inspect.",
-  "type": "string"
-}

changedInput schema / properties / recipeId / description

Previous value: -"The detection_recipes id the report is filed against (the recipe that misfired or failed to fire)."New value: +"The detection recipe the report is filed against (the one that misfired or failed to fire). Identifier only."

addedInput schema / properties / recipeId / maxLength
```
Added value: +64
```
addedInput schema / properties / recipeId / minLength
```
Added value: +3
```

addedInput schema / properties / recipeId / pattern

Added value: +"^[A-Za-z0-9][A-Za-z0-9_-]{1,62}[A-Za-z0-9]$"

changedInput schema / properties / summary / description

Previous value: -"Customer's description of what happened."New value: +"A short description of what the recipe got wrong — what it flagged, or what it missed, and why that was incorrect. DESCRIBE the misfire; do NOT paste the conversation, the prompt, the raw payload or the log that triggered it. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization."

addedInput schema / properties / summary / maxLength
```
Added value: +500
```

changedInput schema / properties / type / description

Previous value: -"'fn' (false negative — recipe should have fired) or 'fp' (false positive — recipe fired on legitimate behaviour)."New value: +"`fn` = false negative (the recipe should have fired). `fp` = false positive (it fired on legitimate behaviour)."

changedInput schema / required

Previous value: -[
-  "recipeId",
-  "summary",
-  "type"
-]New value: +[
+  "recipeId",
+  "type",
+  "summary"
+]

2 tool updatesJul 31, 2026

Changedget_agent2 fields changed

addedOutput schema / $defs / Agent / properties / groups

Added value: +{
+  "description": "Active groups this agent belongs to, name-ordered; `[]` when none. Present on org-fleet rows (GET /v1/orgs/{org_id}/agents). Archived groups are excluded.",
+  "items": {
+    "properties": {
+      "color": {
+        "description": "Group color (hex, e.g. `#0d9488`); `null` when unset.",
+        "type": [
+          "string",
+          "null"
+        ]
+      },
+      "id": {
+        "type": "string"
+      },
+      "name": {
+        "type": "string"
+      }
+    },
+    "required": [
+      "id",
+      "name",
+      "color"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}

addedOutput schema / properties / groups

Added value: +{
+  "description": "Active groups this agent belongs to, name-ordered; `[]` when none. Present on org-fleet rows (GET /v1/orgs/{org_id}/agents). Archived groups are excluded.",
+  "items": {
+    "properties": {
+      "color": {
+        "description": "Group color (hex, e.g. `#0d9488`); `null` when unset.",
+        "type": [
+          "string",
+          "null"
+        ]
+      },
+      "id": {
+        "type": "string"
+      },
+      "name": {
+        "type": "string"
+      }
+    },
+    "required": [
+      "id",
+      "name",
+      "color"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}

Changedlist_agents1 field changed

addedOutput schema / $defs / Agent / properties / groups

Added value: +{
+  "description": "Active groups this agent belongs to, name-ordered; `[]` when none. Present on org-fleet rows (GET /v1/orgs/{org_id}/agents). Archived groups are excluded.",
+  "items": {
+    "properties": {
+      "color": {
+        "description": "Group color (hex, e.g. `#0d9488`); `null` when unset.",
+        "type": [
+          "string",
+          "null"
+        ]
+      },
+      "id": {
+        "type": "string"
+      },
+      "name": {
+        "type": "string"
+      }
+    },
+    "required": [
+      "id",
+      "name",
+      "color"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}

2 tool updatesJul 27, 2026

Changedget_reputation2 fields changed

addedOutput schema / $defs / ReputationScore / properties / checkpoint_accounting / properties / re_evaluated

Added value: +{
+  "description": "How many of the agent's checkpoints carry each kind of re-evaluation annotation (counted over `total`, not the analyzed subset). Observability only — these are not an exclusion bucket and do not enter the score arithmetic. Absent on scores computed before this breakdown existed.",
+  "properties": {
+    "corrected_clear": {
+      "description": "Checkpoints explicitly corrected to `clear` (`re_evaluation_metadata.corrected_verdict = 'clear'`).",
+      "type": "integer"
+    },
+    "corrected_non_clear": {
+      "description": "Checkpoints corrected to a NON-clear verdict — a cross-turn escalation or a reviewer reclassification to `review_needed`/`boundary_violation`. These count against the score per the correction, not as exonerations; a non-zero value is why this agent's score differs from the pre-MNE-2156 calculation.",
+      "type": "integer"
+    },
+    "resolved_no_correction": {
+      "description": "Checkpoints re-evaluated with NO recorded correction — the trust-recovery convention, scored as `clear`.",
+      "type": "integer"
+    }
+  },
+  "required": [
+    "corrected_clear",
+    "corrected_non_clear",
+    "resolved_no_correction"
+  ],
+  "type": "object"
+}

addedOutput schema / properties / checkpoint_accounting / properties / re_evaluated

Added value: +{
+  "description": "How many of the agent's checkpoints carry each kind of re-evaluation annotation (counted over `total`, not the analyzed subset). Observability only — these are not an exclusion bucket and do not enter the score arithmetic. Absent on scores computed before this breakdown existed.",
+  "properties": {
+    "corrected_clear": {
+      "description": "Checkpoints explicitly corrected to `clear` (`re_evaluation_metadata.corrected_verdict = 'clear'`).",
+      "type": "integer"
+    },
+    "corrected_non_clear": {
+      "description": "Checkpoints corrected to a NON-clear verdict — a cross-turn escalation or a reviewer reclassification to `review_needed`/`boundary_violation`. These count against the score per the correction, not as exonerations; a non-zero value is why this agent's score differs from the pre-MNE-2156 calculation.",
+      "type": "integer"
+    },
+    "resolved_no_correction": {
+      "description": "Checkpoints re-evaluated with NO recorded correction — the trust-recovery convention, scored as `clear`.",
+      "type": "integer"
+    }
+  },
+  "required": [
+    "corrected_clear",
+    "corrected_non_clear",
+    "resolved_no_correction"
+  ],
+  "type": "object"
+}

Changedsearch_reputation_directory1 field changed

addedOutput schema / $defs / ReputationScore / properties / checkpoint_accounting / properties / re_evaluated

Added value: +{
+  "description": "How many of the agent's checkpoints carry each kind of re-evaluation annotation (counted over `total`, not the analyzed subset). Observability only — these are not an exclusion bucket and do not enter the score arithmetic. Absent on scores computed before this breakdown existed.",
+  "properties": {
+    "corrected_clear": {
+      "description": "Checkpoints explicitly corrected to `clear` (`re_evaluation_metadata.corrected_verdict = 'clear'`).",
+      "type": "integer"
+    },
+    "corrected_non_clear": {
+      "description": "Checkpoints corrected to a NON-clear verdict — a cross-turn escalation or a reviewer reclassification to `review_needed`/`boundary_violation`. These count against the score per the correction, not as exonerations; a non-zero value is why this agent's score differs from the pre-MNE-2156 calculation.",
+      "type": "integer"
+    },
+    "resolved_no_correction": {
+      "description": "Checkpoints re-evaluated with NO recorded correction — the trust-recovery convention, scored as `clear`.",
+      "type": "integer"
+    }
+  },
+  "required": [
+    "corrected_clear",
+    "corrected_non_clear",
+    "resolved_no_correction"
+  ],
+  "type": "object"
+}

1 tool updateJul 16, 2026

Changedget_started3 fields changed

addedOutput schema / properties / developer_path

Added value: +{
+  "additionalProperties": false,
+  "description": "The developer hero on-ramp: the npx one-liner plus the intent-named MCP prompt-skills (try-me, onboard_an_agent, become_sovereign). Advertisement only — no functional dependency on those prompts existing yet.",
+  "properties": {
+    "narrative": {
+      "type": "string"
+    },
+    "note": {
+      "type": "string"
+    },
+    "npx": {
+      "additionalProperties": false,
+      "properties": {
+        "command": {
+          "type": "string"
+        },
+        "what": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "command",
+        "what"
+      ],
+      "type": "object"
+    },
+    "prompt_skills": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "name": {
+            "type": "string"
+          },
+          "what": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "name",
+          "what"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    }
+  },
+  "required": [
+    "narrative",
+    "npx",
+    "prompt_skills",
+    "note"
+  ],
+  "type": "object"
+}

addedOutput schema / properties / skill_path

Added value: +{
+  "additionalProperties": false,
+  "description": "The two-step on-ramp to declaring and advertising capabilities as A2A skills in a signed, portable AgentCard.",
+  "properties": {
+    "narrative": {
+      "type": "string"
+    },
+    "steps": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "auth": {
+            "enum": [
+              "none",
+              "required"
+            ],
+            "type": "string"
+          },
+          "step": {
+            "type": "integer"
+          },
+          "tool": {
+            "type": "string"
+          },
+          "what": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "step",
+          "tool",
+          "auth",
+          "what"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    }
+  },
+  "required": [
+    "narrative",
+    "steps"
+  ],
+  "type": "object"
+}

changedOutput schema / required

Previous value: -[
-  "who",
-  "value_prop",
-  "try_now",
-  "authenticate",
-  "sovereignty_path",
-  "surface_map",
-  "showcase_agent",
-  "visibility_model",
-  "what_we_keep_private_and_why",
-  "verify",
-  "doctrine"
-]New value: +[
+  "who",
+  "value_prop",
+  "try_now",
+  "authenticate",
+  "skill_path",
+  "sovereignty_path",
+  "developer_path",
+  "surface_map",
+  "showcase_agent",
+  "visibility_model",
+  "what_we_keep_private_and_why",
+  "verify",
+  "doctrine"
+]

1 tool updateJul 11, 2026

Changedput_alignment_by_agent6 fields changed

addedOutput schema / $defs / ComposedAlignmentCard

Added value: +{
+  "description": "OUTPUT-only variant of `UnifiedAlignmentCard` for the COMPOSED card the server emits on GET `/v1/alignment/{scope}/{id}`, `/effective`, and the `composed` field of preview-compose. Identical to `UnifiedAlignmentCard` except `principal` is optional (a default / org-scope composed card has no agent principal) and `values.declared` / `autonomy.bounded_actions` may be empty (a fresh card declares nothing yet). The strict `UnifiedAlignmentCard` remains the authoring/request contract.",
+  "properties": {
+    "_composition": {
+      "$ref": "#/$defs/CompositionMetadata"
+    },
+    "agent_id": {
+      "description": "Target agent id. On PUT, server overwrites to match the URL path.",
+      "type": "string"
+    },
+    "audit": {
+      "allOf": [
+        {
+          "if": {
+            "properties": {
+              "queryable": {
+                "const": true
+              }
+            },
+            "required": [
+              "queryable"
+            ]
+          },
+          "then": {
+            "required": [
+              "query_endpoint"
+            ]
+          }
+        }
+      ],
+      "properties": {
+        "query_endpoint": {
+          "description": "Required when audit.queryable is true.",
+          "type": "string"
+        },
+        "queryable": {
+          "type": "boolean"
+        },
+        "retention_days": {
+          "minimum": 0,
+          "type": "integer"
+        },
+        "storage": {
+          "properties": {
+            "location": {
+              "type": "string"
+            },
+            "type": {
+              "enum": [
+                "local",
+                "remote",
+                "distributed"
+              ],
+              "type": "string"
+            }
+          },
+          "type": "object"
+        },
+        "tamper_evidence": {
+          "enum": [
+            "append_only",
+            "signed",
+            "merkle",
+            null
+          ],
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "trace_format": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "retention_days",
+        "queryable"
+      ],
+      "type": "object"
+    },
+    "autonomy": {
+      "properties": {
+        "bounded_actions": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "escalation_triggers": {
+          "items": {
+            "properties": {
+              "action": {
+                "enum": [
+                  "escalate",
+                  "deny",
+                  "log"
+                ],
+                "type": "string"
+              },
+              "condition": {
+                "type": "string"
+              },
+              "reason": {
+                "type": "string"
+              }
+            },
+            "required": [
+              "condition",
+              "action",
+              "reason"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "forbidden_actions": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "max_autonomous_value": {
+          "properties": {
+            "amount": {
+              "type": "number"
+            },
+            "currency": {
+              "type": "string"
+            }
+          },
+          "type": "object"
+        }
+      },
+      "required": [
+        "bounded_actions"
+      ],
+      "type": "object"
+    },
+    "autonomy_mode": {
+      "description": "ADR-039 master switch for the action-policing pipeline (autonomy constraints). Required at the top level post-cutover; the legacy `enforcement.mode` location is rejected.",
+      "enum": [
+        "off",
+        "observe",
+        "nudge",
+        "enforce"
+      ],
+      "type": "string"
+    },
+    "capabilities": {
+      "additionalProperties": {
+        "properties": {
+          "description": {
+            "type": "string"
+          },
+          "required_actions": {
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "tools": {
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          }
+        },
+        "type": "object"
+      },
+      "type": "object"
+    },
+    "card_id": {
+      "description": "Card row id. Server-assigned on PUT (`ac-{uuid}`).",
+      "type": "string"
+    },
+    "card_version": {
+      "description": "Card schema version (required, non-empty). Current canonical value: `unified/2026-04-26`.",
+      "minLength": 1,
+      "type": "string"
+    },
+    "conscience": {
+      "properties": {
+        "mode": {
+          "enum": [
+            "augment",
+            "replace"
+          ],
+          "type": "string"
+        },
+        "values": {
+          "items": {
+            "properties": {
+              "content": {
+                "type": "string"
+              },
+              "id": {
+                "type": "string"
+              },
+              "severity": {
+                "enum": [
+                  "advisory",
+                  "mandatory"
+                ],
+                "type": "string"
+              },
+              "type": {
+                "enum": [
+                  "BOUNDARY",
+                  "FEAR",
+                  "COMMITMENT",
+                  "BELIEF",
+                  "HOPE"
+                ],
+                "type": "string"
+              }
+            },
+            "required": [
+              "type",
+              "content"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        }
+      },
+      "required": [
+        "mode",
+        "values"
+      ],
+      "type": "object"
+    },
+    "content_hash": {
+      "description": "Response-only: content hash of the composed card (`sha256:<hex>`), injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
+      "type": "string"
+    },
+    "enforcement": {
+      "description": "Optional ADR-039 Decision-3 user-facing knobs for unmapped-tool handling. The legacy `mode`, `unmapped_tool_action` and `fail_open` keys are REJECTED by the validator (mode → top-level autonomy_mode; fail_open → gateway env config).",
+      "properties": {
+        "allow_unmapped_tools": {
+          "description": "When true, tools not mapped to a capability are allowed by default.",
+          "type": "boolean"
+        },
+        "default_unmapped_severity": {
+          "description": "Severity assigned to an unmapped tool when allow_unmapped_tools is false.",
+          "enum": [
+            "low",
+            "medium",
+            "high",
+            "critical"
+          ],
+          "type": "string"
+        },
+        "forbidden_tools": {
+          "items": {
+            "properties": {
+              "pattern": {
+                "type": "string"
+              },
+              "reason": {
+                "type": "string"
+              },
+              "severity": {
+                "enum": [
+                  "critical",
+                  "high",
+                  "medium",
+                  "low"
+                ],
+                "type": "string"
+              }
+            },
+            "required": [
+              "pattern",
+              "reason",
+              "severity"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "grace_period_hours": {
+          "type": "integer"
+        }
+      },
+      "type": "object"
+    },
+    "expires_at": {
+      "format": "date-time",
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "extensions": {
+      "additionalProperties": true,
+      "type": "object"
+    },
+    "integrity_mode": {
+      "description": "ADR-039 master switch for the values/conscience pipeline (integrity constraints). Required at the top level post-cutover; the legacy `integrity.enforcement_mode` location is rejected.",
+      "enum": [
+        "off",
+        "observe",
+        "nudge",
+        "enforce"
+      ],
+      "type": "string"
+    },
+    "issued_at": {
+      "format": "date-time",
+      "type": "string"
+    },
+    "principal": {
+      "allOf": [
+        {
+          "if": {
+            "properties": {
+              "type": {
+                "not": {
+                  "const": "unspecified"
+                }
+              }
+            }
+          },
+          "then": {
+            "required": [
+              "identifier"
+            ]
+          }
+        }
+      ],
+      "description": "Required object describing whose authority the agent acts under (ADR-039 Decision 10).",
+      "properties": {
+        "escalation_contact": {
+          "type": "string"
+        },
+        "identifier": {
+          "description": "Required (non-empty) when principal.type is not `unspecified`; identifies the human / organization / agent.",
+          "minLength": 1,
+          "type": "string"
+        },
+        "relationship": {
+          "enum": [
+            "delegated_authority",
+            "advisory",
+            "autonomous"
+          ],
+          "type": "string"
+        },
+        "type": {
+          "enum": [
+            "human",
+            "organization",
+            "agent",
+            "unspecified"
+          ],
+          "type": "string"
+        }
+      },
+      "required": [
+        "type",
+        "relationship"
+      ],
+      "type": "object"
+    },
+    "values": {
+      "properties": {
+        "conflicts_with": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "declared": {
+          "description": "Ordered list of declared values. Phase 1 cards-as-primitive: each entry is either a catalog-v1 ID string (e.g. `'accuracy'`) or a parameterized map carrying optional `intensity` / `domain` / `severity_on_violation` / `scope` (e.g. `{id: 'accuracy', domain: 'financial', severity_on_violation: 'critical'}`).",
+          "items": {
+            "oneOf": [
+              {
+                "minLength": 1,
+                "type": "string"
+              },
+              {
+                "additionalProperties": {
+                  "type": "string"
+                },
+                "properties": {
+                  "id": {
+                    "minLength": 1,
+                    "type": "string"
+                  }
+                },
+                "required": [
+                  "id"
+                ],
+                "type": "object"
+              }
+            ]
+          },
+          "type": "array"
+        },
+        "definitions": {
+          "additionalProperties": {
+            "properties": {
+              "description": {
+                "type": "string"
+              },
+              "priority": {
+                "type": "integer"
+              }
+            },
+            "type": "object"
+          },
+          "type": "object"
+        },
+        "hierarchy": {
+          "enum": [
+            "lexicographic",
+            "weighted",
+            "contextual"
+          ],
+          "type": "string"
+        }
+      },
+      "required": [
+        "declared"
+      ],
+      "type": "object"
+    },
+    "version": {
+      "description": "Response-only: monotonic card version, injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
+      "type": "integer"
+    }
+  },
+  "required": [
+    "card_version",
+    "agent_id",
+    "autonomy_mode",
+    "integrity_mode",
+    "values",
+    "autonomy",
+    "audit"
+  ],
+  "type": "object"
+}

removedOutput schema / $defs / UnifiedAlignmentCard

Removed value: -{
-  "description": "Unified alignment card (ADR-008/ADR-039). Authored in YAML or JSON; composed server-side with platform defaults, org template, and active exemptions before storage. This schema matches the runtime validator at src/composition/validate.ts EXACTLY — a card authored strictly to it passes `PUT /v1/agents/{id}/alignment-card` and the preview-compose endpoint. Output-only fields (card_id, issued_at, expires_at, _composition, content_hash, version) are server-assigned and must NOT be sent on a PUT.",
-  "properties": {
-    "_composition": {
-      "$ref": "#/$defs/CompositionMetadata"
-    },
-    "agent_id": {
-      "description": "Target agent id. On PUT, server overwrites to match the URL path.",
-      "type": "string"
-    },
-    "audit": {
-      "allOf": [
-        {
-          "if": {
-            "properties": {
-              "queryable": {
-                "const": true
-              }
-            },
-            "required": [
-              "queryable"
-            ]
-          },
-          "then": {
-            "required": [
-              "query_endpoint"
-            ]
-          }
-        }
-      ],
-      "properties": {
-        "query_endpoint": {
-          "description": "Required when audit.queryable is true.",
-          "type": "string"
-        },
-        "queryable": {
-          "type": "boolean"
-        },
-        "retention_days": {
-          "minimum": 0,
-          "type": "integer"
-        },
-        "storage": {
-          "properties": {
-            "location": {
-              "type": "string"
-            },
-            "type": {
-              "enum": [
-                "local",
-                "remote",
-                "distributed"
-              ],
-              "type": "string"
-            }
-          },
-          "type": "object"
-        },
-        "tamper_evidence": {
-          "enum": [
-            "append_only",
-            "signed",
-            "merkle",
-            null
-          ],
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "trace_format": {
-          "type": "string"
-        }
-      },
-      "required": [
-        "retention_days",
-        "queryable"
-      ],
-      "type": "object"
-    },
-    "autonomy": {
-      "properties": {
-        "bounded_actions": {
-          "items": {
-            "type": "string"
-          },
-          "minItems": 1,
-          "type": "array"
-        },
-        "escalation_triggers": {
-          "items": {
-            "properties": {
-              "action": {
-                "enum": [
-                  "escalate",
-                  "deny",
-                  "log"
-                ],
-                "type": "string"
-              },
-              "condition": {
-                "type": "string"
-              },
-              "reason": {
-                "type": "string"
-              }
-            },
-            "required": [
-              "condition",
-              "action",
-              "reason"
-            ],
-            "type": "object"
-          },
-          "type": "array"
-        },
-        "forbidden_actions": {
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "max_autonomous_value": {
-          "properties": {
-            "amount": {
-              "type": "number"
-            },
-            "currency": {
-              "type": "string"
-            }
-          },
-          "type": "object"
-        }
-      },
-      "required": [
-        "bounded_actions"
-      ],
-      "type": "object"
-    },
-    "autonomy_mode": {
-      "description": "ADR-039 master switch for the action-policing pipeline (autonomy constraints). Required at the top level post-cutover; the legacy `enforcement.mode` location is rejected.",
-      "enum": [
-        "off",
-        "observe",
-        "nudge",
-        "enforce"
-      ],
-      "type": "string"
-    },
-    "capabilities": {
-      "additionalProperties": {
-        "properties": {
-          "description": {
-            "type": "string"
-          },
-          "required_actions": {
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "tools": {
-            "items": {
-              "type": "string"
-            },
-            "type": "array"
-          }
-        },
-        "type": "object"
-      },
-      "type": "object"
-    },
-    "card_id": {
-      "description": "Card row id. Server-assigned on PUT (`ac-{uuid}`).",
-      "type": "string"
-    },
-    "card_version": {
-      "description": "Card schema version (required, non-empty). Current canonical value: `unified/2026-04-26`.",
-      "minLength": 1,
-      "type": "string"
-    },
-    "conscience": {
-      "properties": {
-        "mode": {
-          "enum": [
-            "augment",
-            "replace"
-          ],
-          "type": "string"
-        },
-        "values": {
-          "items": {
-            "properties": {
-              "content": {
-                "type": "string"
-              },
-              "id": {
-                "type": "string"
-              },
-              "severity": {
-                "enum": [
-                  "advisory",
-                  "mandatory"
-                ],
-                "type": "string"
-              },
-              "type": {
-                "enum": [
-                  "BOUNDARY",
-                  "FEAR",
-                  "COMMITMENT",
-                  "BELIEF",
-                  "HOPE"
-                ],
-                "type": "string"
-              }
-            },
-            "required": [
-              "type",
-              "content"
-            ],
-            "type": "object"
-          },
-          "type": "array"
-        }
-      },
-      "required": [
-        "mode",
-        "values"
-      ],
-      "type": "object"
-    },
-    "content_hash": {
-      "description": "Response-only: content hash of the composed card (`sha256:<hex>`), injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-      "type": "string"
-    },
-    "enforcement": {
-      "description": "Optional ADR-039 Decision-3 user-facing knobs for unmapped-tool handling. The legacy `mode`, `unmapped_tool_action` and `fail_open` keys are REJECTED by the validator (mode → top-level autonomy_mode; fail_open → gateway env config).",
-      "properties": {
-        "allow_unmapped_tools": {
-          "description": "When true, tools not mapped to a capability are allowed by default.",
-          "type": "boolean"
-        },
-        "default_unmapped_severity": {
-          "description": "Severity assigned to an unmapped tool when allow_unmapped_tools is false.",
-          "enum": [
-            "low",
-            "medium",
-            "high",
-            "critical"
-          ],
-          "type": "string"
-        },
-        "forbidden_tools": {
-          "items": {
-            "properties": {
-              "pattern": {
-                "type": "string"
-              },
-              "reason": {
-                "type": "string"
-              },
-              "severity": {
-                "enum": [
-                  "critical",
-                  "high",
-                  "medium",
-                  "low"
-                ],
-                "type": "string"
-              }
-            },
-            "required": [
-              "pattern",
-              "reason",
-              "severity"
-            ],
-            "type": "object"
-          },
-          "type": "array"
-        },
-        "grace_period_hours": {
-          "type": "integer"
-        }
-      },
-      "type": "object"
-    },
-    "expires_at": {
-      "format": "date-time",
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "extensions": {
-      "additionalProperties": true,
-      "type": "object"
-    },
-    "integrity_mode": {
-      "description": "ADR-039 master switch for the values/conscience pipeline (integrity constraints). Required at the top level post-cutover; the legacy `integrity.enforcement_mode` location is rejected.",
-      "enum": [
-        "off",
-        "observe",
-        "nudge",
-        "enforce"
-      ],
-      "type": "string"
-    },
-    "issued_at": {
-      "format": "date-time",
-      "type": "string"
-    },
-    "principal": {
-      "allOf": [
-        {
-          "if": {
-            "properties": {
-              "type": {
-                "not": {
-                  "const": "unspecified"
-                }
-              }
-            }
-          },
-          "then": {
-            "required": [
-              "identifier"
-            ]
-          }
-        }
-      ],
-      "description": "Required object describing whose authority the agent acts under (ADR-039 Decision 10).",
-      "properties": {
-        "escalation_contact": {
-          "type": "string"
-        },
-        "identifier": {
-          "description": "Required (non-empty) when principal.type is not `unspecified`; identifies the human / organization / agent.",
-          "minLength": 1,
-          "type": "string"
-        },
-        "relationship": {
-          "enum": [
-            "delegated_authority",
-            "advisory",
-            "autonomous"
-          ],
-          "type": "string"
-        },
-        "type": {
-          "enum": [
-            "human",
-            "organization",
-            "agent",
-            "unspecified"
-          ],
-          "type": "string"
-        }
-      },
-      "required": [
-        "type",
-        "relationship"
-      ],
-      "type": "object"
-    },
-    "values": {
-      "properties": {
-        "conflicts_with": {
-          "items": {
-            "type": "string"
-          },
-          "type": "array"
-        },
-        "declared": {
-          "description": "Ordered list of declared values. Phase 1 cards-as-primitive: each entry is either a catalog-v1 ID string (e.g. `'accuracy'`) or a parameterized map carrying optional `intensity` / `domain` / `severity_on_violation` / `scope` (e.g. `{id: 'accuracy', domain: 'financial', severity_on_violation: 'critical'}`).",
-          "items": {
-            "oneOf": [
-              {
-                "minLength": 1,
-                "type": "string"
-              },
-              {
-                "additionalProperties": {
-                  "type": "string"
-                },
-                "properties": {
-                  "id": {
-                    "minLength": 1,
-                    "type": "string"
-                  }
-                },
-                "required": [
-                  "id"
-                ],
-                "type": "object"
-              }
-            ]
-          },
-          "minItems": 1,
-          "type": "array"
-        },
-        "definitions": {
-          "additionalProperties": {
-            "properties": {
-              "description": {
-                "type": "string"
-              },
-              "priority": {
-                "type": "integer"
-              }
-            },
-            "type": "object"
-          },
-          "type": "object"
-        },
-        "hierarchy": {
-          "enum": [
-            "lexicographic",
-            "weighted",
-            "contextual"
-          ],
-          "type": "string"
-        }
-      },
-      "required": [
-        "declared"
-      ],
-      "type": "object"
-    },
-    "version": {
-      "description": "Response-only: monotonic card version, injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
-      "type": "integer"
-    }
-  },
-  "required": [
-    "card_version",
-    "agent_id",
-    "autonomy_mode",
-    "integrity_mode",
-    "principal",
-    "values",
-    "autonomy",
-    "audit"
-  ],
-  "type": "object"
-}

changedOutput schema / description

Previous value: -"Unified alignment card (ADR-008/ADR-039). Authored in YAML or JSON; composed server-side with platform defaults, org template, and active exemptions before storage. This schema matches the runtime validator at src/composition/validate.ts EXACTLY — a card authored strictly to it passes `PUT /v1/agents/{id}/alignment-card` and the preview-compose endpoint. Output-only fields (card_id, issued_at, expires_at, _composition, content_hash, version) are server-assigned and must NOT be sent on a PUT."New value: +"OUTPUT-only variant of `UnifiedAlignmentCard` for the COMPOSED card the server emits on GET `/v1/alignment/{scope}/{id}`, `/effective`, and the `composed` field of preview-compose. Identical to `UnifiedAlignmentCard` except `principal` is optional (a default / org-scope composed card has no agent principal) and `values.declared` / `autonomy.bounded_actions` may be empty (a fresh card declares nothing yet). The strict `UnifiedAlignmentCard` remains the authoring/request contract."

removedOutput schema / properties / autonomy / properties / bounded_actions / minItems
```
Removed value: -1
```
removedOutput schema / properties / values / properties / declared / minItems
```
Removed value: -1
```

changedOutput schema / required

Previous value: -[
-  "card_version",
-  "agent_id",
-  "autonomy_mode",
-  "integrity_mode",
-  "principal",
-  "values",
-  "autonomy",
-  "audit"
-]New value: +[
+  "card_version",
+  "agent_id",
+  "autonomy_mode",
+  "integrity_mode",
+  "values",
+  "autonomy",
+  "audit"
+]

2 tool updatesJul 10, 2026

Changedpreview_compose_protection_by_agent2 fields changed

addedInput schema / $defs / UnifiedProtectionCard / properties / review

Added value: +{
+  "description": "Review-hold policy (Safe House Review, Slice 2a — MNE-920 design). gate_on is the minimum verdict band per surface that escalates to a review-hold. Composition is strictest-wins; on_timeout defaults to 'reject' (fail-closed). reviewer.kind 'endpoint' is designed for MNE-1650 and not consumed yet.",
+  "properties": {
+    "enabled": {
+      "type": "boolean"
+    },
+    "gate_on": {
+      "properties": {
+        "incoming": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "integrity": {
+          "enum": [
+            "off",
+            "review_needed",
+            "boundary_violation"
+          ],
+          "type": "string"
+        },
+        "outgoing": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "tool_calls": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "tool_responses": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "notify": {
+      "properties": {
+        "sse": {
+          "type": "boolean"
+        },
+        "webhooks": {
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    },
+    "on_timeout": {
+      "enum": [
+        "reject",
+        "release"
+      ],
+      "type": "string"
+    },
+    "quarantine_notice": {
+      "maxLength": 2000,
+      "type": "string"
+    },
+    "reviewer": {
+      "properties": {
+        "endpoint_url": {
+          "format": "uri",
+          "type": "string"
+        },
+        "kind": {
+          "enum": [
+            "builtin_opus",
+            "endpoint"
+          ],
+          "type": "string"
+        }
+      },
+      "required": [
+        "kind"
+      ],
+      "type": "object"
+    },
+    "sla_seconds": {
+      "minimum": 1,
+      "type": "number"
+    }
+  },
+  "required": [
+    "enabled"
+  ],
+  "type": "object"
+}

addedInput schema / properties / body / properties / review

Added value: +{
+  "description": "Review-hold policy (Safe House Review, Slice 2a — MNE-920 design). gate_on is the minimum verdict band per surface that escalates to a review-hold. Composition is strictest-wins; on_timeout defaults to 'reject' (fail-closed). reviewer.kind 'endpoint' is designed for MNE-1650 and not consumed yet.",
+  "properties": {
+    "enabled": {
+      "type": "boolean"
+    },
+    "gate_on": {
+      "properties": {
+        "incoming": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "integrity": {
+          "enum": [
+            "off",
+            "review_needed",
+            "boundary_violation"
+          ],
+          "type": "string"
+        },
+        "outgoing": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "tool_calls": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "tool_responses": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "notify": {
+      "properties": {
+        "sse": {
+          "type": "boolean"
+        },
+        "webhooks": {
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    },
+    "on_timeout": {
+      "enum": [
+        "reject",
+        "release"
+      ],
+      "type": "string"
+    },
+    "quarantine_notice": {
+      "maxLength": 2000,
+      "type": "string"
+    },
+    "reviewer": {
+      "properties": {
+        "endpoint_url": {
+          "format": "uri",
+          "type": "string"
+        },
+        "kind": {
+          "enum": [
+            "builtin_opus",
+            "endpoint"
+          ],
+          "type": "string"
+        }
+      },
+      "required": [
+        "kind"
+      ],
+      "type": "object"
+    },
+    "sla_seconds": {
+      "minimum": 1,
+      "type": "number"
+    }
+  },
+  "required": [
+    "enabled"
+  ],
+  "type": "object"
+}

Changedput_protection_by_agent4 fields changed

addedInput schema / $defs / UnifiedProtectionCard / properties / review

Added value: +{
+  "description": "Review-hold policy (Safe House Review, Slice 2a — MNE-920 design). gate_on is the minimum verdict band per surface that escalates to a review-hold. Composition is strictest-wins; on_timeout defaults to 'reject' (fail-closed). reviewer.kind 'endpoint' is designed for MNE-1650 and not consumed yet.",
+  "properties": {
+    "enabled": {
+      "type": "boolean"
+    },
+    "gate_on": {
+      "properties": {
+        "incoming": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "integrity": {
+          "enum": [
+            "off",
+            "review_needed",
+            "boundary_violation"
+          ],
+          "type": "string"
+        },
+        "outgoing": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "tool_calls": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "tool_responses": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "notify": {
+      "properties": {
+        "sse": {
+          "type": "boolean"
+        },
+        "webhooks": {
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    },
+    "on_timeout": {
+      "enum": [
+        "reject",
+        "release"
+      ],
+      "type": "string"
+    },
+    "quarantine_notice": {
+      "maxLength": 2000,
+      "type": "string"
+    },
+    "reviewer": {
+      "properties": {
+        "endpoint_url": {
+          "format": "uri",
+          "type": "string"
+        },
+        "kind": {
+          "enum": [
+            "builtin_opus",
+            "endpoint"
+          ],
+          "type": "string"
+        }
+      },
+      "required": [
+        "kind"
+      ],
+      "type": "object"
+    },
+    "sla_seconds": {
+      "minimum": 1,
+      "type": "number"
+    }
+  },
+  "required": [
+    "enabled"
+  ],
+  "type": "object"
+}

addedInput schema / properties / body / properties / review

Added value: +{
+  "description": "Review-hold policy (Safe House Review, Slice 2a — MNE-920 design). gate_on is the minimum verdict band per surface that escalates to a review-hold. Composition is strictest-wins; on_timeout defaults to 'reject' (fail-closed). reviewer.kind 'endpoint' is designed for MNE-1650 and not consumed yet.",
+  "properties": {
+    "enabled": {
+      "type": "boolean"
+    },
+    "gate_on": {
+      "properties": {
+        "incoming": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "integrity": {
+          "enum": [
+            "off",
+            "review_needed",
+            "boundary_violation"
+          ],
+          "type": "string"
+        },
+        "outgoing": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "tool_calls": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "tool_responses": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "notify": {
+      "properties": {
+        "sse": {
+          "type": "boolean"
+        },
+        "webhooks": {
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    },
+    "on_timeout": {
+      "enum": [
+        "reject",
+        "release"
+      ],
+      "type": "string"
+    },
+    "quarantine_notice": {
+      "maxLength": 2000,
+      "type": "string"
+    },
+    "reviewer": {
+      "properties": {
+        "endpoint_url": {
+          "format": "uri",
+          "type": "string"
+        },
+        "kind": {
+          "enum": [
+            "builtin_opus",
+            "endpoint"
+          ],
+          "type": "string"
+        }
+      },
+      "required": [
+        "kind"
+      ],
+      "type": "object"
+    },
+    "sla_seconds": {
+      "minimum": 1,
+      "type": "number"
+    }
+  },
+  "required": [
+    "enabled"
+  ],
+  "type": "object"
+}

addedOutput schema / $defs / UnifiedProtectionCard / properties / review

Added value: +{
+  "description": "Review-hold policy (Safe House Review, Slice 2a — MNE-920 design). gate_on is the minimum verdict band per surface that escalates to a review-hold. Composition is strictest-wins; on_timeout defaults to 'reject' (fail-closed). reviewer.kind 'endpoint' is designed for MNE-1650 and not consumed yet.",
+  "properties": {
+    "enabled": {
+      "type": "boolean"
+    },
+    "gate_on": {
+      "properties": {
+        "incoming": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "integrity": {
+          "enum": [
+            "off",
+            "review_needed",
+            "boundary_violation"
+          ],
+          "type": "string"
+        },
+        "outgoing": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "tool_calls": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "tool_responses": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "notify": {
+      "properties": {
+        "sse": {
+          "type": "boolean"
+        },
+        "webhooks": {
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    },
+    "on_timeout": {
+      "enum": [
+        "reject",
+        "release"
+      ],
+      "type": "string"
+    },
+    "quarantine_notice": {
+      "maxLength": 2000,
+      "type": "string"
+    },
+    "reviewer": {
+      "properties": {
+        "endpoint_url": {
+          "format": "uri",
+          "type": "string"
+        },
+        "kind": {
+          "enum": [
+            "builtin_opus",
+            "endpoint"
+          ],
+          "type": "string"
+        }
+      },
+      "required": [
+        "kind"
+      ],
+      "type": "object"
+    },
+    "sla_seconds": {
+      "minimum": 1,
+      "type": "number"
+    }
+  },
+  "required": [
+    "enabled"
+  ],
+  "type": "object"
+}

addedOutput schema / properties / review

Added value: +{
+  "description": "Review-hold policy (Safe House Review, Slice 2a — MNE-920 design). gate_on is the minimum verdict band per surface that escalates to a review-hold. Composition is strictest-wins; on_timeout defaults to 'reject' (fail-closed). reviewer.kind 'endpoint' is designed for MNE-1650 and not consumed yet.",
+  "properties": {
+    "enabled": {
+      "type": "boolean"
+    },
+    "gate_on": {
+      "properties": {
+        "incoming": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "integrity": {
+          "enum": [
+            "off",
+            "review_needed",
+            "boundary_violation"
+          ],
+          "type": "string"
+        },
+        "outgoing": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "tool_calls": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        },
+        "tool_responses": {
+          "enum": [
+            "off",
+            "warn",
+            "quarantine",
+            "block"
+          ],
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "notify": {
+      "properties": {
+        "sse": {
+          "type": "boolean"
+        },
+        "webhooks": {
+          "type": "boolean"
+        }
+      },
+      "type": "object"
+    },
+    "on_timeout": {
+      "enum": [
+        "reject",
+        "release"
+      ],
+      "type": "string"
+    },
+    "quarantine_notice": {
+      "maxLength": 2000,
+      "type": "string"
+    },
+    "reviewer": {
+      "properties": {
+        "endpoint_url": {
+          "format": "uri",
+          "type": "string"
+        },
+        "kind": {
+          "enum": [
+            "builtin_opus",
+            "endpoint"
+          ],
+          "type": "string"
+        }
+      },
+      "required": [
+        "kind"
+      ],
+      "type": "object"
+    },
+    "sla_seconds": {
+      "minimum": 1,
+      "type": "number"
+    }
+  },
+  "required": [
+    "enabled"
+  ],
+  "type": "object"
+}

1 tool updateJul 2, 2026

Changedget_started2 fields changed

addedOutput schema / properties / authenticate / properties / headless

Added value: +{
+  "additionalProperties": false,
+  "description": "The headless/cloud write-auth fallback (MNE-1392): when your host has no local browser and the standard OAuth redirect can't complete, drive the RFC 8628 Device Authorization Grant yourself.",
+  "properties": {
+    "discovery": {
+      "format": "uri",
+      "type": "string"
+    },
+    "grant_type": {
+      "type": "string"
+    },
+    "note": {
+      "type": "string"
+    },
+    "steps": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "use": {
+      "type": "string"
+    },
+    "when": {
+      "type": "string"
+    }
+  },
+  "required": [
+    "when",
+    "use",
+    "grant_type",
+    "discovery",
+    "steps"
+  ],
+  "type": "object"
+}

changedOutput schema / properties / authenticate / required

Previous value: -[
-  "methods",
-  "unlocks",
-  "discovery"
-]New value: +[
+  "methods",
+  "unlocks",
+  "discovery",
+  "headless"
+]

1 tool updateJun 27, 2026
- Removedget_risk_history

2 tool updatesJun 23, 2026

Changedget_agent14 fields changed

removedOutput schema / $defs / Agent / properties / aap_enabled

Removed value: -{
-  "description": "Owner projection: AAP pipeline enabled.",
-  "type": "boolean"
-}

removedOutput schema / $defs / Agent / properties / aip_enabled

Removed value: -{
-  "description": "Owner projection: AIP pipeline enabled.",
-  "type": "boolean"
-}

removedOutput schema / $defs / Agent / properties / analyze_output

Removed value: -{
-  "description": "Owner projection: analyze agent output.",
-  "type": [
-    "boolean",
-    "null"
-  ]
-}

removedOutput schema / $defs / Agent / properties / ddr_mode

Removed value: -{
-  "description": "Owner projection: drift-detection-response mode (mig default 'flag').",
-  "type": "string"
-}

removedOutput schema / $defs / Agent / properties / nudge_strategy

Removed value: -{
-  "description": "Owner projection: nudge strategy.",
-  "type": [
-    "string",
-    "null"
-  ]
-}

removedOutput schema / $defs / Agent / properties / proof_enabled

Removed value: -{
-  "description": "Owner projection: proof capture enabled.",
-  "type": "boolean"
-}

removedOutput schema / $defs / Agent / properties / proof_rate

Removed value: -{
-  "description": "Owner projection: proof sampling rate (0–100%).",
-  "type": "integer"
-}

removedOutput schema / properties / aap_enabled

Removed value: -{
-  "description": "Owner projection: AAP pipeline enabled.",
-  "type": "boolean"
-}

removedOutput schema / properties / aip_enabled

Removed value: -{
-  "description": "Owner projection: AIP pipeline enabled.",
-  "type": "boolean"
-}

removedOutput schema / properties / analyze_output

Removed value: -{
-  "description": "Owner projection: analyze agent output.",
-  "type": [
-    "boolean",
-    "null"
-  ]
-}

removedOutput schema / properties / ddr_mode

Removed value: -{
-  "description": "Owner projection: drift-detection-response mode (mig default 'flag').",
-  "type": "string"
-}

removedOutput schema / properties / nudge_strategy

Removed value: -{
-  "description": "Owner projection: nudge strategy.",
-  "type": [
-    "string",
-    "null"
-  ]
-}

removedOutput schema / properties / proof_enabled

Removed value: -{
-  "description": "Owner projection: proof capture enabled.",
-  "type": "boolean"
-}

removedOutput schema / properties / proof_rate

Removed value: -{
-  "description": "Owner projection: proof sampling rate (0–100%).",
-  "type": "integer"
-}

Changedlist_agents7 fields changed

removedOutput schema / $defs / Agent / properties / aap_enabled

Removed value: -{
-  "description": "Owner projection: AAP pipeline enabled.",
-  "type": "boolean"
-}

removedOutput schema / $defs / Agent / properties / aip_enabled

Removed value: -{
-  "description": "Owner projection: AIP pipeline enabled.",
-  "type": "boolean"
-}

removedOutput schema / $defs / Agent / properties / analyze_output

Removed value: -{
-  "description": "Owner projection: analyze agent output.",
-  "type": [
-    "boolean",
-    "null"
-  ]
-}

removedOutput schema / $defs / Agent / properties / ddr_mode

Removed value: -{
-  "description": "Owner projection: drift-detection-response mode (mig default 'flag').",
-  "type": "string"
-}

removedOutput schema / $defs / Agent / properties / nudge_strategy

Removed value: -{
-  "description": "Owner projection: nudge strategy.",
-  "type": [
-    "string",
-    "null"
-  ]
-}

removedOutput schema / $defs / Agent / properties / proof_enabled

Removed value: -{
-  "description": "Owner projection: proof capture enabled.",
-  "type": "boolean"
-}

removedOutput schema / $defs / Agent / properties / proof_rate

Removed value: -{
-  "description": "Owner projection: proof sampling rate (0–100%).",
-  "type": "integer"
-}

2 tool updatesJun 23, 2026
- Addedpreview_compose_protection_by_agent
- Addedput_protection_by_agent

1 tool updateJun 21, 2026

Changedget_started1 field changed

addedInput schema / properties / token

Added value: +{
+  "description": "Optional Dojo try-me invite token. When supplied and valid, returns the token-gated dojo briefing manifest (the same content as GET /v1/dojo/try-me/resolve); omit for public orientation.",
+  "type": "string"
+}

5 tool updatesJun 12, 2026
- Changedget_risk_history3 fields changed
  - addedInput schema / properties / include_playground / description
```
Added value: +"When true, include assessments produced in playground/test runs alongside production ones. Default false (production only)."
```
  - addedInput schema / properties / limit / description
```
Added value: +"Maximum number of risk assessments to return (most recent first). 1–100, default 20."
```
  - addedInput schema / properties / offset / description
```
Added value: +"Number of assessments to skip before returning results, for pagination. Default 0."
```
- Changedreport_recipe_fn_fp1 field changed
  - addedInput schema / properties / recipeId / description
```
Added value: +"The detection_recipes id the report is filed against (the recipe that misfired or failed to fire)."
```
- Changedscan_trust5 fields changed
  - addedOutput schema / properties / access / properties / categories / description
```
Added value: +"Per-category Access scores + checks."
```
  - addedOutput schema / properties / access / properties / grade / description
```
Added value: +"Access letter grade (A+…F)."
```
  - addedOutput schema / properties / access / properties / score / description
```
Added value: +"0–100 weighted Access/discoverability score (independent of Trust)."
```
  - addedOutput schema / properties / access / properties / version / description
```
Added value: +"Access-axis rubric version this sub-score was computed against."
```
  - addedOutput schema / properties / signature / properties / signedAt / description
```
Added value: +"When the scorecard was signed."
```
- Changedsearch_reputation_directory4 fields changed
  - addedInput schema / properties / confidence / description
```
Added value: +"Filter to agents at a given reputation-confidence level (driven by how much evidence backs the score)."
```
  - addedInput schema / properties / page / description
```
Added value: +"1-based page number for pagination. Default 1."
```
  - addedInput schema / properties / per_page / description
```
Added value: +"Number of results per page. 1–100, default 20."
```
  - addedInput schema / properties / sort / description
```
Added value: +"Result ordering. Default \"score\" (highest-rated first); other supported keys order by recency or name."
```
- Changedverify_scan5 fields changed
  - addedInput schema / properties / scan / properties / access / properties / categories / description
```
Added value: +"Per-category Access scores + checks."
```
  - addedInput schema / properties / scan / properties / access / properties / grade / description
```
Added value: +"Access letter grade (A+…F)."
```
  - addedInput schema / properties / scan / properties / access / properties / score / description
```
Added value: +"0–100 weighted Access/discoverability score (independent of Trust)."
```
  - addedInput schema / properties / scan / properties / access / properties / version / description
```
Added value: +"Access-axis rubric version this sub-score was computed against."
```
  - addedInput schema / properties / scan / properties / signature / properties / signedAt / description
```
Added value: +"When the scorecard was signed."
```

3 tool updatesJun 12, 2026

Changedpreview_compose_alignment_by_agent4 fields changed

removedInput schema / properties / body / additionalProperties
```
Removed value: -true
```

addedInput schema / properties / body / description

Added value: +"Unified alignment card (ADR-008/ADR-039). Authored in YAML or JSON; composed server-side with platform defaults, org template, and active exemptions before storage. This schema matches the runtime validator at src/composition/validate.ts EXACTLY — a card authored strictly to it passes `PUT /v1/agents/{id}/alignment-card` and the preview-compose endpoint. Output-only fields (card_id, issued_at, expires_at, _composition, content_hash, version) are server-assigned and must NOT be sent on a PUT."

addedInput schema / properties / body / properties

Added value: +{
+  "_composition": {
+    "$ref": "#/$defs/CompositionMetadata"
+  },
+  "agent_id": {
+    "description": "Target agent id. On PUT, server overwrites to match the URL path.",
+    "type": "string"
+  },
+  "audit": {
+    "allOf": [
+      {
+        "if": {
+          "properties": {
+            "queryable": {
+              "const": true
+            }
+          },
+          "required": [
+            "queryable"
+          ]
+        },
+        "then": {
+          "required": [
+            "query_endpoint"
+          ]
+        }
+      }
+    ],
+    "properties": {
+      "query_endpoint": {
+        "description": "Required when audit.queryable is true.",
+        "type": "string"
+      },
+      "queryable": {
+        "type": "boolean"
+      },
+      "retention_days": {
+        "minimum": 0,
+        "type": "integer"
+      },
+      "storage": {
+        "properties": {
+          "location": {
+            "type": "string"
+          },
+          "type": {
+            "enum": [
+              "local",
+              "remote",
+              "distributed"
+            ],
+            "type": "string"
+          }
+        },
+        "type": "object"
+      },
+      "tamper_evidence": {
+        "enum": [
+          "append_only",
+          "signed",
+          "merkle",
+          null
+        ],
+        "type": [
+          "string",
+          "null"
+        ]
+      },
+      "trace_format": {
+        "type": "string"
+      }
+    },
+    "required": [
+      "retention_days",
+      "queryable"
+    ],
+    "type": "object"
+  },
+  "autonomy": {
+    "properties": {
+      "bounded_actions": {
+        "items": {
+          "type": "string"
+        },
+        "minItems": 1,
+        "type": "array"
+      },
+      "escalation_triggers": {
+        "items": {
+          "properties": {
+            "action": {
+              "enum": [
+                "escalate",
+                "deny",
+                "log"
+              ],
+              "type": "string"
+            },
+            "condition": {
+              "type": "string"
+            },
+            "reason": {
+              "type": "string"
+            }
+          },
+          "required": [
+            "condition",
+            "action",
+            "reason"
+          ],
+          "type": "object"
+        },
+        "type": "array"
+      },
+      "forbidden_actions": {
+        "items": {
+          "type": "string"
+        },
+        "type": "array"
+      },
+      "max_autonomous_value": {
+        "properties": {
+          "amount": {
+            "type": "number"
+          },
+          "currency": {
+            "type": "string"
+          }
+        },
+        "type": "object"
+      }
+    },
+    "required": [
+      "bounded_actions"
+    ],
+    "type": "object"
+  },
+  "autonomy_mode": {
+    "description": "ADR-039 master switch for the action-policing pipeline (autonomy constraints). Required at the top level post-cutover; the legacy `enforcement.mode` location is rejected.",
+    "enum": [
+      "off",
+      "observe",
+      "nudge",
+      "enforce"
+    ],
+    "type": "string"
+  },
+  "capabilities": {
+    "additionalProperties": {
+      "properties": {
+        "description": {
+          "type": "string"
+        },
+        "required_actions": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "tools": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        }
+      },
+      "type": "object"
+    },
+    "type": "object"
+  },
+  "card_id": {
+    "description": "Card row id. Server-assigned on PUT (`ac-{uuid}`).",
+    "type": "string"
+  },
+  "card_version": {
+    "description": "Card schema version (required, non-empty). Current canonical value: `unified/2026-04-26`.",
+    "minLength": 1,
+    "type": "string"
+  },
+  "conscience": {
+    "properties": {
+      "mode": {
+        "enum": [
+          "augment",
+          "replace"
+        ],
+        "type": "string"
+      },
+      "values": {
+        "items": {
+          "properties": {
+            "content": {
+              "type": "string"
+            },
+            "id": {
+              "type": "string"
+            },
+            "severity": {
+              "enum": [
+                "advisory",
+                "mandatory"
+              ],
+              "type": "string"
+            },
+            "type": {
+              "enum": [
+                "BOUNDARY",
+                "FEAR",
+                "COMMITMENT",
+                "BELIEF",
+                "HOPE"
+              ],
+              "type": "string"
+            }
+          },
+          "required": [
+            "type",
+            "content"
+          ],
+          "type": "object"
+        },
+        "type": "array"
+      }
+    },
+    "required": [
+      "mode",
+      "values"
+    ],
+    "type": "object"
+  },
+  "content_hash": {
+    "description": "Response-only: content hash of the composed card (`sha256:<hex>`), injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
+    "type": "string"
+  },
+  "enforcement": {
+    "description": "Optional ADR-039 Decision-3 user-facing knobs for unmapped-tool handling. The legacy `mode`, `unmapped_tool_action` and `fail_open` keys are REJECTED by the validator (mode → top-level autonomy_mode; fail_open → gateway env config).",
+    "properties": {
+      "allow_unmapped_tools": {
+        "description": "When true, tools not mapped to a capability are allowed by default.",
+        "type": "boolean"
+      },
+      "default_unmapped_severity": {
+        "description": "Severity assigned to an unmapped tool when allow_unmapped_tools is false.",
+        "enum": [
+          "low",
+          "medium",
+          "high",
+          "critical"
+        ],
+        "type": "string"
+      },
+      "forbidden_tools": {
+        "items": {
+          "properties": {
+            "pattern": {
+              "type": "string"
+            },
+            "reason": {
+              "type": "string"
+            },
+            "severity": {
+              "enum": [
+                "critical",
+                "high",
+                "medium",
+                "low"
+              ],
+              "type": "string"
+            }
+          },
+          "required": [
+            "pattern",
+            "reason",
+            "severity"
+          ],
+          "type": "object"
+        },
+        "type": "array"
+      },
+      "grace_period_hours": {
+        "type": "integer"
+      }
+    },
+    "type": "object"
+  },
+  "expires_at": {
+    "format": "date-time",
+    "type": [
+      "string",
+      "null"
+    ]
+  },
+  "extensions": {
+    "additionalProperties": true,
+    "type": "object"
+  },
+  "integrity_mode": {
+    "description": "ADR-039 master switch for the values/conscience pipeline (integrity constraints). Required at the top level post-cutover; the legacy `integrity.enforcement_mode` location is rejected.",
+    "enum": [
+      "off",
+      "observe",
+      "nudge",
+      "enforce"
+    ],
+    "type": "string"
+  },
+  "issued_at": {
+    "format": "date-time",
+    "type": "string"
+  },
+  "principal": {
+    "allOf": [
+      {
+        "if": {
+          "properties": {
+            "type": {
+              "not": {
+                "const": "unspecified"
+              }
+            }
+          }
+        },
+        "then": {
+          "required": [
+            "identifier"
+          ]
+        }
+      }
+    ],
+    "description": "Required object describing whose authority the agent acts under (ADR-039 Decision 10).",
+    "properties": {
+      "escalation_contact": {
+        "type": "string"
+      },
+      "identifier": {
+        "description": "Required (non-empty) when principal.type is not `unspecified`; identifies the human / organization / agent.",
+        "minLength": 1,
+        "type": "string"
+      },
+      "relationship": {
+        "enum": [
+          "delegated_authority",
+          "advisory",
+          "autonomous"
+        ],
+        "type": "string"
+      },
+      "type": {
+        "enum": [
+          "human",
+          "organization",
+          "agent",
+          "unspecified"
+        ],
+        "type": "string"
+      }
+    },
+    "required": [
+      "type",
+      "relationship"
+    ],
+    "type": "object"
+  },
+  "values": {
+    "properties": {
+      "conflicts_with": {
+        "items": {
+          "type": "string"
+        },
+        "type": "array"
+      },
+      "declared": {
+        "description": "Ordered list of declared values. Phase 1 cards-as-primitive: each entry is either a catalog-v1 ID string (e.g. `'accuracy'`) or a parameterized map carrying optional `intensity` / `domain` / `severity_on_violation` / `scope` (e.g. `{id: 'accuracy', domain: 'financial', severity_on_violation: 'critical'}`).",
+        "items": {
+          "oneOf": [
+            {
+              "minLength": 1,
+              "type": "string"
+            },
+            {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "properties": {
+                "id": {
+                  "minLength": 1,
+                  "type": "string"
+                }
+              },
+              "required": [
+                "id"
+              ],
+              "type": "object"
+            }
+          ]
+        },
+        "minItems": 1,
+        "type": "array"
+      },
+      "definitions": {
+        "additionalProperties": {
+          "properties": {
+            "description": {
+              "type": "string"
+            },
+            "priority": {
+              "type": "integer"
+            }
+          },
+          "type": "object"
+        },
+        "type": "object"
+      },
+      "hierarchy": {
+        "enum": [
+          "lexicographic",
+          "weighted",
+          "contextual"
+        ],
+        "type": "string"
+      }
+    },
+    "required": [
+      "declared"
+    ],
+    "type": "object"
+  },
+  "version": {
+    "description": "Response-only: monotonic card version, injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
+    "type": "integer"
+  }
+}

addedInput schema / properties / body / required

Added value: +[
+  "card_version",
+  "agent_id",
+  "autonomy_mode",
+  "integrity_mode",
+  "principal",
+  "values",
+  "autonomy",
+  "audit"
+]

Changedput_alignment_by_agent4 fields changed

removedInput schema / properties / body / additionalProperties
```
Removed value: -true
```

addedInput schema / properties / body / description

Added value: +"Unified alignment card (ADR-008/ADR-039). Authored in YAML or JSON; composed server-side with platform defaults, org template, and active exemptions before storage. This schema matches the runtime validator at src/composition/validate.ts EXACTLY — a card authored strictly to it passes `PUT /v1/agents/{id}/alignment-card` and the preview-compose endpoint. Output-only fields (card_id, issued_at, expires_at, _composition, content_hash, version) are server-assigned and must NOT be sent on a PUT."

addedInput schema / properties / body / properties

Added value: +{
+  "_composition": {
+    "$ref": "#/$defs/CompositionMetadata"
+  },
+  "agent_id": {
+    "description": "Target agent id. On PUT, server overwrites to match the URL path.",
+    "type": "string"
+  },
+  "audit": {
+    "allOf": [
+      {
+        "if": {
+          "properties": {
+            "queryable": {
+              "const": true
+            }
+          },
+          "required": [
+            "queryable"
+          ]
+        },
+        "then": {
+          "required": [
+            "query_endpoint"
+          ]
+        }
+      }
+    ],
+    "properties": {
+      "query_endpoint": {
+        "description": "Required when audit.queryable is true.",
+        "type": "string"
+      },
+      "queryable": {
+        "type": "boolean"
+      },
+      "retention_days": {
+        "minimum": 0,
+        "type": "integer"
+      },
+      "storage": {
+        "properties": {
+          "location": {
+            "type": "string"
+          },
+          "type": {
+            "enum": [
+              "local",
+              "remote",
+              "distributed"
+            ],
+            "type": "string"
+          }
+        },
+        "type": "object"
+      },
+      "tamper_evidence": {
+        "enum": [
+          "append_only",
+          "signed",
+          "merkle",
+          null
+        ],
+        "type": [
+          "string",
+          "null"
+        ]
+      },
+      "trace_format": {
+        "type": "string"
+      }
+    },
+    "required": [
+      "retention_days",
+      "queryable"
+    ],
+    "type": "object"
+  },
+  "autonomy": {
+    "properties": {
+      "bounded_actions": {
+        "items": {
+          "type": "string"
+        },
+        "minItems": 1,
+        "type": "array"
+      },
+      "escalation_triggers": {
+        "items": {
+          "properties": {
+            "action": {
+              "enum": [
+                "escalate",
+                "deny",
+                "log"
+              ],
+              "type": "string"
+            },
+            "condition": {
+              "type": "string"
+            },
+            "reason": {
+              "type": "string"
+            }
+          },
+          "required": [
+            "condition",
+            "action",
+            "reason"
+          ],
+          "type": "object"
+        },
+        "type": "array"
+      },
+      "forbidden_actions": {
+        "items": {
+          "type": "string"
+        },
+        "type": "array"
+      },
+      "max_autonomous_value": {
+        "properties": {
+          "amount": {
+            "type": "number"
+          },
+          "currency": {
+            "type": "string"
+          }
+        },
+        "type": "object"
+      }
+    },
+    "required": [
+      "bounded_actions"
+    ],
+    "type": "object"
+  },
+  "autonomy_mode": {
+    "description": "ADR-039 master switch for the action-policing pipeline (autonomy constraints). Required at the top level post-cutover; the legacy `enforcement.mode` location is rejected.",
+    "enum": [
+      "off",
+      "observe",
+      "nudge",
+      "enforce"
+    ],
+    "type": "string"
+  },
+  "capabilities": {
+    "additionalProperties": {
+      "properties": {
+        "description": {
+          "type": "string"
+        },
+        "required_actions": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "tools": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        }
+      },
+      "type": "object"
+    },
+    "type": "object"
+  },
+  "card_id": {
+    "description": "Card row id. Server-assigned on PUT (`ac-{uuid}`).",
+    "type": "string"
+  },
+  "card_version": {
+    "description": "Card schema version (required, non-empty). Current canonical value: `unified/2026-04-26`.",
+    "minLength": 1,
+    "type": "string"
+  },
+  "conscience": {
+    "properties": {
+      "mode": {
+        "enum": [
+          "augment",
+          "replace"
+        ],
+        "type": "string"
+      },
+      "values": {
+        "items": {
+          "properties": {
+            "content": {
+              "type": "string"
+            },
+            "id": {
+              "type": "string"
+            },
+            "severity": {
+              "enum": [
+                "advisory",
+                "mandatory"
+              ],
+              "type": "string"
+            },
+            "type": {
+              "enum": [
+                "BOUNDARY",
+                "FEAR",
+                "COMMITMENT",
+                "BELIEF",
+                "HOPE"
+              ],
+              "type": "string"
+            }
+          },
+          "required": [
+            "type",
+            "content"
+          ],
+          "type": "object"
+        },
+        "type": "array"
+      }
+    },
+    "required": [
+      "mode",
+      "values"
+    ],
+    "type": "object"
+  },
+  "content_hash": {
+    "description": "Response-only: content hash of the composed card (`sha256:<hex>`), injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
+    "type": "string"
+  },
+  "enforcement": {
+    "description": "Optional ADR-039 Decision-3 user-facing knobs for unmapped-tool handling. The legacy `mode`, `unmapped_tool_action` and `fail_open` keys are REJECTED by the validator (mode → top-level autonomy_mode; fail_open → gateway env config).",
+    "properties": {
+      "allow_unmapped_tools": {
+        "description": "When true, tools not mapped to a capability are allowed by default.",
+        "type": "boolean"
+      },
+      "default_unmapped_severity": {
+        "description": "Severity assigned to an unmapped tool when allow_unmapped_tools is false.",
+        "enum": [
+          "low",
+          "medium",
+          "high",
+          "critical"
+        ],
+        "type": "string"
+      },
+      "forbidden_tools": {
+        "items": {
+          "properties": {
+            "pattern": {
+              "type": "string"
+            },
+            "reason": {
+              "type": "string"
+            },
+            "severity": {
+              "enum": [
+                "critical",
+                "high",
+                "medium",
+                "low"
+              ],
+              "type": "string"
+            }
+          },
+          "required": [
+            "pattern",
+            "reason",
+            "severity"
+          ],
+          "type": "object"
+        },
+        "type": "array"
+      },
+      "grace_period_hours": {
+        "type": "integer"
+      }
+    },
+    "type": "object"
+  },
+  "expires_at": {
+    "format": "date-time",
+    "type": [
+      "string",
+      "null"
+    ]
+  },
+  "extensions": {
+    "additionalProperties": true,
+    "type": "object"
+  },
+  "integrity_mode": {
+    "description": "ADR-039 master switch for the values/conscience pipeline (integrity constraints). Required at the top level post-cutover; the legacy `integrity.enforcement_mode` location is rejected.",
+    "enum": [
+      "off",
+      "observe",
+      "nudge",
+      "enforce"
+    ],
+    "type": "string"
+  },
+  "issued_at": {
+    "format": "date-time",
+    "type": "string"
+  },
+  "principal": {
+    "allOf": [
+      {
+        "if": {
+          "properties": {
+            "type": {
+              "not": {
+                "const": "unspecified"
+              }
+            }
+          }
+        },
+        "then": {
+          "required": [
+            "identifier"
+          ]
+        }
+      }
+    ],
+    "description": "Required object describing whose authority the agent acts under (ADR-039 Decision 10).",
+    "properties": {
+      "escalation_contact": {
+        "type": "string"
+      },
+      "identifier": {
+        "description": "Required (non-empty) when principal.type is not `unspecified`; identifies the human / organization / agent.",
+        "minLength": 1,
+        "type": "string"
+      },
+      "relationship": {
+        "enum": [
+          "delegated_authority",
+          "advisory",
+          "autonomous"
+        ],
+        "type": "string"
+      },
+      "type": {
+        "enum": [
+          "human",
+          "organization",
+          "agent",
+          "unspecified"
+        ],
+        "type": "string"
+      }
+    },
+    "required": [
+      "type",
+      "relationship"
+    ],
+    "type": "object"
+  },
+  "values": {
+    "properties": {
+      "conflicts_with": {
+        "items": {
+          "type": "string"
+        },
+        "type": "array"
+      },
+      "declared": {
+        "description": "Ordered list of declared values. Phase 1 cards-as-primitive: each entry is either a catalog-v1 ID string (e.g. `'accuracy'`) or a parameterized map carrying optional `intensity` / `domain` / `severity_on_violation` / `scope` (e.g. `{id: 'accuracy', domain: 'financial', severity_on_violation: 'critical'}`).",
+        "items": {
+          "oneOf": [
+            {
+              "minLength": 1,
+              "type": "string"
+            },
+            {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "properties": {
+                "id": {
+                  "minLength": 1,
+                  "type": "string"
+                }
+              },
+              "required": [
+                "id"
+              ],
+              "type": "object"
+            }
+          ]
+        },
+        "minItems": 1,
+        "type": "array"
+      },
+      "definitions": {
+        "additionalProperties": {
+          "properties": {
+            "description": {
+              "type": "string"
+            },
+            "priority": {
+              "type": "integer"
+            }
+          },
+          "type": "object"
+        },
+        "type": "object"
+      },
+      "hierarchy": {
+        "enum": [
+          "lexicographic",
+          "weighted",
+          "contextual"
+        ],
+        "type": "string"
+      }
+    },
+    "required": [
+      "declared"
+    ],
+    "type": "object"
+  },
+  "version": {
+    "description": "Response-only: monotonic card version, injected by the GET/PUT response. Server-assigned — do not send on a PUT.",
+    "type": "integer"
+  }
+}

addedInput schema / properties / body / required

Added value: +[
+  "card_version",
+  "agent_id",
+  "autonomy_mode",
+  "integrity_mode",
+  "principal",
+  "values",
+  "autonomy",
+  "audit"
+]

Changedverify_scan3 fields changed

changedInput schema / properties / scan / description

Previous value: -"A scan scorecard previously returned by scan_trust (or iitr's /r/ JSON) to verify."New value: +"A scan scorecard previously returned by scan_trust (or iitr's /r/ JSON), passed back verbatim to verify. Same shape as scan_trust's result; the signature is checked against mnemom://iitr/jwks."

addedInput schema / properties / scan / properties

Added value: +{
+  "access": {
+    "additionalProperties": true,
+    "description": "The independent Access/discoverability axis (never blended with Trust). Present from the two-axis rubric (0.3.0+).",
+    "properties": {
+      "applicable": {
+        "description": "False when the site declares Access N/A.",
+        "type": "boolean"
+      },
+      "axis": {
+        "description": "Always \"access\".",
+        "type": "string"
+      },
+      "categories": {
+        "items": {
+          "additionalProperties": true,
+          "type": "object"
+        },
+        "type": "array"
+      },
+      "grade": {
+        "type": "string"
+      },
+      "score": {
+        "type": "number"
+      },
+      "version": {
+        "type": "string"
+      }
+    },
+    "type": "object"
+  },
+  "cached": {
+    "description": "True when served from the scanner's 24h cache rather than a fresh scan.",
+    "type": "boolean"
+  },
+  "categories": {
+    "description": "Trust-axis categories with per-category scores + checks.",
+    "items": {
+      "additionalProperties": true,
+      "type": "object"
+    },
+    "type": "array"
+  },
+  "grade": {
+    "description": "Trust letter grade (A+…F).",
+    "type": "string"
+  },
+  "permalink": {
+    "description": "Shareable /r/ permalink (only on /r/ responses; transport field).",
+    "format": "uri",
+    "type": "string"
+  },
+  "rubricVersion": {
+    "description": "Rubric version (e.g. \"0.4.0\").",
+    "type": "string"
+  },
+  "scannedAt": {
+    "description": "When this scorecard was produced. Results are cached up to 24h — pass fresh:true to scan_trust to force a re-scan.",
+    "format": "date-time",
+    "type": "string"
+  },
+  "schema": {
+    "description": "iitr-scan schema version string (e.g. \"iitr-scan/v0.N\").",
+    "type": "string"
+  },
+  "score": {
+    "description": "0–100 weighted overall TRUST score.",
+    "type": "number"
+  },
+  "signature": {
+    "additionalProperties": true,
+    "description": "Ed25519 signature over the canonical result (transport field; stripped before verify).",
+    "properties": {
+      "alg": {
+        "description": "Always \"Ed25519\".",
+        "type": "string"
+      },
+      "publicKeyId": {
+        "description": "16-hex key fingerprint, e.g. 94502b2b7235c986.",
+        "type": "string"
+      },
+      "signedAt": {
+        "format": "date-time",
+        "type": "string"
+      },
+      "value": {
+        "description": "base64 signature.",
+        "type": "string"
+      }
+    },
+    "type": "object"
+  },
+  "target": {
+    "description": "Normalized host that was scanned.",
+    "type": "string"
+  },
+  "verification": {
+    "additionalProperties": true,
+    "description": "Self-describing in-band verification block {alg, kid, jwks, canonicalization} — how to verify this scorecard's signature. Self-describing, so signed-EXCLUDED (stripped before verify).",
+    "type": "object"
+  }
+}

addedInput schema / properties / scan / required

Added value: +[
+  "schema",
+  "target",
+  "score",
+  "grade",
+  "signature"
+]

15 tool updatesJun 12, 2026
- First observedclaim_agent
- First observedget_agent
- First observedget_reputation
- First observedget_reputation_badge
- First observedget_risk_history
- First observedget_started
- First observedlist_agents
- First observedpreview_compose_alignment_by_agent
- First observedput_alignment_by_agent
- First observedreport_recipe_fn_fp
- First observedscan_trust
- First observedsearch_reputation_directory
- First observedverify_agent_binding
- First observedverify_reputation
- First observedverify_scan

Frequently Asked Questions

Claiming proves that you control a remote MCP connector. It does not move, proxy, or interrupt the server.

Open the connector listing, choose Claim ownership, and sign in to Glama.
Complete one verification method:
- GitHub identity — fastest for official registry listings. For a namespace such as io.github.alice/server, link the matching GitHub user, then choose Claim with GitHub. An organization namespace such as io.github.acme/server also needs that organization to have installed the Glama AI GitHub App and approved its permissions, because GitHub discloses organization membership only to apps it has installed. Use HTTP or DNS when it has not.
- HTTP challenge — works when you can deploy a public file. Generate a token, publish the exact JSON Glama shows at /.well-known/glama.json on the same origin as the connector, then choose Check HTTP challenge.
- DNS challenge — works when you control DNS but cannot change the server. Generate a token, create the exact TXT record Glama shows, wait for it to propagate, then choose Check DNS challenge.
After verification, Glama sends a confirmation email and gives you access to listing details, thumbnails, health checks, and analytics. Keep the HTTP file or DNS record in place: Glama periodically checks it and ownership remains verified while the token is discoverable.

The HTTP ownership file has this structure:

{
  "$schema": "https://glama.ai/mcp/schemas/connector.json",
  "claim": "glama_claim_..."
}

Claim tokens are opaque, stable, and bound to the signed-in Glama account. They contain no email address or other personal information. If Glama can no longer discover a verified HTTP or DNS token, it starts a seven-day grace period before removing claim-based access. Restore the same token during that period to keep ownership verified. Never publish an email address, Glama session token, GitHub token, or connector credential as ownership proof.

If verification fails, confirm that you copied the current token exactly. The HTTP file must be public, return valid JSON with a successful HTTP response, and stay on the connector's origin. DNS changes may need more time to propagate. A claim cannot transfer to a different origin or hostname: if the connector target changes, Glama starts the grace period and the new target must be claimed separately after the previous claim is released.

For a connector linked to the official MCP Registry, registry updates continue to replace its name, description, and URL by default. After claiming, open Manage connector and enable Use Glama listing details as the source of truth if edits made on Glama should be preserved. Categories and thumbnails are always managed on Glama; registry linkage and technical connection settings continue to sync.

Discussions

No comments yet. Be the first to start the discussion!

Related MCP Connectors

Joy Trust Network B
io.github.tlkc888-Jenkins
Trust infrastructure for AI agents. Portable reputation (JTS 0-5), agent discovery, vouching.
Autonomous Agents Security
312
Agent^Rider C
io.github.ceedot-rock
Signed agent identity, trust scoring, credit economy, and social layer for AI agents.
Security Agent Orchestration
6321
MINT Protocol — Universal Work Attestation A
io.github.FoundryNet
Trust stack for AI agents: identity, attest, verify, rate, recommend, discover — on Solana.
Blockchain Web3 & Decentralized Tech Autonomous Agents
22
BLOCKTRUST TrustScan
io.github.brnbtech770
Trust verification for AI agents: identities, domains, phishing, contacts, Trust Circle, Vault.
Security Web3 & Decentralized Tech
2

Related MCP Servers

maiat-protocol
Blockchain Agent Orchestration Finance
JhiNResH
A
license
A
quality
D
maintenance
Trust infrastructure for the agent economy.
Updated 2 months ago (2026-06-27 02:17 UTC)
10
3
MIT
Agent Reputation MCP Server
AiAgentKarl
A
license
Not graded
quality
D
maintenance
Trust and reputation system for AI agents, enabling tracking, verifying, and building trust through scores, interactions, ratings, and reports.
Updated 5 months ago (2026-04-03 16:05 UTC)
MIT
TrustMesh MCP Server
Autonomous Agents Security AI & Machine Learning
Clioloop
A
license
Not graded
quality
Not graded
maintenance
Provides AI agents with trust scoring and reputation management capabilities for secure interactions. Enables agents to check trust scores, rate interactions, and manage disputes before transacting with other agents.
Updated 5 months ago (2026-04-19 00:57 UTC)
-
Agent Guild
AgentTanuki
A
license
Not graded
quality
B
maintenance
The trust and settlement layer for AI agents: discover the safest agent for a job, vet a counterparty before delegating, pay safely via escrow, and carry portable Guild-signed reputation. Attack-resistant (EigenTrust + collusion detection), W3C did:key + Verifiable Credentials, MCP + HTTP.
Updated 5 days ago (2026-08-31 21:44 UTC)
1
Apache 2.0

Try in Browser

RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A4.1/5.0

Disambiguation5/5

Each tool targets a distinct operation: identity claiming, lookup, reputation retrieval/badge, scanning, verification, alignment/protection management, and feedback. No significant overlap exists.

Naming Consistency5/5

All tools follow a consistent verb_noun pattern using snake_case (e.g., claim_agent, get_reputation, verify_scan). Even complex names like preview_compose_alignment_by_agent adhere to the pattern.

Tool Count4/5

With 16 tools, the set is slightly heavy but still well-scoped for the domain of AI agent trust ratings. Each tool serves a clear purpose, and no tool feels redundant.

Completeness4/5

The surface covers core workflows: agent identity, reputation, alignment/protection, scanning, verification, and feedback. Minor gaps like agent updates or deletion might exist, but the core lifecycle is complete.

Server Details

Available Tools

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Tool Schema Changelog

Frequently Asked Questions

Discussions

Related MCP Connectors

Related MCP Servers

Glama MCP Gateway

Resources